fix(ef): RG 112(d) excludes a same-BVM commemoration (fix round 1, F1)

The BVM Saturday Office is itself "de B. Maria Virg."; RG 112(d) (Caput
XVI, "De Commemorationibus") excludes another commemoration whose own
oration invokes the SAME BVM's intercession. our-lady-of-mt-carmel (16
July, Commemoration_only) was wrongly admitted as an ordinary
commemoration alongside the Office on every 16-July-Saturday -- its own
collect explicitly invokes "her" (eius) patronage, and both photographic
scans print a rubric anticipating exactly this collision (an either/or
of Mass texts, not a joint commemoration).

Precedence_ef gains marian_slugs (a closed, hand-verified list of
sanctoral slugs that are themselves feasts of the BVM) and is_bvm_office
(true for subject = Bvm OR a marian_slugs member -- the disjunction is
load-bearing: the Office is identified only by subject, since its own
slug is deliberately reused from the ordinary ferial fallback; Mt Carmel
is identified only by the list, since its own subject tag is Saint, not
Bvm). disposition gains a new branch, checked before the pre-existing
Commemoration_only catch-all, since the one live witness is
Commemoration_only and that branch's own "always Commemorate" had no
exception for this shape.

Checked exhaustively against every Marian-named sanctoral entry: only
Commemoration_only-status entries can ever reach this branch live (a
Feast-status one always wins outright instead of losing). Of the two
such entries in the data, only Mt Carmel is reachable --
our-lady-of-ransom (24 September) is provably unreachable: 24 September
falling on a Saturday forces 1 September to a Thursday, which by
construction makes 24 September the September Ember Saturday, Class2,
every time, not a sampled coincidence.

Re-measured against the full pre-change binary: the original 75,853-day
blast radius is unchanged in total, splitting into 74,633 colour-only +
1,220 colour+comms (16-July Saturdays). Mutation-tested: exactly 3 new
tests redden, nothing else.

4 files changed, 157 insertions, 18 deletions

diff --git a/test/test_differential.ml b/test/test_differential.ml
index 3f416fd..5093484 100644
--- a/test/test_differential.ml
+++ b/test/test_differential.ml
@@ -138,6 +138,7 @@ module Slug = Colitur_kernel.Slug
 module Date = Colitur_kernel.Date
 module Cel = Colitur_kernel.Celebration
 module Colour = Colitur_kernel.Colour
+module Subject = Colitur_kernel.Subject
 module V = Rite_ef.Vocab_ef
 
 (* Same relative paths test_rite_ef.ml/test_sanctoral_ef.ml use: dune test
@@ -216,6 +217,14 @@ type row = {
   slug : string;
   rank : string;
   colour : string;
+  (* Fix round 1 (coordinator finding F3): ONLY ever populated for colitur's
+     own row (see [colitur_rows_2005_2050] below) -- lectio's own fixture
+     format has no subject column at all, so [row_of_line] (the lectio-side
+     parser) sets this to "-", a placeholder never read on that side. Every
+     Layer C predicate that reads [subject] must therefore read it off the
+     COLITUR row [c], never [l] -- the same asymmetry [row]'s other fields
+     do not have, called out here rather than left implicit. *)
+  subject : string;
 }
 
 let read_lines path =
@@ -232,7 +241,7 @@ let read_lines path =
 let row_of_line line =
   match String.split_on_char ' ' line with
   | date :: weekday :: season :: week :: slug :: rank :: colour :: _others ->
-      { date; weekday; season; week; slug; rank; colour }
+      { date; weekday; season; week; slug; rank; colour; subject = "-" }
   | _ -> Alcotest.failf "malformed fixture line (fewer than 7 fields): %S" line
 
 let lectio_rows () = List.map row_of_line (read_lines fixture_path)
@@ -271,7 +280,8 @@ let colitur_rows_2005_2050 () =
               week;
               slug = Slug.to_string cel.Cel.slug;
               rank = V.rank_to_string cel.Cel.rank;
-              colour = Colour.to_string cel.Cel.colour
+              colour = Colour.to_string cel.Cel.colour;
+              subject = Subject.to_string cel.Cel.subject
             }
             :: !rows
       | None -> Alcotest.failf "internal error: no resolved day for %s" (Date.to_iso8601 !d));
@@ -535,8 +545,24 @@ let holy_name_fallback_dates_2005_2050 =
    IV-class Saturday", reduces exactly to this triple), not a short,
    individually-interesting list of dates the way C14/C15/C16 above are. *)
 let is_bvm_saturday_row (c : row) diffs =
+  (* Fix round 1 (coordinator finding F3): [c.subject] added -- the ONLY
+     field in this predicate that pins WHICH celebration is observed, not
+     merely its shape. Every other Layer C entry pins a colitur slug (C1's
+     own [jan_6_13_slug], C6's [nativity_octave_day_slugs], C8/C14/C15/C16's
+     own literal slug checks); this entry could not, because the office
+     deliberately REUSES the ordinary ferial slug (Rite_ef.Temporal_ef's own
+     [bvm_saturday_names] citation, "Slug" paragraph) -- there is no fixed
+     slug string to pin. [subject = "bvm"] is the field that DOES uniquely
+     identify the office (set nowhere else the differential's own
+     [colitur_rows_2005_2050] can produce a Saturday/Class4/white
+     combination for), closing the gap a shape-only predicate left open:
+     without this conjunct, a FUTURE bug that made some OTHER white,
+     Class4, Saturday candidate exist (Christmastide/Paschaltide, where
+     [season_colour] is already white, so a real bug there could slip
+     through unnoticed by colour alone) would be silently absorbed here
+     too. *)
   diffs = [ Colour_f ] && String.equal c.weekday "saturday" && String.equal c.rank "class-4"
-  && String.equal c.colour "white"
+  && String.equal c.colour "white" && String.equal c.subject "bvm"
 
 (* [layer_c_reason l c diffs] returns the [data/ef/expected-divergences.sexp]
    [id] this row-pair's remaining (post Layer A/B) diff set belongs to, or
diff --git a/test/test_golden.ml b/test/test_golden.ml
index bb4bcfc..fdfc01d 100644
--- a/test/test_golden.ml
+++ b/test/test_golden.ml
@@ -940,6 +940,24 @@ let test_bvm_saturday_loses_to_most_holy_name_of_mary_2026 () =
      colour=white subject=bvm name_la=- comms=[] in=- out=[]"
     (describe d)
 
+(* RG112(d), fix round 1 (coordinator finding F1): PE.marian_slugs's own
+   citation (precedence_ef.ml) has the full RG112(d) argument, including
+   the 16 July "Missa dici potest aut ... aut ..." rubric found on both
+   photographic scans. 16 July 2033 is a real otherwise-unoccupied
+   Saturday; before this fix, [comms] here read
+   "[our-lady-of-mt-carmel:ordinary]" (confirmed against real pre-fix
+   `colitur day 2033` output). *)
+let test_bvm_saturday_excludes_mt_carmel_2033 () =
+  let d = fetch 2033 7 16 in
+  Alcotest.(check bool)
+    "2033-07-16: Mt Carmel is in [omitted] (RG112(d)), not silently dropped from the record" true
+    (omitted_has d "our-lady-of-mt-carmel");
+  Alcotest.(check string)
+    "2033-07-16: the BVM Saturday office observed, white; NO commemoration of Mt Carmel (RG112(d))"
+    "2033-07-16 saturday season=time-after-pentecost week=5 slug=ef-time-after-pentecost-5-saturday \
+     rank=class-4 colour=white subject=bvm name_la=Officium sanctae Mariae in sabbato comms=[] in=- out=[]"
+    (describe d)
+
 let suite =
   ( "golden pins (known-tricky years)",
     [ Alcotest.test_case "Easter extreme: 1598 earliest (22 Mar, Gauss-verified)" `Quick
@@ -1004,5 +1022,9 @@ let suite =
       Alcotest.test_case
         "RG91 e27/RG78/RG26: the BVM Saturday office loses to Most Holy Name of Mary (subject Bvm too) \
          and is omitted, no confusion (2026-09-12)"
-        `Quick test_bvm_saturday_loses_to_most_holy_name_of_mary_2026
+        `Quick test_bvm_saturday_loses_to_most_holy_name_of_mary_2026;
+      Alcotest.test_case
+        "RG112(d), fix round 1 (F1): the BVM Saturday office excludes Mt Carmel's own commemoration \
+         (2033-07-16)"
+        `Quick test_bvm_saturday_excludes_mt_carmel_2033
     ] )
diff --git a/test/test_precedence_ef.ml b/test/test_precedence_ef.ml
index 475ae6e..6f8b5b5 100644
--- a/test/test_precedence_ef.ml
+++ b/test/test_precedence_ef.ml
@@ -805,6 +805,52 @@ let disposition_cases =
         "conversion-of-st-paul",
       cand ~origin:P.Sanctoral ~rank:V.Class2 ~subject:Sub.Lord ~layer:PE.universal_layer
         "commemoration-of-the-baptism-of-the-lord",
+      "Commemorate(Ordinary)" );
+    (* RG112(d), fix round 1 (coordinator finding F1) -- PE.marian_slugs's
+       own citation has the full argument (both scans, including the 16
+       July "Missa dici potest aut ... aut ..." rubric). [of_temporal] on a
+       REAL 16-July-Saturday (2033) sources the winner from
+       Temporal_ef.temporal's own real output, the same review-finding-3
+       discipline this file's Ember/vigil rows already use -- not a
+       hand-typed slug/subject pair that could silently drift from what the
+       office actually builds. The loser is the real data/ef/sanctoral.sexp
+       entry, [Commemoration_only], the exact shape that made this branch
+       need to be checked BEFORE the Commemoration_only catch-all. *)
+    ( "RG112(d): the BVM Saturday Office excludes a commemoration invoking \
+       the SAME BVM's intercession -- Omit, not Commemorate (Mt Carmel, \
+       16 July 2033, a real otherwise-unoccupied Saturday)",
+      of_temporal (mk 2033 7 16),
+      cand ~origin:P.Sanctoral ~rank:V.Class3 ~status:Cel.Commemoration_only ~subject:Sub.Saint
+        ~layer:PE.universal_layer "our-lady-of-mt-carmel",
+      "Omit" );
+    (* Conjunct 1/2, LOSER identity: an ORDINARY Commemoration_only saint
+       NOT on PE.marian_slugs must still reach the ordinary commemorate
+       flow even when the winner is the BVM Saturday Office -- proves
+       RG112(d) excludes a specific same-BVM collision, not every
+       commemoration the office happens to outrank (the real live shape,
+       1 August, Holy Machabees, PE.marian_slugs's own comment). *)
+    ( "RG112(d) does NOT fire when the LOSER is not a Marian commemoration \
+       -- an ordinary saint stays Commemorate(Ordinary) even under the BVM \
+       Saturday Office (1 August 2026, Holy Machabees)",
+      of_temporal (mk 2026 8 1),
+      cand ~origin:P.Sanctoral ~rank:V.Class3 ~status:Cel.Commemoration_only ~subject:Sub.Saint
+        ~layer:PE.universal_layer "holy-machabees",
+      "Commemorate(Ordinary)" );
+    (* Conjunct 2/2, WINNER identity: an ordinary (non-Bvm, non-Marian-
+       titled) winner must not exclude Mt Carmel either -- RG112(d) is
+       keyed on the WINNER also being "de B. Maria Virg.", not merely on
+       the loser's own identity. SYNTHETIC: no live date has an ordinary
+       Class3 saint winning outright while Mt Carmel also loses that same
+       day (Mt Carmel's own fixed date, 16 July, has no other real
+       sanctoral entry to construct this from) -- proves the conjunct is
+       real, not merely untested, the same "SYNTHETIC" discipline the
+       RG112(a) rows above already use for their own second conjunct. *)
+    ( "SYNTHETIC: RG112(d) does NOT fire when only the LOSER is Marian -- \
+       an ordinary winner leaves Mt Carmel Commemorate(Ordinary)",
+      cand ~origin:P.Sanctoral ~rank:V.Class3 ~subject:Sub.Saint ~layer:PE.universal_layer
+        "ef-synthetic-ordinary-winner",
+      cand ~origin:P.Sanctoral ~rank:V.Class3 ~status:Cel.Commemoration_only ~subject:Sub.Saint
+        ~layer:PE.universal_layer "our-lady-of-mt-carmel",
       "Commemorate(Ordinary)" )
   ]
 
@@ -1507,6 +1553,32 @@ let test_bvm_saturday_loses_to_a_real_feast_end_to_end () =
     [ ("ef-time-after-pentecost-15-saturday", "omitted: yielded to a higher day") ]
     (List.map (fun (c, reason) -> (S.to_string c.P.cel.Cel.slug, reason)) resolution.P.omitted)
 
+(* RG112(d), fix round 1 (coordinator finding F1) -- PE.marian_slugs's own
+   citation has the full argument. End-to-end through the REAL pipeline
+   (PE.band, PE.disposition AND PE.admit together): 16 July 2033, a real
+   otherwise-unoccupied Saturday, with the real data/ef/sanctoral.sexp
+   [our-lady-of-mt-carmel] entry as the day's only competing candidate.
+   Before this fix, [resolution.P.commemorations] held
+   [our-lady-of-mt-carmel:Ordinary] (confirmed live against real 2005/2033
+   `colitur day` output before this fix existed); after, it is empty and
+   Mt Carmel is reported omitted, not silently dropped. *)
+let test_bvm_saturday_excludes_mt_carmel_end_to_end () =
+  let date = mk 2033 7 16 in
+  let day_ctx = ctx date in
+  let bvm_saturday = of_temporal date in
+  let mt_carmel =
+    cand ~origin:P.Sanctoral ~rank:V.Class3 ~status:Cel.Commemoration_only ~subject:Sub.Saint
+      ~layer:PE.universal_layer "our-lady-of-mt-carmel"
+  in
+  let resolution = P.resolve real_rules day_ctx ~temporal:bvm_saturday ~sanctoral:[ mt_carmel ] in
+  Alcotest.(check string) "the BVM Saturday office is observed"
+    "ef-time-after-pentecost-5-saturday" (S.to_string resolution.P.observed.P.cel.Cel.slug);
+  Alcotest.(check (list string)) "Mt Carmel is NOT commemorated (RG112(d))" []
+    (List.map (fun (c, _) -> S.to_string c.P.cel.Cel.slug) resolution.P.commemorations);
+  Alcotest.(check (list (pair string string))) "Mt Carmel is reported omitted, not silently dropped"
+    [ ("our-lady-of-mt-carmel", "omitted: yielded to a higher day") ]
+    (List.map (fun (c, reason) -> (S.to_string c.P.cel.Cel.slug, reason)) resolution.P.omitted)
+
 (* RG 16(a) (register §6.0) reached end-to-end through the REAL pipeline
    ([PE.band], [PE.disposition] AND [PE.admit] together, not any one of
    them in isolation as this file's own hand-tagged rows test them
@@ -1989,6 +2061,10 @@ let suite =
            (2026-09-12)"
           `Quick test_bvm_saturday_loses_to_a_real_feast_end_to_end;
         Alcotest.test_case
+          "RG112(d), fix round 1 (F1): the BVM Saturday office excludes Mt Carmel, end-to-end \
+           (2033-07-16)"
+          `Quick test_bvm_saturday_excludes_mt_carmel_end_to_end;
+        Alcotest.test_case
           "RG16(a): a Feast of the Lord suppresses the Sunday's own commemoration entirely, \
            end-to-end (2028-08-06)"
           `Quick test_rg16a_lord_feast_suppresses_sunday_end_to_end;
diff --git a/test/test_temporal_ef.ml b/test/test_temporal_ef.ml
index ff3cc0b..4e97d33 100644
--- a/test/test_temporal_ef.ml
+++ b/test/test_temporal_ef.ml
@@ -507,25 +507,40 @@ let test_colours () =
    (6 Jan) is a Tuesday, so the actual first-Sunday-after-Epiphany origin is
    11 Jan -- exercising all four sub-stretches of the fix. *)
 let test_christmastide_feria_slugs () =
-  (* 26 Dec 2026 and 10 Jan 2026 are both SATURDAYS -- ef-bvm-saturday task
-     (RG 78, "De sancta Maria in sabbato"): every Christmastide feria
-     [christmastide_feria_slug] builds is unconditionally Class4
-     ([ferial_rank]'s own catch-all outside Advent/Lent/Passiontide), so on a
-     Saturday {!Rite_ef.Temporal_ef.bvm_saturday_names}'s own override fires
-     here too -- but per that citation's own "Slug" paragraph, the SLUG is
-     deliberately left UNCHANGED (reused from this same "-0-"/"-2-" naming,
-     not replaced): only colour/subject/name change. So the slug assertions
-     below are unaffected by the fix; what is NEW is the colour/subject
-     override on these two specific dates, asserted alongside them. *)
+  (* 26 Dec 2026 is a SATURDAY -- but, fix round 1 (coordinator finding F2),
+     it can NEVER actually hold the BVM Saturday office in the real
+     resolved pipeline: 26/27/28 December are St Stephen/St John/the Holy
+     Innocents (RG 67-70), fixed, unconditional, real data/ef/sanctoral.sexp
+     entries every single year (rank >= Class2), which always outrank a
+     Class4 temporal candidate -- so RG 78's own protasis ("in quibus
+     OCCURRIT Officium de feria IV classis") is never satisfied by ANY day
+     in the 26-28 December stretch, in any year. [T.temporal] itself has no
+     visibility into the sanctoral layer at all (by design -- the temporal
+     candidate is computed independent of what saint's day it is; Precedence
+     decides the winner afterward), so it still unconditionally tags this
+     date [subject = Bvm] -- a genuine, correct fact about [T.temporal]'s
+     own pure computation, but NOT a claim that this shape is ever the real
+     OBSERVED office, and pinning it with RG-78 citation language as if it
+     were would overclaim. Only the SLUG is asserted here (unaffected
+     either way, unconditionally correct); the override demonstration
+     itself uses 3 January and 10 January below instead -- both, checked
+     directly against data/ef/sanctoral.sexp, have no competing entry in
+     any year, so the BVM Saturday office genuinely IS reachable there. *)
   Alcotest.(check string) "26 Dec (Sat)" "ef-christmas-0-saturday" (slug_of (d 2026 12 26));
-  Alcotest.(check string) "26 Dec (Sat): the BVM Saturday office overrides the season colour (white, RG 120(b))"
-    "white" (colour_of (d 2026 12 26));
-  Alcotest.(check bool) "26 Dec (Sat): subject Bvm" true (subject_of (d 2026 12 26) = Sub.Bvm);
   Alcotest.(check string) "28 Dec (Mon)" "ef-christmas-0-monday" (slug_of (d 2026 12 28));
+  (* 3 Jan 2026 is a SATURDAY, genuinely reachable (data/ef/sanctoral.sexp
+     has no 3 January entry) -- the real demonstration for the "-1-"
+     stretch that 26 December's own Saturday could not honestly provide. *)
+  Alcotest.(check string) "3 Jan (Sat): slug stays the ordinary \"-1-\" naming" "ef-christmas-1-saturday"
+    (slug_of (d 2026 1 3));
+  Alcotest.(check string) "3 Jan (Sat): the BVM Saturday office overrides the season colour (white, RG 120(b))"
+    "white" (colour_of (d 2026 1 3));
+  Alcotest.(check bool) "3 Jan (Sat): subject Bvm" true (subject_of (d 2026 1 3) = Sub.Bvm);
   Alcotest.(check string) "2 Jan (Fri)" "ef-christmas-1-friday" (slug_of (d 2026 1 2));
   Alcotest.(check string) "5 Jan (Mon)" "ef-christmas-1-monday" (slug_of (d 2026 1 5));
   (* 7-10 Jan precede the actual origin Sunday (11 Jan): colitur-only, not
-     lectio's "week 1" key, precisely to avoid colliding with 12-13 Jan below. *)
+     lectio's "week 1" key, precisely to avoid colliding with 12-13 Jan below.
+     10 January is ALSO genuinely reachable (no sanctoral entry that date). *)
   Alcotest.(check string) "7 Jan (Wed, before the origin)" "ef-christmas-2-wednesday" (slug_of (d 2026 1 7));
   Alcotest.(check string) "10 Jan (Sat, before the origin)" "ef-christmas-2-saturday" (slug_of (d 2026 1 10));
   Alcotest.(check bool) "10 Jan (Sat): subject Bvm" true (subject_of (d 2026 1 10) = Sub.Bvm);