ARIN and the economics of transition architecture beyond RIRs

Summary

• Transition architecture is not an argument for abolishing ARIN; it is a design exercise for separating the continuity of registry functions from the discretionary permanence of any one operator.
• ARIN is the right mature case because its records support a high-value IPv4 transfer market, legacy-resource administration, public directory reliance, RPKI, reverse DNS, court evidence, cloud onboarding and small-operator continuity.
• The minimum invariant is uniqueness: no architecture beyond regional registries can be credible unless it preserves a single auditable registration claim for each number resource at every point in the transition.
• The practical architecture would combine escrowed registry state, signed change histories, a neutral continuity operator, holder-authentication portability, constrained emergency powers and tested service succession for RDAP, Whois, reverse DNS and RPKI.
• A serious cutover would be phased, reversible and boring: freeze the last verified state, shadow-publish audit data, maintain existing services, migrate authentication, test security-chain continuity, then move only those functions that can be proved not to break uniqueness.

Transition design is not abolition

The most useful way to discuss a future beyond regional Internet registries is not to begin with abolition. Abolition is an institutional conclusion. Transition architecture is an engineering and economic question. It asks what must continue if the present operator becomes too discretionary, too fragile, too expensive, too conflicted, too legally constrained, or too weak to perform the registry function in a way the market can trust. The answer may be that the present operator continues under tighter constraints. It may be that an emergency operator performs a narrow service while governance is repaired. It may be that some functions move to a more open technical layer while others remain with the incumbent. It may even be that the incumbent remains the best operator for a long time. None of those answers can be evaluated unless the function is first separated from the institution.

ARIN is a useful case precisely because it is not the obvious failure case. It serves a mature region with deep technical capacity, sophisticated resource holders, a long legacy record, a depleted IPv4 free pool, active transfers and strong reliance by courts, banks, cloud providers, security teams and operators. That maturity makes the question harder, not easier. If a transition architecture cannot be described for ARIN without sounding reckless, it is probably not an architecture. If it can be described for ARIN in a way that preserves uniqueness, security, continuity and market reliance, then the same framework can be adapted to weaker or more stressed regions.

The aim is not to replace a known institution with a slogan. The Internet numbering system cannot run on protest. It needs records, validation, authenticated changes, public query services, fee support, dispute handling, reverse-DNS delegation, routing-security publication, legacy-holder continuity and some form of recognized coordination. A transition that breaks these things would not discipline registry power. It would punish the networks that depend on the registry layer being boring.

Yet the opposite mistake is also common. Because the registry function is important, people infer that the incumbent's full discretionary position must be protected. That inference is too large. The fact that uniqueness must continue does not prove that every policy instrument, board theory, fee design, enforcement habit or institutional boundary must remain unchanged. Critical infrastructure usually points in the other direction: the more important a function is, the more recoverable, auditable and substitutable its operator should be.

Transition architecture therefore begins with a distinction. The protected thing is the registration function: the single recognized state of number resources, the evidence trail behind changes, the publication services that make records usable, and the ability of running networks to remain stable while disputes are resolved. The protected thing is not the incumbent's claim to be the only imaginable vessel for that function.

This framing keeps the problem within institutional economics. A registry lowers transaction costs by giving the market a trusted reference point. If that reference point becomes too discretionary, the cost of reliance rises. Buyers demand more warranties. Sellers accept discounts. Banks apply larger haircuts. Cloud platforms ask for more proof. Small operators delay expansion. Courts and regulators face technical uncertainty. A transition architecture is a way to preserve the cost-reducing function when institutional trust is no longer enough by itself.

For ARIN, the question is not whether the region should wake up tomorrow under a different registry. It should not. The question is whether the North American registry function is already designed so that, if such a move ever became necessary, it could happen without improvisation. Mature systems build lifeboats before they need them. They do not sail permanently in the lifeboat, and they do not call the existence of a lifeboat an attack on the ship.

ARIN is the hard case because it works

Transition discussions often begin with distressed institutions because distress makes risk visible. That is understandable but incomplete. A plan built only for collapse tends to be emergency-heavy and market-light. It says how to keep a registry alive when the board fails, the office is paralysed, or the courts intervene. It says less about how a mature, functioning registry can make itself replaceable enough to deserve trust. ARIN belongs in the second category.

The public ARIN region includes the United States, Canada and many Caribbean and North Atlantic jurisdictions. The economic range is broad. Hyperscale cloud platforms, large carriers, universities, public agencies, financial institutions, content networks, hosting providers, security firms, enterprise legacy holders and small access providers all depend on registry records in different ways. Some have legal teams and address-market advisers. Some have one engineer doing routing, customer support and paperwork. A transition architecture must not be designed only for the firms that can afford to navigate complexity.

ARIN's free IPv4 pool has been depleted since September 2015. That fact changes the registry's economic meaning. In an allocation era, the key question was how new supply should be distributed. In a depletion era, the key question is how old and transferred resources remain legible, marketable and operationally secure. Transfers, returned space, waiting-list mechanics, legacy-resource treatment, service agreements, account authority, RPKI, reverse DNS and public directory accuracy matter because they affect the usability of scarce inputs already embedded in networks and businesses.

This is why ARIN is a better test of transition design than a registry that is already visibly broken. The ARIN-region record is not merely a list. It is a settlement reference for transfers, a due-diligence aid for mergers and restructuring, a contact layer for abuse handling, a dependency for reverse DNS, a foundation for routing-security services, and a practical fact in disputes about who can act for a resource holder. The larger the surrounding market, the more expensive a disorderly transition would be.

That expense is the main argument for design before need. If a registry function ever had to be moved under panic, every uncertainty would become a transaction cost. Which record is authoritative? Which authentication credential survives? Which transfer queue is frozen? Which reverse-DNS delegation continues? Which RPKI certificates remain valid? Which court order controls which resource? Which staff can sign which operational act? Which fees fund the service during the transition? Which changes are reversible? Which party is liable for a mistake? Each unanswered question would become a risk premium.

A functioning ARIN can ask those questions without panic. It can identify the minimum service set that must survive any institutional disruption. It can design independent escrow of registry state. It can test publication failover. It can make account authority portable. It can define how emergency authority begins and ends. It can specify which functions are purely clerical, which are market-moving, which are security-sensitive and which are governance-laden. It can do all this while remaining the operator.

That is why transition architecture should not be read as hostility to ARIN. If anything, the mature registry should be the place where the discipline is easiest to develop. Weak institutions fear replaceability because it exposes weakness. Strong institutions can treat replaceability as evidence of strength. A registry that can prove its function could survive its own temporary incapacity gives the market a reason to rely on it today.

The political difficulty is that replaceability changes the psychology of authority. A registry that sees itself as a steward may accept backup. A registry that has begun to see continuity as institutional entitlement may resist it. ARIN's maturity makes this a live test of culture: whether stability is understood as protection of the ledger or protection of the office.

The invariant is uniqueness, not incumbency

The first rule of any transition beyond regional registries is that uniqueness must not break. Every other reform is secondary. No architecture that creates two incompatible registration claims over the same number resource can claim to improve the system. If a transition produces duplicate recognized holders, uncertain chains of authority or a contested public record that counterparties cannot resolve, the cure has failed.

Uniqueness sounds simple: one resource, one recognized registration state. In practice it is a bundle of controls. The system must know which entity is currently recorded as the holder or responsible party. It must know which credentials or legal documents can authorize a change. It must preserve historical changes. It must mark disputes without rewriting unrelated records. It must prevent the same resource from being transferred twice. It must maintain publication services so outsiders can observe the current state. It must keep enough evidence that a court, regulator, auditor, buyer or network operator can understand why the record says what it says.

The incumbent registry is one way to provide this invariant. It is not the invariant itself. Confusing the operator with the invariant is the root of many bad arguments. A city needs water pressure; it does not need a particular manager forever. A payment system needs finality; it does not need every internal committee to be permanent. A numbering system needs uniqueness; it does not need every discretionary feature of the current registry model to be treated as a natural law.

For ARIN, uniqueness has special historical texture. The region contains legacy resources assigned before modern contracts had their present density, transferred resources obtained under contemporary policy, autonomous system numbers used in routing relationships, IPv6 allocations with different scarcity economics, and holders that may have complex corporate histories. The transition problem is not solved by exporting a table of current records. The chain of custody matters because markets ask not only what the record says but whether the record can survive challenge.

That is why the minimum transition architecture begins with a signed, versioned state model. Each authoritative change should be attributable to a prior state, an authorized actor, a basis for authority, a timestamp, a service category and a review trail. The model need not expose confidential details to the public. It does need to allow independent verification that the current state emerged from a controlled sequence rather than from private administrative assertion. The market does not need to read every support ticket. It needs assurance that no invisible rewrite has occurred.

This is also where an open audit layer is more useful than an open political layer. A registry transition does not require every market participant to vote on every change. It requires every relevant participant to know that the state machine is constrained. The public should be able to see commitments, hashes, sequence numbers, dispute markers, emergency-state declarations and service-continuity attestations. Confidential holder documents can remain protected. The proof that the ledger has not been silently altered should not.

Uniqueness also requires a rule for conflict. During transition, some records will be disputed. A company may have changed control. A legacy holder may have stale contacts. A transfer may be pending. A court may have issued an order that affects one resource but not another. The architecture should not resolve every dispute by administrative speed. It should preserve the last verified state, mark the conflict, block incompatible changes and send the dispute to an independent forum or a defined legal channel. That preserves uniqueness without giving the registry operator the power to decide every contested economic question by changing the live record.

The invariant, then, is narrow and demanding. Preserve one authoritative state. Preserve the evidence by which it is known. Publish enough proof that outsiders can rely on it. Allow legitimate updates. Prevent double recognition. Isolate disputes. Everything beyond that should justify itself.

Escrow makes continuity an option, not a promise

Registry continuity is often described in reassuring language: services are redundant, staff are competent, procedures exist, and the institution understands its responsibility. Reassurance is not enough for a transition architecture. Escrow is the mechanism that turns continuity from a promise into an option. If the authoritative state, authentication material, publication configuration and service dependencies remain under the exclusive practical control of one institution, then every emergency plan eventually becomes a request for that institution's cooperation.

Escrow must be broader than a backup file. A static copy of a database may help disaster recovery, but a registry transition needs operational escrow. It needs the current registry state, prior states, signed change logs, contact and authority metadata, transfer queue status, dispute markers, reverse-DNS delegation data, RDAP and Whois publication material, RPKI repository and certificate-state information, service configuration, relevant cryptographic material under controlled custody, and instructions sufficient for a qualified continuity operator to run the minimum service set.

The distinction between data escrow and functional escrow matters. Data escrow answers the question: can the record be reconstructed? Functional escrow answers a harder question: can the record be served, authenticated, updated and secured under emergency authority without granting the emergency operator open-ended power? A mature registry should be able to answer both.

For ARIN, escrow would have to respect confidentiality and legal obligations. Holder documents, identity-verification files, account credentials, support correspondence and transaction details cannot simply be published. But confidentiality is not an argument against escrow. It is an argument for layered custody. Public commitments can prove that a state exists and has not been altered. Independent custodians can hold encrypted materials. Access can require multi-party authorization. Courts can compel disclosure under defined circumstances. Auditors can review controls without exposing every document to the market.

The economics are straightforward. If escrow is credible, the market prices less institutional tail risk. A buyer of IPv4 space knows that if the registry is disrupted, a last verified state and transfer evidence can be reconstructed. A bank financing an address-dependent business knows that recognized records are not hostage to one office. A cloud provider relying on bring-your-own-address arrangements knows that account authority and routing-security services can be maintained during institutional stress. A small operator knows that its continuity does not depend entirely on its ability to navigate an emergency bureaucracy.

Escrow also disciplines the incumbent. An institution whose records are independently preserved has less ability to use ambiguity as leverage. That does not mean the incumbent loses authority over ordinary operations. It means its authority is bounded by evidence. A registry that acts properly benefits: escrow confirms the quality of its work. A registry that acts opportunistically loses the cover of opacity.

The design challenge is to avoid creating a new unaccountable custodian. Escrow should not move discretionary power from ARIN to a single secretive backup contractor. The custodian's role should be narrow: preserve materials, verify integrity, enable continuity triggers and provide access under predefined authority. The custodian should not decide policy, approve transfers, reinterpret agreements or become a shadow registry. Its legitimacy should come from technical custody and auditable rules, not from a new claim to regional authority.

Escrow should also be continuous. A yearly deposit is too slow for a market in which transfers, account changes, routing-security updates and reverse-DNS changes can matter daily. The appropriate cadence depends on the service, but the principle is clear: the maximum loss of verifiable state should be small enough that operators and counterparties can tolerate it. For some publication services, that may mean near-real-time replication. For deeply confidential files, it may mean frequent encrypted commitments with controlled retrieval.

The key point is not that escrow would make transition easy. It would make transition possible. Without escrow, every discussion of replacing or constraining a failing registry operator is theoretical. With escrow, the question becomes one of governance: who can activate continuity, for which services, under what limits and with what path back to normal operations?

A neutral continuity operator should be powerful only in its boredom

If a registry function must be carried through institutional failure, a continuity operator may be necessary. The term should sound deliberately dull. A continuity operator is not a rival government, a new regional priesthood, a policy parliament, a commercial broker or a permanent successor by stealth. It is an entity capable of performing a minimum service set under narrow authority when the ordinary operator cannot be trusted or cannot function.

The minimum service set should be defined before the operator is chosen. It should include publication of the last verified registry state, RDAP and Whois continuity, reverse-DNS maintenance, RPKI repository and certificate-state continuity, authenticated holder support for urgent low-risk changes, preservation of transfer queues without unauthorized completion, dispute marking, fee collection sufficient to keep services alive, and communication with courts, regulators and resource holders. It should not include broad policy revision, discretionary reallocation, market-making, punitive revocation, institutional lobbying or expansion of the registry's mission.

The operator's virtue is procedural modesty. It keeps the lights on, preserves the ledger, authenticates limited changes and prevents panic. It does not use the emergency to settle ideological questions about number-resource ownership, regional sovereignty, transfer economics or the future of the RIR model. Those questions may matter, but emergency continuity is the wrong venue for them.

Neutrality has several dimensions. First, the operator should not be a market participant with a direct commercial interest in address transfers, leasing, brokerage or a competing registry business. Second, it should not be controlled by the incumbent whose failure triggered the emergency. Third, it should not be controlled solely by peer institutions that share incentives to protect the incumbent class. Fourth, it should be legally capable of receiving and following court or regulator instructions without turning every legal request into a geopolitical dispute. Fifth, it should be technically capable enough that its neutrality is not an excuse for incompetence.

For ARIN, this is a high bar. The region's market sophistication means that any continuity operator would be watched by lawyers, banks, brokers, cloud platforms, small operators, public agencies and network engineers. A mistake could move real value. A delayed service could disrupt customers. A careless RPKI action could create routing consequences. A poorly handled account recovery could invite fraud. The operator must therefore be prequalified, insured, audited, rehearsed and limited.

Emergency authority should also be reversible. The continuity operator should begin from the last verified state and keep a strict record of every act it performs. When normal authority is restored, or when a successor is chosen, its changes should be reviewable and, where appropriate, reversible. This is especially important for market-moving acts. Routine publication continuity may be irreversible only in the sense that time passes. A transfer approval, revocation or full account-authority replacement can change bargaining positions. Those acts need either independent approval or delayed completion unless service continuity would otherwise be harmed.

Funding should not depend on emergency improvisation. A continuity operator that must negotiate payment after activation will face pressure from the parties it serves or constrains. The better structure is a prefunded reserve, insurance-like contributions, or an escrowed service fee mechanism tied to the minimum service set. The amount need not be extravagant. Its purpose is to fund technical continuity, not create a second permanent bureaucracy.

The political temptation will be to make the operator too representative. Committees may want seats. Stakeholders may demand formal voice. Governments may seek assurance. Holders may want protection. Representation matters, but a continuity operator should not become a deliberative assembly. Oversight can sit around it; authority should remain narrow. The operator's job is to keep the registry function from failing while legitimate institutions decide what comes next.

This is why the operator should be powerful only in its boredom. Its mandate should be so limited, its acts so logged, its triggers so defined and its exit so clear that no one would rationally seek control of it for political advantage. If it becomes attractive as a prize, its design has failed.

Open audit layers should prove state without politicising every decision

An open ledger in the number-resource context need not mean that every confidential registry file becomes public or that every holder's commercial information is placed on a public chain. The useful idea is narrower: the authoritative state and its transitions should be independently verifiable. Public confidence should not rest only on the incumbent's assertion that its private database is coherent.

The architecture can separate three layers. The first is the confidential evidence layer: agreements, identity documents, corporate records, support tickets, transfer files, sanctions checks, legal correspondence and security-sensitive account material. The second is the authoritative registry state: holder, resource, status, public contacts where appropriate, reverse-DNS information, routing-security eligibility, dispute markers and service standing. The third is the audit layer: signed commitments, change sequence numbers, state hashes, emergency declarations, custody attestations and public statements about which state is current.

The third layer can be open without exposing the first. It can allow outsiders to know that a record was part of the registry state at a given time, that a change occurred in a defined sequence, that the change was authorized through a recognized pathway, and that no silent fork has been introduced. It can also allow a continuity operator to prove that it began from the last verified state rather than from a convenient reconstruction.

For ARIN's market, this would be valuable even without a crisis. Transfers would have cleaner audit trails. Legacy-holder regularization would be easier to diligence. Banks and buyers could ask for proofs rather than narratives. Courts could compare registry attestations with evidence. Security teams could distinguish a stale public contact from an unverified rewrite. Small operators would be less dependent on informal trust or specialist intermediaries.

The risk is that open audit becomes performative transparency. Publishing large amounts of data can make a system look accountable while making it harder for ordinary users to understand the decisive facts. A good audit layer should answer specific questions. What is the current authoritative state? What was the prior state? When did it change? Under which authority class did it change? Is the resource disputed? Is the publication service operating under normal or emergency authority? Has a continuity trigger been invoked? Which records are frozen? Which services are being shadow-published?

This is also where deterministic validation helps. Some rules can be checked locally. A state transition should not allocate or recognize the same resource twice. A transfer cannot originate from a holder not recognized in the prior state. An emergency declaration should have a start time, scope and authorizing trigger. A dispute marker should preserve the last verified state while blocking incompatible changes. A reverse-DNS update should map to the recognized resource holder or an authorized delegate. The more such rules can be verified mechanically, the less discretionary trust the system requires.

Not every question can be made mechanical. Whether a merger document is valid may require legal judgment. Whether a court order applies to a particular affiliate may require interpretation. Whether a sanctions risk blocks service may depend on law. The audit layer should not pretend to replace judgment. It should make judgment attributable, bounded and reviewable.

An open audit layer also creates a foundation for future decentralization without forcing premature decentralization. The system can begin by publishing proofs around the incumbent registry's state. Over time, holders could receive portable credentials, independent verification tools and locally checkable records. The transition from institutional trust to technical verifiability can be gradual. The goal is not to leap from ARIN's database to a fully distributed world in one movement. It is to reduce the amount of trust that must be placed in any single operator at any one time.

Emergency power must expire by construction

Every transition architecture needs emergency authority. It also needs to distrust emergency authority. The moment a registry function enters crisis, someone must decide which state is frozen, which services continue, who can make urgent changes, how holders authenticate, what courts and regulators receive, and when high-consequence transactions pause. If no one can act, continuity fails. If someone can act without limits, the emergency becomes a new source of discretionary power.

The solution is to make emergency authority reversible, scoped and time-limited from the beginning. A trigger should identify the condition: loss of service, loss of quorum, court-appointed control, insolvency, severe security compromise, verified data-integrity breach, inability to publish key services, or another predefined event. The declaration should state the service scope: publication only, support continuity, security-chain maintenance, transfer freeze, dispute isolation, or full minimum-service operation. It should state who authorized the trigger, what evidence supported it, when it expires and how it can be renewed.

For ARIN, emergency scope would need fine granularity. RDAP publication continuity is different from transfer approval. Reverse-DNS maintenance is different from a fee-policy change. RPKI repository continuity is different from new resource certification for a disputed holder. Account password recovery is different from full replacement of an organization's authority structure. A single emergency label should not give one operator equal discretion over all these acts.

Expiration is not a formality. Institutions under stress often discover that temporary measures are convenient. A continuity operator may find that it has become useful. Peer institutions may prefer not to reopen a hard governance question. Large market participants may adapt to the emergency arrangement and lobby quietly for its extension. Staff may prefer the clarity of the temporary command. Emergency power must therefore have an automatic tendency to end unless evidence justifies renewal.

Renewal should be public, even where the underlying evidence remains confidential. The notice can say that a specific service remains under continuity authority because the ordinary operator has not restored technical capacity, because a court order remains unresolved, because key material remains at risk, or because a security review has not completed. The notice should not need to reveal sensitive credentials or private holder files. It should reveal enough that affected parties know emergency power is not coasting.

Emergency authority should also be non-destructive by default. The last verified state should be preserved. Conflicting changes should be paused. Existing valid publication should continue. Running networks should not be forced to renumber, lose reverse DNS, lose security attestations or lose public contactability merely because the governance layer is contested. If an independent legal decision requires a destructive act, the architecture should record the decision, scope it narrowly and preserve evidence for review.

This matters because number-resource disputes can tempt institutions into self-help. A registry that believes a holder has violated policy may want to revoke. A creditor may want a transfer blocked. A buyer may want closing accelerated. A government may want a resource disabled. A continuity operator should resist becoming the easiest instrument for whichever party can frame its demand as urgent. Its rule should be preservation unless a defined authority requires a specific change.

The test for emergency power is simple. Could the same mechanism be used safely if the party invoking it were not trusted? If the answer is no, the mechanism is too discretionary. Transition architecture should not depend on good people occupying emergency roles. It should make their choices narrow enough that trust is helpful but not fatal.

Holder authentication has to become portable

A registry record is only as useful as the system that decides who can change it. Holder authentication is therefore one of the most important and under-discussed parts of transition architecture. If a resource holder's authority exists only inside one registry's account system, then the holder is not portable. It may possess valuable number resources, public records and operational reliance, yet still be dependent on the incumbent registry to recognize its ability to act.

Portability does not mean that any holder can move anywhere on demand without checks. It means that the proof of holder authority should be capable of surviving a change in registry operator, continuity operator or service model. The holder should not have to renumber, re-prove its entire history from scratch, or obtain discretionary permission from a failing institution merely to maintain legitimate registration services.

For ARIN, portable authentication would need to handle several populations. Contemporary members and customers may have clear account structures, service agreements and verified contacts. Legacy holders may have older records, partial documentation, historical corporate changes or special service arrangements. Transferees may have recent approval files. Public bodies may have statutory authority. Universities may have decentralized internal control. Companies may have mergers, reorganizations, bankruptcies or delegated technical contacts. A single password system cannot carry all this meaning.

The architecture should separate proof of identity, proof of authority and proof of resource relationship. Identity asks who the actor is. Authority asks whether the actor can bind the holder. Resource relationship asks whether the holder is recognized for the resource in question. In ordinary registry operations these may be compressed into an account interface. In transition, compression becomes risk. A portable credential should let a continuity operator or successor verify the same categories without relying on hidden incumbent knowledge.

One possible model is a holder authority package: a signed, periodically refreshed set of assertions that identifies the holder, authorized roles, resource list, agreement or service status, delegated contacts, dispute limitations and emergency-use conditions. Some parts can be public. Some can be encrypted for escrow. Some can require notarized or equivalent legal evidence. Some can be verified through multi-factor technical control. The specific technology matters less than the property: the holder can carry verifiable authority across operational contexts.

Portable authentication also creates accountability for registries. If holders can preserve their authority independent of one account portal, the registry must compete on service quality, accuracy and trust rather than on lock-in. This does not make regional coordination vanish. It gives resource holders a safety valve. In normal times the safety valve may sit unused. Its existence still changes incentives.

The DNS market offers an imperfect analogy. Domain registrants often can transfer between registrars under rules that preserve the domain's continuity. The registry and registrar structure is not the same as Internet number-resource administration, and addresses are not domain names. Still, the economic lesson is relevant: portability can discipline service providers without making the underlying namespace chaotic. The hard part is to design portability around uniqueness, security and legal evidence rather than around consumer convenience alone.

Portable holder authentication would also reduce emergency friction. A continuity operator would not need to rebuild trust holder by holder under pressure. It could use pre-existing signed authority packages, escrowed verification records and defined update rules. Courts and regulators would have clearer evidence. Small operators would be less likely to lose service because one administrative contact has left the company or one registry portal has become unavailable.

The aim is not to let holders escape all obligations. A holder that is under dispute, sanctions constraint, fraud review or court order may face limits. Portability should carry those markers too. A credible architecture moves authority and constraints together. It prevents both registry hostage power and holder opportunism.

RPKI, RDAP and reverse DNS are the dangerous seams

It is tempting to describe registry transition as a database problem. That temptation is dangerous. A number-resource registry is not only a table of holders and resources. It is surrounded by publication and security services that other systems consume. RDAP, Whois, reverse DNS and RPKI are among the seams where a poorly designed transition could create visible operational harm.

RDAP and Whois are public reliance services. They help operators, abuse desks, security researchers, transaction counterparties and others learn who is associated with a resource and how the registry presents that association. They are not perfect records of operational control, and privacy or accuracy limits can matter. Yet they are part of the market's ordinary evidence set. During transition, the public directory should continue from the last verified state, with clear markers for emergency authority, frozen records or disputes. Silence would invite rumor. Inconsistent parallel publication would invite arbitrage.

Reverse DNS has different consequences. It ties number-resource administration to naming infrastructure used for mail reputation, diagnostics, security tooling and operational convention. A transition that mishandles reverse-DNS delegation can create customer-facing friction even if routing continues. The rule should be continuity of existing delegation unless the holder requests a legitimate update, an independent decision requires change, or a security incident demands narrowly scoped action. The continuity operator should have the data and credentials needed to maintain service, not broad discretion to reorder delegations.

RPKI is the most security-sensitive seam. It involves resource certificates, route-origin authorizations, repositories, manifests, revocation material, publication points and relying-party validation. A careless transition could invalidate security assertions, create stale material, break repository availability or confuse relying parties. A static backup is not enough. The architecture needs key-custody rules, emergency signing procedures, certificate-state continuity, repository failover, revocation planning and a migration path that operators can test before crisis.

For ARIN, the sensitivity is amplified by the scale of routing-security adoption among sophisticated networks and the market value of resources. A large address holder may depend on RPKI to support routing policy across providers. A cloud customer may rely on bring-your-own-address arrangements whose security posture includes resource certification. A small ISP may not understand the full chain but may still be affected if upstreams enforce route origin validation. Transition design must protect both expert users and those who only discover the dependency when something breaks.

The safer approach is layered succession. First, the incumbent continues to operate services in normal times while publishing audit commitments and maintaining escrow. Second, a shadow continuity environment periodically proves that RDAP, Whois, reverse DNS and RPKI state can be reconstructed without serving live conflicting data. Third, emergency procedures are rehearsed with non-production resources or controlled test cases. Fourth, activation rules define which service can fail over and whether the failover is read-only, maintenance-only or fully operational. Fifth, the return path is defined so that emergency service does not become a permanent fork.

RPKI deserves a special anti-fork rule. There should not be two live authorities issuing conflicting security material for the same resource under the same trust expectations. If a transition requires moving publication or signing authority, it must be coordinated, logged and visible to relying parties. Ambiguity in the security chain is worse than ordinary administrative delay because automated routing decisions may read the ambiguity faster than humans can explain it.

The broader lesson is that registry power is embedded in services, not only in policy. A transition that preserves the table while breaking the seams would fail the market. A transition that keeps the seams stable while reducing discretion would show that registry continuity and institutional permanence are not the same thing.

Courts and regulators need a legible registry state

Number-resource disputes increasingly touch legal institutions that were not built around routing tables. Courts, receivers, insolvency professionals, regulators, public procurement teams and law-enforcement channels may need to understand who is recognized, what authority the registry had, which services are affected and which acts would harm third parties. Transition architecture should be compatible with that world rather than treating law as an external nuisance.

The first requirement is legibility. A judge or regulator should not have to infer registry state from jargon, institutional reputation or private assurances. The record should state the resource, recognized holder, authority pathway, dispute status, service status, relevant constraints and historical changes in a format that technical and legal readers can both parse. This does not mean reducing the registry to ordinary property language. It means making the operational fact of recognition clear enough that legal orders can be narrow.

Narrowness matters. A court may need to freeze a disputed transfer without affecting unrelated reverse-DNS maintenance. A regulator may need contact evidence without changing holder status. A receiver may need access to account authority for a bankrupt company while preserving RPKI continuity. A sanctions authority may require service limits for a specific entity without contaminating an entire resource range. If the registry state is not decomposed into service categories, legal instructions can become broader than intended.

For ARIN's region, legal compatibility is not optional. The surrounding economy is legally sophisticated. Address holdings can appear in mergers, financing, bankruptcy, tax analysis, public procurement, cloud contracts and commercial disputes. Lawyers may disagree over whether a number resource should be described as property, contractual entitlement, operational claim, license-like interest or something else. The registry cannot settle all of legal theory. It can make its own recognition state and service boundaries precise.

This is another reason to separate the ledger from discretionary enforcement. A registry or continuity operator should be able to tell a court: here is the last verified state, here are the pending requests, here is the service we can preserve, here is what a freeze would affect, here is what would require revocation, here is what would change RPKI, and here is what would leave running networks untouched. That kind of explanation helps courts avoid crude remedies.

Regulators also need assurance that transition does not create a private lawless zone. A move beyond RIR discretion should not mean that resource holders become immune from ordinary law. It should mean that enforcement occurs through legitimate legal and technical channels rather than through opaque registry self-help. If a state has lawful authority over an operator within its jurisdiction, the transition architecture should be able to record and enforce a specific order. It should not allow a foreign or supranational private body to expand that order into a general power over unrelated networks.

The same principle applies to market regulation. Address transfers, leasing and use arrangements may raise fraud, sanctions, tax, consumer-protection or competition concerns. The registry's job is not to become a universal commercial regulator. Its job is to maintain accurate recognition, prevent duplicate claims, authenticate changes, mark disputes and comply with lawful instructions. A transition architecture that makes those functions legible will make it easier for proper authorities to address misconduct without using registry discretion as a substitute for law.

Legal compatibility also protects the registry. Institutions are more likely to face distrust when they cannot explain their acts in ordinary categories. If ARIN or any successor can show controlled state, auditable authority, narrow service effects and preserved evidence, it is less likely to be treated as arbitrary. The law does not need the registry function to be simple. It needs it to be intelligible.

Funding should buy resilience, not a second incumbent

No transition architecture is credible unless it is funded. Escrow, audit, shadow publication, emergency rehearsals, key custody, continuity staffing, insurance, legal readiness and public communication all cost money. Underfunding them would create a decorative plan that fails when needed. Overfunding them could create a new institution with its own appetite for permanence. The funding model therefore has to buy resilience without buying a second incumbent.

The cost base should follow the minimum service set. If the continuity architecture is meant to preserve registry state, public directory services, reverse DNS, RPKI continuity, authenticated urgent changes, dispute markers and evidence custody, then its budget should be tied to those functions. It should not fund broad policy programs, advocacy, conferences, market analysis or institutional expansion. A reserve that pays for continuity is easier to justify than a reserve that quietly grows into a parallel registry bureaucracy.

Several sources are possible. A small resilience surcharge on registry fees could fund escrow and continuity testing. A portion of existing reserves could be earmarked for emergency operation. Transfer-related fees could contribute to audit infrastructure because transfers rely heavily on market confidence. Insurance products could cover specific operational costs. Large holders might fund voluntary enhanced assurance services, provided that such services do not give them privileged registry status. Public grants could support resilience for smaller operators, though state funding would need safeguards against political capture.

For ARIN, the distributional question is important. A flat surcharge may be trivial for large platforms and material for small networks. A resource-size-based surcharge may be easier to justify but could be seen as another tax on legacy holdings. A transfer-linked contribution may align with market reliance but would not cover all continuity needs. A reserve-funded model may avoid new fees but requires confidence that reserves are adequate and properly governed. The right mix should be transparent about who pays and why.

Funding should also be conditional on performance. Escrow deposits should be verified. Shadow systems should be tested. Audits should publish useful summaries. Continuity operators should pass rehearsals. RPKI succession should be measured against actual validation behavior. RDAP and reverse-DNS failover should have evidence, not slideware. If the architecture is funded but not tested, the market will eventually learn to discount it.

The risk of creating a second incumbent can be reduced through procurement and rotation. Custody, audit and continuity roles can be separated. Vendors can be rotated or periodically retendered. No single contractor should hold all keys, all evidence and all operational capability. Oversight should include technical, legal and holder perspectives, but it should not become a large permanent parliament. The architecture should be resilient because its duties are clear, not because its institution is grand.

Liability is part of funding. A continuity operator that can make mistakes needs insurance or indemnity within narrow limits. Auditors need protection against retaliation but not immunity for gross negligence. Custodians need duties enforceable by contract and law. Holders need remedies if emergency acts exceed authority. Without a liability model, the architecture either attracts no competent operator or gives the operator too much protection.

The economic principle is that resilience spending should reduce the total cost of reliance. If the market pays one dollar into transition readiness but saves several dollars in lower diligence, lower dispute risk, lower emergency uncertainty and lower continuity premiums, the spending is justified. If the spending mostly supports institutional theater, it is not. A mature ARIN-region architecture should be able to state that calculation plainly.

Migration governance is a sequence, not a drama

The word transition can invite cinematic thinking: a crisis, a declaration, a replacement and a new order. Real migration should be much less dramatic. The safest transition is one in which most actors notice only that the system has become more auditable and less hostage to one operator. Governance should be sequenced around proof, not spectacle.

The first phase is mapping. The registry function must be decomposed into record state, public directory publication, reverse DNS, RPKI, holder authentication, transfer processing, dispute handling, billing, policy development, legal compliance and member accountability. Each function should be classified by reversibility, market consequence, security sensitivity, confidentiality and need for real-time continuity. This classification prevents vague talk about "the registry" from obscuring the fact that different parts require different transition tools.

The second phase is evidence preservation. Signed state commitments, change logs, escrow deposits, authority packages and service dependencies should be captured while the incumbent is functioning. Waiting until failure is irrational. A failing institution is least able, least trusted and most conflicted at the moment when transition evidence is most valuable.

The third phase is shadow operation. A continuity environment should reconstruct the public record, test RDAP output, model reverse-DNS delegation, mirror RPKI repository state in a safe way, verify holder authority packages and rehearse emergency support without serving conflicting live data. The shadow environment is not a rival registry. It is a proof that the function can be operated if needed.

The fourth phase is limited portability. Holders could be allowed to download or verify authority packages, confirm resource lists, test delegated contacts, and validate that their records can be recognized by a continuity operator. This would reveal stale contacts, corporate-history problems and legacy documentation gaps in normal times rather than in crisis. It would also teach holders that portability is a practical control, not a revolutionary slogan.

The fifth phase is emergency readiness. Triggers, notices, service scopes, renewal rules, fee flows, court interfaces and communication templates should be tested. The registry, custodian, continuity operator and oversight participants should know what happens if activation is required. A tabletop exercise is not enough, but it is better than improvisation. Technical failover tests, legal simulations and holder-support drills all matter.

Only after these phases should live cutover be considered. Even then, cutover may be partial. RDAP publication might fail over while ordinary holder changes remain paused. Reverse-DNS maintenance might be delegated under continuity authority while transfers remain frozen. RPKI repository continuity might be maintained without issuing new certificates except under narrow rules. Holder support might process urgent contact updates but not market-moving transfers. The architecture should allow partial activation because real crises are rarely total.

Governance of migration should include exit criteria. What evidence restores ordinary operation? What defects require extension? What acts remain reviewable after return? What happens to fees collected during emergency service? How are holders notified that authority has returned or moved? How are disputes that arose during transition resolved? Without exit criteria, the migration plan is incomplete.

The more sequenced the migration, the less political it becomes. People fight about grand transitions because the consequences are opaque. They can evaluate phased controls because each phase has a test. Did escrow work? Did the audit commitment match the database? Did RDAP shadow publication reproduce the public record? Did reverse-DNS failover maintain delegation? Did relying parties accept the RPKI succession test? Did holders authenticate successfully? These are answerable questions.

A phased cutover should start with read-only truth

If a live cutover ever became necessary, the safest first move would be read-only truth. The continuity operator or successor should publish the last verified state, with emergency markings, while preventing conflicting writes. This protects uniqueness and gives the market a reference point. It is not enough for a long period, but it is the correct starting point.

Read-only truth has several advantages. It reduces panic because outsiders can still query the record. It prevents opportunistic changes while authority is disputed. It allows courts and regulators to see the baseline. It gives holders time to verify their resource lists and contacts. It permits technical teams to monitor RDAP, Whois, reverse DNS and RPKI continuity separately. It buys time without pretending that every service can continue normally.

The second move is maintenance writes. These are low-risk changes needed to preserve service: correcting broken contacts, maintaining reverse-DNS delegation for an undisputed holder, preserving RPKI publication, updating emergency communication channels, and recording dispute markers. Maintenance writes should be logged more heavily than ordinary writes because they occur under unusual authority. They should be narrow enough that they do not move economic value except to prevent avoidable damage.

The third move is authenticated holder writes. Once portable authority packages or equivalent verification are working, holders should be able to perform ordinary non-disputed updates. The system should distinguish between changes that preserve continuity and changes that transfer control. Updating a technical contact is not the same as replacing the holder. Renewing service is not the same as approving a transfer. A mature interface should encode that difference.

The fourth move is queued market activity. Transfers, mergers, acquisitions, reorganizations and legacy regularizations may need to proceed eventually. But during transition they should be handled with independent review, clear priority rules and explicit dispute checks. The market cannot be frozen indefinitely; scarcity makes liquidity valuable. Yet liquidity under uncertain authority can invite fraud and unequal bargaining. The correct sequence is not "stop the market" or "business as usual"; it is "resume high-consequence activity only when the authority path is proved."

The fifth move is policy restoration or successor governance. Once minimum services and market activity are stable, the broader question can be addressed: should the incumbent resume, should a successor take over, should certain functions remain in open audit layers, should holder portability become permanent, and should regional policy mechanisms be revised? Those are large institutional questions. They should be answered after continuity is protected, not while the record itself is at risk.

For ARIN, a phased cutover would have to be especially careful around legacy resources. A large part of market reliance may concern resources whose historical documentation is uneven or whose relationship to modern agreements differs by holder. The read-only phase should preserve those differences rather than flatten them. The maintenance phase should not use emergency authority to force new contractual choices. The market-activity phase should require enough evidence to prevent fraud without making every legacy holder prove the entire history of the early Internet.

The central metric is whether uniqueness remains unbroken throughout the sequence. At no point should two live systems claim equal authority over the same resource. At no point should a holder be able to exploit the transition to obtain duplicate recognition. At no point should an emergency operator change state without leaving a trail that a later reviewer can understand. If those rules hold, transition becomes an extension of registry discipline rather than a break from it.

ARIN can prove the registry can survive the registry

The mature test for ARIN is whether it can prove a simple proposition: the North American number-registration function can survive temporary incapacity, excessive discretion or replacement of the operator without breaking uniqueness. That proposition does not require ARIN to disappear. It requires ARIN to show that the function is bigger than its current office and more disciplined than its current discretion.

The first practical step is a public minimum-service definition. ARIN could identify the services that must continue under any institutional stress: registry state publication, RDAP and Whois, reverse DNS, RPKI repository continuity, authenticated urgent support, dispute marking, evidence preservation and communication. It could distinguish those from services that can pause: major policy change, high-consequence transfers, contested account replacements, unusual enforcement acts and nonessential programs.

The second step is escrow design. What state is deposited? How often? Under whose custody? With what encryption? Under what triggers? What can be verified publicly? What remains confidential? What court or regulator interface exists? How is the deposit tested? These questions are not revolutionary. They are the ordinary questions of critical-infrastructure resilience.

The third step is holder portability. ARIN could let holders verify authority packages, correct stale records, identify delegated contacts and understand how their authentication would survive emergency operation. This would improve current data quality even if no transition ever occurs. It would also make legacy-resource issues visible before they become urgent.

The fourth step is service succession testing. RDAP and Whois shadow publication can be checked against live output. Reverse-DNS failover can be rehearsed under controlled cases. RPKI succession can be tested with non-production material and documented relying-party behavior. Transfer queues can be modeled for freeze and restart. Account recovery can be simulated. The aim is not to stage a public drama but to prove that the minimum service set is operable.

The fifth step is emergency governance. Triggers, scopes, expirations, renewal notices, independent review and return conditions should be defined. The emergency operator should be prequalified but unattractive as a political prize. Its role should be maintenance, not rule. Its authority should be strongest when preserving the last verified state and weakest when asked to change economic positions.

The sixth step is market communication. Buyers, sellers, banks, cloud platforms, small operators, public bodies and security teams should understand what the architecture does and does not do. It preserves recognition state. It does not guarantee routing by every network. It supports security-chain continuity. It does not eliminate all legal disputes. It preserves holder authority. It does not make fraudulent transfers easier. Clear limits are part of credibility.

If ARIN can do these things, it would not weaken itself. It would demonstrate that a registry can be trusted because it has made itself accountable to the function it serves. The old model asks the market to trust the institution because the institution is recognized. The better model asks the market to trust the institution because recognition is backed by escrow, auditability, portability, emergency limits and tested continuity.

That is the economics of transition architecture beyond RIRs. It is not a call to destroy a working registry. It is a call to remove hostage logic from a critical coordination layer. Preserve uniqueness. Preserve the records. Preserve RDAP, Whois, reverse DNS and RPKI. Preserve running networks and market reliance. Preserve legal intelligibility. But do not confuse those goals with the permanent discretionary power of any one registry operator.

ARIN's maturity gives it the chance to lead by making this distinction ordinary. A registry that can survive the registry is not weaker. It is finally designed like infrastructure.