docs: describe scoped consumer API and wire migration

Document FS lifetime attestation and explicit names, structured TUI identity versus qualified display, optional scope refs and real HTTP conformance coverage. Acceptance suite passes including workspace docs with -D warnings.

CHANGELOG.md

@@ -12,9 +12,12 @@ All notable changes to the published WIP Rust crates are documented here.
   local names, with coherent provider-attested scope Object binding for fetch and
   dispatch. Supplied scope_ref is checked at membership precedence; scope deletion
   retires retained tokens, while ordinary Object state updates preserve lifetime.
-- Migrates FS root publication and public-example self-scopes to the Host API,
+- Integrates scoped references across filesystem and public consumers and the TUI.
-  including coherent backend observations and explicit built-in names. Non-root
+  External FS scopes bind to visible current connected lineage, not retained
-  FS semantics and Client cache recovery remain follow-up work. See
+  registry artifacts. TUI labels use absolute safely quoted `::`/`#` notation;
+  structured selection and Client scope invalidation prevent stale UI dispatch.
+  The public example carries fetched scope refs and includes real HTTP lifetime,
+  visibility and validator-precedence conformance tests with optional refs. See
   [MIGRATION.md](MIGRATION.md) for API/wire examples and provider responsibilities.
 
 ## 0.1.0

MIGRATION.md

@@ -46,9 +46,11 @@ still contains only format, documentation, types and operations, not identity.
 field `scope_ref: Option<String>` in struct literals. Use `None` when omitted,
 not an invented identity. This is an opaque scope Object ref observation/call
 precondition, **not** a third Interface identity component or a validator.
-Host now enforces scope publication lifetimes and optional scope-ref identity
+Host enforces scope publication lifetimes and optional scope-ref identity
-inside the provider boundary (T-21). Client cache-recovery semantics remain
+inside the provider boundary. Client caches keep the complete structured reference
-follow-up work (T-22); do not mistake registry artifact retention for publication.
+and optional fetched scope binding; confirmed scope deletion or ref replacement
+invalidates bound observations, while local eviction is not deletion evidence.
+Do not mistake registry artifact retention for publication.
 
 ## Validation boundaries
 
@@ -176,17 +178,31 @@ the latter also validates compatible live scope associations and response shape.
 
 ## Downstream status
 
-The filesystem consumer registers `file.read`, `symlink.inspect` and `file.write`
+The filesystem default registers local names `file.read`, `symlink.inspect` and
-at its deployment-pinned root Scope. It binds that lifetime from the refreshed
+`file.write` at its deployment-pinned root Scope, displayed as `/::file.read` etc.
-retained root lineage inside the backend execution boundary for calls, generic
+External compositions choose explicit Scope/local names and implement
-Object observations and fetch. A textual Linux root rename/replacement does not
+`Composition::scope` to attest a non-root lifetime from the exact refreshed backend
-substitute the pinned root Object. The root has no Object ref, so fetch omits
+entry in its connected lineage. The engine never independently resolves a scope
-scope_ref; the private lifetime check still applies. Non-root FS registrations
+path during dispatch. Default composition remains root-scoped; exposing non-root
-fail closed pending broader FS/TUI semantics integration (T-23).
+registrations requires the application's current lifetime attestation, not merely
+an artifact or matching ref/validator. All bindings are formed inside backend
+execution, with current principal lineage visibility and publication metadata.
+Retire/recreate Scope handles on deletion, replacement or movement; a pinned leaf
+alone is not evidence that a self-scope Object remains published at that path.
+The Linux deployment root remains pinned across textual root rename/replacement,
+and its ref-less default publication continues to omit scope_ref.
 
 The public API example self-scopes `catalog`, `audit` and `diagnostics` at
-`/article-service`, fetches through its provider, and carries the observed scope
+`/article-service`, fetches through its provider, and constructs call metadata
-ref in calls. Client keys use structured values; scope deletion/replacement
+from the fetched structured reference and scope_ref. External-style conformance
-cache recovery remains T-22. This Host change does not modify TUI formatting;
+tests also cross real TCP HTTP for root/self-scopes, same names in different
-canonical Text View work is tracked separately in T-24. Interface authoring/macros remain
+scopes, optional refs, stale refs, deletion/republication and validator precedence.
-descriptor-only and need no identity fields or declaration changes.
+
+The TUI stores structured references in cache keys, selections, actions, editors
+and in-flight subjects. Normal screens reuse the canonical absolute scoped
+formatter (`/scope::name#operation`, with JSON component quoting when needed).
+Labels are never parsed to reconstruct identity, and scope_ref/validators are not
+normal-screen reference labels. Client invalidation is synchronized back into UI
+observations before dispatch; re-observation is not automatic execution. Typed
+result entries are still fetched on selection, not all at once, and do not create
+inferred indexable edges. Interface authoring/macros remain descriptor-only.

README.md

@@ -85,6 +85,13 @@ The unreleased Protocol/HTTP API uses explicit `InterfaceReference { scope,
 name }` records and optional `scope_ref` observation/precondition metadata.
 Legacy opaque-string wire references are rejected. See [MIGRATION.md](MIGRATION.md)
 for construction examples, validation boundaries and downstream migration status.
+The filesystem default publishes `/::file.read`, `/::symlink.inspect` and
+`/::file.write`; external compositions explicitly choose Scope/local names.
+The TUI retains structured references for selection and dispatch, while normal
+screens use absolute `scope::name#operation` labels with safely quoted components.
+These labels are display-only: they are never parsed as cache keys or call targets,
+and scope refs/validators remain runtime metadata rather than normal-screen labels.
+Client scope invalidation is reflected in the UI before another explicit call.
 
 ## End-to-end example
 

crates/wip-public-api-example/src/lib.rs

@@ -10,7 +10,10 @@
 //! request-scoped implementation, backend handle, authorization policy, and
 //! publication wiring remain host-private. A transport binding would translate
 //! its own wire routes and envelopes to the protocol call DTOs; no HTTP type is
-//! part of an application trait or interface descriptor.
+//! part of an application trait or interface descriptor. Its dev-only conformance
+//! suite also uses the public Client and HTTP crates over real TCP HTTP to test
+//! scope replacement/deletion, optional refs, principal visibility and precondition
+//! precedence. Those dependencies are not required by the example executable.
 //!
 //! # Breaking migration exercised here
 //!