docs(readme): the variant rule is normative in the spec now, and the README still pointed at the manifest

Two loose ends from v0.7.0.

The README sent a reader to case_id_derivation.variant_suffix in the manifest
for the rule about variant cases. That was correct until v0.7.0 made the rule
normative in spec section 6 and left the manifest block as the MEASUREMENT
behind it. Left alone it reproduces in one line the defect v0.7.0 closed: a
reader sent to the wrong authority. Both are named now, each for what it is.

And the release that made a point of re-measuring '--' rather than copying the
manifest's 0.3.0 numbers forward had inherited the adjacent '__' claim
untested. Measured now across all five published id spaces - 83 lexicon ids, 7
active: ids, 3 carrier: ids, 7 malware rule ids, 19 secret-egress entry names -
neither '__' nor '--' occurs in any of them. The one-to-one transform holds, so
no text changed; the sentence was true and is now measured.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M4xrxV3EXbSALqvB23kpeY

CHANGELOG.md

@@ -9,6 +9,29 @@ Versioning note: the repository tag versions **the contract** (file set, key nam
 case ids, disposition semantics). Each JSON file additionally carries its own
 `"version"` field, bumped when that file changes.
 
+## [0.7.1] — 2026-08-13
+
+Two loose ends from `0.7.0`, neither of which changes a contract.
+
+### Fixed
+
+- **The README still named the manifest as the authority for the variant rule.** It read
+  "see `case_id_derivation.variant_suffix` in the manifest" — true until `0.7.0`, when the
+  rule became normative in `spec/conformance-corpus.md` §6 and the manifest's block became
+  the *measurement* behind it rather than the contract. Left alone it would have reproduced
+  in one line the same defect `0.7.0` closed: a reader sent to the wrong authority.
+
+### Measured
+
+- **The `__` half of the derivation was re-measured too, not just the `--` half.** `0.7.0`
+  made a point of re-measuring `--` rather than copying the manifest's `0.3.0` numbers
+  forward, while the adjacent sentence asserting that `__` "does not occur anywhere in the
+  ratified id space" was inherited untested — a claim about this release's own soundness that
+  the release did not check. Measured now across all five published id spaces: the 83 lexicon
+  ids, the 7 `active:` ids, the 3 `carrier:` ids, the 7 malware rule ids and the 19
+  secret-egress entry names carry **neither** `__` nor `--`. The one-to-one transform holds.
+  No text changed; the sentence was true. It is now true *and* measured.
+
 ## [0.7.0] — 2026-08-13
 
 **The normative spec forbade, in as many words, a case the corpus has shipped since

README.md

@@ -93,8 +93,9 @@ The corpus covers three tables, and they do not carry equal weight — treating
 number would misreport all three:
 
 - `lexicon/injection-lexicon.json` — 84 cases over 83 patterns. Both seeding runtimes
-  implement it and both ratified its id space. One pattern carries a second, variant case;
+  implement it and both ratified its id space. One pattern carries a second, variant case:
-  see `case_id_derivation.variant_suffix` in the manifest.
+  the rule for when that is legal is normative in [§6](spec/conformance-corpus.md), and
+  `case_id_derivation.variant_suffix` in the manifest carries the measurement behind it.
 - `signatures/active-content.json` — 7 cases, one per published id, the seventh added in
   v0.6.0 when the seed runtime split raw HTML into two carrier classes. One runtime
   implements it. For a runtime that