When a device is lost or a key is replaced:

1. Generate new keys.
2. Update policies if needed.
3. Recompute the state:

state_commitment' = H(
  identity_root,
  new_control_key,
  recovery_key,
  attributes_root,
  policies_root'
)

1. Publish new state.

Identity stays the same (root stays constant).

Only the state changes.