fix(manifest): the egress blocker named a premise the measurement falsified

`scope_planned.blockers` for secret egress read "19 entries … 25 at different cut
points" — one table cut at two granularities, waiting on a reconciliation of two
ports. `docs/secret-egress-divergence.md` (2d9ee9c, corrected in 4a6f6ff) measured
otherwise: they are ports of two different source tables in the same source
repository, so reconciling the ports was never going to close it.

Replaced with the three measured, independent reasons: no id space on the commons
side (seed A carries name+pattern only, and a fixture names labels); match
semantics disagree (first-match-wins against finditer over all 25 — one label
against two on the Bearer+JWT witness); membership diverges both ways and is
inherited from two different seeds, so re-measuring either port cannot close it.
Only the first is the outgoing question; the other two stand whatever the answer.

Two hand-carried numbers in the retired text corrected in place: aws-access-key-id
was not the one clean 1:1 (2/19 byte-identical, AWS not among them — the guard
anchors with \b), and `GitHub Token` maps to three guard ids, not four, leaving
ghu_ and ghr_ uncovered. `scope_planned.$comment` said "a distinct unresolved
question" — singular — and is amended alongside.

Measured here, not transcribed: `entry_points_by_scope.scopes` carries no entry for
signatures/secret-egress.json at all. Recorded as a standing requirement, not as a
fourth reason. No id string is proposed; checked against both outgoing coord
messages of 2026-08-13. No case, no signature table and no other data file touched.

conformance/manifest.json 0.5.0 -> 0.5.1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016inh17NCrQpWN3mrghfJgT

CHANGELOG.md

@@ -9,6 +9,59 @@ Versioning note: the repository tag versions **the contract** (file set, key nam
 case ids, disposition semantics). Each JSON file additionally carries its own
 `"version"` field, bumped when that file changes.
 
+## [0.7.2] — 2026-08-13
+
+**`scope_planned.blockers` named the premise that `docs/secret-egress-divergence.md`
+falsified.** The blocker read "19 entries … 25 at different cut points" — one table cut at two
+granularities, waiting on a reconciliation of two ports. Measured 2026-08-13: they are ports of
+**two different source tables** in the same source repository, so no reconciliation of the ports
+was ever going to close it. No data moves in this release, and no case is minted — only the
+recorded reason a case cannot be.
+
+### Fixed
+
+- **The egress blocker now carries the three measured reasons, kept independent.** (1) Commons
+  has no id space for this table: seed A (`hooks/scripts/pre-edit-secrets.mjs`) carries a name
+  and a pattern per entry and nothing else, so entries are keyed by human-readable `name` while
+  the guard emits `egress:<id>`, and a fixture names labels. This is the only one of the three
+  an answer can resolve, and it is the outgoing question. (2) Match semantics disagree:
+  `first match wins` with `ordering.normative: true` here, against `finditer` over all 25
+  patterns there — one witness, an `Authorization` header holding a three-part JWT, produces
+  **one** label under commons' declared contract and **two** from the guard. (3) Membership
+  diverges both ways and is inherited from two different seeds (seed A 19 entries, seed B 33,
+  the guard ported 25, 8 unported), so re-measuring either port cannot close it. The blocker
+  points to `docs/secret-egress-divergence.md` for the method behind every number.
+
+- **Two hand-carried numbers in the retired text are corrected in the same string.**
+  `aws-access-key-id` was called "the one clean one-to-one": measured, only **2 of 19** commons
+  patterns are byte-identical to a guard pattern after unescaping, and AWS is not among them —
+  the guard anchors the same run as `\bAKIA[0-9A-Z]{16}\b`. `GitHub Token` was called "four ids
+  there": measured on witnesses it maps to **three**, and leaves `ghu_` and `ghr_` covered by no
+  guard id. Both were transcription, not measurement. What is retracted is quoted in place; the
+  full retired text stands in git at `conformance/manifest.json` 0.5.0.
+
+- **`scope_planned.$comment` said "a distinct unresolved question" — singular.** Left alone it
+  would tell a reader the case becomes mintable when an answer arrives, which is true of one
+  reason in three. Amended alongside the blocker rather than after it, since the two are read
+  together.
+
+### Measured
+
+- **The standing requirement was measured here, not transcribed from the document.**
+  `entry_points_by_scope.scopes` carries **no entry at all** for `signatures/secret-egress.json`
+  — the three declared scopes are the lexicon, active-content and carriers. Entry point,
+  findings accessor and fixture presentation must be filled for both runtimes before a first
+  egress case, independently of the three reasons. It is recorded as a requirement, not as a
+  fourth reason: it would stand even if all three were resolved tomorrow.
+
+- **No id string is proposed, in this file or anywhere else.** Checked against the two outgoing
+  coord messages of 2026-08-13 rather than assumed: both state in as many words that no id is
+  being proposed. Naming an id in a shared space is the exception `carrier:*` established, it
+  requires both runtimes asked first, and both are unanswered.
+
+`conformance/manifest.json` 0.5.0 → 0.5.1. No case directory, no `expected.json` and no
+signature table changed; `git status` shows one file besides this changelog.
+
 ## [0.7.1] — 2026-08-13
 
 Two loose ends from `0.7.0`, neither of which changes a contract.