LeverRef

The identity of a declared lever. A lever is (target, limits, domain, write), so its identity is its own — not that of the element it writes, which may back several levers. Pure data: holding one confers no access to anything.

It names its element as well as itself, and that is not decoration. A ref used to be a bare declared name, and §7.3.1 step 8 required that a ref from one element cannot narrow another. Nothing enforced it: two elements declaring the same alias — which is exactly what two instances of one subsystem produce (§4.1.9) — let one element's reference silently narrow the other's lever, and the call did something other than what it appeared to say. D.15 found this shape once already: a reference that identifies less than it looks like it does.

Identity is by name rather than by object, for the reason §4.2.2 gives — names come from the model and the descriptor is keyed on them — and element names are unique within a model (Model.addToModelElementMap), so the pair is a key. Across two models it deliberately is not: a ref reads "lever staff of element Review", which is what B.12's late binding would want to resolve against a freshly built model.