1 files changed, 14 insertions, 8 deletions
diff --git a/lib/kernel/validate.mli b/lib/kernel/validate.mli
index 385e111..9ad6b59 100644
--- a/lib/kernel/validate.mli
+++ b/lib/kernel/validate.mli
@@ -84,14 +84,20 @@ val failure_to_string : failure -> string
     {!Rite.readings} on every day and is held to neither, so this stays a
     check on rites that HAVE readings rather than a demand that every rite
     have them.
-    - ["citations"]: well-formedness. A day's citation parts, sorted, are
-      exactly [[First; Gospel]]. This single condition carries three
-      invariants at once: zero or two but never one (an Epistle without a
-      Gospel, or the reverse, is a malformed Mass rather than a partial one);
-      no part outside [First]/[Gospel] (the chants -- Psalm, Second, Tract,
-      Alleluia, Sequence -- are deliberately unbuilt, so one appearing is a
-      defect, not a feature arriving early); and no part twice (two Epistles
-      and no Gospel has length two and would pass a bare cardinality test).
+    - ["citations"]: well-formedness. A day's citation parts, sorted, must be
+      either empty or equal ONE of [rite.Rite.citation_shapes] exactly --
+      rite-supplied ({!Rite.t.citation_shapes}'s own doc comment has the
+      full citation and argument for why: EF has one shape, [[First;
+      Gospel]]; the OF has two, that same pair plus [[First; Second;
+      Gospel]] on Sundays/solemnities). This single condition carries three
+      invariants at once: zero, or exactly one of the rite's own complete
+      shapes, never a partial one (an Epistle without a Gospel, or the
+      reverse, is a malformed Mass under any rite's shape list); no part
+      outside what the rite itself declares (EF: the other chants remain
+      deliberately unbuilt, so one appearing is a defect, not a feature
+      arriving early); and no part twice (two Epistles and no Gospel has
+      length two and would pass a bare cardinality test, but matches none of
+      a rite's own declared shapes).
     - ["citations-unresolved"]: coverage. A day resolved NO citations at all,
       i.e. the rite's own lookup chain fell through every one of its steps.
       Deliberately a separate label from ["citations"] above: a coverage gap