chore: ng-e2e-helpers suit alpha.14, et la mise a jour des paquets devient une tache

.tasks/todo/T01.g-adversarial-review-of-the-published-surface.md

@@ -2,7 +2,7 @@
 id: T01.g
 title: Adversarial review of the whole published surface
 parent: T01
-depends_on: [T01.a, T01.b, T01.c, T01.d, T01.e, T01.f]
+depends_on: [T01.a, T01.b, T01.c, T01.d, T01.e, T01.f, T01.h]
 created: 2026-09-16
 claimed_by: null
 claimed_at: null

.tasks/todo/T01.h-refresh-the-nextgraph-packages.md

@@ -0,0 +1,26 @@
+---
+id: T01.h
+title: Refresh the NextGraph packages to their latest published versions
+parent: T01
+depends_on: [T01.f]
+created: 2026-09-21
+claimed_by: null
+claimed_at: null
+blocked: false
+---
+
+## Description
+
+Once the surface work is done, bring `@ng-org/web`, `@ng-org/orm`, `@ng-org/shex-orm` and `@ng-org/alien-deepsignals` to their latest published versions, in BOTH workspace packages, and reconcile whatever the update surfaces.
+
+**Why this is its own task and not a chore.** The 2026-09-21 update from `alpha.13/19/8/11` to `alpha.14/21/9/13` was expected to be routine and was not: it revealed that `orm_start_graph` had gained a sixth parameter (`config`, before the callback), which is exactly what a live measurement had observed against the deployed broker and attributed to the deployment being ahead. It also renamed `OrmSubscription` to `RdfOrmSubscription`, made `Scope.graphs` required, and — through a clean reinstall — exposed that six e2e files imported `ng-e2e-helpers` without the polyfill declaring it. An update against this SDK is a source of findings, so it gets a task and a gate.
+
+**What to do.** Check the published version of each of the four packages. Bump them in `packages/polyfill/package.json` and `packages/ng-e2e-helpers/package.json` together, so no two versions of a package with module-level state coexist in the tree — that duplication is the single-instance hazard the polyfill's own contract names. Reinstall with pnpm (`CI=true pnpm install --no-frozen-lockfile` when the lockfile has drifted), then read what the typechecks and the suites say rather than assuming the update was invisible.
+
+**Then verify against the real broker**, not only by typecheck: run `packages/polyfill/e2e/orm-live-read.ts` and the polyfill e2e suite. A signature that matches at compile time can still disagree with the deployment.
+
+**Record what the update revealed.** If it changes a fact already written in a doctrine leaf — an arity, a symbol name, a type's optionality — fix the leaf in the same pass. A stale fact in doctrine is worse than an absent one.
+
+## Progress
+
+## Result