21 files changed, 2393 insertions, 90 deletions

diff --git a/lib/kernel/calendar.ml b/lib/kernel/calendar.ml
new file mode 100644
index 0000000..5d3572c
--- /dev/null
+++ b/lib/kernel/calendar.ml
@@ -0,0 +1,387 @@
+(* Resolution across a whole liturgical year. See calendar.mli for the
+   architectural rationale (why [year] is the primitive and [day] derived). *)
+
+(* The kernel's domain floor and ceiling (Date.make's documented 1583..9999
+   bound). Both are always constructible -- in-range by definition -- so
+   neither of these can itself raise. *)
+let domain_min_date =
+  match Date.make ~year:1583 ~month:1 ~day:1 with Ok d -> d | Error e -> failwith e
+
+let domain_max_date =
+  match Date.make ~year:9999 ~month:12 ~day:31 with Ok d -> d | Error e -> failwith e
+
+(* [start, stop] for the liturgical year opening in civil year [y], clamped at
+   both ends of the domain rather than calling [rite.year_start] on a civil
+   year outside 1583..9999.
+
+   Top: at [y] = 9999, [rite.year_start (y + 1)] would ask for civil year
+   10000 -- out of Date's domain (Plan 2 shipped exactly this bug in
+   Validate). Clamp [stop] to 31 December 9999 instead: the final liturgical
+   year comes back truncated, not un-computable.
+
+   Bottom: symmetric case, reachable only through [day] below. A date in
+   civil year 1583 before that year's own [rite.year_start] genuinely belongs
+   to the liturgical year that opened in civil year 1582 for an
+   Advent-anchored rite -- but [rite.year_start 1582] is equally out of
+   domain. [day] only ever decrements a valid date's own (in-domain) civil
+   year by at most one, so [y] = 1582 is the sole way this branch is reached.
+   Clamp [start] to 1 January 1583: "year 1582" becomes the truncated
+   stretch from the domain floor up to the day before [rite.year_start 1583],
+   which is exactly the sliver a date there needs.
+
+   [y] itself is clamped once, up front, to [1582, 9999] -- not left to each
+   branch's own guard. Task 5's review found that guarding [start] and [stop]
+   independently protected only one of their two [rite.year_start] calls
+   each: [start]'s guard (["y < 1583"]) leaves [stop]'s "y + 1" call
+   unguarded at the bottom (["year 999"] still called [year_start 1000], out
+   of domain), and [stop]'s guard (["y >= 9999"]) leaves [start]'s call
+   unguarded at the top (["year 100000"] still called [year_start 100000]).
+   Neither is reachable through [day] (see calendar.mli), but [year] is
+   public, and a direct out-of-contract call must not raise either. Clamping
+   [y] once closes both gaps with one check instead of two. *)
+let year_bounds (rite : ('s, 'r) Rite.t) (y : int) : Date.t * Date.t =
+  let y = max 1582 (min 9999 y) in
+  let start = if y < 1583 then domain_min_date else rite.Rite.year_start y in
+  let stop =
+    if y >= 9999 then domain_max_date else Date.add_days (rite.Rite.year_start (y + 1)) (-1)
+  in
+  (start, stop)
+
+(* RG 91's contest for one date: the temporal office against every sanctoral
+   entry whose Date_spec resolves to it, plus whatever the placement pass
+   below has [injected] there so far (a celebration transferred in from an
+   impeded day elsewhere). [Layer.on_date] is keyed on exactly (month, day),
+   which for a [Fixed] spec -- the only form Plan 2 ships -- is the same test
+   as resolving the spec against [date]'s own year and comparing, so no
+   separate filter is needed here.
+
+   [injected] is keyed by [Date.to_rata] rather than [Date.t] directly:
+   [Date.t] carries no [compare]-respecting hash, and rata-die is already the
+   canonical total order this module uses for date arithmetic. *)
+let resolve_with_injected (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date)
+    (injected : (int, 'r Precedence.candidate list) Hashtbl.t) (date : Date.t) :
+    ('s, 'r) Temporal.t * 's Precedence.context * 'r Precedence.resolution =
+  let temporal = rite.Rite.temporal date in
+  let temporal_candidate =
+    { Precedence.cel = temporal.Temporal.office; origin = Precedence.Temporal }
+  in
+  let natural =
+    Layer.on_date idx ~month:(Date.month date) ~day:(Date.day date)
+    |> List.map (fun (e : 'r Layer.entry) ->
+           { Precedence.cel = e.Layer.cel; origin = Precedence.Sanctoral })
+  in
+  let arrived = try Hashtbl.find injected (Date.to_rata date) with Not_found -> [] in
+  let ctx = { Precedence.date; season = temporal.Temporal.season; weekday = temporal.Temporal.weekday } in
+  let resolution =
+    Precedence.resolve rite.Rite.rules ctx ~temporal:temporal_candidate ~sanctoral:(natural @ arrived)
+  in
+  (temporal, ctx, resolution)
+
+(* What Precedence.resolve currently reports as observed on [date], given the
+   placements decided so far -- this is exactly the [occupant] callback
+   Rite.transfer_target's search walks forward with (rite.mli explains why
+   that judgement has to come from the rite, not from here). *)
+let occupant_of (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date)
+    (injected : (int, 'r Precedence.candidate list) Hashtbl.t) (date : Date.t) : 'r Celebration.t =
+  let _, _, resolution = resolve_with_injected rite idx injected date in
+  resolution.Precedence.observed.Precedence.cel
+
+(* Hard guard on the placement fixed point (spec §2.4): every genuine
+   transfer moves a celebration strictly forward and the celebration set is
+   finite, so the round below always empties [deferred] within a handful of
+   rounds in practice (an RG 97-98 collision of N feasts on one date costs at
+   most N-1 extra rounds -- each round resolves the winner of whatever pile-up
+   occurred and re-defers the rest, one fewer each time). 64 is not tuned to
+   that bound; it is a defensive ceiling nothing in the 1962 calendar comes
+   close to, so that a rite/data combination this module has not anticipated
+   fails as a recorded, inspectable [omitted] reason (below) instead of
+   hanging the CLI. *)
+let max_transfer_rounds = 64
+
+let unconverged_reason =
+  "omitted: transfer placement did not converge within max_transfer_rounds (RG 96-98)"
+
+(* A rite-supplied [transfer_target] is trusted to search strictly forward
+   (rite.mli), but nothing stops it naming a date past the end of the
+   liturgical year it was asked about -- e.g. an I-class feast impeded in
+   the last days before Advent I, whose first admissible day genuinely
+   falls in the following liturgical year's own territory (unproven to
+   occur in the real EF calendar, but not something this module can rule
+   out by construction). [place_transfers] never injects such a target: the
+   [dates] array is exactly what [year]/[build_day] walk to produce the
+   result, so a candidate placed outside it would be [observed]/
+   [transferred_in] nowhere in the output at all -- gone, not merely
+   mis-filed, and silently so, contradicting [calendar.mli]'s "never
+   silently dropped". This reason makes that failure mode visible instead. *)
+let out_of_range_reason = "omitted: transfer target falls outside the liturgical year (RG 96)"
+
+(* Rebuilds the per-date injection index from [assignment] (slug -> (origin,
+   target)) fresh each round, rather than accumulating it incrementally as
+   candidates are placed. A candidate re-deferred in a later round (its first
+   target turned out to already be claimed by a higher-band rival, see
+   [place_transfers]) must vacate its old target date entirely, not merely
+   gain a second one; rebuilding from a slug-keyed map, which holds exactly
+   one entry per candidate, gives that for free. An append-only structure
+   would instead leave the stale placement behind forever, and the round
+   loop would never see [deferred] empty out. *)
+let injected_index_of_assignment (assignment : (string, Date.t * Date.t) Hashtbl.t)
+    (candidate_by_slug : (string, 'r Precedence.candidate) Hashtbl.t) :
+    (int, 'r Precedence.candidate list) Hashtbl.t =
+  let tbl : (int, 'r Precedence.candidate list) Hashtbl.t = Hashtbl.create 16 in
+  Hashtbl.iter
+    (fun slug (_origin, target) ->
+      let key = Date.to_rata target in
+      let c = Hashtbl.find candidate_by_slug slug in
+      Hashtbl.replace tbl key (c :: (try Hashtbl.find tbl key with Not_found -> [])))
+    assignment;
+  tbl
+
+(* The placement pass itself (spec §2.4 steps 1-4; step 5, recording
+   transferred_in/out, is [year]'s job once this reaches a fixed point).
+
+   Every [Precedence.Transfer]-*and*-[Precedence.Repose]-disposed loser lands
+   in [resolution.deferred] together -- [Precedence.resolve]'s own fold
+   matches them as one case, [Transfer | Repose -> ... :: defs ...] -- and
+   everything gathered below is routed through
+   [rite.transfer_target], i.e. RG 96's next-admissible-day search. That is
+   only correct for [Transfer]. [Repose] denotes RG 100-102's *repositio*
+   (perpetual impediment, reassigned to the next appropriate day and treated
+   as proper) -- a distinct rubric this module does not implement. It is
+   documented here rather than split into a second mechanism because nothing
+   currently produces [Repose]: the design spec records it as "declared, not
+   exercised" (§1.3) -- the EF ruleset (Tasks 7-9) returns it for nothing;
+   perpetual impediment arises from proper/diocesan calendars, which are
+   overlay content, out of this plan's scope. If a future rite's rules ever
+   do return [Repose], it would silently take the RG 96 path here, which
+   would be wrong -- worth knowing before that day, not discovering it then.
+
+   Each round: gather every currently-deferred candidate across the whole
+   year (fresh, against this round's [injected] state -- a candidate already
+   placed and now winning its target is no longer a loser anywhere and so
+   will not reappear here); if none, the fixed point is reached. Otherwise
+   sort ALL of them by band -- RG 97-98: this is the global ordering that
+   decides who transfers first when I-class feasts coincide -- ties break on
+   slug, same convention as Precedence.compare_by, so placement never depends
+   on the layer's own entry order. Then place each in turn, in that order.
+
+   [claimed_this_round] is what makes the sort actually decide anything: it
+   starts empty every round and gains one entry per candidate placed so far
+   THIS round, and [occupant_with_claims] reports a claimed date as occupied
+   by whoever claimed it, layered on top of [injected] (last round's settled
+   state, frozen for the round -- see [injected_index_of_assignment] for why
+   that has to stay frozen rather than being updated in place). Without it,
+   every candidate in a round would search against the exact same snapshot
+   and a same-date collision would only be caught (and only one side of it
+   corrected) on re-resolution next round, one collision layer per round --
+   RG 97-98's own ordering would still come out right in the end, but only
+   by accident of Precedence.resolve's own internal tie-break repeating this
+   module's, not because this module's sort ever decided anything. Layering
+   the claims instead means a same-round collision is resolved in the one
+   round it is found, in the sorted order, and the earlier RG 97-98 test
+   pins exactly that: it fails on "claims 2 Feb first" without this.
+
+   [~start ~stop] bound the [transfer_target] a placement is allowed to
+   settle on: outside that range it goes into [out_of_range] instead of
+   [assignment], permanently (never retried -- [transfer_target] is a pure
+   function of a candidate's own permanent origin and the occupancy state,
+   so asking it again would only recompute the same out-of-range answer). *)
+let place_transfers (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date) ~(start : Date.t)
+    ~(stop : Date.t) (dates : Date.t array) :
+    (string, Date.t * Date.t) Hashtbl.t
+    * (string, 'r Precedence.candidate) Hashtbl.t
+    * (string, Date.t * Date.t) Hashtbl.t =
+  let assignment : (string, Date.t * Date.t) Hashtbl.t = Hashtbl.create 16 in
+  let candidate_by_slug : (string, 'r Precedence.candidate) Hashtbl.t = Hashtbl.create 16 in
+  let out_of_range : (string, Date.t * Date.t) Hashtbl.t = Hashtbl.create 4 in
+  let compare_deferred (_, ctx1, c1) (_, ctx2, c2) =
+    let b1 = rite.Rite.rules.Precedence.band ctx1 c1 in
+    let b2 = rite.Rite.rules.Precedence.band ctx2 c2 in
+    if b1 <> b2 then Int.compare b1 b2
+    else Slug.compare c1.Precedence.cel.Celebration.slug c2.Precedence.cel.Celebration.slug
+  in
+  let round = ref 0 in
+  let converged = ref false in
+  let guard_hit = ref false in
+  while (not !converged) && not !guard_hit do
+    incr round;
+    if !round > max_transfer_rounds then guard_hit := true
+    else begin
+      let injected = injected_index_of_assignment assignment candidate_by_slug in
+      let raw =
+        Array.to_list dates
+        |> List.concat_map (fun date ->
+               let _, ctx, resolution = resolve_with_injected rite idx injected date in
+               List.map (fun c -> (date, ctx, c)) resolution.Precedence.deferred)
+      in
+      (* [raw] rediscovers every candidate's *permanent* natural loss at its
+         origin every round -- the layer entry never moves, so a candidate
+         already settled elsewhere still shows up losing at the date it was
+         always going to lose at. Left unfiltered, that stale sighting gets
+         placed again right next to the candidate's own already-settled
+         self, which -- because a placed candidate's own rank makes it look
+         "occupied" to a fresh search starting from its original origin --
+         oscillates between two dates forever, never reaching [deferred =
+         []] (confirmed by removing this filter: "transferable" lands on 14
+         Jan instead of 13 in test_transfer_moves_and_does_not_duplicate,
+         not merely "doesn't converge" -- the bug is a wrong answer, not
+         only a hang). A sighting is genuinely actionable only if the
+         candidate has never been placed yet (first time seen, and not
+         already known unplaceable -- [out_of_range] gets the same
+         permanent exclusion [assignment] does, for the same reason), or if
+         it is losing exactly at the date it is *currently* assigned to (a
+         fresh RG 97-98 bump: something else also landed there and
+         out-ranked it) -- any other date is the stale, permanent one and is
+         dropped. *)
+      let deferred =
+        List.filter
+          (fun (date, _ctx, c) ->
+            let slug = Slug.to_string c.Precedence.cel.Celebration.slug in
+            if Hashtbl.mem out_of_range slug then false
+            else
+              match Hashtbl.find_opt assignment slug with
+              | None -> true
+              | Some (_, target) -> Date.compare date target = 0)
+          raw
+      in
+      if deferred = [] then converged := true
+      else begin
+        let claimed_this_round : (int, 'r Precedence.candidate) Hashtbl.t = Hashtbl.create 4 in
+        let occupant_with_claims d =
+          match Hashtbl.find_opt claimed_this_round (Date.to_rata d) with
+          | Some c -> c.Precedence.cel
+          | None -> occupant_of rite idx injected d
+        in
+        List.stable_sort compare_deferred deferred
+        |> List.iter (fun (origin, _ctx, c) ->
+               let target = rite.Rite.transfer_target c origin occupant_with_claims in
+               let slug = Slug.to_string c.Precedence.cel.Celebration.slug in
+               if Date.compare target start < 0 || Date.compare target stop > 0 then
+                 Hashtbl.replace out_of_range slug (origin, target)
+               else begin
+                 Hashtbl.replace claimed_this_round (Date.to_rata target) c;
+                 Hashtbl.replace assignment slug (origin, target);
+                 Hashtbl.replace candidate_by_slug slug c
+               end)
+      end
+    end
+  done;
+  (assignment, candidate_by_slug, out_of_range)
+
+(* The final build of one day, once placement has reached its fixed point (or
+   exhausted the guard): resolve against the settled [injected] state, then
+   layer on [transferred_in] (this date received an injected candidate that
+   went on to win) and [transferred_out] (whichever candidates' settled
+   placements originated here -- RG 97-98 lets that be more than one; see
+   [Liturgical_day.transferred_out]). *)
+let build_day (rite : ('s, 'r) Rite.t) (idx : 'r Layer.by_date)
+    (assignment : (string, Date.t * Date.t) Hashtbl.t)
+    (out_of_range : (string, Date.t * Date.t) Hashtbl.t)
+    (injected : (int, 'r Precedence.candidate list) Hashtbl.t)
+    (transferred_out_of : (int, ('r Celebration.t * Date.t) list) Hashtbl.t) (date : Date.t) :
+    ('s, 'r) Liturgical_day.t =
+  let temporal, _ctx, resolution = resolve_with_injected rite idx injected date in
+  let arrived = try Hashtbl.find injected (Date.to_rata date) with Not_found -> [] in
+  let transferred_in =
+    arrived
+    |> List.find_opt (fun c ->
+           Slug.equal c.Precedence.cel.Celebration.slug
+             resolution.Precedence.observed.Precedence.cel.Celebration.slug)
+    |> Option.map (fun c -> c.Precedence.cel)
+  in
+  let transferred_out =
+    try Hashtbl.find transferred_out_of (Date.to_rata date) with Not_found -> []
+  in
+  (* [resolution.deferred] here is NOT "the placement pass never got to
+     these": it is the origin day's own permanent, structural loss -- the
+     layer entry that lost the RG 91 contest here never moves, so a
+     candidate successfully placed somewhere else still shows up losing at
+     the exact date it was always going to lose at (this is the same fact
+     [place_transfers]'s round loop has to filter around, see its comment).
+     A [deferred] sighting only belongs in [omitted] if it was never
+     actually settled anywhere -- i.e. it is stuck in [out_of_range], or the
+     guard above was hit before it reached a day it wins. Settled elsewhere
+     means genuinely accounted for via [observed]/[transferred_in] on the
+     day it landed and [transferred_out] here, not via [omitted] too --
+     double-booking it in both would fail Task 12's "appears exactly once"
+     reading of this day alone. *)
+  let unresolved c =
+    let slug = Slug.to_string c.Precedence.cel.Celebration.slug in
+    if Hashtbl.mem out_of_range slug then true
+    else
+      match Hashtbl.find_opt assignment slug with
+      | None -> true
+      | Some (_, target) ->
+          not (Slug.equal (occupant_of rite idx injected target).Celebration.slug c.Precedence.cel.Celebration.slug)
+  in
+  let reason_for c =
+    if Hashtbl.mem out_of_range (Slug.to_string c.Precedence.cel.Celebration.slug) then
+      out_of_range_reason
+    else unconverged_reason
+  in
+  let omitted =
+    List.map (fun (c, reason) -> (c.Precedence.cel, reason)) resolution.Precedence.omitted
+    @ (resolution.Precedence.deferred |> List.filter unresolved
+      |> List.map (fun c -> (c.Precedence.cel, reason_for c)))
+  in
+  {
+    Liturgical_day.date;
+    rite = rite.Rite.id;
+    temporal;
+    observed = resolution.Precedence.observed.Precedence.cel;
+    commemorations =
+      List.map (fun (c, p) -> (c.Precedence.cel, p)) resolution.Precedence.commemorations;
+    transferred_in;
+    transferred_out;
+    omitted;
+    citations = [];
+  }
+
+let year (rite : ('s, 'r) Rite.t) (layer : 'r Layer.t) (y : int) :
+    ('s, 'r) Liturgical_day.t array =
+  let idx = Layer.index_by_date layer in
+  let start, stop = year_bounds rite y in
+  (* [max 0]: defends [Array.init] against a negative length, which would
+     otherwise arise for a rite whose [year_start] lands exactly on the
+     domain floor (start clamps to the same date, giving [stop] a day
+     before it). Not reachable through [day] -- see calendar.mli -- but
+     [year] is public, and a direct out-of-contract call must not raise
+     either. *)
+  let n = max 0 (Date.to_rata stop - Date.to_rata start + 1) in
+  let dates = Array.init n (fun i -> Date.add_days start i) in
+  let assignment, candidate_by_slug, out_of_range = place_transfers rite idx ~start ~stop dates in
+  let injected = injected_index_of_assignment assignment candidate_by_slug in
+  let transferred_out_of : (int, ('r Celebration.t * Date.t) list) Hashtbl.t = Hashtbl.create 16 in
+  Hashtbl.iter
+    (fun slug (origin, target) ->
+      let cel = (Hashtbl.find candidate_by_slug slug).Precedence.cel in
+      let key = Date.to_rata origin in
+      Hashtbl.replace transferred_out_of key
+        ((cel, target) :: (try Hashtbl.find transferred_out_of key with Not_found -> [])))
+    assignment;
+  (* Canonicalise each day's departures: the accumulation above walks
+     [assignment] via [Hashtbl.iter], whose bucket order is not guaranteed
+     stable across runs (OCaml's hash seed can be randomised via
+     OCAMLRUNPARAM=R), so a day with more than one departure -- RG 97-98's
+     coinciding-feasts case -- would otherwise report them in a
+     run-dependent order: an environment read, in a kernel whose invariants
+     forbid one. [Layer.index_by_date] guards against exactly this by
+     re-sorting each date bucket after building it (layer.ml); same fix,
+     same reason. Sorted by target date -- which, for a correctly-converged
+     year, is also RG 97-98's own order: the higher-precedence loser claims
+     the earlier admissible day -- ties (not expected, but not assumed
+     impossible) broken on slug. *)
+  let by_target_then_slug (c1, t1) (c2, t2) =
+    let dc = Date.compare t1 t2 in
+    if dc <> 0 then dc else Slug.compare c1.Celebration.slug c2.Celebration.slug
+  in
+  Hashtbl.iter
+    (fun k v -> Hashtbl.replace transferred_out_of k (List.sort by_target_then_slug v))
+    transferred_out_of;
+  Array.map (build_day rite idx assignment out_of_range injected transferred_out_of) dates
+
+let day (rite : ('s, 'r) Rite.t) (layer : 'r Layer.t) (date : Date.t) :
+    ('s, 'r) Liturgical_day.t =
+  let cy = Date.year date in
+  let y = if Date.compare date (rite.Rite.year_start cy) >= 0 then cy else cy - 1 in
+  let start, _ = year_bounds rite y in
+  (year rite layer y).(Date.to_rata date - Date.to_rata start)
diff --git a/lib/kernel/calendar.mli b/lib/kernel/calendar.mli
new file mode 100644
index 0000000..1c0b0ed
--- /dev/null
+++ b/lib/kernel/calendar.mli
@@ -0,0 +1,72 @@
+(** Resolution across a whole liturgical year (spec §2.4).
+
+    Transfers make per-date resolution impossible to do correctly: resolving
+    25 March can push a feast onto 26 March, and RG 97-98 has coinciding
+    I-class feasts transfer in table order, which needs global knowledge of
+    the whole year. So [year] is the primitive -- it resolves every date in
+    one pass -- and [day] is derived: it finds the liturgical year containing
+    a date and indexes into it. Both are pure; neither caches.
+
+    Once every day's temporal-vs-sanctoral contest is resolved, [year] places
+    every deferred candidate (RG 96-98): a losing I-class candidate the
+    rite's rules send to [Precedence.Transfer] does not stay put -- it moves
+    to the next day [rite.transfer_target] names as admissible, and both
+    ends of the move are recorded: [transferred_in] on the day it arrives
+    (at most one -- RG 96 sends each departure to the next day that is not I
+    or II class, and the first to arrive occupies it), [transferred_out] on
+    the day it left (a list, not an option: RG 97-98 has coinciding I-class
+    feasts transfer "in order", so one day can lose more than one). Every
+    deferred candidate is accounted for exactly once: placed, or -- only if
+    the placement fixed point is not reached within the round guard (which
+    nothing in the 1962 calendar is expected to trigger), or the rite's own
+    [transfer_target] names a date outside this liturgical year's own range
+    (unproven to occur in the real EF calendar, but not ruled out by
+    construction) -- left in [Liturgical_day.omitted] with a reason that
+    says which, never silently dropped. See [calendar.ml]'s
+    [place_transfers] for the algorithm and its termination argument.
+
+    [Precedence.Repose]-disposed losers are gathered the same way
+    [Precedence.Transfer]-disposed ones are (Precedence folds both into
+    [deferred] as one case) and are routed through the same RG 96 search.
+    That is only correct for [Transfer]: [Repose] denotes RG 100-102's
+    *repositio*, a distinct rubric this module does not implement. Nothing
+    in the EF ruleset currently returns [Repose] (design spec §1.3:
+    "declared, not exercised" -- perpetual impediment arises from
+    proper/diocesan calendars, out of this plan's scope), so the gap is
+    latent rather than a live bug; documented here rather than given a
+    second mechanism for a disposition nothing emits. *)
+
+(** [year rite layer y] resolves every day of the liturgical year that opens
+    in civil year [y]: from [rite.year_start y] through the day before
+    [rite.year_start (y + 1)], inclusive of both ends.
+
+    Total over 1583..9999, including the boundary years, and beyond them too:
+    [y] is clamped to [1582, 9999] before either bound is computed (not just
+    guarded near the two edges independently -- see [year_bounds] in
+    [calendar.ml] for why that distinction matters), so [year] never raises
+    regardless of the [y] it is given, not only for values near the domain
+    edge.
+    - At [y] = 9999, [rite.year_start (y + 1)] would ask for civil year
+      10000, out of {!Date}'s domain (this is the bug Plan 2 shipped in
+      [Validate] and later fixed). The end of the walk clamps to 31 December
+      9999 instead of computing that call; the returned year comes back
+      truncated to whatever the rite's own temporal cycle covers between
+      [rite.year_start 9999] and the last day of that civil year, not
+      un-computable.
+    - Symmetrically, [y] < 1583 clamps the start of the walk to 1 January
+      1583 instead of calling [rite.year_start y] on an out-of-domain civil
+      year. [year] is never called this way directly by anything in this
+      module; {!day} is the only caller that can reach [y] = 1582 (one below
+      the floor, never lower), when the date it was asked about sits in civil
+      year 1583 before that year's own [rite.year_start] -- i.e. the sliver
+      whose true liturgical year opened in civil year 1582, which the domain
+      cannot represent. Calling [year] with such a [y] directly is also safe:
+      it returns exactly that truncated sliver. *)
+val year : ('s, 'r) Rite.t -> 'r Layer.t -> int -> ('s, 'r) Liturgical_day.t array
+
+(** [day rite layer date] finds the liturgical year containing [date] -- the
+    year [y] with [rite.year_start y <= date < rite.year_start (y + 1)] --
+    and returns its slot for [date]. Recomputes that whole year on every
+    call: pure, no cache, no mutable state. Acceptable cost for the natural
+    usage (dump a year, sweep years for validation), which pays it once. *)
+val day : ('s, 'r) Rite.t -> 'r Layer.t -> Date.t -> ('s, 'r) Liturgical_day.t
diff --git a/lib/kernel/celebration.ml b/lib/kernel/celebration.ml
index 2963366..eb4249e 100644
--- a/lib/kernel/celebration.ml
+++ b/lib/kernel/celebration.ml
@@ -8,10 +8,17 @@ open Sexplib0.Sexp_conv
    but would carry no information while forcing every consumer (Layer,
    Overlay, and later Precedence and Calendar) to thread a variable that
    means nothing. *)
+(* Whether this celebration can be the observed day at all. The 1960 reform
+   reduced many feasts to a bare commemoration; they retain a rank (RG 111 orders
+   admitted commemorations by dignity) but can never be observed. NOT a fifth
+   rank: RG 8 fixes the classes at four. *)
+type status = Feast | Commemoration_only [@@deriving sexp]
+
 type 'r t = {
   slug : Slug.t;
   names : Names.t;
   rank : 'r;
+  status : status;
   colour : Colour.t;
   subject : Subject.t;
   citations : Citation.t list;
@@ -19,6 +26,6 @@ type 'r t = {
 }
 [@@deriving sexp]
 
-let make ~slug ?(names = Names.empty) ~rank ~colour ?(subject = Subject.Temporal)
-    ?(citations = []) ~layer () =
-  { slug; names; rank; colour; subject; citations; layer }
+let make ~slug ?(names = Names.empty) ~rank ?(status = Feast) ~colour
+    ?(subject = Subject.Temporal) ?(citations = []) ~layer () =
+  { slug; names; rank; status; colour; subject; citations; layer }
diff --git a/lib/kernel/celebration.mli b/lib/kernel/celebration.mli
index 1c84d35..a3c2960 100644
--- a/lib/kernel/celebration.mli
+++ b/lib/kernel/celebration.mli
@@ -1,8 +1,15 @@
+(** Whether this celebration can be the observed day at all. The 1960 reform
+    reduced many feasts to a bare commemoration; they retain a rank (RG 111
+    orders admitted commemorations by dignity) but can never be observed. NOT
+    a fifth rank: RG 8 fixes the classes at four. *)
+type status = Feast | Commemoration_only [@@deriving sexp]
+
 (** A celebration. Parameterised by the rite's rank type only. *)
 type 'r t = {
   slug : Slug.t;
   names : Names.t;
   rank : 'r;
+  status : status;
   colour : Colour.t;
   subject : Subject.t;
   citations : Citation.t list;
@@ -10,7 +17,8 @@ type 'r t = {
 }
 [@@deriving sexp]
 
-(** [subject] defaults to [Subject.Temporal], [names] to empty, [citations] to []. *)
+(** [status] defaults to [Feast], [subject] to [Subject.Temporal], [names] to
+    empty, [citations] to []. *)
 val make :
-  slug:Slug.t -> ?names:Names.t -> rank:'r -> colour:Colour.t ->
+  slug:Slug.t -> ?names:Names.t -> rank:'r -> ?status:status -> colour:Colour.t ->
   ?subject:Subject.t -> ?citations:Citation.t list -> layer:string -> unit -> 'r t
diff --git a/lib/kernel/liturgical_day.ml b/lib/kernel/liturgical_day.ml
new file mode 100644
index 0000000..bbb52b8
--- /dev/null
+++ b/lib/kernel/liturgical_day.ml
@@ -0,0 +1,27 @@
+open Sexplib0.Sexp_conv
+
+(* The single stable result schema (parent spec §2). *)
+type ('s, 'r) t = {
+  date : Date.t;
+  rite : string;
+  temporal : ('s, 'r) Temporal.t;
+      (** embedded, not flattened: it is already a coherent unit with its own
+          invariants, and re-listing season/week/weekday here would create two
+          places for them to disagree *)
+  observed : 'r Celebration.t;
+  commemorations : ('r Celebration.t * Precedence.privilege) list;
+  transferred_in : 'r Celebration.t option;
+      (** arrived here from an impeded day *)
+  transferred_out : ('r Celebration.t * Date.t) list;
+      (** celebrations that left this day, and where each one went. A list,
+          not an option: RG 97-98 has coinciding I-class feasts transfer
+          "in order" -- plural -- so a day can lose more than one. Asymmetric
+          with [transferred_in] deliberately: a day receives at most one
+          arrival, because RG 96 sends each departure to the next day that
+          is not I or II class, and the first to arrive occupies it. *)
+  omitted : ('r Celebration.t * string) list;
+      (** with the reason, never silent -- Task 12's no-celebration-lost
+          invariant reads this *)
+  citations : Citation.t list;  (** always empty until Plan 4 *)
+}
+[@@deriving sexp]
diff --git a/lib/kernel/liturgical_day.mli b/lib/kernel/liturgical_day.mli
new file mode 100644
index 0000000..a109251
--- /dev/null
+++ b/lib/kernel/liturgical_day.mli
@@ -0,0 +1,25 @@
+(** The single stable result schema (parent spec §2). *)
+type ('s, 'r) t = {
+  date : Date.t;
+  rite : string;
+  temporal : ('s, 'r) Temporal.t;
+      (** embedded, not flattened: it is already a coherent unit with its own
+          invariants, and re-listing season/week/weekday here would create two
+          places for them to disagree *)
+  observed : 'r Celebration.t;
+  commemorations : ('r Celebration.t * Precedence.privilege) list;
+  transferred_in : 'r Celebration.t option;
+      (** arrived here from an impeded day *)
+  transferred_out : ('r Celebration.t * Date.t) list;
+      (** celebrations that left this day, and where each one went. A list,
+          not an option: RG 97-98 has coinciding I-class feasts transfer
+          "in order" -- plural -- so a day can lose more than one. Asymmetric
+          with [transferred_in] deliberately: a day receives at most one
+          arrival, because RG 96 sends each departure to the next day that
+          is not I or II class, and the first to arrive occupies it. *)
+  omitted : ('r Celebration.t * string) list;
+      (** with the reason, never silent -- Task 12's no-celebration-lost
+          invariant reads this *)
+  citations : Citation.t list;  (** always empty until Plan 4 *)
+}
+[@@deriving sexp]
diff --git a/lib/kernel/precedence.ml b/lib/kernel/precedence.ml
new file mode 100644
index 0000000..05ad69f
--- /dev/null
+++ b/lib/kernel/precedence.ml
@@ -0,0 +1,69 @@
+(* The rite-parameterised resolver. RG 91 says who wins; RG 92-95 says what
+   happens to the loser; RG 108-111 says how many commemorations are admitted.
+   Three separate functions, because the loser's fate depends on the loser's own
+   rank, not the winner's. *)
+open Sexplib0.Sexp_conv
+
+type origin = Temporal | Sanctoral [@@deriving sexp]
+type privilege = Privileged | Ordinary [@@deriving sexp]
+type disposition = Omit | Commemorate of privilege | Transfer | Repose [@@deriving sexp]
+
+type 'r candidate = { cel : 'r Celebration.t; origin : origin } [@@deriving sexp]
+
+type 's context = { date : Date.t; season : 's; weekday : Date.weekday }
+
+type ('s, 'r) rules = {
+  band : 's context -> 'r candidate -> int;
+  disposition : winner:'r candidate -> loser:'r candidate -> disposition;
+  admit :
+    observed:'r candidate ->
+    ('r candidate * privilege) list ->
+    ('r candidate * privilege) list;
+}
+
+type 'r resolution = {
+  observed : 'r candidate;
+  commemorations : ('r candidate * privilege) list;
+  deferred : 'r candidate list;
+  omitted : ('r candidate * string) list;
+}
+
+(* Ties break on slug so the result never depends on input order. *)
+let compare_by rules ctx a b =
+  let ba = rules.band ctx a and bb = rules.band ctx b in
+  if ba <> bb then Int.compare ba bb
+  else Slug.compare a.cel.Celebration.slug b.cel.Celebration.slug
+
+let resolve rules ctx ~temporal ~sanctoral =
+  (* A commemoration-only entry can never be observed (see Celebration.status),
+     so it is held out of the contest entirely rather than relying on its band. *)
+  let eligible, forced_comm =
+    List.partition
+      (fun c -> c.cel.Celebration.status = Celebration.Feast)
+      sanctoral
+  in
+  let sorted = List.stable_sort (compare_by rules ctx) (temporal :: eligible) in
+  let observed = List.hd sorted in
+  let losers = List.tl sorted @ forced_comm in
+  let comms, deferred, omitted =
+    List.fold_left
+      (fun (comms, defs, omits) l ->
+        match rules.disposition ~winner:observed ~loser:l with
+        | Commemorate p -> ((l, p) :: comms, defs, omits)
+        | Transfer | Repose -> (comms, l :: defs, omits)
+        | Omit -> (comms, defs, (l, "omitted: yielded to a higher day") :: omits))
+      ([], [], []) losers
+  in
+  let comms = List.rev comms and deferred = List.rev deferred in
+  let admitted = rules.admit ~observed comms in
+  let dropped =
+    List.filter (fun c -> not (List.exists (fun a -> fst a == fst c) admitted)) comms
+  in
+  {
+    observed;
+    commemorations = admitted;
+    deferred;
+    omitted =
+      List.rev omitted
+      @ List.map (fun (c, _) -> (c, "omitted: admission limit reached")) dropped;
+  }
diff --git a/lib/kernel/precedence.mli b/lib/kernel/precedence.mli
new file mode 100644
index 0000000..ae054dd
--- /dev/null
+++ b/lib/kernel/precedence.mli
@@ -0,0 +1,78 @@
+(** The rite-parameterised resolver: RG 91 says who wins, RG 92-95 says what
+    happens to the loser, RG 108-111 says how many commemorations are admitted.
+    Three separate rite-supplied functions, because the loser's fate depends on
+    the loser's own rank, not the winner's -- conflating them would resist
+    extension to a second rite. *)
+
+(** Which of the day's two office streams a candidate came from. *)
+type origin = Temporal | Sanctoral [@@deriving sexp]
+
+(** RG 111: an admitted commemoration's own standing, distinct from its rank. *)
+type privilege = Privileged | Ordinary [@@deriving sexp]
+
+(** What becomes of a losing candidate. *)
+type disposition =
+  | Omit  (** yields with no trace in the day's celebration *)
+  | Commemorate of privilege  (** kept as a commemoration of the observed day *)
+  | Transfer  (** moved to the next free day (RG 92-95) *)
+  | Repose  (** kept only in a votive/private sense; not commemorated today *)
+[@@deriving sexp]
+
+(** A celebration together with the office stream it was drawn from. Parameterised
+    by the rite's rank type only, matching {!Celebration.t}. *)
+type 'r candidate = { cel : 'r Celebration.t; origin : origin } [@@deriving sexp]
+
+(** The day a resolution is computed for. Parameterised by the rite's season
+    type only -- a context has no rank of its own. *)
+type 's context = { date : Date.t; season : 's; weekday : Date.weekday }
+
+(** The rite's three resolution functions. *)
+type ('s, 'r) rules = {
+  band : 's context -> 'r candidate -> int;
+      (** RG 91: orders candidates for the day; lower wins. *)
+  disposition : winner:'r candidate -> loser:'r candidate -> disposition;
+      (** RG 92-95: the loser's fate, which depends on the loser's own rank. *)
+  admit :
+    observed:'r candidate ->
+    ('r candidate * privilege) list ->
+    ('r candidate * privilege) list;
+      (** RG 108-111: how many commemorations are admitted, and in what order;
+          anything filtered out here is recorded in {!resolution.omitted}, not
+          dropped.
+
+          OBLIGATION ON THE IMPLEMENTATION, not enforced by this type: every
+          candidate this function returns must be a value taken UNCHANGED
+          from its input list, never rebuilt (e.g. via a [{ c with ... }]
+          record update, even one that copies every field back unchanged).
+          {!resolve}'s own [omitted] accounting distinguishes an admitted
+          candidate from a dropped one by PHYSICAL equality ([==]) on the
+          candidate value, not structural equality -- a rebuilt record is
+          [=] to the original but not [==], so {!resolve} cannot match the
+          rebuilt copy against the original it was given. The celebration
+          then surfaces TWICE in the same day's result -- once in
+          {!resolution.commemorations} (the rebuilt copy, admitted) and once
+          in {!resolution.omitted} (the original, which nothing in the
+          admitted set matches). One admission, double-reported, silently
+          rather than raising. This obligation previously lived only in one rite's
+          own module documentation (Rite_ef.Precedence_ef.admit); stated
+          here because this signature -- not any one rite's implementation
+          of it -- is what an author of the next rite reads. *)
+}
+
+(** The outcome of resolving one day's candidates. *)
+type 'r resolution = {
+  observed : 'r candidate;
+  commemorations : ('r candidate * privilege) list;
+  deferred : 'r candidate list;
+  omitted : ('r candidate * string) list;  (** each with a reason *)
+}
+
+(** Total: the temporal candidate is passed separately, so there is no
+    empty-candidate case. Ties break on slug, so the result never depends on
+    input order. A [Commemoration_only] celebration is held out of the contest
+    and can never be [observed]. Every input candidate appears exactly once in
+    [observed], [commemorations], [deferred] or [omitted] — nothing is dropped
+    silently. *)
+val resolve :
+  ('s, 'r) rules -> 's context -> temporal:'r candidate ->
+  sanctoral:'r candidate list -> 'r resolution
diff --git a/lib/kernel/rite.ml b/lib/kernel/rite.ml
new file mode 100644
index 0000000..89fceb6
--- /dev/null
+++ b/lib/kernel/rite.ml
@@ -0,0 +1,14 @@
+(* Everything a rite supplies, bundled. Passing these as loose arguments let a
+   caller pair one rite's vocab with another's temporal; bundling makes that
+   unrepresentable through the normal path. *)
+type ('s, 'r) t = {
+  id : string;
+  vocab : ('s, 'r) Vocab.t;
+  year_start : int -> Date.t;
+  temporal : Date.t -> ('s, 'r) Temporal.t;
+  anchors : int -> (string * Date.t) list;
+  rules : ('s, 'r) Precedence.rules;
+  season_runs : 's list;
+  transfer_target :
+    'r Precedence.candidate -> Date.t -> (Date.t -> 'r Celebration.t) -> Date.t;
+}
diff --git a/lib/kernel/rite.mli b/lib/kernel/rite.mli
new file mode 100644
index 0000000..ffe9471
--- /dev/null
+++ b/lib/kernel/rite.mli
@@ -0,0 +1,62 @@
+(** Everything a rite supplies, bundled. Passing these as loose arguments let a
+    caller pair one rite's vocab with another's temporal; bundling makes that
+    unrepresentable through the normal path. Carries functions, so it has no
+    sexp form. *)
+type ('s, 'r) t = {
+  id : string;
+  vocab : ('s, 'r) Vocab.t;
+  year_start : int -> Date.t;
+      (** first day of the liturgical year opening in civil year y *)
+  temporal : Date.t -> ('s, 'r) Temporal.t;
+  anchors : int -> (string * Date.t) list;
+      (** Easter-derived days: (expected slug, date) *)
+  rules : ('s, 'r) Precedence.rules;
+  season_runs : 's list;
+      (** the expected run-length-compressed season sequence over one liturgical
+          year. NOT necessarily [vocab.seasons]: a rite may have one season
+          appear in two separate runs (the modern form's Ordinary Time does). *)
+  transfer_target :
+    'r Precedence.candidate -> Date.t -> (Date.t -> 'r Celebration.t) -> Date.t;
+      (** RG 96: where an impeded I-class feast goes. Given the deferred
+          candidate, the date it was impeded on, and [occupant] -- a callback
+          exposing what {!Calendar} currently resolves as observed on any
+          given date -- returns the date to place it on.
+
+          Deliberately one rite-supplied function, not a generic search Calendar
+          drives itself: "not I or II class" is not derivable from [band] or
+          [disposition] alone. RG 91's own table would let a universal I-class
+          feast (entry 11) numerically outrank an ordinary Sunday (entry 15,
+          II class) in a raw occurrence contest -- entry 11 comes before entry
+          15, and lower wins -- so testing "would the translated feast win
+          here" is not the same question as "is this day free to receive a
+          translation": RG 96 forbids landing on the Sunday regardless of
+          which one would structurally win. Only the rite knows which of its
+          own ranks are exempt from translation onto them. The rite also
+          owns the search's starting point, because RG 96's exception is
+          rite-specific too: the Annunciation does not search forward from
+          its own impeded date at all, it goes straight to the Monday after
+          Low Sunday (searching onward from there only if that day is itself
+          blocked). [occupant] is supplied rather than a raw layer/temporal
+          pair so the rite never has to re-implement occurrence resolution
+          just to answer "what sits here".
+
+          OBLIGATIONS (not enforced by the type, and {!Calendar}'s own
+          termination argument depends on both): the result must be
+          {b strictly later} than the [Date.t] argument (the date the
+          candidate was impeded on) -- {!Calendar}'s placement pass treats
+          [target = origin] or [target < origin] as a legitimate placement,
+          not an error, so a rite whose search can stand still or go
+          backward would silently loop candidates in place or resurrect an
+          already-superseded occupant rather than failing loudly. The call
+          must also {b terminate} on its own: {!Calendar}'s round guard
+          (calendar.ml's [max_transfer_rounds]) bounds how many ROUNDS the
+          whole-year placement pass takes, which is a distinct, outer thing
+          from whatever internal search a single call to this function runs
+          -- an implementation that walks forward day by day looking for an
+          admissible date, without its own bound, can hang the caller
+          outright on a rite/data shape it does not handle, never reaching
+          the round guard at all. See rite_ef/precedence_ef.ml's
+          [transfer_target] for a concrete termination argument (a
+          structural step bound, not an appeal to the real calendar's own
+          structure). *)
+}
diff --git a/lib/kernel/slug.ml b/lib/kernel/slug.ml
index 5139c99..25281f2 100644
--- a/lib/kernel/slug.ml
+++ b/lib/kernel/slug.ml
@@ -1,6 +1,10 @@
 (* Stable celebration identifiers. Also the lectionary key: EF slugs are adopted
-   verbatim from lectio so the Plan 3 lectionary bootstrap needs no mapping
-   table (spec §4.4). *)
+   verbatim from lectio so the Plan 4 lectionary bootstrap needs no mapping
+   table (spec §4.4). CORRECTED (final fix wave, item 7): this comment said
+   "Plan 3" -- the SANCTORAL bootstrap (data/ef/sanctoral.sexp) is Plan 3 and
+   shipped in this branch; the LECTIONARY bootstrap (reading citations,
+   Liturgical_day.t's own [citations] field) is a separate, later Plan 4,
+   per that field's own doc comment ("always empty until Plan 4"). *)
 type t = string
 
 let valid_char c = (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c = '-'
diff --git a/lib/kernel/validate.ml b/lib/kernel/validate.ml
index 7be3425..cc8bdce 100644
--- a/lib/kernel/validate.ml
+++ b/lib/kernel/validate.ml
@@ -20,7 +20,35 @@ let has_duplicate strings =
   let rec go = function a :: (b :: _ as rest) -> a = b || go rest | _ -> false in
   go sorted
 
-let run vocab ~year_start ~temporal ~anchors ~year =
+(* Like [has_duplicate], but names the offender(s) instead of only reporting
+   that one exists -- the ["slugs"] check below wants a useful failure
+   detail, not just a bool. *)
+let duplicates strings =
+  let sorted = List.sort String.compare strings in
+  let rec go acc = function
+    | a :: (b :: _ as rest) -> go (if a = b then a :: acc else acc) rest
+    | _ -> acc
+  in
+  List.sort_uniq String.compare (go [] sorted)
+
+(* Task 12's "unconverged" check has no structural signal to key off --
+   Calendar's placement pass records its round-guard reason as a plain
+   string in [Liturgical_day.omitted] (calendar.ml's own [unconverged_reason],
+   not exposed as a public constant), and [Liturgical_day.omitted]'s own doc
+   comment says exactly this check is meant to read it. A short, distinctive
+   substring rather than the full literal keeps the coupling to calendar.ml's
+   exact wording as loose as it can be while still being unambiguous: nothing
+   else this kernel emits into [omitted] talks about "converging". *)
+let contains_substring s ~needle =
+  let ls = String.length s and ln = String.length needle in
+  let rec at i = i + ln <= ls && (String.sub s i ln = needle || at (i + 1)) in
+  ln = 0 || at 0
+
+let run (rite : ('s, 'r) Rite.t) (layer : 'r Layer.t) ~year =
+  let vocab = rite.Rite.vocab in
+  let year_start = rite.Rite.year_start in
+  let temporal = rite.Rite.temporal in
+  let anchors = rite.Rite.anchors in
   let start = year_start year in
   let stop =
     (* [year_start (year + 1)] needs a date in civil year (year+1); at
@@ -68,18 +96,16 @@ let run vocab ~year_start ~temporal ~anchors ~year =
           (* Weekday agreement. *)
           if t.Temporal.weekday <> Date.weekday date then
             fail date "weekday" "temporal weekday disagrees with Date.weekday";
-          (* Slug: three properties, none checked here, all delivered
-             elsewhere. Well-formedness needs no check: [Slug.t] is a private
-             string validated on every construction path ([of_string],
-             [of_string_exn], [t_of_sexp]), and [to_string] is the identity,
-             so round-tripping an existing [Slug.t] can never fail -- a check
-             here would be structurally incapable of firing, which is worse
-             than no check, since it would look like coverage that isn't
-             there. Uniqueness *per date* needs no check either: [temporal]
-             returns exactly one office by construction. Uniqueness *across
-             the year* is deliberately NOT asserted -- a resumed Sunday
-             reuses an earlier Epiphany key on purpose, so the check would be
-             false. *)
+          (* Slug: three properties. Well-formedness needs no check: [Slug.t]
+             is a private string validated on every construction path
+             ([of_string], [of_string_exn], [t_of_sexp]), and [to_string] is
+             the identity, so round-tripping an existing [Slug.t] can never
+             fail -- a check here would be structurally incapable of firing,
+             which is worse than no check, since it would look like coverage
+             that isn't there. Uniqueness *per date* needs no check either:
+             [temporal] returns exactly one office by construction.
+             Uniqueness *across the year* IS asserted, below, once the whole
+             walk is in hand -- see the ["slugs"] check after this loop. *)
           (* Vocabulary closure. *)
           if not (List.exists (fun r -> vocab.Vocab.rank_to_string r
                                         = vocab.Vocab.rank_to_string cel.Celebration.rank)
@@ -97,9 +123,28 @@ let run vocab ~year_start ~temporal ~anchors ~year =
            | None -> fail date "determinism" "a second call to temporal raised where the first succeeded"))
     days;
   let observed = List.rev !observed in
+  (* Slug uniqueness across the year (Plan 2 carried item 4): moved into
+     [Validate] itself so every consumer gets it, not only a 200-sample
+     QCheck property scoped to one rite. Asserted OUTRIGHT, no exemption:
+     Plan 2 verified zero duplicate slugs domain-wide, across all 8 416
+     years, for the EF rite's own resumed-Sunday mechanism -- the exemption
+     the test property used to carry protected nothing real, because a
+     resumed Sunday only ever backfills a week number Septuagesima cut short
+     that same liturgical year (so it was never actually used that year to
+     begin with), never repeats one the year's own January Sundays already
+     used. If a future rite genuinely needs an exemption, it can supply one
+     then -- not speculatively here. *)
+  (match duplicates (List.map (fun (_, t) -> Slug.to_string t.Temporal.office.Celebration.slug) observed) with
+   | [] -> ()
+   | dups ->
+       fail start "slugs"
+         (Printf.sprintf "slug(s) sighted on more than one date this year: %s" (String.concat ", " dups)));
   (* Season contiguity and completeness: the run-length-compressed sequence must
-     equal vocab.seasons exactly -- all seasons, each in one unbroken run, in
-     canonical order. No EF season can be empty in any year. *)
+     equal the rite's own [season_runs] exactly, in canonical order. This is
+     NOT necessarily [vocab.seasons] -- most rites have each season in one
+     unbroken run, but a rite may legitimately have one season appear in two
+     separate runs (the modern form's Ordinary Time does), so the expected
+     sequence is rite-supplied rather than derived from the vocabulary. *)
   let compressed =
     List.fold_left
       (fun acc (_, t) ->
@@ -108,7 +153,7 @@ let run vocab ~year_start ~temporal ~anchors ~year =
       [] observed
     |> List.rev
   in
-  let expected = List.map vocab.Vocab.season_to_string vocab.Vocab.seasons in
+  let expected = List.map vocab.Vocab.season_to_string rite.Rite.season_runs in
   if compressed <> expected then
     fail start "seasons"
       (Printf.sprintf "season runs %s; expected %s"
@@ -157,4 +202,121 @@ let run vocab ~year_start ~temporal ~anchors ~year =
           if actual <> expected_slug then
             fail date "anchor" (Printf.sprintf "expected slug %S, got %S" expected_slug actual))
     anchor_pairs;
+  (* Resolution invariants (Task 12): everything above only ever asked
+     [rite.temporal] for a date's office in isolation. From here on the
+     LITURGICAL YEAR IS ACTUALLY RESOLVED against [layer] -- occurrence,
+     transfer placement, commemorations, the works (spec §2.4) -- and the
+     result checked for five further properties a temporal-only pass cannot
+     see at all. [days] (the walk built above) is reused rather than
+     recomputed: it names exactly the same [start, stop] span
+     {!Calendar.year} resolves for this [year]. *)
+  (match Calendar.year rite layer year with
+   | exception exn ->
+       (* The kernel contract forbids [run] itself from ever raising on
+          in-range input, and an exception escaping resolution is the most
+          total form of "silently lost" there is: nothing about this year's
+          sanctoral entries could be verified as accounted for at all. *)
+       fail start "lost"
+         (Printf.sprintf "resolving the year raised (%s); nothing could be verified as accounted for"
+            (Printexc.to_string exn))
+   | resolved ->
+       let idx = Layer.index_by_date layer in
+       let bump tbl slug = Hashtbl.replace tbl slug (1 + (try Hashtbl.find tbl slug with Not_found -> 0)) in
+       (* Expected: how many times each layer entry's own Date_spec resolves
+          within [start, stop]. Walking dates and querying [Layer.on_date]
+          (rather than resolving each entry's Date_spec against candidate
+          civil years directly) is what naturally counts a fixed late-
+          November date TWICE in the ~20% of liturgical years whose 371-day
+          span reaches it on both ends -- see validate.mli's own note on 30
+          November / St Andrew. *)
+       let expected : (string, int) Hashtbl.t = Hashtbl.create 64 in
+       List.iter
+         (fun date ->
+           Layer.on_date idx ~month:(Date.month date) ~day:(Date.day date)
+           |> List.iter (fun (e : 'r Layer.entry) ->
+                  bump expected (Slug.to_string e.Layer.cel.Celebration.slug)))
+         days;
+       (* Actual: how many times each slug is actually sighted across the
+          resolved year. Deliberately [observed] + [commemorations] +
+          [omitted] only, NOT [transferred_out]: a successfully transferred
+          celebration is already counted once, via [observed] (+
+          [transferred_in]) on the day it lands; also counting
+          [transferred_out] at the day it left would double-book every clean
+          transfer, which is exactly what this check exists to catch, not
+          cause. *)
+       let actual : (string, int) Hashtbl.t = Hashtbl.create 64 in
+       let bump_cel tbl (c : 'r Celebration.t) = bump tbl (Slug.to_string c.Celebration.slug) in
+       Array.iter
+         (fun (d : ('s, 'r) Liturgical_day.t) ->
+           bump_cel actual d.Liturgical_day.observed;
+           List.iter (fun (c, _) -> bump_cel actual c) d.Liturgical_day.commemorations;
+           List.iter (fun (c, _) -> bump_cel actual c) d.Liturgical_day.omitted)
+         resolved;
+       Hashtbl.fold (fun slug exp acc -> (slug, exp) :: acc) expected []
+       |> List.sort compare (* stable failure order: Hashtbl.iter's own order is hash-seed-dependent *)
+       |> List.iter (fun (slug, exp) ->
+              let act = try Hashtbl.find actual slug with Not_found -> 0 in
+              if act < exp then
+                fail start "lost"
+                  (Printf.sprintf "%s: sighted %d time(s) this year, but its own Date_spec resolves %d"
+                     slug act exp)
+              else if act > exp then
+                fail start "duplicated"
+                  (Printf.sprintf "%s: sighted %d time(s) this year, but its own Date_spec resolves only %d"
+                     slug act exp));
+       Array.iter
+         (fun (d : ('s, 'r) Liturgical_day.t) ->
+           let date = d.Liturgical_day.date in
+           let observed_slug = Slug.to_string d.Liturgical_day.observed.Celebration.slug in
+           let has_slug (c, _) = Slug.to_string c.Celebration.slug = observed_slug in
+           (* "observed": the day's own winner must not ALSO be listed as one
+              of its own losers -- see validate.mli's own note on why this is
+              reachable (two distinct layer entries sharing a slug, one
+              transferred onto the other's natural date, the transferred one
+              winning) despite {!Precedence.resolve}'s fold never letting the
+              SAME candidate value appear as both winner and loser. *)
+           if List.exists has_slug d.Liturgical_day.commemorations
+              || List.exists has_slug d.Liturgical_day.omitted
+           then
+             fail date "observed"
+               (Printf.sprintf
+                  "%s is this day's observed celebration and also appears among its own \
+                   commemorations/omissions"
+                  observed_slug);
+           (* "unconverged": see [contains_substring]'s own comment above. *)
+           if
+             List.exists
+               (fun (_, reason) -> contains_substring reason ~needle:"did not converge")
+               d.Liturgical_day.omitted
+           then
+             fail date "unconverged"
+               "transfer placement did not reach a fixed point within the round guard (RG 96-98)";
+           (* "admission": re-offer this day's own admitted commemorations
+              back to [rite.rules.admit] and require the exact same set back.
+              [origin] is reconstructed as [Sanctoral] uniformly:
+              {!Liturgical_day.t} does not retain a commemoration's original
+              origin, and the real EF [admit] (precedence_ef.ml) reads only
+              rank and slug from a candidate, never [origin], so this
+              reconstruction is exact for it; documented in validate.mli as
+              the one place a rite whose [admit] DOES consult [origin] could
+              see a false negative from this check. *)
+           let observed_candidate : 'r Precedence.candidate =
+             { Precedence.cel = d.Liturgical_day.observed; origin = Precedence.Sanctoral }
+           in
+           let as_candidates comms =
+             List.map (fun (c, p) -> ({ Precedence.cel = c; origin = Precedence.Sanctoral }, p)) comms
+           in
+           let offered = as_candidates d.Liturgical_day.commemorations in
+           let readmitted = rite.Rite.rules.Precedence.admit ~observed:observed_candidate offered in
+           let norm l =
+             List.map (fun (c, p) -> (Slug.to_string c.Precedence.cel.Celebration.slug, p)) l
+             |> List.sort compare
+           in
+           if norm readmitted <> norm offered then
+             fail date "admission"
+               (Printf.sprintf
+                  "admit is not a fixed point on this day's own commemorations: re-offering %d \
+                   admitted %d back"
+                  (List.length offered) (List.length readmitted)))
+         resolved);
   List.rev !failures
diff --git a/lib/kernel/validate.mli b/lib/kernel/validate.mli
index 709a711..5e55fc5 100644
--- a/lib/kernel/validate.mli
+++ b/lib/kernel/validate.mli
@@ -5,26 +5,71 @@ type failure = { year : int; date : string; check : string; detail : string }
 
 val failure_to_string : failure -> string
 
-(** [run vocab ~year_start ~temporal ~anchors ~year] returns every invariant
-    violation in the liturgical year opening in civil year [year]. An empty
-    list means the year is clean.
+(** [run rite layer ~year] returns every invariant violation in the
+    liturgical year opening in civil year [year]. An empty list means the
+    year is clean.
 
-    [anchors y] is the rite's own independent restatement of its fixed and
-    Easter-derived named days for civil year [y], as (expected slug, date)
-    pairs -- not derived from [temporal] itself, so a drift between the two
-    is caught rather than invisible. [run] consults both [anchors year] and
-    [anchors (year + 1)], since a liturgical year straddles two civil years,
-    and checks only the pairs whose date actually falls within the year
-    walked.
+    [rite.Rite.anchors y] is the rite's own independent restatement of its
+    fixed and Easter-derived named days for civil year [y], as (expected
+    slug, date) pairs -- not derived from [rite.Rite.temporal] itself, so a
+    drift between the two is caught rather than invisible. [run] consults
+    both [anchors year] and [anchors (year + 1)], since a liturgical year
+    straddles two civil years, and checks only the pairs whose date actually
+    falls within the year walked.
+
+    ["slugs"]: no two dates within the walked liturgical year may carry the
+    same office slug (Plan 2 carried item 4). Asserted outright, with no
+    exemption for the resumed-Sunday reuse a slug's own name might suggest:
+    a resumed Sunday only ever backfills a week number Septuagesima cut
+    short that same year, so by construction it never repeats a number that
+    year's own January Sundays actually used.
+
+    The season check compares the run-length-compressed season sequence
+    against [rite.Rite.season_runs], not [rite.Rite.vocab.seasons]: a rite may
+    have one season appear in two separate runs (the modern form's Ordinary
+    Time does), so the two are not necessarily the same list.
+
+    [layer] is resolved against [rite] via {!Calendar.year} (spec §2.4's
+    occurrence/transfer/commemoration pass), and the resulting fully-resolved
+    liturgical year is checked for five further invariants a temporal-only
+    pass cannot see (Task 12), each its own ["check"] label:
+    - ["observed"]: a day's [observed] celebration is never ALSO listed among
+      that same day's [commemorations] or [omitted] -- a day reports one
+      winner, not a winner that also lost to itself.
+    - ["lost"]: no sanctoral entry is silently dropped. Per slug, the number
+      of times it is actually sighted ([observed] + [commemorations] +
+      [omitted], summed over the whole year -- NOT [transferred_out], which
+      would double-count a successfully placed transfer against its own
+      arrival) must never fall below the number of times its own
+      {!Date_spec} resolves within the year's span (an entry with two
+      occurrences, e.g. 30 November in the nine liturgical years where the
+      371-day span reaches it twice, must be sighted twice, not once). Also
+      fires if resolving the year raises at all -- an escaping exception is
+      the most total form of silent loss, and the kernel contract forbids
+      [run] itself from propagating it.
+    - ["duplicated"]: the same per-slug count must never EXCEED the number of
+      {!Date_spec} resolutions either. Deliberately NOT "no slug appears
+      twice in the year" -- a fixed date can legitimately resolve twice, per
+      ["lost"] above -- it is "resolutions and sightings agree", the property
+      that actually distinguishes a transfer that moved from one that
+      duplicated.
+    - ["unconverged"]: no day's [omitted] carries the reason {!Calendar}'s
+      placement pass records when its round guard (calendar.ml's
+      [max_transfer_rounds]) is hit before every deferred candidate reaches a
+      fixed point.
+    - ["admission"]: the rite's own [rules.admit] is a fixed point on what it
+      already admitted -- re-offering a day's [commemorations] back to
+      [admit] (reconstructed with {!Precedence.Sanctoral} origin; the real EF
+      admit reads only rank and slug, never origin, so this reconstruction is
+      exact for it) must return exactly that same set. A cap-enforcing
+      selector that is not idempotent on its own output has, by definition,
+      admitted something its own rule would not admit if asked again -- the
+      rite-agnostic form of "the admission limit was not exceeded" available
+      without embedding a rite's specific numeric caps (RG 111's, for EF)
+      into kernel code.
 
     Total over the whole 1583..9999 domain, including [year] = 9999: the
     liturgical year opening there continues into out-of-domain civil year
     10000, so the walk is clamped to 31 December 9999 and the checks run
     against that truncated final year rather than raising. *)
-val run :
-  ('s, 'r) Vocab.t ->
-  year_start:(int -> Date.t) ->
-  temporal:(Date.t -> ('s, 'r) Temporal.t) ->
-  anchors:(int -> (string * Date.t) list) ->
-  year:int ->
-  failure list
+val run : ('s, 'r) Rite.t -> 'r Layer.t -> year:int -> failure list
diff --git a/lib/kernel/vocab.ml b/lib/kernel/vocab.ml
index 78729bb..a4e61a3 100644
--- a/lib/kernel/vocab.ml
+++ b/lib/kernel/vocab.ml
@@ -7,13 +7,32 @@
    parametric types natively. *)
 type ('s, 'r) t = {
   seasons : 's list;
-      (** canonical liturgical-year order; Validate's contiguity check reads this *)
+      (** canonical liturgical-year order. CORRECTED (final fix wave, item
+          7): this used to say "Validate's contiguity check reads this" --
+          false since validate.ml's own "seasons" check switched to
+          {!Colitur_kernel.Rite.t}.season_runs in this branch (Plan 2
+          carried item 1: EF has each season in one run, but the modern
+          form's Ordinary Time does not, so the expected run sequence had
+          to become rite-supplied rather than derived from this field).
+          For EF specifically [Rite_ef.rite] sets season_runs to
+          this very list, so the two happen to agree there, but Validate
+          itself no longer reads [seasons] to build its expectation. *)
   season_to_string : 's -> string;
   season_of_string : string -> 's option;
   ranks : 'r list;
       (** documentation order, highest first. Plan 2 uses it only for the
-          closure check -- it is not a precedence relation until Plan 3
-          defines one. *)
+          closure check. CORRECTED (final fix wave, item 7): this used to
+          say "it is not a precedence relation until Plan 3 defines one" --
+          Plan 3 did define one (RG 111's dignity ordering, Rite_ef.
+          Precedence_ef.dignity/compare_dignity), but as its OWN small,
+          separately-hardcoded function, not one derived from this field:
+          [admit] needs Vocab_ef.rank's dignity as plain data (RG 8's four
+          classes), and reusing this field's own [int list] position would
+          couple that meaning to documentation order the way {!band} is
+          explicitly NOT allowed to (precedence_ef.ml's own file comment).
+          This field therefore still carries no precedence relation of its
+          own; a rite that wanted one derived from it would have to build
+          it itself. *)
   rank_to_string : 'r -> string;
   rank_of_string : string -> 'r option;
 }
diff --git a/lib/kernel/vocab.mli b/lib/kernel/vocab.mli
index 78729bb..a4e61a3 100644
--- a/lib/kernel/vocab.mli
+++ b/lib/kernel/vocab.mli
@@ -7,13 +7,32 @@
    parametric types natively. *)
 type ('s, 'r) t = {
   seasons : 's list;
-      (** canonical liturgical-year order; Validate's contiguity check reads this *)
+      (** canonical liturgical-year order. CORRECTED (final fix wave, item
+          7): this used to say "Validate's contiguity check reads this" --
+          false since validate.ml's own "seasons" check switched to
+          {!Colitur_kernel.Rite.t}.season_runs in this branch (Plan 2
+          carried item 1: EF has each season in one run, but the modern
+          form's Ordinary Time does not, so the expected run sequence had
+          to become rite-supplied rather than derived from this field).
+          For EF specifically [Rite_ef.rite] sets season_runs to
+          this very list, so the two happen to agree there, but Validate
+          itself no longer reads [seasons] to build its expectation. *)
   season_to_string : 's -> string;
   season_of_string : string -> 's option;
   ranks : 'r list;
       (** documentation order, highest first. Plan 2 uses it only for the
-          closure check -- it is not a precedence relation until Plan 3
-          defines one. *)
+          closure check. CORRECTED (final fix wave, item 7): this used to
+          say "it is not a precedence relation until Plan 3 defines one" --
+          Plan 3 did define one (RG 111's dignity ordering, Rite_ef.
+          Precedence_ef.dignity/compare_dignity), but as its OWN small,
+          separately-hardcoded function, not one derived from this field:
+          [admit] needs Vocab_ef.rank's dignity as plain data (RG 8's four
+          classes), and reusing this field's own [int list] position would
+          couple that meaning to documentation order the way {!band} is
+          explicitly NOT allowed to (precedence_ef.ml's own file comment).
+          This field therefore still carries no precedence relation of its
+          own; a rite that wanted one derived from it would have to build
+          it itself. *)
   rank_to_string : 'r -> string;
   rank_of_string : string -> 'r option;
 }
diff --git a/lib/rites/rite_ef/precedence_ef.ml b/lib/rites/rite_ef/precedence_ef.ml
new file mode 100644
index 0000000..db7e708
--- /dev/null
+++ b/lib/rites/rite_ef/precedence_ef.ml
@@ -0,0 +1,893 @@
+(* RG 91's Table of Precedence (docs/research/rules-register.md §4). Each
+   branch below is one of the table's 28 entries, checked in the table's own
+   numeric order -- lower wins, and because occasional entries are true
+   exceptions to a later, broader one (RG 91 entry 18's Ember days are an
+   exception carved out of entry 22's Lent ferias; entry 21/26's vigils are
+   an exception carved out of the generic Class2/Class3 sanctoral-feast
+   entries that would otherwise also match), checking in table order and
+   returning on the first match is what makes the exception actually win
+   without a separate exclusion for every later entry it pre-empts.
+
+   Two kinds of evidence decide an entry:
+   - The temporal cycle's own office (Nativity, a Sunday, a feria, All Souls)
+     is identified structurally, from the context's date/season/weekday and
+     the day's Easter offset -- never from its slug, which is just a label.
+     [origin = Temporal] gates every such entry so a sanctoral candidate that
+     happens to share a date (Immaculate Conception can never coincide with
+     the movable cycle, but nothing stops a future rite bug from producing
+     one) cannot be mistaken for the office itself. All Souls (entry 8, the
+     one non-temporal-origin member of this group) additionally reads the
+     context's weekday for its own register-stated exception -- see entry 8
+     below.
+   - A sanctoral feast's entry is decided by its [rank], and -- except at
+     entry 14 (see its own comment below, where the register draws no such
+     line) -- per the brief's structural insight, also by its
+     {!Celebration.t}.layer: a celebration whose layer is not the universal
+     base is an overlay, hence "proper" or "indult" rather than the
+     universal entry (11-13 I class; 16/19/20 II class; 23/24 III class; see
+     precedence_ef.mli). [origin = Sanctoral] gates these for the same
+     reason: temporal-origin celebrations carry the literal layer id
+     "temporal" (rite_ef/temporal_ef.ml's [build]), which is not
+     [universal_layer] either, and would otherwise be misread as "proper" by
+     the layer test alone.
+
+   Vigils (21, 26) are the one shape neither of those two kinds fully
+   describes on their own: a II/III-class vigil can be temporal-origin (the
+   Ascension Vigil, produced by temporal_ef today) or sanctoral-origin (a
+   saint's vigil, not yet loaded by any task), so its entry cannot be gated
+   on [origin] at all. Nothing in the day's other fields marks "this is a
+   vigil, not an ordinary office of the same rank" either, so this reads it
+   off the temporal cycle's own slug convention (a "-vigil" suffix -- see
+   [named] in temporal_ef.ml) rather than guessing a new one. *)
+
+open Colitur_kernel
+
+(* Not an RG citation -- RG 91 ranks proper and indult feasts, it does not
+   encode how a computer tells them apart. See precedence_ef.mli. *)
+let universal_layer = "ef-universal"
+let indult_prefix = "indult:"
+let unclassified = max_int
+
+let is_indult layer = String.starts_with ~prefix:indult_prefix layer
+let is_universal layer = String.equal layer universal_layer
+
+(* Not an RG citation either -- see [universal_layer] above. Nothing in
+   {!Celebration.t} otherwise marks "this is a vigil, not an ordinary office
+   of the same rank" (see the file's top comment), so entries 21/26 read it
+   off the temporal cycle's own slug suffix (rite_ef/temporal_ef.ml's
+   [named], e.g. "ef-ascension-vigil"). *)
+let vigil_suffix = "-vigil"
+
+(* Not an RG citation -- see [universal_layer]. Task 10's sanctoral bootstrap
+   turned out to name its four real vigils with lectio's OWN convention, a
+   "vigil-of-X" PREFIX (data/ef/sanctoral.sexp: vigil-of-st-lawrence,
+   vigil-of-sts-peter-paul, vigil-of-the-assumption, vigil-of-the-nativity-
+   of-st-john-the-baptist), not [vigil_suffix] -- exactly the mismatch Task
+   7's review predicted when it asked for [vigil_suffix] to be exposed.
+   [is_vigil] below checks both conventions, so a celebration is a "vigil"
+   for RG 91/33's purposes regardless of which layer (temporal or sanctoral)
+   produced it. *)
+let vigil_prefix = "vigil-of-"
+
+let is_vigil slug =
+  String.ends_with ~suffix:vigil_suffix slug || String.starts_with ~prefix:vigil_prefix slug
+
+(* Not an RG citation -- see [universal_layer]. Entry 18's Ember days are
+   identified by the temporal cycle's own slug convention (rite_ef/
+   temporal_ef.ml's [ember]: "ef-<set>-ember-<day>"), not re-derived here:
+   the September anchor in particular is one of the more contested dates in
+   the 1962 calendar (temporal_ef.ml's own comment on
+   [third_sunday_of_september]), and re-deriving it a second time would only
+   create a second place for that same uncertainty to drift. Only the
+   Advent, Lent and September sets are listed: RG 91 entry 18 names exactly
+   those three; the Whitsun (Pentecost) set is I class and falls inside the
+   Pentecost octave, entry 10, matched below before this is ever reached.
+   Exposed for the same reason as [vigil_suffix]: a rename of temporal_ef's
+   format has somewhere to be caught other than a silently-wrong entry 18.
+
+   [september_ember_prefix] is broken out as its own name (rather than an
+   anonymous list literal) because Task 9's [privilege_of] needs to test the
+   September set alone: RG 109(e)'s three named seasons (Advent, Lent,
+   Passiontide, §4 "Commemorations") never include September, which sits
+   entirely in time after Pentecost under any reading -- so September Ember
+   days need their own separate privilege category, (d), regardless of how
+   (e) itself is read. CORRECTED (fix round 1, F1/F2): this comment
+   previously justified the split the other way round, claiming RG 109(e)
+   privileges September specifically "while leaving the Advent and Lent
+   sets ordinary" -- WRONG; see [privilege_of]'s own (e) comment below for
+   the full argument. The Advent and Lent Ember sets ARE privileged under
+   (e), the same as any other Advent/Lent feria; building [ember_prefixes]
+   from this constant rather than duplicating the literal keeps the two
+   from silently drifting apart. *)
+let advent_ember_prefix = "ef-advent-ember-"
+let lent_ember_prefix = "ef-lent-ember-"
+let september_ember_prefix = "ef-september-ember-"
+let ember_prefixes = [ advent_ember_prefix; lent_ember_prefix; september_ember_prefix ]
+
+let is_ember_18 slug = List.exists (fun prefix -> String.starts_with ~prefix slug) ember_prefixes
+
+let band (ctx : Vocab_ef.season Precedence.context) (c : Vocab_ef.rank Precedence.candidate) :
+    int =
+  let cel = c.Precedence.cel in
+  let rank = cel.Celebration.rank in
+  let subject = cel.Celebration.subject in
+  let layer = cel.Celebration.layer in
+  let slug = Slug.to_string cel.Celebration.slug in
+  let is_temporal = c.Precedence.origin = Precedence.Temporal in
+  let is_vigil = is_vigil slug in
+  let date = ctx.Precedence.date in
+  let season = ctx.Precedence.season in
+  let weekday = ctx.Precedence.weekday in
+  let is_sunday = weekday = Date.Sun in
+  let m = Date.month date and d = Date.day date in
+  (* Easter offset, the same convention as temporal_ef.ml's [days_between
+     easter d]: 0 is Easter itself, negative before, positive after. *)
+  let off = Date.to_rata date - Date.to_rata (Computus.gregorian_easter (Date.year date)) in
+  (* Named so entry 8's Sunday exception below can read "one worse than the
+     Sunday it must yield to" rather than a bare integer that happens to
+     equal entry 15's own value; entry 15's own branch returns this same
+     binding, not a second literal, so the two can never drift apart. *)
+  let entry_15_band = 15 in
+  let open Vocab_ef in
+  (* 1: Nativity, Easter Sunday, Pentecost Sunday (I class w/ octave). *)
+  if is_temporal && rank = Class1 && ((m = 12 && d = 25) || off = 0 || off = 49) then 1
+    (* 2: Sacred Triduum (Thu-Sat of Holy Week). *)
+  else if is_temporal && rank = Class1 && off >= -3 && off <= -1 then 2
+    (* 3: Epiphany, Ascension, Holy Trinity, Corpus Christi, Sacred Heart,
+       Christ the King. *)
+  else if is_temporal && rank = Class1
+          && ((m = 1 && d = 6) (* Epiphany *)
+             || off = 39 (* Ascension *) || off = 56 (* Trinity *)
+             || off = 60 (* Corpus Christi *) || off = 68 (* Sacred Heart *)
+             || Date.compare date (Temporal_ef.christ_the_king (Date.year date)) = 0)
+  then 3
+    (* 4: Immaculate Conception, Assumption BVM. *)
+  else if (not is_temporal) && rank = Class1 && ((m = 12 && d = 8) || (m = 8 && d = 15)) then 4
+    (* 5: Vigil & Octave day of the Nativity. *)
+  else if is_temporal && rank = Class1 && ((m = 12 && d = 24) || (m = 1 && d = 1)) then 5
+    (* 6: Sundays of Advent, Lent, Passiontide, and Low Sunday. *)
+  else if is_temporal && rank = Class1 && is_sunday
+          && (season = Advent || season = Lent || season = Passiontide || off = 7)
+  then 6
+    (* 7: I-class ferias not above -- Ash Wednesday; Mon/Tue/Wed of Holy Week.
+       Thu-Sat of Holy Week are the Triduum, entry 2 above, not this entry. *)
+  else if is_temporal && rank = Class1 && (off = -46 || (off >= -6 && off <= -4)) then 7
+    (* 8: All Souls -- RG 91 entry 8's own text (§4) carries a qualifier this
+       transcription must honour: "yields to an occurring Sunday". 2 November
+       is always Time_after_pentecost (well clear of Advent/Lent/Passiontide
+       and of every other entry's own Easter-relative or fixed date), so a
+       Sunday landing on it is always an ordinary entry-15 II-class Sunday --
+       the one and only rival this exception ever has to lose to. On such a
+       Sunday this returns [entry_15_band + 1]: strictly worse than 15 (an
+       exact tie would fall to Precedence.resolve's slug tie-break, which
+       for "ef-all-souls" against a "ef-time-after-pentecost-sunday-*" slug
+       would make All Souls WIN -- the precise bug this guards against), but
+       otherwise not a citation to any other RG 91 row -- nothing else can
+       ever occur on 2 November to be confused with it. Entry 8's own [rank]
+       is untouched by this, so Task 8's disposition (RG 95: only I-class
+       feasts transfer) still sees the true I-class candidate it needs to
+       move to 3 November. *)
+  else if (not is_temporal) && rank = Class1 && m = 11 && d = 2 then
+    if is_sunday then entry_15_band + 1 else 8
+    (* 9: Vigil of Pentecost. *)
+  else if is_temporal && rank = Class1 && off = 48 then 9
+    (* 10: Days within the Octaves of Easter and Pentecost. *)
+  else if is_temporal && rank = Class1 && ((off >= 1 && off <= 6) || (off >= 50 && off <= 55))
+  then 10
+    (* 11: I-class feasts of the universal Church not above. *)
+  else if (not is_temporal) && (not is_vigil) && rank = Class1 && is_universal layer then 11
+    (* 12: Proper I-class feasts. *)
+  else if (not is_temporal) && (not is_vigil) && rank = Class1 && not (is_indult layer) then 12
+    (* 13: Indult I-class feasts. By elimination once 11 and 12 have failed:
+       not the universal layer (11), and marked as an indult overlay (12's
+       "not indult" test having just failed). *)
+  else if (not is_temporal) && (not is_vigil) && rank = Class1 then 13
+    (* 14: Feasts of the Lord, II class -- RG 91 entry 14, deliberately
+       UNQUALIFIED (contrast entry 16, which explicitly says "not
+       of the Lord"; RG 37c (§4, "Sundays") speaks of "II-class feasts of
+       the Lord" replacing an occurring II-class Sunday with no universal
+       qualifier either). No layer test here, unlike 11/12/13 and 16/19/20:
+       the register does not split this entry into universal/proper/indult,
+       so a proper or indult feast of the Lord still bands 14, not 19/20. *)
+  else if (not is_temporal) && (not is_vigil) && rank = Class2 && subject = Subject.Lord then 14
+    (* 15: Sundays, II class (every Sunday not already named at 6). *)
+  else if is_temporal && rank = Class2 && is_sunday then entry_15_band
+    (* 16: II-class feasts of the universal Church, not of the Lord. *)
+  else if (not is_temporal) && (not is_vigil) && rank = Class2 && is_universal layer then 16
+    (* 17: Days within the Octave of the Nativity (26-28 Dec are Stephen,
+       John, the Innocents -- sanctoral, not this entry). *)
+  else if is_temporal && rank = Class2 && m = 12 && (d = 29 || d = 30 || d = 31) then 17
+    (* 18: II-class ferias -- Advent 17-23 Dec; Ember days of Advent, Lent,
+       September. *)
+  else if is_temporal && rank = Class2
+          && ((season = Advent && m = 12 && d >= 17 && d <= 23) || is_ember_18 slug)
+  then 18
+    (* 19: Proper II-class feasts. *)
+  else if (not is_temporal) && (not is_vigil) && rank = Class2 && not (is_indult layer) then 19
+    (* 20: Indult II-class feasts. By elimination, as at 13. *)
+  else if (not is_temporal) && (not is_vigil) && rank = Class2 then 20
+    (* 21: II-class vigils (Ascension, Assumption, John Baptist, Peter & Paul
+       -- can be temporal- or sanctoral-origin, see the file comment above). *)
+  else if rank = Class2 && is_vigil then 21
+    (* 22: Ferias of Lent and Passiontide (Thursday after Ash Wednesday to the
+       Saturday before Palm Sunday), except the Ember days (18 above). *)
+  else if is_temporal && rank = Class3 && (season = Lent || season = Passiontide) then 22
+    (* 23: III-class feasts in particular calendars. Unlike 11/12 and 14/16
+       above, the universal entry (24) is the HIGHER number here -- RG 91's
+       own table ranks a particular-calendar III-class feast ahead of a
+       universal one, the reverse of the I/II-class ordering. Transcribed as
+       the register states it, not "corrected" into the other classes'
+       pattern. RG 91 has no indult sub-rank at III class, so every non-base
+       layer lands here, not split further. *)
+  else if (not is_temporal) && (not is_vigil) && rank = Class3 && not (is_universal layer) then 23
+    (* 24: III-class feasts in the universal calendar. *)
+  else if (not is_temporal) && (not is_vigil) && rank = Class3 then 24
+    (* 25: Ferias of Advent to 16 Dec, except the Ember days (18 above). *)
+  else if is_temporal && rank = Class3 && season = Advent then 25
+    (* 26: III-class vigils (St Lawrence). *)
+  else if rank = Class3 && is_vigil then 26
+    (* 27: Office of the BVM on Saturday -- every otherwise-unoccupied IV-class
+       Saturday, per the historical default that fills it; ordinary Mass
+       propers still make Rogation Mon/Tue/Wed proper without changing the
+       Office (RG 88, see temporal_ef.ml's [temporal]), so those never carry
+       this entry unless they happen to fall on the Saturday itself. Excludes
+       vigils for the same reason 11-13/14/16/19/20/23/24 do: RG 91 has no
+       IV-class vigil at all (RG 91's own vigil list, §4 "Vigils",
+       stops at III class), so one would be an anomaly, not this entry. *)
+  else if is_temporal && (not is_vigil) && rank = Class4 && weekday = Date.Sat then 27
+    (* 28: IV-class ferias -- the unqualified catch-all (temporal_ef.ml's own
+       comment on [ferial_rank] cites the same primary text, "Feriae IV
+       classis"). Excludes vigils for the same reason as 27 above: a IV-class
+       "feria" that is also a vigil is not a feria RG 91 describes. *)
+  else if (not is_vigil) && rank = Class4 then 28
+  else unclassified
+
+(* Task 8: what happens to the day's LOSING candidate (docs/research/
+   rules-register.md §4, "Occurrence" RG 92-95 and "Vigils" RG 33, plus RG
+   94). [band] above decides who wins; this decides the loser's fate, which
+   turns on the LOSER's own rank and status (RG 95), except RG 33's vigil
+   omission, which also has to read the winner. Nothing here ever returns
+   [Precedence.Repose]: that disposition denotes RG 100-102's *repositio*
+   (perpetual impediment from a proper/diocesan calendar), out of this
+   plan's scope -- see calendar.mli's own note that nothing in the EF
+   ruleset currently emits it. *)
+
+(* RG 33 -- CORRECTED 2026-08-12 (Task 16, primary-source-verified against
+   docs/research/1962-06-23,_SS_Ioannes_XXIII,_Missale_Romanum,_LT.pdf, the
+   General Rubrics' own Chapter XI "De Vigiliis"). The register previously
+   transcribed this as "a I/II-class vigil is entirely omitted"; the
+   PRIMARY TEXT reads the other way round:
+
+     "33. Vigilia II aut III classis penitus omittitur, si occurrat in
+     dominica quavis, aut in festo I classis, vel si festum cui
+     præmittitur in alium diem transferri aut ad commemorationem reduci
+     contingat."
+
+   -- "A vigil of the II OR III class is entirely omitted, if it occurs on
+   ANY Sunday whatsoever, or on a feast of the I class, or if the feast it
+   precedes happens to be transferred to another day or reduced to a
+   commemoration." I-class vigils (Nativity, Pentecost, RG 30) are outside
+   this rule entirely -- RG 30's own text says they "festis quibuslibet
+   præferunt, et nullam admittunt commemorationem" (are preferred to ANY
+   feast whatsoever, and admit no commemoration at all), i.e. they can never
+   lose in the first place: {!band} entries 1/5/9 already rank Nativity Eve
+   and the Pentecost Vigil above every Sunday and every other I-class row
+   that could coincide with their fixed/Easter-relative dates (verified: no
+   date collision is even representable), so no I-class vigil can ever reach
+   this function as a [loser] -- the branch below never needs to test for
+   [Class1] and, before this fix, its stray inclusion of [Class1] here was
+   simply dead code, not a second bug (see the task report for the
+   argument). The bug was the OTHER half: [Class3] (the sole III-class
+   vigil, St Lawrence, RG 32) was MISSING from this branch, so it fell
+   through to the generic "commemorated or omitted" branch below instead of
+   RG 33's mandatory omission -- confirmed wrong for real data: 9 August
+   2026 is a Sunday, and before this fix "vigil-of-st-lawrence" competed for
+   (and could in principle win) that Sunday's single commemoration slot,
+   when RG 33 says it must not even be a candidate. The oracle comparison
+   (missalemeum, Task 16) independently confirms: 9 Aug 2026 shows no trace
+   of the vigil surviving as a commemoration.
+
+   The third omission trigger in RG 33's own text -- "or if the feast it
+   precedes is transferred to another day or reduced to a commemoration" --
+   is NOT implemented: no II/III-class vigil's own feast (Ascension,
+   Assumption, John Baptist, Sts Peter & Paul, Lawrence) is ever
+   transferred or reduced to a commemoration anywhere in this codebase's
+   current data (all fixed I-class, none coincide with anything of equal or
+   higher rank within any year this project has sampled), so no witness
+   exists to build or test this clause against; flagged in the register
+   (§6) rather than guessed. *)
+let is_omissible_vigil (rank : Vocab_ef.rank) = rank = Vocab_ef.Class2 || rank = Vocab_ef.Class3
+
+(* Every Sunday slug this rite's temporal cycle produces -- named
+   (temporal_ef.ml's [named], e.g. "ef-easter-sunday") or the generic
+   "ef-<season>-sunday-<n>" fallback ([sunday_slug]) -- contains this
+   marker; nothing else [band] classifies does. Not an RG citation itself --
+   see [universal_layer]'s note on this file's own naming conventions --
+   exposed for the same reason as {!vigil_suffix}: a future rename of
+   temporal_ef's Sunday-slug format has somewhere to be caught other than a
+   silently-wrong RG 33 disposition. *)
+let sunday_marker = "-sunday"
+
+let contains_substring s ~needle =
+  let ls = String.length s and ln = String.length needle in
+  let rec at i = i + ln <= ls && (String.sub s i ln = needle || at (i + 1)) in
+  ln = 0 || at 0
+
+let is_sunday_slug slug = contains_substring slug ~needle:sunday_marker
+
+(* RG 33's own two conditions, taken directly from its text ("any Sunday or
+   a I-class feast") -- NOT derived from anything about which RG 91 entries
+   can numerically outrank a vigil. [rank = Class1] is the "I-class feast"
+   half. [is_sunday_slug] is the "any Sunday" half, and it is not redundant
+   with the rank check: RG 91 entries 14 and 16-20 (Feasts of the Lord II
+   class, universal/proper/indult II-class feasts, days within the Nativity
+   octave) are all [Class2], all outrank a II-class vigil (entry 21), and
+   none of them is a Sunday -- a winner of that shape satisfies neither
+   condition here, so [impedes_vigil] correctly returns [false] and such a
+   vigil falls through to RG 95's ordinary commemorate-or-omit branch
+   instead of RG 33's omission, exactly as the rubric requires. *)
+let impedes_vigil (winner : Vocab_ef.rank Precedence.candidate) =
+  let cel = winner.Precedence.cel in
+  cel.Celebration.rank = Vocab_ef.Class1
+  || is_sunday_slug (Slug.to_string cel.Celebration.slug)
+
+(* RG 91 entry 17's own slug convention (rite_ef/temporal_ef.ml's [named]:
+   "ef-nativity-octave-day-%d" for 29-31 Dec -- 26-28 Dec are Stephen, John,
+   the Innocents, sanctoral, and never carry this prefix, see [band]'s entry
+   17 comment). Not an RG citation itself -- see [universal_layer] -- reused
+   below by [privilege_of] for RG 109(c). *)
+let nativity_octave_prefix = "ef-nativity-octave-day-"
+
+(* RG 109's own three named seasons for (e), "of ferias of Advent, Lent and
+   Passiontide" (§4, "Commemorations") -- temporal_ef.ml's generic
+   <season>-<week>-<weekday> ferial fallback slugs, whose season word is
+   [season_slug_word]'s output for exactly these three (vocab_ef.ml: Advent
+   and Passiontide are unmodified [season_to_string]; Lent likewise). Also
+   matches the Lent "after Ashes" sub-case ("ef-lent-after-ashes-<weekday>",
+   temporal_ef.ml's own [christmastide_feria_slug]-adjacent branch), which
+   is still a Lent feria under this same prefix. Not an RG citation -- see
+   [universal_layer] -- private: nothing outside [privilege_of] needs it. *)
+let alp_feria_prefixes = [ "ef-advent-"; "ef-lent-"; "ef-passiontide-" ]
+
+(* RG 109 (docs/research/rules-register.md §4, "Commemorations"): the
+   closed list of privileged commemorations, checked in the register's own
+   lettered order. A candidate matching none of (a)-(f) is ordinary, per the
+   register's own closing sentence, "All others are ordinary." Read entirely
+   off the candidate's own fields (rank, slug, origin) -- no [context]
+   (date/season/weekday) is available or needed: every category names a
+   property of the commemorated OFFICE ITSELF ("a commemoration OF a
+   Sunday", "OF a I-class day", ...), not of the day it happens to fall on,
+   and each of (a)-(e) already has a candidate-only marker this file's own
+   conventions establish ([sunday_marker], rank, [nativity_octave_prefix],
+   [september_ember_prefix]/[alp_feria_prefixes]) -- see the task report for
+   the full reasoning.
+
+   [disposition] below is this function's only caller, at both of its
+   [Commemorate] sites -- replacing Task 8's [interim_privilege] placeholder,
+   which always returned [Ordinary] regardless of the loser's real shape.
+   [admit] (RG 108-111's admission counts, below) trusts the privilege value
+   [disposition] has already attached rather than recomputing it here a
+   second time. *)
+let privilege_of (c : Vocab_ef.rank Precedence.candidate) : Precedence.privilege =
+  let cel = c.Precedence.cel in
+  let rank = cel.Celebration.rank in
+  let slug = Slug.to_string cel.Celebration.slug in
+  let is_temporal = c.Precedence.origin = Precedence.Temporal in
+  let open Vocab_ef in
+  (* (a) RG 109(a) (§4): "of a Sunday" -- the same slug marker RG 33's
+     [impedes_vigil] already reads to answer "is this candidate a Sunday". *)
+  if is_sunday_slug slug then Precedence.Privileged
+  (* (b) RG 109(b) (§4): "of a I-class day" -- the candidate's own
+     rank. In this codebase's current disposition rules the ONLY way a
+     [Class1] candidate ever reaches [Commemorate] at all is via
+     [Celebration.status = Commemoration_only] (a plain [Feast]-status
+     [Class1] loser always [Transfer]s instead, RG 95, below) -- so this
+     branch is real but its only reachable witness today is that shape; see
+     the task report. *)
+  else if rank = Class1 then Precedence.Privileged
+  (* (c) RG 109(c) (§4): "of days within the Octave of the Nativity". *)
+  else if is_temporal && String.starts_with ~prefix:nativity_octave_prefix slug then
+    Precedence.Privileged
+  (* (d) RG 109(d) (§4): "of September Ember days" -- named on its
+     own because September falls entirely outside (e)'s three seasons
+     (Advent/Lent/Passiontide) under ANY reading, not because it needs
+     excluding FROM (e) the way review round 1's F1/F2 finding corrected
+     the Advent/Lent Ember sets below to no longer need. *)
+  else if is_temporal && String.starts_with ~prefix:september_ember_prefix slug then
+    Precedence.Privileged
+  (* (e) RG 109(e) (§4): "of ferias of Advent, Lent and Passiontide" --
+     CORRECTED, fix round 1 (F1/F2): this branch previously excluded the
+     Advent and Lent Ember sets via [not (is_ember_18 slug)], reading RG
+     109(e)'s bare "feriis Adventus, Quadragesimae" as tacitly narrower than
+     the ordinary ferias of those seasons, on the theory that (d)'s separate
+     September carve-out implied Ember days needed excluding from (e) too.
+     That reading does not survive comparing (e)'s text against RG 91's own
+     TABLE entries for the same seasons (register §4, "Ferias of Lent and
+     Passiontide... EXCEPTIS feriis Quatuor Temporum" at entry 22; "Ferias
+     of Advent... EXCEPTIS feriis Quatuor Temporum" at entry 25): the table
+     needs an explicit "exceptis" to keep Ember days from being double-
+     listed at both their own entry 18 AND entries 22/25 -- and an explicit
+     exception is only necessary because, ABSENT one, "feriae Adventus"/
+     "feriae Quadragesimae" already DO include their Ember sub-days by
+     default (an unnecessary exception is not how a rubrical text is
+     drafted). RG 109(e) carries no such "exceptis" clause, so its bare
+     "feriis Adventus, Quadragesimae" is read at that same default,
+     INCLUSIVE scope: the Advent and Lent Ember ferias ARE "ferias of
+     Advent"/"of Lent" in RG 109(e)'s sense, hence privileged, not merely
+     ordinary. (d)'s own separate existence is unaffected by this reading
+     either way -- September Ember days sit in "time after Pentecost",
+     never within Advent/Lent/Passiontide under any reading, so (d) remains
+     necessary regardless; it is not evidence for excluding Advent/Lent
+     Ember from (e), only for including September at all.) Consequently
+     [is_ember_18] is no longer tested here -- an Advent/Lent Ember slug
+     matches this branch exactly like an ordinary Advent/Lent feria slug
+     does, via the same [alp_feria_prefixes] prefix test; only a September
+     Ember slug is structurally excluded, because "ef-september-ember-*"
+     never starts with any of [alp_feria_prefixes] ("ef-advent-"/"ef-lent-"/
+     "ef-passiontide-") in the first place -- (d) above already privileges
+     it under its own name. *)
+  else if is_temporal && List.exists (fun p -> String.starts_with ~prefix:p slug) alp_feria_prefixes then
+    Precedence.Privileged
+  (* (f) RG 109(f) (§4): "of the Major Rogations, in Mass" -- the
+     Major Litanies (25 April, RG 80) are STILL not computed anywhere in
+     this codebase (temporal_ef.ml's own comment on [temporal]'s Rogation
+     branch, CORRECTED final fix wave item 7: they did not, in fact,
+     "arrive with Plan 3's sanctoral" -- Plan 3 shipped without them,
+     register §6 tracks this as an open item with no plan yet committed to
+     build it), so no candidate this engine can currently construct
+     represents one. There is no existing slug
+     convention to anchor a check to, and guessing one risks silently
+     misclassifying whatever a future task does name it -- a wrong citation
+     is worse than a missing one, so this is left unimplemented and flagged
+     in the task report rather than guessed. Deliberately NOT matched by
+     anything above: the Minor Litanies/Rogations ("ef-rogation-monday"/
+     "-tuesday", RG 87) temporal_ef.ml DOES compute are a different
+     observance RG 109(f) does not name (RG 88: the Minor Rogations change
+     nothing in the Office at all), so they correctly fall through to
+     "ordinary" below, not this category. *)
+  else Precedence.Ordinary
+
+let disposition ~(winner : Vocab_ef.rank Precedence.candidate)
+    ~(loser : Vocab_ef.rank Precedence.candidate) : Precedence.disposition =
+  let open Vocab_ef in
+  let cel = loser.Precedence.cel in
+  let is_temporal = loser.Precedence.origin = Precedence.Temporal in
+  if cel.Celebration.status = Celebration.Commemoration_only then
+    (* Always -- checked before RG 33's omission and RG 95's transfer so
+       neither can override it: a Commemoration_only entry can never win
+       (Precedence.resolve holds it out of the band contest entirely, see
+       that module's [resolve]) and, per the brief, can never transfer
+       either. Its privilege is [privilege_of loser] like every other
+       [Commemorate] below -- Commemoration_only carries a real [rank] for
+       exactly this purpose (Celebration.mli: "RG 111 orders admitted
+       commemorations by dignity"), so RG 109(b) applies to it precisely as
+       it would to any other candidate. *)
+    Precedence.Commemorate (privilege_of loser)
+  else if
+    is_omissible_vigil cel.Celebration.rank
+    && is_vigil (Slug.to_string cel.Celebration.slug)
+    && impedes_vigil winner
+  then
+    (* RG 33, corrected (see {!is_omissible_vigil}'s own comment): II- or
+       III-class vigils only -- a real I-class vigil can never reach this
+       function as a loser at all (see that comment), so this branch would
+       never have fired for [Class1] even before the fix; what changed is
+       that [Class3] (St Lawrence) now correctly reaches RG 33's omission
+       instead of falling through to the generic "commemorated or omitted"
+       branch below. *)
+    Precedence.Omit
+  else if
+    cel.Celebration.rank = Class1
+    && not (is_sunday_slug (Slug.to_string cel.Celebration.slug))
+  then
+    (* RG 95 (§4, "Occurrence" and "Transfer/translation"): only I-class FEASTS have the right
+       of translation -- RG 91's own table lists Sundays as a separate row
+       (entry 6) from feasts (entries 11-13), so a Sunday is never a "feast" in RG 95's sense, and
+       [is_sunday_slug] (the same marker RG 33's [impedes_vigil] and RG
+       109(a)'s [privilege_of] already use) excludes it here. This is the
+       branch that completes Task 7's All Souls fix (RG
+       91 entry 8): All Souls is I class, not a vigil, and not a Sunday
+       slug, so once it loses to an occurring Sunday it still reaches here
+       and transfers -- to 3 November, now DIRECTLY authorised by RG 96
+       Attamen (b) (primary-source-verified 2026-08-12): "Commemoratio
+       omnium Fidelium defunctorum, quando occurrit cum dominica,
+       transfertur, tamquam in sedem propriam, in feriam II sequentem" --
+       when it coincides with a Sunday, transferred, as to its own proper
+       seat, to the following Monday. Previously this rested only on entry
+       8's own parenthetical plus the general RG 96 walk, which happened to
+       produce the right date; WHERE it lands either way is
+       Rite.transfer_target's job, not this function's -- disposition only
+       says THAT it moves. *)
+    Precedence.Transfer
+  else if
+    is_temporal
+    && (not (is_vigil (Slug.to_string cel.Celebration.slug)))
+    && cel.Celebration.rank = Class4
+  then
+    (* CORRECTED, fix round 1 (F1/F2 -- both real, the second the direct
+       cause of the first): the branch this replaces gated on
+       [privilege_of loser = Ordinary], justified by treating RG 109 as an
+       "exhaustive, closed list of the only temporal-origin circumstances
+       that ever generate a commemoration". That justification does not
+       survive reading RG 109 itself: it is headed "Commemorationes
+       PRIVILEGIATAE sunt commemorationes" and closes "Omnes aliae
+       commemorationes sunt commemorationes ORDINARIAE" -- it sorts
+       commemorations that ALREADY exist into two HONOUR classes
+       (privileged vs ordinary, RG 108's differing liturgical hours), and
+       says nothing about which offices have the RIGHT to be commemorated
+       in the first place. Testing [privilege_of = Ordinary] as an
+       ELIGIBILITY gate therefore happened to reach the right answer for
+       IV-class ferias (they are never commemorated, but for a reason
+       RG 109 does not state) and the WRONG answer for II- and III-class
+       ferias impeded during a season RG 109(e) does not privilege by name
+       (Advent 17-23 Dec's own ordinary-non-Ember ferias were fine, already
+       matching (e)'s slug prefix; the Advent and Lent EMBER ferias were
+       not, since the pre-fix (e) excluded them -- see [privilege_of]'s own
+       fix-round-1 comment above, which independently corrects THAT half
+       too). Confirmed wrong by direct reproduction (fix-round-1 review):
+       1900-12-21 (an Advent Ember Friday, RG 91 entry 18, II class) lost
+       its own commemoration entirely under the pre-fix code, while an
+       ORDINARY (non-Ember, lower-solemnity) Advent feria the same week
+       kept its commemoration -- backwards on any reading.
+
+       The actual rule is Caput IV, "De feriis" (RG 21-27), which the
+       original Task 16 pass never opened -- a FERIAL-CLASS-keyed rule,
+       entirely separate from RG 109's HONOUR-class one:
+       - RG 23 (I-class ferias -- Ash Wednesday, Holy Week): "nullam
+         admittunt commemorationem, nisi unam privilegiatam" -- admit no
+         commemoration except one privileged one. Never actually reaches
+         this function as a loser (these ferias structurally always
+         outrank anything that could coincide with their dates -- {!band}
+         entries 2/7, see that function's own file comment and the Task 11
+         Easter-window invariant), so this clause has no live witness, the
+         same as before.
+       - RG 24 (II-class ferias -- Advent 17-23 Dec, the Advent/Lent/
+         September Ember ferias, RG 91 entry 18): "si vero impediuntur,
+         COMMEMORARI DEBENT" -- if indeed impeded, they MUST be
+         commemorated. Not optional, not conditioned on RG 109's list.
+       - RG 25 (III-class ferias -- ordinary Lent/Passiontide ferias, RG 91
+         entry 22; ordinary Advent ferias to 16 Dec, entry 25): "Hae
+         feriae, si impediuntur, commemorari debent" -- same mandate.
+       - RG 26: "Omnes feriae, numeris 23-25 non nominatae, sunt feriae IV
+         classis; quae NUNQUAM COMMEMORANTUR" -- every feria not named in
+         23-25 is IV class, and IV-class ferias are NEVER commemorated.
+         This is [ferial_rank]'s own unqualified IV-class catch-all
+         (temporal_ef.ml), covering the ordinary green-season ferias of
+         Time after Epiphany/Pentecost, Septuagesima, Paschaltide outside
+         its privileged octave, and the Minor Rogation days (RG 87/88 --
+         they change nothing in the Office, so they take their season's
+         plain ferial class, which for Paschaltide-adjacent dates is
+         IV, not a special one).
+
+       So this branch is now gated directly on RG 26's own condition
+       ([rank = Class4]), which is the ONLY ferial class RG 21-27 excludes
+       from commemoration -- Class1 is structurally unreachable here (RG
+       23, above); Class2 and Class3 both fall through to the final
+       [Commemorate] branch below (RG 24/25's mandate), tagged with
+       whatever HONOUR class [privilege_of] separately computes for them
+       under RG 109 -- a question this branch no longer conflates with
+       eligibility. SANCTORAL losers are entirely unaffected (the
+       [is_temporal] guard): Caput IV governs FERIAE, RG 21's own opening
+       definition ("Nomine feriae intelleguntur singuli dies hebdomadae,
+       praeter dominicam"), never a saint's day; RG 111(c)/(d) admit an
+       "ordinary" commemoration of a losing SAINT freely, with no such
+       class-keyed gate.
+
+       Empirically confirmed against the missalemeum oracle (Task 16,
+       2026-2027, both years): every one of ~190 days where a saint's feast
+       impedes an ordinary (IV-class, non-privileged) temporal feria shows
+       ZERO commemorations in the oracle (e.g. "St. Marcellus I" impeding
+       the plain "Friday after Epiphany"), and the SAME rank-4 gate,
+       independently, correctly still omits the Minor Rogation days (RG 87)
+       losing to a saint -- both consequences of RG 26 alone now, not of a
+       reading of RG 109 that RG 109's own text does not support.
+
+       [is_vigil] is EXCLUDED from this branch for the same reason as
+       before, restated under the corrected citation: a II/III-class vigil
+       is temporal-origin too (the Ascension/Pentecost-adjacent case
+       {!of_temporal} produces) and typically Class2, so it would already
+       fall through this branch's [rank = Class4] test harmlessly on its
+       own -- RG 91 has no IV-class vigil at all (this file's own entry-27/
+       28 comments), so [is_vigil && rank = Class4] should never occur on
+       real data. Kept as an explicit, defensive guard (not load-bearing
+       for real data, but total over every candidate {!Precedence.resolve}
+       or {!Calendar} can construct, including shapes RG 91's table itself
+       does not describe) rather than relying on that absence silently: a
+       vigil, per RG 31 (II class, "si impediuntur, commemorantur") / RG 32
+       (III class, "si impeditur, commemoratur"), is ALWAYS commemorated
+       once RG 33 does not omit it outright, regardless of ferial class --
+       a rule Caput IV does not speak to at all (vigils are Caput V, RG
+       28-34, not "feriae"). RG 32's own full sentence, primary-source-
+       verified (final fix wave): "Vigilia III classis est vigilia S.
+       Laurentii. Haec vigilia praefertur diebus liturgicis IV classis; et,
+       si impeditur, commemoratur, iuxta rubricas" -- confirmed word for
+       word against the scan, not constructed by analogy with RG 31 (the
+       register's own §4 "Vigils" entry states RG 32 only as "same pattern
+       [as RG 31]", not verbatim -- now closed here). *)
+    Precedence.Omit
+  else
+    (* RG 95's other branch: "aut commemorantur aut penitus omittuntur" --
+       commemorated or wholly omitted. Reached by every SANCTORAL loser
+       below I class (RG 111(c)/(d)'s "ordinary" commemoration, no closed
+       list the way the temporal branch above has), AND by an impeded
+       I-class Sunday (excluded from the [Transfer] branch above, and from
+       the temporal Class4 [Omit] branch above because a Sunday is never
+       IV class -- RG 11-12/91 entry 6/15 make every Sunday I or II class,
+       never a "feria" at all in Caput IV's own sense, RG 21): RG 109(a)
+       (§4) lists "of a Sunday" as a privileged commemoration
+       category, which presupposes an impeded Sunday stays put rather than
+       moving to another day the way a feast does -- [privilege_of] tags it
+       [Privileged] via the same [is_sunday_slug] marker, with no further
+       code needed here. Which of commemorate/omit survives is RG 108-111's
+       admission count ([admit], below), not this function's decision; this
+       only opens the commemoration, tagged with its real RG 109 privilege
+       via [privilege_of].
+
+       RG 94 (a fixed-day commemoration is not carried along with a
+       transferred feast) needs no code here: [Precedence.resolve] calls
+       this function once per loser, always against the day's actual
+       [observed] winner -- never against a fellow loser that itself
+       transferred away -- so no mechanism exists by which a commemoration
+       could ride along with a departing feast in the first place; there is
+       nothing to suppress. *)
+    Precedence.Commemorate (privilege_of loser)
+
+(* Task 9: how many of the day's commemorations RG 111 admits, and which
+   (docs/research/rules-register.md §4, "Commemorations",
+   RG 111). [band] decides who wins the day; [disposition] decides who is
+   even eligible to be commemorated, and tags each with its RG 109 privilege
+   via [privilege_of]; this decides how many of THOSE survive.
+
+   RG 111 keys its four admission rules off the CLASS OF THE DAY ("diebus I
+   classis", "dominicis II classis", "aliis diebus II classis", "diebus III
+   et IV classis") -- read here off [observed]'s own [rank] and, for the
+   Sunday/non-Sunday II-class split, the same slug marker [privilege_of] and
+   RG 33's [impedes_vigil] already use ([is_sunday_slug]). No [context]
+   (date/season/weekday) is available to [admit] (see precedence.mli's
+   [rules.admit]) or needed: [observed] IS the day's own celebration, so its
+   rank and slug already carry everything RG 111's own four categories test. *)
+
+(* RG 8's four-class dignity order, Class1 highest. Deliberately NOT [band]
+   (RG 91's much finer 28-entry table): [band] needs a [context] [admit]
+   does not have (see above), and Celebration.mli's own comment on [status]
+   -- "RG 111 orders admitted commemorations by dignity" -- names [rank]
+   itself as that dignity, not the finer occurrence-table entry. *)
+let dignity = function
+  | Vocab_ef.Class1 -> 1
+  | Vocab_ef.Class2 -> 2
+  | Vocab_ef.Class3 -> 3
+  | Vocab_ef.Class4 -> 4
+
+(* Deterministic selection order for RG 111: dignity first, then slug --
+   the same tie-break {!Precedence.compare_by} uses for [band] itself (the
+   brief: "break ties on slug"), so which candidate wins a shared rank never
+   depends on the order [comms] arrives in. *)
+let compare_dignity (a, _) (b, _) =
+  let da = dignity a.Precedence.cel.Celebration.rank
+  and db = dignity b.Precedence.cel.Celebration.rank in
+  if da <> db then Int.compare da db
+  else Slug.compare a.Precedence.cel.Celebration.slug b.Precedence.cel.Celebration.slug
+
+let rec take n = function
+  | [] -> []
+  | x :: xs -> if n <= 0 then [] else x :: take (n - 1) xs
+
+let admit ~(observed : Vocab_ef.rank Precedence.candidate)
+    (comms : (Vocab_ef.rank Precedence.candidate * Precedence.privilege) list) :
+    (Vocab_ef.rank Precedence.candidate * Precedence.privilege) list =
+  (* Sorted once, by dignity then slug (see [compare_dignity]); every branch
+     below either takes a prefix of this list or filters it, so the RESULT
+     is always a sub-list of [comms] with its elements untouched -- never
+     rebuilt -- which matters beyond determinism: {!Precedence.resolve}'s
+     own [dropped] computation tells an admitted candidate from a dropped
+     one by physical equality (==) on the candidate value (Task 2's own
+     deferred note: "assuming admit returns the same candidate values rather
+     than rebuilt ones; undocumented for rite authors" -- documented here,
+     now that this is the function that note was about). Building a fresh
+     [{ c with ... }] record anywhere below would silently defeat that
+     accounting: the original would then match nothing in [admitted], so the
+     celebration would surface TWICE in the same day -- once in
+     [commemorations] (the rebuilt copy) and once in [omitted] (the original,
+     which nothing admitted matches). One admission, double-reported, and no
+     crash to announce it, which is exactly why this comment exists. *)
+  let sorted = List.stable_sort compare_dignity comms in
+  let is_privileged (_, p) = p = Precedence.Privileged in
+  let observed_rank = observed.Precedence.cel.Celebration.rank in
+  let observed_is_sunday =
+    is_sunday_slug (Slug.to_string observed.Precedence.cel.Celebration.slug)
+  in
+  let open Vocab_ef in
+  match (observed_rank, observed_is_sunday) with
+  | Class1, _ ->
+      (* RG 111: "I class: none save one privileged." Ordinary commemorations
+         never get a slot at all on a I-class day, no matter how many are
+         due; at most one privileged one does, the highest-dignity one if
+         several are. *)
+      (match List.filter is_privileged sorted with [] -> [] | best :: _ -> [ best ])
+  | Class2, true ->
+      (* RG 111(b), primary text, RE-VERIFIED word for word against the scan
+         (final fix wave; this sentence is the sole textual basis for the
+         shipped rank-floor fix below, and the register's own §4 "RG 111"
+         entry previously carried only the fragment "de festo II classis",
+         not the full sentence -- now added there too): "in dominicis II
+         classis, una tantum admittitur commemoratio, SCILICET DE FESTO II
+         CLASSIS, quæ tamen omittitur si commemoratio privilegiata facienda
+         sit" -- "on Sundays of the II class, only ONE commemoration is
+         admitted, NAMELY OF A FEAST OF THE II CLASS, which however is
+         dropped if a privileged commemoration is due." Two clauses, not
+         one: (i) a privileged
+         commemoration, whenever due, categorically takes the day's one slot
+         -- not by comparing its dignity against the ordinary contender's,
+         so an ordinary commemoration that would otherwise win on raw
+         dignity is still dropped once any privileged one is also due (the
+         asymmetric clause the brief and task report flag as deliberate, not
+         present at "other II class" below); (ii) failing that, the slot is
+         reserved SPECIFICALLY for a [Class2] candidate -- "de festo II
+         classis" is a RANK restriction, not merely "whichever ordinary
+         candidate has the best dignity": a III- or IV-class ordinary loser
+         (a plain commemoration-only saint with no privilege of its own) has
+         NO standing for this slot at all and must be entirely omitted, even
+         when it is the only candidate present.
+
+         Fix, Task 16 (primary-source-verified + missalemeum-confirmed):
+         previously this fell back to "the best of [sorted], whatever its
+         rank" once no privileged candidate was due, silently admitting a
+         III/IV-class ordinary saint that RG 111(b)'s own wording excludes.
+         Confirmed wrong for real data by the oracle comparison: e.g. 11 Jan
+         2026 (Holy Family, a II-class Sunday) has St Hyginus (Class3,
+         commemoration-only) as its only competing candidate -- missalemeum
+         shows him "displaced" (omitted), never commemorated; the
+         pre-fix code admitted him regardless. *)
+      (match List.filter is_privileged sorted with
+       | best :: _ -> [ best ]
+       | [] -> (
+           match List.filter (fun (c, _) -> c.Precedence.cel.Celebration.rank = Class2) sorted with
+           | [] -> []
+           | best :: _ -> [ best ]))
+  | Class2, false ->
+      (* RG 111: "other II class: one" -- no privilege-override clause here,
+         unlike the Sunday case immediately above, so the day's one slot
+         goes to whichever candidate outranks the rest by dignity alone,
+         privileged or not. *)
+      (match sorted with [] -> [] | best :: _ -> [ best ])
+  | (Class3 | Class4), _ ->
+      (* RG 111: "III-IV class: at most two" -- by dignity, same as the
+         non-Sunday II-class case, just with room for two. *)
+      take 2 sorted
+
+(* Task 11: RG 96 -- where an impeded I-class feast lands (docs/research/
+   rules-register.md §4, "Transfer/translation"). [band] decides who is
+   impeded; [disposition] decides that an impeded I-class FEAST (not a
+   Sunday, not omitted by RG 33) is [Transfer]-disposed; this is the third
+   and final question RG 96 poses -- WHERE the translation lands -- and is
+   {!Rite.t.transfer_target} itself, called by {!Calendar}'s placement pass
+   once per deferred candidate, never re-run once a target is accepted
+   (calendar.ml's own comment on [~start ~stop]).
+
+   RG 96's own text, register-transcribed: "the next following day that is
+   not I or II class." [is_blocking] reads that off [Vocab_ef.rank] --
+   RG 96 speaks of the day's CLASS (RG 8's four-way dignity), not [band]'s
+   finer 28-entry occurrence-table row, the same distinction {!admit} above
+   already draws for RG 111 ({!dignity}, not [band]). *)
+let is_blocking (rank : Vocab_ef.rank) = rank = Vocab_ef.Class1 || rank = Vocab_ef.Class2
+
+(* RG 96's own named exception (docs/research/rules-register.md §4,
+   "Transfer/translation", RG 96 Attamen (a) -- primary-source-verified
+   2026-08-12, corrected from an earlier unconditional transcription; see
+   the register's own correction note). Verbatim: "festum Annuntiationis
+   B. Mariae Virg., quando est transferendum post Pascha, transfertur,
+   tamquam in sedem propriam, in feriam II post dominicam in albis" -- when
+   [the feast] is to be transferred PAST EASTER, [it] is transferred, as to
+   its own proper seat, to the Monday after Low Sunday. The exception is
+   CONDITIONAL on that "past Easter" clause -- {!transfer_target} tests it
+   by comparing the GENERAL RG 96 target against Easter itself, not by
+   testing the date here. Identified by slug -- the same convention this
+   file already uses to pick out one specific celebration from a rank/
+   status shape shared by many others ({!nativity_octave_prefix},
+   [is_ember_18]'s date anchors) -- not an RG citation itself: RG 96 does
+   not encode how a computer recognises "the Annunciation", only what
+   happens to it once recognised. data/ef/sanctoral.sexp's own bootstrapped
+   slug (Task 10), reused verbatim rather than guessed. *)
+let annunciation_slug = "annunciation-of-the-blessed-virgin-mary"
+
+(* Not an RG citation -- a defensive engineering ceiling, the same role
+   Calendar's own [max_transfer_rounds] plays for the OUTER round loop
+   (calendar.ml). That guard bounds how many ROUNDS the whole-year placement
+   pass takes; it does nothing for the walk a single call to this function
+   makes internally, which is this module's own responsibility (rite.mli
+   documents the obligation this constant exists to satisfy). Comfortably
+   longer than the longest real run of consecutive I/II-class days the 1962
+   calendar produces -- 24 Dec to 1 Jan (the Nativity vigil through the
+   Circumcision, both I class, with the intervening octave days II class) is
+   9 days; Easter through Low Sunday (the Easter octave, I class, entry 10)
+   is 8 -- RG 91 entry 28's own unqualified IV-class catch-all guarantees a
+   non-blocking feria follows any such run in real data. Not tuned to that
+   bound any more than 64 is tuned to RG 97-98's real collision count: a
+   ceiling nothing in the 1962 calendar comes close to, so a rite/data shape
+   this module has not anticipated fails FINITELY (see [search_from]) rather
+   than hanging the CLI. *)
+let max_search_days = 400
+
+(* The domain's own ceiling ({!Date.make}'s documented 1583..9999 bound,
+   also duplicated by calendar.ml's own [domain_max_date] for the same
+   reason: neither module exposes it to the other, and this is a three-line
+   constant, not worth a new signature just to share it). [search_from]
+   below must never call [occupant] on a date past this: [occupant] chains
+   through the rite's own [temporal] (calendar.ml's [resolve_with_injected]),
+   which for the real EF rite calls [Computus.gregorian_easter], which is
+   NOT total outside 1583..9999 -- it constructs a [Date.t] via [Date.make]
+   and [failwith]s on [Error]. [Date.add_days] itself has no such limit (it
+   is documented "unbounded total arithmetic"), so [search_from] CAN walk
+   [d] past 31 December 9999 without raising by itself -- the raise would
+   only happen on the NEXT [occupant d] call, which is exactly the bug this
+   guards against: an I-class feast impeded late enough in civil year 9999
+   that every remaining day of the year is also I or II class (reachable
+   through the project's own overlay mechanism, confirmed by review: an
+   Add-ed I-class feast on 25 December leaves only Class2 Nativity-octave
+   days for the rest of 9999, so the unguarded walk reached 1 January 10000
+   and crashed there). *)
+let domain_max_date =
+  match Date.make ~year:9999 ~month:12 ~day:31 with Ok d -> d | Error e -> failwith e
+
+(* Walks forward from [d], returning the first date [occupant] reports as
+   NOT [is_blocking]. [steps] is a strictly increasing structural bound on
+   the recursion, capped at [max_search_days]: the function decreases
+   [max_search_days - steps] by exactly one on every call and returns as
+   soon as that reaches zero (whether or not an admissible day was ever
+   found), so THIS loop terminates by construction, regardless of what
+   [occupant] reports -- it does not rely on the real EF calendar's own
+   structure to guarantee termination the way the comment above explains
+   why the bound is never actually reached in practice. Also stops, without
+   calling [occupant] again, once [d] passes {!domain_max_date} -- see that
+   constant's own comment for why probing [occupant] beyond it can raise.
+   Either way the last date visited is returned WITHOUT a further
+   [occupant] probe -- one more finite (not necessarily admissible) date,
+   not a further search -- because the value the caller ([transfer_target])
+   is still owed is "a date", never an exception; {!Calendar}'s own
+   [~start ~stop] bound (calendar.ml's [place_transfers]) is what turns an
+   implausible non-terminating real search into a recorded [omitted], not
+   this function pretending to have found something admissible. *)
+let rec search_from (occupant : Date.t -> Vocab_ef.rank Celebration.t) (steps : int) (d : Date.t) :
+    Date.t =
+  if steps >= max_search_days || Date.compare d domain_max_date > 0 then d
+  else if is_blocking (occupant d).Celebration.rank then search_from occupant (steps + 1) (Date.add_days d 1)
+  else d
+
+(* [transfer_target]'s contract (rite.mli): total, terminating, and its
+   result is always strictly after [origin]. Terminating: [search_from]'s
+   own structural bound, above. Strictly after [origin]: the general branch
+   is exactly [search_from]'s own result starting at [Date.add_days origin
+   1], which only ever advances forward from there, so it is always >=
+   origin + 1. The Annunciation branch, when it fires, instead searches from
+   the Monday after Low Sunday for [origin]'s own civil year -- NOT provably
+   later than [origin] by the code alone, but true of every representable
+   year: the Annunciation's [origin] is always 25 March (Date_spec.Fixed in
+   data/ef/sanctoral.sexp), Easter always falls within that SAME civil year
+   in [22 March, 25 April] (Computus's own documented range, register §0),
+   so Low Sunday (Easter + 7) falls in [29 March, 2 May] and the Monday
+   after it in [30 March, 3 May] -- always after 25 March.
+
+   RG 96 Attamen (a) (see {!annunciation_slug}'s own comment) makes the
+   Annunciation exception CONDITIONAL on the general walk carrying the
+   feast past Easter -- so the general target is always computed FIRST,
+   for every candidate, and only overridden for the Annunciation when that
+   target itself falls after Easter Sunday. A version of this function that
+   tested the DATE of [origin] instead (e.g. "is 25 March within some fixed
+   window of Easter") would be re-deriving the register's own "quando est
+   transferendum post Pascha" condition from first principles, exactly the
+   kind of guess this project's "a wrong citation is worse than a missing
+   one" rule warns against; comparing the general target against Easter
+   directly tests the rubric's own words. *)
+let transfer_target (c : Vocab_ef.rank Precedence.candidate) (origin : Date.t)
+    (occupant : Date.t -> Vocab_ef.rank Celebration.t) : Date.t =
+  let general_target = search_from occupant 0 (Date.add_days origin 1) in
+  let is_annunciation = Slug.to_string c.Precedence.cel.Celebration.slug = annunciation_slug in
+  let easter = Computus.gregorian_easter (Date.year origin) in
+  if is_annunciation && Date.compare general_target easter > 0 then
+    (* Low Sunday = Easter + 7 (register §0, temporal_ef.ml's [off 7]); the
+       Monday after it = Easter + 8. Searched onward from there exactly
+       like the general case searches from [origin + 1] -- "only if that
+       day is itself blocked" (rite.mli) is [search_from]'s ordinary
+       behaviour, not a second mechanism. *)
+    search_from occupant 0 (Date.add_days easter 8)
+  else general_target
diff --git a/lib/rites/rite_ef/precedence_ef.mli b/lib/rites/rite_ef/precedence_ef.mli
new file mode 100644
index 0000000..55f947e
--- /dev/null
+++ b/lib/rites/rite_ef/precedence_ef.mli
@@ -0,0 +1,260 @@
+(** RG 91's Table of Precedence for the EF (1962) rite: ranks any candidate
+    for a given day by its RG 91 entry number. See
+    docs/research/rules-register.md §4, whose 28-entry transcription this
+    module follows line by line. *)
+
+open Colitur_kernel
+
+(** The universal (base) sanctoral layer's {!Celebration.t}.layer id. A
+    Sanctoral-origin candidate whose layer is anything else is an overlay:
+    "proper" (RG 91 entries 12, 19, 23) unless its layer id also carries
+    {!indult_prefix} ("indult", entries 13, 20). This id and the prefix are
+    colitur's own data-modelling convention, not an RG citation -- RG 91
+    prescribes the ranking, not a machine encoding for it. Whichever task
+    loads the real EF sanctoral base layer and its overlays must either
+    reuse these two constants or this classifier will misfile them. *)
+val universal_layer : string
+
+(** See {!universal_layer}. *)
+val indult_prefix : string
+
+(** Slug suffix marking a celebration as a vigil (RG 91 entries 21, 26),
+    e.g. "ef-ascension-vigil" -- colitur's own temporal-cycle convention
+    (rite_ef/temporal_ef.ml's [named]). Also colitur's own convention, not
+    an RG citation, exposed for the same reason as {!universal_layer}. See
+    {!vigil_prefix} for the sanctoral data's own, different convention: a
+    vigil can arrive named either way, and {!band}/{!disposition} must
+    recognise both. *)
+val vigil_suffix : string
+
+(** Slug prefix marking a celebration as a vigil, e.g. "vigil-of-st-lawrence"
+    -- the sanctoral data's own convention (data/ef/sanctoral.sexp, adopted
+    verbatim from lectio's naming, per spec §4.4's "slugs are lectionary keys,
+    not re-derived"). Also colitur's own convention, not an RG citation --
+    see {!universal_layer}. Task 10 bootstrapped four real sanctoral vigils
+    named this way (St Lawrence 08-09, Sts Peter & Paul 06-28, the Assumption
+    08-14, the Nativity of St John the Baptist 06-23; a fifth, Christmas, is
+    suppressed as a duplicate of the temporal cycle's own "ef-nativity-vigil"
+    -- see data/ef/adjustments.sexp), none of which end in {!vigil_suffix}:
+    without this prefix also being checked, {!band} would misfile all four at
+    16/24 (an ordinary feast of the same rank) instead of RG 91's 21/26, and
+    RG 33's vigil omission ({!disposition}'s [is_vigil] test, the same
+    predicate) would never fire for them either -- two rubrics silently
+    broken for four celebrations, exactly what Task 7's review predicted
+    when it asked for {!vigil_suffix} to be exposed. *)
+val vigil_prefix : string
+
+(** Slug prefixes marking a celebration as one of RG 91 entry 18's three
+    Ember-day sets (Advent, Lent, September -- the Pentecost/Whitsun set is
+    I class and matched by entry 10 before this is ever consulted). Also
+    colitur's own convention mirroring rite_ef/temporal_ef.ml's own "ef-<set>
+    -ember-<day>" slug format, not re-derived from first principles; exposed
+    so a rename of that format has somewhere to be caught other than a
+    silently-wrong entry 18. *)
+val ember_prefixes : string list
+
+(** Returned for a candidate shape RG 91's 28-entry table has no row for --
+    e.g. a [Class1] vigil that is not the Nativity or Pentecost (entries 5,
+    9 are the only I-class vigils the table names), or a [Class4] candidate
+    also marked as a vigil. Deliberately outside 1..28 and larger than any
+    real entry, so an unclassified candidate can never win an occurrence
+    contest by accident; a caller that sees it back knows the shape needs a
+    new rule, not a silently wrong one. *)
+val unclassified : int
+
+(** [band ctx c]: RG 91's Table of Precedence. Returns the table's own entry
+    number -- I class 1-13, II class 14-21, III class 22-26, IV class 27-28;
+    lower wins (see {!Precedence.rules.band}) -- EXCEPT where the table's own
+    text states an exception: entry 8 (All Souls) reads "yields to an
+    occurring Sunday", so on a Sunday this returns a value that
+    loses to entry 15 rather than the literal integer 8 (see the comment on
+    entry 8 in precedence_ef.ml for the exact value and why). Total over
+    every candidate {!Precedence.resolve} or {!Calendar} can construct,
+    including shapes the 1962 table itself does not describe (see
+    {!unclassified}). *)
+val band : Vocab_ef.season Precedence.context -> Vocab_ef.rank Precedence.candidate -> int
+
+(** RG 33's marker: every Sunday slug this rite's temporal cycle produces
+    (temporal_ef.ml's [named] and [sunday_slug]) contains this substring;
+    nothing else {!band} classifies does. Also colitur's own convention, not
+    an RG citation -- see {!universal_layer} -- exposed for the same reason
+    as {!vigil_suffix}: a rename of temporal_ef's Sunday-slug format has
+    somewhere to be caught other than a silently-wrong RG 33 disposition. *)
+val sunday_marker : string
+
+(** [disposition ~winner ~loser]: RG 92-95, 33, 21-27, 94 (docs/research/
+    rules-register.md §4, "Occurrence", "Vigils" and "Caput IV, 'De
+    feriis'"). What becomes of a losing candidate, decided by the LOSER's
+    own rank and status (RG 95), except RG 33's vigil omission, which also
+    reads the winner:
+    - a {!Celebration.status} of [Commemoration_only] is always
+      [Commemorate] (checked first: it can never win -- see
+      {!Precedence.resolve} -- and, by that same status's own definition,
+      already denotes an office with nothing left to translate, so it never
+      transfers either; not itself a further RG citation beyond RG 93's
+      general four-mechanism statement above);
+    - a [Class2] or [Class3] loser whose slug marks it a vigil
+      ({!vigil_suffix} OR {!vigil_prefix} -- both conventions this
+      codebase's data uses, see {!vigil_prefix}'s own comment) is [Omit]
+      when the winner is any Sunday ({!sunday_marker}) or itself [Class1]
+      (RG 33 -- entirely omitted, not merely commemorated). A [Class1]
+      vigil (Nativity, Pentecost) is outside RG 33 entirely -- RG 30 makes
+      it preferred to any feast whatsoever, so a real one can never reach
+      this function as a [loser] in the first place (see the .ml's own
+      comment on [is_omissible_vigil] for the full argument);
+    - any other [Class1] loser that is NOT a Sunday ({!sunday_marker}) is
+      [Transfer] (RG 95 -- only I-class FEASTS have the right of
+      translation; RG 91's own table lists Sundays as a separate row, entry
+      6, from feasts, entries 11-13, so a Sunday is never a "feast" in RG
+      95's sense and does not transfer even when impeded by a higher
+      I-class day. This is also what moves All Souls, RG 91 entry 8, once
+      it loses to an occurring Sunday -- WHERE it lands is
+      {!Rite.t.transfer_target}'s job, not this function's);
+    - a TEMPORAL-origin, non-vigil loser of [Class4] is [Omit] (RG 26,
+      "Caput IV, De feriis" -- "every feria not named in [RG 23-25] is IV
+      class ... and IV-class ferias are NEVER commemorated." A SEPARATE
+      rule from RG 109's honour-class one immediately below, keyed on
+      ferial CLASS rather than on RG 109's privilege letters: RG 109 sorts
+      commemorations that already exist into honour classes (RG 108's
+      differing liturgical hours), it does not itself decide which offices
+      have the right to be commemorated at all -- that is Caput IV's own
+      business. A SANCTORAL loser of the same rank is unaffected by this
+      branch (the [is_temporal] guard): RG 21 defines "feria" as any
+      weekday, never a saint's day, and RG 111(c)/(d) admit an "ordinary"
+      commemoration of a losing SAINT freely, with no such class-keyed
+      gate);
+    - everything else -- including an impeded I-class Sunday, and a
+      SANCTORAL loser of any rank below I class -- is [Commemorate],
+      carrying its real RG 109 privilege (see {!admit} below); RG 109(a)
+      lists "of a Sunday" as a privileged commemoration category precisely
+      because an impeded Sunday stays put rather than moving to another
+      day, and RG 24/25 make a losing II- or III-class FERIA's own
+      commemoration mandatory when impeded, not merely eligible.
+
+    Total over every winner/loser pair {!Precedence.resolve} or {!Calendar}
+    can construct: [Vocab_ef.rank] (RG 8) and {!Celebration.status} are both
+    closed variants, and the five cases above -- an if/else-if chain ending
+    in the unconditional [Commemorate] catch-all -- exhaust every value
+    those two fields can take between them; there is no sixth,
+    "unclassified" case the way {!band} needs one, because this function's
+    own return type has no such slot to fall into by accident. *)
+val disposition :
+  winner:Vocab_ef.rank Precedence.candidate ->
+  loser:Vocab_ef.rank Precedence.candidate ->
+  Precedence.disposition
+
+(** Slug prefix marking a celebration as one of RG 91 entry 17's days within
+    the Octave of the Nativity (29-31 Dec -- 26-28 Dec are Stephen, John, the
+    Innocents, sanctoral, never this prefix). Also colitur's own convention
+    mirroring rite_ef/temporal_ef.ml's own "ef-nativity-octave-day-%d" slug
+    format, not an RG citation -- see {!universal_layer} -- exposed for the
+    same reason as {!vigil_suffix}: a rename of that format has somewhere to
+    be caught other than a silently-wrong RG 109(c) privilege. *)
+val nativity_octave_prefix : string
+
+(** The September set of {!ember_prefixes}, broken out on its own because RG
+    109(d) (§4, "Commemorations") privileges September Ember days under its
+    own name, and September sits outside RG 109(e)'s three named seasons
+    (Advent, Lent, Passiontide) under any reading of that clause -- NOT
+    because the Advent and Lent Ember sets need excluding from (e), which
+    they do not: (e)'s own bare text privileges them too, the same as any
+    other Advent/Lent feria (see {!Precedence_ef.privilege_of}'s own (e)
+    comment in the .ml for the full argument, corrected fix round 1).
+    {!ember_prefixes} is built from this constant, not a duplicated literal,
+    so the two cannot silently drift apart. *)
+val september_ember_prefix : string
+
+(** [admit ~observed comms]: RG 108-111 (docs/research/rules-register.md §4,
+    "Commemorations"). How many of [comms] -- each already tagged with its
+    real RG 109 privilege by {!disposition} -- RG 111 admits, and which,
+    given the day actually observed:
+    - [observed] a [Class1] day: none, except at most one privileged
+      commemoration (the highest-dignity one, if several are due) -- an
+      ordinary one is never admitted here, no matter how many are due;
+    - [observed] a [Class2] Sunday (its slug carries {!sunday_marker}): one,
+      subject to TWO conditions, not one -- (i) a privileged commemoration,
+      whenever due, categorically takes the day's one slot over any
+      ordinary one, not by comparing dignity, so an ordinary commemoration
+      that would otherwise win on dignity is still dropped; (ii) failing
+      that, the slot is reserved for a [Class2] candidate SPECIFICALLY
+      ("de festo II classis", RG 111(b)'s own wording -- a RANK FLOOR, not
+      "whichever ordinary candidate has the best dignity"): a III- or
+      IV-class ordinary loser has no standing for this slot at all and is
+      admitted nothing, even when it is the only candidate due;
+    - [observed] any other [Class2] day: one, by dignity alone -- no
+      privilege override and no rank floor, unlike the Sunday case
+      immediately above;
+    - [observed] a [Class3] or [Class4] day: at most two, by dignity alone.
+
+    "Dignity" here is [Vocab_ef.rank] (RG 8's four classes), NOT {!band}'s
+    finer RG 91 entry number -- {!band} needs a [context] (date/season/
+    weekday) this function does not receive (see {!Precedence.rules.admit}).
+    Ties break on slug, matching {!Precedence.compare_by}, so the result
+    never depends on the order [comms] arrives in.
+
+    Every candidate this returns is a value taken unchanged from [comms],
+    never rebuilt: {!Precedence.resolve}'s own [dropped]/[omitted]
+    accounting tells an admitted candidate from a dropped one by physical
+    equality on the candidate value, so anything this function admitted
+    stays admitted, and anything it did not is reported in
+    {!Precedence.resolution.omitted}, never silently lost. Total: every
+    [Vocab_ef.rank] is one of the four cases above, and every branch is
+    itself total over an empty or arbitrarily long [comms]. *)
+val admit :
+  observed:Vocab_ef.rank Precedence.candidate ->
+  (Vocab_ef.rank Precedence.candidate * Precedence.privilege) list ->
+  (Vocab_ef.rank Precedence.candidate * Precedence.privilege) list
+
+(** The Annunciation's own bootstrapped slug (data/ef/sanctoral.sexp, Task
+    10), reused verbatim by {!transfer_target} to recognise RG 96's named
+    exception. Not an RG citation -- see {!universal_layer} -- exposed so a
+    future re-bootstrap that renames the slug has somewhere to be caught
+    other than a silently-wrong transfer target. *)
+val annunciation_slug : string
+
+(** [transfer_target c origin occupant]: RG 96 (docs/research/rules-register
+    .md §4, "Transfer/translation") -- where an impeded I-class feast, once
+    {!disposition} has decided it is [Transfer]-disposed, is placed. This
+    *is* {!Colitur_kernel.Rite.t}.transfer_target; see that field's own
+    fuller rationale for why the search has to be rite-supplied at all.
+
+    RG 96's own rule: the next following day whose currently-resolved
+    occupant is not I or II class (read off [Vocab_ef.rank], RG 8's dignity
+    -- not {!band}'s finer occurrence-table entry, the same distinction
+    {!admit} draws for RG 111). This general target is computed for EVERY
+    candidate, always, first.
+
+    RG 96's own named exception (Attamen (a), primary-source-verified --
+    see {!annunciation_slug}'s comment for the Latin and the register's own
+    correction note): for the Annunciation specifically, IF that general
+    target would fall after Easter Sunday itself ("quando est transferendum
+    post Pascha" -- when it is to be transferred past Easter), the
+    Annunciation is placed instead at the Monday after Low Sunday (its
+    [sedes propria]), searching onward from there only if that day is
+    itself occupied by a blocking class. The exception is CONDITIONAL, not
+    unconditional: an Annunciation impeded for a reason that resolves
+    BEFORE Easter (e.g. an ordinary Lent Sunday with a free feria the next
+    day) takes the general target like any other I-class feast. Operationally
+    the condition holds exactly when 25 March falls close enough to Easter
+    that the general walk crosses it -- concretely, when 25 March itself
+    falls within Holy Week or Easter Week.
+
+    Total, terminating, and its result is always strictly later than
+    [origin] -- {!Colitur_kernel.Rite.t}.transfer_target's own obligations,
+    which {!Colitur_kernel.Calendar}'s placement pass relies on and its own
+    round guard does not itself enforce (calendar.ml's [place_transfers]
+    bounds ROUNDS across a whole year, not one call's internal walk).
+    Terminating by a structural bound on the internal walk (max 400 days,
+    an engineering ceiling, not an RG citation -- see the .ml) AND a guard
+    at {!Colitur_kernel.Date}'s own domain ceiling (31 December 9999,
+    beyond which probing [occupant] can itself raise -- see the .ml's
+    [domain_max_date]), not by an argument about the real 1962 calendar's
+    own structure, so a rite/data shape this function has not anticipated
+    fails FINITELY rather than hanging or crashing the caller. Strictly
+    later than [origin]: the general search starts at [origin + 1] and only
+    ever advances forward from there; the Annunciation's own alternate
+    starting point is provably later than 25 March for every representable
+    year (Easter's documented range, register §0) -- see the .ml for the
+    full argument. *)
+val transfer_target :
+  Vocab_ef.rank Precedence.candidate -> Date.t -> (Date.t -> Vocab_ef.rank Celebration.t) -> Date.t
diff --git a/lib/rites/rite_ef/rite_ef.ml b/lib/rites/rite_ef/rite_ef.ml
new file mode 100644
index 0000000..7a29421
--- /dev/null
+++ b/lib/rites/rite_ef/rite_ef.ml
@@ -0,0 +1,24 @@
+(* This module's name matches the library's own name ("rite_ef"), so dune
+   treats it as the library's top-level module instead of generating one
+   automatically -- every sibling module this library defines must be
+   re-exported here explicitly, or external references to e.g.
+   [Rite_ef.Temporal_ef] (bin/main.ml, every test/ file that opens this
+   rite) stop resolving. *)
+module Vocab_ef = Vocab_ef
+module Temporal_ef = Temporal_ef
+module Precedence_ef = Precedence_ef
+
+open Colitur_kernel
+
+let context : (Vocab_ef.season, Vocab_ef.rank) Rite.t =
+  { Rite.id = Temporal_ef.id;
+    vocab = Vocab_ef.vocab;
+    year_start = Temporal_ef.year_start;
+    temporal = Temporal_ef.temporal;
+    anchors = Temporal_ef.anchors;
+    rules =
+      { Precedence.band = Precedence_ef.band;
+        disposition = Precedence_ef.disposition;
+        admit = Precedence_ef.admit };
+    season_runs = Vocab_ef.seasons;
+    transfer_target = Precedence_ef.transfer_target }
diff --git a/lib/rites/rite_ef/rite_ef.mli b/lib/rites/rite_ef/rite_ef.mli
new file mode 100644
index 0000000..e2b3e6d
--- /dev/null
+++ b/lib/rites/rite_ef/rite_ef.mli
@@ -0,0 +1,35 @@
+(** The EF (1962) rite module: this library's top-level module (its filename
+    matches the library's own name "rite_ef", so dune uses it as the
+    library's entry point directly rather than generating one -- see the
+    .ml's own comment). Re-exports every sibling module this library
+    defines, so [Rite_ef.Vocab_ef], [Rite_ef.Temporal_ef] and
+    [Rite_ef.Precedence_ef] keep resolving exactly as they did before this
+    module existed. *)
+
+module Vocab_ef = Vocab_ef
+module Temporal_ef = Temporal_ef
+module Precedence_ef = Precedence_ef
+
+(** The EF rite, bundled (design spec's [RITE] signature, realised as a
+    {!Colitur_kernel.Rite.t} value rather than a functor -- see rite.mli):
+    - [id], [vocab], [year_start], [temporal], [anchors]: {!Temporal_ef}
+      unchanged (RG 71-77 seasons, RG 91's named movable days).
+    - [rules]: {!Precedence_ef}'s three RG 91/92-95/108-111 functions,
+      wrapped as one {!Colitur_kernel.Precedence.rules} record.
+    - [season_runs]: {!Vocab_ef.seasons} itself -- the EF liturgical year
+      visits each of its eight seasons exactly once, in that same order
+      (Advent-anchored, matching [year_start]), so the expected
+      run-length-compressed sequence {!Colitur_kernel.Rite.t.season_runs}
+      wants IS the vocabulary's own canonical list, not a separate one.
+    - [transfer_target]: {!Precedence_ef.transfer_target}, RG 96 (see that
+      value's own documentation for the termination and forward-progress
+      argument {!Colitur_kernel.Rite.t.transfer_target}'s contract requires).
+
+    Deliberately carries no [sanctoral]/[lectionary] fields the way the
+    original design-doc sketch of [RITE] does: {!Colitur_kernel.Rite.t} (the
+    type actually shipped, Plan 2) keeps the sanctoral {!Colitur_kernel.Layer.t}
+    a separate argument to {!Colitur_kernel.Calendar.year}/[day] rather than
+    embedding it here, so a caller can load data/ef/sanctoral.sexp (plus
+    data/ef/adjustments.sexp's overlay) however suits it -- bin/main.ml's
+    [load_ef_layer] is the one this module ships with. *)
+val context : (Vocab_ef.season, Vocab_ef.rank) Colitur_kernel.Rite.t
diff --git a/lib/rites/rite_ef/temporal_ef.ml b/lib/rites/rite_ef/temporal_ef.ml
index 52a9adb..7782876 100644
--- a/lib/rites/rite_ef/temporal_ef.ml
+++ b/lib/rites/rite_ef/temporal_ef.ml
@@ -17,9 +17,17 @@ let weekday_index d =
 (* The Sunday on or before [d]. *)
 let sunday_on_or_before d = Date.add_days d (-(weekday_index d))
 
-(* RG 71: Advent I is the Sunday nearest 30 November -- equivalently the fourth
-   Sunday before Christmas, i.e. three weeks before the last Sunday on or before
-   24 December. *)
+(* RG 20 (Caput III, "De Dominicis"), primary-source-verified (final fix
+   wave): "Dominica I Adventus ea est, quae cadit die 30 novembris vel est
+   ipsi proximior" -- Advent I Sunday is that which falls on 30 November or
+   is nearest to it. CORRECTED citation: this comment previously cited RG
+   71 for this placement rule -- WRONG, RG 71 (cited on [season] below)
+   states only Advent's own season BOUNDARY ("a I Vesperis dominicae I
+   Adventus..."), not which Sunday opens it; the register's own RG 71 entry
+   is a boundary citation, and the only "nearest 30 November" text there
+   before this fix was UNLYC nn. 39-42, the MODERN form's rule, not this
+   one's. Equivalently the fourth Sunday before Christmas, i.e. three weeks
+   before the last Sunday on or before 24 December. *)
 let advent_start y = Date.add_days (sunday_on_or_before (mk y 12 24)) (-21)
 let year_start = advent_start
 
@@ -47,8 +55,13 @@ let season d =
   else if Date.compare d paschal_end <= 0 then Paschaltide (* RG 76 *)
   else Time_after_pentecost (* RG 77 *)
 
-(* Last Sunday of October, per the 1960 calendar -- NOT the OF's last Sunday
-   before Advent. Register §6 flags this for primary-source confirmation. *)
+(* RG 17(d) (Caput III, "De Dominicis"), PRIMARY-SOURCE-VERIFIED (final fix
+   wave, closing the item register §6 previously carried as "oracle-backed,
+   not yet primary-verified"): "festum D. N. Iesu Christi Regis, celebrandum
+   dominica ultima mensis octobris" -- the feast of Our Lord Jesus Christ
+   the King is to be celebrated on the LAST SUNDAY OF OCTOBER. NOT the OF's
+   last Sunday before Advent -- a genuine EF/OF divergence, not merely a
+   citation gap. *)
 let christ_the_king y = sunday_on_or_before (mk y 10 31)
 
 let same a b = Date.compare a b = 0
@@ -77,7 +90,10 @@ let named d =
   if m = 12 && dd = 25 then Some (Christmastide, "ef-nativity", Colour.White, Class1)
   else if m = 12 && dd = 24 then
     (* RG 91 entry 5: the Vigil of the Nativity is I class. lectio has no slug
-       for it, so this key has no lectionary entry until Plan 3 fills it. *)
+       for it, so this key has no lectionary entry until Plan 4 fills it
+       (CORRECTED, final fix wave, item 7 -- this is the lectionary/reading-
+       citations bootstrap, Plan 4, not the sanctoral one, Plan 3, which
+       already shipped in this branch). *)
     Some (Advent, "ef-nativity-vigil", Colour.Violet, Class1)
   else if m = 12 && (dd = 29 || dd = 30 || dd = 31) then
     (* Days within the Octave of the Nativity; 26-28 Dec are Stephen, John and
@@ -98,9 +114,15 @@ let named d =
   else if same d (off 7) then
     Some (Paschaltide, "ef-low-sunday", Colour.White, Class1) (* RG 91 entry 6 *)
   else if same d (off 38) then
-    (* RG 91 entry 21: II-class vigil. It is also Rogation Wednesday; with no
-       precedence framework until Plan 3, temporal emits the higher-ranked
-       vigil and the Rogation commemoration waits for RG 108-111. *)
+    (* RG 91 entry 21: II-class vigil. It is also Rogation Wednesday; [named]
+       emits the higher-ranked vigil (entry 21 outranks any Rogation-day
+       ferial rank). CORRECTED (final fix wave, item 7): this comment
+       previously said the Rogation commemoration itself "waits for RG
+       108-111" -- the precedence framework and RG 108-111 both exist now
+       (this branch), but no candidate for the Rogation Wednesday's own
+       observance is constructed here or anywhere else, so there is nothing
+       for RG 108-111 to admit; see the fuller comment on the Rogation
+       branch further down in [temporal] for the current, still-real gap. *)
     Some (Paschaltide, "ef-ascension-vigil", Colour.White, Class2)
   else if same d (off 39) then Some (Paschaltide, "ef-ascension", Colour.White, Class1)
   else if same d (off 48) then Some (Paschaltide, "ef-pentecost-vigil", Colour.Red, Class1) (* RG 91 entry 9 *)
@@ -170,8 +192,10 @@ let week d =
      this to "ef-christmas-0-<weekday>", indistinguishable from the stretch
      above in lectio's own data. colitur cannot preserve a distinction lectio
      doesn't make, so this becomes "ef-christmas-1-<weekday>" -- a
-     colitur-only key and a lectionary gap for the Plan 3 bootstrap to fill,
-     exactly like the Nativity vigil and octave-day keys above.
+     colitur-only key and a lectionary gap for the Plan 4 bootstrap to fill
+     (CORRECTED, final fix wave, item 7: the lectionary bootstrap is Plan 4,
+     not Plan 3 -- see Slug.ml's own corrected comment), exactly like the
+     Nativity vigil and octave-day keys above.
    - 7-13 Jan, split in two by the *actual* first-Sunday-after-Epiphany
      origin ([week_origin Time_after_epiphany], which by construction always
      falls somewhere in this window -- see that function's own comment):
@@ -253,18 +277,30 @@ let id = "ef"
 
 (* The third Sunday of September: the Ember week's anchor.
 
-   This specific date-derivation rule is one of the more contested points in
-   the 1962 calendar: pre-1955 practice tied the September Ember days to the
-   week following the Exaltation of the Holy Cross (14 Sept) instead. The two
-   rules only disagree when 1 September is a Monday -- 2025 is such a year --
-   and the primary-source scan available to this project does not contain an
-   explicit numbered-paragraph statement of either rule (searched; see
-   register §3 "Ember days"), so this citation is deliberately left at the
-   rank rules only (RG 91 entries 18/22, cited on [ember] below), not the
-   date-derivation rule itself: a wrong citation is worse than none.
-   Empirically: for 2025 this rule gives 24/26/27 September, confirmed
-   against an independent oracle; the Holy-Cross rule would give 17/19/20
-   September instead. See register §3 for the full note. *)
+   [cited] PRIMARY-SOURCE-VERIFIED (register §3a): MR1962, "De anno et eius
+   partibus", under the heading "Quatuor Tempora" (not a numbered RG
+   paragraph, which is why an earlier paragraph-number search missed it):
+
+     "Quatuor Tempora celebrantur quarta et sexta feria ac sabbato post
+     tertiam dominicam Adventus, post primam dominicam Quadragesimae, post
+     dominicam Pentecostes, post dominicam tertiam septembris."
+
+   -- the Ember Days are kept on the Wednesday, Friday and Saturday after
+   Advent III, after Lent I, after Pentecost, [and] after the third Sunday
+   of September -- confirming all four of this module's anchors, including
+   this specific contested one. This specific date-derivation rule was one
+   of the more contested points in the 1962 calendar: pre-1955 practice
+   tied the September Ember days to the week following the Exaltation of
+   the Holy Cross (14 Sept) instead. The two rules only disagree when 1
+   September is a Monday -- 2025 is such a year, and confirms the
+   third-Sunday reading empirically too (24/26/27 September against an
+   independent oracle, vs the Holy-Cross rule's 17/19/20). An earlier
+   version of this comment said the scan contained no numbered-paragraph
+   statement of either rule and left the citation at the rank rules only
+   (RG 91 entries 18/22) -- WRONG, corrected once the nominative heading
+   "Quatuor Tempora" was found rather than the genitive "Quatuor Temporum"
+   the original search used; register §3a records the correction, because a
+   false "not in the source" note is worse than no note. *)
 let third_sunday_of_september y =
   let sep1 = mk y 9 1 in
   let first_sunday = Date.add_days sep1 ((7 - weekday_index sep1) mod 7) in
@@ -278,8 +314,10 @@ let third_sunday_of_september y =
    The September and Advent sets match lectio's own Ember slugs. The Lent and
    Whitsun (Pentecost) sets do not -- lectio has no Ember slug for either, so
    "ef-lent-ember-*" and "ef-pentecost-ember-*" are colitur-only keys and a
-   lectionary gap for the Plan 3 bootstrap to fill (spec §4.4), the same
-   status as the Nativity vigil and the Rogation days below. *)
+   lectionary gap for the Plan 4 bootstrap to fill (spec §4.4; CORRECTED,
+   final fix wave, item 7 -- Plan 4, not Plan 3, is the lectionary
+   bootstrap), the same status as the Nativity vigil and the Rogation days
+   below. *)
 let ember d =
   let y = Date.year d in
   let easter = Computus.gregorian_easter y in
@@ -302,25 +340,38 @@ let ember d =
 
 (* RG 91 entry 7: Ash Wednesday (named above) and Monday-Wednesday of Holy
    Week are I-class ferias -- the primary text reads "feria IV cinerum et II,
-   III et IV Hebdomadae sanctae", i.e. explicitly stops at Wednesday. Thursday
-   to Saturday of Holy Week are the Sacred Triduum, RG 91 entry 2 -- ranked
-   even above entry 7, not a mere feria -- but their own named offices are a
-   Plan 3 sanctoral addition; until then this gives them the same I-class rank
-   via the generic ferial path. RG 91 entry 10: the weekdays within the
-   privileged Octaves of Easter and Pentecost are I class too. *)
+   III et IV Hebdomadae sanctae", i.e. explicitly stops at Wednesday
+   (PRIMARY-SOURCE-VERIFIED, final fix wave: confirmed word for word
+   against the scan). Thursday to Saturday of Holy Week are the Sacred
+   Triduum, RG 91 entry 2 -- ranked even above entry 7, not a mere feria --
+   but the Sacred Triduum has NO PROPER OFFICE of its own in this codebase
+   (CORRECTED, final fix wave, item 7: this comment previously said their
+   "own named offices are a Plan 3 sanctoral addition"; WRONG on two
+   counts -- Plan 3 shipped, in this branch, without adding them, AND a
+   proper office for I-class FERIAS was never a sanctoral matter to begin
+   with, RG 21's own definition of "feria" excludes Sundays/feasts, not the
+   other way round). `Temporal_ef.temporal 2026-04-02/03/04` (Holy
+   Thursday/Good Friday/Holy Saturday) still resolve today to the ordinary
+   Passiontide ferial fallback's own generic slugs,
+   "ef-passiontide-2-{thursday,friday,saturday}" -- register §6 records
+   this as its own open item now. This gives them the same I-class rank
+   via the generic ferial path regardless. RG 91 entry 10: the weekdays
+   within the privileged Octaves of Easter and Pentecost are I class too. *)
 let privileged_feria d =
   let easter = Computus.gregorian_easter (Date.year d) in
   let n = days_between easter d in
   (n >= -6 && n <= -1) || (n >= 1 && n <= 6) || (n >= 50 && n <= 55)
 
 (* RG 117 enumerates the five colours (white, red, green, violet, black);
-   RG 127 assigns green and RG 128 violet to the seasons de Tempore below.
-   White's own specific paragraph (the "B) De colore albo" section, between
-   117 and 123) was not pinned by the primary-source search available here --
-   left uncited rather than guessed; see register §3 "Colours". *)
+   RG 127 assigns green and RG 128 violet to the seasons de Tempore below. RG
+   119 (register §3b, primary-source-verified 2026-08-11 -- this comment was
+   stale until Task 16 noticed the correction had not been copied down here):
+   white "a festo Nativitatis Domini usque ad expletum tempus Epiphaniae"
+   and "a Missa Vigiliae paschalis usque ad Missam vigiliae Pentecostis
+   exclusive" -- exactly Christmastide and Paschaltide below. *)
 let season_colour = function
   | Advent | Septuagesima | Lent | Passiontide -> Colour.Violet (* RG 128 *)
-  | Christmastide | Paschaltide -> Colour.White
+  | Christmastide | Paschaltide -> Colour.White (* RG 119 *)
   | Time_after_epiphany | Time_after_pentecost -> Colour.Green (* RG 127 *)
 
 (* Gaudete (Advent III) and Laetare (Lent IV) are rose: RG 131, "may be used...
@@ -365,16 +416,27 @@ let temporal d =
   | None -> (
       (* Rogations (the Minor Litanies only -- RG 87, Monday and Tuesday
          before Ascension). The Major Litanies (25 April, RG 80) are a fixed
-         date and are not yet computed; they arrive with Plan 3's sanctoral
-         (register §6). The Wednesday here is the Ascension vigil (see Task
-         11). RG 88: "de Litaniis minoribus nihil fit in Officio" -- the
-         Office (hence the day's rank) is unchanged by the Rogation; only the
-         Mass is proper. No RG 91 table entry elevates these days, so they
+         date and are STILL not computed (CORRECTED, final fix wave, item 7:
+         this comment previously said "they arrive with Plan 3's sanctoral"
+         -- Plan 3 shipped, in this branch, without them; register §6 tracks
+         this as a plain open item, with no plan committed to build it yet).
+         The Wednesday here is the Ascension vigil (see Task 11), which
+         happens to also fall on Rogation Wednesday -- the vigil (higher
+         RG 91 entry) is what [named] emits for that date; the Rogation
+         Wednesday's own commemoration is not separately constructed (a real
+         gap, not a forward dependency: the precedence framework and RG
+         108-111 both exist now, but nothing wires a Rogation-Wednesday
+         candidate into the contest for this specific date the way Monday
+         and Tuesday get one below). RG 88: "de Litaniis minoribus nihil fit
+         in Officio" -- the Office (hence the day's rank) is unchanged by
+         the Rogation; only the Mass is proper. No RG 91 table entry
+         elevates these days, so they
          take the ordinary ferial rank of their season via [ferial_rank]
          rather than a fixed class. lectio has no Rogation slug at all, so
          "ef-rogation-monday"/"-tuesday" are colitur-only keys and a
-         lectionary gap for Plan 3, like the Ember and Nativity-vigil keys
-         above. *)
+         lectionary gap for Plan 4 (CORRECTED, final fix wave, item 7 --
+         the lectionary bootstrap is Plan 4, not Plan 3), like the Ember
+         and Nativity-vigil keys above. *)
       let rogation = days_between easter d in
       if rogation = 36 || rogation = 37 then
         build ~season:s
@@ -411,6 +473,34 @@ let temporal d =
                       let colour =
                         (* The Pentecost octave weekdays are red, not Paschaltide's white. *)
                         if days_between easter d >= 50 && days_between easter d <= 55 then Colour.Red
+                          (* RG 128(b) (docs/research/rules-register.md §3b), primary
+                             text: "...a dominica in Septuagesima usque ad Vigiliam
+                             paschalem, EXCEPTIS: ... MISSA SIVE CHRISMATIS SIVE IN
+                             CENA DOMINI FERIA V HEBDOMADAE SANCTAE; ..." -- violet
+                             runs Septuagesima to the Easter Vigil EXCEPT (among
+                             others) "the Mass, whether of the Chrism or in Cena
+                             Domini [Holy Thursday], on Thursday of Holy Week" --
+                             named as a WHOLE-MASS exception (unlike Palm Sunday's
+                             "blessing and procession of palms", which the SAME
+                             sentence carves out as only PART of that day, register
+                             §3b's own RG126 note on the not-yet-modelled per-action
+                             nuance), so this is a clean whole-day colour fact, not
+                             a per-action one the day/colour model cannot express.
+                             RG 122, fix round 1 (F9), states the same fact
+                             affirmatively rather than as an exception to RG 128's
+                             violet: "Demum adhibetur color albus, feria V
+                             Hebdomadae sanctae, in Missa Chrismatis et in Missa in
+                             Cena Domini" -- white is used, finally [among the
+                             White section's own list], on Thursday of Holy Week,
+                             in the Mass of Chrism and in the Mass in Cena Domini.
+                             Task 16, found via the missalemeum oracle comparison:
+                             every other Triduum day's oracle colour SET includes
+                             violet as one option (Good Friday "bv", Holy Saturday
+                             "vw" -- RG 132's black is a separate, ALREADY-flagged
+                             gap, register §3b, not touched here), but Holy
+                             Thursday's is white ALONE -- confirming this specific
+                             day, and only this one, needs the exception coded. *)
+                        else if days_between easter d = -3 then Colour.White
                         else season_colour s
                       in
                       let week_n = week d in
diff --git a/lib/rites/rite_ef/vocab_ef.ml b/lib/rites/rite_ef/vocab_ef.ml
index 13e7309..e5726e8 100644
--- a/lib/rites/rite_ef/vocab_ef.ml
+++ b/lib/rites/rite_ef/vocab_ef.ml
@@ -45,7 +45,10 @@ let season_of_string = function
 
 (* Deliberately NOT season_to_string: slugs are lectionary keys adopted verbatim
    from lectio, which names these two seasons differently. Changing these words
-   would silently break the Plan 3 lectionary bootstrap. *)
+   would silently break the Plan 4 lectionary bootstrap (CORRECTED, final fix
+   wave, item 7 -- see Slug.ml's own corrected comment for the Plan 3/4
+   distinction: the sanctoral bootstrap these slugs already serve is Plan 3
+   and shipped; the lectionary/reading-citations bootstrap is Plan 4). *)
 let season_slug_word = function
   | Christmastide -> "christmas"
   | Paschaltide -> "easter"