Keep the record. Make the keeper replaceable.

The Internet was built on a simple engineering discipline: rough consensus and running code. Standards earned their authority because they worked on real networks, not because a committee declared them. The registries borrowed their legitimacy from that tradition and then turned it around, using policy to overrule networks that were already running.

I call the repair running-code primacy. Every registry rule should face one question: what breaks in the running Internet if this is not decided centrally? If the answer is uniqueness, interoperability, accurate records, security or continuity, the rule may belong in the shared layer. If nothing breaks, the rule is not coordination. It is power, and it belongs somewhere else.

In Note 64 I set out three design rules for any shared record of this kind. Minimum initial specification: write down only what every participant must share, in a form each can verify. Localized future decision: let each operator decide later changes for itself. Voluntary adoption: a new rule becomes real when networks choose to run it, and choosing not to is not a violation.

Applied to the registries, the shared layer keeps only what running networks require. Leasing, customers’ locations, pricing, financing and business models go back to the operator, to contracts and markets and, where force is needed, to public law and the courts. The numbers inside an IP address work everywhere because nobody licenses them; the record that keeps them unique should be just as unremarkable.

A land registry records who owns a field without asking whether the new owner’s plans are wise. A registry of Internet numbers should work the same way. It should verify that a transfer is genuine, that the numbers are not registered twice and that the record is right, and then record it within fixed deadlines: in my draft for AFRINIC, ten business days for an ordinary transfer and twenty between registries. It should refuse only for listed defects, with written reasons, evidence and a right of appeal.

Taking addresses away should be just as limited: a court order or independent decision, proven fraud, a duplicate that cannot be resolved, written abandonment, a short and reviewed security emergency, or non-payment after notice. The security records that protect routing must stay neutral, never a lever over members. When holders disagree, the record should show the dispute and hold the last verified state while an independent forum decides. A registry should never be recordkeeper, claimant, judge and executioner at once.

Accountability starts with the ability to leave. You can change mobile provider and keep your number, and your provider behaves accordingly. A network should be able to move the registration of its addresses, with the record, the proof of control and the security information, to a qualified successor, without renumbering and without asking permission from the registry it is leaving.

This is not about a company changing its membership from one registry to another. It is about the resource: a particular block of addresses must not stay trapped inside one institution’s failure, capture or dispute.

Continuity has to be designed, not assumed. The registry’s state should be versioned, independently audited and copied beyond the control of any single organisation. Directory services need tested failover, and the security system needs a planned succession of keys and repositories, because a static backup is not enough. The registries’ own contingency discussions already accept that another operator can take over the service. They have not yet accepted that the choice cannot rest with the same club.

Today a network has to take the registry’s word for what its record says. The end state I argue for is different: the state of the record is shared and verifiable, so that any network can check for itself who holds which numbers, and no single institution is the source of validity. A distributed ledger is one way to build it. What matters is independent verification and portability, not a particular technology, token or currency.

It does not have to arrive by rupture. The path runs in stages: make the system visible, protect the continuity of running networks, coordinate the holders at risk, and only then move to a thinner architecture. During the transition the existing registries can go on maintaining records and publishing services, once they no longer judge commerce. AFRINIC itself may continue, as a narrow, accountable and replaceable operator.

The engineering is real work: authentication, conflicting histories, compromised keys and secure succession all have to be solved. I would rather name those problems than pretend they are not there.

New managers. A better board can improve a registry for a while, but the next board inherits the same veto. The aim is not a kinder sovereign. It is to end the claim to sovereignty.

Governments. States can and should enforce their own laws through their own courts, and that is where coercive decisions belong. Handing the numbering system itself to governments would invite censorship, fragmentation and political pressure on routing, and nearly two hundred states will never agree on a single register.

A bigger global body. Giving ICANN, the registries’ coordinating body or a United Nations forum more authority would build a larger version of the same gate. A permanent forum is still a forum.

More liability alone. Making registries pay for the harm they cause would put a price on it, but liability does not buy a right to rule. The better cure is to remove the power that causes the harm.