1 files changed, 23 insertions, 0 deletions
diff --git a/lib/kernel/validate.mli b/lib/kernel/validate.mli
index b46ca30..385e111 100644
--- a/lib/kernel/validate.mli
+++ b/lib/kernel/validate.mli
@@ -78,6 +78,29 @@ val failure_to_string : failure -> string
       was not exceeded" available without embedding a rite's specific
       numeric caps (RG 111's, for EF) into kernel code.
 
+    Two further labels (Task 10) check the day's reading {!Citation.t}s. Both
+    are GATED on the rite producing at least one citation somewhere in the
+    year: a rite whose lectionary is not built returns [[]] from
+    {!Rite.readings} on every day and is held to neither, so this stays a
+    check on rites that HAVE readings rather than a demand that every rite
+    have them.
+    - ["citations"]: well-formedness. A day's citation parts, sorted, are
+      exactly [[First; Gospel]]. This single condition carries three
+      invariants at once: zero or two but never one (an Epistle without a
+      Gospel, or the reverse, is a malformed Mass rather than a partial one);
+      no part outside [First]/[Gospel] (the chants -- Psalm, Second, Tract,
+      Alleluia, Sequence -- are deliberately unbuilt, so one appearing is a
+      defect, not a feature arriving early); and no part twice (two Epistles
+      and no Gospel has length two and would pass a bare cardinality test).
+    - ["citations-unresolved"]: coverage. A day resolved NO citations at all,
+      i.e. the rite's own lookup chain fell through every one of its steps.
+      Deliberately a separate label from ["citations"] above: a coverage gap
+      and a well-formedness fault want different fixes and should be
+      countable apart. On the EF data as it stands this label has no live
+      witness -- every day of every year 1583..9999 resolves exactly one
+      Epistle and one Gospel -- which is precisely why test_validate.ml
+      carries a synthetic fixture proving it can fire at all.
+
     Total over the whole 1583..9999 domain, including [year] = 9999: the
     liturgical year opening there continues into out-of-domain civil year
     10000, so the walk is clamped to 31 December 9999 and the checks run