TIPOwnership
The owner controls the tag; the wallet is only where payments go.
A tag account has two separate pubkeys, and they answer two different questions.
owner answers "who controls this tag": who can change its wallet, and
who can edit its off-chain profile fields. Every write to a tag, on-chain
or off, is gated on a signature or session matching this pubkey.
wallet answers "where do payments to this tag go": it is the address
returned by resolve() and encoded into the tag's payment link and QR
code. It has no authority over the tag at all.
These are independent by design, and commonly differ. Registering a tag
with no wallet specified defaults it to the owner's own pubkey, but the
owner can point it anywhere: a hardware wallet, an exchange deposit
address, a multisig treasury. Changing the wallet later (via
updateWallet) never changes who owns the tag; ownership and payment
destination are two separate questions, and only one of them is about
control.