feat(client): union-read ReadCap gate + listMyEntityDocs + doc corrections

- read-model.ts `readUnion` now applies the emulated ReadCap gate (drops a
  subject when its doc is governsRead && !canRead for the current identity), so
  per-scope isolation holds by construction AND by filter.
- store-registry: `listMyEntityDocs(username, scope)` (current account only) vs
  the all-accounts `listEntityDocs` fallback (documented as the enumeration to
  avoid on the read path).
- docs: nextgraph-current-state / read-model — corrected to the SOURCE-VERIFIED
  reality that the JS SDK exposes NO open/sync-by-cap primitive
  (load_repo_from_read_cap is pub(crate)); in the mono-wallet all repos are
  already local (same session), so the anchorless union spans them with no open
  step. simulation.md: listEntityDocs+useShape({graphs}) is a fallback, not the
  read path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/nextgraph-current-state.md

@@ -176,13 +176,29 @@ and the web variant at ~`553-610`) reads the target from the `nuri` arg: a strin
 
 A repo's triples enter `graph_dataset` (hence the union) only after the repo is
 opened/synced into `self.repos` **and** its commits applied via `update_graph`.
-Paths that open a repo: `doc_create` (own docs), bootstrap /
-`load_repo_from_read_cap`, or being followed from a store's `ldp:contains` / a
-shared cap / an inbox. Opening requires possessing the repo's **NURI + ReadCap** —
-there is **no store-level read inheritance** (see § Capability / ReadCap
-granularity). *(INFERRED: that "following a graph reference makes a previously
-unknown repo known/openable" is the one step not read verbatim in source; the
-open-requires-cap and no-inheritance facts around it ARE verified.)*
+
+**VERIFIED (T03.k) — there is NO JS primitive to sync an *unknown* repo.** Every
+JS entry point that could "open" a repo — `sparql_query` anchored,
+`doc_subscribe` (`Fetch::Subscribe`), `orm_start_graph` — resolves its target via
+`resolve_target`/`resolve_target_for_sparql`, which does
+`self.repos.get(repo_id).ok_or(RepoNotFound)` (`request_processor.rs:155/163/264/269`).
+None of them PULLS a repo that is absent from `self.repos`; they only touch a repo
+already there. The primitive that actually loads a repo from its ReadCap,
+`Verifier::load_repo_from_read_cap` (`verifier.rs:2237`), is **`pub(crate)` —
+unexposed to JS**; it is only reached internally (bootstrap, inbox processing). So
+from JS today a repo becomes queryable ONLY by being `doc_create`d in this session
+(own docs) or synced by an internal path — never on demand by NURI+ReadCap.
+
+**Consequence for this lib's mono-wallet polyfill:** every account's documents are
+`doc_create`d in the ONE shared wallet within the SAME session, so they are ALL
+already in `self.repos` and queryable by the anchorless union **without any per-doc
+open step**. `read-model.ts`'s per-doc anchored `ASK` is therefore a *no-op* on a
+present repo and an instant `RepoNotFound` skip on an absent one — it never SYNCS
+(it cannot). The union query alone spans all same-session repos. At the real
+multi-store migration this gap closes: opening a real per-user store repo by cap is
+a native broker sync (the `OpenRepo` TODO at `verifier.rs:1423`), and the open step
+becomes a real sync. Opening still requires the repo's **NURI + ReadCap** — there is
+**no store-level read inheritance** (see § Capability / ReadCap granularity).
 
 ### The union is READ-ONLY — writes must target one document
 

docs/read-model.md

@@ -14,7 +14,14 @@ The governing constraints (all verified in `nextgraph-rs`, cited there):
 - `sparql_query` with **no anchor** → the **LOCAL UNION** of all opened graphs;
   with an anchor → **one** repo. Union is **read-only**.
 - A repo is queryable **only after it is opened/synced** (needs its NURI + ReadCap;
-  no store-level read inheritance).
+  no store-level read inheritance). **VERIFIED (T03.k):** the current JS SDK exposes
+  **no primitive that syncs an *unknown* repo** — `sparql_query`/`doc_subscribe`/
+  `orm_start_graph` all resolve via `self.repos.get().ok_or(RepoNotFound)` and only
+  touch a repo already present; the real loader `load_repo_from_read_cap` is
+  `pub(crate)`, unexposed. In THIS mono-wallet polyfill that is fine: every account's
+  docs are `doc_create`d in the SAME session, so they are all already in `self.repos`
+  and the anchorless union spans them with no per-doc open needed. The open step
+  becomes a real broker sync only at the multi-store migration.
 - **No reactive union query**, and the reactive ORM **hangs** if handed a per-entity
   / unsynced graph fan-out (`RepoNotFound` aborts `orm_start_graph`).
 
@@ -128,8 +135,9 @@ explicit `GRAPH ?g` body spans every opened graph independently of the anchor.
 The anchor's "one repo" restriction is observable only for a body that reads the
 **default graph** (no `GRAPH` wrapper). The read model never needs the anchored
 form for listing — it uses the anchorless `GRAPH ?g` union — so this does not
-affect it. (The per-doc **open** step in `read-model.ts` uses an anchored `ASK`
-purely for its side effect of opening the repo, not to restrict a read.)
+affect it. (The per-doc "open" step in `read-model.ts` uses an anchored `ASK`
+only to CONFIRM presence — it cannot sync an unknown repo, see the VERIFIED note
+above; a repo absent from `self.repos` throws `RepoNotFound` and is skipped.)
 
 ## Implementation — `read-model.ts`
 

docs/simulation.md

@@ -69,8 +69,15 @@ public/protected/private stores — on top of one shared wallet.
   is its own document/repo with a future inbox) and appends its NURI to the
   account's **scope index document** — the index doc plays the role of the future
   **store-container** (it lists the entity-document NURIs "in" that scope).
-  `listEntityDocs(scope)` unions the contained NURIs across all accounts — the
-  read fan-out. Use the returned NURIs as `useShape(shape, { graphs })`.
+  `listEntityDocs(scope)` unions the contained NURIs across all accounts. This is a
+  **fallback / test-only** path, NOT the read path: enumerating every account and
+  handing the NURIs to `useShape({ graphs })` opens/syncs other accounts' possibly-
+  unsynced docs and HANGS (the ORM fan-out, ~75s — see
+  [`read-model.md`](./read-model.md)). The real READ path is
+  `readModel.readUnion(docs)` (open/sync by-need + ONE anchorless union
+  `sparql_query`); the app resolves the by-need doc set from the discovery index
+  (public events) and `listMyEntityDocs(username, scope)` (my own account, bounded —
+  no cross-account fan-out).
 - **GENERIC by construction.** The registry knows only the three native scopes,
   **zero** application entity kind. The consumer maps its entities to a scope and
   injects the session + username normalization via `configureStoreRegistry({