docs(carriers): the third verdict exists, and publishing an alias is what takes it away

The carrier decision request went to both runtimes today. Then re-reading our own
spec turned up an error in it: the request said the corpus has no verdict for a
case a runtime cannot reach. It has one, and this repository wrote it — §1.1
`not-applicable`, attaching to a declared table. A correction went to both.

What the correction found is sharper than the mistake. llm-security declares the
lexicon table alone (`DECLARED_TABLES`, measured at 47905da), so carrier cases
are not-applicable there today. Their suite derives the registered set by walking
each vendored file for any node carrying `aliases.llm_security`, then asserts
every registered table is declared — the §1.1 anti-narrowing floor. Granularity
is the file. So one aliased carrier id would force `codepoints/carriers.json`
into their declared set, oblige them to run all six carrier cases, and convert
the three artifact-side ones into failures. Publishing the alias is the
irreversible act, not minting the case.

manifest.json 0.3.3 -> 0.3.4; README's carrier paragraph carried the same
superseded "labels differ by pipeline stage" claim and now carries the measured
one. No case, no id and no expected.json moved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F1HPHHP1zDNk1tMKDPuLCC

CHANGELOG.md

@@ -9,6 +9,61 @@ Versioning note: the repository tag versions **the contract** (file set, key nam
 case ids, disposition semantics). Each JSON file additionally carries its own
 `"version"` field, bumped when that file changes.
 
+## [0.4.3] — 2026-08-11
+
+**No fixture, id or `expected.json` moved — a runtime that passes `0.4.2` passes `0.4.3`
+unchanged. What changed is a claim this repository made about a runtime it does not own, and the
+claim was wrong on the day it was written.**
+
+### Fixed
+
+- `conformance/manifest.json` `0.3.2` → `0.3.4` — the `scope_planned.blockers` entry for
+  `codepoints/carriers.json` described the guard as emitting two stage-coupled labels per carrier,
+  "the same split for bidi and unicode-tag". The artifact-side label for tags is
+  `lexicon:unicode-tags-present`, emitted from `lexicon.py`, and `output.py` carries a comment
+  saying it deliberately does not repeat it there. **Wrong when written, not stale:** checked at
+  `e671edb` — the commit the sibling secret-egress blocker was measured against — where
+  `coverage.py` already asserted that label, and re-measured at `a59184b`.
+
+  The correction moves the blocker rather than removing it. The guard's `Finding` carries a
+  `detector` field beside `label`, and the prefix is that field's value: `detector="lexicon"` on
+  `lexicon:unicode-tags-present`, `"output"` on `output:zero-width-present`. **The prefix names
+  the detector, not the pipeline stage** — and for tags a single detector serves both entry
+  points, which is why there is no sixth `output:` label to find. "A commons id would have to be
+  invented stage-neutral" was never the problem. Six labels exist to adopt verbatim, the way the
+  83 lexicon ids were adopted from this same runtime's port.
+
+  What blocks adoption is measured and named instead, at llm-security `47905da`: `sanitize:`
+  asserts a strip that runtime does not perform (`scanners/unicode-scanner.mjs` exports one entry
+  point, `scan(targetPath, discovery)`, reporting presence with `scanner: 'UNI'`, a prose title
+  and no id); three of the six name a persist gate it does not have, which the corpus already has
+  a verdict for — §1.1 `not-applicable`, attaching to a declared **table** — but which
+  **publishing the alias is what takes away**: that runtime's suite walks each vendored file for
+  any node carrying `aliases.llm_security` and asserts every registered table is declared, so one
+  aliased carrier id forces `codepoints/carriers.json` into a declared set of what is today the
+  lexicon alone, obliging it to run all six cases and converting the three artifact-side ones into
+  failures; and the entry point pinned for it in `measurement.runtimes` (`scanForInjection`) does not
+  reach carriers at all, so carrier cases need a per-scope entry point this manifest expresses
+  nowhere. Both runtimes already build their carrier sets from `codepoints/carriers.json`, so the
+  divergence is in what a finding is *called* and where it can be *observed*, never in which code
+  points are carriers.
+
+### Asked, not decided
+
+- The three objections went to both runtimes over coord on 2026-08-11 as a decision request, each
+  asked the question only it can answer. **Nothing was minted.** A case id is contract surface
+  consumers pin against, and publishing a single carrier alias is itself irreversible — it widens
+  another runtime's declared table set by force of that runtime's own test suite. Minting first
+  would have made a proposal into a fait accompli. The manifest records the request, so a later
+  reader can tell "asked, unanswered" from "nobody asked".
+
+- **A correction followed the request the same day, on our own error.** The request asserted that
+  the corpus had no third verdict for a case a runtime cannot reach. It has one — §1.1
+  `not-applicable` — and this repository wrote that section. The question was put before its own
+  normative spec was re-read; the follow-up says so to both runtimes and restates the choice as
+  mint-input-side-only, accept three standing failures, or publish a guard-only id space with no
+  `llm_security` alias at all.
+
 ## [0.4.2] — 2026-08-11
 
 **No data file changed and no pattern moved.** A runtime that passes `0.4.1` passes `0.4.2`