chore: T01.f est close, le digest porte le fait RepoNotFound

.tasks/INDEX.md

@@ -1,12 +1,13 @@
 # Task Index
-_Generated 2026-09-16 from filesystem._
+_Generated from filesystem._
 
-## T01 align-the-published-surface — todo
 
-- T01.a a provenance annotation for a target announced but not yet written — todo
-- T01.b what the ORM offers for writing and deleting, and what the three remaining symbols are — todo
-- T01.c watchShape becomes useShapeQuery and takes the SDK's Scope — todo (deps: T01.a)
-- T01.d useShapeQuery reads through the SDK's shape query — todo (deps: T01.c) [blocker recorded: the open MAJOR bug names watchShape/readUnion as the unaffected paths, and the contract publishes that as the workaround]
-- T01.e publish the ORM family with the rights filter — todo (deps: T01.b, T01.d)
-- T01.f remove readUnion, and the documents that cite it — todo (deps: T01.e)
-- T01.g adversarial review of the whole published surface — todo (deps: T01.a–T01.f)
+## T01 Align the published surface on the NextGraph SDK - todo
+- T01.a A provenance annotation for a target announced but not yet written - done
+- T01.b What the ORM offers for writing and deleting, and what the three remaining symbols are - done
+- T01.c watchShape becomes useShapeQuery and takes the SDK's Scope - done (deps: [T01.a])
+- T01.d useShapeQuery reads through the SDK's shape query - done (deps: [T01.c])
+- T01.e Publish the ORM family with the rights filter - done (deps: [T01.b, T01.d])
+- T01.f Remove readUnion, and the documents that cite it - done (deps: [T01.e])
+- T01.g Adversarial review of the whole published surface - todo (deps: [T01.a, T01.b, T01.c, T01.d, T01.e, T01.f, T01.h])
+- T01.h Refresh the NextGraph packages to their latest published versions - todo (deps: [T01.f])

.tasks/doing/T01-align-the-published-surface.md

@@ -50,3 +50,4 @@ The polyfill's published surface has drifted from the SDK's: invented names, inv
 - T01.d - `useShapeQuery` reads through `RdfOrmSubscription.getOrCreate`, injected as `configure({ ormSubscription })`; absent, the read publishes `isError` naming it. Scope resolution, the `ensureReposOpen` barrier, `readUnion` and the `@type` filter are gone from that path; `graphs`/`subjects`/`did:ng:i` reach the engine verbatim. The observable, snapshot, state and capability filter stay ours. `isError` KEPT, wired to the one real failure (the query refusing to open). A start the ENGINE refuses is swallowed upstream, so it reads `isPending` for ever - recorded in code and contract, no timeout invented. `userStoreDoc` and `liveStartWithConfig` deleted. VERIFIED: `listMyEntityDocs` is NOT dead, its own suite and an e2e journey call it. The change silently broke `examples/notebook/`, repaired out of boundary and deliberately. `1.0.0-dev.6`, major, 42/42 e2e.
 - T01.e - `getObjects` and `insertObject` published WRAPPED at upstream's names, parameters and returns. Read is capability-filtered per `@graph`; the write takes `assertMayReach` + `assertMayWrite` BEFORE the call, and `graph_orm_update` now carries the same ownership guard, so the ORM rights hole is closed. NOT published, each with a checkable reason: `RdfOrmSubscription` (pooled with no identity in the key), `DiscreteOrmSubscription`, `ngSession`, `getRaw`, `watch`/`effect`, `removeObject` (in alpha.21 but absent from the pinned `nextgraph-rs`, so no citation resolves). `1.0.0-dev.7`, MAJOR. ROOT CAUSE FOUND for the consumer's `orm_start_graph is not a function`: `makeNg()`'s passthrough did `.bind(ng)`, and the SDK's `ng` is an async proxy whose `get` trap answers EVERY key including `bind` with a path-carrying callable - so the published `ng` returned a PROMISE for all 88 members. Now `Reflect.apply`, pinned by `test/ng-proxy.test.ts`. The e2e only proves it since `initNg` routes the ORM through the wrapper - before, `polyfill-entry.ts` handed `initNg` the raw SDK object, which is why the suite stayed green while the documented path was dead.
 
+- T01.f - `readUnion` and `UnionSubject` unpublished, `read-model.ts` deleted, replaced by an internal `readDocumentSubjects(doc)` doing ONE anchored query. The blocker recorded on this task was MISDIAGNOSED: it was stated as "no shape read serves a public index", but an index is read BY ANCHOR, not by shape, and `docs.sparqlQuery` already calls `fetchReadCap(anchor)` - so the public read already worked and `useShapeQuery` never needed touching. The barrier written for it was reverted. VERIFIED UPSTREAM (`engine/verifier/src/request_processor.rs:269`, `let repo = self.repos.get(repo_id).ok_or(NgError::RepoNotFound)?`): an anchored query on a repo the verifier does not know REJECTS, crossing to JS as a rejected Promise carrying `"RepoNotFound"` (`sdk/js/lib-wasm/src/lib.rs:403,606`). The observable partition is "in `self.repos`" vs "not in" - "does not exist" and "not known to me" are INDISTINGUISHABLE, while "known but unsynced" collides with "genuinely empty". No read-capability check exists on that path at all, which confirms `fetchReadCap` is emulation machinery with no upstream counterpart. Consequence: `readUnion`'s `onUnreadable` was an INVENTION, not a heritage, so shedding it is an alignment gain; the tolerance is RELOCATED to the callers, with a visible `catch`, and no tolerant batch helper replaced it. Two behaviour changes: an unreachable document is now refused out loud, and an application composing its own raw SPARQL sees the `urn:ng-eventually:` scaffolding that `readUnion` filtered - no rights move (VERIFIED: `exposeReadCap` is called only for `scope === "public"`, `account-registry.ts:1205`), but a MODEL LEAK the application must unlearn at migration. `1.0.0-dev.8`, major. The `ng-helpers` citation of `readUnion` lives in THEIR usage declaration, never in this repo's leaves - the parent's claim named the wrong document. Follow-ups left open: `useShapeQuery` opens nothing named in `scope.graphs`, `ensureReposOpen` is now dead, `examples/notebook/tsconfig.json` fails typecheck (pre-existing).