fix(citation): make the well-formed reading-part set rite-supplied

I7 (final-review.md, 2026-08-25-colitur-of-phases-3-5): OF Sundays and
solemnities shipped without the Second reading, and the lectionary
data header called the First reading an "Epistle" -- EF vocabulary.
The sole blocker was Validate's own kernel-hardcoded assertion that a
well-formed day's sorted citation parts are exactly [First; Gospel];
Citation.part already carried Second.

Rite.t gains citation_shapes : Citation.part list list, the fourth
EF-shaped kernel misfit (after Preface.t, Mass_formulary.source,
transfer_target's strictly-later contract) and the first fixed rather
than only documented. EF supplies its one shape unchanged; OF supplies
two, [First; Gospel] on a feria/feast/memorial and [First; Second;
Gospel] on a Sunday or solemnity (OLM 1981 Praenotanda n. 66.1 vs
n. 69.1, n. 84(b)/(c), page-image verified against olm-1981.pdf).
Validate's "citations" check now matches against the rite's own
declared shapes rather than a single literal pattern, preserving all
three invariants it always enforced: zero or one complete shape, never
partial; no part outside what the rite declares; no part repeated.

bootstrap_lectionary_of.ml's cite now extracts a Second reading from
Sunday-cycle ini sections only, correctly excluding the one stray
`second` field lectio's snapshot carries on a weekday-cycle section (a
content-verified scraping artifact). The hand-authored Christmas Day
entry gains its own Second reading from the same OLM passage already
cited for its First/Gospel. Regenerated data/of/lectionary.sexp: 771
entries unchanged, citation fields 1542 -> 1725 (+183, all Second
readings), SHA-256 re-pinned, header wording fixed and a new coverage
bullet added. Responsorial Psalm is deliberately still not emitted --
OLM 1981 Praenotanda n. 71 itself lists it apart from the readings
proper as a chant with its own refrain, and the finding driving this
change names only the missing Second reading.

EF output verified byte-identical to the branch start (empty
lib/rites/rite_ef + data/ef diff since v1.0.0, plus a direct binary
comparison of `day`/`readings` for 2026, 1583 and 9999 against a
worktree build of the pre-change commit).

Tests: three new fixtures in test_validate.ml prove the generalisation
holds both directions (a multi-shape rite accepts either of its
declared shapes; a rite that never declared a shape still rejects it).
test_citation_coverage_of.ml's pinned residual grows 41 -> 49, all new
entries the same already-understood chapter-crossing shape.

4 files changed, 32 insertions, 0 deletions

diff --git a/lib/rites/rite_ef/rite_ef.ml b/lib/rites/rite_ef/rite_ef.ml
index 808e017..8efcbfd 100644
--- a/lib/rites/rite_ef/rite_ef.ml
+++ b/lib/rites/rite_ef/rite_ef.ml
@@ -51,6 +51,13 @@ let context ~lectionary ~commons : (Vocab_ef.season, Vocab_ef.rank) Rite.t =
     season_runs = Vocab_ef.seasons;
     transfer_target = Precedence_ef.transfer_target;
     readings = Lectionary_ef.readings ~lectionary ~commons;
+    (* The one shape the EF Mass has ever had: an Epistle and a Gospel,
+       nothing else (RG carries no Second-reading or responsorial-psalm
+       structure -- that is an OF/OLM 1981 innovation, {!Rite.t
+       .citation_shapes}'s own doc comment has the citation). Kept as the
+       single-element list it always implicitly was before this field
+       existed, so EF's resolved output is unaffected letter for letter. *)
+    citation_shapes = [ [ Citation.First; Citation.Gospel ] ];
     creed = Rubrics_ef.creed;
     gloria = Rubrics_ef.gloria;
     preface = Rubrics_ef.preface }
diff --git a/lib/rites/rite_ef/rite_ef.mli b/lib/rites/rite_ef/rite_ef.mli
index 2ed61de..304bcb6 100644
--- a/lib/rites/rite_ef/rite_ef.mli
+++ b/lib/rites/rite_ef/rite_ef.mli
@@ -33,6 +33,11 @@ module Rubrics_ef = Rubrics_ef
       slug, else (a weekday with no entry of its own) the preceding Sunday's
       temporal slug, in data/ef/lectionary.sexp. See {!Lectionary_ef.readings}
       for why the Common is consulted second rather than last.
+    - [citation_shapes]: the single [[First; Gospel]] shape the EF Mass has
+      always had -- see {!Colitur_kernel.Rite.t.citation_shapes}'s own doc
+      comment for why this is now rite-supplied (the OF needs a second
+      shape) rather than a kernel constant, and this file's own [context]
+      for why EF's own resolved output is unaffected letter for letter.
     - [creed]: {!Rubrics_ef.creed}, RG 475-476 -- whether the Creed is said.
       The first rubric in this phase governing a part of Mass rather than
       occurrence/precedence.
diff --git a/lib/rites/rite_of/rite_of.ml b/lib/rites/rite_of/rite_of.ml
index 9eeb5ef..f45bf50 100644
--- a/lib/rites/rite_of/rite_of.ml
+++ b/lib/rites/rite_of/rite_of.ml
@@ -80,6 +80,19 @@ let context ~lectionary : (Vocab_of.season, Vocab_of.rank) Rite.t =
     season_runs = Vocab_of.[ Advent; Christmas; Ordinary_time; Lent; Easter; Ordinary_time ];
     transfer_target = Precedence_of.transfer_target;
     readings = Lectionary_of.readings ~lectionary ~year_start:Temporal_of.year_start;
+    (* Two well-formed shapes, not EF's one -- OLM 1981 Praenotanda n. 66.1
+       ("Quaelibet Missa tres exhibet lectiones": Sunday/solemnity Mass,
+       First from the OT, Second "ex Apostolo", Gospel) against n. 69.1
+       ("Quaelibet Missa duas exhibet lectiones": ferial Mass, First and
+       Gospel only), both page-image verified,
+       docs/research/of/olm-1981.pdf pp.32-33/"XXXII-XXXIII"; n. 84(b)/(c),
+       pp.37-38/"XXXVII-XXXVIII", extends the three-reading shape to every
+       solemnity of a particular calendar and confines feasts/memorials to
+       two. {!Rite.t.citation_shapes}'s own doc comment has the fuller
+       argument for why this is a rite-supplied field rather than a kernel
+       constant. *)
+    citation_shapes =
+      [ [ Citation.First; Citation.Gospel ]; [ Citation.First; Citation.Second; Citation.Gospel ] ];
     creed = Rubrics_of.creed;
     gloria = Rubrics_of.gloria;
     preface = Rubrics_of.preface }
diff --git a/lib/rites/rite_of/rite_of.mli b/lib/rites/rite_of/rite_of.mli
index eeb38d5..8124467 100644
--- a/lib/rites/rite_of/rite_of.mli
+++ b/lib/rites/rite_of/rite_of.mli
@@ -43,6 +43,13 @@ module Lectionary_of = Lectionary_of
       reading-cycle arithmetic's own Advent anchor) -- no [~commons]
       parameter, unlike EF: the OF lectionary chain has no Commons
       indirection to thread through.
+    - [citation_shapes]: TWO well-formed shapes, not EF's one --
+      [[First; Gospel]] on a feria, feast or memorial, and
+      [[First; Second; Gospel]] on a Sunday or solemnity (OLM 1981
+      Praenotanda n. 66.1/n. 69.1, n. 84(b)/(c)) -- see this file's own
+      [context] for the full citation and
+      {!Colitur_kernel.Rite.t.citation_shapes}'s own doc comment for why
+      this field is rite-supplied at all.
     - [creed], [gloria], [preface]: {!Rubrics_of}, IGMR n. 53/67-68/364-365.
 
     [~lectionary] is a caller-supplied parameter, not a value closed over an