Owner review: this adds in-memory state to Registry (a per-DID record of a detached handle and whether it verified). It is not persisted; a restart checks each handle again.
An account's claimed handle is shown only when the account holds it. A handle that is the account's own did:web hostname is taken as it is, because serving the DID document proves control of that name. Any other claimed handle, such as one from a didbot handle pool, is checked with handle::verify in both directions, once per claim and again after an #identity event. If it fails, the handle is dropped with a warning and the account is shown by its DID. did:web:evil.example claiming kestrel.agents.example no longer draws under that name or answers /agents/kestrel.agents.example.
The lib.rs and handle.rs docs now say what is checked, and the two plan items that said nothing checks a handle are closed. Fixes 3mwixcswbj325 (https://tangled.org/permadeath.com/vibescrobble.com/issues).
🤖 Generated with Claude Code