docs: describe scoped consumer API and wire migration

Document FS lifetime attestation and explicit names, structured TUI identity versus qualified display, optional scope refs and real HTTP conformance coverage. Acceptance suite passes including workspace docs with -D warnings.

CHANGELOG.md

@@ -12,9 +12,12 @@ All notable changes to the published WIP Rust crates are documented here.
   local names, with coherent provider-attested scope Object binding for fetch and
   dispatch. Supplied scope_ref is checked at membership precedence; scope deletion
   retires retained tokens, while ordinary Object state updates preserve lifetime.
-- Migrates FS root publication and public-example self-scopes to the Host API,
-  including coherent backend observations and explicit built-in names. Non-root
-  FS semantics and Client cache recovery remain follow-up work. See
+- Integrates scoped references across filesystem and public consumers and the TUI.
+  External FS scopes bind to visible current connected lineage, not retained
+  registry artifacts. TUI labels use absolute safely quoted `::`/`#` notation;
+  structured selection and Client scope invalidation prevent stale UI dispatch.
+  The public example carries fetched scope refs and includes real HTTP lifetime,
+  visibility and validator-precedence conformance tests with optional refs. See
   [MIGRATION.md](MIGRATION.md) for API/wire examples and provider responsibilities.
 
 ## 0.1.0

MIGRATION.md

@@ -46,9 +46,11 @@ still contains only format, documentation, types and operations, not identity.
 field `scope_ref: Option<String>` in struct literals. Use `None` when omitted,
 not an invented identity. This is an opaque scope Object ref observation/call
 precondition, **not** a third Interface identity component or a validator.
-Host now enforces scope publication lifetimes and optional scope-ref identity
-inside the provider boundary (T-21). Client cache-recovery semantics remain
-follow-up work (T-22); do not mistake registry artifact retention for publication.
+Host enforces scope publication lifetimes and optional scope-ref identity
+inside the provider boundary. Client caches keep the complete structured reference
+and optional fetched scope binding; confirmed scope deletion or ref replacement
+invalidates bound observations, while local eviction is not deletion evidence.
+Do not mistake registry artifact retention for publication.
 
 ## Validation boundaries
 
@@ -176,17 +178,31 @@ the latter also validates compatible live scope associations and response shape.
 
 ## Downstream status
 
-The filesystem consumer registers `file.read`, `symlink.inspect` and `file.write`
-at its deployment-pinned root Scope. It binds that lifetime from the refreshed
-retained root lineage inside the backend execution boundary for calls, generic
-Object observations and fetch. A textual Linux root rename/replacement does not
-substitute the pinned root Object. The root has no Object ref, so fetch omits
-scope_ref; the private lifetime check still applies. Non-root FS registrations
-fail closed pending broader FS/TUI semantics integration (T-23).
+The filesystem default registers local names `file.read`, `symlink.inspect` and
+`file.write` at its deployment-pinned root Scope, displayed as `/::file.read` etc.
+External compositions choose explicit Scope/local names and implement
+`Composition::scope` to attest a non-root lifetime from the exact refreshed backend
+entry in its connected lineage. The engine never independently resolves a scope
+path during dispatch. Default composition remains root-scoped; exposing non-root
+registrations requires the application's current lifetime attestation, not merely
+an artifact or matching ref/validator. All bindings are formed inside backend
+execution, with current principal lineage visibility and publication metadata.
+Retire/recreate Scope handles on deletion, replacement or movement; a pinned leaf
+alone is not evidence that a self-scope Object remains published at that path.
+The Linux deployment root remains pinned across textual root rename/replacement,
+and its ref-less default publication continues to omit scope_ref.
 
 The public API example self-scopes `catalog`, `audit` and `diagnostics` at
-`/article-service`, fetches through its provider, and carries the observed scope
-ref in calls. Client keys use structured values; scope deletion/replacement
-cache recovery remains T-22. This Host change does not modify TUI formatting;
-canonical Text View work is tracked separately in T-24. Interface authoring/macros remain
-descriptor-only and need no identity fields or declaration changes.
+`/article-service`, fetches through its provider, and constructs call metadata
+from the fetched structured reference and scope_ref. External-style conformance
+tests also cross real TCP HTTP for root/self-scopes, same names in different
+scopes, optional refs, stale refs, deletion/republication and validator precedence.
+
+The TUI stores structured references in cache keys, selections, actions, editors
+and in-flight subjects. Normal screens reuse the canonical absolute scoped
+formatter (`/scope::name#operation`, with JSON component quoting when needed).
+Labels are never parsed to reconstruct identity, and scope_ref/validators are not
+normal-screen reference labels. Client invalidation is synchronized back into UI
+observations before dispatch; re-observation is not automatic execution. Typed
+result entries are still fetched on selection, not all at once, and do not create
+inferred indexable edges. Interface authoring/macros remain descriptor-only.

README.md

@@ -85,6 +85,13 @@ The unreleased Protocol/HTTP API uses explicit `InterfaceReference { scope,
 name }` records and optional `scope_ref` observation/precondition metadata.
 Legacy opaque-string wire references are rejected. See [MIGRATION.md](MIGRATION.md)
 for construction examples, validation boundaries and downstream migration status.
+The filesystem default publishes `/::file.read`, `/::symlink.inspect` and
+`/::file.write`; external compositions explicitly choose Scope/local names.
+The TUI retains structured references for selection and dispatch, while normal
+screens use absolute `scope::name#operation` labels with safely quoted components.
+These labels are display-only: they are never parsed as cache keys or call targets,
+and scope refs/validators remain runtime metadata rather than normal-screen labels.
+Client scope invalidation is reflected in the UI before another explicit call.
 
 ## End-to-end example
 

crates/wip-public-api-example/src/lib.rs

@@ -10,7 +10,10 @@
 //! request-scoped implementation, backend handle, authorization policy, and
 //! publication wiring remain host-private. A transport binding would translate
 //! its own wire routes and envelopes to the protocol call DTOs; no HTTP type is
-//! part of an application trait or interface descriptor.
+//! part of an application trait or interface descriptor. Its dev-only conformance
+//! suite also uses the public Client and HTTP crates over real TCP HTTP to test
+//! scope replacement/deletion, optional refs, principal visibility and precondition
+//! precedence. Those dependencies are not required by the example executable.
 //!
 //! # Breaking migration exercised here
 //!