fix(rite-ef,kernel): follow the oracle on the Purification; admit reads the day's own Sunday-ness, not observed

Fix round 1 review, two findings landed together because each golden pin's
correctness depends on both.

CRITICAL (item 1): reverts this branch's own first-pass retag of the
Purification (2 February) from Lord back to Bvm -> Lord. The calendarium
titles it 'B. Mariae Virg.', but missalemeum -- this project's designated
EF oracle -- treats it as taking an occurring II-class Sunday's place
outright, commemorations empty, exactly RG16(a)'s own festum Domini
treatment (2020-02-02, 2014-02-02, independently fetched). Control,
2019-09-08 (the Nativity of the BVM, an ordinary Marian feast, on a
Sunday): the Sunday observed, the feast merely commemorated -- the
opposite pattern, proving the Purification's own oracle treatment is
deliberate, not a gap. RG16(a) alone, on the untouched data, would have
matched the oracle character for character; retagging Bvm is what moved
colitur away from it on 1200 domain-wide days. The user has ruled: follow
the oracle. Genuine primary-text counter-evidence (RG120(b), the colour
rule grouping 2 February under 'B. Mariae Virg.', a category separate
from 'Domini') is recorded in the register, not discarded -- a different
project could reasonably rule the other way on the same evidence.
most-holy-name-of-mary stays retagged Bvm; that one was never disputed.
Removes the now-unneeded C12 lectio allow-list entry (data/ef/
expected-divergences.sexp, test_differential.ml): with the Purification
Lord again, colitur matches lectio's own class = lord on every affected
date, no divergence to allow-list.

IMPORTANT (item 2): Precedence.rules.admit gains a ~temporal parameter --
a genuine kernel signature change, unlike RG16(a) itself. RG111(b)'s own
Sunday rank floor ('one commemoration, namely of a II-class feast') used
to be detected by reading observed's own slug for a Sunday marker, which
silently assumed observed IS the day's temporal-cycle office. RG16(a)
breaks that assumption on purpose: a Feast of the Lord standing in for an
impeded Sunday 'cum omnibus iuribus et privilegiis' keeps the day a
dominica II classis for RG111(b) too, even though the FEAST, not the
Sunday, is observed. Before this fix an unrelated saint (Pope Sixtus II
et al., 6 August, Class3) was wrongly admitted into the freed slot on
every one of 1178 domain-wide days. Oracle-confirmed directly: 2023-08-06
(a Sunday) shows him displaced, commemorations empty; 2026-08-06 (an
ordinary Thursday) shows him admitted -- being a Sunday is exactly what
excludes him. admit now reads Sunday-ness off ~temporal (the day's own
temporal-cycle candidate, passed through from Precedence.resolve
unchanged) instead of observed. Validate's own admission fixed-point
invariant updated to pass the same real temporal candidate through.

Both golden pins in test_golden.ml were promoted from actual colitur day
output without independently consulting the rubric or the oracle first --
a real defect the review caught. Re-derived from both before re-pinning:
2028-08-06 and 2025-02-02 now pin comms=[], no commemoration at all,
matching missalemeum exactly in both cases.

1 files changed, 31 insertions, 14 deletions

diff --git a/lib/rites/rite_ef/precedence_ef.mli b/lib/rites/rite_ef/precedence_ef.mli
index 55f947e..ee7667d 100644
--- a/lib/rites/rite_ef/precedence_ef.mli
+++ b/lib/rites/rite_ef/precedence_ef.mli
@@ -164,24 +164,26 @@ val nativity_octave_prefix : string
     so the two cannot silently drift apart. *)
 val september_ember_prefix : string
 
-(** [admit ~observed comms]: RG 108-111 (docs/research/rules-register.md §4,
-    "Commemorations"). How many of [comms] -- each already tagged with its
-    real RG 109 privilege by {!disposition} -- RG 111 admits, and which,
+(** [admit ~observed ~temporal comms]: RG 108-111 (docs/research/rules-register.md
+    §4, "Commemorations"). How many of [comms] -- each already tagged with
+    its real RG 109 privilege by {!disposition} -- RG 111 admits, and which,
     given the day actually observed:
     - [observed] a [Class1] day: none, except at most one privileged
       commemoration (the highest-dignity one, if several are due) -- an
       ordinary one is never admitted here, no matter how many are due;
-    - [observed] a [Class2] Sunday (its slug carries {!sunday_marker}): one,
-      subject to TWO conditions, not one -- (i) a privileged commemoration,
-      whenever due, categorically takes the day's one slot over any
-      ordinary one, not by comparing dignity, so an ordinary commemoration
-      that would otherwise win on dignity is still dropped; (ii) failing
-      that, the slot is reserved for a [Class2] candidate SPECIFICALLY
-      ("de festo II classis", RG 111(b)'s own wording -- a RANK FLOOR, not
-      "whichever ordinary candidate has the best dignity"): a III- or
-      IV-class ordinary loser has no standing for this slot at all and is
-      admitted nothing, even when it is the only candidate due;
-    - [observed] any other [Class2] day: one, by dignity alone -- no
+    - the CIVIL DAY is a [Class2] Sunday ([temporal]'s slug carries
+      {!sunday_marker} -- CORRECTED, fix round 1, RG16(a) task: read off
+      [temporal], not [observed]; see below): one, subject to TWO
+      conditions, not one -- (i) a privileged commemoration, whenever due,
+      categorically takes the day's one slot over any ordinary one, not by
+      comparing dignity, so an ordinary commemoration that would otherwise
+      win on dignity is still dropped; (ii) failing that, the slot is
+      reserved for a [Class2] candidate SPECIFICALLY ("de festo II classis",
+      RG 111(b)'s own wording -- a RANK FLOOR, not "whichever ordinary
+      candidate has the best dignity"): a III- or IV-class ordinary loser
+      has no standing for this slot at all and is admitted nothing, even
+      when it is the only candidate due;
+    - the civil day is any other [Class2] day: one, by dignity alone -- no
       privilege override and no rank floor, unlike the Sunday case
       immediately above;
     - [observed] a [Class3] or [Class4] day: at most two, by dignity alone.
@@ -192,6 +194,20 @@ val september_ember_prefix : string
     Ties break on slug, matching {!Precedence.compare_by}, so the result
     never depends on the order [comms] arrives in.
 
+    [temporal] -- CORRECTED, fix round 1 (RG16(a) task): this function used
+    to read the Sunday/non-Sunday split off [observed]'s own slug, which
+    silently assumed [observed] IS the day's temporal-cycle office. RG 16(a)
+    breaks that assumption on purpose: a Feast of the Lord holds an impeded
+    II-class Sunday's own place "cum omnibus iuribus et privilegiis"
+    (RG 16(a)'s own text), so the day still counts as a "dominica II
+    classis" for RG 111(b) even though [observed] is now the FEAST.
+    [temporal] -- {!Precedence.rules.admit}'s own parameter, the day's
+    temporal-cycle candidate regardless of who won -- is the reliable
+    signal; oracle-confirmed (6 August: Sunday excludes a Class3 saint
+    Sixtus II from the freed slot, an ordinary weekday admits him). Every
+    row of the previous behaviour where [observed] and [temporal] coincide
+    (no RG 16(a) displacement occurred) is unaffected.
+
     Every candidate this returns is a value taken unchanged from [comms],
     never rebuilt: {!Precedence.resolve}'s own [dropped]/[omitted]
     accounting tells an admitted candidate from a dropped one by physical
@@ -202,6 +218,7 @@ val september_ember_prefix : string
     itself total over an empty or arbitrarily long [comms]. *)
 val admit :
   observed:Vocab_ef.rank Precedence.candidate ->
+  temporal:Vocab_ef.rank Precedence.candidate ->
   (Vocab_ef.rank Precedence.candidate * Precedence.privilege) list ->
   (Vocab_ef.rank Precedence.candidate * Precedence.privilege) list