feat(config): flavour is settable, and an INI overlay is diagnosed

The escaping flavour was the one rendering setting with no config key,
so a template whose extension says nothing needed the flag every run.
Unset still means infer, which config --show reports as (infer) rather
than (none).

Backfills the 0.8.0 and 0.9.0 changelog entries. Both were tagged by
hand rather than through 'make release', which is precisely the guard
that would have refused a release with no changelog line.

1 files changed, 9 insertions, 0 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dc47dfc..f970978 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 One line per release. Versions are git tags (`vX.Y.Z`).
 
+## [0.10.0] - 2026-08-21
+- Two configuration gaps and a diagnosis. **`flavour` is now a config key.** It was the one rendering setting with no way to set it once: `template` and `format` had keys, the escaping flavour did not, so a template whose extension says nothing about its output needed the flag on every invocation. It is normally inferred from the extension and unset still means "infer", which is why `config --show` reports `(infer)` rather than `(none)` — an unset flavour is not an absence. There is deliberately no silent fallback, because guessing it wrong yields malformed output rather than ugly output. **An INI overlay handed to `--overlay` is diagnosed rather than left to fail.** The INI form is a SOURCE format that `colitur convert` turns into the S-expression one; feeding it directly failed deep in the sexp reader with "more than one S-expression in file", naming neither the cause nor the cure — and the shipped examples under `data/ef/examples/` are exactly what someone would try it with. The detector's own first version capped its scan at 40 lines while `poland.ini`'s comment header is 43, so it silently never fired on the very file it was written for. Also: the README's about page carried three false claims — that older tags are not downloadable (true for one morning), that the OF form exists (`lib/rites/` holds `rite_ef` alone), and suite timings from a much smaller suite — and gains a status section stating not just the five validation layers but what they cannot see, since the differential and the oracle share one data lineage. 570 tests.
+
+## [0.9.0] - 2026-08-20
+- An audit of the shipped program, and the fixes it found. **The citation parser accepted OCaml integer-literal syntax**, so `Luke 1_1:5` read as chapter ELEVEN and `+5` as 5 — a transcription typo silently becoming a *different chapter*, reachable through any user overlay. Numbers are now plain digits and positive, and a descending range is rejected. **Four pairs of different books shared a full title**: 1 and 2 Corinthians both rendered "Epistola ad Corinthios", as did Thessalonians, Timothy and Peter — 108 citations in 2027 alone that a reader cannot resolve to a book. This was the Kings defect fixed one release earlier and simply not generalised. A test now forbids it, while allowing the case where two ids *are* the same book under different numbering, which a tradition relates. **Spec §8.5 went from recorded to delivered**: shipped styles did not re-parse their own rendered output — 32 of 52 Latin abbreviations and 49 of 52 full titles failed — so a citation copied out of colitur's own output into an overlay was passed through untouched and printed in the wrong language, silently. Every shipped name is now a registered spelling and `split_book` learned multi-word titles. **Overlay errors stopped naming OCaml source files at the reader**: the five-path rewriter is replaced by a generic one applied at every load path, so "rank: is not one of the allowed values (at Class9)" replaces a raw `Of_sexp_error` dump. Also: the `new-overlay` scaffold shows `citations` at the right nesting level (it documented the field without showing it, and the nesting is the single easiest thing to get wrong); `config --show` validates before printing rather than exiting 2 after five rows; error messages no longer echo whole file lines, which copied an unrelated file's contents to stderr when a flag pointed at one; and a month answers to both spellings of its own name, since an unknown template key renders as the empty string and the mistake produced a silently blank heading. `--raw` output is byte-identical to 0.8.0 across the whole domain. 569 tests.
+
+## [0.8.0] - 2026-08-20
+- Output, naming, and configurable citations — the release that made everything a reader sees a file rather than a value in code. **Rendering**: a logic-less template engine (Mustache subset, no partials, no lambdas, no code execution) with *mandatory* per-flavour escaping — `latex typst groff html xml ics none` — plus five emitters (`csv json sexp xml ics`, the last RFC 5545 with stable UIDs and 75-octet folding), `colitur table`/`render`/`emit`/`publish`, and eleven shipped templates: an ordo booklet in six flavours and a wall calendar in four. **Naming**: language tables and a config file, so slugs stop reaching the page — `ef-septuagesima-sunday-2` was printing in a booklet because nothing asserted coverage. Latin names for the whole temporal cycle and sanctoral, transcribed from the Missal, with a citation checker wired into the suite; `--raw` keeps the bare-slug form. The coverage test at first walked only the *observed* day and so never saw commemorations or transfers, which is exactly how "Commemoratio canute-martyr" reached a printed page. **Citations became configurable**: parsed into structure and re-rendered, so book names, abbreviations, punctuation and numbering tradition are each a file — `[bible]` and `[sigla]` sections in a language file, `lang/traditions.ini` for Vulgate-versus-modern numbering, three config keys and flags. Naming and renumbering are deliberately separate mechanisms; conflating them is how a citation ends up naming the wrong book. The design's own survey of "the shipped data" had read one of three citation-bearing files and missed twenty-one book tokens — `sanctoral.sexp` carries more citations than the lectionary does — and the fact was already written down in `commons.sexp`'s header, which called the inconsistency "cosmetic" because nothing parsed those strings. **Differential closure**: lectio adopted eight corrections argued from the Missal, so on those days the shared lineage is broken and colitur is no longer the outlier; the fixture was regenerated and seven divergence classes closed. Also: `publish --prune` refused a manifest entry escaping `--out` (a real traversal, found by canary), `fold_ics` was made total on arbitrary octets, and four vacuous assertions were replaced with real ones. 559 tests.
+
 ## [0.7.0] - 2026-08-18
 - A flat INI form for overlays, a reference man page, and two real local calendars. **`colitur convert FILE.ini`** transpiles a flat, section-per-slug format to the S-expression one — `status`, `subject` and `layer` all default, so an ordinary local saint's feast says only what distinguishes it, and dates flatten to `MM-DD`, `easter+N` and `oct/sun/-1`. It is a front door, not a second data model: it parses to exactly the `Overlay.t` the sexp form does, and a test asserts the two produce identical values. It is deliberately less expressive — `Add`, `Suppress`, single-field `Edit` — and refuses `Replace`, multi-field and citation edits *by name* rather than dropping them. **The conversion verifies its own output**: the emitted text is parsed back with the same function that loads an overlay and must mean what the INI said, or nothing is written — a transpiler emitting valid-but-wrong sexp is the failure a convenience format invites, and `colitur check` could never catch it. That check was wrong on the first attempt in exactly that way, re-serialising the parsed value instead of parsing the emitted text; a mutation corrupting the renderer sailed through it, and the fix makes the same mutation redden two tests. **`colitur-overlay(5)`** documents the format in full — every directive, every field, the three date shapes — and, more usefully, *how an overlay is applied*: load, merge, resolve, emit, with the point made explicit that overlay entries take part in precedence on equal terms, so "my feast does not appear" is almost always a lost contest rather than a load failure. **Two real calendars ship** beside the invented example: **Poland**, 17 entries from the *Calendarium Perpetuum pro Dioecesium Poloniae* (1964), with three unrecoverable classes marked as inferences and a warning about the 1921/1934 *Proprium Poloniae* still bound into many missals; and **Benedictine**, two entries and a comment explaining why — the monastic rite grades feasts Duplex and Semiduplex below II class, where the Roman calendar has III and IV, so most Benedictine propers cannot be expressed here at all, and rather than invent a mapping the source never states, that file lists two dozen excluded feasts by name. Both are examples, not authorities. 405 tests.