docs: correct README and data README claims that drifted from the code

The README said the hot list refreshes on a schedule and the model is
trained weekly. Both are regenerated by hand. It also said the full database
syncs weekly (SyncWorker runs every 6 hours), that the model threshold is 0.7
(the shipped weights carry 0.653332 and SpamMLScorer reads it from the file),
that a not-spam report subtracts votes (merge_community_reports only parks a
community-only row for review until the maintainer approves it), and that hot
ranges need 3+ numbers (generate_hot_list wants 4 qualifying numbers and 6
reporters between them).

data/README said reports arrive through Issues and PRs, that the app fetches
spam_numbers.json whole, and that PhoneBlock's hashed lookup runs at runtime.
Reports come through the Worker, the app diffs shards against the signed
manifest, and ExternalLookup has no PhoneBlock code left.
docs/reproducible-builds.md described CI APK artifacts no workflow builds.

CHANGELOG: d522387 dropped the v1.7.36 heading, so its notes sat under
v1.7.37. The Unreleased drain entry now names database versions 40 and 41,
since the 280 files went in over two merges (132 added, 28 + 3 updated).

Also clears the prose semicolons and spaced hyphens left outside the version
highlights, which the getting-started item moves out of the README.

Author: SysAdminDoc

CHANGELOG.md

@@ -191,14 +191,14 @@ The rest of this section takes effect when the report Worker is next deployed.
 - The README now explains the signing-key rotation. Releases v1.7.26 through
   v1.7.29 shipped unsigned and the original keystore password was lost, so the
   key was rotated at v1.7.37. Upgrading over an older install can fail with a
-  signature mismatch; the new Installing section covers exporting a backup
+  signature mismatch. The new Installing section covers exporting a backup
   first and gives the signer certificate SHA-256 to check an APK against. That
   caveat had only ever appeared in a comment on a closed issue.
 - New sideload troubleshooting for GrapheneOS, CalyxOS and stock Android 13+.
   A sideloaded app is put behind restricted settings, so the SMS role and
   notification access are hidden and the permission dialog either never appears
   or appears and changes nothing. The README names the "Allow restricted
-  settings" path and distinguishes it from a genuinely denied permission.
+  settings" path and tells it apart from a permission that's really denied.
 - The detection-pipeline section states that a blocked text still reaches your
   inbox, and why: only the default SMS app controls delivery.
 - `data/README.md` now carries a contract for anything reading the published
@@ -209,13 +209,21 @@ The rest of this section takes effect when the report Worker is next deployed.
 - Corrected the string, plural and database-size counts, and gated all three so
   they cannot drift again. The database figure moves on every community merge
   and was the only count nothing checked.
+- Corrected README claims that had drifted from the code. The trending feeds
+  and the ML model are regenerated by hand, not on a schedule, and the full
+  database syncs every 6 hours rather than weekly. The model's threshold comes
+  from its weights file (0.653 today, not 0.7). A "not spam" report can only
+  put a community-only number up for review, a campaign range needs 4
+  trending numbers and 6 reporters, and the app doesn't call PhoneBlock at all.
+- The v1.7.36 notes had lost their heading and sat under v1.7.37. They have
+  their own section again.
 
 ### Data
 
 - Drained a 280-file community report backlog that had been accumulating since
-  the 2026-08-24 merge. Database version 40 adds 132 numbers and updates 31,
-  bringing the total to 51,634. Coverage outside North America grew most:
-  Colombia to 71 rows, Mexico to 36, Russia to 6.
+  the 2026-08-24 merge. Database versions 40 and 41 add 132 numbers and update
+  31 between them, bringing the total to 51,634. Coverage outside North America
+  grew most: Colombia to 71 rows, Mexico to 36, Russia to 6.
 - The merge now lists every submission it rejects as implausible, and reports
   how many were collapsed as duplicates, so a drain that dropped a third of the
   queue no longer reads the same as one that dropped nothing. Votes dropped for
@@ -239,7 +247,7 @@ The rest of this section takes effect when the report Worker is next deployed.
 ### Translations
 
 - A shipped locale can no longer decay silently. Each has a coverage floor in
-  `scripts/translation_floors.json` and dropping below it fails the build;
+  `scripts/translation_floors.json`, and dropping below it fails the build.
   zh-rCN starts at 76.1%. A locale with no recorded floor warns instead, so
   adding a translation does not break the build before anyone sets one.
 - `check_translations.py --update-floors` now only ever raises a floor. Run
@@ -291,6 +299,8 @@ The rest of this section takes effect when the report Worker is next deployed.
 - Blocked +8651667456713, an audiobook-course robocall reported through the
   in-app flow and the issue tracker (issue #20). Database version 38.
 
+## v1.7.36 (2026-08-12)
+
 ### Interface
 
 - Paged the Room-backed database, blocked-log, grouped-log, dashboard, and