Fix documentation defects found by an adversarial review

Fifteen findings, all verified before acting. The ones that mattered:

- Corrections added without updating what they corrected. §5's table still
  said a cap-less NURI is one "without :k:", two hundred lines after §4
  established the discriminant is `r:`. Same shape of defect in the P1a
  report, which kept the sentence "it is the owner's keyring, upstream the
  keyring is the wallet" — the exact sentence §4quater declares wrong, and the
  one that produced a global in-memory keyring.

- A wrong source citation: RootCapRefresh/BranchCapRefresh live in
  verifier/src/commits/mod.rs, not repo/src/commit.rs, and are no-op stubs.

- Documentation describing deleted code: isolation.ts, discovery.readIndex,
  the global index, and an acceptance test that was dropped with discovery.

- The P1a implementation report had aged into being wrong in four places
  (caps not persisted, inbox processing not started, plain string types, the
  :k: segment). It is dated, so it now carries a header saying what later lots
  overtook, rather than being rewritten.

- vision.md stated "a document's data is stored encrypted" in the present
  tense. That is the target; here the cap value is the constant OK and nothing
  is encrypted. Said plainly now.

- Prose left mangled by an earlier mechanical find-and-replace, in four places
  I had claimed were repaired.

Also: reach.ts and connect.ts had no home in the permanent docs — the boundary
and the connection sequence are now described in simulation.md, not only in a
brief.

docs/simulation.md

@@ -374,7 +374,7 @@ documents whose caps you hold, and nothing else. Proven in
 `test/isolation-active.test.ts` (a document nobody shared is unreadable; a share to
 one inbox reveals it there and only there; a bare reference reads nothing while the
 repo link opens the published document; a returning identity keeps its caps) and in
-`test/watch-shape.test.ts` (e), the acceptance test below.
+`test/cross-user-access.test.ts`, the acceptance test below.
 
 This discrimination is only observable because each entity is its own document (the
 consumer application creates per-entity docs via `createEntityDoc`) — in a mono-store
@@ -387,7 +387,7 @@ Alice owns a protected document holding a secret and a public one that carries a
 reference, and can NAME the protected document while reading nothing of it —
 publication is **not recursive**. Charlie, holding the same link plus the protected
 document's cap (delivered to his inbox), reads through the very same reference. The
-only difference between them is what what they hold holds; nobody was named to any
+only difference between them is each of them holds; nobody was named to any
 registry. And dynamically: the cap lands in Bob's inbox, his client processes it, and
 the read that was empty yields the content — the held-caps signal re-running it.
 
@@ -423,7 +423,7 @@ possession-shaped (`createEntityDoc` files a cap, `shareCap` delivers one,
 one document per entity, the per-document cap discriminates at entity granularity —
 the target's behaviour.
 
-The old item-level application-visibility filter (`isolation.ts`
+The old item-level application-visibility filter (the since-deleted `isolation.ts`
 `applyIsolation`, a `Set`-of-records filter keyed on owner+scope) is retired
 from the consumer path: the application carries no access logic — it declares its
 identity and shares caps, and trusts the SDK. Its matrix functions are