chore: T01.o est close, la fuite de droits est fermee apres cinq rondes

.tasks/doing/T01-align-the-published-surface.md

@@ -68,3 +68,4 @@ The polyfill's published surface has drifted from the SDK's: invented names, inv
 - T01.m - THE COUNT WAS ELEVEN, not the three the split had named. Deleted from `open-repo.ts`: `held`, `syncState`, `inFlight`, `settleInFlight`, `registryEpoch` - the last two IMPLIED openness through a short-circuit and nobody had ever counted them, including six adversarial rounds of T01.j. Surviving as the one answer, in `surface/subscribe.ts` (NOT `emulated-verifier/`, which is what the task file wrongly said): `fanOuts`, `establishing`, `realUnsub`, `lastState`, `attempt` - and `lastState` turned out to have been a second barrier record all along, the correct one. THE INVARIANT, written at `open-repo.ts:100-128` and on `DocChannel`: "is this document open in this session" is answered in ONE place, `docChannel(nuri)`, and `open-repo` records only the bootstrap open it ASKED FOR. Teardown is now safe BY CONSTRUCTION with no cross-module notification added, because nothing outside records openness any more; `resetOpenedRepos` disowns rather than forgets, since forgetting yields the lax `"unknown"`. CONTRACT: both non-guarantees DELETED and the arrival guarantee unqualified, `1.0.0-dev.10`, guarantee and test in the same commit - and an INDEPENDENT review attacked that first and hardest and could not break it. `462 pass / 0 fail` six times, e2e `46 passed / 46`. My own spec was wrong twice and the agent said so instead of contorting to satisfy it: the module path, and failure B's acceptance test ("2 subscribes in-window"), which is UNACHIEVABLE because the fan-out correctly dedupes. Four adversarial passes found SIX real defects in the agent's own work, including two regressions and a test of its own that asserted the defect. THE LESSON WORTH KEEPING, from the last one: it had the right fix, could not make a test discriminate, and REVERTED it - correctly - but recorded "could not construct an ordering" as an OPEN QUESTION rather than a clean bill. That wording is what let a later pass finish it. The window is exactly ONE microtask hop, swept 0-6: at 0 the clear has not happened so delivery is legitimate, at 1 a forgotten barrier is delivered, at 2+ `lastState` is already null so nothing is queued. Its earlier fake put the rejection three hops behind the replay, so the replay always won - what it had wrong was the TEST, not the remedy. Also verified by the independent review, and worth knowing because the guarantee is right for a reason nobody had written down: `"unknown"` is unreachable where a barrier was expected NOT for the stated reason, but because `fetchReadCap` -> `downloadReadCap` -> `ensurePhysicalRepoOpen` populates the open record BEFORE `mustNotAttempt` is evaluated, so even the refused path leaves a trace. Follow-ups left open: a never-settling `doc_subscribe` is unrecoverable; `public-store.attempted` skips an open after `configure`; `forgetEverything` clears four maps never.
 - T01.n - the four `@ng-org` peer ranges fixed, VERIFIED BY RESOLUTION against the registry with the real node-semver engine rather than by reading. WORSE THAN THE TASK STATED: `@ng-org/orm`'s `"*"` admitted ZERO of its 22 published versions - that library publishes no bare `0.1.2` at all, so the range was UNSATISFIABLE, not merely wrong. The other three admitted exactly 1, the stale bare `0.1.2` of 2025, and excluded every alpha. After: web `>=0.1.2-alpha.14 <0.1.2` (2 admitted, maxSatisfying alpha.15), orm `>=0.1.2-alpha.21 <0.1.2` (2), shex-orm `>=0.1.2-alpha.9 <0.1.2` (2), alien-deepsignals `>=0.1.2-alpha.13 <0.1.2` (2). The floor was taken PER PACKAGE from its own devDependencies pin rather than copying the sibling package's `alpha.13` that the task offered as an example - that floor predates its own devDep bump and is a stale artifact, not a rule. `peerDependenciesMeta: optional` confirmed correct for all four and VERIFIED rather than assumed: every `@ng-org/*` reference in `packages/polyfill/src` is `import type` only, zero runtime imports, the application injecting the real functions through `bootstrap.ts`. `examples/notebook` gained the `typecheck` script it lacked. Fresh install ends with ONE `.pnpm` store entry per package and every consuming project's realpath matching. `462 pass / 0 fail`. It also caught an error of MINE: the task file I wrote carried a baseline of 449 while the measurement says 462 - written before T01.m added its tests and never refreshed. That is the second of my own specs to carry a wrong number, after T01.m's unachievable acceptance test. Left alone, reported: `ng-e2e-helpers`' own floor looks stale for the same reason (INFERRED, out of scope).
 - T01.g - the closing review REFUTED the parent's success criterion, which is what it was for. 8 findings over 53 published symbols (not the 25 the orchestrator's naive grep counted - it measured export STATEMENTS), 41 clean. THE BLOCKING ONE IS A RIGHTS LEAK, and it is this batch's whole failure mode applied to access control: `read-filter.ts` returned non-function members RAW on the written ground that "a plain property carries no items" - true of the CITED tree (orm alpha.18, a bare `DeepSignalSet`), FALSE of the INSTALLED alpha.21, whose `useShape` returns a `UseShapeResult` carrying every identity's items on the plain properties `data`, `promise` and `subscription`. A stranger read the owner's data through all three and nothing threw. It became T01.o. Three majors: the contract instructed an injection that does not resolve (`@ng-org/orm`'s `.` maps to `core.d.ts`, which has no `useShape`); four present-tense claims that the SDK returns a bare `DeepSignalSet` are false of alpha.21, TWO of them load-bearing provenance grounds - the `readUnion` failure mode again, invisible to `provenance.test.ts` by construction; and the only live gate for the published `useShape` injects a HAND-WRITTEN substitute, so no fake in the repository returned the shipped shape, which is exactly why every gate was green. Four minors became T01.p. THE LESSON FOR THE ORCHESTRATOR, not the code: ten adversarial passes and every re-run gate of this batch were blind to this, because the only artifact exercising that path was a fake that had never been checked against what ships. A green suite is worth what its fakes are faithful to, and nobody had asked.
+- T01.o - THE RIGHTS LEAK IS CLOSED, after FIVE independent adversarial rounds. Delivered: two views (collection and result envelope) sharing one rule and one set of write traps in a single object so neither can be repaired without the other; DECIDED-OR-REFUSED as the default, which is the round-4 inversion - what the file has decided it serves is served, everything else refuses whatever its type; nine traps per view all routed through one `read` so `get`, descriptors, `has` and `ownKeys` cannot diverge; all three mutations gated on the same question with `add` additionally requiring the object to NAME a held document; every member `@ng-org/alien-deepsignals` declares non-mutating served over the readable items, pinned by a test that PARSES the shipped `dist/iteratorHelpers.js` and asserts a PARTITION (union equal, parts disjoint, exception set exactly one member) so neither a dropped member nor a smuggled second exception can pass. `1.0.0-dev.11`, `491 pass / 0 fail` exit 0, e2e exit 0 47/47, orm-live-read exit 0. WHAT THE FIVE ROUNDS FOUND, in order: three read leaks through plain properties; `add` returning the raw collection because `Set.prototype.add` returns `this`; the write side unsound plus 18 owner members broken by an over-broad refusal; a COUNT leaking through any member not spelled `size`/`length`, with the suite ASSERTING that as correct six lines above a test calling it the defect; and finally the record contradicting the code plus a gate that could not fail. THE CAUSE WAS ONE THING EVERY TIME - a justification about a value nobody executed: "a plain property carries no items" (true of the cited release, false of the built one), "the `get` trap is the read" (false for `getOwnPropertyDescriptor`), "they return void or a boolean" (false for `add`), "a primitive cannot reach an item" (false for a count), "upstream's `readOnlyArray` throws on `copyWithin`" (false - MEASURED: it runs and DESTROYS an element, while push/splice/sort/reverse/fill/shift all do throw, so refusing it is STRICTER than the target and is now recorded as a deliberate divergence), and the ECMAScript carve-out reasoning that the spec closes the KEY SET rather than the VALUE. Now a project rule, `justify-a-return-value-by-running-it`. TWO THINGS THE ORCHESTRATOR OWES: my own exit-code check read `$?` after a pipeline and measured `tail`, and every e2e figure I relayed before this task came off a SUMMARY LINE while the runner intermittently hangs after printing a clean verdict - pre-existing, now a named follow-up. AND THE STRUCTURAL LESSON: ten adversarial passes and every re-run gate were blind to the original leak because the only artifact exercising that path was a HAND-WRITTEN fake nobody had compared to the shipped shape - which then diverged twice more, once too correct (it fixed upstream's inverted `isLoading`), once too permissive (a plain array where `readOnlyArray` refuses). A green suite is worth exactly the fidelity of its doubles. Also recorded, unclosable: `console.log(result)` prints every identity's items from behind the proxy - host introspection no trap can prevent - so the contract now says not to inspect what a shape read hands you when several identities share a page.