refactor: renommer client → sdk, et fusionner les deux portes en une

Deux mouvements de surface, aucun changement de comportement.

**`packages/client` → `packages/sdk`, `@ng-eventually/client` → `@ng-eventually/sdk`.**
« client » ne disait rien : ce paquet EST le SDK que l'application appelle, et c'est
tout ce qu'elle appelle. L'ancien nom reste comme mot-clé de recherche dans
`docs/source-layout-by-fate.md` et le tableau des paquets du README.

**Une seule entrée.** L'entrée `./polyfill` disparaît ; ses symboles applicatifs —
`configure`, `configureStoreRegistry`, `setCurrentUser`, `connectedUser` et leurs types
— vivent dans un bloc `POLYFILL-ERA` de `src/index.ts`.

Ce que la seconde porte portait mérite d'être nommé avant d'être retiré : *ce qu'on
importe de ce chemin est exactement ce qu'on supprimera à la migration*. Une seule
porte perd ce signal — rien à la ligne d'import ne distingue `configure`, qui part, de
`docs`, que le vrai SDK remplace sur place. Trois choses le portent désormais : le bloc
lui-même, l'inventaire d'exports de `docs/api-contract.md` (épinglé par
`test/vocabulary.test.ts`, donc il ne peut pas rancir en silence), et le contrôle de
vocabulaire sur les noms publiés.

**Six symboles quittent la surface au passage**, et la fusion est ce qui a rendu le
choix visible plutôt qu'hérité :

- `getConfig` / `getStoreRegistryDeps` — câblage interne, atteint par
  `shared-wallet/bootstrap` ;
- `resetConfig` / `resetStoreRegistry` / `resetCaps` — remises à zéro de test, atteintes
  par leur chemin interne, ce qui est leur raison d'être ;
- le `share` direct — `inbox.share` a toujours été la même fonction, et la publier deux
  fois brouillait la frontière qu'elle servait à marquer.

Corrections d'affirmations fausses trouvées en chemin : le contrat annonçait `isNuri` /
`hasReadCap` sur la porte SDK alors qu'ils ne sont plus exportés depuis le passage au
permissif en entrée (`NuriLike` validé à la porte) ; le README du paquet documentait
`capFor`, `shareCap`, `getCaps` et `publishRepoLink`, dont aucun n'existe ; et le README
de l'app d'exemple affirmait que la suite e2e la pilote, ce qui reste à faire.

179 tests unitaires, typecheck bibliothèque / exemple / harnais, e2e 42/42 contre le
broker en ligne — mesuré une fois après le renommage, une fois après la fusion.

packages/sdk/src/surface/read-model.ts

@@ -0,0 +1,213 @@
+/**
+ * read-model — the listing primitive of the polyfill: read a bounded, by-need set
+ * of documents, each with its own anchored `sparql_query`, and return the triples
+ * grouped per subject. This is the mechanism documented in docs/read-model.md.
+ *
+ * ── Why per-doc anchored, rather than an anchorless union-scan ─────────────
+ * An anchored `sparql_query(sid, "SELECT ?s ?p ?o WHERE { ?s ?p ?o }", base, doc)`
+ * is restricted to the anchor repo's graph: `resolve_target_for_sparql(Repo)` →
+ * `Some(repo_graph_name)`, which becomes the query's default graph. A body with no
+ * `GRAPH` wrapper reads only that default graph → only that doc's triples, O(1) per
+ * doc, independent of how many other graphs the local store holds.
+ *
+ * The footgun this avoids: an anchorless query (`anchor` undefined → `UserSite` →
+ * `set_default_graph_as_union`) spans EVERY named graph currently in the session
+ * store. On a shared / bloated wallet that accumulates across runs, that is
+ * O(wallet size) → the observed ~90s timeouts. So the read path never union-scans
+ * all graphs — it reads exactly the bounded by-need set, one anchored query per doc.
+ *
+ * NB (verified, docs/read-model.md § probe step 4): an explicit `GRAPH ?g { … }`
+ * body iterates the named graphs regardless of the default graph, so an anchor does
+ * not bound such a body. The per-doc read therefore uses a default-graph body (no
+ * `GRAPH` wrapper) so the anchor's one-repo restriction actually applies.
+ *
+ * ── Why not the reactive ORM fan-out ──────────────────────────────────────
+ * `useShape({ graphs: […manyDocs] })` drives `orm_start_graph` over a fan-out of
+ * per-entity graphs; a freshly-created / not-yet-synced doc in that fan-out makes
+ * `RepoNotFound` abort the whole subscription → the readyPromise never resolves →
+ * the ~75s hang (docs/nextgraph-current-state.md § The ORM fan-out hang). Listing
+ * is instead a set of one-shot anchored `sparql_query`s. There is no reactive
+ * union query, so reactivity is assembled by re-querying on a change signal.
+ *
+ * ── Generic by construction ───────────────────────────────────────────────
+ * No application domain here: the consumer passes the doc NURIs to read (from
+ * the discovery index for public events, or its own scope docs for my-entities)
+ * and interprets the returned per-subject property bags. All NextGraph I/O routes
+ * through the T01.a `docs` primitives (the real injected `ng`), so this module
+ * imports no `@ng-org` package.
+ *
+ * At the real multi-store migration the per-doc anchored read is unchanged (native
+ * SPARQL, anchored to one repo); only bringing a repo into the session (open by cap)
+ * changes — the anchored query already resolves a same-session repo directly.
+ */
+
+import { docCreate, sparqlUpdate, sparqlQuery } from "./docs";
+import { getCaps, getStoreRegistryDeps } from "../shared-wallet/bootstrap";
+import { mustNotAttempt } from "../emulated-verifier/reach";
+import { ensureReposOpen } from "../emulated-verifier/open-repo";
+import { assertNuri } from "./sparql";
+import { toNuri } from "../model/nuri";
+import { isMachinerySubject } from "../emulated-verifier/machinery";
+import type { Nuri, NuriLike } from "../model/types";
+
+// Keep the primitives referenced so tree-shaking never drops the import used by
+// the (side-effecting) open step below; `docCreate`/`sparqlUpdate` are not used
+// here but the module intentionally depends only on the docs primitive surface.
+void docCreate;
+void sparqlUpdate;
+
+/** One subject read from a doc, with its properties (predicate → values). */
+export interface UnionSubject {
+  /**
+   * The subject IRI (`?s`) — in the polyfill, the doc's own NURI.
+   *
+   * Typed `Nuri`, not `string`: both fields are always document references here (the
+   * read is anchored per document and the subject is pinned to the anchor), and typing
+   * them loosely forced a consumer to cast whatever it had just read before it could
+   * pass it back — `shareNote(note.doc)`, `leaveMessage(note.doc)`. A cast at that
+   * boundary re-opens exactly the confusion the template literal types exist to close.
+   * Found by writing the example application (`examples/notebook`).
+   */
+  subject: Nuri;
+  /** The graph (doc NURI) the subject was read from. */
+  graph: Nuri;
+  /** predicate IRI → the list of object values (literals or IRIs) for it. */
+  props: Record<string, string[]>;
+}
+
+/** Tolerant extraction of SPARQL SELECT bindings across possible shapes. */
+function bindings(
+  result: unknown,
+): Array<Record<string, { value: string } | undefined>> {
+  if (!result) return [];
+  if (Array.isArray(result))
+    return result as Array<Record<string, { value: string }>>;
+  const anyRes = result as {
+    results?: { bindings?: Array<Record<string, { value: string }>> };
+  };
+  return anyRes.results?.bindings ?? [];
+}
+
+async function sessionId(): Promise<string> {
+  return (await getStoreRegistryDeps().getSession()).sessionId;
+}
+
+/**
+ * Read one doc with an anchored default-graph query, tolerant per-doc.
+ *
+ * The anchor (`doc` NURI) restricts the query to that repo's graph as the default
+ * graph (`resolve_target_for_sparql(Repo)` → `Some(repo_graph_name)`); a body with
+ * no `GRAPH` wrapper reads exactly that default graph → only this doc's triples.
+ * This is O(1) in the doc's own size and independent of the rest of the (possibly
+ * bloated / shared) session store — it never iterates other graphs.
+ *
+ * COLD-START (fresh session, same persistent wallet): the repo is NOT in
+ * `self.repos` until something opens it, and an anchored query against an unopened
+ * repo silently returns 0 rows (never `RepoNotFound`). {@link readUnion} therefore
+ * opens the batch's repos ({@link ensureReposOpen}) BEFORE this read runs, so the
+ * anchored query resolves a same-session repo directly. A genuinely-absent repo
+ * still yields `[]` (in isolation, never aborting the others). Returns the doc's
+ * rows, or `[]` on failure.
+ *
+ * At the real multi-store migration this becomes a real sync: opening a per-user
+ * store repo by cap is a native broker fetch (`verifier.rs:1423` `OpenRepo` TODO).
+ */
+async function readDoc(
+  sid: string,
+  doc: Nuri,
+): Promise<Array<Record<string, { value: string } | undefined>>> {
+  try {
+    const nuri = assertNuri(doc);
+    // Anchored to `nuri` → default graph = this repo. No `GRAPH ?g` wrapper, so
+    // the anchor's one-repo restriction applies (an explicit `GRAPH ?g` body would
+    // iterate all named graphs regardless of the anchor — see docs § probe step 4).
+    const res = await sparqlQuery(
+      sid,
+      "SELECT ?s ?p ?o WHERE { ?s ?p ?o }",
+      undefined,
+      nuri,
+      "readDoc",
+    );
+    return bindings(res);
+  } catch (error) {
+    console.error("[read-model] read failed for", doc, error);
+    return [];
+  }
+}
+
+/**
+ * Read a BOUNDED, by-need set of docs — each with its OWN anchored query — and
+ * return the triples grouped per subject. `docs` are the NURIs to read (the
+ * consumer resolves them by need — index for public, own scope docs for mine).
+ * Docs that fail are skipped (see {@link readDoc}); a failing doc never aborts the
+ * batch.
+ *
+ * Never an anchorless union-scan over all graphs (which is O(wallet size) and wrong
+ * on a shared / bloated wallet — the footgun this path exists to avoid). Each doc is
+ * read with an anchored default-graph query, O(1) per doc, independent of wallet
+ * size — a non-empty wallet no longer matters. Reads run in parallel via `Promise.all`.
+ */
+export async function readUnion(docsLike: NuriLike[]): Promise<UnionSubject[]> {
+  const sid = await sessionId();
+  // Drop the empties BEFORE validating, not after: this call has always tolerated a
+  // list with holes in it — a scope index can carry a blank entry, and a caller
+  // building a list from optional values should not have to compact it. Validating
+  // first turned that tolerance into a throw, which took down a whole reconnect run.
+  // Empty is absence, and absence is not a malformed reference.
+  const unique = [...new Set(docsLike.filter(Boolean))].map((d) => toNuri(d, "readUnion"));
+  if (unique.length === 0) return [];
+
+  // COLD-START heal (polyfill-era): on a fresh session over a persistent wallet the
+  // target repos are not yet in `self.repos`, so an anchored read would return 0
+  // rows. Open/subscribe each repo ONCE (idempotent, per session) and await its
+  // initial-state push before the anchored reads. No-op once opened / when the
+  // injected `ng` has no `doc_subscribe` (unit fake). See open-repo.ts.
+  //
+  // Called on the WHOLE set, before the boundary is consulted, because opening is also
+  // where a document in a PUBLIC store hands over its cap (see public-store.ts): a
+  // document filtered out first would never get the chance to answer. `ensureRepoOpen`
+  // still refuses to open what this user may not touch — it asks, it does not enter.
+  await ensureReposOpen(unique);
+
+  // RULE 2 — do not even attempt. Drop the documents whose cap this user does not
+  // hold before reading anything: upstream you cannot address a repo you have no cap
+  // for, so asking about one is not "a read that will be refused", it is a read that
+  // has no meaning. (The passage points enforce rule 1 regardless — see reach.ts — so
+  // a lapse here is caught, not exploited.)
+  const reachable = unique.filter((d) => !mustNotAttempt(d));
+
+  // One anchored query per doc, in parallel, tolerant (a bad doc yields []).
+  const perDoc = await Promise.all(
+    reachable.map(async (d) => ({ doc: assertNuri(d), rows: await readDoc(sid, d) })),
+  );
+
+  // Possession gate, kept as defence in depth behind rule 2 above: `reachable`
+  // already excluded these, so this loop should never drop anything. In this
+  // polyfill each subject IRI is its own document NURI, so the cap key is the doc NURI.
+  const caps = getCaps();
+
+  const bySubject = new Map<string, UnionSubject>();
+  for (const { doc, rows } of perDoc) {
+    if (caps.isEnforcing() && caps.capFor(doc) === undefined) continue;
+    // Anchored to `doc`, so every row belongs to `doc`; the subject is the doc NURI
+    // (writeEntity invariant). Pin subject/graph to the doc NURI (the anchor), which
+    // is stable regardless of the repo_graph_name overlay suffix the store carries.
+    for (const row of rows) {
+      // The polyfill's own compartments live as reserved SUBJECTS inside the very
+      // documents the consumer reads (the Header branch carrying a document's inbox
+      // address is the first). They are machinery, not this entity's properties —
+      // drop them here, once, for every compartment present and future.
+      if (isMachinerySubject(row.s?.value)) continue;
+      const p = row.p?.value;
+      const o = row.o?.value;
+      if (!p || o === undefined) continue;
+      let entry = bySubject.get(doc);
+      if (!entry) {
+        entry = { subject: doc, graph: doc, props: {} };
+        bySubject.set(doc, entry);
+      }
+      (entry.props[p] ??= []).push(o);
+    }
+  }
+  return [...bySubject.values()];
+}