fix(ef): RG 112(d) excludes a same-BVM commemoration (fix round 1, F1)

The BVM Saturday Office is itself "de B. Maria Virg."; RG 112(d) (Caput
XVI, "De Commemorationibus") excludes another commemoration whose own
oration invokes the SAME BVM's intercession. our-lady-of-mt-carmel (16
July, Commemoration_only) was wrongly admitted as an ordinary
commemoration alongside the Office on every 16-July-Saturday -- its own
collect explicitly invokes "her" (eius) patronage, and both photographic
scans print a rubric anticipating exactly this collision (an either/or
of Mass texts, not a joint commemoration).

Precedence_ef gains marian_slugs (a closed, hand-verified list of
sanctoral slugs that are themselves feasts of the BVM) and is_bvm_office
(true for subject = Bvm OR a marian_slugs member -- the disjunction is
load-bearing: the Office is identified only by subject, since its own
slug is deliberately reused from the ordinary ferial fallback; Mt Carmel
is identified only by the list, since its own subject tag is Saint, not
Bvm). disposition gains a new branch, checked before the pre-existing
Commemoration_only catch-all, since the one live witness is
Commemoration_only and that branch's own "always Commemorate" had no
exception for this shape.

Checked exhaustively against every Marian-named sanctoral entry: only
Commemoration_only-status entries can ever reach this branch live (a
Feast-status one always wins outright instead of losing). Of the two
such entries in the data, only Mt Carmel is reachable --
our-lady-of-ransom (24 September) is provably unreachable: 24 September
falling on a Saturday forces 1 September to a Thursday, which by
construction makes 24 September the September Ember Saturday, Class2,
every time, not a sampled coincidence.

Re-measured against the full pre-change binary: the original 75,853-day
blast radius is unchanged in total, splitting into 74,633 colour-only +
1,220 colour+comms (16-July Saturdays). Mutation-tested: exactly 3 new
tests redden, nothing else.

1 files changed, 29 insertions, 3 deletions

diff --git a/test/test_differential.ml b/test/test_differential.ml
index 3f416fd..5093484 100644
--- a/test/test_differential.ml
+++ b/test/test_differential.ml
@@ -138,6 +138,7 @@ module Slug = Colitur_kernel.Slug
 module Date = Colitur_kernel.Date
 module Cel = Colitur_kernel.Celebration
 module Colour = Colitur_kernel.Colour
+module Subject = Colitur_kernel.Subject
 module V = Rite_ef.Vocab_ef
 
 (* Same relative paths test_rite_ef.ml/test_sanctoral_ef.ml use: dune test
@@ -216,6 +217,14 @@ type row = {
   slug : string;
   rank : string;
   colour : string;
+  (* Fix round 1 (coordinator finding F3): ONLY ever populated for colitur's
+     own row (see [colitur_rows_2005_2050] below) -- lectio's own fixture
+     format has no subject column at all, so [row_of_line] (the lectio-side
+     parser) sets this to "-", a placeholder never read on that side. Every
+     Layer C predicate that reads [subject] must therefore read it off the
+     COLITUR row [c], never [l] -- the same asymmetry [row]'s other fields
+     do not have, called out here rather than left implicit. *)
+  subject : string;
 }
 
 let read_lines path =
@@ -232,7 +241,7 @@ let read_lines path =
 let row_of_line line =
   match String.split_on_char ' ' line with
   | date :: weekday :: season :: week :: slug :: rank :: colour :: _others ->
-      { date; weekday; season; week; slug; rank; colour }
+      { date; weekday; season; week; slug; rank; colour; subject = "-" }
   | _ -> Alcotest.failf "malformed fixture line (fewer than 7 fields): %S" line
 
 let lectio_rows () = List.map row_of_line (read_lines fixture_path)
@@ -271,7 +280,8 @@ let colitur_rows_2005_2050 () =
               week;
               slug = Slug.to_string cel.Cel.slug;
               rank = V.rank_to_string cel.Cel.rank;
-              colour = Colour.to_string cel.Cel.colour
+              colour = Colour.to_string cel.Cel.colour;
+              subject = Subject.to_string cel.Cel.subject
             }
             :: !rows
       | None -> Alcotest.failf "internal error: no resolved day for %s" (Date.to_iso8601 !d));
@@ -535,8 +545,24 @@ let holy_name_fallback_dates_2005_2050 =
    IV-class Saturday", reduces exactly to this triple), not a short,
    individually-interesting list of dates the way C14/C15/C16 above are. *)
 let is_bvm_saturday_row (c : row) diffs =
+  (* Fix round 1 (coordinator finding F3): [c.subject] added -- the ONLY
+     field in this predicate that pins WHICH celebration is observed, not
+     merely its shape. Every other Layer C entry pins a colitur slug (C1's
+     own [jan_6_13_slug], C6's [nativity_octave_day_slugs], C8/C14/C15/C16's
+     own literal slug checks); this entry could not, because the office
+     deliberately REUSES the ordinary ferial slug (Rite_ef.Temporal_ef's own
+     [bvm_saturday_names] citation, "Slug" paragraph) -- there is no fixed
+     slug string to pin. [subject = "bvm"] is the field that DOES uniquely
+     identify the office (set nowhere else the differential's own
+     [colitur_rows_2005_2050] can produce a Saturday/Class4/white
+     combination for), closing the gap a shape-only predicate left open:
+     without this conjunct, a FUTURE bug that made some OTHER white,
+     Class4, Saturday candidate exist (Christmastide/Paschaltide, where
+     [season_colour] is already white, so a real bug there could slip
+     through unnoticed by colour alone) would be silently absorbed here
+     too. *)
   diffs = [ Colour_f ] && String.equal c.weekday "saturday" && String.equal c.rank "class-4"
-  && String.equal c.colour "white"
+  && String.equal c.colour "white" && String.equal c.subject "bvm"
 
 (* [layer_c_reason l c diffs] returns the [data/ef/expected-divergences.sexp]
    [id] this row-pair's remaining (post Layer A/B) diff set belongs to, or