REQ1: A product can read another product's state when trusted

[filvecchiato]

Requirement for Release 2.

The problem

Products that work on the same things keep separate copies of the state that describes
them. Host-provided storage is sealed per product and per device, so no product can read
another's, and there is no shared surface either can write to. State two products both
describe — whether an item is unwrapped, which collection is selected — diverges the
moment one of them changes it, and neither can reconcile it on its own.

The product that owns the state also has no way to say who may read it. Trust between
products is declared in the product manifest, and nothing reads that declaration, so the
only answer available is refusal.

What has to be true for Release 2

• A product reads a trusted product's state through the Host API
• Nothing is readable by default
• The product that owns the state declares who may read it, and a declared reader
  reads without the user being prompted
• Reads work whether or not the owning product is open
• A denial the user already gave outlives a later declaration that would permit the
  read
• Same behaviour on every host that claims support
• Demonstrated end to end: change state in one product, open another, see the change

Explicitly out of scope

• Writing to another product's state. Read-only this release, and by design.
• Syncing state across a user's devices. Storage is per product and per device, and
  nothing here changes that.
• Using another product's accounts or identity context. That is REQ2.