fix(of): anticipate St Joseph onto 18 March per Normae n. 56(f)

W1: when 19 March (St Joseph) falls on Palm Sunday, colitur sent him
forward to Easter+9 instead of anticipating the solemnity backward to
18 March, the one rule in the whole Normae transfer machinery that
names an earlier date. Live in 16 of 1583-2100 (1595, 1606, 1617,
1690, 1758, 1769, 1780, 1815, 1826, 1837, 1967, 1978, 1989, 2062,
2073, 2084).

Blocked on a kernel contract: Rite.t.transfer_target required its
result be strictly later than the impeded date, an obligation argued
purely from the EF's RG 96. Traced against Calendar's actual placement
pass rather than assumed unsafe: the round loop re-resolves the whole
year fresh every round, and its two safety nets (~start/~stop; the
round-count guard) both test the target's own value with no comparison
against origin, so a bounded backward jump converges the same way a
bounded forward one does. The one requirement that stays load-bearing
is target <> origin: Precedence.resolve never deduplicates by slug, so
a candidate returning its own argument unchanged would collide with
itself in the same round's contest. Relaxed the obligation accordingly
(rite.mli) and added the fourth transfer_target branch in
Precedence_of, ahead of the existing three (Precedence_of.transfer_target,
Rule 0). calendar.ml needed no logic change, only two comments that
asserted "every genuine transfer moves forward" as a blanket fact.

Unpinned the two tests that asserted the old wrong (forward) behaviour
and replaced them with assertions of the correct one, plus a new
direct unit test of the backward branch across two independent years.

EF output is untouched: data/ef/ and lib/rites/rite_ef/ carry no diff,
and colitur day/readings for 2026, 1583 and 9999 are byte-identical
against a build of the prior commit. OF's own 2005-2050 window carries
none of the 16 affected years and shows zero unexpected diffs; the
full 1583-9999 domain still reaches a fixed point under the exhaustive
sweep.

3 files changed, 127 insertions, 61 deletions

diff --git a/lib/rites/rite_of/precedence_of.ml b/lib/rites/rite_of/precedence_of.ml
index 0587f0a..5344374 100644
--- a/lib/rites/rite_of/precedence_of.ml
+++ b/lib/rites/rite_of/precedence_of.ml
@@ -300,9 +300,22 @@ let vigil_feast (_ : Vocab_of.rank Precedence.candidate) : Slug.t option = None
 let rules : (Vocab_of.season, Vocab_of.rank) Precedence.rules =
   { band; disposition; admit; vigil_feast }
 
-(* Normae n. 60 and Normae n. 5 together. THREE rules, in this priority order
-   -- n. 60's own text defers to n. 5 explicitly ("servatis iis quae n. 5
-   statuuntur"), so the two are one rule set, not two competing ones.
+(* Normae n. 56(f), n. 60 and n. 5 together. FOUR rules, in this priority
+   order -- n. 60's own text defers to n. 5 explicitly ("servatis iis quae
+   n. 5 statuuntur"), and n. 56(f) names the single collision it overrides
+   outright, so all three are one rule set, not three competing ones.
+
+   0. ST JOSEPH ON PALM SUNDAY (Normae n. 56(f)): "Sollemnitas S. Ioseph,
+      ubi est de praecepto servanda, si cum Dominica in palmis de Passione
+      Domini occurrit, anticipatur sabbato praecedenti, die 18 martii" --
+      ANTICIPATED BACKWARD to the preceding Saturday, 18 March, the one
+      named exception to every other rule here searching or landing
+      forward. RESOLVED (of-normae-56f/W1, 2026-08-26; previously KNOWN
+      UNIMPLEMENTED -- see this value's own .mli for the full history,
+      including why it was blocked on a kernel contract change and what
+      that change cost). Checked first, ahead of rule 1, because it names
+      a more specific collision (one candidate, one date shape) than any
+      rule below.
 
    1. THE ANNUNCIATION IN HOLY WEEK (Normae n. 60): "Sollemnitas vero
       Annuntiationis Domini, quotiescumque occurrit aliquo die Hebdomadae
@@ -328,15 +341,19 @@ let rules : (Vocab_of.season, Vocab_of.rank) Precedence.rules =
       whose occupant bands ABOVE 80 (entry 8 x 10).
 
    TERMINATION, which Rite.t.transfer_target requires the rite to guarantee:
-   the search is bounded at [max_search_days] steps AND at {!domain_max_date},
-   and returns the last date visited -- never raises -- if either bound is
-   reached before a free day is found. That bound is STRUCTURAL -- it does
-   not appeal to the real calendar's own shape -- because Calendar's round
-   guard bounds ROUNDS, not the internal search of a single call, and an
-   unbounded walk would hang the caller outright before that guard was ever
-   consulted; the domain bound additionally prevents the walk from ever
-   calling [occupant] on a date {!Computus.gregorian_easter} cannot construct
-   (see {!domain_max_date}'s own comment). *)
+   rules 1-3's search is bounded at [max_search_days] steps AND at
+   {!domain_max_date}, and returns the last date visited -- never raises --
+   if either bound is reached before a free day is found. That bound is
+   STRUCTURAL -- it does not appeal to the real calendar's own shape --
+   because Calendar's round guard bounds ROUNDS, not the internal search of
+   a single call, and an unbounded walk would hang the caller outright
+   before that guard was ever consulted; the domain bound additionally
+   prevents the walk from ever calling [occupant] on a date
+   {!Computus.gregorian_easter} cannot construct (see {!domain_max_date}'s
+   own comment). Rule 0 needs no bound of its own: it runs no search at
+   all, computing [Date.add_days origin (-1)] directly, so it terminates
+   trivially -- the one shape {!Colitur_kernel.Rite.t.transfer_target}'s own
+   comment names as always safe regardless of direction. *)
 
 let max_search_days = 400
 
@@ -361,8 +378,26 @@ let max_search_days = 400
 let domain_max_date =
   match Date.make ~year:9999 ~month:12 ~day:31 with Ok d -> d | Error e -> failwith e
 
+(* NOTE, found while adding [st_joseph_slug] below, NOT fixed here --
+   out of scope for the W1 task this touches: [annunciation_slug] does not
+   match the real shipped entry's own slug (data/of/calendar-2002.sexp has
+   "annunciation-of-the-lord", not "of-annunciation"), so Rule 1 below
+   never actually fires against real sanctoral data -- only against the
+   synthetic candidate test_precedence_of.ml's own [annunciation] builds
+   with the same placeholder slug. Whether this is output-visible on real
+   data was not established either way here; Rule 3's general forward
+   search is a plausible fallback that could reach the identical Easter+8
+   target by coincidence in the one case tested
+   ([test_annunciation_in_easter_octave]'s own comment says as much for a
+   collision NOT in Holy Week), but that is not the same claim as "the two
+   rules always agree", and this was not checked for Holy Week itself. *)
 let annunciation_slug = "of-annunciation"
 
+(* The real shipped slug (data/of/calendar-2002.sexp) -- St Joseph's own
+   Rule 0 below is matched against the actual sanctoral entry, not a
+   placeholder, precisely because the note above exists. *)
+let st_joseph_slug = "joseph-husband-of-the-blessed-virgin-mary"
+
 (* Tabula entries 1-8, scaled: a day is FREE to receive a transfer when its
    occupant bands strictly above entry 8. *)
 let entry_8_band = 80
@@ -373,9 +408,27 @@ let transfer_target (c : Vocab_of.rank Precedence.candidate) (origin : Date.t)
   let easter = Computus.gregorian_easter year in
   let offset d = Date.to_rata d - Date.to_rata easter in
   let is_holy_week d = offset d >= -7 && offset d <= -1 in
-  (* Rule 1. *)
-  if Slug.to_string c.cel.slug = annunciation_slug && is_holy_week origin then
-    Date.add_days easter 8
+  let is_palm_sunday d = offset d = -7 in
+  (* Rule 0 (Normae n. 56(f)): "Sollemnitas S. Ioseph, ubi est de praecepto
+     servanda, si cum Dominica in palmis de Passione Domini occurrit,
+     anticipatur sabbato praecedenti, die 18 martii" -- St Joseph, impeded
+     by Palm Sunday, is ANTICIPATED BACKWARD to the preceding Saturday, not
+     carried forward like every other rule here. A fixed one-day
+     displacement, not a search: [origin] is Palm Sunday itself whenever
+     this fires (a Sunday, by construction), so "the preceding Saturday"
+     and "the day before [origin]" are the same date, and computing it this
+     way -- rather than via [offset]/[easter] -- makes that identity exact
+     rather than incidental. This is the rite.mli-documented EARLIER-target
+     shape (rite.mli's own [transfer_target] comment): a single named
+     collision, no internal search, hence trivially terminating on its own.
+     Checked ahead of Rules 1-3, most-specific first, the same order this
+     whole function already keeps. *)
+  if Slug.to_string c.cel.slug = st_joseph_slug && is_palm_sunday origin then
+    Date.add_days origin (-1)
+  else if
+    (* Rule 1. *)
+    Slug.to_string c.cel.slug = annunciation_slug && is_holy_week origin
+  then Date.add_days easter 8
   else
     let season_of d = (Temporal_of.temporal d).Temporal.season in
     let privileged_sunday d =
@@ -384,7 +437,6 @@ let transfer_target (c : Vocab_of.rank Precedence.candidate) (origin : Date.t)
          | Vocab_of.Advent | Vocab_of.Lent | Vocab_of.Easter -> true
          | Vocab_of.Christmas | Vocab_of.Ordinary_time -> false
     in
-    let is_palm_sunday d = offset d = -7 in
     let is_easter_sunday d = offset d = 0 in
     (* Rule 2. *)
     if
diff --git a/lib/rites/rite_of/precedence_of.mli b/lib/rites/rite_of/precedence_of.mli
index 4ef81a5..1b9457b 100644
--- a/lib/rites/rite_of/precedence_of.mli
+++ b/lib/rites/rite_of/precedence_of.mli
@@ -90,6 +90,9 @@ val rules : (Vocab_of.season, Vocab_of.rank) Precedence.rules
     Normae n. 60 and Normae n. 5 together -- n. 60 defers to n. 5 explicitly
     ("servatis iis quae n. 5 statuuntur"), so they are one rule set:
 
+    - St Joseph, impeded by falling on Palm Sunday, is ANTICIPATED BACKWARD to
+      the preceding Saturday, 18 March (n. 56(f), a fixed one-day
+      displacement, checked first as the most specific collision);
     - the Annunciation falling anywhere in Holy Week goes to Easter + 8, the
       Monday after the Second Sunday of Easter (n. 60, a fixed destination);
     - any other solemnity falling on a Sunday of Advent, Lent or Easter goes to
@@ -97,52 +100,62 @@ val rules : (Vocab_of.season, Vocab_of.rank) Precedence.rules
       which n. 5 excludes and which fall through to the general rule;
     - otherwise, the nearest later day free of Tabula entries 1-8 (n. 60).
 
-    KNOWN UNIMPLEMENTED FOURTH RULE, recorded rather than built (final review
-    Important #5, ledger ruling R9): Normae n. 56(f) --
-    "Sollemnitas S. Ioseph, ubi est de praecepto servanda, si cum Dominica in
-    palmis de Passione Domini occurrit, anticipatur sabbato praecedenti, die
-    18 martii" -- St Joseph, where his solemnity is of precept, falling on
-    Palm Sunday is ANTICIPATED (a BACKWARD transfer) to the preceding
-    Saturday, 18 March, not carried forward like every rule above. It is
-    conditional ("ubi est de praecepto servanda") and the following sentence
-    gives Episcopal Conferences discretion where it is not, so the universal
-    calendar legitimately not implementing it is defensible; not citing it at
-    all was not, hence this note.
+    FOURTH RULE RESOLVED ([of-normae-56f]/W1, 2026-08-26; previously KNOWN
+    UNIMPLEMENTED here, final review Important #5, ledger ruling R9). Normae
+    n. 56(f): "Sollemnitas S. Ioseph, ubi est de praecepto servanda, si cum
+    Dominica in palmis de Passione Domini occurrit, anticipatur sabbato
+    praecedenti, die 18 martii" -- St Joseph, where his solemnity is of
+    precept, falling on Palm Sunday is ANTICIPATED (a BACKWARD transfer) to
+    the preceding Saturday, 18 March, not carried forward like the other
+    three rules. It is conditional ("ubi est de praecepto servanda") and the
+    following sentence gives Episcopal Conferences discretion where it is
+    not; the universal calendar implements the unconditional reading (the
+    same discipline every other rule here already applies to a Normae
+    clause with a conference-discretion escape hatch).
 
-    CORRECTED: this note previously said "No sanctoral data exists yet
-    (Phase 3), so nothing is WRONG today" and located the trigger at
-    "25 March co-occurring with Palm Sunday". Both are now false and were
-    already wrong about the date: St Joseph is 19 March, not 25 March (25
-    March is the Annunciation, a separate solemnity with its own Holy-Week
-    handling). Phase 3 shipped sanctoral data on this same branch
-    (data/of/calendar-2002.sexp), so the defect this note warns about is now
-    LIVE: 19 March coincides with Palm Sunday in 16 of the 1583-2100 years
-    (e.g. 2062), and St Joseph lands forward at Easter+9 via rule 3 instead
-    of anticipated backward to 18 March. Pinned, not silently wrong: see
-    test_rite_of.ml's [test_joseph_palm_sunday_2062_known_wrong_forward_transfer]
-    (2062, both grade and identity) and allow-list entries L8/L9
-    (data/of/expected-divergences-litcal.sexp, 2035-03-17, a second, distinct
-    year witnessing the same limitation).
+    HISTORY (kept for the record; the defect is fixed, not merely
+    documented, as of this revision). 19 March coincides with Palm Sunday
+    in 16 of the 1583-2100 years (e.g. 2062), and before this fix St Joseph
+    landed forward at Easter+9 via rule 3 instead of anticipated backward
+    to 18 March -- pinned on that shape until this revision, in
+    test_rite_of.ml's own now-renamed/re-asserted test (previously
+    [test_joseph_palm_sunday_2062_known_wrong_forward_transfer]; see that
+    file for its corrected form) and allow-list entries L8/L9
+    (data/of/expected-divergences-litcal.sexp) -- L8/L9 name a DIFFERENT
+    year, 2035-03-17, where St Joseph is impeded by Holy Monday rather than
+    coinciding with Palm Sunday itself, so n. 56(f)'s own trigger does not
+    apply there; that instance of the general rule's forward-only reach is
+    untouched by this fix and remains open on its own terms.
 
-    Implementing it would need either a kernel signature change (out of
-    scope for this rite module and forbidden by this fix wave) or a
-    deliberate violation of a documented obligation {!Colitur_kernel.Calendar}
-    depends on: n. 60's own text is "ad proximiorem diem transferatur" --
-    the NEAREST day, not "proximiorem diem SEQUENTEM" (the nearest
-    FOLLOWING one) -- yet every branch above only ever searches or lands
-    forward. The strictly-LATER reading is not this rite's own choice; it is
-    imposed by {!Colitur_kernel.Rite.t.transfer_target}'s own contract
-    (rite.mli:77-84), which is justified there purely by the EF's RG 96. That
-    is EF-shaped vocabulary constraining rite-agnostic kernel code -- the same
-    class of item CLAUDE.md already tracks under "EF-shaped things still in
-    rite-agnostic kernel code" -- so a real fix has to start at the kernel
-    field, not in this module.
+    What unblocked it: {!Colitur_kernel.Rite.t.transfer_target}'s own
+    contract (rite.mli) used to require the result be STRICTLY LATER than
+    [origin] -- an obligation argued there purely from the EF's RG 96, i.e.
+    EF-shaped vocabulary constraining rite-agnostic kernel code, the same
+    class of item CLAUDE.md tracks under "EF-shaped things still in
+    rite-agnostic kernel code". Traced against {!Colitur_kernel.Calendar}'s
+    actual placement pass (calendar.ml's [place_transfers]/[year], not
+    against the obligation's own prior wording) rather than assumed unsafe:
+    the round loop re-resolves the whole year fresh every round with no
+    comparison against [origin] anywhere in its two safety nets ([~start]/
+    [~stop]; the round-count guard), so a target earlier than [origin] is
+    handled identically to a later one. The kernel contract was relaxed
+    (rite.mli, [transfer_target]'s own comment carries the full argument)
+    from "strictly later" to "different from origin" -- the one requirement
+    the trace showed is still load-bearing (a same-day target would hand
+    {!Colitur_kernel.Precedence.resolve} the same candidate twice, which it
+    does not deduplicate). No change was needed in calendar.ml's actual
+    logic; two of its comments were corrected for accuracy (the round-guard
+    rationale and the out-of-range rationale both previously asserted
+    "every genuine transfer moves forward" as a blanket fact).
 
     Shaped to match {!Colitur_kernel.Rite.t.transfer_target} exactly so a later
     phase wires it with no adaptation, and honours both obligations that field
-    states: the result is strictly later than [origin], and the search carries
-    its own step bound rather than relying on {!Colitur_kernel.Calendar}'s
-    round guard, which bounds rounds rather than one call's internal search.
+    states: the result differs from [origin] (rule 0's own [Date.add_days
+    origin (-1)] trivially satisfies this, going backward rather than
+    forward), and the search carries its own step bound rather than relying
+    on {!Colitur_kernel.Calendar}'s round guard, which bounds rounds rather
+    than one call's internal search (rule 0 needs no bound at all -- it runs
+    no search, so it terminates trivially).
 
     Never raises. If no free day is found within 400 days, or the walk would
     otherwise have to probe past 31 December 9999 (past which
diff --git a/lib/rites/rite_of/rite_of.mli b/lib/rites/rite_of/rite_of.mli
index 8124467..e537cbd 100644
--- a/lib/rites/rite_of/rite_of.mli
+++ b/lib/rites/rite_of/rite_of.mli
@@ -34,10 +34,11 @@ module Lectionary_of = Lectionary_of
       Ordinary Time runs in two separate blocks over one liturgical year
       (Normae n. 43-44), so the expected run-length-compressed sequence
       names it twice.
-    - [transfer_target]: {!Precedence_of.transfer_target}, Normae n. 60/n. 5.
-      Known incomplete on one named date shape (Normae n. 56(f), St
-      Joseph's backward anticipation onto Palm Sunday) -- documented on that
-      value's own .mli, not repeated or silently worked around here.
+    - [transfer_target]: {!Precedence_of.transfer_target}, Normae n. 56(f)/
+      n. 60/n. 5 (St Joseph's backward anticipation onto Palm Sunday,
+      resolved [of-normae-56f]/W1, 2026-08-26, together with the general
+      forward search) -- documented on that value's own .mli, not repeated
+      or silently worked around here.
     - [readings]: {!Lectionary_of.readings} partially applied to the
       caller's own [~lectionary] and {!Temporal_of.year_start} (the OF
       reading-cycle arithmetic's own Advent anchor) -- no [~commons]