fix(readme): the paragraph still argued the premise our own commit retired

README.md opened the egress gap with "It is not an id question at all -- the two
runtimes carry different tables, cut at different granularities", and sent the
reader to scope_planned.blockers as the authority. Since 4356caa that blocker
opens reason (1) with "NO ID SPACE ON THE COMMONS SIDE. This is the hard
blocker." Before 0.7.2 the README was out of date; after it, two files on a
public remote disagreed, and it was our commit that made them.

The paragraph now carries the three measured, independent reasons from
docs/secret-egress-divergence.md. The counts survived the falsification, so
"different tables" and 19-against-25 are kept; only "cut at different
granularities" and the pending-reconciliation claim are gone. It deliberately
omits the outgoing question's status (true on the day written, untested by
anything, and dated in the manifest) and the standing entry_points_by_scope
requirement (a requirement, not a fourth reason).

conformance/manifest.json 0.5.1 -> 0.5.2 in the same release: the blocker
misquoted the contract it cites, rendering the value without the backticks the
field carries around `order`. The data file is unchanged and was never wrong.
Round-trip proved byte-neutrality before the edit; the read-back matched the
decoded string against the data file that owns it, since json.tool passes on
wrong escaping.

No case minted, no data file touched, no id proposed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZ5vrpu2kxcRktiW59b7s3

README.md

@@ -109,11 +109,22 @@ number would misreport all three:
   missing **name** rather than a missing capability. It lapses the moment that runtime names
   its label and the alias is added.
 
-One case remains unshipped, for the secret-egress table, and it is not blocked on effort.
-It is not an id question at all — the two runtimes carry *different tables*, 19 entries
-against 25, cut at different granularities, and a shared id space presupposes a reconciliation
-nobody has performed. `conformance/manifest.json` records that blocker under
-`scope_planned.blockers`, measured, so the gap is visible rather than inferred.
+One case remains unshipped, for the secret-egress table, and it is not blocked on effort. The
+reasons are three, they were measured, and they are independent — none of them dissolves under
+anything this repository can run alone. **(1) There is no id space on the commons side.** The
+seed this table was ported from carries a name and a pattern per entry and nothing else, so its
+entries are keyed by human-readable name while the other runtime emits `egress:<id>` labels —
+and a fixture names labels. This is the hard blocker, and the only one of the three that an
+answer can resolve; the answer belongs to the runtimes that own the seeds, not to a name coined
+here. **(2) Match semantics disagree**, and an id space would not close it: this table declares
+first-match-wins with `ordering.normative: true`, the other runtime reports every match, and one
+witness — an `Authorization` header holding a three-part JWT — produces one label here and two
+there. That difference is exactly what an `expected.json` encodes. **(3) Membership diverges in
+both directions, and the divergence is inherited rather than introduced.** The two sides hold 19
+entries and 25, but they are ports of two *different* source tables in one source repository, so
+re-measuring either port cannot close it. `conformance/manifest.json` records all three under
+`scope_planned.blockers`, and the method behind every number is in
+[the divergence measurement](docs/secret-egress-divergence.md).
 
 The carrier blocker closed in v0.5.0 and is kept, with its retired text, under
 `scope_planned.blockers_resolved` — including the correction one runtime volunteered against