"inter-aggregate references must use primary keys"
"primary key" is very RDBMS-specific so identity would be more appropriate.
"Objects within the AGGREGATE can hold references to other AGGREGATE roots."
Can, but generally shouldn't.
Why reference through identity?
An Aggregate Root (AR) is a strong consistency boundary. The natural way for an AR to protect it's invariants (including from violations through concurrency) is to encapsulate it's data in a way that allows it to oversee/detect every change.
When you reference other ARs by object reference rather than identity the consistency boundary becomes blurry which makes the design much harder to reason about.
Here's a (rather silly) example:

We can see that it's not enough anymore to look at the AR's structure to know what's truly part of it's boundary and surely that could lead to issues.
Furthermore, would you know if persons will get deleted if you delete InviteList
or if changes made to persons from within InviteList
would get persisted when calling save(inviteList)
? You'd have to inspect the persistence mappings (assuming an ORM) and the cascade options to know for sure.
Why have direct references?
I'd say the primary reason to allow a direct reference to another AR would be to be pragmatic about queries that are constructed from domain objects. It's generally harder to query without such relationships (e.g. find all InviteList
that have an invitee named "Foo"
) or construct DTOs that must aggregate data from multiple ARs (e.g. InviteListDto
with all the invitee names).
However, that's also one of the many reasons CQRS have become so popular these days. If you bypass the domain model for queries entirely (e.g. plain SQL) then you do not have to make concessions in your domain for querying needs.
References
Here's a sample from the IDDD book by Vaugh Vernon where he talks about that very quote from Evans.