fix: les trois citations que les paquets installes invalidaient

Recherche menee sur les 94 citations vers engine/ et sdk/, en comparant
l'arbre cite aux artefacts publies. Onze citations de niveau 2
(doc_subscribe, sparql_update, sparql_query, doc_create) sont
identiques de part et d'autre, ainsi que ShapeType, Schema et
DeepSignalSet. Trois ne l'etaient pas.

- Scope : la revision citee declare `graphs?` OPTIONNEL,
  @ng-org/orm@0.1.2-alpha.21 le rend requis - et c'est le paquet
  installe qui est reexporte ici.
- BaseType : la revision citee garde "@graph" en commentaire derriere un
  TODO, @ng-org/shex-orm@0.1.2-alpha.9 le declare.
- NG : le compte de membres disait 88 en neuf endroits, dont un marque
  VERIFIED et un autre annoncant une mesure contre alpha.14. Le paquet
  installe en declare 90 - 84 fonctions et 6 classes RDF - et deux des
  quatre-vingt-dix, graph_orm_next_page et graph_orm_previous_page, sont
  absents de l'arbre cite. Le compte vit desormais a un seul endroit,
  avec la version a laquelle il appartient ; ailleurs il disparait, parce
  que la phrase disait "tous les membres" et que le chiffre n'y ajoutait
  qu'une occasion de perimer.

Les deux premieres reprennent la forme que RdfOrmConfig et
OrmSubscriptionHandle portaient deja : une clause finale nommant la
version publiee la ou elle diverge de la revision citee.

packages/polyfill/src/index.ts

@@ -144,7 +144,7 @@ export * as storeRegistry from "./surface/placement";
 // @ng-org. `export type` is ERASED at build, so this adds NO runtime @ng-org import to
 // the lib (no risk of a duplicate SDK copy in the bundle).
 // @provenance ShapeType kind=passthrough level=3 ref=sdk/js/shex-orm/src/types.ts:ShapeType
-// @provenance BaseType kind=passthrough level=3 ref=sdk/js/shex-orm/src/types.ts:BaseType
+// @provenance BaseType kind=passthrough level=3 ref=sdk/js/shex-orm/src/types.ts:BaseType - the cited revision keeps `"@graph"` commented out behind a TODO; the published `@ng-org/shex-orm@0.1.2-alpha.9` declares it, and it is the published one that is re-exported here
 // @provenance Schema kind=passthrough level=3 ref=sdk/js/shex-orm/src/types.ts:Schema
 export type { ShapeType, BaseType, Schema } from "@ng-org/shex-orm";
 // @provenance DeepSignalSet kind=passthrough level=3 ref=sdk/js/alien-deepsignals/src/types.ts:DeepSignalSet
@@ -152,7 +152,7 @@ export type { DeepSignalSet } from "@ng-org/alien-deepsignals";
 // The scope `useShapeQuery` takes, re-exported from the SDK rather than restated here:
 // restating it is how a type drifts, and the two axes it filters on (`graphs`,
 // `subjects`) are upstream's to change.
-// @provenance Scope kind=passthrough level=3 ref=sdk/js/orm/src/types.ts:Scope
+// @provenance Scope kind=passthrough level=3 ref=sdk/js/orm/src/types.ts:Scope - the cited revision declares `graphs?` OPTIONAL; the published `@ng-org/orm@0.1.2-alpha.21` makes it required, and it is the published one that is re-exported here
 export type { Scope } from "@ng-org/orm";
 // What `getObjects` takes: a `Scope` plus `where` and `orderBy`. It is re-exported from
 // the SDK's `/all` subpath because that is where the SDK puts it - the type the function
@@ -160,7 +160,7 @@ export type { Scope } from "@ng-org/orm";
 // choice here. Restating it would be how it drifts.
 // @provenance RdfOrmConfig kind=passthrough level=3 ref=sdk/js/orm/src/utilTypes.ts:OrmConfig - the published `@ng-org/orm@0.1.2-alpha.21` renames it `RdfOrmConfig` and re-parameterises it on the shape's type rather than its `ShapeType`, which the cited revision has not yet done
 export type { RdfOrmConfig } from "@ng-org/orm/all";
-// @provenance NG kind=passthrough level=2 ref=sdk/js/web/src/index.ts:NG — 88 members, all forwarded; the proxy adds none and removes none
+// @provenance NG kind=passthrough level=2 ref=sdk/js/web/src/index.ts:NG — every member forwarded; the proxy adds none and removes none. The count lives once, with the release it belongs to, in `surface/ng-proxy.ts`
 export type { NG } from "@ng-org/web";
 
 // ── POLYFILL-ERA — THE DELETION LIST ────────────────────────────────────────
@@ -226,7 +226,7 @@ import { wrappedNg } from "./surface/ng-proxy";
  *
  * Declared `NG` — upstream's own type for its `ng` (`index.d.ts:NG`). It was published as
  * `Record<string, any>` until 2026-08-14, which announced a different surface from the one
- * it forwards to: an application got no completion and no check on any of the 88 members.
+ * it forwards to: an application got no completion and no check on any of its members.
  */
 // @provenance ng kind=passthrough level=2 ref=sdk/js/web/src/index.ts:ng — a Proxy over the injected real `ng`; only `sparql_update` is overridden (the emulated write guard)
 export const ng: NG = wrappedNg();

packages/polyfill/src/surface/lifecycle.ts

@@ -109,7 +109,7 @@ export function init(...args: any[]): any {
  * prose, unenforceable and silent when missed - and it WAS missed, by both consumers in
  * this repository, which is how the hole was found.
  *
- * Nothing is taken from the caller: `wrappedNg()` forwards every one of the 88 members to
+ * Nothing is taken from the caller: `wrappedNg()` forwards every one of its members to
  * the very object `configure()` received, and it is the same object `ng` publishes, so the
  * ORM now reaches the engine through exactly what the application does. The remaining
  * arguments and the return value pass straight through.

packages/polyfill/src/surface/ng-proxy.ts

@@ -39,10 +39,18 @@ function graphsWrittenBy(patches: unknown): Nuri[] {
 }
 
 /**
- * Typed `NG` — upstream's own type for `ng` (`NG = typeof NGModule`, 88 exported members,
- * installed `index.d.ts:136-231`). The proxy adds no member and removes none, so this is
- * the honest declaration; it used to be `Record<string, any>`, which silently dropped all
- * 88 signatures and let any misspelt member typecheck.
+ * Typed `NG` - upstream's own type for `ng`. `NG = typeof NGModule`, the `NGModule`
+ * namespace of the installed `@ng-org/web`, which at `0.1.2-alpha.14` declares 90 members:
+ * 84 functions and 6 RDF classes. The proxy adds no member and removes none, so this is
+ * the honest declaration; it used to be `Record<string, any>`, which silently dropped
+ * every signature and let any misspelt member typecheck.
+ *
+ * The count is named with its RELEASE because it moves with one, and this one had stopped
+ * matching: the figure recorded here was two short, and two of the ninety -
+ * `graph_orm_next_page` and `graph_orm_previous_page` - appear nowhere in the cited
+ * checkout's `sdk/js/lib-wasm/src/lib.rs`, the tree that declares the PREVIOUS release
+ * `@ng-org/web@0.1.2-alpha.13`. A count with no release beside it is a claim nobody can
+ * re-check against anything, so it drifts in silence - which is what happened.
  *
  * The empty object is only the Proxy's TARGET: every property is answered by the `get`
  * trap below, never by the target, so there is nothing to put in it. Typing the target is
@@ -144,7 +152,7 @@ export function makeNg(): NG {
       // callable for the path `<member>.bind`, calling it posts a remote request named
       // after the MEMBER with the bind arguments, and what comes back is a PROMISE.
       //
-      // The published `ng` therefore answered all 88 members with a promise instead of a
+      // The published `ng` therefore answered every member with a promise instead of a
       // function, and a caller got the SDK's own `<member> is not a function`. What made
       // it invisible for months is that this library's internals never go through this
       // proxy - they call the injected `ng` directly - and every fake in the suite is a