A mint is P2P-only, so the genesis carries alsoKnownAs: [] and services: {}. A DID could be minted, published to the global directory, and still resolve for nobody, and the settings card called that "Published" and stopped. /did/carry now does both halves in one act: ask a membrane to carry the identity, and put the handle and endpoint it grants on-chain. The membrane owns the namespace under its domain, so it grants the handle rather than the peer choosing one — it is the only thing that can answer <handle>/.well-known/atproto-did. ⚠ Reversible half first. The bridge can drop a DID; the PLC append cannot be undone. A refusal therefore never leaves something permanent behind it. ⚠ One passphrase prompt. The update is signed by the ROTATION key, derived from the sealed recovery root — the signing key this node boots with deliberately cannot do it, which is the same split that makes losing a device survivable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>