Fix documentation defects found by an adversarial review

Fifteen findings, all verified before acting. The ones that mattered:

- Corrections added without updating what they corrected. §5's table still
  said a cap-less NURI is one "without :k:", two hundred lines after §4
  established the discriminant is `r:`. Same shape of defect in the P1a
  report, which kept the sentence "it is the owner's keyring, upstream the
  keyring is the wallet" — the exact sentence §4quater declares wrong, and the
  one that produced a global in-memory keyring.

- A wrong source citation: RootCapRefresh/BranchCapRefresh live in
  verifier/src/commits/mod.rs, not repo/src/commit.rs, and are no-op stubs.

- Documentation describing deleted code: isolation.ts, discovery.readIndex,
  the global index, and an acceptance test that was dropped with discovery.

- The P1a implementation report had aged into being wrong in four places
  (caps not persisted, inbox processing not started, plain string types, the
  :k: segment). It is dated, so it now carries a header saying what later lots
  overtook, rather than being rewritten.

- vision.md stated "a document's data is stored encrypted" in the present
  tense. That is the target; here the cap value is the constant OK and nothing
  is encrypted. Said plainly now.

- Prose left mangled by an earlier mechanical find-and-replace, in four places
  I had claimed were repaired.

Also: reach.ts and connect.ts had no home in the permanent docs — the boundary
and the connection sequence are now described in simulation.md, not only in a
brief.

packages/client/src/caps.ts

@@ -63,7 +63,7 @@ export class CapRegistry {
    * whoever HOLDS the link, exactly like §5 of the brief says ("whoever has the
    * URL reads the content"), and holding it means having received it. The set
    * exists so the library can refuse to surface a document its holder never
-   * published (see `discovery.submitToIndex`).
+   * published. *(This fed `discovery.submitToIndex`, removed 2026-07-30; the flag is kept because publishing is still what turns a document into a shareable link.)*
    */
   private published = new Set<Nuri>();
   /** doc NURI → principals holding its WRITE cap. Decorative until P1b. */

packages/client/src/inbox.ts

@@ -295,7 +295,7 @@ export async function read(targetInbox: Nuri): Promise<Deposit[]> {
   await assertOwnInbox(targetInbox, "read");
   const sid = await sessionId();
   // NOTE: cold-start repo opening is done by the COLD DIRECT readers that need it
-  // (e.g. `discovery.readIndex` → `ensureInboxRepoOpen`), NOT here — `inbox.watch`
+  // (a cold reader that opens the repo before reading), NOT here — `inbox.watch`
   // already holds the repo open via its own `subscribeDoc`, so opening a second
   // bootstrap subscription from inside a watch's re-read would be redundant and can
   // race the watch's own initial-`State` delivery. Keeping `read` a pure anchored
@@ -384,7 +384,7 @@ export const materialize = read;
  * `self.repos`, so a plain anchored `read` resolves an unopened repo and silently
  * returns 0 deposits — even for a deposit a remote session already synced to the
  * broker. Gating on the sync barrier makes the read see the synced deposits. This
- * is the SAME cold-read heal `discovery.readIndex` applies to the index inbox.
+ * is the same cold-read heal any cold direct reader needs.
  *
  * NOT for the `watch` path: {@link watch} already holds the repo open via its own
  * `subscribeDoc`, so opening a second bootstrap subscription from inside a watch