fix(kernel): Mass_formulary.t.said is honestly optional -- was false for Votive

The .mli promised said is "the slug whose Mass is said". For Votive
(RG 78/309(a), the Saturday votive Mass of Our Lady) it was set to the
day's own ferial slug -- whose Mass is exactly the one NOT said. A
consumer joining rubrics to readings on that slug would silently get
the wrong Mass: 2026-01-03 reports ef-christmas-1-saturday, which has
zero entries in data/ef/lectionary.sexp, because the citations
actually come from bvm_saturday_citations, a season-keyed function
with no slug of its own anywhere in the shipped data.

Chose the type-honest fix over the interim documentation one: said is
now Slug.t option, None exactly for Votive, because there is
genuinely no slug in the shipped data this field could report for
that one source. Adding real ids for the five seasonal BVM Masses
(the reviewer's first option) is out of scope -- a data restructuring
this round explicitly does not carry. Threading the office slug
through a second field was considered and rejected as redundant: the
day's own office is already available on the same Liturgical_day.t
via observed.slug, which every caller already has in scope regardless
of via, so said does not need to duplicate it.

colitur rubrics stays byte-identical: rubrics_line already has
d.observed in scope and falls back to its slug when said is None,
printing the exact value it always printed for a Votive row (verified
directly, diffed against pre-fix output across four years). colitur
day/readings are unaffected (neither reads Mass_formulary at all).

colitur emit --format sexp's pretty-printed line count for 2027 moved
9011 -> 9025: every day's formulary record widened by said's own
extra option wrapping, and to_string_hum wraps by column width.
Cosmetic only, diffed line by line to confirm every change is this
shape or a consequent wrap shift; recorded in test/cli.t alongside the
476(f) note it now sits next to.

1 files changed, 25 insertions, 4 deletions

diff --git a/lib/kernel/mass_formulary.mli b/lib/kernel/mass_formulary.mli
index a2faf64..b990e69 100644
--- a/lib/kernel/mass_formulary.mli
+++ b/lib/kernel/mass_formulary.mli
@@ -27,10 +27,31 @@ type source =
           is the RG 78/309(a) Saturday Mass of Our Lady. *)
 [@@deriving sexp]
 
-type t = { said : Slug.t; via : source } [@@deriving sexp]
+type t = { said : Slug.t option; via : source } [@@deriving sexp]
 
-(** The slug whose Mass is said. For {!Proper}, {!Own_slug} and {!Votive}
-    this is the day's own; for {!Preceding_sunday} it is that Sunday's
-    TEMPORAL slug; for {!Common} it is the Common's own id. *)
+(** The slug whose CITATIONS were actually used to build the day's
+    readings, when the shipped data can name one.
+
+    [Some] for four of the five sources: {!Proper} and {!Own_slug} each
+    carry the day's own slug; {!Preceding_sunday} carries that Sunday's
+    TEMPORAL slug; {!Common} carries the Common's own id.
+
+    [None] for {!Votive}, and ONLY for {!Votive} (whole-branch review fix
+    round, celebrant-rubrics-phase1): RG 309(a)'s five seasonal "Missae de
+    sancta Maria in sabbato" carry no slug of their own anywhere in the
+    shipped data -- their citations come from a season-keyed function
+    ({!Rite_ef.Lectionary_ef.bvm_saturday_citations}), never from a
+    [Lectionary.find] against any slug, so there is genuinely no slug this
+    field could honestly report. An earlier version of this type set
+    [said] to the day's own OFFICE slug for {!Votive} too (RG 78's Office
+    of Our Lady, kept unchanged under the votive Mass) -- readable at the
+    call site as "this is the slug whose Mass is said", which is false for
+    exactly this one case: that slug's own [Lectionary] entry, if it has
+    one at all, is NOT what the day's citations came from. [None] says so
+    directly instead of silently mis-naming a Mass. The day's own OFFICE
+    is not lost by this change -- it is still on the very same
+    {!Liturgical_day.t} this formulary lives on, via [observed.slug],
+    which every caller already has in scope regardless of [via]; this
+    field does not need to duplicate it. *)
 
 val source_to_string : source -> string