Fix documentation defects found by an adversarial review

Fifteen findings, all verified before acting. The ones that mattered:

- Corrections added without updating what they corrected. §5's table still
  said a cap-less NURI is one "without :k:", two hundred lines after §4
  established the discriminant is `r:`. Same shape of defect in the P1a
  report, which kept the sentence "it is the owner's keyring, upstream the
  keyring is the wallet" — the exact sentence §4quater declares wrong, and the
  one that produced a global in-memory keyring.

- A wrong source citation: RootCapRefresh/BranchCapRefresh live in
  verifier/src/commits/mod.rs, not repo/src/commit.rs, and are no-op stubs.

- Documentation describing deleted code: isolation.ts, discovery.readIndex,
  the global index, and an acceptance test that was dropped with discovery.

- The P1a implementation report had aged into being wrong in four places
  (caps not persisted, inbox processing not started, plain string types, the
  :k: segment). It is dated, so it now carries a header saying what later lots
  overtook, rather than being rewritten.

- vision.md stated "a document's data is stored encrypted" in the present
  tense. That is the target; here the cap value is the constant OK and nothing
  is encrypted. Said plainly now.

- Prose left mangled by an earlier mechanical find-and-replace, in four places
  I had claimed were repaired.

Also: reach.ts and connect.ts had no home in the permanent docs — the boundary
and the connection sequence are now described in simulation.md, not only in a
brief.

README.md

@@ -88,7 +88,7 @@ away; the app code (SDK-shaped) is unchanged.
   testable).
 - Authorization is emulated capabilities: documents carry grants; the client
   enforces them generically (read filter + write guard). The app declares a
-  document's read policy and issues directed grants — the same acts it will
+  document, shares one document's cap to an inbox — the same acts it will
   perform in the target. No policy is injected.
 - Inbox: the client `inbox` namespace deposits (`post`) and, in the shared-wallet
   emulation, reads the deposits back (`read` / `materialize` / `watch`) in place
@@ -107,7 +107,7 @@ Implemented. The polyfill mechanisms are wired against a real broker, not stubbe
   (avoids the `@ng-org` double-proxy `DataCloneError`).
 - Emulated ReadCaps — `caps.ts` (`CapRegistry`, per-document, directed grants) +
   read filter `read-filter.ts` (reactive-set `Proxy` view), applied by
-  `use-shape.ts` only when a policy is declared.
+  `use-shape.ts` only once a cap exists (`caps.isEnforcing()`).
 - Write guard — `ng-proxy.ts` (`sparql_update` override, emulated write cap).
 - Inbox — `inbox.ts` (`post` / `read` / `materialize` / `watch`).
 - Identity — `accounts.ts` (`IdentityStore`, injected storage).