feat(fs): bind external scopes to current execution lineage

Add fail-closed Composition lifetime attestation for non-root scopes; preserve pinned deployment-root semantics and principal visibility. Fetch and dispatch bind optional published scope refs inside the refreshed backend boundary.

Validation: cargo test -p wip-fs-server (25 unit, 8 HTTP, 31 extension tests and 1 doc-test); Nix clippy for FS and public example with -D warnings; git diff --check.

crates/wip-fs-server/README.md

@@ -8,10 +8,12 @@ envelopes, and HTTP status mapping.
 
 ## Library assembly and migration
 
-The existing `ServerConfig`, `WipFsServer::new`, `handle_http`, CLI flags and wire
-representation remain compatible. The formerly private projection has become a
-public, generic library engine. No package version or publication policy changes
-are required.
+`ServerConfig`, `WipFsServer::new`, `handle_http` and CLI flags retain their
+assembly shape. The scoped Host/Protocol API is a breaking Rust/wire migration:
+Interface references are `{scope, name}` values, registration takes a `Scope`
+and local name, and calls use `interface.reference` plus optional `scope_ref`.
+Fetch returns the same structured reference and current scope Object's optional
+ref. This is the standard WIP wire format, not an FS-specific profile.
 
 Use `default_projection(root, access, limits)` to obtain the default Linux engine
 without starting a listener. `projection.view(&principal)` is the effective view;
@@ -30,9 +32,11 @@ For an external backend/composition:
    register generated definitions with `registry.register(&scope, name,
    Definition, validator)`. `DefaultInterfaces::register(&mut registry, &scope)`
    optionally supplies reusable built-in tokens named `file.read`,
-   `symlink.inspect`, and `file.write`; tokens do not force publication. The
-   current engine binds only the root scope and fails closed for non-root
-   registrations; broader FS scope semantics remain follow-up work.
+   `symlink.inspect`, and `file.write`; tokens do not force publication. For a
+   non-root scope, create a handle at its canonical WIP path and implement
+   `Composition::scope(path, &entry, context)` to attest that handle only for
+   its current Object lifetime. Local names are exact names, not parsed `::`/`#`
+   display strings; the same local name can be registered at different scopes.
 3. Implement `Composition<Entry>` on a local type. Its local Object wraps the entry
    and implements both `WipObject` and the chosen generated traits, avoiding orphan
    rules. `PublishedObject::expose` proves each implementation at compile time.
@@ -78,6 +82,29 @@ It never independently looks up the raw configured root path. Root Objects need
 not expose any interfaces. Calls check both the private lifetime and optional
 `scope_ref`; normal root state updates do not retire the lifetime.
 
+`Composition::scope` is the trusted non-root lifetime attestation hook. It runs
+only for registered scope paths in the refreshed, principal-visible execution
+lineage, never through independent scope-path resolution. Return `Some(scope)`
+only when the retained entry is still the current Object published at that path;
+use retained backend identity and application publication-lifecycle state under
+the backend boundary, not ref or validator equality. Deletion, replacement or
+movement needs a fresh handle and registration, even if a ref is absent or reused.
+Ordinary state changes retain the handle. A different returned path is an internal
+publication failure; `None` or a fresh unregistered lifetime hides old artifacts.
+The default hook returns `None`, so existing compositions fail closed outside `/`.
+
+Self-scope needs special care: a backend may allow ordinary execution against an
+unlinked/replaced pinned leaf, but that does not establish that leaf as the current
+scope Object. The hook must attest current membership as well as retained identity
+within the same boundary. The default Linux composition does not attest non-root
+lifetimes or invent inode-based Object refs. External compositions must provide
+that guarantee themselves, including their documented external-writer limits.
+Scope metadata is obtained by publishing that retained entry (reusing the target
+publication for self-scope); scope Objects need not expose interfaces. Optional
+refs are taken from the published Object, not from a raw backend entry. Calls
+without `scope_ref` remain valid when the lifetime is current; supplied stale refs
+reject with `InterfaceMismatch` after Object validator checks.
+
 `with_object` (including fetch) and individual tree Object publications also
 enter this backend boundary. Generic read callbacks use a `NotStarted` attempt
 as an adapter to the existing execution API; no typed operation runs and no