fix: validate resolved ancestry inside atomic projection dispatch

Resolve one connected lineage and retain its root-to-parent capabilities. Backends validate ancestor identity/membership and refresh all policy metadata inside the same boundary as target validators and typed dispatch; hidden/replaced ancestors reject as NotFound without invocation or effects. Preserve pinned leaf and configured-root capabilities. Covers MR ANCESTOR_VISIBILITY_TOCTOU with HTTP memory and Linux replacement/budget/guard regressions; all T-19 workspace acceptance commands pass (Clippy via Nix shell).

crates/wip-fs-server/README.md

@@ -23,8 +23,9 @@ For an external backend/composition:
 
 1. Implement `BackendEntry` on a local, cloneable, root-confined stable capability.
    Its `WipObject` metadata is public-only; its validator binds identity and the
-   protected state. Implement `FilesystemBackend` to resolve capabilities,
-   enumerate bounded children, and execute against an already-resolved entry.
+   protected state. Implement `FilesystemBackend` to resolve one connected
+   `ResolvedEntry<Entry>` (root-to-parent ancestry plus pinned target), enumerate
+   bounded children, and execute against that already-resolved lineage.
 2. Register generated `#[wip_interface::interface]` definitions using the existing
    `wip_host::InterfaceRegistry`. `DefaultInterfaces::register` optionally supplies
    reusable built-in tokens; using those tokens does not force their publication.
@@ -55,10 +56,26 @@ listener, a global object registry, or dynamic plugin loading.
 ### Extension security contract
 
 Backend implementations and Operation authors are trusted code, not sandboxed
-plugins. `FilesystemBackend::execute` must refresh state/validators **inside** its
-transaction or lock before calling the engine callback, retain the same resolved
-target through validation and dispatch, and return the committed post-operation
-validator. Confirm rollback only after rollback succeeds. Pre-dispatch failures
+plugins. `FilesystemBackend::resolve` returns `ResolvedEntry::new(ancestors, target)`
+from one connected backend traversal/snapshot, not independent path-prefix
+resolutions. A root target has no ancestors; other targets retain the root first,
+then intermediate parent containers. This is backend-private context, never wire
+metadata. Backend `resolve` and `execute` signatures both carry this type;
+compositions still receive only the exact scoped target `Entry`.
+
+`FilesystemBackend::execute` must validate ancestor membership/identity and
+refresh **all** lineage state/validators inside its transaction or lock before
+calling the engine callback, retaining the same target and connected ancestry
+through validation and dispatch. Replaced/detached ancestors must return
+`NotFound` without callback invocation, even when the replacement is visible.
+The engine evaluates Object visibility for every refreshed ancestor and target
+inside that same boundary; a hidden ancestor rejects the entire subtree before
+publication/typed dispatch. Never fix a changed lineage by resolving the raw path
+again and substituting capabilities. Participating policy-relevant backend state
+changes must be serialized by this boundary, not just target-content writes.
+Return the committed post-operation validator. Retained ancestry is subject to
+handle/work ceilings; resource exhaustion is an error, not missing ancestry.
+Confirm rollback only after rollback succeeds. Pre-dispatch failures
 must never commit; failed started operations without a non-commit guarantee remain
 `OperationOutcomeUnknown`. Object implementations must delegate validators to
 that entry and declare requirements per `(InterfaceRef, operation)`, rather than
@@ -68,13 +85,16 @@ cancellation and resource budgets throughout backend work and report effects
 truthfully. POSIX symlinks, identity, atomic mutations and locking cannot be assumed
 for other backends.
 
-The default Linux backend uses advisory exclusive locks on regular files,
-refreshes validators after acquiring the lock and holds it through post-dispatch
-state observation. This serializes cooperating library calls; it does **not**
-promise transactional isolation from unrelated processes ignoring `flock`.
-Descriptor-relative pinned handles still prevent replacement from redirecting an
-operation to a different file. Linux capabilities only expose bounded methods,
-not raw descriptors or backend paths.
+The default Linux backend acquires advisory exclusive locks in root-to-parent
+order and then on the lockable target (directory or regular file). It compares
+retained ancestor identity to no-follow descriptor-relative lookup results,
+refreshes lineage snapshots after acquiring the locks, and holds the guards
+through post-dispatch state observation. The configured root remains its pinned
+capability even if its textual path is renamed; replaced intermediate ancestors
+are rejected. Leaf path replacement never redirects execution to a new inode.
+This serializes cooperating library calls; it does **not** promise transactional
+isolation from unrelated processes ignoring `flock`. Linux capabilities only
+expose bounded methods, not raw descriptors or backend paths.
 
 A policy must be stable/deterministic within one effective Worldspace view.
 Interface/operation visibility is uniform per registered reference within that