docs+refactor(client): fidelity pass — id identity, drop connections, no faux-login, accurate NextGraph framing

Align the polyfill's surface and docs with the verified NextGraph reality and
remove application-level concepts:

- Identity is an ID, not a username: AccountRecord.id, shim predicate shim:id,
  normalizeId; accounts core becomes IdentityStore (set/clear/get) — the faux
  login/logout framing is gone (identity is set at wallet-import time).
- Relationship/connection is an application concept, not a platform primitive
  (NextGraph has no bilateral-connection primitive: grantee is unpersisted
  scaffolding, cap-send is unimplemented). Remove connections.ts; caps exposes
  only a directed grantRead(doc, granteeId) + a read-only protectedDocsOf(owner).
  Delete the now-dead isolation.ts social-visibility axis.
- Inbox docs: NextGraph has no separate curator — the recipient's own verifier
  unseals and applies each queued sealed message inline (process_inbox);
  inbox_post_link is a proposed/future API. Stop attributing the emulated
  curator to the platform.
- Read isolation reframed around the outcome: no cap -> empty union read;
  targeted read of an unheld repo -> RepoNotFound; cap introspection
  (canRead/governsRead) is emulation-only with no NextGraph API behind it.
- read-model.md corrected: the listing path is per-doc ANCHORED default-graph
  queries, never the anchorless GRAPH ?g union (that is O(wallet)); the probe
  section no longer claims the opposite.
- README recap table restructured (target | current NextGraph status | current
  emulation); INDEX_ACCOUNT documented as reservedAccount("index") in the
  sentinel namespace; de-domained generic-layer comments; softened tone.

Consumer application (Festipod) rewired separately to own the relationship
concept and feed the lib an id. Lib gates: bun test 83 pass / 0 fail, tsc clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/client/test/discovery.test.ts

@@ -102,7 +102,7 @@ function makeFakeNg() {
     // Shim account SELECT. Two shapes: the full scan (`?acc a <Account>`) and
     // the TARGETED bounded resolve (`<subj> a <Account>`), which binds one
     // subject — honour that subject filter so the bounded query is O(1)/exact.
-    if (query.includes(`<${SHIM}:username>`)) {
+    if (query.includes(`<${SHIM}:id>`)) {
       const subjM = query.match(new RegExp(`GRAPH <[^>]+>\\s*\\{\\s*<([^>]+)>\\s+a\\s+<${SHIM}:Account>`));
       const onlySubject = subjM ? subjM[1]! : null;
       const bySubject = new Map<string, Record<string, string>>();
@@ -110,16 +110,16 @@ function makeFakeNg() {
         if (q.g !== anchor) continue;
         if (onlySubject !== null && q.s !== onlySubject) continue;
         const rec = bySubject.get(q.s) ?? {};
-        if (q.p === `${SHIM}:username`) rec.username = q.o;
+        if (q.p === `${SHIM}:id`) rec.id = q.o;
         if (q.p === `${SHIM}:docPublic`) rec.docPublic = q.o;
         if (q.p === `${SHIM}:docProtected`) rec.docProtected = q.o;
         if (q.p === `${SHIM}:docPrivate`) rec.docPrivate = q.o;
         bySubject.set(q.s, rec);
       }
       const bindings = [...bySubject.values()]
-        .filter((r) => r.username)
+        .filter((r) => r.id)
         .map((r) => ({
-          username: { value: r.username! },
+          id: { value: r.id! },
           docPublic: { value: r.docPublic ?? "" },
           docProtected: { value: r.docProtected ?? "" },
           docPrivate: { value: r.docPrivate ?? "" },
@@ -167,7 +167,7 @@ function inject() {
   configure({ ng: ng as any, useShape: (() => {}) as any });
   configureStoreRegistry({
     getSession: async () => SESSION,
-    normalizeUser: (u) => u.trim().replace(/^@+/, "").toLowerCase(),
+    normalizeId: (u) => u.trim().replace(/^@+/, "").toLowerCase(),
   });
   resetRegistryCache();
   setCurrentUser(null);
@@ -256,10 +256,10 @@ test("(d) submitToIndex refuses a PROTECTED/PRIVATE document (public-only)", asy
   resetCaps();
 });
 
-test("INDEX_ACCOUNT lives in the reserved namespace (no typed username can equal it)", () => {
-  // The index account occupies a key no user input can produce: it is prefixed
-  // with a NUL control char, which a user cannot type into a username field and
-  // which no `normalizeUser` output (a typeable value) contains. So it is
+test("INDEX_ACCOUNT lives in the reserved namespace (no typed id can equal it)", () => {
+  // The index account occupies a key no consumer input can produce: it is prefixed
+  // with a NUL control char, which a user cannot type into an id field and
+  // which no `normalizeId` output (a typeable value) contains. So it is
   // disjoint from the keys "index" / "@index" a hostile user would submit.
   expect(INDEX_ACCOUNT.startsWith("\u0000")).toBe(true); // unreachable-by-typing sentinel
   expect(INDEX_ACCOUNT).not.toBe("index");