docs(contract): ensureIdentity lève quand la connexion n'a pas abouti

Le contrat disait qu'il « termine le travail de connexion qu'il entame », sans
dire ce qui arrive quand il n'y parvient pas. Depuis que les échecs remontent,
il lève — et c'est actionnable : une application qui rend son interface malgré
un rejet affiche un compte vide, pas un écran vide, ce qu'aucun utilisateur ne
sait interpréter.

Dans l'autre sens c'est une garantie renforcée : résolu signifie que tout ce
qui vous a été partagé est lisible.

.project/concepts/app-contract/contract_polyfill-surface.md

@@ -108,6 +108,8 @@ Only a document's owner writes to it. Holding its read key never grants a write.
 
 `ensureIdentity()` settles the identity, completes the connection work it starts, and returns the identity. It takes no identifier, and no other call takes one.
 
+It resolves **only once that work has actually completed**: if what was shared with you could not be restored, or a queue could not be drained, it throws instead of returning. So a resolved call means everything shared with you is readable — and a rejected one must not be rendered past, since the interface would show an empty account rather than an empty screen.
+
 `ensureIdentity()` mounts a full-screen barrier on every top-level load, and takes it down itself — past the broker round-trip it never appears. A person who comes back to the page from that round-trip finds the barrier live again, prefilled, and confirming it hands the page over a second time. The application's own page is never reloaded and nothing outside the barrier is touched.
 
 **The session is the package's, not yours.** You never build one, and no call takes one. Call this package's `init` (not the one you passed to `configure`): it captures the session the SDK delivers to `init`'s callback and keeps it, then calls your callback with that same event untouched — so an application that wants the `session_id` for the `docs` primitives reads it there, and one that does not may pass no callback at all. Identity normalisation is the package's too: `@Alice`, `alice ` and `ALICE` are one person.