Once a warehouse receipt is on chain, the real difficulty is who may see what and who may act on it. A single receipt is watched by buyers, banks and supervisors at once, yet their permissions should not be identical. Untangling that relationship is what lets a receipt function as a financing instrument.

The design splits into two tiers. The visible tier goes to buyers: they can see whether the cargo is in storage, whether inspection passed, the title number and its batch, but this tier carries no disposal right - no pickup, no state change. The disposable tier stays with the supervisory and pledge banks: they can confirm an intact title chain, a clean pledge status and satisfied release conditions, yet still do not touch the physical good. The cargo sits in the warehouse; only its on-chain state is locked.

The pivot is the state machine. A receipt moving from in storage to in transit to delivered must clear a check at every jump: if the pledge is unresolved or the state is unclear, it stalls at the node, the bank releases no funds and the buyer lifts no cargo. SHA-256 hashes each state change on chain, so who touched what and when is recorded and traceable afterward.

The most direct payoff of this tiering is blocking double-pledge. Paper receipts once enabled multiple pledges through forgery; now the disposal right is locked inside a single on-chain state, and a second pledge bank sees the existing encumbrance on a status query and simply cannot open a new line. Buyers see goods, banks see rights, supervisors see the chain - each party's view sits in its own lane, and title transfer can actually move.