id(session): implement the documents/document frame pair (D1-040, from #535) #3762

What

Implement the D1-040 design: a documents/document ClientFrame/ServerFrame pair in the world-session protocol, modelled on records, so web and CLI clients can read the public documents — today reachable only from the SSH shell, which reads the shared server blob store directly. Scope is server-wide parity (the design's Decision 1): the frames expose exactly the set SSH exposes today; per-world scoping waits on the deferred per-world document store and is out of scope here.

Design

doc/2026-11-01T16-05-00Z_design_documents_session_frames/2026-11-01T16-05-00Z_design_documents_session_frames.md (lands with PR #3760; tracker #535 item D1-040). The design is decided — frame shapes, authorization, bounds, the serving-logic move, and test expectations are all pinned there. Read it first; this issue is the delivery vehicle, not a second design pass.

Acceptance criteria

• ClientFrame::Documents { capability, prefix, after } and ClientFrame::Document { capability, name } in pkgs/id/src/world_session/types.rs; ServerFrame::Documents { names, next_after } and ServerFrame::Document { name, size, text } per the design (no sequence on the list frame — the design records why)
• Serving logic (list_public_documents / read_public_document and their name/bounds rules) lives in the session layer next to records_session; authorization is the records rule (join capability → participant_id, else join denied); the design's one structural unknown — how the session layer reaches the blob store the SSH shell holds today — is resolved and noted on this issue
• SSH shell is frame-backed: command_frame gains documents / documents_continue / document arms mirroring records; rendered SSH output (public named files: listing, [listing truncated], --- {name} ({size} bytes; read-only) --- header, /help) is byte-identical to before
• Contract updated on both sides: frames named in pkgs/id/src/shell_contract and the shared frame contract; web contract tests extended; web client gains the minimal list + read documents panel the design specifies
• Tests per the design's test expectations: session tests mirroring records_session (paging, prefix, after exclusivity, oversized/non-viewable/missing refusals, join denied), contract accept/refuse cases, existing SSH document shell tests passing against the frame-backed path
• Existing mcpx/id CI green in GitHub Actions on the PR (note: pkgs/mcpx conformance has a pre-existing compile break on main — features_test.go:308 — do not chase it here)

Out of scope

• Document writes/publishing (unchanged), a documents_ticket replication frame (design non-goal), any change to which documents are public (id(ssh): fix #211 reconciliation gaps: total records cap, document output through send, per-world document store #548 owns the store).

Links

• Tracker: id(ssh): input and presentation designs #535 (D1-040). Design PR: docs(id): D1-040 documents frame-pair design + D1-045 command-toggle research (#535) #3760. Prerequisite: id(ssh): fix #211 reconciliation gaps: total records cap, document output through send, per-world document store #548 (closed).
• Model: records frames in pkgs/id/src/world_session/types.rs, records_session in pkgs/id/src/world_session/mod.rs.