Retire legacy sources and verify managed iOS deployment

docs/api-dotnet.md

@@ -132,7 +132,7 @@ erasure of every runtime/library copy.
 
 `VoiceCat.Codec` and `VoiceCat.Dsp` call the desktop `voicecat_media` native library
 through source-generated `LibraryImport`. It links pinned Opus 1.5.2 and the existing
-vendored RNNoise; it has no dependency on libvoicecat or its C ABI. Fixed C signatures
+vendored RNNoise; it has no dependency on the retired native core or its C ABI. Fixed C signatures
 wrap Opus controls so P/Invoke never calls C varargs. SafeHandle owns every native
 encoder, decoder, DRED parser/state, and denoiser, including failed initialization.
 
@@ -168,7 +168,7 @@ can try FEC/PLC. Only consume recovery output on success. Parse/native errors th
 `RnnoiseProcessor.Process(Span<short>, sampleRate)` operates in place on complete
 480-sample mono chunks at 48 kHz. Other rates pass through unchanged; partial chunks
 at 48 kHz throw instead of leaving a tail silently untreated. Float scratch is
-preallocated, and rounding/clipping matches the C++ processor. Use distinct instances
+preallocated, and rounding/clipping is covered by canonical vectors. Use distinct instances
 for stereo channels when the later pipeline supports stereo microphone denoising.
 Noise reduction does not gate speech.
 
@@ -230,7 +230,7 @@ Database v2 has no DRED column; CRUD rejects DRED rather than silently losing it
 
 Session permissions gate kick/ban/move/mute and account operations. Only administrators
 can grant permissions; account-administration permission cannot grant administrator status.
-These two permission restrictions are stricter than the C++ oracle. Moves bypass channel
+These two permission restrictions are intentional managed-server policy. Moves bypass channel
 passwords but respect capacity and clear streams. Server mute/deafen immediately updates
 encrypted routing. Kick/ban retire routing before closure and emit one LEFT with the reason.
 Account bans persist by username; guest bans persist by address because nicknames are not
@@ -281,7 +281,7 @@ The reaper sends a fatal disconnect, removes presence/routing and broadcasts one
 event. Valid UDP activity keeps a TCP-idle client alive. Shutdown cancels and awaits
 the accept, reaper, control and media loops before disposing credentials/storage.
 
-`AccountStore(path)` retains the C++ schema version 2, accepts version 1 migration,
+`AccountStore(path)` uses schema version 2 and accepts version 1 migration,
 and rejects unknown revisions. Opening an existing channel table does not reseed it.
 Account creation/authentication uses parameterized SQL; two password workers bound
 per-store Argon2 work. Failed authentication leaves `last_login` unchanged. Dispose
@@ -293,7 +293,7 @@ the native administration CLI; there is no automatic bootstrap account.
 Argon2id v19 PHC strings: 16-byte salt, 32-byte output, new-hash parameters
 64 MiB memory, two iterations, parallelism one. Verification supports up to 128 MiB,
 ten iterations, parallelism four and 1024 UTF-8 password bytes; malformed or excessive
-hashes fail closed. Standard C++ interactive-cost accounts are preserved. These
+hashes fail closed. Standard interactive-cost Argon2id accounts are preserved. These
 bounds intentionally reject imported hashes above those costs. Native fixtures cover
 ASCII, Unicode and embedded NUL; the database oracle verifies cross-implementation
 authentication in both directions.