deterministic OCaml engine to compute and validate liturgical calendars for multiple rites, template-driven output to year 9999 https://git.labunix.xyz/colitur.git/atom?h=v0.6.0 2026-08-18T10:30:08Z 2026-08-18T10:30:08Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-18T10:30:08Z urn:sha1:e07d0b1f49e1bb006b12a5e612453101d9e641a7 "113. Commemoratio de Tempore fit primo loco. In admittendis et ordinandis aliis commemorationibus, servetur ordo tabellae praecedentiae." Only the second sentence was implemented, adopted on ef-rg16a as the admission and ordering criterion. The first -- the commemoration OF THE SEASON is made in the first place -- was not, so ordering ran through band alone for every commemoration including the seasonal one. Reconciled with RG 110(c), which adds the inseparable Peter/Paul pair "ante omnes alias commemorationes". Both rubrics are primary-source certain: the photographic scans' OCR is illegible at RG 110(c), but docs/research/LT.txt, the electronic transcription, carries the Rubricae Generales complete, and O'Connell's footnote 39 turns out to render that clause exactly rather than gloss it. They share a technical term. RG 113's own sentence fixes the sense of "aliae commemorationes" as the ones other than the de Tempore one it has just placed primo loco, and RG 110(c) sits three paragraphs earlier in the same code. Read consistently, the pair heads the OTHERS, not the whole list: season, then the pair, then the table order. So this runs after rg110_additions, and List.partition's stability keeps the pair adjacent while the seasonal commemoration steps in front of it. Blast radius, two full 1583-9999 sweeps diffed: 3 533 days, every one ORDER-ONLY -- the commemoration set is identical on both sides of every changed day, checked as sorted multisets, zero days where anything else moved. All are 22 February with chair-of-st-peter observed. Exactly the population measured before the rule was written. The order-sensitive test row is in test_precedence_ef.ml's admit_cases, which is still the only place in the suite that asserts commemoration order at all. It needed a mixed-origin candidate: every other candidate in that table is origin = Temporal by default, so the rule is an identity on them. 2026-08-18T09:26:04Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-18T09:26:04Z urn:sha1:01219763c87c84175fcfa469882c6f30a56720d5 RG 128(b)'s own exception list, transcribed in the rules register and primary-source-verified since Task 16, excepts "Actione liturgica feria VI in Passione et Morte Domini usque ad Communionem exclusive" from the violet that otherwise runs from Septuagesima to the Easter Vigil. RG 132 assigns black there. The register recorded this as an acknowledged gap rather than a disputed reading -- the code comment beside the Holy Thursday exception says so in as many words -- and it is closed here. Found by two witnesses outside the Divinum Officium lineage that colitur, lectio and missalemeum all share: O'Connell, The Celebration of Mass, 4th ed. (1964), revised throughout to the Codex Rubricarum (1960) and the 1962 Missal, and a published 1962 Ordo. Both say black. So does missalemeum's own colour set, which orders the day "bv". The rubric is per-action ("usque ad Communionem exclusive") and the model emits one colour per day; black is the day's principal one, the same acknowledged limit RG 126's Palm Sunday blessing already carries. Blast radius: one day per year, colour only, across the whole 1583-9999 domain. Two golden pins re-pinned. Good Friday's 46 differential rows leave C23 for a new C36 gated on the exact triple [First_f; Gospel_f; Colour_f], so C23's own exact-pair gate still means what its note says for its remaining four days: 184 + 46 = 230, no residue, both counts from the comparator rather than hand-counted. 2026-08-18T08:21:39Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-18T08:21:39Z urn:sha1:e25558fee984837389d0e53cd6e17a3820f8e5ea M11 was the one entry in the missalemeum allow-list adjudicated against colitur, and it was right to be. The calendarium directs "Com. octavae Nativitatis" under each of 26, 27 and 28 December (LT.txt:5454-5459) and RG 109(c) makes a commemoration of the days within the Octave privileged. colitur emitted none. The cause was a reasoning error stated in Temporal_ef's own comment: "26-28 Dec are Stephen, John and the Innocents, hence sanctoral". Their office is sanctoral -- those II-class feasts win the day -- but they remain days WITHIN the Octave (RG 67, "Dies infra octavam sunt II classis"), and colitur built them as generic Class4 ferias. With no octave-day candidate there was nothing for the feast to be commemorated over. Building days 2-4 exactly as days 5-7 always were makes the commemoration fall out of the existing machinery rather than needing a special case: the feast wins on rank, the octave day loses, RG 109(c) privileges it, RG 111(c)'s single slot goes to it. A second, independent defect surfaced while fixing it. The octave-day branch covered 29-31 December unconditionally, so a Sunday falling there got a feria identity -- where RG 69 says a Sunday occurring 26-31 December SEMPER keeps its own office and commemorates the feast. Confirmed against the oracle rather than argued: missalemeum shows "Sunday in the Octave of Christmas" on 2035-12-30, a Sunday, where colitur showed a feria. Both named and anchors now exclude Sundays; anchors had asserted the octave slugs unconditionally and was wrong the same way. Blast radius, full sweep against the pre-change binary: 25251 days, every one 26-31 December, exactly two shapes, zero unclassified -- 21653 carrying an octave-day slug and 3598 that are all Sundays, the RG 69 correction. Allow-lists: M11 closed and removed. C6 narrowed 138 to 119, nineteen of its days having changed temporal identity rather than verdict. M15 widened 18 to 22 -- both streams now commemorate the octave, but the candidate is temporal-origin and carries no English name to match against missalemeum's own, this entry's documented limit on four more dates. Stated rather than glossed: this trades a substantive divergence, colitur omitting a commemoration the Missal directs, for a comparator limit, the commemoration existing but not being name-matchable. That is a real improvement, but what the oracle now proves is that both streams commemorate something on those days; the identity rests on the rubric and the calendarium. Register: section 6.17. 2026-08-17T20:30:58Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-17T20:30:58Z urn:sha1:59e78716e5d7b13fd33f9c0245883c83712340e6 Two open questions closed, both by looking rather than reasoning. M13 listed three possibilities for 19 March 2027 and stayed open because none was confirmed. The live one was (b): a rubric at St Joseph's own Proprium Sanctorum entry overriding the general table, "the same shape as the Annunciation's own Attamen clause", its text simply not yet found. It was looked for directly. Joseph's entry runs from its heading straight into the Introit with no rubric of any kind -- and the analogue does not exist where the note placed it either: the Annunciation's entry does the same. That exception lives in RG 96, a general rubric about transferring an impeded I-class feast, not in its propers, so there is no precedent for a propers-level override at all. With (b) eliminated and (c) still unsupported, (a) stands: RG 91 ranks a I-class feast above a III-class Passiontide feria, Joseph is not impeded so RG 96 never engages, and colitur observes him. Recorded with its limit, because this is elimination and not proof: the specific hypothesis named is false, which is weaker than showing no rubric anywhere says otherwise. Separately, the note that Mass I of the BVM Saturday needed an Advent-Saturday oracle year to corroborate it is answered: there is no such year and cannot be. Advent has no IV-class ferias -- Class2 from 17 December, Class3 before -- and RG 78 requires a IV-class feria. Zero IV-class Advent Saturdays across 2000-2100. Its single witness is not a gap in the research but the only evidence obtainable. The branch is kept: the Missal does print the Mass for Advent, RG 309's subject being Masses that may be celebrated as votive, and an overlay producing such a day would otherwise fall through silently. Register: sections 6.13 addendum and 6.14. 2026-08-17T19:45:47Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-17T19:45:47Z urn:sha1:cffb879fa124c22acd400f59152a57d20cec036f RG 78's office has been built since ef-bvm-saturday: an otherwise unoccupied IV-class Saturday is de sancta Maria in sabbato, white, IV class. The Mass stayed the feria's, so the day observed Our Lady and then read Colossians on the parable of the weeds. That is M26 shape 1. RG 309(a) is the rule -- the Masses the Missal assigns "iuxta temporum diversitatem" -- and it prints five, each under its own season heading. All ten citations are transcribed from the scans with line numbers in the source. Masses II-V were confirmed twice, against the scan and against a live missalemeum capture of 2038 which names them and agrees on both readings. Mass I rests on the scan alone: no oracle year to hand has an Advent Saturday carrying this office. One witness where the others have two, and the code says so rather than blurring it. The mapping looked like the hard part and dissolved. The Missal's ranges are cut by civil dates and movable feasts, not by this rite's seasons -- II ends mid-season at the Purification, III spans four seasons. But measured against what a IV-class Saturday can actually be, it reduces to a seasonal mapping plus one date test at 2/3 February, with no Easter arithmetic at all: III's end to IV's start leaves the Triduum unassigned, unreachable because Holy Saturday is I class; IV's end to V's start leaves Pentecost week unassigned, also unreachable because that week's Saturday is an Ember Saturday. Time after Pentecost then begins exactly at Trinity, exactly where Mass V begins. Both gaps verified by sweep -- zero IV-class Saturdays in either across 2000-2059 -- not inferred. The office is identified structurally, never off the slug, which it deliberately shares with the ordinary feria: subject Bvm, IV class, Saturday. Blast radius: 87611 reading rows over the full domain, every one a Saturday. Allow-lists: M26 27 to 6, shape 1 gone, leaving only the Christ-the-King residue argued in colitur's favour last commit. The 2038 suite's BVM-SATURDAY-MASS class is removed rather than zeroed -- an id with no rows must not be declared. M18 355 to 376. C17 widened 397 to 445, taking its own Saturdays back from C1, C19 and C25, since one cause should not be filed under two ids; C31 89 to 103; C25 closed at 0 rows, its Holy-Name-week Saturdays now answered before step 3 is reached. Three unit tests pinned the old behaviour and are corrected rather than re-pinned: two asserted the day "keeps its ferial Mass", which was the honest thing to assert while this was unimplemented. The third still tests what it always did -- that step 4 refuses a temporal office -- and only what answers instead has changed. Register: section 6.13. 2026-08-17T15:22:43Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-17T15:22:43Z urn:sha1:2b9f8133a22ce6dc309644a98bbe61507f574b38 Date_spec carried one variant, Fixed(month, day), and its own header said Sunday- and Easter-relative forms would arrive with the OF sanctoral. They arrive early because two things needed them at once: a user-supplied overlay carrying a local movable feast had no way to express "the first Sunday of October", and Rogation Wednesday's commemoration has been recorded as architecturally blocked since 2026-08-13. That blockage turns out to have been a premise, not a fact. The register concluded the Rogation "is not Commemoration_only sanctoral data by nature... it needs a genuinely THIRD kind of thing this architecture has no name for" -- but the reasoning rested on there being "no civil (month, day) pair to anchor a Fixed entry to". That is a statement about Date_spec's expressiveness. With Easter_offset the entity is ordinary sanctoral data, the identical shape Add major-litanies already ships, differing only in how the date is written. No third channel was needed. The register is corrected rather than left contradicting the code. Two variants: Easter_offset of int, and Nth_weekday of {month; nth; weekday} with negative nth counting from the end. Fixed's sexp representation is untouched, so all 327 sanctoral entries and the whole overlay parse unchanged. Both are re-validated in t_of_sexp through their smart constructors, extending the idiom Fixed already used -- the failure that guards against is invisible, a spec deserialising into something that silently never resolves and a celebration vanishing with no diagnostic. Easter is supplied by the rite, not computed in the kernel. Computus ships Gregorian and Julian both, and picking one here would hard-code a Roman assumption into rite-agnostic code and be silently wrong for a Julian-reckoning rite. Rite.t gains an easter field; Rite_ef supplies the Gregorian one. Layer keeps a split index. Fixed entries stay in the year-independent (month, day) table, which preserves the fast path and the "30 November counted twice in a 371-day span" behaviour validate.mli documents for St Andrew. Movable entries have no year-independent key by construction -- the same spec lands on a different (month, day) each year -- so they resolve per civil year into a rata-die table. index_by_date is removed rather than kept as an alias: two ways to index a layer, one of which silently ignores movable entries, is the trap this change exists to avoid. Two domain-edge defects, both found by the suite rather than reasoning. A liturgical year is Advent-anchored, so resolving civil year y names y +/- 1, and at the edges those are 1582 and 10000, which Computus correctly refuses by raising. The ceiling surfaced through the domain-ceiling test, the floor through `colitur day 1583` failing outright. Fixed once, in Layer.index, the single point that calls the rite's easter -- a clamp repeated per caller would have been two places to get wrong a third time. Rogation Wednesday: RG 87 assigns the Litaniae minores to the Monday, Tuesday AND Wednesday before Ascension (scan1:691); colitur built the first two from the start and never the third. RG 88 keeps it out of the Office, so the Ascension Vigil remains observed. RG 89 routes it through the Major Litanies' rules, but RG 109's closed list names only maiores, so by RG 107 it is an ORDINARY commemoration -- confirmed in the output, not assumed. Name from the Missal's own "feria IV" (scan1:20495-20497), violet to match the Monday and Tuesday offices. Blast radius, full 1583-9999 sweep against the pre-change binary: 2257 days, every one the same shape, zero unclassified, line counts equal both sides. The complement is the informative half -- in the other 6160 years the Rogation does not appear at all, because RG 111 admits one commemoration on a II-class day and an impeded feast takes it under RG 113, a Commemoration_only candidate having no row in RG 91's table. Both shapes are pinned. Allow-lists unmoved: layer 3 compares no commemorations and is blind by construction, and layer 4's 2026-2027 window has a competing feast on both Wednesdays, so the Rogation is capped out in exactly the years the oracle can see. C8 is unchanged, asserted by its own count pin. Not built: Sunday-relative specs, which nothing needs yet, and the --overlay plumbing that would let a user actually supply a local movable feast. Nth_weekday therefore ships with synthetic and property coverage only; inventing a shipped entry to exercise it would be fabricating calendar data. Register: section 6.10. 2026-08-15T01:40:19Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-15T01:40:19Z urn:sha1:b0ff86ae552b90613be21c52433f4180deba7758 Two Critical findings, both real: Holy Week (including the entire Sacred Triduum) was reading Passion Week's Masses -- the original colitur_keys widened lectio's single, conflated ini section into both weeks instead of Passion week alone. Narrowed to Passion week only; Holy Week's own four cleanest days (Monday, Tuesday, Thursday, Saturday) are hand-authored directly from the Missal, verified twice against both scans (C23); Holy Wednesday and Good Friday are genuinely multi-lesson liturgies with no single Epistle slot and are deliberately left unanswered, not guessed (C24). The Lenten Ember days were still dead keys: Temporal_ef computes ef-lent-ember-{wed,fri,sat}, lectio's ini names the same data ef-lent-1-{wednesday,friday,saturday}, and colitur_keys never translated it -- both engines independently fell through to the same wrong ferial answer, so even the differential stayed green (C22, a genuine lectio bug recorded for upstream). Fixed the instance and the class: colitur_keys gained the rename, and tools/bootstrap_lectionary.ml gained assert_reachable, sweeping Rite_ef.Temporal_ef.temporal at generation time so a translation table entry naming a slug colitur never computes dies loudly instead of shipping silently, plus an informational log of every real slug with no entry at all. C21 ("colitur's step 3 cannot reach a correct answer for the fixed Christmastide slugs") is retired, superseded rather than merely patched: the Nativity-Octave days now have their own direct Missal formulary (Tit. 3,4-7/Luc. 2,15-20, "Diebus infra octavam Nativitatis Domini"), resolved at step 2, not step 3 at all. That surfaced a real RG 69 gap underneath it: a Sunday landing 26-31 December should keep its own Office, not the fixed weekday placeholder, which Temporal_ef does not currently distinguish. C6's verdict is re-opened (open, not colitur) for the 19 of its 138 rows where this applies directly, and a new entry C25 (57 rows) records the same gap propagating one hop further through step 3 into Holy Name week. Both are out of this task's own scope -- a behaviour change to a shared, multi-round-reviewed kernel-adjacent function -- and recorded, not fixed, per the coordinator's own instruction. C6's own note is rewritten in full rather than layered with another correction; C18's stale trailing count is fixed to match its own pin; the Vigil-misapplication risk flagged as a Minor closed itself once the Nativity-Octave fix landed, confirmed by inspection rather than assumed. dune test: 358/358. COLITUR_EXHAUSTIVE_SWEEP=1 dune test --force: 359/359. 2026-08-14T23:59:11Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-14T23:59:11Z urn:sha1:6b41415f17f3264454f6dcc13898948fd1902d0b Review re-verified all fifteen saints and all seven formularies against both printings and found zero citation discrepancies, confirming the Gabriel printing error and all three proper/Common reversals; the reordering was adjudicated sound. Two Important findings, both about the guard rather than the data. IMPORTANT 1 -- the guard had no test, and a comment claimed it did. `test_step4_never_diverts_a_temporal_office` asserted 2026-07-04 keeps its ferial Mass and its comment claimed to "pin it behaviourally". It did not: no shipped assignment names a temporal slug, so the guard is a NO-OP on shipped data and that test passes with the guard removed. The reviewer proved it by forcing `sanctoral_office = true` -- all 357 tests stayed green. That mattered more than an ordinary missing test: the guard is the structural claim the whole reordering argument leans on, and on a task with no oracle the tests are the entire safety net. Fixed by exposing `Commons.of_tables` (already present internally; it applies exactly `load`'s validation, so a synthetic table is a well-formed table with a WRONG assignment rather than malformed data the loader would reject before the guard is reached -- and it is the constructor a future diocesan overlay needs anyway), adding `day_with ~commons` beside `day`, and writing test_step4_guard_refuses_a_common_assigned_to_a_ferial_slug: a synthetic Commons assigning the Common of Abbots to `ef-time-after-pentecost-5-saturday`, a really-observed ferial slug, asserting 2026-07-04 still says its ferial Mass. Two checks, the first making the second mean something -- it asserts the hostile assignment IS present and resolvable, so the ferial Mass wins because the GUARD refused it and not because the lookup missed. Mutation-verified: with the guard disabled exactly one test fails, this one; before this round that mutation reddened nothing. The old test is renamed test_step4_leaves_a_temporal_office_alone_on_shipped_data and its comment corrected to say it does not pin the guard. IMPORTANT 2 -- the guard cited an authority that does not say what was claimed. The comment said "[Validate] already asserts slug uniqueness per liturgical year, so a sanctoral feast can never collide with a temporal slug". validate.ml's check maps over `Temporal.office` slugs ONLY, compared to each other across the days of one year; it says nothing about cross-stream collision. An assumption was promoted to an asserted invariant -- the exact defect class this project's citation discipline exists to catch. Rewritten to state it as an assumption (no sanctoral slug carries the `ef-` prefix every temporal slug does; 0 of 327 today), to quote the real authority verbatim (validate.ml's own note that this "is the same assumption the rest of this codebase already leans on"), to carry a CORRECTED marker naming the wrong citation so it is not re-derived, and to record the failure mode if it ever broke: benign and one-directional -- a colliding saint is denied his Common and falls through to steps 2/3, i.e. to exactly the answer the unguarded chain would have given him. No day gains a reading it should not have. MINOR -- the previous commit body led with "Blast radius, measured ... ZERO differing lines", which is true but oversold: the CLI prints no citations, so that sweep is STRUCTURALLY INCAPABLE of observing the reorder or any citation value. It is a valid negative control for the sanctoral `Edit` overlay and nothing else. The evidence for the reorder is mutation 1 (relegating step 4 to last reddens exactly the four step-4 pins) plus those pins' own explicit expected values -- not the sweep. Correcting the record here. MINOR -- test_commons_load_rejects_bad_data wrote four FIXED-name files into the temp dir and removed none, colliding across concurrent runs. Replaced with a local `with_temp_file` copied from test_lectionary.ml's own (`Filename.temp_file` + `Fun.protect ~finally`); the four labels moved into the assertion messages where they belonged. Verified zero leftovers after a full run. MINOR -- added the sharper argument for the reorder, which makes the deviation obviously right rather than merely well-evidenced, and it now LEADS the branch comment as warrant (1), with the Missal citation demoted to a corroborating warrant (2): step 4 is STEP 1'S CONTINUATION. Step 1 already runs the observed office's own proper ahead of steps 2 and 3; step 4 is that same rule for the saints whose readings the Missal keeps in a Common instead of printing on the celebration. Placing it last would have made the chain internally inconsistent with code that already existed -- St Joseph beating a competing temporal entry because his readings sit on his Celebration.t, and St Vincent Ferrer losing to one because his sit one indirection away. Nothing in the rubrics draws that distinction; it is an artefact of where colitur stores the data. So the plan's ordering did not merely disagree with the data, it contradicted step 1. 358 tests green (357 before), 359 with the exhaustive sweep. 2026-08-14T23:40:54Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-14T23:40:54Z urn:sha1:1299815ea03c2b1e4ff19d92d32e386fec24f4e4 Fifteen class-3 saints had no readings anywhere in colitur -- the 6 March - 5 April cluster whose RANKS lectio's generator fix of 2026-08-12 restored without backfilling readings, and lectio has no Commons concept to have backfilled them from. They are exactly the fifteen `status Feast` entries in data/ef/sanctoral.sexp carrying `(citations ())`. The Missal splits them eight/seven, and NOT as the plan predicted. It expected propers for Benedict, Patrick, Thomas Aquinas and Gregory the Great; only Thomas Aquinas has one. Benedict ("Missa Os iusti, de Communi Abbatum"), Patrick ("Missa Statuit, de Communi Confessoris Pontificis I loco") and Gregory the Great ("Missa Si diligis me, de Communi unius aut plurium Summorum Pontificum") are all sent to a Common, with only Oratio, Secreta and Postcommunio printed at the date. All three reversals verified on the page images (pp. 488, 492) as well as in both OCR text layers. PROPERS (data/ef/adjustments.sexp, `Edit ... Set_citation`): thomas-aquinas 7 Mar Sap 7:7-14 / Mt 5:13-19 john-of-god 8 Mar Eccli 31:8-11 / Mt 22:34-46 forty-holy-martyrs 10 Mar Hebr 11:33-39 / Luc 6:17-23 cyril-of-jerusalem 18 Mar Eccli 39:6-14 / Mt 10:23-28 gabriel-the-archangel 24 Mar Dan 9:21-26 / Luc 1:26-38 john-damascene 27 Mar Sap 10:10-17 / Luc 6:6-11 john-of-capistrano 28 Mar Sap 10:10-14 / Luc 9:1-6 francis-of-paola 2 Apr Philipp 3:7-12 / Luc 12:32-34 COMMONS (data/ef/commons.sexp), each quoting the Missal's own instruction at the saint's date: sts-felicitas-perpetua 6 Mar non Virginum I Eccli 51:1-8,12 / Mt 13:44-52 frances-rome 9 Mar non Virginum II Prov 31:10-31 / Mt 13:44-52 gregory-the-great 12 Mar Summ. Pontificum 1 Petri 5:1-4,10-11 / Mt 16:13-19 patrick 17 Mar Conf. Pont. I Eccli 44:16-27;45:3-20 / Mt 25:14-23 benedict 21 Mar Abbatum Eccli 45:1-6 / Mt 19:27-29 isidore-of-seville 4 Apr Doctorum 2 Tim 4:1-8 / Mt 5:13-19 vincent-ferrer 5 Apr Conf. non Pont. I Eccli 31:8-11 / Luc 12:35-40 Every value read in three independent places -- both OCR text layers (two DIFFERENT printings, whose Commune Sanctorum pagination differs by 1-2, so the data keys on heading plus Mass incipit and never on the bracketed page number) and the rendered page images. That caught a genuine typographical error in one printing: it gives St Gabriel's Gospel as "Luc. 2, 26-38" (on the page image, so not an OCR artefact). Luke 1:26-38 is settled by the other printing, by the pericope text in both, and by the SAME edition citing the identical pericope correctly two pages later at the Annunciation. Step 4 EXECUTES SECOND (order 1, 4, 2, 3), not last as the plan sketched. Measured: every day on which one of the fifteen is actually the observed office already has a non-empty step-2 or step-3 answer waiting, so a step 4 placed after the ferial fallback is unreachable on every date in 1583-9999 -- and wrong where it would fire (2038-03-06 would emit Septuagesima II Saturday's Mass on a day whose office is Sts Perpetua and Felicity). Step 4 is also the only step in the chain with a direct primary-source warrant: the Missal names the Mass at each such saint's own date, while steps 2 and 3 rest only on lectio's observed behaviour. Guarded so it can never divert a day whose observed office IS its temporal office -- ferias, Sundays, the Triduum and the RG 78 Saturday Office of the BVM (which deliberately shares the ferial slug) are structurally excluded. Step NUMBERS are unchanged so every "step 3" already written down still names the same branch. The Commons are caller-supplied, like the lectionary: `Rite_ef.context` gains a REQUIRED `~commons`, not an optional one -- a silently-defaulted empty table would give a rite whose class-3 saints quietly lose their Mass, and nothing in layers 3-5 compares citations, so that loss would be invisible. `Commons.load` rejects the four defects indistinguishable downstream from "this saint has no Common": duplicate common id, duplicate assignment, empty formulary, assignment naming a common that does not exist. KNOWN LIMITS, recorded rather than papered over. There is no oracle: lectio has no readings for these feasts and missalemeum's 2026-2027 window never observes one of the fifteen. Eight of the fifteen are NEVER the observed office anywhere in the domain (10-28 March always falls to a Lenten or Passiontide feria that outranks a III-class feast), so they have no end-to-end witness and are covered by dedicated table tests instead. The Commune Sanctorum's own opening rubric permits any Epistle or Gospel of a Common in any Mass of that Common unless one is assigned, so what is emitted is the reading PRINTED WITH the named formulary, not the only lawful one; labelled alternatives (e.g. the widow's Epistle 1 Tim 5:3-10, squarely available to St Frances of Rome) are noted in the data and deliberately not encoded. The BVM Common is NOT authored: the RG 78 Saturday Office shares the ordinary ferial slug, so assigning a Common to it would hand the BVM Mass to every feria sharing that slug; routing it needs a subject-keyed lookup and a season-keyed choice among the Missal's five "Missae de sancta Maria in sabbato" -- new behaviour, not new data. It currently emits its feria's Mass, now pinned as such. Blast radius, measured (git archive HEAD binary vs HEAD, full 1583-9999 `colitur day` sweep, diffed): ZERO differing lines, 3 074 246 lines each side, byte-identical -- the CLI prints no citations, so this change is invisible to layers 2-5 by construction, and the sanctoral overlay perturbed nothing else. 357 tests green (344 before), 358 with the exhaustive sweep. Mutation-tested six ways, all reverted after confirming: relegating step 4 to last reddens exactly the four step-4 pins and nothing else; corrupting a Common's citation, dropping an assignment, dropping a proper Edit, and corrupting either an unreachable proper or an unreachable Common each redden their own pins. The load-bearing assertion is stated over the loaded layer rather than a hard-coded list: every sanctoral entry that can ever BE the observed office now has either a proper or an assigned Common -- fifteen failures before, zero after, and a future re-bootstrap adding a readingless class-3 feast fails there instead of silently emitting its feria's Mass. 2026-08-14T23:06:20Z Lukasz Kasprzak lukas@labunix.xyz 2026-08-14T23:06:20Z urn:sha1:fe94cd9c4150fd6285dab49b06e23b6db42d131b Three Important findings, all traceable to the task-5 brief rather than the implementation itself; all confirmed against the real data and the real resolver before fixing, not taken on trust. 1. test_step3_uses_temporal_not_observed (2028-12-26) did not exercise step 3 at all: 26 December is always Stephen, a real sanctoral entry with its own citations, so that date resolves entirely at step 1. Its justifying comment was also wrong -- 24 December's TEMPORAL slug is ef-nativity-vigil, IDENTICAL to its observed slug (Temporal_ef.named hard-codes the Vigil for that date ahead of any Sunday computation), so there was never a temporal/observed split on that date to exploit. Replaced with 2025-02-03: 2 February 2025 (Sunday) is observed as the Purification (own citations Mal 3:1-4 / Luke 2:22-32) but its TEMPORAL identity is ef-time-after-epiphany-sunday-4 (Rom 13:8-10 / Matt 8:23-27, a different lectionary entry); 3 February has no proper of its own and reaches step 3, which must return the Sunday's TEMPORAL reading, not the Purification's. Verified against data/ef/sanctoral.sexp and data/ef/lectionary.sexp directly. 2. The termination-argument comment in lectionary_ef.ml (and its echo in lectionary_ef.mli) claimed an unguarded Sunday would loop. It would not: readings is not recursive -- step 3's fallback is one flat Lectionary.find, never a re-entrant call into readings -- so an unguarded Sunday would just repeat step 2's own already-failed lookup once (same pure inputs, same None) and return [] normally. Rewritten to say what is actually true: the guard exists because a Sunday has no PRECEDING Sunday to resume, not because skipping it would be dangerous; the chain terminates because every step consults data or a strictly earlier date, and no step ever calls back into readings. 3. Correcting the record, per instruction, rather than amending ba0adba: that commit's own body said Advent ferias carry 'Advent I's own readings copied onto the following Monday-Thursday'. Both details are wrong, verified directly against data/ef/lectionary.sexp: the duplicated readings are ef-advent-SUNDAY-2's (Rom 15:4-13 / Matt 11:2-10), not Advent I's, and they appear on ef-advent-2-monday, -tuesday, -thursday and -saturday -- four non-contiguous days, not a Monday-to-Thursday span. The in-code comment and the task-5 brief's own commit template both already said 'Advent II' correctly; only ba0adba's commit body had the error. dune test --force: 344 tests, all green (unchanged count -- one test's body changed, none added or removed).