final class ReflectionReference {
    /* Returns ReflectionReference if array element is a reference, null otherwise. */
    public static function fromArrayElement(array $array, int|string $key): ?ReflectionReference;
    /* Returns unique identifier for the reference. The return value format is unspecified. */
    public function getId(): int|string;
    private function __construct(); // Always throws
    private function __clone(); // Always throws
}

The return value of getId() uniquely identifies the reference for the duration of its lifetime. An ID may be reused if the reference is destroyed. The format of the return value is unspecified any may change. Only the fact that it will be an integer or string is guaranteed.

In the current implementation the address of the reference is directly returned as the ID. We should be hiding the address here, possibly by hashing it with a secret key. the ID is a raw SHA1 hash of the reference address and a per-process key. Raw meaning 20 character binary data, no hex encoding.