The one controlled path from a pseudonym back to a subject id: authenticated, purpose-bound, audited, with optional four-eyes approval. A library with no transport; never reachable from an MCP tool.