Fix documentation defects found by an adversarial review

Fifteen findings, all verified before acting. The ones that mattered:

- Corrections added without updating what they corrected. §5's table still
  said a cap-less NURI is one "without :k:", two hundred lines after §4
  established the discriminant is `r:`. Same shape of defect in the P1a
  report, which kept the sentence "it is the owner's keyring, upstream the
  keyring is the wallet" — the exact sentence §4quater declares wrong, and the
  one that produced a global in-memory keyring.

- A wrong source citation: RootCapRefresh/BranchCapRefresh live in
  verifier/src/commits/mod.rs, not repo/src/commit.rs, and are no-op stubs.

- Documentation describing deleted code: isolation.ts, discovery.readIndex,
  the global index, and an acceptance test that was dropped with discovery.

- The P1a implementation report had aged into being wrong in four places
  (caps not persisted, inbox processing not started, plain string types, the
  :k: segment). It is dated, so it now carries a header saying what later lots
  overtook, rather than being rewritten.

- vision.md stated "a document's data is stored encrypted" in the present
  tense. That is the target; here the cap value is the constant OK and nothing
  is encrypted. Said plainly now.

- Prose left mangled by an earlier mechanical find-and-replace, in four places
  I had claimed were repaired.

Also: reach.ts and connect.ts had no home in the permanent docs — the boundary
and the connection sequence are now described in simulation.md, not only in a
brief.

docs/migration-guide.md

@@ -76,9 +76,7 @@ Replace the emulated `inbox.ts` deposit (`docs.sparqlUpdate` into a shared-walle
 document) with the native `inbox_post_link` (proposed/future). On the read side the
 recipient's own verifier unseals each queued sealed message and applies it inline
 when it processes its inbox — there is no separate curator to build; the in-lib read
-emulation simply goes away (see the deferred global-index note in the top-level
-README and [`decisions/discovery-model.md`](./decisions/discovery-model.md)). The
-single global index replaces the cross-account fan-out.
+emulation simply goes away. *(There is no global index to replace the cross-account fan-out: both were removed on 2026-07-30 — you cannot discover in NextGraph, you follow links.)*
 
 ### 5. Retire the identity store → real per-user login
 Remove `accounts.ts` (the `IdentityStore` that persists the identity id in
@@ -87,11 +85,10 @@ becomes the real per-user login
 (see [`decisions/shared-wallet-login-flow.md`](./decisions/shared-wallet-login-flow.md)).
 The flow shape ("broker redirect → app") does not change.
 
-### 6. Drop the isolation scaffold
-`isolation.ts` (application-visibility scaffold) disappears against a
-different piece of infra than the caps: real per-account wallets, and the
-relationship concept the consumer application owns. Distinct axis from ReadCaps —
-remove independently.
+### 6. ~~Drop the isolation scaffold~~ — already gone
+`isolation.ts` (the old application-visibility filter) was deleted from the library;
+nothing remains to remove at migration. Kept as a numbered step so the following
+numbers stay stable across references.
 
 ### 7. Remove the build alias — the client becomes the real SDK
 The consumer application imports `@ng-org/web` / `@ng-org/orm` resolved to this lib