docs: six validation layers, not five -- the LMS Ordo is wired in

Task 6 (celebrant-rubrics-phase1) added test_lms_ordo.ml as a sixth
validation layer, comparing 400 days against a printed Latin Mass
Society Ordo -- a genuinely independent fourth lineage, never passed
through Divinum Officium/missalemeum/lectio. README.md's own table
still said "Five validation layers"; man/colitur.1 still said "two
published-calendar oracles"; CLAUDE.md still said "5 layers" in two
places and, worse, stated as fact that "the published Ordo... Not
wired in as a layer" in the file every future session is instructed
to read first.

Updated all three, describing what the new layer covers (the Creed,
the BVM Saturday votive Mass's own seasonal selection, the reading
formulary override) and what it cannot see (one civil year, only
three of the formulary axis's five sources, England & Wales diocesan
propers excluded from every comparison) -- consistent with
docs/research/ordo/PROVENANCE-lms.md, not overstating it.

CLAUDE.md's own stale claim is corrected in place, not silently
rewritten, matching the file's own established convention: the
paragraph it lived in was about a DIFFERENT, earlier Ordo (unreliable
PDF column extraction, still genuinely unwired for that reason), and
its own closing prediction -- "a structured Ordo would be the only
way to add a fourth lineage" -- is exactly what the LMS Ordo's
structured extractor (tools/extract_lms_ordo.ml) has since done.
Historical "five layers" mentions elsewhere in CLAUDE.md, describing
completed state as of earlier branches, are left alone -- they were
true then, and rewriting them would misrepresent the record the same
way overstating layer 6's own coverage would.

Left README's pre-existing v0.9.0/569-tests staleness untouched, as
instructed -- it predates this branch and is a separate matter.

1 files changed, 35 insertions, 7 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 23dce0b..f4f6b7b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -100,7 +100,7 @@ overlays**.
 - **Data format**: **S-expressions** (`sexplib`/`ppx_sexp_conv`) — the OCaml type
   *is* the format, parse/print auto-derived, no hand-written parser.
 
-## Validation (the "sure bet" pillar — 5 layers)
+## Validation (the "sure bet" pillar — 6 layers)
 
 1. **Types** — illegal states unrepresentable (closed variants for ranks/colours/
    seasons; dates validated at construction; resolution total).
@@ -113,11 +113,30 @@ overlays**.
    citations).
 4. **Oracle cross-check** — vs missalemeum (EF) / litcal (OF) in lectio's `sources/`.
 5. **Golden regression** — landmark + known-tricky years pinned.
+6. **LMS Ordo cross-check** (`test_lms_ordo.ml`, added `celebrant-rubrics-phase1`) —
+   the Creed (RG 475–476), the RG 78/309(a) Saturday votive Mass's own seasonal
+   selection, and the reading-formulary override, each compared against a printed
+   Latin Mass Society Ordo for England & Wales (Peter Day-Milne, v2.21) over one
+   liturgical year, 2024-11-27–2025-12-31 (400 days). Genuinely a FOURTH lineage,
+   not a re-count of layer 4 — see the very next bullet, which this layer
+   supersedes for the "no independent witness" half of its own claim.
 
-**Status: all five layers are built and green.** Layer 2 is exhaustively clean over
+**Status: all six layers are built and green.** Layer 2 is exhaustively clean over
 all 8 417 years (`COLITUR_EXHAUSTIVE_SWEEP=1 dune test --force`, ~50 s; the default
 suite samples). Layer 3 compares 16 801 days against lectio; layer 4, 730 days
-against missalemeum; layer 5 pins ~30 dates.
+against missalemeum; layer 5 pins ~30 dates; layer 6 compares 400 days against the
+LMS Ordo, full 1:1 on the Creed axis, and found a real colitur defect on its first
+run (RG 476(f), closed — see the register).
+
+**Layer 6's own blind spots, stated plainly rather than left implied**: it covers
+ONE civil year, not the whole 2005–2050 differential window; the formulary-
+override axis compares only 3 of {!Mass_formulary.source}'s 5 constructors
+(`Own_slug` is excluded — a real, evidenced data-representation ambiguity in
+colitur's own citations, not a gap in the Ordo, and `Votive` is covered by a
+separate, dedicated seasonal-numeral check instead); and it is an England & Wales
+DIOCESAN Ordo — universal-calendar days are compared, the diocesan variant on 156
+of its 400 days is not. `docs/research/ordo/PROVENANCE-lms.md` has the full
+source citation, SHA-256 and characterisation record.
 
 **Know what each layer cannot see** — this is load-bearing, not a caveat:
 - **LAYERS 3 AND 4 ARE ONE LINEAGE, not two** (register §6.20, 2026-08-18 —
@@ -132,9 +151,18 @@ against missalemeum; layer 5 pins ~30 dates.
   The genuinely independent witness found is the **published Ordo** (clergy-
   compiled, not software): it confirmed seven colitur positions including
   three hand-authored entries missing from the entire DO tree (Major
-  Litanies, the RG 110 Peter companion, St Barbara). Not wired in as a layer —
-  its PDF columns shift between pages and extraction is unreliable; a
-  structured Ordo would be the only way to add a fourth *lineage*.
+  Litanies, the RG 110 Peter companion, St Barbara).
+  *(CORRECTED, `celebrant-rubrics-phase1`, 2026-08-22: this paragraph
+  previously ended "Not wired in as a layer — its PDF columns shift between
+  pages and extraction is unreliable; a structured Ordo would be the only
+  way to add a fourth lineage." That is still true of THIS SPECIFIC Ordo
+  (the one that confirmed the three entries above) — it remains unwired,
+  for that exact reason. But its own closing prediction has since been
+  fulfilled by a DIFFERENT, later-acquired published Ordo: the Latin Mass
+  Society's, structurally parseable (`tools/extract_lms_ordo.ml`), now
+  wired in as layer 6 — see the validation section above. Two distinct
+  printed Ordos, not one: this file's own historical entries about the
+  first should not be read as describing the second.)*
 - **THE CHAIN IS NOW BROKEN AT ONE LINK, AND LAYER 4 IS THE OUTLIER**
   (2026-08-18). lectio has ADOPTED eight corrections colitur argued from the
   Missal — `ubaldus`/`didacus` promoted to III-class feasts, both August
@@ -354,7 +382,7 @@ Litanies, Barbara and Rogation Wednesday. `Overlay.merge` is
 last-writer-wins, so a local calendar can still override a universal entry
 by naming its slug. Refused on `easter`/`temporal` (they read no sanctoral
 data) rather than silently ignored. **An overlay is applied, not validated**
-— the five layers assert things about the SHIPPED data and cannot vouch for
+— the six layers assert things about the SHIPPED data and cannot vouch for
 a user file; a directive matching nothing warns on stderr and continues, a
 file that fails to load is fatal. Worked example, both a fixed and a movable
 local feast: `test/fixtures/overlay-example-diocesan.sexp`.