fix: align host dispatch with canonical paths

README.md

@@ -174,22 +174,29 @@ references are rejected. Registry references are opaque and remain outside the
 descriptor; generated descriptors contain neither those references nor Rust
 trait identity.
 
-Dispatch is qualified by interface reference and operation name. The host
-checks current object identity and validator policy, current interface
-membership, interface validator, descriptor operation, arguments, and result
-while retaining the selected object and registered artifact. Host-private
-fields and backend handles are never projected by `WipObject`.
+Dispatch is qualified by interface reference and operation name and targets a
+canonical Worldspace path. An `ObjectProvider` resolves that path exactly once
+inside `with_object`; the host then checks the supplied object validator,
+current interface membership, interface validator, descriptor operation,
+operation-specific object-validator policy, arguments, and authorization in
+canonical precedence. Path and children remain provider resolution context and
+are never projected by `WipObject`; host-private fields and backend handles are
+also excluded.
 
 Application domain failures belong in a derived result union and are returned
 through `Ok`. `wip::HostError` is reserved for runtime/backend failures. Invalid
 arguments are rejected before invocation; malformed encoded results are
-rejected as internal host failures and never returned as application data.
+reported as `InvalidResult` and never returned as application data. Validator,
+membership, authorization, and result failures retain their distinct canonical
+protocol error codes.
 
 Providers remain responsible for backend atomicity. Enter a transaction, lock,
-stable-handle scope, or conditional-update primitive before constructing and
-dispatching the request-scoped `PublishedObject`, and retain it until dispatch
-returns. The runtime never validates one object and then resolves a second
-snapshot, but it cannot make an arbitrary external backend atomic by itself.
+stable-handle scope, or conditional-update primitive before invoking the
+`with_object` callback, and retain it until the callback returns. Mutable
+operations must make validator comparison and backend commit atomic and return a
+validator for the committed state. The runtime never validates one object and
+then resolves a second snapshot, but it cannot make an arbitrary external
+backend atomic by itself.
 
 ## Validation