fix: un dépôt est délivré une fois et retiré, comme en amont

packages/polyfill/src/surface/read-model.ts

@@ -125,6 +125,7 @@ async function sessionId(): Promise<string | number> {
 async function readDoc(
   sid: string | number,
   doc: Nuri,
+  onUnreadable?: (doc: Nuri, error: unknown) => void,
 ): Promise<Array<Record<string, { value: string } | undefined>>> {
   try {
     const nuri = assertNuri(doc);
@@ -141,6 +142,16 @@ async function readDoc(
     return bindings(res);
   } catch (error) {
     console.error("[read-model] read failed for", doc, error);
+    // The swallow STAYS — a batch read has always tolerated one bad document, and a caller
+    // building a list from optional values must not lose the whole read to one hole. What is
+    // new (2026-08-26) is that the failure is no longer INDISTINGUISHABLE from an empty
+    // document: a caller that needs to tell them apart says so by passing `onUnreadable`.
+    //
+    // It needed telling apart because of inbox consumption. A deposit is now retired before
+    // its arm runs, so an arm that reads `[]` and concludes "absent, nothing to do" turns a
+    // broker hiccup into permanent loss — and one that concludes "must be a failure" lets a
+    // single unresolvable reference stall every deposit behind it. Only the truth serves.
+    onUnreadable?.(doc, error);
     return [];
   }
 }
@@ -165,7 +176,10 @@ async function readDoc(
  * size — a non-empty wallet no longer matters. Reads run in parallel via `Promise.all`.
  */
 // @provenance readUnion kind=aligned level=2 ref=sdk/js/lib-wasm/src/lib.rs:sparql_query — one anchored query per document — upstream's own anchoring (`resolve_target_for_sparql`), composed client-side
-export async function readUnion(docsLike: NuriLike[]): Promise<UnionSubject[]> {
+export async function readUnion(
+  docsLike: NuriLike[],
+  onUnreadable?: (doc: Nuri, error: unknown) => void,
+): Promise<UnionSubject[]> {
   const sid = await sessionId();
   // Drop the empties BEFORE validating, not after: this call has always tolerated a
   // list with holes in it — a scope index can carry a blank entry, and a caller
@@ -196,7 +210,10 @@ export async function readUnion(docsLike: NuriLike[]): Promise<UnionSubject[]> {
 
   // One anchored query per doc, in parallel, tolerant (a bad doc yields []).
   const perDoc = await Promise.all(
-    reachable.map(async (d) => ({ doc: assertNuri(d), rows: await readDoc(sid, d) })),
+    reachable.map(async (d) => ({
+      doc: assertNuri(d),
+      rows: await readDoc(sid, d, onUnreadable),
+    })),
   );
 
   // Possession gate, kept as defence in depth behind rule 2 above: `reachable`