fix(citation): make the well-formed reading-part set rite-supplied

I7 (final-review.md, 2026-08-25-colitur-of-phases-3-5): OF Sundays and
solemnities shipped without the Second reading, and the lectionary
data header called the First reading an "Epistle" -- EF vocabulary.
The sole blocker was Validate's own kernel-hardcoded assertion that a
well-formed day's sorted citation parts are exactly [First; Gospel];
Citation.part already carried Second.

Rite.t gains citation_shapes : Citation.part list list, the fourth
EF-shaped kernel misfit (after Preface.t, Mass_formulary.source,
transfer_target's strictly-later contract) and the first fixed rather
than only documented. EF supplies its one shape unchanged; OF supplies
two, [First; Gospel] on a feria/feast/memorial and [First; Second;
Gospel] on a Sunday or solemnity (OLM 1981 Praenotanda n. 66.1 vs
n. 69.1, n. 84(b)/(c), page-image verified against olm-1981.pdf).
Validate's "citations" check now matches against the rite's own
declared shapes rather than a single literal pattern, preserving all
three invariants it always enforced: zero or one complete shape, never
partial; no part outside what the rite declares; no part repeated.

bootstrap_lectionary_of.ml's cite now extracts a Second reading from
Sunday-cycle ini sections only, correctly excluding the one stray
`second` field lectio's snapshot carries on a weekday-cycle section (a
content-verified scraping artifact). The hand-authored Christmas Day
entry gains its own Second reading from the same OLM passage already
cited for its First/Gospel. Regenerated data/of/lectionary.sexp: 771
entries unchanged, citation fields 1542 -> 1725 (+183, all Second
readings), SHA-256 re-pinned, header wording fixed and a new coverage
bullet added. Responsorial Psalm is deliberately still not emitted --
OLM 1981 Praenotanda n. 71 itself lists it apart from the readings
proper as a chant with its own refrain, and the finding driving this
change names only the missing Second reading.

EF output verified byte-identical to the branch start (empty
lib/rites/rite_ef + data/ef diff since v1.0.0, plus a direct binary
comparison of `day`/`readings` for 2026, 1583 and 9999 against a
worktree build of the pre-change commit).

Tests: three new fixtures in test_validate.ml prove the generalisation
holds both directions (a multi-shape rite accepts either of its
declared shapes; a rite that never declared a shape still rejects it).
test_citation_coverage_of.ml's pinned residual grows 41 -> 49, all new
entries the same already-understood chapter-crossing shape.

1 files changed, 32 insertions, 4 deletions

diff --git a/lib/kernel/rite.mli b/lib/kernel/rite.mli
index d53e4e6..ec850f8 100644
--- a/lib/kernel/rite.mli
+++ b/lib/kernel/rite.mli
@@ -100,10 +100,12 @@ type ('s, 'r) t = {
     temporal_at:(Date.t -> ('s, 'r) Temporal.t) ->
     Mass_formulary.t option * Citation.t list;
       (** The Mass actually said -- which formulary, and how that was decided
-          -- paired with its Epistle and Gospel citations. Rite-supplied for
-          the same reason [transfer_target] is: what a day with no proper of
-          its own falls back to is a rubric of a particular rite, not a
-          universal.
+          -- paired with its reading citations (EF: Epistle and Gospel; OF:
+          First, and on Sundays/solemnities also Second, and Gospel -- see
+          {!citation_shapes} for the rite-supplied shape [Validate] holds
+          this list to). Rite-supplied for the same reason [transfer_target]
+          is: what a day with no proper of its own falls back to is a rubric
+          of a particular rite, not a universal.
 
           The [Mass_formulary.t option] is [None] exactly when the rite's
           lectionary is not built at all (the citation list is then also
@@ -119,6 +121,32 @@ type ('s, 'r) t = {
           temporal identity (the preceding Sunday's, for the ferial rule)
           without re-implementing the temporal cycle -- the same shape
           [transfer_target]'s own [occupant] callback established. *)
+  citation_shapes : Citation.part list list;
+      (** Every well-formed shape a resolved day's [citations] may take, each
+          already sorted in {!Citation.part}'s own declaration order (the
+          order [List.sort compare] gives it, and the order {!Validate}'s own
+          ["citations"] check sorts a day's actual parts into before
+          comparing). A day passes that check when its sorted parts are
+          EMPTY (nothing resolved -- the separate ["citations-unresolved"]
+          coverage check) or equal one of these shapes EXACTLY -- no more
+          parts, no fewer, none repeated.
+
+          Generalises what used to be a single kernel-hardcoded
+          [[First; Gospel]], the fourth EF-shaped kernel misfit (after
+          {!Preface.t}, {!Mass_formulary.source}, [transfer_target]'s
+          strictly-later contract) and the first fixed rather than only
+          documented: the OF's Mass has TWO legitimate sizes, not one --
+          [[First; Gospel]] on a feria, feast or memorial, and
+          [[First; Second; Gospel]] on a Sunday or solemnity (OLM 1981
+          Praenotanda n. 66.1 vs n. 69.1, page-image verified,
+          docs/research/of/olm-1981.pdf pp.32-33/"XXXII-XXXIII": "Quaelibet
+          Missa tres exhibet lectiones" against "Quaelibet Missa duas
+          exhibet lectiones"; n. 84(b)/(c), pp.37-38/"XXXVII-XXXVIII",
+          extends the three-reading shape to every solemnity of a
+          particular calendar and confines feasts/memorials to two). EF
+          still supplies exactly the one shape it always had -- see
+          rite_ef.ml's own [citation_shapes] -- so EF's resolved output is
+          unaffected letter for letter. *)
   creed : temporal:('s, 'r) Temporal.t -> observed:'r Celebration.t -> date:Date.t -> bool;
       (** Whether the Creed is said, post-Gospel/homily, at this day's Mass
           (EF: RG 475-476). A [bool], not an [option]: this is a decision,