fix(render): derive citation keys from the day, not a hardcoded pair (W5)

lib/render/view.ml hardcoded exactly two template keys, "first" and
"gospel", regardless of what a day's citations actually contain. The OF
now resolves a third reading, Second, on Sundays and solemnities (OLM
1981 Praenotanda n. 69.1/n. 84(b)(c)) via the rite-supplied
Rite.t.citation_shapes, which the render layer could not express. Latent
today (bin/main.ml's reject_rite_for refuses --rite on every command that
reaches View.of_days, so only EF ever reaches this path), but the wrong
shape to carry forward.

View.citation_fields now derives one key per Citation.part ACTUALLY
PRESENT in a day's own citations, in Citation.all_parts order, using
Citation.part_to_string for the key name. An absent part contributes no
key at all, not a key holding the empty string: Template.render already
treats a missing key and a present Str "" identically in Var, Section and
Inverted position, so nothing is lost, and Emit_json.year dumps the whole
Obj verbatim, so an unconditionally-present-but-empty key for a
still-unbuilt part (Psalm/Tract/Alleluia/Sequence) would sit in every EF
day's JSON forever. Filtering to present parts alone is what makes EF's
output identical byte for byte BY CONSTRUCTION rather than by a rite
check: EF's citations are always exactly [First; Gospel], so the derived
key set is always {"first"; "gospel"}, in that order.

padding_cell keeps its own fixed "first"/"gospel" pair rather than
deriving from a (nonexistent) day: it mirrors the closed set every rite
currently reachable through this render path (EF alone) always carries,
documented as debt for whenever a rite whose citation_shapes includes
Second is admitted here -- test_padding_and_real_share_key_set would
catch the mismatch immediately.

Downstream consumers: Emit_json needed no change (already a verbatim
dump). Emit_xml and Emit_ics gained a third, order-preserving element/line
(a <citation part="second"> element; a "Second ..." DESCRIPTION line
spliced between Epistle and Gospel) since neither is a fixed-column
format. Emit_csv is deliberately left unwidened and commented: RFC 4180's
header-row contract makes a variable column count illegal, and OF cannot
reach `emit` today regardless, so there is nothing to widen for yet;
admitting OF here later needs a disclosed, deliberate format change, not
a silent one.

term_keys (line ~239) is left unchanged, with a comment recording the
judgment call: "epistle" and "lesson" are indeed EF/Roman vocabulary
(Epistola vs. a non-apostolic Lectio, e.g. an Ember day's Old Testament
reading) sitting in an otherwise rite-agnostic list, but nothing forces a
fix yet -- no OF template exists, and every in-repo EF template already
reads term.epistle, so renaming it would break 11 shipped templates and
any user template for zero present benefit. "lesson" already sits unused,
already translated in both lang files, and is the natural neutral term a
future OF ordo template would reach for.

Tests: test_view.ml gains test_ef_days_never_carry_a_second_key (a whole
year, not one day) and test_three_citation_day_exposes_all_three, driving
View.of_days directly with a hand-built Liturgical_day.t since OF cannot
reach this path through the CLI yet -- the only honest way to exercise a
latent path. test_emit.ml/test_ics.ml extend coverage to Emit_xml/Emit_ics
(presence, value, and reading order) and pin Emit_csv's deliberate
16-column non-widening.

EF byte-identity: zero diff in data/ef/ or lib/rites/rite_ef/ against the
pre-change commit. `colitur day`, `readings`, `emit --format csv/xml/json/
ics`, and `table --template templates/ef/ordo.txt` for 2026, all non-empty,
all byte-identical (cmp) against a worktree build of the pre-change commit.

1 files changed, 19 insertions, 1 deletions

diff --git a/lib/render/emit_csv.ml b/lib/render/emit_csv.ml
index 415a684..e04211f 100644
--- a/lib/render/emit_csv.ml
+++ b/lib/render/emit_csv.ml
@@ -21,7 +21,25 @@ let s v k = match get v k with Some (T.Str x) -> x | _ -> ""
    lang-keyed object -- the [name_la]/[name_en] pair this replaces carried
    the kernel's own [Celebration.names], a different, unlocalised source.
    Machine formats still carry [slug] alongside it, so a script keeps the
-   stable key and a human reads the name. *)
+   stable key and a human reads the name.
+
+   W5: deliberately NOT widened with a "second" column, unlike
+   [Emit_xml]/[Emit_ics] (each a repeated-element/free-text format that
+   grows for free). A CSV's header row is a CONTRACT with every row under
+   it (RFC 4180 sec. 2: "each field in the header... should contain the
+   same number of fields as the records"), so there is no way to add a
+   column only on the days that carry a [Second] reading -- a real
+   three-citation day would either need an ALWAYS-present, mostly-empty
+   "second" column (widening every EF row forever for a case EF can never
+   hit) or genuinely variable-width rows (not CSV). Neither is a change to
+   make speculatively: [bin/main.ml]'s [reject_rite_for] refuses [--rite]
+   on `emit` entirely for any rite but EF, so no [Second] reading can reach
+   this module today, and EF's own [citations] is always exactly
+   [[First; Gospel]] ({!Rite_ef}'s own [citation_shapes]) -- there is
+   nothing to widen FOR yet. When OF is admitted here, this is the one
+   emitter that needs a deliberate, disclosed breaking change (a new
+   column, a version bump, or a documented "third reading silently
+   dropped" trade-off), not a silent one. *)
 let columns =
   [ "date"; "rite"; "season"; "season_name"; "week"; "slug"; "name"; "weekday";
     "rank"; "rank_name"; "colour"; "colour_name"; "subject"; "first"; "gospel"; "comms" ]