feat(citation): the Sigla facade, total by construction

format never raises and returns an unparseable citation unchanged, so a
gap degrades to today's behaviour rather than to a crash. The coverage
test asserts separately that no shipped citation takes that path.

verbatim is what --raw uses: an identity name table would still reformat
punctuation and renumber, which would break byte-exact diffing against
lectio.

The existing citation-coverage walk (1970-2070) now also drives a
round-trip check in the same pass: parse -> render -> parse must reach
the same structure, using Book.default_spelling for names (Book.to_string
returns the internal id, which is not a registered token and cannot be
read back). Proved with a mutation: changing the default style's
part_sep to a separator the parser does not accept reddened the
round-trip case on 31 multi-part citations and nothing else; reverted.

1 files changed, 22 insertions, 0 deletions

diff --git a/lib/citation/sigla.ml b/lib/citation/sigla.ml
new file mode 100644
index 0000000..a4f4555
--- /dev/null
+++ b/lib/citation/sigla.ml
@@ -0,0 +1,22 @@
+(* SPDX-License-Identifier: AGPL-3.0-or-later *)
+
+type t =
+  | Verbatim
+  | Styled of {
+      style : Render.style;
+      tradition : Book.tradition;
+      names : Book.id -> [ `Full | `Abbr ] -> string;
+    }
+
+let verbatim = Verbatim
+let make ~style ~tradition ~names = Styled { style; tradition; names }
+
+let format t s =
+  match t with
+  | Verbatim -> s
+  | Styled { style; tradition; names } -> (
+      match Parse.parse s with
+      | Error _ -> s
+      | Ok c ->
+          let c = { c with Parse.book = Book.map tradition c.Parse.book } in
+          Render.render style ~names c)