The handle, at its best.

Weissflog’s 2018 treatment states the modern form cleanly: move memory management into centralized systems, “the systems being the sole owner of their memory allocations”; group same-typed items into arrays whose base pointers are system-private; and let only index-handles cross to the outside world, with the handle’s spare bits carrying a generation pattern — a per-slot counter after the November 2018 update — so a stale handle is usually caught when the slot is reused.

Weissflog 2018   "the systems being the sole owner of their memory allocations"
                 the generation check "isn't waterproof" -- detection, not prevention
West 2007        at five percent CPU cost, "we allowed the components to store
                 pointers to one another" -- the traveling pointer, under frame-rate duress

Read with Part I’s eyes, the discipline is clause one (systems own their state) and clause two (only identities cross) discovered independently — enforced by convention inside a single address space. The third clause has no ECS form at all; its absence is the next dive’s subject.

Even the pattern’s founding document records the pressure on clause two. West’s 2007 component article reports that when manager-mediated access cost five percent of CPU, “we allowed the components to store pointers to one another” — the traveling pointer, admitted under frame-rate duress, inside the very article that taught the industry components.

The admission is the load-bearing detail. Convention holds until the frame budget objects; nothing in the address space refuses the crossing. A law enforced by agreement bends exactly where the BCS substrate’s gates do not — the refusals of the PASS 6/6 transcript are the same clauses with the enforcement moved from review into the platform.

The model below steps one slot through a fixed event sequence and runs the generation check as a pure function — handle admitted when its generation equals the slot’s. The model gives the slot two generation bits, so its counter wraps after four values; real engines carry more bits, and the same wrap. Detection works at step 4 and fails at step 5 — “isn’t waterproof”, collision detection over a reused slot, probabilistic by construction.

The chapter’s diagnosis lands in the next dive: detection of reuse is the wrong ambition once the minting law makes reuse unrepresentable. A name that is never reissued has no ABA case to catch.