correct the architecture docs against what was measured

capabilities.md cited '== lowering to str_eq unless both operand names are in a
hardcoded int-name set' as the paradigm defect. That is wrong: __int_names comes
from type annotations, which is legitimate propagation. The real defect was 35
hardcoded builtin return types one layer down, and mislocating it hid a live
miscompilation of unannotated lets.

geometry-vs-code.md listed concurrency and error handling as open. Both are
answered: ordering is a partial order and coordination is the price of
forgetting; standing is signed, so not-known and known-false are opposite
directions rather than one boolean. Added the fourth proof form (adversarial
exactness) and recorded that form 1 no longer survives as a verdict -- every row
it justified was a basis, not a capability.

Also marked cross-cutting concerns as implemented rather than predicted.

docs/architecture/geometry-vs-code.md

@@ -43,7 +43,7 @@ correcting.
 | Self | a world-tube — a trajectory through the manifold |
 | Consolidation | episodic → semantic promotion |
 | Reification | dense regions cohering; runs on the beat, has no caller |
-| Cross-cutting concerns | **dissolved** — a hold is a *neighbour*. Adjacency, not tracking |
+| Cross-cutting concerns | **dissolved** — a hold is a *neighbour*. Adjacency, not tracking. **Implemented 2026-08-17**: a construct declares what runs at a crossing, and it resolves at execution — see the runtime seam. |
 | Effects | topology. `reach_out` is bounded by `detect_gap` and `verify` because those are its edges |
 | Capability | position relative to a boundary. In C it is already spelled `const` |
 | The AST | a projection of geometry into a tree — a surface, not the centre |
@@ -58,7 +58,7 @@ correcting.
 | CRC32 polynomial, Adler32, zlib framing | same — agreed constants, derivable from nothing |
 | Cosine, distance, the float arithmetic | the machinery that *walks* the geometry is not itself geometry |
 | Arena, refcount, allocator | bookkeeping for the **representation**, not for the positions |
-| Locks, threads, publication boundary | hardware concurrency has no geometric analogue |
+| Locks, threads, publication boundary | the hardware is code. **Ordering is not** — see Answered, above. Coordination is required only where state is non-monotone. |
 | WAL, page layout, ARIES recovery | durability against a physical device that can lose power |
 | Emission — writing C or JS text | the final surface has to be *typed out* by something |
 | OS interaction — launchd, spawn, signals | outside the system by definition |
@@ -90,12 +90,32 @@ column.
 
 ---
 
+## Answered
+
+| Thing | The answer |
+|---|---|
+| Concurrency | **Ordering is geometric.** Causality is a partial order (Lamport 1978); a total order is an arbitrary extension of it and "cannot be depended on to imply a causal relationship." Programming languages force you to write a total order, so authoring *invents* constraints the problem never had — and every lock, barrier, fence and consensus protocol is apparatus for recovering the partial order destroyed at authoring time. CALM (Hellerstein/Alvaro, proven by Ameloot et al.): a program has a consistent coordination-free implementation **iff it is monotone**. What breaks monotonicity is destructive update. **Coordination is the price of forgetting.** |
+| Error handling | **`grounded: false` covers not-knowing; it does not cover failed.** Standing is a *signed* component: `> 0` supported, `= 0` unknown, `< 0` contradicted. Not-known and known-false are opposite directions on one axis and a boolean cannot tell them apart. `inhibitory` as an int32 flag is that sign wearing a boolean. |
+
+## Fourth proof form
+
+**4 — ADVERSARIAL EXACTNESS.** Where approximation is a break, geometry is
+excluded. A cryptographic hash is a *deliberately structure-destroying* map:
+near inputs land at maximally uncorrelated outputs. Geometry is the claim that
+near things stay near — a manifold that approximated SHA-256 would *be* a break
+of SHA-256. Signature verification is the same: 0.99-valid is invalid. And
+X25519 **is** geometry, a group on an elliptic curve, which is precisely why it
+must be code: its security is the hardness of moving in that geometry.
+
+**Form 1 no longer survives as a verdict.** Every row it justified turned out to
+be a *basis*, not a capability. RFC 8259 fixes where the commas go — that is a
+surface, and projecting onto a surface is geometry. A convention describes the
+basis you project onto; it never describes an act.
+
 ## Open — not yet decided
 
 | Thing | The question |
 |---|---|
-| Concurrency | hardware threads are code, but is *ordering* geometric? |
 | Parsing | is a grammar a convention, or a region? |
 | The module system | if the partition is a neighbourhood, does linking survive? |
 | Numeric literals | is `3` a position, or a convention we agreed on? |
-| Error handling | `grounded: false` covers not-knowing. Does it cover *failed*? |