feat(kernel,ef): the lectionary reports which Mass it said

Rite.readings now returns (Mass_formulary.t option * Citation.t list)
instead of a bare citation list, and Liturgical_day.t carries the result
as a new formulary field. Validate holds a rite that resolves a formulary
at all to resolving one on every day, the same discipline it already
applies to citations; the EF lectionary chain resolves Some on every day
of every year 1583-9999, confirmed by a direct sweep over 2005-2050 as
well as through Validate itself.

Plan Tasks 2 and 3 are merged into this one commit on the coordinator's
own instruction: Rite.readings' signature and the field that consumes it
are one atomic edit, and the intermediate state does not compile on its
own.

Each of the four lectionary steps now builds its own Mass_formulary.t at
the point it decides, not by re-deriving it afterwards from the citations
it returns: step 1 tags Proper with the observed slug, step 2 tags
Own_slug with the day's own temporal slug, step 3 tags Preceding_sunday
with the resumed Sunday's temporal slug, and step 4 tags Common with the
Common's own id -- Commons.find now returns that id alongside its
citations rather than discarding it, since it is only ever in scope at
the point the assignment is looked up.

The RG 309(a) Saturday votive Mass of Our Lady, which answers between
steps 4 and 2 rather than as one of the four numbered steps, is tagged
Own_slug too: Mass_formulary.source has no dedicated constructor for it,
and its own guard only ever fires when the observed celebration already
is the day's own (reused ferial) temporal slug, which is exactly what
Own_slug documents. Recorded as a judgement call in the task report, not
a specified answer.

test/cli.t's `emit --format sexp` line count is repinned (8472 to 8881):
that command serializes Liturgical_day.t whole, so the new field grows
its output. `colitur day` itself is untouched -- verified byte-identical
against the pre-change binary across 1583, 1900, 2026, 2038 and 9999.

8 files changed, 129 insertions, 29 deletions

diff --git a/lib/kernel/calendar.ml b/lib/kernel/calendar.ml
index 98e9032..7fe9f67 100644
--- a/lib/kernel/calendar.ml
+++ b/lib/kernel/calendar.ml
@@ -543,6 +543,10 @@ let build_day (rite : ('s, 'r) Rite.t) (idx : 'r Layer.index)
       |> List.map (fun c -> (c.Precedence.cel, reason_for c)))
     @ rg33_omitted
   in
+  let formulary, citations =
+    rite.Rite.readings ~observed:resolution.Precedence.observed.Precedence.cel ~temporal ~date
+      ~temporal_at:rite.Rite.temporal
+  in
   {
     Liturgical_day.date;
     rite = rite.Rite.id;
@@ -553,9 +557,8 @@ let build_day (rite : ('s, 'r) Rite.t) (idx : 'r Layer.index)
     transferred_in;
     transferred_out;
     omitted;
-    citations =
-      rite.Rite.readings ~observed:resolution.Precedence.observed.Precedence.cel ~temporal ~date
-        ~temporal_at:rite.Rite.temporal;
+    citations;
+    formulary;
   }
 
 let year (rite : ('s, 'r) Rite.t) (layer : 'r Layer.t) (y : int) :
diff --git a/lib/kernel/liturgical_day.ml b/lib/kernel/liturgical_day.ml
index bbb52b8..709f878 100644
--- a/lib/kernel/liturgical_day.ml
+++ b/lib/kernel/liturgical_day.ml
@@ -23,5 +23,8 @@ type ('s, 'r) t = {
       (** with the reason, never silent -- Task 12's no-celebration-lost
           invariant reads this *)
   citations : Citation.t list;  (** always empty until Plan 4 *)
+  formulary : Mass_formulary.t option;
+      (** which Mass the day says, and how that was decided; [None] only for
+          a rite with no lectionary -- see {!Mass_formulary} *)
 }
 [@@deriving sexp]
diff --git a/lib/kernel/liturgical_day.mli b/lib/kernel/liturgical_day.mli
index f0ea3d9..4a71d6d 100644
--- a/lib/kernel/liturgical_day.mli
+++ b/lib/kernel/liturgical_day.mli
@@ -28,5 +28,10 @@ type ('s, 'r) t = {
           ["citations"] / ["citations-unresolved"] checks. (This said "always
           empty until Plan 4" until Task 10; the lectionary landed before
           Plan 4 did, and the comment outlived its truth.) *)
+  formulary : Mass_formulary.t option;
+      (** Which Mass this day says, and how that was decided -- see
+          {!Mass_formulary}. [None] only for a rite with no lectionary; for
+          EF it is [Some] on every day of every year 1583..9999, asserted by
+          {!Validate}. *)
 }
 [@@deriving sexp]
diff --git a/lib/kernel/rite.ml b/lib/kernel/rite.ml
index 600a691..a7d21d3 100644
--- a/lib/kernel/rite.ml
+++ b/lib/kernel/rite.ml
@@ -17,5 +17,5 @@ type ('s, 'r) t = {
     temporal:('s, 'r) Temporal.t ->
     date:Date.t ->
     temporal_at:(Date.t -> ('s, 'r) Temporal.t) ->
-    Citation.t list;
+    Mass_formulary.t option * Citation.t list;
 }
diff --git a/lib/kernel/rite.mli b/lib/kernel/rite.mli
index 0324bf2..45f3ed6 100644
--- a/lib/kernel/rite.mli
+++ b/lib/kernel/rite.mli
@@ -71,10 +71,22 @@ type ('s, 'r) t = {
     temporal:('s, 'r) Temporal.t ->
     date:Date.t ->
     temporal_at:(Date.t -> ('s, 'r) Temporal.t) ->
-    Citation.t list;
-      (** The day's Epistle and Gospel citations, or []. Rite-supplied for the
-          same reason [transfer_target] is: what a day with no proper of its
-          own falls back to is a rubric of a particular rite, not a universal.
+    Mass_formulary.t option * Citation.t list;
+      (** The Mass actually said -- which formulary, and how that was decided
+          -- paired with its Epistle and Gospel citations. Rite-supplied for
+          the same reason [transfer_target] is: what a day with no proper of
+          its own falls back to is a rubric of a particular rite, not a
+          universal.
+
+          The [Mass_formulary.t option] is [None] exactly when the rite's
+          lectionary is not built at all (the citation list is then also
+          []): a rite that HAS a lectionary is expected to resolve [Some] on
+          every day it covers, the same total-coverage discipline
+          {!Validate}'s own ["formulary"] check holds it to. [None] is never
+          a per-day "no Mass today" answer for a rite that otherwise
+          resolves readings -- that shape is coverage FAILURE, not a
+          legitimate outcome, which is exactly what makes the [Validate]
+          check meaningful.
 
           [temporal_at] is a callback so the rite can reach another date's
           temporal identity (the preceding Sunday's, for the ferial rule)
diff --git a/lib/kernel/validate.ml b/lib/kernel/validate.ml
index c9d4263..ce48615 100644
--- a/lib/kernel/validate.ml
+++ b/lib/kernel/validate.ml
@@ -453,5 +453,34 @@ let run (rite : ('s, 'r) Rite.t) (layer : 'r Layer.t) ~year =
                  fail date "citations"
                    (Printf.sprintf "expected exactly one First and one Gospel, got [%s]"
                       (String.concat "," (List.map Citation.part_to_string sorted))))
+           resolved;
+       (* ---- Formulary invariant (Task 3, celebrant-rubrics-phase1) ----
+
+          Same rite-agnostic gating as the citation checks immediately
+          above, and for the same reason: a rite whose lectionary is not
+          built returns [(None, [])] from {!Rite.readings} on every day, so
+          [year_has_formulary] is false and this check never fires for it.
+          A rite that resolves a formulary AT ALL is held to resolving one
+          on every day of the year -- a day that says no Mass at all is a
+          defect, not a gap, the same discipline the ["citations-unresolved"]
+          check above already holds for the citations themselves. One check
+          name, not two: unlike [citations], there is no separate
+          "well-formed but wrong" shape to distinguish -- [Mass_formulary.t
+          option] is either the day's answer or it is missing, so
+          [year_has_formulary] gates a single ["formulary"] label. *)
+       let year_has_formulary =
+         Array.exists
+           (fun (d : ('s, 'r) Liturgical_day.t) -> d.Liturgical_day.formulary <> None)
+           resolved
+       in
+       if year_has_formulary then
+         Array.iter
+           (fun (d : ('s, 'r) Liturgical_day.t) ->
+             match d.Liturgical_day.formulary with
+             | Some _ -> ()
+             | None ->
+                 fail d.Liturgical_day.date "formulary"
+                   "no Mass formulary resolved for this day: the lectionary chain fell through \
+                    every step")
            resolved);
   List.rev !failures
diff --git a/lib/rites/rite_ef/lectionary_ef.ml b/lib/rites/rite_ef/lectionary_ef.ml
index d7b2497..4325bed 100644
--- a/lib/rites/rite_ef/lectionary_ef.ml
+++ b/lib/rites/rite_ef/lectionary_ef.ml
@@ -51,9 +51,9 @@ module Commons = struct
         | None -> (
             (* A formulary with no citations is indistinguishable at the call
                site from "this saint has no Common" -- [commons_for] would
-               return [Some []] and [readings] would emit [] either way. That
-               is exactly the silent hole this project does not allow, so it
-               is rejected here where it is still nameable. *)
+               return [Some (common, [])] and [readings] would emit [] either
+               way. That is exactly the silent hole this project does not
+               allow, so it is rejected here where it is still nameable. *)
             match List.find_opt (fun (_, cs) -> cs = []) commons with
             | Some (s, _) ->
                 Error (Printf.sprintf "commons: common %S has no citations" (Slug.to_string s))
@@ -72,10 +72,19 @@ module Commons = struct
                          (Slug.to_string saint) (Slug.to_string common))
                 | None -> Ok { commons; assigned })))
 
+  (* Returns the Common's own id ALONGSIDE its citations, not the citations
+     alone: [readings]' step 4 needs the id to build the day's
+     {!Colitur_kernel.Mass_formulary.t} ("the Common's own id as its slug"),
+     and the id is only ever in scope here, at the point [common] is looked
+     up -- re-deriving it afterwards would mean a second [assoc_opt] search
+     over [t.assigned] for a value this function already held. *)
   let find t saint =
     match List.assoc_opt saint t.assigned with
     | None -> None
-    | Some common -> List.assoc_opt common t.commons
+    | Some common -> (
+        match List.assoc_opt common t.commons with
+        | None -> None
+        | Some cs -> Some (common, cs))
 
   (* Byte-for-byte the failure discipline of [Lectionary.load] (see its own
      comments for why each catch-all is placed where it is): every parse and
@@ -250,7 +259,8 @@ let is_bvm_saturday_office (observed : Vocab_ef.rank Celebration.t)
 
 let readings ~lectionary ~commons ~observed ~temporal ~date ~temporal_at =
   match observed.Celebration.citations with
-  | _ :: _ as cs -> cs
+  | _ :: _ as cs ->
+      (Some { Mass_formulary.said = observed.Celebration.slug; via = Mass_formulary.Proper }, cs)
   | [] -> (
       (* Step 4: a saint who is the day's observed office and has no proper
          says his assigned Common. The assignment is explicit, never
@@ -346,7 +356,8 @@ let readings ~lectionary ~commons ~observed ~temporal ~date ~temporal_at =
       match
         if sanctoral_office then commons_for ~commons observed.Celebration.slug else None
       with
-      | Some cs -> cs
+      | Some (common_id, cs) ->
+          (Some { Mass_formulary.said = common_id; via = Mass_formulary.Common }, cs)
       | None -> (
           (* The votive Mass of Our Lady on Saturday (RG 309(a)) runs HERE:
              after the proper (step 1) and the Common (step 4), which answer
@@ -354,13 +365,32 @@ let readings ~lectionary ~commons ~observed ~temporal ~date ~temporal_at =
              lookup -- which is exactly what used to answer, with the feria's
              own Mass, on a day whose office is Our Lady's. Placing it later
              would be dead code; placing it earlier would let it outrank a
-             real saint's proper. *)
+             real saint's proper.
+
+             FORMULARY PROVENANCE, a genuine judgement call: {!Mass_formulary.source}
+             has no fifth constructor for "the RG 309(a) seasonal votive Mass",
+             so this is tagged [Own_slug] -- [is_bvm_saturday_office] only ever
+             fires when [sanctoral_office] above is false, i.e. the observed
+             celebration already IS the day's own temporal office (the office
+             deliberately reuses the ordinary ferial slug, [Temporal_ef]'s own
+             [bvm_saturday_names]), so [said] is genuinely "the day's own
+             slug" -- [Own_slug]'s own documented meaning
+             (mass_formulary.mli's [said] comment) -- even though the
+             citations themselves come from [bvm_saturday_citations]'s
+             season table rather than a [Lectionary.find] hit. Flagged in the
+             task report as an interpretation, not a specified answer. *)
           if is_bvm_saturday_office observed temporal then
-            bvm_saturday_citations temporal.Temporal.season ~month:(Date.month date)
-              ~day:(Date.day date)
+            let said = temporal.Temporal.office.Celebration.slug in
+            ( Some { Mass_formulary.said; via = Mass_formulary.Own_slug },
+              bvm_saturday_citations temporal.Temporal.season ~month:(Date.month date)
+                ~day:(Date.day date) )
           else
           match Lectionary.find lectionary temporal.Temporal.office.Celebration.slug with
-          | Some cs -> cs
+          | Some cs ->
+              ( Some
+                  { Mass_formulary.said = temporal.Temporal.office.Celebration.slug;
+                    via = Mass_formulary.Own_slug },
+                cs )
           | None -> (
               (* Step 3: a feria with no proper of its own says the preceding
                  Sunday's Mass. WARRANT is the same as step 2's -- lectio's own
@@ -404,12 +434,14 @@ let readings ~lectionary ~commons ~observed ~temporal ~date ~temporal_at =
                  season name), so deriving one from the other textually would be
                  a latent bug the moment a season's naming convention differs. *)
               let offset = days_since_sunday temporal.Temporal.weekday in
-              if offset = 0 then []
+              if offset = 0 then (None, [])
               else
                 let sunday = Date.add_days date (-offset) in
                 let sunday_temporal = temporal_at sunday in
                 match
                   Lectionary.find lectionary sunday_temporal.Temporal.office.Celebration.slug
                 with
-                | Some cs -> cs
-                | None -> [])))
+                | Some cs ->
+                    let said = sunday_temporal.Temporal.office.Celebration.slug in
+                    (Some { Mass_formulary.said; via = Mass_formulary.Preceding_sunday }, cs)
+                | None -> (None, []))))
diff --git a/lib/rites/rite_ef/lectionary_ef.mli b/lib/rites/rite_ef/lectionary_ef.mli
index caefc74..2f36926 100644
--- a/lib/rites/rite_ef/lectionary_ef.mli
+++ b/lib/rites/rite_ef/lectionary_ef.mli
@@ -72,21 +72,28 @@ module Commons : sig
   val assignments : t -> (Slug.t * Slug.t) list
 end
 
-(** The Common assigned to a saint who has no proper, if any. Exposed for the
-    golden pins, which must show WHICH Common fired, not merely that two
-    citations appeared.
+(** The Common assigned to a saint who has no proper, if any -- its own id
+    ALONGSIDE its citations, not the citations alone: {!readings}' step 4
+    needs the id to name which Common fired in the {!Colitur_kernel.Mass_formulary.t}
+    it builds. Exposed for the golden pins too, which must show WHICH Common
+    fired, not merely that two citations appeared.
 
     Takes the table explicitly for the same reason {!readings} takes
     [~lectionary]: the data is the caller's, not this module's. *)
-val commons_for : commons:Commons.t -> Slug.t -> Citation.t list option
+val commons_for : commons:Commons.t -> Slug.t -> (Slug.t * Citation.t list) option
 
-(** The day's Epistle and Gospel citations, or [].
+(** The Mass actually said -- which formulary, and how that was decided --
+    paired with the day's Epistle and Gospel citations. [(None, [])] when
+    none of the four steps below answers.
 
     Four steps, in EXECUTION order 1, 4, 2, 3 (the numbers are the plan's and
     are kept as written, so that every "step 3" already recorded in a test
-    name, comment or report still means the same branch):
+    name, comment or report still means the same branch). Each step's own
+    {!Colitur_kernel.Mass_formulary.source} is built at the point the step
+    decides, not re-derived afterwards from the citations it returns:
 
     - {b Step 1} -- the observed celebration's own proper.
+      {!Colitur_kernel.Mass_formulary.Proper}, [said] the observed slug.
     - {b Step 4} -- a saint who is the day's observed office and has no
       proper says his assigned Common. Runs before the temporal fallbacks,
       not after them: this is the only step in the chain with a direct
@@ -98,14 +105,23 @@ val commons_for : commons:Commons.t -> Slug.t -> Citation.t list option
       a feria, a Sunday, the Triduum and the RG 78 Saturday Office of the
       BVM (whose observed celebration is its own temporal office) are
       structurally excluded, not merely absent from the data.
+      {!Colitur_kernel.Mass_formulary.Common}, [said] the Common's own id.
     - {b Step 2} -- the day's own temporal slug in the lectionary.
+      {!Colitur_kernel.Mass_formulary.Own_slug}, [said] that slug. The RG
+      309(a) Saturday votive Mass of Our Lady also answers here (structurally,
+      not as a fifth numbered step): it is tagged the same way, because its
+      own guard only ever fires when the observed celebration already IS the
+      day's own temporal office (the office reuses the ordinary ferial
+      slug) -- see the implementation comment on that branch.
     - {b Step 3} -- for a weekday whose own slug has no entry, the preceding
       Sunday's temporal slug (never its observed one; a Sunday is guarded
       out because it has no PRECEDING Sunday to resume, not because
       consulting itself would loop -- [readings] is not recursive, see its
       own implementation comment).
+      {!Colitur_kernel.Mass_formulary.Preceding_sunday}, [said] that
+      Sunday's temporal slug.
 
-    A day matching none of the four gets []. *)
+    A day matching none of the four gets [(None, [])]. *)
 val readings :
   lectionary:Lectionary.t ->
   commons:Commons.t ->
@@ -113,4 +129,4 @@ val readings :
   temporal:(Vocab_ef.season, Vocab_ef.rank) Temporal.t ->
   date:Date.t ->
   temporal_at:(Date.t -> (Vocab_ef.season, Vocab_ef.rank) Temporal.t) ->
-  Citation.t list
+  Mass_formulary.t option * Citation.t list