docs: six validation layers, not five -- the LMS Ordo is wired in

Task 6 (celebrant-rubrics-phase1) added test_lms_ordo.ml as a sixth
validation layer, comparing 400 days against a printed Latin Mass
Society Ordo -- a genuinely independent fourth lineage, never passed
through Divinum Officium/missalemeum/lectio. README.md's own table
still said "Five validation layers"; man/colitur.1 still said "two
published-calendar oracles"; CLAUDE.md still said "5 layers" in two
places and, worse, stated as fact that "the published Ordo... Not
wired in as a layer" in the file every future session is instructed
to read first.

Updated all three, describing what the new layer covers (the Creed,
the BVM Saturday votive Mass's own seasonal selection, the reading
formulary override) and what it cannot see (one civil year, only
three of the formulary axis's five sources, England & Wales diocesan
propers excluded from every comparison) -- consistent with
docs/research/ordo/PROVENANCE-lms.md, not overstating it.

CLAUDE.md's own stale claim is corrected in place, not silently
rewritten, matching the file's own established convention: the
paragraph it lived in was about a DIFFERENT, earlier Ordo (unreliable
PDF column extraction, still genuinely unwired for that reason), and
its own closing prediction -- "a structured Ordo would be the only
way to add a fourth lineage" -- is exactly what the LMS Ordo's
structured extractor (tools/extract_lms_ordo.ml) has since done.
Historical "five layers" mentions elsewhere in CLAUDE.md, describing
completed state as of earlier branches, are left alone -- they were
true then, and rewriting them would misrepresent the record the same
way overstating layer 6's own coverage would.

Left README's pre-existing v0.9.0/569-tests staleness untouched, as
instructed -- it predates this branch and is a separate matter.

3 files changed, 58 insertions, 12 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 23dce0b..f4f6b7b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -100,7 +100,7 @@ overlays**.
 - **Data format**: **S-expressions** (`sexplib`/`ppx_sexp_conv`) — the OCaml type
   *is* the format, parse/print auto-derived, no hand-written parser.
 
-## Validation (the "sure bet" pillar — 5 layers)
+## Validation (the "sure bet" pillar — 6 layers)
 
 1. **Types** — illegal states unrepresentable (closed variants for ranks/colours/
    seasons; dates validated at construction; resolution total).
@@ -113,11 +113,30 @@ overlays**.
    citations).
 4. **Oracle cross-check** — vs missalemeum (EF) / litcal (OF) in lectio's `sources/`.
 5. **Golden regression** — landmark + known-tricky years pinned.
+6. **LMS Ordo cross-check** (`test_lms_ordo.ml`, added `celebrant-rubrics-phase1`) —
+   the Creed (RG 475–476), the RG 78/309(a) Saturday votive Mass's own seasonal
+   selection, and the reading-formulary override, each compared against a printed
+   Latin Mass Society Ordo for England & Wales (Peter Day-Milne, v2.21) over one
+   liturgical year, 2024-11-27–2025-12-31 (400 days). Genuinely a FOURTH lineage,
+   not a re-count of layer 4 — see the very next bullet, which this layer
+   supersedes for the "no independent witness" half of its own claim.
 
-**Status: all five layers are built and green.** Layer 2 is exhaustively clean over
+**Status: all six layers are built and green.** Layer 2 is exhaustively clean over
 all 8 417 years (`COLITUR_EXHAUSTIVE_SWEEP=1 dune test --force`, ~50 s; the default
 suite samples). Layer 3 compares 16 801 days against lectio; layer 4, 730 days
-against missalemeum; layer 5 pins ~30 dates.
+against missalemeum; layer 5 pins ~30 dates; layer 6 compares 400 days against the
+LMS Ordo, full 1:1 on the Creed axis, and found a real colitur defect on its first
+run (RG 476(f), closed — see the register).
+
+**Layer 6's own blind spots, stated plainly rather than left implied**: it covers
+ONE civil year, not the whole 2005–2050 differential window; the formulary-
+override axis compares only 3 of {!Mass_formulary.source}'s 5 constructors
+(`Own_slug` is excluded — a real, evidenced data-representation ambiguity in
+colitur's own citations, not a gap in the Ordo, and `Votive` is covered by a
+separate, dedicated seasonal-numeral check instead); and it is an England & Wales
+DIOCESAN Ordo — universal-calendar days are compared, the diocesan variant on 156
+of its 400 days is not. `docs/research/ordo/PROVENANCE-lms.md` has the full
+source citation, SHA-256 and characterisation record.
 
 **Know what each layer cannot see** — this is load-bearing, not a caveat:
 - **LAYERS 3 AND 4 ARE ONE LINEAGE, not two** (register §6.20, 2026-08-18 —
@@ -132,9 +151,18 @@ against missalemeum; layer 5 pins ~30 dates.
   The genuinely independent witness found is the **published Ordo** (clergy-
   compiled, not software): it confirmed seven colitur positions including
   three hand-authored entries missing from the entire DO tree (Major
-  Litanies, the RG 110 Peter companion, St Barbara). Not wired in as a layer —
-  its PDF columns shift between pages and extraction is unreliable; a
-  structured Ordo would be the only way to add a fourth *lineage*.
+  Litanies, the RG 110 Peter companion, St Barbara).
+  *(CORRECTED, `celebrant-rubrics-phase1`, 2026-08-22: this paragraph
+  previously ended "Not wired in as a layer — its PDF columns shift between
+  pages and extraction is unreliable; a structured Ordo would be the only
+  way to add a fourth lineage." That is still true of THIS SPECIFIC Ordo
+  (the one that confirmed the three entries above) — it remains unwired,
+  for that exact reason. But its own closing prediction has since been
+  fulfilled by a DIFFERENT, later-acquired published Ordo: the Latin Mass
+  Society's, structurally parseable (`tools/extract_lms_ordo.ml`), now
+  wired in as layer 6 — see the validation section above. Two distinct
+  printed Ordos, not one: this file's own historical entries about the
+  first should not be read as describing the second.)*
 - **THE CHAIN IS NOW BROKEN AT ONE LINK, AND LAYER 4 IS THE OUTLIER**
   (2026-08-18). lectio has ADOPTED eight corrections colitur argued from the
   Missal — `ubaldus`/`didacus` promoted to III-class feasts, both August
@@ -354,7 +382,7 @@ Litanies, Barbara and Rogation Wednesday. `Overlay.merge` is
 last-writer-wins, so a local calendar can still override a universal entry
 by naming its slug. Refused on `easter`/`temporal` (they read no sanctoral
 data) rather than silently ignored. **An overlay is applied, not validated**
-— the five layers assert things about the SHIPPED data and cannot vouch for
+— the six layers assert things about the SHIPPED data and cannot vouch for
 a user file; a directive matching nothing warns on stderr and continues, a
 file that fails to load is fatal. Worked example, both a fixed and a movable
 local feast: `test/fixtures/overlay-example-diocesan.sexp`.
diff --git a/README.md b/README.md
index d1b2ed2..5f4724f 100644
--- a/README.md
+++ b/README.md
@@ -145,7 +145,7 @@ v0.9.0, EF only. **569 tests**, of which the property suite runs against every
 year in 1583-9999 rather than a sample — that is how confidence extends past
 the ~2050 horizon of any reference to check against.
 
-Five validation layers, each blind to something the others catch:
+Six validation layers, each blind to something the others catch:
 
 | | |
 |---|---|
@@ -153,12 +153,18 @@ Five validation layers, each blind to something the others catch:
 | properties | invariants over all 8 417 years (QCheck) |
 | differential | 16 801 days compared against the sibling `lectio` engine |
 | oracle | three captured years compared against missalemeum |
+| ordo | one liturgical year compared against a printed Latin Mass Society Ordo |
 | golden | 11 pinned template outputs |
 
 Knowing what each layer *cannot* see is load-bearing here: the differential and
-the oracle share one data lineage (Divinum Officium → missalemeum → lectio →
-colitur), so an error inherited by both is invisible to either. That is written
-up in full in `docs/` rather than left implied.
+the missalemeum oracle share one data lineage (Divinum Officium → missalemeum
+→ lectio → colitur), so an error inherited by both is invisible to either. The
+Ordo layer is a genuinely separate lineage — a clergy-compiled book, never
+passed through that chain — but has its own blind spots: it covers one civil
+year, only three of the reading-formulary's five sources (a documented
+data-representation ambiguity excludes the rest), and England & Wales
+diocesan propers are excluded from every comparison, universal-calendar days
+only. That is written up in full in `docs/` rather than left implied.
 
 **Chants are deliberately absent.** Psalm, Tract, Alleluia and Sequence have no
 source and no oracle, so `Validate` rejects any citation part outside
diff --git a/man/colitur.1 b/man/colitur.1
index 29f5640..09414ea 100644
--- a/man/colitur.1
+++ b/man/colitur.1
@@ -1002,7 +1002,7 @@ rather than silently ignored.
 .PP
 .B An overlay is applied, not validated.
 This program's test layers \(em properties over every year in the domain, a
-differential against a sibling engine, two published\-calendar oracles, and
+differential against a sibling engine, three published\-calendar oracles, and
 hand\-verified pins \(em assert things about the
 .I shipped
 calendar. None of them can vouch for a file you supply. A directive naming a
@@ -1568,6 +1568,18 @@ emits. Published calendars \(em missalemeum, Divinum Officium, gcatholic \(em
 are used as comparison oracles in the test suite only: a divergence from one
 is flagged loudly and adjudicated against the Missal, never silently adopted.
 Several such divergences have been resolved in this engine's favour.
+Missalemeum's own data derives from Divinum Officium, so those two are one
+lineage rather than two independent witnesses; a printed
+.I Ordo
+from the Latin Mass Society of England and Wales, compiled directly from the
+Missal and never passed through that lineage, is used as a genuinely
+independent oracle for one liturgical year (Advent 2024 through the end of
+1962's 2025) \(em the Creed rubric, the Saturday votive Mass of Our Lady's
+own seasonal selection, and which Mass a day borrows, each compared against
+it in full. It covers only the universal calendar (its own diocesan propers
+and local patrons are excluded from every comparison), one civil year, and
+one publisher's transcription \(em a divergence against it is a question,
+not a verdict, the same discipline applied to every other oracle here.
 .SH LIMITATIONS
 Only the Extraordinary Form (1962) is implemented; the Ordinary Form is a
 planned peer module, not an overlay of this one.