feat(client): union-read ReadCap gate + listMyEntityDocs + doc corrections

- read-model.ts `readUnion` now applies the emulated ReadCap gate (drops a
  subject when its doc is governsRead && !canRead for the current identity), so
  per-scope isolation holds by construction AND by filter.
- store-registry: `listMyEntityDocs(username, scope)` (current account only) vs
  the all-accounts `listEntityDocs` fallback (documented as the enumeration to
  avoid on the read path).
- docs: nextgraph-current-state / read-model — corrected to the SOURCE-VERIFIED
  reality that the JS SDK exposes NO open/sync-by-cap primitive
  (load_repo_from_read_cap is pub(crate)); in the mono-wallet all repos are
  already local (same session), so the anchorless union spans them with no open
  step. simulation.md: listEntityDocs+useShape({graphs}) is a fallback, not the
  read path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/client/src/read-model.ts

@@ -34,7 +34,7 @@
  */
 
 import { docCreate, sparqlUpdate, sparqlQuery } from "./docs";
-import { getStoreRegistryDeps } from "./polyfill";
+import { getStoreRegistryDeps, getCaps, getCurrentUser } from "./polyfill";
 import { assertNuri } from "./sparql";
 import type { Nuri } from "./types";
 
@@ -72,17 +72,26 @@ async function sessionId(): Promise<string> {
 }
 
 /**
- * Open/sync ONE doc into the session store by running a cheap anchored probe
- * query against it (`resolve_target_for_sparql(anchor)` opens that repo). Per-doc
- * and tolerant: a doc that can't be opened (not yet synced, no cap) throws HERE,
- * in isolation, and is skipped — it never aborts the listing of the others (the
- * fan-out ORM's failure mode). Returns whether the open succeeded.
+ * Touch ONE doc with a cheap anchored `ASK`, tolerant per-doc.
+ *
+ * VERIFIED (T03.k, see docs/nextgraph-current-state.md § *A repo is only queryable
+ * once OPENED/synced*): the current JS SDK exposes **no primitive that SYNCS an
+ * unknown repo**. An anchored `sparql_query` resolves via `resolve_target_for_sparql`
+ * → `self.repos.get(id).ok_or(RepoNotFound)` — it never PULLS an absent repo (and
+ * neither do `doc_subscribe` nor `orm_start_graph`; the real loader
+ * `load_repo_from_read_cap` is `pub(crate)`, unexposed). So this `ASK` cannot sync:
+ * on a repo already in `self.repos` (every doc `doc_create`d this session — which,
+ * in the mono-wallet polyfill, is ALL of them) it is a no-op that confirms presence;
+ * on a genuinely-absent repo it throws `RepoNotFound` HERE, in isolation, and the
+ * doc is skipped — never aborting the listing of the others (the ORM fan-out's
+ * failure mode). Returns whether the touch succeeded.
+ *
+ * At the real multi-store migration this becomes a real sync: opening a per-user
+ * store repo by cap is a native broker fetch (`verifier.rs:1423` `OpenRepo` TODO).
  */
 async function openDoc(sid: string, doc: Nuri): Promise<boolean> {
   try {
     const nuri = assertNuri(doc);
-    // ASK is the cheapest way to touch (hence open) the repo; the result is
-    // irrelevant — the side effect (repo opened into the union) is the point.
     await sparqlQuery(sid, "ASK { ?s ?p ?o }", undefined, nuri);
     return true;
   } catch (error) {
@@ -126,6 +135,16 @@ export async function readUnion(docs: Nuri[]): Promise<UnionSubject[]> {
     return [];
   }
 
+  // Cap gate (defence-in-depth). The union spans every OPENED graph, so a subject
+  // whose DOCUMENT is under a read policy the current user may not satisfy must be
+  // dropped — isolation holds BY CONSTRUCTION (the app only resolves docs it is
+  // entitled to) AND BY FILTER here. Generic: the lib owns the cap registry; a doc
+  // under no policy (`!governsRead`) flows through unchanged. In this polyfill each
+  // subject IRI IS its own document NURI, so the cap key is the subject.
+  const caps = getCaps();
+  const user = getCurrentUser();
+  const denied = (doc: string): boolean => caps.governsRead(doc) && !caps.canRead(doc, user);
+
   const bySubject = new Map<string, UnionSubject>();
   for (const row of rows) {
     const s = row.s?.value;
@@ -133,6 +152,7 @@ export async function readUnion(docs: Nuri[]): Promise<UnionSubject[]> {
     const o = row.o?.value;
     const g = row.g?.value ?? "";
     if (!s || !p || o === undefined) continue;
+    if (denied(s)) continue;
     let entry = bySubject.get(s);
     if (!entry) {
       entry = { subject: s, graph: g, props: {} };