feat: bind Host interfaces to scope Object lifetimes

Register explicit scope/name coordinates independently of Definition type. Require provider-attested current scope snapshots for fetch and dispatch, compare optional scope_ref at membership precedence, and retain the same Descriptor through result validation.

Migrate FS pinned-root boundaries and public self-scope example; document provider atomicity/lifecycle and root-only FS support. Add lifecycle, ref, replacement-race, root-lineage and compile-time exposure regressions.

Validation: cargo fmt --all --check; git diff --check; cargo check --workspace --all-targets; cargo test --workspace --all-targets and --doc (232 passing test-harness cases including doctests); nix develop --command cargo clippy --workspace --all-targets -- -D warnings; RUSTDOCFLAGS=-Dwarnings cargo doc --workspace --no-deps. Narrow wip-host suite also passed.

MIGRATION.md

@@ -1,4 +1,4 @@
-# Structured Interface reference migration
+# Structured Interface reference and scope publication migration
 
 This unreleased API/wire change follows `wip-reference` canonical Core Model,
 Protocol and WIP over HTTP at `6086f3c5ef10aa1464ce9c824750d7f667217bfd`.
@@ -46,9 +46,9 @@ still contains only format, documentation, types and operations, not identity.
 field `scope_ref: Option<String>` in struct literals. Use `None` when omitted,
 not an invented identity. This is an opaque scope Object ref observation/call
 precondition, **not** a third Interface identity component or a validator.
-The scope-ref lifecycle/atomic Host enforcement and Client cache-recovery
-semantics are follow-up work (T-21/T-22); this migration supplies the data model
-and codec, not a completed lifecycle implementation.
+Host now enforces scope publication lifetimes and optional scope-ref identity
+inside the provider boundary (T-21). Client cache-recovery semantics remain
+follow-up work (T-22); do not mistake registry artifact retention for publication.
 
 ## Validation boundaries
 
@@ -116,15 +116,77 @@ malformed success responses retain Client-local `InvalidResponse`. Standard
 `POST v1/observe`, `v1/fetch_interface`, `v1/call_operation`, error-code/status
 mapping and Transport failure classification are unchanged.
 
+## Host registration and provider migration
+
+Registration now requires an explicit canonical Scope and local name:
+
+```rust,ignore
+let mut registry = wip_host::InterfaceRegistry::new();
+let scope = wip_host::Scope::new("/service")?;
+let api = registry.register(&scope, "catalog", CatalogDefinition, None)?;
+
+// INSIDE the backend transaction/lock/stable-handle boundary:
+let current = wip_host::ScopeObservation::new(&scope, &current_scope_object);
+let publication = wip_host::PublishedObject::new(current_target_object)
+    .expose(&api)?
+    .bind_scope(current);
+```
+
+Collision keys are exact `(scope, name)` coordinates, not Rust Definition TypeId.
+The same Definition can be registered in different scopes or under different
+names. Root, self and ancestor scopes are valid, but ancestor compatibility and
+explicit target membership remain independent checks. Descriptors still have
+no publication identity fields.
+
+A Scope carries a private publication lifetime, not a generated Protocol ref.
+Clone it only while the same scope Object remains published: ordinary Object
+state/validator updates do not retire it. Deletion, replacement or movement
+requires retiring the old lifetime with `registry.remove_scope(&scope)` and
+creating a fresh Scope before republication, even at the same path or ref.
+Retained registration tokens cannot fetch or start calls after retirement.
+Ref-less replacement cannot be tracked by a Client identity precondition; refs
+and scope_ref remain optional, not forcibly generated.
+
+`ScopeObservation::new(&scope, &object)` is a provider attestation that this
+lifetime currently belongs to the Object at the scope path. Construct and attach
+it with `PublishedObject::bind_scope` inside the same coherent boundary as target
+resolution, membership, Descriptor/validator selection, implementation and
+backend handles, through dispatch and commit/rollback. A matching ref or an
+independent scope prelookup is not sufficient. The scope Object need not expose
+any interfaces. Providers own atomicity and external-writer limitations; the
+runtime checks the attached lifetime and optional scope_ref, and validates both
+arguments and results against the same frozen Descriptor. A supplied scope_ref
+mismatch, including a missing current ref, is `InterfaceMismatch` at membership
+precedence, after target existence and a supplied Object validator mismatch.
+Omission applies no scope identity precondition.
+
+Artifact-only `registry.fetch_interface(reference)` is removed. Prefer
+`ObjectProvider::fetch_interface(&provider, &registry, &reference)`, which resolves
+the visible scope Object with `with_object` and uses its attached current binding.
+Low-level `registry.fetch_interface(&reference, &current_observation)` requires
+the same coherent current attestation, not a cached snapshot. Fetch returns
+Descriptor, Interface validator and optional scope Object ref together; Clients
+need not additionally fetch an ancestor Object. `registry.scopes()` may repeat
+a handle for several names; do not treat it as a unique-scope iterator.
+
+`PublishedObject::protocol_object()` is a path-free composition projection, not
+publication authority. For current observations use `ObjectProvider::observe_object`
+or `publication.protocol_object_at(path)` inside the coherent provider boundary;
+the latter also validates compatible live scope associations and response shape.
+
 ## Downstream status
 
-The workspace Client, Host, filesystem server, TUI and public-API example
-are mechanically migrated to structured protocol values and updated fixtures.
-The existing Host's generated opaque registration handle is bridged explicitly
-to scope `/` with its full handle as the name; no delimiter parsing or scope
-registration/lifetime model is introduced here. The existing Client keys use
-structured values; this change does not implement scope deletion/replacement
-cache recovery. TUI formatting is only the type-compatibility adaptation, not
-the full canonical Text View work (T-24). Filesystem/TUI semantics integration
-remains T-23. Interface authoring/macros are descriptor-only and require no
-identity fields or declaration changes.
+The filesystem consumer registers `file.read`, `symlink.inspect` and `file.write`
+at its deployment-pinned root Scope. It binds that lifetime from the refreshed
+retained root lineage inside the backend execution boundary for calls, generic
+Object observations and fetch. A textual Linux root rename/replacement does not
+substitute the pinned root Object. The root has no Object ref, so fetch omits
+scope_ref; the private lifetime check still applies. Non-root FS registrations
+fail closed pending broader FS/TUI semantics integration (T-23).
+
+The public API example self-scopes `catalog`, `audit` and `diagnostics` at
+`/article-service`, fetches through its provider, and carries the observed scope
+ref in calls. Client keys use structured values; scope deletion/replacement
+cache recovery remains T-22. This Host change does not modify TUI formatting;
+canonical Text View work is tracked separately in T-24. Interface authoring/macros remain
+descriptor-only and need no identity fields or declaration changes.