feat(client): activate ReadCap isolation via current identity + connections

Isolation was dormant (no current identity ever set). Now: setCurrentUser
records who is reading; declareConnections(neighborsOf) grants each protected
document's read cap to owner + connections. Reads discriminate through the
ReadCap filter: private→owner, protected→owner+connections, public→all. Generic
(the consumer injects identity + connections). Write-guard coverage limits
documented honestly in docs/simulation.md (real write paths bypass the JS proxy;
full enforcement awaits native caps). isolation-active.test.ts proves the
protected+connections path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/client/src/caps.ts

@@ -28,6 +28,11 @@ export class CapRegistry {
   private writers = new Map<Nuri, Set<PrincipalId>>();
   /** doc NURIs readable by everyone (public_store repos — no cap needed). */
   private publicDocs = new Set<Nuri>();
+  /** doc NURI → its declared (scope, owner), as recorded at {@link open}. Lets
+   *  a later, connection-aware sharing act (see {@link grantReadToConnections})
+   *  re-derive which documents are `protected` and who owns them, without the
+   *  consumer re-supplying that per-document — it already declared it at open. */
+  private policy = new Map<Nuri, { scope: Scope; owner: PrincipalId }>();
 
   /** Grant `principal` the READ cap of document `doc`. */
   grantRead(doc: Nuri, principal: PrincipalId): void {
@@ -53,6 +58,27 @@ export class CapRegistry {
     if (scope === "public") this.makePublic(doc);
     else this.grantRead(doc, owner);
     this.grantWrite(doc, owner);
+    this.policy.set(doc, { scope, owner });
+  }
+
+  /**
+   * Extend the read caps of every `protected` document so its owner's direct
+   * connections may read it — the sharing act "protected = owner + connections".
+   * `neighborsOf(owner)` yields the principals connected to `owner` (the consumer
+   * supplies its social graph; this layer invents no relationship). Public docs
+   * are already world-readable; private docs are untouched (owner only). Additive
+   * and idempotent: re-running after the connection graph changes only ever adds
+   * read caps for the current connections.
+   *
+   * This is the per-document ReadCap image of a native cap operation: in the
+   * target, sharing a protected repo with a connection issues that connection the
+   * repo's ReadCap. Here it grants the emulated read cap on the same unit.
+   */
+  grantReadToConnections(neighborsOf: (owner: PrincipalId) => Iterable<PrincipalId>): void {
+    for (const [doc, { scope, owner }] of this.policy) {
+      if (scope !== "protected") continue;
+      for (const connection of neighborsOf(owner)) this.grantRead(doc, connection);
+    }
   }
 
   /** Is `doc` under any READ-cap policy? (Undeclared docs are not enforced.) */
@@ -92,6 +118,7 @@ export class CapRegistry {
     this.readers.clear();
     this.writers.clear();
     this.publicDocs.clear();
+    this.policy.clear();
   }
 }