feat(kernel): movable Date_spec variants, and Rogation Wednesday

Date_spec carried one variant, Fixed(month, day), and its own header said
Sunday- and Easter-relative forms would arrive with the OF sanctoral. They
arrive early because two things needed them at once: a user-supplied
overlay carrying a local movable feast had no way to express "the first
Sunday of October", and Rogation Wednesday's commemoration has been
recorded as architecturally blocked since 2026-08-13.

That blockage turns out to have been a premise, not a fact. The register
concluded the Rogation "is not Commemoration_only sanctoral data by
nature... it needs a genuinely THIRD kind of thing this architecture has
no name for" -- but the reasoning rested on there being "no civil (month,
day) pair to anchor a Fixed entry to". That is a statement about
Date_spec's expressiveness. With Easter_offset the entity is ordinary
sanctoral data, the identical shape Add major-litanies already ships,
differing only in how the date is written. No third channel was needed.
The register is corrected rather than left contradicting the code.

Two variants: Easter_offset of int, and Nth_weekday of {month; nth;
weekday} with negative nth counting from the end. Fixed's sexp
representation is untouched, so all 327 sanctoral entries and the whole
overlay parse unchanged. Both are re-validated in t_of_sexp through their
smart constructors, extending the idiom Fixed already used -- the failure
that guards against is invisible, a spec deserialising into something
that silently never resolves and a celebration vanishing with no
diagnostic.

Easter is supplied by the rite, not computed in the kernel. Computus
ships Gregorian and Julian both, and picking one here would hard-code a
Roman assumption into rite-agnostic code and be silently wrong for a
Julian-reckoning rite. Rite.t gains an easter field; Rite_ef supplies the
Gregorian one.

Layer keeps a split index. Fixed entries stay in the year-independent
(month, day) table, which preserves the fast path and the "30 November
counted twice in a 371-day span" behaviour validate.mli documents for St
Andrew. Movable entries have no year-independent key by construction --
the same spec lands on a different (month, day) each year -- so they
resolve per civil year into a rata-die table. index_by_date is removed
rather than kept as an alias: two ways to index a layer, one of which
silently ignores movable entries, is the trap this change exists to
avoid.

Two domain-edge defects, both found by the suite rather than reasoning. A
liturgical year is Advent-anchored, so resolving civil year y names y +/-
1, and at the edges those are 1582 and 10000, which Computus correctly
refuses by raising. The ceiling surfaced through the domain-ceiling test,
the floor through `colitur day 1583` failing outright. Fixed once, in
Layer.index, the single point that calls the rite's easter -- a clamp
repeated per caller would have been two places to get wrong a third time.

Rogation Wednesday: RG 87 assigns the Litaniae minores to the Monday,
Tuesday AND Wednesday before Ascension (scan1:691); colitur built the
first two from the start and never the third. RG 88 keeps it out of the
Office, so the Ascension Vigil remains observed. RG 89 routes it through
the Major Litanies' rules, but RG 109's closed list names only maiores,
so by RG 107 it is an ORDINARY commemoration -- confirmed in the output,
not assumed. Name from the Missal's own "feria IV" (scan1:20495-20497),
violet to match the Monday and Tuesday offices.

Blast radius, full 1583-9999 sweep against the pre-change binary: 2257
days, every one the same shape, zero unclassified, line counts equal both
sides. The complement is the informative half -- in the other 6160 years
the Rogation does not appear at all, because RG 111 admits one
commemoration on a II-class day and an impeded feast takes it under RG
113, a Commemoration_only candidate having no row in RG 91's table. Both
shapes are pinned.

Allow-lists unmoved: layer 3 compares no commemorations and is blind by
construction, and layer 4's 2026-2027 window has a competing feast on
both Wednesdays, so the Rogation is capped out in exactly the years the
oracle can see. C8 is unchanged, asserted by its own count pin.

Not built: Sunday-relative specs, which nothing needs yet, and the
--overlay plumbing that would let a user actually supply a local movable
feast. Nth_weekday therefore ships with synthetic and property coverage
only; inventing a shipped entry to exercise it would be fabricating
calendar data.

Register: section 6.10.

1 files changed, 15 insertions, 7 deletions

diff --git a/lib/kernel/calendar.ml b/lib/kernel/calendar.ml
index 724641d..99992b3 100644
--- a/lib/kernel/calendar.ml
+++ b/lib/kernel/calendar.ml
@@ -58,7 +58,7 @@ let year_bounds (rite : ('s, 'r) Rite.t) (y : int) : Date.t * Date.t =
    [injected] is keyed by [Date.to_rata] rather than [Date.t] directly:
    [Date.t] carries no [compare]-respecting hash, and rata-die is already the
    canonical total order this module uses for date arithmetic. *)
-let resolve_with_injected (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date)
+let resolve_with_injected (rite : ('s, 'r) Rite.t) (idx : 'r Layer.index)
     (injected : (int, 'r Precedence.candidate list) Hashtbl.t) (date : Date.t) :
     ('s, 'r) Temporal.t * 's Precedence.context * 'r Precedence.resolution =
   let temporal = rite.Rite.temporal date in
@@ -66,7 +66,7 @@ let resolve_with_injected (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date)
     { Precedence.cel = temporal.Temporal.office; origin = Precedence.Temporal }
   in
   let natural =
-    Layer.on_date idx ~month:(Date.month date) ~day:(Date.day date)
+    Layer.on_date idx date
     |> List.map (fun (e : 'r Layer.entry) ->
            { Precedence.cel = e.Layer.cel; origin = Precedence.Sanctoral })
   in
@@ -81,7 +81,7 @@ let resolve_with_injected (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date)
    placements decided so far -- this is exactly the [occupant] callback
    Rite.transfer_target's search walks forward with (rite.mli explains why
    that judgement has to come from the rite, not from here). *)
-let occupant_of (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date)
+let occupant_of (rite : ('s, 'r) Rite.t) (idx : 'r Layer.index)
     (injected : (int, 'r Precedence.candidate list) Hashtbl.t) (date : Date.t) : 'r Celebration.t =
   let _, _, resolution = resolve_with_injected rite idx injected date in
   resolution.Precedence.observed.Precedence.cel
@@ -185,7 +185,7 @@ let injected_index_of_assignment (assignment : (string, Date.t * Date.t) Hashtbl
    [assignment], permanently (never retried -- [transfer_target] is a pure
    function of a candidate's own permanent origin and the occupancy state,
    so asking it again would only recompute the same out-of-range answer). *)
-let place_transfers (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date) ~(start : Date.t)
+let place_transfers (rite : ('s, 'r) Rite.t) (idx : 'r Layer.index) ~(start : Date.t)
     ~(stop : Date.t) (dates : Date.t array) :
     (string, Date.t * Date.t) Hashtbl.t
     * (string, 'r Precedence.candidate) Hashtbl.t
@@ -273,7 +273,7 @@ let place_transfers (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date) ~(start :
    went on to win) and [transferred_out] (whichever candidates' settled
    placements originated here -- RG 97-98 lets that be more than one; see
    [Liturgical_day.transferred_out]). *)
-let build_day (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date)
+let build_day (rite : ('s, 'r) Rite.t) (idx : 'r Layer.index)
     (assignment : (string, Date.t * Date.t) Hashtbl.t)
     (out_of_range : (string, Date.t * Date.t) Hashtbl.t)
     (injected : (int, 'r Precedence.candidate list) Hashtbl.t)
@@ -442,7 +442,15 @@ let build_day (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date)
 
 let year (rite : ('s, 'r) Rite.t) (layer : 'r Layer.t) (y : int) :
     ('s, 'r) Liturgical_day.t array =
-  let idx = Layer.index_by_date layer in
+  (* A liturgical year is Advent-anchored and straddles two civil years --
+     [year_start y .. year_start (y+1) - 1] -- so BOTH must be resolved for
+     movable entries, or a movable feast in the tail of the span silently
+     vanishes. *)
+  (* A liturgical year straddles two civil years, so both are named.
+     [Layer.index] filters them to the kernel domain, which is what keeps
+     the edges (y = 1583 naming 1582, y = 9999 naming 10000) from
+     calling the rite's [easter] out of range. *)
+  let idx = Layer.index layer ~easter:rite.Rite.easter ~years:[ y - 1; y; y + 1 ] in
   let start, stop = year_bounds rite y in
   (* [max 0]: defends [Array.init] against a negative length, which would
      otherwise arise for a rite whose [year_start] lands exactly on the
@@ -468,7 +476,7 @@ let year (rite : ('s, 'r) Rite.t) (layer : 'r Layer.t) (y : int) :
      OCAMLRUNPARAM=R), so a day with more than one departure -- RG 97-98's
      coinciding-feasts case -- would otherwise report them in a
      run-dependent order: an environment read, in a kernel whose invariants
-     forbid one. [Layer.index_by_date] guards against exactly this by
+     forbid one. [Layer.index] guards against exactly this by
      re-sorting each date bucket after building it (layer.ml); same fix,
      same reason. Sorted by target date -- which, for a correctly-converged
      year, is also RG 97-98's own order: the higher-precedence loser claims