fix(of): correct season citation, note All Souls gap, guard transfer search

Fix wave from the final whole-branch review of OF Phase 2 (0 Critical,
5 Important, 8 Minor). Applies the five items ruled in-scope and records
two more, per the controller's R7/R8/R9 rulings.

Fixes:
- temporal_of.ml: season-boundary header cited "Normae n. 71-77", a range
  that does not exist (the Normae end at n. 61) and collides with real IGMR
  nn. 71-77 (Preparation of the Gifts) in the same PDF -- EF leakage from
  RG 71-77. Corrected to Normae Titulus II, nn. 17-47, with a note against
  reintroducing the wrong range.
- precedence_of.ml entry 3: added the Tabula's second clause (Commemoratio
  omnium fidelium defunctorum / All Souls) to the comment, and recorded the
  Phase 3 hazard -- Vocab_of.rank has no constructor for it yet, and every
  natural tagging choice gets 2 November's precedence wrong in a different
  way. No code change; nothing can construct the entity yet.
- precedence_of.ml transfer_target's search: added a domain_max_date guard
  (following Rite_ef.Precedence_ef's existing shape and reasoning) so the
  walk can no longer probe Computus past 9999-12-31, and it now returns the
  last date visited on bound exhaustion instead of failwith-ing. .mli
  updated to drop the @raise Failure clause.
- precedence_of.ml is_privileged_sunday: added its own inline Tabula I.2
  citation, matching its sibling helpers.
- precedence_of.ml entry 10: trimmed the reused "universal or temporal-origin"
  comment -- Temporal_of never constructs a Memoria_obligatoria candidate, so
  the temporal-origin half was vacuous there.

Recorded without fixing (both comment-only, per explicit scope ruling):
- test_precedence_of.ml: corrected the entry-3 Nativity Vigil test's
  characterisation. The pinned band-30 assertion (2026-12-24, a Thursday) is
  correct, but is not the value on a 24-December Sunday (e.g. 2028, 2034),
  where is_privileged_sunday instead bands the same candidate 20. Named the
  underlying Phase 1 defect this exposes -- named() claims 24 December
  unconditionally and is matched before sunday_slug, so the Fourth Sunday of
  Advent gets no office at all in those years, invisible to the litcal layer
  -- as known and carried to the next task.
- precedence_of.mli transfer_target: documented Normae n. 56(f) (St Joseph
  on Palm Sunday anticipates backward to 18 March) as a known, cited,
  unimplemented fourth transfer rule, and named the underlying kernel
  constraint (Rite.t.transfer_target's strictly-later obligation, justified
  only by the EF's RG 96) as the reason a real fix needs a kernel change.

dune test: 799 tests, exit 0. make check (exhaustive sweep): 805 tests,
exit 0, 224.7s. No kernel/rite_ef/data changes (git diff empty).

1 files changed, 38 insertions, 2 deletions

diff --git a/lib/rites/rite_of/precedence_of.mli b/lib/rites/rite_of/precedence_of.mli
index 4822411..5866526 100644
--- a/lib/rites/rite_of/precedence_of.mli
+++ b/lib/rites/rite_of/precedence_of.mli
@@ -97,14 +97,50 @@ val rules : (Vocab_of.season, Vocab_of.rank) Precedence.rules
       which n. 5 excludes and which fall through to the general rule;
     - otherwise, the nearest later day free of Tabula entries 1-8 (n. 60).
 
+    KNOWN UNIMPLEMENTED FOURTH RULE, recorded rather than built (final review
+    Important #5, ledger ruling R9): Normae n. 56(f) --
+    "Sollemnitas S. Ioseph, ubi est de praecepto servanda, si cum Dominica in
+    palmis de Passione Domini occurrit, anticipatur sabbato praecedenti, die
+    18 martii" -- St Joseph, where his solemnity is of precept, falling on
+    Palm Sunday is ANTICIPATED (a BACKWARD transfer) to the preceding
+    Saturday, 18 March, not carried forward like every rule above. It is
+    conditional ("ubi est de praecepto servanda") and the following sentence
+    gives Episcopal Conferences discretion where it is not, so the universal
+    calendar legitimately not implementing it is defensible; not citing it at
+    all was not, hence this note. No sanctoral data exists yet (Phase 3), so
+    nothing is WRONG today -- but this must be settled before Phase 3 ships
+    data, or 25 March co-occurring with Palm Sunday will send St Joseph to
+    Easter + 8 via rule 3 (the same target the Annunciation would already be
+    heading to that same year) instead of backward to 18 March.
+
+    Implementing it would need either a kernel signature change (out of
+    scope for this rite module and forbidden by this fix wave) or a
+    deliberate violation of a documented obligation {!Colitur_kernel.Calendar}
+    depends on: n. 60's own text is "ad proximiorem diem transferatur" --
+    the NEAREST day, not "proximiorem diem SEQUENTEM" (the nearest
+    FOLLOWING one) -- yet every branch above only ever searches or lands
+    forward. The strictly-LATER reading is not this rite's own choice; it is
+    imposed by {!Colitur_kernel.Rite.t.transfer_target}'s own contract
+    (rite.mli:77-84), which is justified there purely by the EF's RG 96. That
+    is EF-shaped vocabulary constraining rite-agnostic kernel code -- the same
+    class of item CLAUDE.md already tracks under "EF-shaped things still in
+    rite-agnostic kernel code" -- so a real fix has to start at the kernel
+    field, not in this module.
+
     Shaped to match {!Colitur_kernel.Rite.t.transfer_target} exactly so a later
     phase wires it with no adaptation, and honours both obligations that field
     states: the result is strictly later than [origin], and the search carries
     its own step bound rather than relying on {!Colitur_kernel.Calendar}'s
     round guard, which bounds rounds rather than one call's internal search.
 
-    @raise Failure if no free day is found within 400 days -- a structural
-    bound, not an appeal to the calendar's own shape. *)
+    Never raises. If no free day is found within 400 days, or the walk would
+    otherwise have to probe past 31 December 9999 (past which
+    {!Colitur_kernel.Computus.gregorian_easter} is not total), the last date
+    visited is returned instead -- {!Colitur_kernel.Calendar}'s own
+    [~start]/[~stop] bound turns that into a recorded [omitted], not a crashed
+    CLI. Same shape as [Rite_ef.Precedence_ef.search_from]
+    (precedence_ef.ml:1895-1899) -- named in prose, not a doc cross-reference:
+    [rite_of]'s dune library does not depend on [rite_ef]. *)
 val transfer_target :
   Vocab_of.rank Precedence.candidate ->
   Date.t ->