Observer handles were portable bearer credentials. Store the owning device class and identifier on each observer record, require the bound device in the shared identity resolver, and make register mint records only from verified device proof so the handle becomes only a per-stream selector. The SSE stream now rechecks the bound device on a bounded interval so revocation closes busy streams without waiting for an idle heartbeat.