ef(lectionary): the Commons, chain step 4

Fifteen class-3 saints had no readings anywhere in colitur -- the 6 March -
5 April cluster whose RANKS lectio's generator fix of 2026-08-12 restored
without backfilling readings, and lectio has no Commons concept to have
backfilled them from. They are exactly the fifteen `status Feast` entries in
data/ef/sanctoral.sexp carrying `(citations ())`.

The Missal splits them eight/seven, and NOT as the plan predicted. It
expected propers for Benedict, Patrick, Thomas Aquinas and Gregory the
Great; only Thomas Aquinas has one. Benedict ("Missa Os iusti, de Communi
Abbatum"), Patrick ("Missa Statuit, de Communi Confessoris Pontificis I
loco") and Gregory the Great ("Missa Si diligis me, de Communi unius aut
plurium Summorum Pontificum") are all sent to a Common, with only Oratio,
Secreta and Postcommunio printed at the date. All three reversals verified
on the page images (pp. 488, 492) as well as in both OCR text layers.

PROPERS (data/ef/adjustments.sexp, `Edit ... Set_citation`):
  thomas-aquinas         7 Mar  Sap 7:7-14      / Mt 5:13-19
  john-of-god            8 Mar  Eccli 31:8-11   / Mt 22:34-46
  forty-holy-martyrs    10 Mar  Hebr 11:33-39   / Luc 6:17-23
  cyril-of-jerusalem    18 Mar  Eccli 39:6-14   / Mt 10:23-28
  gabriel-the-archangel 24 Mar  Dan 9:21-26     / Luc 1:26-38
  john-damascene        27 Mar  Sap 10:10-17    / Luc 6:6-11
  john-of-capistrano    28 Mar  Sap 10:10-14    / Luc 9:1-6
  francis-of-paola       2 Apr  Philipp 3:7-12  / Luc 12:32-34

COMMONS (data/ef/commons.sexp), each quoting the Missal's own instruction at
the saint's date:
  sts-felicitas-perpetua  6 Mar  non Virginum I   Eccli 51:1-8,12 / Mt 13:44-52
  frances-rome            9 Mar  non Virginum II  Prov 31:10-31   / Mt 13:44-52
  gregory-the-great      12 Mar  Summ. Pontificum 1 Petri 5:1-4,10-11 / Mt 16:13-19
  patrick                17 Mar  Conf. Pont. I    Eccli 44:16-27;45:3-20 / Mt 25:14-23
  benedict               21 Mar  Abbatum          Eccli 45:1-6    / Mt 19:27-29
  isidore-of-seville      4 Apr  Doctorum         2 Tim 4:1-8     / Mt 5:13-19
  vincent-ferrer          5 Apr  Conf. non Pont. I Eccli 31:8-11  / Luc 12:35-40

Every value read in three independent places -- both OCR text layers (two
DIFFERENT printings, whose Commune Sanctorum pagination differs by 1-2, so
the data keys on heading plus Mass incipit and never on the bracketed page
number) and the rendered page images. That caught a genuine typographical
error in one printing: it gives St Gabriel's Gospel as "Luc. 2, 26-38" (on
the page image, so not an OCR artefact). Luke 1:26-38 is settled by the
other printing, by the pericope text in both, and by the SAME edition citing
the identical pericope correctly two pages later at the Annunciation.

Step 4 EXECUTES SECOND (order 1, 4, 2, 3), not last as the plan sketched.
Measured: every day on which one of the fifteen is actually the observed
office already has a non-empty step-2 or step-3 answer waiting, so a step 4
placed after the ferial fallback is unreachable on every date in 1583-9999 --
and wrong where it would fire (2038-03-06 would emit Septuagesima II
Saturday's Mass on a day whose office is Sts Perpetua and Felicity). Step 4
is also the only step in the chain with a direct primary-source warrant: the
Missal names the Mass at each such saint's own date, while steps 2 and 3 rest
only on lectio's observed behaviour. Guarded so it can never divert a day
whose observed office IS its temporal office -- ferias, Sundays, the Triduum
and the RG 78 Saturday Office of the BVM (which deliberately shares the
ferial slug) are structurally excluded. Step NUMBERS are unchanged so every
"step 3" already written down still names the same branch.

The Commons are caller-supplied, like the lectionary: `Rite_ef.context` gains
a REQUIRED `~commons`, not an optional one -- a silently-defaulted empty
table would give a rite whose class-3 saints quietly lose their Mass, and
nothing in layers 3-5 compares citations, so that loss would be invisible.
`Commons.load` rejects the four defects indistinguishable downstream from
"this saint has no Common": duplicate common id, duplicate assignment, empty
formulary, assignment naming a common that does not exist.

KNOWN LIMITS, recorded rather than papered over. There is no oracle: lectio
has no readings for these feasts and missalemeum's 2026-2027 window never
observes one of the fifteen. Eight of the fifteen are NEVER the observed
office anywhere in the domain (10-28 March always falls to a Lenten or
Passiontide feria that outranks a III-class feast), so they have no
end-to-end witness and are covered by dedicated table tests instead. The
Commune Sanctorum's own opening rubric permits any Epistle or Gospel of a
Common in any Mass of that Common unless one is assigned, so what is emitted
is the reading PRINTED WITH the named formulary, not the only lawful one;
labelled alternatives (e.g. the widow's Epistle 1 Tim 5:3-10, squarely
available to St Frances of Rome) are noted in the data and deliberately not
encoded. The BVM Common is NOT authored: the RG 78 Saturday Office shares the
ordinary ferial slug, so assigning a Common to it would hand the BVM Mass to
every feria sharing that slug; routing it needs a subject-keyed lookup and a
season-keyed choice among the Missal's five "Missae de sancta Maria in
sabbato" -- new behaviour, not new data. It currently emits its feria's Mass,
now pinned as such.

Blast radius, measured (git archive HEAD binary vs HEAD, full 1583-9999
`colitur day` sweep, diffed): ZERO differing lines, 3 074 246 lines each
side, byte-identical -- the CLI prints no citations, so this change is
invisible to layers 2-5 by construction, and the sanctoral overlay perturbed
nothing else.

357 tests green (344 before), 358 with the exhaustive sweep. Mutation-tested
six ways, all reverted after confirming: relegating step 4 to last reddens
exactly the four step-4 pins and nothing else; corrupting a Common's citation,
dropping an assignment, dropping a proper Edit, and corrupting either an
unreachable proper or an unreachable Common each redden their own pins. The
load-bearing assertion is stated over the loaded layer rather than a
hard-coded list: every sanctoral entry that can ever BE the observed office
now has either a proper or an assigned Common -- fifteen failures before,
zero after, and a future re-bootstrap adding a readingless class-3 feast
fails there instead of silently emitting its feria's Mass.

1 files changed, 12 insertions, 5 deletions

diff --git a/lib/rites/rite_ef/rite_ef.mli b/lib/rites/rite_ef/rite_ef.mli
index 12f5609..2183799 100644
--- a/lib/rites/rite_ef/rite_ef.mli
+++ b/lib/rites/rite_ef/rite_ef.mli
@@ -26,10 +26,12 @@ module Lectionary_ef = Lectionary_ef
       value's own documentation for the termination and forward-progress
       argument {!Colitur_kernel.Rite.t.transfer_target}'s contract requires).
     - [readings]: {!Lectionary_ef.readings} partially applied to the caller's
-      own [~lectionary] -- the observed celebration's own proper, else the
-      day's own temporal slug, else (a weekday with no entry of its own) the
-      preceding Sunday's temporal slug, in data/ef/lectionary.sexp (chain
-      steps 1-3; the Commons are later work).
+      own [~lectionary] and [~commons] -- the observed celebration's own
+      proper, else (for a saint who is the day's observed office) his
+      assigned Common from data/ef/commons.sexp, else the day's own temporal
+      slug, else (a weekday with no entry of its own) the preceding Sunday's
+      temporal slug, in data/ef/lectionary.sexp. See {!Lectionary_ef.readings}
+      for why the Common is consulted second rather than last.
 
     Deliberately carries no [sanctoral]/[lectionary] fields the way the
     original design-doc sketch of [RITE] does: {!Colitur_kernel.Rite.t} (the
@@ -44,7 +46,12 @@ module Lectionary_ef = Lectionary_ef
     that never touches lectionary data at all the moment that file was
     missing from a bare build -- see the task report). A future
     diocesan/proper lectionary overlay has a caller-side seam to attach to
-    for the same reason the sanctoral overlay already does. *)
+    for the same reason the sanctoral overlay already does. [~commons]
+    travels the same seam, and is deliberately REQUIRED rather than
+    defaulted -- see this module's .ml for why a silently-defaulted
+    {!Lectionary_ef.Commons.empty} would be undetectable by any of the five
+    validation layers. *)
 val context :
   lectionary:Colitur_kernel.Lectionary.t ->
+  commons:Lectionary_ef.Commons.t ->
   (Vocab_ef.season, Vocab_ef.rank) Colitur_kernel.Rite.t