docs+test: small factual corrections (item 7, part 1)

Six independent, small corrections found during the final review:

- dune (workspace root): the comment said the stanza used "(:standard)"
  to preserve dune's default `default` alias target; the stanza actually
  spells that out explicitly via (alias_rec install). Comment now matches
  the code.
- test_validate.ml's test_easter_extremes asserted `List.length ys = 2`
  where an identity check was called for -- the comment already named
  1598 and 1666, but nothing confirmed extreme_years() found THOSE two
  rather than some other pair with the right cardinality. Now asserts the
  identities directly (the project's "cardinality where identity was
  required" vacuity flavour, per the review).
- test_oracle.ml and expected-divergences-missalemeum.sexp both claimed
  "one entry (M13) is [verdict open]" -- M11 is open too (its own verdict
  changed from colitur to open in fix round 1); both now say "two entries
  (M11 and M13)".
- expected-divergences-missalemeum.sexp's M2 note attributed `band` to
  temporal_ef.ml; `band` is precedence_ef.ml's own function.
- lib/kernel/precedence.mli documented `dropped`/`admit`'s physical-
  equality obligation nowhere -- it lived only in one rite's own module
  (Rite_ef.Precedence_ef.admit's doc comment), but this signature is what
  an author of the next rite actually reads. Added the obligation here,
  cross-referencing the EF instance as precedent, not the only source.
- README's opam install line omitted sexplib and ppx_sexp_conv (both in
  dune-project's own depends; `dune build` fails without them for a
  contributor following the README verbatim) and documented only
  `colitur easter`, though `temporal` and `day` both exist and are the
  more useful entry points. Fixed both.

No behaviour change: comment/doc/test-assertion corrections only (the
easter-extremes fix strengthens an assertion, it does not change what
passes). Verified byte-identical `colitur day` output across 1583, 1900,
1902, 2008, 2011, 2026, 2038, 9999. 259/259 tests green.

1 files changed, 17 insertions, 1 deletions

diff --git a/lib/kernel/precedence.mli b/lib/kernel/precedence.mli
index d30e5c3..4225eb7 100644
--- a/lib/kernel/precedence.mli
+++ b/lib/kernel/precedence.mli
@@ -38,7 +38,23 @@ type ('s, 'r) rules = {
     ('r candidate * privilege) list;
       (** RG 108-111: how many commemorations are admitted, and in what order;
           anything filtered out here is recorded in {!resolution.omitted}, not
-          dropped. *)
+          dropped.
+
+          OBLIGATION ON THE IMPLEMENTATION, not enforced by this type: every
+          candidate this function returns must be a value taken UNCHANGED
+          from its input list, never rebuilt (e.g. via a [{ c with ... }]
+          record update, even one that copies every field back unchanged).
+          {!resolve}'s own [omitted] accounting distinguishes an admitted
+          candidate from a dropped one by PHYSICAL equality ([==]) on the
+          candidate value, not structural equality -- a rebuilt record is
+          [=] to the original but not [==], so {!resolve} would then count
+          it as dropped a SECOND time (once because it is genuinely absent
+          from the admitted set, once because its identity no longer
+          matches its own admitted copy), silently double-counting rather
+          than raising. This obligation previously lived only in one rite's
+          own module documentation (Rite_ef.Precedence_ef.admit); stated
+          here because this signature -- not any one rite's implementation
+          of it -- is what an author of the next rite reads. *)
 }
 
 (** The outcome of resolving one day's candidates. *)