fix: les cinq types de champs de EventuallyConfig rejoignent la barriere polyfill-era

NgLike, UseShapeLike, OrmSubscriptionLike, GetObjectsLike et InsertObjectLike
n'existent que pour decrire ce que configure() recoit (les champs de
EventuallyConfig), et configure()/EventuallyConfig sont deja, sans ambiguite,
sur la liste de suppression - verifie en relisant index.ts : configure et
EventuallyConfig sont bien sous la barriere POLYFILL-ERA. Les cinq portaient
deja l'annotation honnete kind=invention level=none ref=none (aucun equivalent
cible), mais siegeaient sous l'entete qui promet un equivalent cible pour
chaque symbole liste.

Deplace les cinq exports sous la barriere, a cote de EventuallyConfig. Aucune
signature ne change - memes noms, memes formes, toujours exportes depuis cette
entree unique - seule la classification qui dit a un consommateur ce qu'il
supprimera a la migration est corrigee.

C'est un PATCH au sens de la politique de version du contrat concept : rien ne
bouge sous ## Surface ni ## Guarantees. Version 1.0.0-dev.12 -> 1.0.0-dev.13,
entree ajoutee au contrat concept et a docs/api-contract.md section 14, dans le
meme commit que le changement.

.project/concepts/app-contract/polyfill-surface/contract_polyfill-surface.md

@@ -283,11 +283,13 @@ What each level means here, in this package's own terms:
 - **minor** — a symbol is added and nothing existing moves (`inbox.readSyncedForDocument` arrived this way).
 - **patch** — a fix that changes neither the published surface nor anything above under `## Guarantees`.
 
-**A tag says where it comes from.** A release cut on `main` carries a **full version** (`1.0.0`), and the three rules above govern what changes between two full versions. Work still on a branch carries a **pre-release** of the version it is heading for (`1.0.0-dev.12`), which sorts *below* that version by construction - so you can pin what exists today while the tag itself tells you the surface has not been released and may still move before it is. Between two pre-releases of the same version nothing is promised: re-pull and read this leaf again. When the branch lands, the full version appears alongside; the pre-release keeps resolving, so no reference you pinned is ever withdrawn from under you.
+**A tag says where it comes from.** A release cut on `main` carries a **full version** (`1.0.0`), and the three rules above govern what changes between two full versions. Work still on a branch carries a **pre-release** of the version it is heading for (`1.0.0-dev.13`), which sorts *below* that version by construction - so you can pin what exists today while the tag itself tells you the surface has not been released and may still move before it is. Between two pre-releases of the same version nothing is promised: re-pull and read this leaf again. When the branch lands, the full version appears alongside; the pre-release keeps resolving, so no reference you pinned is ever withdrawn from under you.
 
-**Tags carry the package name**, because this repository publishes more than one engagement and their versions move independently: `polyfill/v1.0.0-dev.12` is this package, `ng-e2e-helpers/v...` is the other one. A bare `v...` tag would say nothing about which surface it froze the day the two diverge - which is the day one of them takes a major and the other does not.
+**Tags carry the package name**, because this repository publishes more than one engagement and their versions move independently: `polyfill/v1.0.0-dev.13` is this package, `ng-e2e-helpers/v...` is the other one. A bare `v...` tag would say nothing about which surface it froze the day the two diverge - which is the day one of them takes a major and the other does not.
 
-`1.0.0` is a baseline, not a claim of maturity: it is the number that makes your pin mean something. Nothing was released before it, so none of the changes named above is a bump from anything - but the next release very likely is a major. What exists today is `1.0.0-dev.12`, on a branch: pin that string exactly, and anchor your `usage_` leaf's `against:` on it - `against: @ng-eventually/polyfill@1.0.0-dev.12`, the string you pinned, never the version it is heading for.
+`1.0.0` is a baseline, not a claim of maturity: it is the number that makes your pin mean something. Nothing was released before it, so none of the changes named above is a bump from anything - but the next release very likely is a major. What exists today is `1.0.0-dev.13`, on a branch: pin that string exactly, and anchor your `usage_` leaf's `against:` on it - `against: @ng-eventually/polyfill@1.0.0-dev.13`, the string you pinned, never the version it is heading for.
+
+`1.0.0-dev.13` is a **patch**: `NgLike`, `UseShapeLike`, `OrmSubscriptionLike`, `GetObjectsLike` and `InsertObjectLike` moved from the entry's SDK-SHAPED section to its POLYFILL-ERA one, beside `EventuallyConfig`, whose fields they type. No signature changed - same five names, same five shapes, all still exported from this one entry - so nothing under `## Surface` or `## Guarantees` moved, which is the patch/major line this leaf draws itself. What changed is classification only: each was already honestly annotated `kind=invention level=none ref=none` (no target counterpart, at any level), sitting under a heading that promises one for every symbol it lists, because each exists solely to describe what `configure` receives and `configure` was already on the deletion list. An application that already understood it would stop typing these five the day it deletes its `configure()` call was not misled about behaviour; this patch only makes the surface say so, instead of implying the opposite.
 
 `1.0.0-dev.12` is a **major**, and it is one removal: **`Schema` (`@ng-org/shex-orm`) and `DeepSignalSet` (`@ng-org/alien-deepsignals`) are gone from the entry, and nothing replaces them.** Both were re-exported type-only under `## Surface`'s own rule - a type is published only when a published signature uses it - and neither was: `DeepSignalSet` is named only in prose describing what `useShape`'s result carries, never as an actual type anywhere in this package, and `Schema` was named nowhere at all beyond the re-export itself. The same rule already removed `ReadCap` and `InboxScope` from this list; this is that rule catching a second, later recurrence. If your code names either type, it stays DEFINED nowhere in this package to fall back on - name the SDK package directly (`@ng-org/shex-orm`, `@ng-org/alien-deepsignals`) if you need it.
 

docs/api-contract.md

@@ -782,14 +782,18 @@ The entry used to say `export * from "./model/types"`, a blanket re-export publi
 > **A type is published only if a PUBLISHED SIGNATURE uses it.**
 
 ```ts
+export type { Nuri, NuriLike, PrincipalId } from "./model/types";
+// ... elsewhere in the entry, in the POLYFILL-ERA block beside EventuallyConfig
+// (moved there in 1.0.0-dev.13 - see below):
 export type {
-  Nuri, NuriLike, PrincipalId, NgLike, UseShapeLike, OrmSubscriptionLike,
+  NgLike, UseShapeLike, OrmSubscriptionLike, GetObjectsLike, InsertObjectLike,
-  GetObjectsLike, InsertObjectLike,
 } from "./model/types";
 ```
 
 Each one's warrant: `Nuri` is what every reference-returning call returns and `NuriLike` what every entry accepts (§ 10, § 11); `Scope` left this list in `1.0.0-dev.5` - the read takes the SDK's own `Scope`, re-exported from `@ng-org/orm`, and a store is named by its reference (§ 5, § 12); `PrincipalId` is `ensureIdentity`'s return and a field of `Deposit`, `PostOptions` and `EventuallyConfig` (§ 2bis, § 9, § 1); `NgLike`, `UseShapeLike`, `OrmSubscriptionLike`, `GetObjectsLike` and `InsertObjectLike` type the five injected members of `EventuallyConfig` (§ 1), the last two since `1.0.0-dev.7` (§ 6bis). `OrmSubscriptionHandle` - what the last of them RETURNS - is deliberately not published: an application hands the shape query in and reads the snapshot back, and publishing the handle would offer a path around the capability filter and the shared-wallet identity boundary.
 
+**These five moved out of this list in `1.0.0-dev.13` (2026-09-28), into the entry's POLYFILL-ERA block beside `EventuallyConfig` - a PATCH, not a removal: same five names, same five shapes, still exported from this one entry.** Each was already annotated `kind=invention level=none ref=none` (honestly - none has a target counterpart at any level), which had always sat oddly under the entry's SDK-SHAPED heading ("a target counterpart for every symbol"). All five exist only to describe what `configure` receives, and `configure` / `EventuallyConfig` were already on the deletion list (§ 1: "NO COUNTERPART, by design... `configure` / `configureStoreRegistry` are deleted"). The move corrects which list tells a consumer their fate at migration; it changes nothing under `## Surface` or `## Guarantees` in the concept contract, so it is a patch by that leaf's own `## Change policy`.
+
 Two types the blanket export published are now internal, each because **nothing published names it**:
 
 - **`ReadCap`** — no published signature takes or returns one. Its users are two private helpers of `surface/inbox.ts` (`capsSeenIn`, `capOfPayload`) and the emulated registers. Publishing it advertised a value a consumer has no published call to obtain, and deliberately so: `linkTo` was removed precisely for handing one out (§ 0 of `readcap-and-nuri-model.md`), and `mintCap` is unreachable from outside (§ 11). The only use a consumer could make of it is a cast — which is what the surface's permissive-in / precise-out design exists to make unnecessary.

packages/polyfill/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ng-eventually/polyfill",
-  "version": "1.0.0-dev.12",
+  "version": "1.0.0-dev.13",
   "type": "module",
   "description": "Polyfill of the NextGraph JS SDK over @ng-org/web + @ng-org/orm, with emulated capabilities and inbox. Drop-in; remove at migration.",
   "main": "./src/index.ts",

packages/polyfill/src/index.ts

@@ -91,21 +91,21 @@
 // is named only in prose describing what `useShape`'s result envelope carries, never as
 // an actual type anywhere in this package. Unlike `ReadCap` / `InboxScope`, neither has
 // an internal use to stay DEFINED for: they are simply gone, not moved.
-// Each one, and the signature that earns it its place:
+//
+// `NgLike`, `UseShapeLike`, `OrmSubscriptionLike`, `GetObjectsLike` and `InsertObjectLike`
+// left THIS section on 2026-09-28, for a third reason again the opposite of the first two:
+// each is honestly `kind=invention level=none ref=none` - no counterpart answers, at any
+// level - and this section's own heading promises one for every symbol it lists. All five
+// exist only to describe what `configure` receives (they type `EventuallyConfig`'s
+// fields), and `configure` / `EventuallyConfig` are already below, on the deletion list:
+// they go with it. The move changes no signature - same names, same shapes, still
+// exported from this one entry - it only corrects which of the two lists tells a consumer
+// their fate at migration. See them beside `EventuallyConfig` below.
+// Each one still SDK-shaped, and the signature that earns it its place:
 //   Nuri          every reference the surface RETURNS
 //   NuriLike      every reference the surface ACCEPTS
 //   PrincipalId   `ensureIdentity`, `inbox.Deposit`/`PostOptions`, `EventuallyConfig`
-//   NgLike        `EventuallyConfig.ng`
+//   RdfOrmConfig  `getObjects`
-//   UseShapeLike  `EventuallyConfig.useShape`
-//   OrmSubscriptionLike  `EventuallyConfig.ormSubscription`
-//   GetObjectsLike       `EventuallyConfig.getObjects`
-//   InsertObjectLike     `EventuallyConfig.insertObject`
-//   RdfOrmConfig         `getObjects`
-//
-// `OrmSubscriptionHandle` - what that last one RETURNS - is deliberately NOT here. An
-// application hands the shape query in and reads the snapshot back; it never holds a
-// subscription, and publishing the handle would offer a path around the capability filter
-// and the shared-wallet identity boundary. It stays defined in `model/types.ts`.
 //
 // `Scope` left this list in `1.0.0-dev.5`, and it is the only one that left because the
 // TYPE was wrong rather than unreachable. It was `"public" | "protected" | "private"` -
@@ -115,16 +115,7 @@
 // takes the SDK's `Scope` now (re-exported below, from the SDK itself), and a store is
 // named by its reference. The three strings stay DEFINED in `model/types.ts` as
 // `StoreType`, where the library's own modules still tell the three apart.
-export type {
+export type { Nuri, NuriLike, PrincipalId } from "./model/types";
-  Nuri,
-  NuriLike,
-  PrincipalId,
-  NgLike,
-  UseShapeLike,
-  OrmSubscriptionLike,
-  GetObjectsLike,
-  InsertObjectLike,
-} from "./model/types";
 export { useShape } from "./surface/use-shape";
 export { useShapeQuery } from "./surface/use-shape-query";
 export type { ShapeQuery, ShapeObservable } from "./surface/use-shape-query";
@@ -182,6 +173,28 @@ export type { NG } from "@ng-org/web";
  */
 export { configure } from "./shared-wallet/bootstrap";
 export type { EventuallyConfig } from "./shared-wallet/bootstrap";
+// The five field types of `EventuallyConfig` above, moved down beside it on 2026-09-28 -
+// they used to sit in the SDK-SHAPED section, which was wrong: each is honestly `kind=
+// invention level=none ref=none`, and each exists only to describe what `configure`
+// receives. They go with `configure` at migration; nothing here survives it.
+//   NgLike               `EventuallyConfig.ng`
+//   UseShapeLike         `EventuallyConfig.useShape`
+//   OrmSubscriptionLike  `EventuallyConfig.ormSubscription`
+//   GetObjectsLike       `EventuallyConfig.getObjects`
+//   InsertObjectLike     `EventuallyConfig.insertObject`
+//
+// `OrmSubscriptionHandle` - what `OrmSubscriptionLike` RETURNS - is deliberately NOT
+// here either. An application hands the shape query in and reads the snapshot back; it
+// never holds a subscription, and publishing the handle would offer a path around the
+// capability filter and the shared-wallet identity boundary. It stays defined in
+// `model/types.ts`.
+export type {
+  NgLike,
+  UseShapeLike,
+  OrmSubscriptionLike,
+  GetObjectsLike,
+  InsertObjectLike,
+} from "./model/types";
 // `RegistrySession` went with `getSession` (2026-08-12): it was published for exactly one
 // reason — an application typed the session thunk it injected with it — and a published
 // type whose signature is gone is a promise about the target that nothing keeps. Upstream a