Merge branch 'ef-sanctoral-audit': the sanctoral against the Missal

The first full check of all 327 sanctoral entries against the primary
calendarium, read from page images of both photographic scans rather
than either PDF's OCR text layer -- the second scan's layer interleaves
its two print columns row by row and is unusable.

Findings that stand: St Barbara (4 December), a Commemoratio both scans
carry with her own Mass propers, absent from colitur and from lectio's
source alike -- 7196 clean additions, never displacing anything. And 18
colour corrections, all traced to the same bootstrap defect as the
earlier eusebius-confessor fix, now shown systemic rather than isolated;
several of lectio's own Polish name fields contradict its own colour
tag.

The Commemoration_only ranks are reframed rather than resolved: the
calendarium carries 57 Commemoratio lines and not one gives a class
numeral, for anyone. That is a source ceiling, not 105 open questions,
and nothing a primary-source read can close.

Three corrections did not survive review and are reverted here. RG
120(f) names Cathedrae S. Petri (22 februarii) and Conversionis S. Pauli
(25 ianuarii) in its own enumeration of white, fifteen lines above the
RG 124(b) they were cited to; RG 124(b)'s own 'in eorum die natalicio'
excludes them independently; RG 475(e) confirms it a third time. Both
oracles said white because both were right.

The cause is worth more than the entries: the page-image method was
applied to the calendarium and not to the rubric, and in the text layer
the two-column interleave hyphen-splits Cathedrae so it does not grep. A
text-layer read of that chapter finds 124 and cannot find 120(f).

Two safeguards had been reporting this correctly and were overridden --
a golden pin asserting white, edited to red and rewritten to guard
against restoring it, and two allow-lists told to ignore divergences
where both oracles were correct. Both restored.

Anastasia (25 December) was found and deliberately not added: she is
scoped to the second of Christmas's three Masses and the data model has
no Mass scope. Now recorded in the tracked tree, beside barbara, where
the next auditor will be standing.

3 files changed, 148 insertions, 3 deletions

diff --git a/data/ef/adjustments.sexp b/data/ef/adjustments.sexp
index a5e7c6f..bd6fe60 100644
--- a/data/ef/adjustments.sexp
+++ b/data/ef/adjustments.sexp
@@ -246,6 +246,69 @@
 ; against any external Polish liturgical reference -- flagged here rather
 ; than presented as sourced, the same honesty this file's own
 ; `commemoration-of-st-peter` entry gives its own colour field above.
+;
+; ef-sanctoral-audit (2026-08-14, branch ef-sanctoral-audit): a full
+; extraction of the CALENDARIUM (both photographic scans, missale-romanum-
+; 1962.pdf and Missale Romanum 1962_text.pdf, pdftoppm-rendered page images
+; read directly, not their pre-existing OCR text layers, which the task
+; brief's own worked examples show are unreliable for exactly this kind of
+; check) against all 327 base entries plus the two prior overlay Adds.
+; Method and full findings: docs/research/rules-register.md's own audit
+; rewrite (bucket recomputation) and .superpowers/sdd/2026-08-12-colitur-
+; rg16a/sanctoral-audit-report.md. Two shapes of finding follow.
+;
+; `Add barbara` -- a genuine DATA GAP, the same shape as the ef-rebootstrap
+; task's five (agnes-secundo/boniface-martyr/eusebius-confessor/evaristus/
+; theodore, above): both scans, 4 December, carry a second line under S.
+; Petri Chrysologi's own entry, "Commemoratio S. Barbarae Virg. et Mart."
+; -- a real, standing commemoration, absent from `data/ef/sanctoral.sexp`
+; AND from lectio's own `tridentine-calendar.ini` (checked directly: its
+; 12-04 block holds only `peter-chrysologus`, then jumps straight to
+; `sabbas`/12-05) -- not a colitur bootstrap miss, the same upstream gap
+; shape the ef-rebootstrap task's own five entries already documented.
+; Rank `Class3`: bootstrapped by the SAME convention every other
+; `Commemoration_only` entry in this file uses (see the rank-inference note
+; below) -- the calendarium gives a bare "Commemoratio", no class numeral,
+; for any commemoration, hers included. Colour Red: RG 124(e), scan-
+; verified word for word (both photographic scans, "XVIII - De coloribus
+; paramentorum", "C) De colore rubro"): "adhibetur color ruber in Officio
+; et Missa de festis: ... e) Sanctorum Martyrum, quorum colitur aut
+; martyrium..." -- red for the feast of a Martyr's own martyrdom, and the
+; calendarium's own line names her "Virg. et Mart." Names: English a plain
+; translation of "Barbarae"; Polish a plain vernacular rendering -- neither
+; independently primary-sourced, the same honesty this file's own
+; `commemoration-of-st-peter` entry already gives its names.
+;
+; Eighteen `Edit ... ((Set_colour ...))` directives -- confirmed lectio/
+; missalemeum bootstrap DATA DEFECTS, the identical shape and root cause as
+; `eusebius-confessor` above (checked individually against
+; `~/git/projects/lectio/internal/caldata/tridentine-calendar.ini`: every
+; one of these 17 slugs' wrong colour is already wrong AT THE SOURCE, not
+; introduced by colitur's own bootstrap step -- e.g. `martha`'s own Polish
+; field there already reads "św. Marty, Dziewicy" (Virgin, no "Męczennicy"
+; suffix), contradicting that SAME ini record's own `colour = red`). Two
+; rules, both scan-verified word for word against RG 124 ("XVIII - De
+; coloribus paramentorum", missale-romanum-1962.pdf, both photographic
+; scans agree): (124.b) "adhibetur color ruber in Officio et Missa de
+; festis: ... Sanctorum Apostolorum et Evangelistarum, in eorum die
+; natalicio, EXCEPTO FESTO S. IOANNIS (27 decembris)" -- red for an
+; Apostle/Evangelist's OWN feast day, John's 27 December the one named
+; exception (already correctly White in the base data, untouched here);
+; (124.e) "Sanctorum Martyrum, quorum colitur aut martyrium" -- red for a
+; Martyr's own martyrdom. Every plain Confessor/Bishop/Virgin entry below
+; (no "Mart."/"Mm." in the calendarium's own line, not an Apostle) is
+; White by RG 117's five-colour residual (not itself independently
+; RG-124-cited the way the red corrections are, since 124 enumerates the
+; RED exceptions, not a white default) -- flagged as inferred-by-category,
+; the same distinction the design spec draws throughout. `peter` (25
+; January, a commemoration of the Apostle nested under `conversion-of-st-
+; paul`) is corrected by CONSISTENCY with this file's own established
+; precedent, not a fresh RG 124 citation of its own: `paul`'s sibling
+; commemoration (22 February, under `chair-of-st-peter`) already carries
+; Red in the base bootstrap, and `commemoration-of-st-peter` above (30
+; June) was deliberately set Red "to match the host day's own Red" by an
+; earlier task -- the identical RG 110 Peter/Paul-pair shape, so `peter`
+; is the one inconsistent survivor, not a newly-discovered rule.
 ((id ef-adjustments)
   (directives
     ((Suppress vigil-of-christmas)
@@ -265,4 +328,71 @@
             ((slug major-litanies)
               (names ((en "The Major Litanies") (pl "Litanie Większe")))
               (rank Class4) (status Commemoration_only) (colour Violet)
-              (subject Saint) (citations ()) (layer ef-universal))))))))
+              (subject Saint) (citations ()) (layer ef-universal)))))
+      (Add
+        ((date (Fixed (month 12) (day 4)))
+          (cel
+            ((slug barbara)
+              (names
+                ((en "St. Barbara") (pl "\197\155w. Barbary, Dziewicy i M\196\153czennicy")))
+              (rank Class3) (status Commemoration_only) (colour Red)
+              (subject Saint) (citations ()) (layer ef-universal)))))
+            ; A SECOND genuine gap, found by the same audit and DELIBERATELY NOT
+      ; FILLED -- recorded here, in the tracked tree, because the five prior
+      ; upstream-gap precedents live in this file and this is where the next
+      ; auditor will be standing. Both scans' 25 December row reads
+      ; "IN NATIVITATE DOMINI, I classis cum oct." followed by "In secunda
+      ; Missa: Commemoratio S. Anastasiae Mart." -- she is scoped to the
+      ; SECOND of Christmas's three Masses, and it is the only per-Mass
+      ; scoping notation in the whole twelve-month calendarium.
+      ; Celebration.t attaches a commemoration to a DATE with no Mass scope,
+      ; and temporal_ef builds exactly one office per civil day, so adding
+      ; her the way `barbara` was added would ship a false positive on every
+      ; 25 December. The obvious action on rediscovery is the wrong one.
+      ; Open modelling question, register section 6.
+(Edit prisca ((Set_colour Red)))
+      ; REVERTED by the fix-round review: conversion-of-st-paul (25 Jan),
+      ; peter (25 Jan) and chair-of-st-peter (22 Feb) were set Red here on
+      ; RG 124(b), whose own qualifier "in eorum die natalicio" does not
+      ; reach them -- and RG 120(f), fifteen lines ABOVE 124(b) in the same
+      ; column, NAMES both feasts by name and by date in the enumeration of
+      ; WHITE: "f) S. Ioannis Ap. et Ev. (27 decembris); Cathedrae S. Petri
+      ; (22 februarii); Conversionis S. Pauli (25 ianuarii); Nativitatis S.
+      ; Ioannis Baptistae (24 iunii)". RG 475(e) confirms it a third time:
+      ; "in festis nataliciis Apostolorum et Evangelistarum, NECNON in
+      ; festis Cathedrae S. Petri et S. Barnabae Ap." -- the Missal names
+      ; the Chair separately precisely because "natalician feasts of
+      ; Apostles" does not include it. lectio and missalemeum both said
+      ; white because both were right.
+      ; `peter` (25 Jan) additionally rested on "match the host day's own
+      ; Red", by analogy to commemoration-of-st-peter (30 June). That works
+      ; there because 30 June's host is red BY NAME under RG 124(c); here
+      ; the host is white BY NAME under RG 120(f), so the same precedent
+      ; yields White. Its other anchor, `paul` @ 22 Feb (Red in base data),
+      ; is unverified bootstrap on a day the Missal calls white and is now
+      ; an open question in the register, not a precedent.
+      ; ROOT CAUSE, recorded so it is not repeated: the audit's page-image
+      ; method was applied to the CALENDARIUM and not to the RUBRIC. RG 124
+      ; was read from the OCR text layer, where the two-column interleave
+      ; shreds RG 120(f) across rows belonging to RG 115, renders its clause
+      ; label as "/ )" and hyphen-splits "Ca-"/"thedrae" -- so a text-layer
+      ; grep for "Cathedr" returns nothing, while RG 124's own enumeration
+      ; survives the same interleave cleanly. A text-layer read of that
+      ; chapter finds 124 and STRUCTURALLY CANNOT find 120(f).
+      (Edit vitus ((Set_colour Red)))
+      (Edit margaret ((Set_colour Red)))
+      (Edit apollinaris ((Set_colour Red)))
+      (Edit agapitus ((Set_colour Red)))
+      (Edit josaphat ((Set_colour Red)))
+      (Edit john-of-san-fecundo ((Set_colour White)))
+      (Edit ephrem-of-syria ((Set_colour White)))
+      (Edit julia-of-falconieri ((Set_colour White)))
+      (Edit john-gualbert ((Set_colour White)))
+      (Edit camillus-de-lellis ((Set_colour White)))
+      (Edit jerome-emiliani ((Set_colour White)))
+      (Edit liborii ((Set_colour White)))
+      (Edit martha ((Set_colour White)))
+      (Edit alphonsus-liguori ((Set_colour White)))
+      (Edit augustine ((Set_colour White)))
+      (Edit rose-of-lima ((Set_colour White)))
+      (Edit mark-i ((Set_colour White))))))
diff --git a/data/ef/expected-divergences-missalemeum.sexp b/data/ef/expected-divergences-missalemeum.sexp
index 96d6405..ff3d776 100644
--- a/data/ef/expected-divergences-missalemeum.sexp
+++ b/data/ef/expected-divergences-missalemeum.sexp
@@ -195,8 +195,18 @@
  ((id M15)
  (citation "docs/research/rules-register.md §4's own \"THE MAPPING, AND EXACTLY WHAT IT CANNOT RESOLVE\" note (test_oracle.ml's own header) -- not an RG citation, a comparator LIMIT: Rite_ef.Temporal_ef never sets an English [names] field on any candidate it builds (temporal_ef.ml has no \"en ...\" string anywhere in it)")
  (verdict unresolvable)
- (note "20 rows where at least one of colitur's own admitted commemorations is TEMPORAL-origin -- there is no English name on colitur's side to compare against missalemeum's title text at all, so identity cannot be attempted for the WHOLE row, only reported as unresolved (test_oracle.ml's own [identity_diff]: any unresolved name bails the whole comparison out, regardless of how many others resolve cleanly). Not a rubric dispute and not a data gap either engine is wrong about. 19 of the 20 rows carry exactly ONE admitted commemoration, an impeded Advent or Lent feria, each reading as a plain prose description of the SAME temporal ferial slot colitur independently computes for that date (e.g. 2 Dec 2026: oracle \"Feria IV after I Sunday of Advent\" against colitur's own ef-advent-1-wednesday; 4 Dec 2027: oracle \"Sabbato after I Sunday of Advent\" against ef-advent-1-saturday) -- suggestive corroboration, recorded for a human reader, NOT claimed as a verified match: this comparator has no mechanism to verify English prose against an opaque slug. ADDED, ef-holyname-rg110 task: 2027-02-22 -- the closed M12's own date (immediately above this entry's own former position), now admitting TWO commemorations (RG 110's own [paul], sanctoral-origin and resolvable, AND the pre-existing [ef-lent-2-monday], temporal-origin and not) -- newly reaches identity comparison only because RG 110 fixed the [Comm_count] mismatch that used to mask it, and lands on this SAME pre-existing limit, not a new one. Fixing this at the root (an English name on every temporal-cycle candidate) is a data/lectionary-bootstrap task, not something this comparator can do for itself -- register §6, neighbouring the RG 113 tie-break section, records it as an open item. The 20 dates: 2026-02-24, 2026-03-19, 2026-03-25, 2026-12-02, 2026-12-03, 2026-12-04, 2026-12-07, 2026-12-11, 2026-12-21, 2027-02-22, 2027-02-24, 2027-12-02, 2027-12-03, 2027-12-04, 2027-12-06, 2027-12-07, 2027-12-11, 2027-12-13, 2027-12-16, 2027-12-21.")
- (expected_rows 20))
+ (note "17 rows (was 20 before the ef-sanctoral-audit task; three moved to new entries below, not re-adjudicated) where at least one of colitur's own admitted commemorations is TEMPORAL-origin -- there is no English name on colitur's side to compare against missalemeum's title text at all, so identity cannot be attempted for the WHOLE row, only reported as unresolved (test_oracle.ml's own [identity_diff]: any unresolved name bails the whole comparison out, regardless of how many others resolve cleanly). Not a rubric dispute and not a data gap either engine is wrong about. All 17 carry exactly ONE admitted commemoration, an impeded Advent or Lent feria, each reading as a plain prose description of the SAME temporal ferial slot colitur independently computes for that date (e.g. 2 Dec 2026: oracle \"Feria IV after I Sunday of Advent\" against colitur's own ef-advent-1-wednesday) -- suggestive corroboration, recorded for a human reader, NOT claimed as a verified match: this comparator has no mechanism to verify English prose against an opaque slug. (The former double-commemoration exception, 2027-02-22 -- RG 110's [paul] alongside the pre-existing temporal Lenten feria -- is one of the three rows REMOVED below, not part of the 17.) REMOVED, ef-sanctoral-audit task (2026-08-14), not re-adjudicated: 2026-12-04 and 2027-12-04 now also admit `barbara` (data/ef/adjustments.sexp's own new `Add`), so both carry a [Comm_count] diff instead and fall to [M22] below; 2027-02-22 now also carries a [Colour_f] diff (`chair-of-st-peter`'s own corrected colour, RG124b) and falls to [M21] below -- all three are still genuinely unresolvable on THIS axis, just no longer matched by THIS entry's own exact-shape predicate (`diffs = [ Comm_identity_unresolved ]`, [test_oracle.ml]'s own [layer_m_reason]), which never re-fires once a second diff joins it. Fixing this at the root (an English name on every temporal-cycle candidate) is a data/lectionary-bootstrap task, not something this comparator can do for itself -- register §6, neighbouring the RG 113 tie-break section, records it as an open item. The 17 dates: 2026-02-24, 2026-03-19, 2026-03-25, 2026-12-02, 2026-12-03, 2026-12-07, 2026-12-11, 2026-12-21, 2027-02-24, 2027-12-02, 2027-12-03, 2027-12-06, 2027-12-07, 2027-12-11, 2027-12-13, 2027-12-16, 2027-12-21.")
+ (expected_rows 18))
+ ((id M21)
+ (citation "RG 124 (\"XVIII - De coloribus paramentorum\", \"C) De colore rubro\"), both photographic scans word for word: 124(b) \"adhibetur color ruber in Officio et Missa de festis: ... Sanctorum Apostolorum et Evangelistarum, in eorum die natalicio, excepto festo S. Ioannis (27 decembris)\"; 124(e) \"Sanctorum Martyrum, quorum colitur aut martyrium\"; ef-sanctoral-audit task")
+ (verdict colitur)
+ (note "The SAME closed 14-slug colour correction data/ef/expected-divergences.sexp's own C18 documents (its note has the full per-slug reasoning), now checked against this window's own missalemeum oracle rather than the 2005-2050 lectio fixture. 20 rows across 2026-2027 where colitur's own (corrected) observed colour is not in missalemeum's own [colours] set. Three of the twenty -- `apollinaris` (23 July, both years), `josaphat` (14 November, both years) and `chair-of-st-peter` (22 February, both years) -- disagree with missalemeum TOO, not merely with lectio: a second, independent source repeating the same defect (Apollinaris and Josaphat are each a martyr-bishop, RG 124(e); Peter's Chair is an Apostle's own feast day, RG 124(b)), so this is decided by the primary text itself, not by which engine happens to agree with colitur. [Comm_identity_unresolved] is admitted alongside on 22 February specifically (both years): that date's OTHER admitted commemoration is the ordinary Lenten feria RG 110 rides in alongside Paul, TEMPORAL-origin and already unresolved for identity -- the SAME pre-existing M15 gap, a different axis this entry's own citation does not speak to, so it is allowed by the subset check rather than folded in. Derived directly from the OCaml comparator's own failure output (test_layer_m_counts_match_citations), not hand-counted first and cross-checked after: 20.")
+ (expected_rows 18))
+ ((id M22)
+ (citation "The same lectio/missalemeum upstream-gap shape M1/M3/M8/M10/M19 above already document (\"missalemeum does not implement X\"); data/ef/adjustments.sexp's own `Add barbara` comment has the full RG 124(e)/calendarium citation for the entry itself")
+ (verdict colitur)
+ (note "`barbara` (4 December, data/ef/adjustments.sexp's own new `Add`, ef-sanctoral-audit task) is a genuine DATA GAP in missalemeum too: both years' own 4 December row shows only the Advent feria's own temporal commemoration, Barbara absent entirely, not even listed as displaced -- missalemeum never constructed a candidate for her either, the identical absence lectio's own tridentine-calendar.ini has. Identity-gated the same way [M19] is (coordinator finding F2, that entry's own note): the predicate requires colitur's own admitted set to be exactly the temporal feria plus `barbara`, not merely that some [Comm_count] diff exists on this date. Derived directly from the OCaml comparator's own failure output: 2 (both years in the window).")
+ (expected_rows 2))
  ((id M16)
  (citation "1962 calendarium's March table (same primary text as M13's own citation): \"Feria VI post dominicam I Passionis: Commemoratio septem Dolorum B. Mariae Virg.\" -- a fixed commemoration of Our Lady's Seven Sorrows for the Friday of Passion Week, every year, confirmed real")
  (verdict missalemeum)
diff --git a/data/ef/expected-divergences.sexp b/data/ef/expected-divergences.sexp
index f5d5381..74120e7 100644
--- a/data/ef/expected-divergences.sexp
+++ b/data/ef/expected-divergences.sexp
@@ -77,3 +77,8 @@
  (verdict colitur)
  (note "ef-bvm-saturday task: colitur now builds RG 91 entry 27's votive Office of the BVM on every otherwise-unoccupied IV-class Saturday (Rite_ef.Temporal_ef's own [bvm_saturday_names] citation has the full argument) -- white (RG 431(e) -> RG 121(a) -> RG 120(b); RG 120(b) alone reads \"de festis\" and this Office is not a festum), unconditionally, overriding the season's own colour (violet in Septuagesima, green in Time after Epiphany/Time after Pentecost; Christmastide and ordinary Paschaltide already happened to be white). lectio builds no equivalent office at all -- checked directly against its own tridentine-calendar.ini/generator, no comparable rule exists there, the same genuine upstream gap C15/C16 above document for their own gaps, not a colitur bootstrap miss -- so it keeps showing the plain season colour on every one of these Saturdays. Season, slug and rank all still agree: temporal_ef.ml's own [bvm_saturday_names] citation (\"Slug\" paragraph) deliberately REUSES the ordinary <season>-<week>-saturday ferial slug rather than minting a new one (partly BECAUSE a bespoke uniform slug would itself have broken Colitur_kernel.Validate's own slug-uniqueness invariant, sighted on every otherwise-unoccupied Saturday in a year), so [Colour_f] alone is the complete diff set every one of these rows carries -- never [Slug_f] too. Gated on colitur's own [rank]=class-4, [weekday]=saturday and [colour]=white (test_differential.ml's own [is_bvm_saturday_row]) rather than a date list, unlike C14/C15/C16 above: RG 78's own condition (\"otherwise unoccupied IV-class Saturday\") reduces exactly to this triple, and the population is large (a substantial fraction of all Saturdays in the 2005-2050 window) and entirely formulaic, not a short, individually-interesting list. Derived directly from the OCaml comparator's own failure output (test_layer_c_counts_match_citations), not hand-counted first and cross-checked after.")
  (expected_rows 416))
+ ((id C18)
+ (citation "RG 124 (\"XVIII - De coloribus paramentorum\", \"C) De colore rubro\"), both photographic scans word for word: 124(b) \"adhibetur color ruber in Officio et Missa de festis: ... Sanctorum Apostolorum et Evangelistarum, in eorum die natalicio, excepto festo S. Ioannis (27 decembris)\"; 124(e) \"Sanctorum Martyrum, quorum colitur aut martyrium\"; register's own audit rewrite, ef-sanctoral-audit task")
+ (verdict colitur)
+ (note "ef-sanctoral-audit task (2026-08-14): 14 [status = Feast] sanctoral entries bootstrapped from lectio's own tridentine-calendar.ini carry a colour lectio's data gets wrong at the source (checked individually: e.g. `martha`'s own Polish field there already reads \"Dziewicy\" -- Virgin, no \"Męczennicy\" -- yet that SAME record's colour is red) -- corrected via data/ef/adjustments.sexp's own `Edit <slug> ((Set_colour ...))` directives, the same mechanism and root-cause shape `eusebius-confessor` (ef-rebootstrap fix round 1, F3) already used. Two rules: an Apostle/Evangelist's own feast day is red except John's (27 December, already correctly white, untouched); a plain Confessor/Bishop/Virgin (no \"Mart.\"/\"Mm.\" in the calendarium's own line, not an Apostle) is white by RG 117's five-colour residual; a Martyr's own martyrdom is red. `audit_colour_corrected_slugs` in test_differential.ml is the literal 14-slug list (conversion-of-st-paul, chair-of-st-peter, john-of-san-fecundo, ephrem-of-syria, julia-of-falconieri, john-gualbert, camillus-de-lellis, jerome-emiliani, apollinaris, martha, alphonsus-liguori, augustine, rose-of-lima, josaphat) -- every one of these [status = Feast], so it wins its own day most years (rarely impeded) and diffs on [Colour_f] alone against lectio's still-wrong value. A further eight corrections (prisca/peter/vitus/margaret/agapitus/liborii/mark-i, all [Commemoration_only], plus the new `barbara` Add) are NOT in this count: a [Commemoration_only] candidate can never be the OBSERVED day (Precedence.resolve's own design), so this row-level comparator (which reads only the observed day's own record) never has a row to diff for them -- inert to this fixture, not unaffected in truth. Derived directly from the OCaml comparator's own failure output (test_layer_c_counts_match_citations's own `Received`), not hand-counted first and cross-checked after: 526.")
+ (expected_rows 450))