feat(ef): implement the calendarium's bissextile February shift

The Missale Romanum's calendarium footnote for February (LT.txt:5011-5014,
scan-corroborated scan2.txt:3050-3058): in a leap year the sixth kalends of
March (24 February) is doubled rather than a 29th day appended, so St
Matthias moves 24->25 February and St Gabriel of Our Lady of Sorrows
27->28, with 24 February itself carrying no fixed office that year.
data/ef/expected-divergences-lms.sexp entry L3 tracked this as an open gap.

Implemented as the rubric's own general mechanism (every fixed entry from
24 through 28 February shifts one civil day later in a leap year), not as
"move these two named saints": the two readings are indistinguishable on
shipped data (nothing else is fixed in that window) and diverge only for a
future --overlay entry in the same range, which the mechanism reading
covers correctly and a two-saints special case would not. This project has
already been bitten once (RG 16(a)) by a rule implemented against shipped
data's coincidental shape rather than the rubric itself.

Kernel stays rite-agnostic: Rite.t gains a fixed_key field (Date.t -> (int
* int) option), the same seam easter already establishes, read only by
Layer.on_date's FIXED half -- the movable half (Easter_offset/Nth_weekday)
is untouched. Default is the identity mapping, an optional argument on
on_date, so every existing caller and every rite that supplies nothing is
byte-identical to before this field existed. Date.is_leap is exposed in
date.mli (already existed in date.ml) so the rite reads the kernel's own
single-sourced leap-year definition. The EF implementation lives in
Rite_ef.Temporal_ef.bissextile_fixed_key, fully cited, wired into
Rite_ef.context.

Blast radius, measured over the full 1583-9999 domain (Calendar.year run
twice per civil year, real fixed_key vs identity, every day diffed): all
2,041 leap years in the domain show a visible change for each saint;
6,983 individual liturgical days change total, zero unclassified, across
four shapes (Matthias vacates 24 Feb in 1,803 years / occupies 25 Feb in
1,811; Gabriel vacates 27 Feb in 1,699 / occupies 28 Feb in 1,670).
L3's own prior estimate (1,650 years, observed-outright only) is confirmed
close on the same definition (1,677 measured); the broader observed-or-
commemorated count is higher, not lower, showing the narrow estimate
undercounted visible impact rather than overcounting it.

The lectio differential (2005-2050 fixture) gains a new cited entry, C40
in data/ef/expected-divergences.sexp: lectio implements no such shift, so
every leap year in its window now diverges on the two shifted days (21
rows, not the naive 44 -- the comparator never compares commemorations, so
a side where the shifted saint has zero comparator-visible footprint on
both engines produces no row). The LMS Ordo's 2023-2024 fixture -- the
window L3 was originally found in -- now matches on the Creed comparison;
its formulary-override bucket count is corrected 182->181 (24 February
leaves the counted Proper population, becoming Own_slug-sourced). The
missalemeum oracle fixtures (2026-2027, 2038, 2035) cover no leap year and
are unaffected.

L3 is closed: converted from an active allow-list record to a prose
closure paragraph (L1's own precedent), citation preserved verbatim, fix
and measured blast radius recorded. The id-list assertion narrows to [L4]
alone, and the now-dead "2024-02-24" -> "L3" date mapping is removed.

Six golden values pinned across four new test cases: Matthias in a leap
year (both the vacated and occupied sides) and a common-year control;
Gabriel likewise, deliberately choosing a leap year where he is admitted
only as an ordinary commemoration rather than winning outright, a
different shape from Matthias's.

Mutation-tested: forcing fixed_key back to identity reddens exactly five
test cases -- the differential's Layer C count-pin (C40 drops to 0 actual
vs 21 expected), the LMS Ordo's Creed and formulary-bucket checks, and
both new golden pins -- confirming the tests actually exercise the fix.
Reverted; dune test, the exhaustive sweep, and make check are all green.

7 files changed, 57 insertions, 8 deletions

diff --git a/lib/kernel/calendar.ml b/lib/kernel/calendar.ml
index d55e38d..db6c58e 100644
--- a/lib/kernel/calendar.ml
+++ b/lib/kernel/calendar.ml
@@ -79,7 +79,7 @@ let resolve_with_injected ?(suppressed = no_suppression) (rite : ('s, 'r) Rite.t
     { Precedence.cel = temporal.Temporal.office; origin = Precedence.Temporal }
   in
   let natural =
-    Layer.on_date idx date
+    Layer.on_date ~fixed_key:rite.Rite.fixed_key idx date
     |> List.map (fun (e : 'r Layer.entry) ->
            { Precedence.cel = e.Layer.cel; origin = Precedence.Sanctoral })
   in
@@ -339,7 +339,7 @@ let rg33_suppressed (rite : ('s, 'r) Rite.t) (idx : 'r Layer.index)
   Array.iter
     (fun date ->
       let candidates =
-        Layer.on_date idx date
+        Layer.on_date ~fixed_key:rite.Rite.fixed_key idx date
         |> List.map (fun (e : 'r Layer.entry) ->
                { Precedence.cel = e.Layer.cel; origin = Precedence.Sanctoral })
       in
@@ -529,7 +529,8 @@ let build_day (rite : ('s, 'r) Rite.t) (idx : 'r Layer.index)
     | None -> []
     | Some slugs ->
         let on_date =
-          Layer.on_date idx date |> List.map (fun (e : 'r Layer.entry) -> e.Layer.cel)
+          Layer.on_date ~fixed_key:rite.Rite.fixed_key idx date
+          |> List.map (fun (e : 'r Layer.entry) -> e.Layer.cel)
         in
         let temporal_office = temporal.Temporal.office in
         (temporal_office :: (on_date @ List.map (fun c -> c.Precedence.cel) arrived))
diff --git a/lib/kernel/date.mli b/lib/kernel/date.mli
index 2f632c8..0e86d54 100644
--- a/lib/kernel/date.mli
+++ b/lib/kernel/date.mli
@@ -14,6 +14,13 @@ val month : t -> int
 val day : t -> int
 val weekday : t -> weekday
 
+(** Proleptic Gregorian leap-year test: divisible by 4, except a century year
+    not divisible by 400. The same rule {!make}/{!days_in_month} already use
+    internally to admit 29 February -- exposed so a rite can key its own
+    calendar-reckoning rules (e.g. a kalends-doubling convention) off the
+    identical, single-sourced definition rather than re-deriving it. *)
+val is_leap : int -> bool
+
 (** [to_rata]/[of_rata] expose the underlying day-count (days since 1970-01-01);
     [of_rata] and [add_days] are unbounded total arithmetic (they may denote a
     year outside 1583..9999 — only [make] enforces the domain). *)
diff --git a/lib/kernel/layer.ml b/lib/kernel/layer.ml
index f069546..2a072f0 100644
--- a/lib/kernel/layer.ml
+++ b/lib/kernel/layer.ml
@@ -73,8 +73,12 @@ let index t ~easter ~years =
   Hashtbl.iter (fun k v -> Hashtbl.replace movable k (canonical v)) movable;
   { fixed; movable }
 
-let on_date idx date =
-  let f = try Hashtbl.find idx.fixed (Date.month date, Date.day date) with Not_found -> [] in
+let on_date ?(fixed_key = fun d -> Some (Date.month d, Date.day d)) idx date =
+  let f =
+    match fixed_key date with
+    | None -> []
+    | Some k -> ( try Hashtbl.find idx.fixed k with Not_found -> [])
+  in
   let m = try Hashtbl.find idx.movable (Date.to_rata date) with Not_found -> [] in
   match m with [] -> f | _ -> canonical (f @ m)
 
diff --git a/lib/kernel/layer.mli b/lib/kernel/layer.mli
index ab6e56b..a71e113 100644
--- a/lib/kernel/layer.mli
+++ b/lib/kernel/layer.mli
@@ -36,8 +36,17 @@ type 'r index
 val index : 'r t -> easter:(int -> Date.t) -> years:int list -> 'r index
 
 (** Entries falling on [date], fixed and movable together, in the layer's
-    canonical slug order. *)
-val on_date : 'r index -> Date.t -> 'r entry list
+    canonical slug order.
+
+    [fixed_key] answers "which (month, day) does the FIXED half look up for
+    this civil date", defaulting to the identity [Some (Date.month date,
+    Date.day date)] -- exactly today's behaviour, for a caller that supplies
+    nothing. A rite's own kalends-reckoning convention (see {!Rite.t}'s
+    [fixed_key] field) is threaded through here rather than applied to
+    [date] itself, so it touches ONLY the fixed table: the MOVABLE half
+    (keyed by rata die, via {!Date_spec.Easter_offset}/{!Date_spec.
+    Nth_weekday}) always uses [date] unchanged. *)
+val on_date : ?fixed_key:(Date.t -> (int * int) option) -> 'r index -> Date.t -> 'r entry list
 
 (** Loads a layer from a sexp file. Parse and validation failures come back as
     [Error], never as an exception. *)
diff --git a/lib/kernel/rite.ml b/lib/kernel/rite.ml
index 4999fc2..738785a 100644
--- a/lib/kernel/rite.ml
+++ b/lib/kernel/rite.ml
@@ -8,6 +8,7 @@ type ('s, 'r) t = {
   temporal : Date.t -> ('s, 'r) Temporal.t;
   anchors : int -> (string * Date.t) list;
   easter : int -> Date.t;
+  fixed_key : Date.t -> (int * int) option;
   rules : ('s, 'r) Precedence.rules;
   season_runs : 's list;
   transfer_target :
diff --git a/lib/kernel/rite.mli b/lib/kernel/rite.mli
index 39538d0..0dcf17e 100644
--- a/lib/kernel/rite.mli
+++ b/lib/kernel/rite.mli
@@ -17,6 +17,33 @@ type ('s, 'r) t = {
           into rite-agnostic code and be silently wrong for a Julian-reckoning
           rite. Read by {!Layer.index} to resolve
           {!Date_spec.Easter_offset}. *)
+  fixed_key : Date.t -> (int * int) option;
+      (** The (month, day) under which a FIXED sanctoral entry ({!Layer.on_date})
+          is looked up for this civil date. [Some (month, day)] identity for
+          every rite with no reason to differ -- a Byzantine or other
+          non-Roman rite supplies nothing beyond that, and its output is
+          therefore byte-identical to a rite that predates this field
+          entirely. [None] means no fixed entry can ever be found for this
+          date, regardless of what {!Layer.index} holds.
+
+          Exists for the Roman calendarium's own bissextile (leap-year)
+          footnote (February, docs/research/LT.txt:5011-5014): the
+          intercalary day is inserted by DOUBLING the sixth kalends of March
+          (civil 24 February in a common year), not by appending a 29th day
+          at the month's end, so every fixed feast dated at or after that
+          kalends position is kept one civil day later than usual, and 24
+          February itself carries no fixed entry that year. This is a fact
+          about the ROMAN rite's own kalends reckoning, not a universal
+          computus rule -- a rite with no such convention (or none at all,
+          the default above) must not have it hardcoded into rite-agnostic
+          code, the same reason {!easter} above is rite-supplied rather than
+          chosen here. See rite_ef/temporal_ef.ml's [bissextile_fixed_key]
+          for the concrete Roman implementation and its full citation.
+
+          Deliberately untouched: the MOVABLE half of {!Layer.on_date}'s
+          lookup ({!Date_spec.Easter_offset}, {!Date_spec.Nth_weekday}) --
+          this field's contract is fixed-date reckoning only, and nothing in
+          the calendarium footnote concerns Easter-relative dates. *)
   rules : ('s, 'r) Precedence.rules;
   season_runs : 's list;
       (** the expected run-length-compressed season sequence over one liturgical
diff --git a/lib/kernel/validate.ml b/lib/kernel/validate.ml
index ce48615..f523b39 100644
--- a/lib/kernel/validate.ml
+++ b/lib/kernel/validate.ml
@@ -239,7 +239,7 @@ let run (rite : ('s, 'r) Rite.t) (layer : 'r Layer.t) ~year =
        let expected : (string, int) Hashtbl.t = Hashtbl.create 64 in
        List.iter
          (fun date ->
-           Layer.on_date idx date
+           Layer.on_date ~fixed_key:rite.Rite.fixed_key idx date
            |> List.iter (fun (e : 'r Layer.entry) ->
                   bump expected (Slug.to_string e.Layer.cel.Celebration.slug)))
          days;