path: root/test/test_oracle.ml

(* Task 16: oracle harness vs missalemeum (sibling project's snapshot of
   missalemeum.com/Divinum Officium data), EF only, 2026-2027 -- validation
   layer 4 of the design spec's five (colitur CLAUDE.md "Validation" section;
   layer 3, the lectio differential, is test_differential.ml, already green).

   *** WIP, 2026-08-13, branch ef-rg112-rg110: this file is EXPECTED RED
   right now. [Observed_identity_mismatch]/[Observed_identity_unresolved]
   (below) are new -- this layer used to compare the observed day's rank and
   colour and stop there, never whether it is actually the RIGHT day (Holy
   Family, 11 January 2026, is rank 2/white on both sides purely by
   coincidence -- an ordinary unnamed Sunday and Holy Family share both).
   Landing the strengthened comparator FIRST, red, before touching any
   production code, is the point: it is the regression net the rest of this
   task's fix commits are checked against, not a change bundled in alongside
   the fix. The very next commits make it green again (data/ef/expected-
   divergences-missalemeum.sexp's own M-series entries below, and this
   file's own [layer_m_reason] widening) -- see that file and
   docs/research/rules-register.md for the running account.

   *** WHY THIS LAYER EXISTS, AND WHAT IT CAN DO THAT THE LECTIO DIFFERENTIAL
   CANNOT (test_differential.ml's own header comment, limit 1) ***

   The lectio differential compares colitur against data colitur was itself
   BOOTSTRAPPED from (data/ef/sanctoral.sexp comes from lectio's tridentine-
   calendar.ini) -- it cannot catch an error inherited from that bootstrap,
   and it explicitly does not compare commemorations at all (lectio's
   trailing tokens are losing candidates, not an RG 111 admitted set, per
   that file's own limit 1). missalemeum is INDEPENDENT of colitur's
   bootstrap chain, and its JSON carries a real admitted-commemorations
   array (its own RG 111-shaped selection, not lectio's rejects) -- so this
   file compares axes the lectio differential cannot touch at all: rank,
   colour (as SET membership, see below), commemoration presence, count,
   and (CORRECTED 2026-08-12, Task B, branch ef-rg16a -- see below) IDENTITY
   -- WHICH commemoration is admitted, not only how many.

   *** THE FIXTURE'S OWN SHAPE (fixtures/missalemeum-ef-2026-2027.txt,
   fixtures/missalemeum-ef-2026-2027.provenance, tools/
   extract_missalemeum_oracle.py) ***

   info.id (e.g. "sancti:01-02:1:w") encodes the PROPERS REUSED that day,
   not the day's own rank or colour -- 137 of 730 days (19%) disagree
   between the id-embedded rank and info.rank itself (task brief's own
   premise was wrong here; the brief's extraction note has been corrected).
   This file, like the extraction script, reads ONLY info.rank and
   info.colors for the DAY's own rank/colour, never parses anything out of
   info.id for that purpose.

   *** COMMEMORATION IDENTITY (added 2026-08-12, Task B, branch ef-rg16a)
   -- CORRECTING the previous header's own "deliberately NOT compared"
   claim ***

   The gap this correction closes: layer 4 used to compare commemoration
   PRESENCE and List.length ONLY -- cardinality, never identity. A reviewer
   proved this was vacuous by reversing admit's own dignity/precedence sort
   (Rite_ef.Precedence_ef, so the engine admits the WORST candidate, an
   outright RG 111 violation) and finding every assertion in this file
   still green across all 730 days (see the perturbation record in the task
   report, reproduced and reverted, not left in the tree). This file now
   also compares WHICH commemoration is admitted, using two independent
   signals from missalemeum's own JSON: the commemoration's title text
   (English, exact string) and, for a sancti-origin commemoration, its own
   [id]'s embedded rank digit (used only as a corroborating check, never as
   the primary signal -- see [Comm_identity] below).

   THE MAPPING, AND EXACTLY WHAT IT CANNOT RESOLVE: missalemeum identifies
   a commemoration by an English TITLE string; colitur identifies one by a
   SLUG. There is no hand-built slug<->title lookup table here -- colitur's
   own {!Celebration.t}.names already carries an English name for every
   SANCTORAL-origin celebration (bootstrapped from lectio's own English
   titles, which verifiably match missalemeum's titles character-for-
   character on every checked row), so the comparison reads that name
   directly off colitur's own resolved output, the same field
   test_differential.ml already treats as authoritative for OF/EF display
   text. This resolves identity for every SANCTORAL-origin commemoration.
   It CANNOT resolve a TEMPORAL-origin commemoration (an impeded feria, a
   privileged Sunday, an Ember/Rogation day, etc.): {!Rite_ef.Temporal_ef}'s
   own [build] never sets a celebration's [names] field (rite_ef/
   temporal_ef.ml has no [en "..."] string anywhere in it), so every such
   candidate's own title is empty on colitur's side -- there is nothing to
   compare against missalemeum's title text, and no principled way to
   invent one without duplicating missalemeum's own English-prose
   convention ("Feria III after the I Sunday of Lent") as a second,
   unverified source of truth. THIS CASE IS NEVER SILENTLY SKIPPED: see
   [Comm_identity_unresolved] below -- it is counted, reported, and must be
   named in the allow-list like any other difference, exactly the discipline
   the brief demands ("a day whose commemoration cannot be matched must be
   visibly counted and reported, not quietly passed").

   Identity is only even ATTEMPTED once presence and count already agree
   (both non-empty, same length) -- a cardinality mismatch is already
   [Comm_presence]/[Comm_count]'s own business (see [diff_fields] below),
   and comparing SETS of different size would just restate that mismatch
   under a third name, not add information. Compared as a SORTED MULTISET
   of titles, not a sequence: missalemeum's own [commemorations] array order
   is not independently verified against RG 113's own "commemoratio de
   Tempore fit primo loco" ordering rule here, so this axis proves WHICH
   commemorations are admitted, not what order they are listed in.

   info.colors is an ARRAY -- 14 of 730 days carry two colours (rose+violet
   on Gaudete/Laetare per RG 131's indult, red+violet on Palm Sunday, black+
   violet on Good Friday, violet+white on Holy Saturday -- one colour per
   liturgical ACTION within that one civil day, which colitur's one-colour-
   per-day model cannot represent, register §3b's own RG 126 note). So the
   colour axis below is MEMBERSHIP (colitur's single colour must be one of
   the oracle's set), never equality.

   Four days carry more than one Mass in the JSON array (Christmas, All
   Souls) -- the extraction script takes entry[0] throughout, VERIFIED
   (not assumed) identical to every other Mass of the same day on every
   field this file reads (see that script's own header and the task
   report).

   *** THE ALLOW-LIST (data/ef/expected-divergences-missalemeum.sexp) ***

   A SEPARATE file from data/ef/expected-divergences.sexp (the lectio
   allow-list): the two oracles disagree with colitur in different places
   and for different reasons, and this file's own convention differs in one
   deliberate way -- [verdict] is not always "colitur". Some entries are
   genuine DATA GAPS this task found and could not fix here (data/ef/
   sanctoral.sexp is bootstrapped from lectio, which is itself missing the
   entries; RG 110's inseparable-Peter/Paul commemoration is unimplemented
   code, a real feature this task did not build) -- honestly verdicted
   [missalemeum] (colitur is short a feature or a row, not right), never
   silently absorbed as if colitur were correct. TWO entries (M11 and M13)
   are [verdict open] -- CORRECTED, final fix wave, item 7: this comment
   previously said "one entry (M13)", missing M11, whose own verdict was
   changed from [colitur] to [open] in fix round 1 (see M11's own entry
   below for why) but this summary was never updated to match. Task B
   (branch ef-rg16a) briefly added a THIRD, M17 (the same-band tie-break
   between Maurice and Thomas of Villanova, 22 September) -- CORRECTED,
   fix round 1 of that same task: M17 was itself wrong. The "tie" was
   manufactured by {!Precedence_ef.band} lending a [Commemoration_only]
   candidate the same table entry as a genuine [Feast] of its own rank
   (RG 91's table has no row for a bare commemoration at all -- fixed in
   [band] itself, not here); once fixed, 22 September resolves cleanly on
   both sides and M17 was deleted, not merely re-adjudicated. ONE entry
   (M15) carries its own fourth verdict, [unresolvable] -- not a rubric
   dispute or a data gap either engine is wrong about, but a LIMIT of this
   comparator itself (see M15's own entry). All remaining OPEN entries are
   adjudicated as unresolved/unresolvable, not resolved either way -- the
   brief's own explicit permission ("say so as an open item") used for real,
   not
   defaulted past. See the task report for every entry's full
   reasoning and primary-source citation. *)

module Cal = Colitur_kernel.Calendar
module Layer = Colitur_kernel.Layer
module Overlay = Colitur_kernel.Overlay
module LD = Colitur_kernel.Liturgical_day
module Slug = Colitur_kernel.Slug
module Date = Colitur_kernel.Date
module Cel = Colitur_kernel.Celebration
module Colour = Colitur_kernel.Colour
module Names = Colitur_kernel.Names
module Lang = Colitur_kernel.Lang
module V = Rite_ef.Vocab_ef

(* Same relative paths test_differential.ml uses: dune test runs from
   _build/default/test/. *)
let sanctoral_path = "../data/ef/sanctoral.sexp"
let adjustments_path = "../data/ef/adjustments.sexp"
let fixture_path = "fixtures/missalemeum-ef-2026-2027.txt"
let allow_list_path = "../data/ef/expected-divergences-missalemeum.sexp"

(* fixtures/missalemeum-ef-2026-2027.provenance carries the same digest and
   the exact regeneration command. Asserted (not merely documented) for the
   same reason test_differential.ml's own [fixture_sha256] is: a hand-edit
   or partial re-extraction would otherwise silently turn the oracle into
   an unlabelled snapshot of whatever someone last ran. *)
(* CORRECTED 2026-08-12, Task B (branch ef-rg16a): field 9
   (commemoration_ids) appended to the fixture (tools/
   extract_missalemeum_oracle.py's own header) so this file can compare
   commemoration IDENTITY, not merely presence/count -- see this file's own
   header comment, rewritten below. Regenerated from the SAME underlying
   snapshot (fixtures/missalemeum-ef-2026-2027.provenance: still lectio
   commit d7da4b0, re-verified, first 8 fields byte-identical) -- only field
   9 is new content, so this digest changes but the fixture's own data does
   not. *)
let fixture_sha256 = "4162e79d7a0bc03b81a34ce6cd3b074e2d32570217759bc3b4058ada75ea8781"

(* Identical technique to test_differential.ml's own [sha256_of_file]
   (that file's own comment explains why: shelling out to [sha256sum]
   rather than adding a crypto library dependency Task 15/16's frozen deps
   do not include). Duplicated, not shared, for the same reason
   [real_layer] below is -- neither file exposes an .mli the other could
   depend on, and this is three lines. *)
let sha256_of_file path =
  let tmp = Filename.temp_file "colitur_oracle_sha256" ".txt" in
  Fun.protect
    ~finally:(fun () -> try Sys.remove tmp with Sys_error _ -> ())
    (fun () ->
      let cmd = Printf.sprintf "sha256sum %s > %s" (Filename.quote path) (Filename.quote tmp) in
      let rc = Sys.command cmd in
      if rc <> 0 then Alcotest.failf "sha256sum exited %d for %s (is it on PATH?)" rc path;
      let ic = open_in tmp in
      let line =
        try input_line ic
        with End_of_file ->
          close_in ic;
          Alcotest.failf "sha256sum produced no output for %s" path
      in
      close_in ic;
      match String.index_opt line ' ' with
      | Some i -> String.sub line 0 i
      | None -> Alcotest.failf "unexpected sha256sum output for %s: %S" path line)

let real_layer () =
  let layer =
    match Layer.load V.rank_of_sexp sanctoral_path with
    | Ok l -> l
    | Error e -> Alcotest.failf "%s: failed to load: %s" sanctoral_path e
  in
  let overlay =
    match Overlay.load V.rank_of_sexp adjustments_path with
    | Ok o -> o
    | Error e -> Alcotest.failf "%s: failed to load: %s" adjustments_path e
  in
  let layer, diagnostics = Overlay.apply layer overlay in
  Alcotest.(check (list string)) "the committed overlay applies cleanly, no diagnostics" []
    (List.map Overlay.diagnostic_to_string diagnostics);
  layer

(* [Rite_ef.context] takes [~lectionary] (fix round 1, coordinator review) --
   caller-supplied, same as [real_layer] above. *)
let real_lectionary () =
  match Colitur_kernel.Lectionary.load "../data/ef/lectionary.sexp" with
  | Ok l -> l
  | Error e -> Alcotest.failf "../data/ef/lectionary.sexp: failed to load: %s" e

(* ---------------------------------------------------------------------- *)
(* The oracle side: one line per day, as tools/extract_missalemeum_oracle  *)
(* .py's own header documents.                                            *)
(* ---------------------------------------------------------------------- *)

type oracle_row = {
  o_date : string;
  o_rank : int;
  o_colours : char list;
  o_title : string;
  o_commemorations : string list;
  o_commemoration_ids : string list;  (** parallel to [o_commemorations], see field 9's own doc above *)
  o_displaced : string list;
}

let explode s = List.init (String.length s) (String.get s)

let split_list_field f = if f = "-" then [] else String.split_on_char ';' f

(* A commemoration id's own trailing "rank" field, e.g. "sancti:01-05:4:r" ->
   [Some 4] -- the SECOND, corroborating identity signal this file's own
   header describes (test_identity_rank_corroboration, near the bottom of
   this file). [None] for any id that does not have exactly 4 ':'-separated
   parts (defensive; every id checked so far does). *)
let id_rank id =
  match String.split_on_char ':' id with [ _; _; rank; _ ] -> int_of_string_opt rank | _ -> None

let is_sancti_id id = String.length id >= 7 && String.sub id 0 7 = "sancti:"

let oracle_row_of_line line =
  match String.split_on_char '|' line with
  | [ date; rank; colours; title; _tempora; commemorations; displaced; _n_masses; commemoration_ids ] ->
      { o_date = date;
        o_rank = int_of_string rank;
        o_colours = explode colours;
        o_title = title;
        o_commemorations = split_list_field commemorations;
        o_commemoration_ids = split_list_field commemoration_ids;
        o_displaced = split_list_field displaced }
  | _ -> Alcotest.failf "malformed fixture line (expected 9 '|'-separated fields): %S" line

let read_lines path =
  let ic = open_in path in
  let rec loop acc =
    match input_line ic with
    | line -> loop (line :: acc)
    | exception End_of_file ->
        close_in ic;
        List.rev acc
  in
  loop []

let oracle_rows () = List.map oracle_row_of_line (read_lines fixture_path)

(* ---------------------------------------------------------------------- *)
(* The colitur side: the SAME pipeline bin/main.ml's `colitur day` and     *)
(* test_differential.ml's own [colitur_rows_2005_2050] use --              *)
(* Colitur_kernel.Calendar over the real committed data. Restricted to     *)
(* 2026-2027 (indexing 2025 too, for the same reason test_differential.ml  *)
(* indexes [y-1]: Calendar.year resolves one Advent-anchored liturgical    *)
(* year, which straddles two civil years). *)
(* ---------------------------------------------------------------------- *)

(* [c_commemorations]: one entry per admitted commemoration, carrying its
   own slug, RG 8 rank, STATUS, AND its English name if colitur's own
   {!Celebration.t}.names has one -- [None] for a TEMPORAL-origin
   candidate, which [Rite_ef.Temporal_ef] never names (this file's own
   header, "THE MAPPING, AND EXACTLY WHAT IT CANNOT RESOLVE"). The [None]
   case is what [Comm_identity_unresolved] below reads; [status] is read by
   [test_identity_rank_corroboration]'s own scope guard, see its comment. *)
type colitur_row = {
  c_date : string;
  c_rank : int;
  c_colour : char;
  c_observed_slug : string;
  c_observed_name : string option;
      (** colitur's own resolved English name for the OBSERVED celebration --
          [None] for a TEMPORAL-origin day (an ordinary Sunday, a feria, a
          movable named feast: {!Rite_ef.Temporal_ef}'s own [build] never
          sets [names], the SAME gap this file's header already documents
          for commemorations, see [Comm_identity_unresolved]), the same
          [Names.find ... en] read [c_commemorations] below already uses,
          applied to [LD.observed] instead of a commemoration candidate. *)
  c_commemorations : (string * int * Cel.status * string option) list;
      (** slug, rank, status, English name *)
}

let rank_to_int = function V.Class1 -> 1 | V.Class2 -> 2 | V.Class3 -> 3 | V.Class4 -> 4

let colour_to_char = function
  | Colour.White -> 'w'
  | Colour.Red -> 'r'
  | Colour.Green -> 'g'
  | Colour.Violet -> 'v'
  | Colour.Rose -> 'p'
  | Colour.Black -> 'b'

let en = Lang.of_string_exn "en"

let colitur_rows_2026_2027 () =
  let layer = real_layer () in
  let rite = Rite_ef.context ~lectionary:(real_lectionary ()) in
  let by_rata : (int, (V.season, V.rank) LD.t) Hashtbl.t = Hashtbl.create 800 in
  for y = 2025 to 2027 do
    let days = Cal.year rite layer y in
    Array.iter (fun (d : (V.season, V.rank) LD.t) -> Hashtbl.replace by_rata (Date.to_rata d.LD.date) d) days
  done;
  let mk y m d = match Date.make ~year:y ~month:m ~day:d with Ok t -> t | Error e -> failwith e in
  let rows = ref [] in
  let d = ref (mk 2026 1 1) in
  let stop = mk 2027 12 31 in
  while Date.compare !d stop <= 0 do
    (match Hashtbl.find_opt by_rata (Date.to_rata !d) with
    | Some day ->
        let cel = day.LD.observed in
        let commemorations =
          List.map
            (fun (c, _) ->
              (Slug.to_string c.Cel.slug, rank_to_int c.Cel.rank, c.Cel.status, Names.find c.Cel.names en))
            day.LD.commemorations
        in
        rows :=
          { c_date = Date.to_iso8601 day.LD.date;
            c_rank = rank_to_int cel.Cel.rank;
            c_colour = colour_to_char cel.Cel.colour;
            c_observed_slug = Slug.to_string cel.Cel.slug;
            c_observed_name = Names.find cel.Cel.names en;
            c_commemorations = commemorations
          }
          :: !rows
    | None -> Alcotest.failf "internal error: no resolved day for %s" (Date.to_iso8601 !d));
    d := Date.add_days !d 1
  done;
  List.rev !rows

(* ---------------------------------------------------------------------- *)
(* Field-diff computation: the axes the oracle supports, RANK/COLOUR/      *)
(* PRESENCE/COUNT as before, plus (Task B) IDENTITY -- see this file's own *)
(* header for the mapping and its exact limits. *)
(* ---------------------------------------------------------------------- *)

type field =
  | Rank
  | Colour_f
  | Comm_presence
  | Comm_count
  | Comm_identity_mismatch
  | Comm_identity_unresolved
  | Observed_identity_mismatch
  | Observed_identity_unresolved

let field_name = function
  | Rank -> "rank"
  | Colour_f -> "colour"
  | Comm_presence -> "commemoration-presence"
  | Comm_count -> "commemoration-count"
  | Comm_identity_mismatch -> "commemoration-identity-mismatch"
  | Comm_identity_unresolved -> "commemoration-identity-unresolved"
  | Observed_identity_mismatch -> "observed-identity-mismatch"
  | Observed_identity_unresolved -> "observed-identity-unresolved"

(* CORRECTING the gap this file's own header names (added under this task,
   branch ef-rg112-rg110): the axes above all compare the day's OBSERVED
   celebration's rank and colour ([Rank]/[Colour_f]) and the admitted
   COMMEMORATIONS' identity ([Comm_identity_*]) -- nothing until now compared
   the OBSERVED celebration's own identity, WHICH day is actually being kept,
   only what class/colour it happens to carry. Holy Family (11 January 2026:
   oracle title "The Holy Family: Jesus, Mary & Joseph", colitur's own
   observed slug the plain "ef-time-after-epiphany-sunday-1", BOTH rank 2 and
   colour white on both sides) is exactly the shape this axis exists to
   catch -- rank and colour already agreed by coincidence (an ordinary,
   unnamed II-class Sunday and Holy Family share both), so nothing above
   ever saw a difference. Same mapping and the same honesty about its limit
   as [identity_diff] just above: colitur identifies a day by SLUG,
   missalemeum by an English TITLE string, and the bridge is
   {!Celebration.t}.names, read directly off [LD.observed] by
   [colitur_rows_2026_2027] into [c_observed_name] -- resolvable for a
   SANCTORAL-origin observed day (a saint's feast winning the day outright),
   NEVER for a TEMPORAL-origin one (an ordinary Sunday, a feria, a movable
   named feast -- {!Rite_ef.Temporal_ef}'s own [build] never sets [names]).
   [Observed_identity_unresolved] is that TEMPORAL-origin case: counted and
   reported, never silently skipped, the same discipline
   [Comm_identity_unresolved] already established and the brief demands
   again here ("a day whose observed identity cannot be resolved must be a
   counted, allow-listed outcome, never a silent skip"). Unlike commemoration
   identity, this axis needs no presence/count gate first -- there is always
   exactly one observed day on each side, no list-length ambiguity to
   resolve before a title comparison is even meaningful. *)
let observed_identity_diff (c : colitur_row) (o : oracle_row) =
  match c.c_observed_name with
  | None -> Some Observed_identity_unresolved
  | Some name -> if String.equal name o.o_title then None else Some Observed_identity_mismatch

(* Identity (Task B): only even attempted once presence AND count already
   agree (both non-empty, same length) -- see this file's own header,
   "Identity is only even ATTEMPTED...". Two outcomes beyond a clean match:
   [Comm_identity_unresolved] when ANY of colitur's own admitted
   commemorations carries no English name to compare (a TEMPORAL-origin
   candidate -- counted and reported, never silently skipped, per the
   brief); [Comm_identity_mismatch] when every name IS resolvable but the
   SORTED MULTISET of titles still disagrees with missalemeum's own. *)
let identity_diff (c : colitur_row) (o : oracle_row) =
  let c_has = c.c_commemorations <> [] and o_has = o.o_commemorations <> [] in
  if not (c_has && o_has) || List.length c.c_commemorations <> List.length o.o_commemorations then None
  else
    let unresolved = List.exists (fun (_, _, _, name) -> name = None) c.c_commemorations in
    if unresolved then Some Comm_identity_unresolved
    else
      let c_titles = List.sort compare (List.filter_map (fun (_, _, _, n) -> n) c.c_commemorations) in
      let o_titles = List.sort compare o.o_commemorations in
      if c_titles = o_titles then None else Some Comm_identity_mismatch

let diff_fields (c : colitur_row) (o : oracle_row) =
  let c_has = c.c_commemorations <> [] and o_has = o.o_commemorations <> [] in
  List.filter_map
    (fun x -> x)
    [ (if c.c_rank = o.o_rank then None else Some Rank);
      (if List.mem c.c_colour o.o_colours then None else Some Colour_f);
      (if c_has = o_has then None else Some Comm_presence);
      (* Count is only meaningful once presence already agrees (both non-empty):
         a presence mismatch already flags the row via [Comm_presence] above,
         and comparing lengths across a 0-vs-N split would just restate that
         same disagreement under a second name. *)
      (if c_has && o_has && List.length c.c_commemorations <> List.length o.o_commemorations then
         Some Comm_count
       else None);
      identity_diff c o;
      observed_identity_diff c o
    ]

(* ---------------------------------------------------------------------- *)
(* The cited allow-list (data/ef/expected-divergences-missalemeum.sexp).  *)
(* Each predicate is gated on an EXACT, literal date set (never a date    *)
(* range or a slug pattern -- with at most 4 dates per id, a literal list *)
(* costs nothing and cannot silently widen to absorb an unrelated future  *)
(* mismatch the way a range could), AND an exact/subset diff shape, the   *)
(* same double-gate test_differential.ml's own [layer_c_reason] uses.     *)
(* ---------------------------------------------------------------------- *)

let subset xs ys = List.for_all (fun x -> List.mem x ys) xs

let contains_substring s ~needle =
  let ls = String.length s and ln = String.length needle in
  let rec at i = i + ln <= ls && (String.sub s i ln = needle || at (i + 1)) in
  ln = 0 || at 0

(* M1 -- RG 33 (corrected, precedence_ef.ml's own [is_omissible_vigil]):
   missalemeum does not implement RG 33's mandatory omission of a II/III-
   class vigil impeded by a Sunday -- 28 June 2026 (Vigil of Sts Peter &
   Paul, II class) still shows a commemoration of the vigil on the V Sunday
   after Pentecost; 9 August 2026 (Vigil of St Lawrence, III class) shows
   the vigil as the day's FULL OBSERVED OFFICE, not merely a commemoration,
   displacing the XI Sunday after Pentecost entirely. Both wrong per RG 33's
   own "in dominica quavis" (ANY Sunday, unqualified) -- verdict colitur. *)
let m1_dates = [ "2026-06-28"; "2026-08-09" ]

(* M2 -- CLOSED, REMOVED (ef-bvm-saturday task), same shape as M12/M17's own
   removal elsewhere in this suite (not re-adjudicated to a different
   verdict, gone because the underlying divergence stopped occurring): RG 91
   entry 27 ("Officium sanctae Mariae in sabbato") is now built
   (Rite_ef.Temporal_ef's own [bvm_saturday_names] citation has the full RG
   78/RG 120(b) argument) -- white, unconditionally, on every otherwise-
   unoccupied IV-class Saturday, so [Colour_f] no longer appears in this
   predicate's own diff set on ANY of these 22 dates (checked: 0 of them
   retain it). What is left on every one of them is [Observed_identity_
   unresolved] ALONE -- colitur's own BVM-Saturday candidate is
   temporal-origin and deliberately carries no ENGLISH name (Latin only,
   the same zero-circularity discipline Holy Family/Holy Name/the Sacred
   Triduum already established) -- which is EXACTLY [M18]'s own shape
   ([diffs = [ Observed_identity_unresolved ]], nothing else disagreeing),
   not a distinct citation any more. Kept as a separate id here would have
   been the same "count proving cardinality where identity was required"
   trap this project's own review process watches for: [subset] admits a
   SMALLER diff set than the one named, so this branch would have kept
   silently absorbing these 22 rows under a stale "colour differs" citation
   even though that citation's own reason no longer fires -- checked
   directly, not assumed: removing this branch and re-running moves the
   count from M2's own former 22 to M18's own count rising by exactly 22
   (373 -> 395, see M18's own note below), with the "no unexplained
   differences" test staying green throughout. *)

(* M3 -- RG 87 (Minor Litanies/Rogations): the SAME gap the lectio
   differential's own C8 already names (data/ef/expected-divergences.sexp)
   -- missalemeum, like lectio, computes no Rogation day at all and shows
   the plain paschaltide-week feria instead. Only ONE date in this window
   shows it (3 May 2027, Rogation Monday) because every other Rogation day
   here is won by a saint anyway (both sides then agree on the SAINT's own
   identity, with only the underlying temporal identity differing, which
   this comparator's rank/colour/commemoration axes do not expose). Verdict
   colitur, same citation as lectio's own C8. *)
let m3_dates = [ "2027-05-03" ]

(* M4 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note for the
   full account (agnes-secundo now present in data/ef/sanctoral.sexp,
   sourced from lectio's independently-fixed generator; the divergence no
   longer occurs on either 2026-01-28 or 2027-01-28). *)

(* M5 -- CORRECTED (ef-major-litanies task): the Major Litanies (RG 80,
   Caput X "De Litaniis maioribus et minoribus") are now built
   (Rite_ef.Precedence_ef's own [major_litanies_slug]/[disposition]/
   [privilege_of] RG 109(f) branch/[transfer_target] RG 80 branch,
   data/ef/adjustments.sexp's matching [Add] entry). This note's own
   PRIOR text (struck below, kept for the record of what was corrected)
   claimed missalemeum's single admitted commemoration on 25 April 2027
   (the Sunday-conflict shape) was "the Major Litanies" -- CHECKED AGAINST
   THE RAW FIXTURE ROW DIRECTLY while adjudicating this task's own new
   divergence (test/fixtures/missalemeum-ef-2026-2027.txt, the 2027-04-25
   line: "...|IV Sunday after Easter|-|St. Mark|Pro rogationibus|1|
   sancti:04-25:2:r") and found BACKWARDS: missalemeum's own
   [commemorations] field for that row is "St. Mark", and "Pro
   rogationibus" (the Litanies) is the one listed in [displaced]. The
   note had the two swapped -- a genuine source-fidelity slip in this
   file's own prior authorship, not a re-reading of a primary document,
   but corrected on the same "read positively, quote it" discipline this
   project applies to the primary scans. See [M20] below for the fix
   this correction actually motivates (2027's own now-real divergence,
   colitur=Litanies vs missalemeum=Mark, adjudicated separately).

   What THIS entry (M5) still covers, unchanged in kind: 25 April 2026 (an
   ordinary, non-Sunday year -- Mark wins the day outright on both sides,
   uncontested). Both engines now admit a commemoration there (colitur:
   [major-litanies]; missalemeum: "Pro rogationibus") -- PRESENCE now
   agrees (closing the register §6 gap this entry used to track), but the
   two engines name the SAME real-world observance in different registers:
   colitur's own English descriptive name (data/ef/adjustments.sexp's own
   honestly-flagged, not-primary-sourced "The Major Litanies") against
   missalemeum's Latin-ish "Pro rogationibus" ("for the Rogations") --
   never going to match as literal strings, and not a rubric dispute at
   all (RG 80/81 do not prescribe an English title for this observance;
   this comparator's own [identity_diff] can only ever compare exact
   strings, the same declared limit [M15]/[M18] already document for
   temporal-origin candidates, now hit here for a different structural
   reason -- a real candidate on both sides, just two different
   vocabularies). Verdict colitur (the identity axis's own declared limit,
   not an error): {!m5_commemoration_matches} pins WHICH candidate colitur
   actually admits here, not merely that some [Comm_identity_mismatch]
   diff exists, the same discipline [M19]'s own identity guard already
   established. *)
let m5_dates = [ "2026-04-25" ]

let m5_commemoration_matches (c : colitur_row) =
  match c.c_commemorations with [ (slug, _, _, _) ] -> String.equal slug "major-litanies" | _ -> false

(* M20 -- ef-major-litanies task, NEW. 25 April 2027: the Sunday-conflict
   shape (RG 80's own condition -- 25 April is Easter Sunday or Monday --
   does NOT fire this year, so the Litanies stay put on 25 April itself,
   which this year happens to be an ordinary II-class Sunday, RG 91 entry
   15). St Mark (II class, RG 91 entry 16) also loses to the Sunday. Two
   losing candidates, ONE slot (RG 111(b)): colitur admits the Litanies,
   NOT Mark; missalemeum's raw fixture row shows the reverse (verified
   directly, not inferred -- see [M5]'s own corrected note above for the
   exact line).

   ADJUDICATED: verdict colitur, RG 109(f) + RG 111(b) (docs/research/
   rules-register.md §4 "Commemorations", both primary-source-verified
   word for word, all three documents): RG 109(f), Caput XVI "De
   Commemorationibus", places "de Litaniis maioribus, in Missa" in the
   SAME closed list as (a)-(e), with equal grammatical standing -- no
   textual qualifier narrows its privilege relative to theirs. RG 111(b),
   same chapter: "in dominicis II classis, una tantum admittitur
   commemoratio, scilicet de festo II classis, QUÆ TAMEN OMITTITUR SI
   COMMEMORATIO PRIVILEGIATA FACIENDA SIT" -- the II-class-feast
   commemoration is DROPPED if a privileged commemoration is due, full
   stop; the clause names no table-order qualifier ("whichever ranks
   higher"), only the categorical fact of a privileged commemoration being
   due. This is the SAME mechanism {!Precedence_ef.admit}'s [Class2, true]
   branch already implements and this project's OWN prior work already
   primary-source-verified for this exact clause (precedence_ef.ml's own
   "Fix, Task 16" comment) -- not new code, not a special case written for
   the Litanies; St Mark simply meets the same fate any other ordinary
   Class2 commemoration meets when a privileged one is also due that
   Sunday (RG 16(a)'s Transfiguration/Sixtus shape is the nearest existing
   witness, though there the privileged side wins the DAY, not merely the
   commemoration slot).

   HONESTLY FLAGGED, not overclaimed: this is the FIRST real, independent
   (non-synthetic) data point this codebase has for "an ordinary Class2
   feast candidate and a privileged non-feast commemoration candidate,
   both losing to the identical Sunday" -- every other witness for
   [admit]'s Class2-Sunday privilege-override branch in this suite's own
   test_precedence_ef.ml is hand-built (real slugs/ranks, but a
   constructed collision, not one the calendar itself produces). Read
   plainly, RG 111(b)'s text supports colitur's outcome; missalemeum's own
   divergence here is consistent with this project's ALREADY-DOCUMENTED
   pattern of RG 108-111 gaps in that oracle (M1: RG 33's Sunday omission
   not implemented; M8: RG 109(a)+RG 111(a) not implemented for an impeded
   I-class Sunday; M10: RG 109(e) inconsistently applied) -- plausibly one
   more instance of the same generator not modelling RG 109(f)'s privilege
   for this one rare, single-date observance, not evidence the general
   RG 111(b) mechanism itself is mis-read. Recorded as an adjudicated
   verdict, not a certainty: if a future primary-source pass finds
   textual grounds narrowing RG 109(f)'s privilege specifically (e.g. a
   clause this task's own scan reading did not surface), this entry is
   the one to revisit first. *)
let m20_dates = [ "2027-04-25" ]

let m20_commemoration_matches (c : colitur_row) =
  match c.c_commemorations with [ (slug, _, _, _) ] -> String.equal slug "major-litanies" | _ -> false

(* M6 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note. Eusebius
   Confessor (14 Aug) is now present in data/ef/sanctoral.sexp
   (eusebius-confessor), so the divergence no longer occurs. *)

(* M7 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note. St
   Evaristus (26 Oct) is now present in data/ef/sanctoral.sexp
   (evaristus), so the divergence no longer occurs. *)

(* M8 -- RG 109(a) ("of a Sunday" is always privileged) + RG 111(a) ("on
   I-class days... none save one privileged"): when a FIXED I-class feast
   (All Saints, 1 Nov; the Assumption, 15 Aug) lands on an ordinary Sunday,
   the impeded Sunday IS the one privileged commemoration RG 111(a) admits
   -- already an established, independently-tested rule in this codebase
   (test_precedence_ef.ml's "RG95/RG109(a): an impeded I-class SUNDAY does
   NOT transfer -- it is Commemorated and Privileged"). missalemeum shows
   no commemoration at all on either occurrence in this window. Verdict
   colitur. *)
let m8_dates = [ "2026-11-01"; "2027-08-15" ]

(* M9 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note. St
   Theodore (9 Nov) is now present in data/ef/sanctoral.sexp (theodore),
   so the divergence no longer occurs. *)

(* M14 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note. St
   Boniface Martyr (14 May) is now present in data/ef/sanctoral.sexp
   (boniface-martyr), so the divergence no longer occurs. *)

(* M10 -- RG 109(e), unqualified text ("de feriis Adventus, Quadragesimae
   et Passionis" -- OF THE FERIAS OF ADVENT, not "of the Advent ferias 17-
   23 December only"; that narrower window is RG 91 entry 18's own
   OCCURRENCE-table dignity, a different axis from RG 109's commemoration-
   privilege list, register §4's own citations keep the two separate).
   colitur commemorates the losing early-Advent feria (the Monday after
   Advent I, 30 Nov; the Tuesday/Wednesday after Advent II, 8 Dec) when a
   saint wins those days -- missalemeum shows nothing on these specific
   four rows, even though it DOES show equivalent later-Advent-feria
   commemorations elsewhere in this same window (2-21 December, matching
   colitur exactly on every one of those -- see the task report), which is
   why this reads as a missalemeum-side inconsistency on these four
   particular rows rather than a textually-narrower rule this task missed.
   Verdict colitur. *)
let m10_dates = [ "2026-11-30"; "2027-11-30"; "2026-12-08"; "2027-12-08" ]

(* M11 -- CORRECTED, fix round 1 (F3): this used to claim "no RG paragraph
   found" and verdict colitur. WRONG. RG 67 ("dies infra octavam sunt II
   classis") + RG 109(c) ("de diebus infra octavam Nativitatis Domini") +
   the calendarium's own explicit note under 26/27/28 December ("S.
   STEPHANI PROTOMARTYRIS, II classis. / Com. octavae Nativitatis.", same
   pattern for John the Evangelist and the Holy Innocents) all confirm a
   REAL commemoration is due here -- and it is a genuine regression: before
   Task 16's own commemoration-eligibility fix, colitur happened to
   commemorate the day's generic Christmastide loser unconditionally
   (matching presence, for the wrong reason); the fix (correctly) stopped
   that, but the 26-28 December window's own temporal candidate has the
   WRONG ferial rank to begin with ([ferial_rank]'s Christmastide catch-all
   gives it Class4; RG 67 says II) -- and a naive fix gets RG 69's Sunday
   case backwards (the Sunday, when this window falls on one, commemorates
   the NAMED feast, not the generic octave placeholder). Needs new
   architecture (a commemoration attached to whichever named feast wins,
   not a competing RG 92-95 candidate) or a more careful fix than this
   round attempted. Verdict now OPEN, not colitur -- see the sexp entry's
   own full note and the task report. *)
let m11_dates = [ "2026-12-26"; "2026-12-28"; "2027-12-27"; "2027-12-28" ]

(* M12 -- CLOSED (ef-holyname-rg110 task): RG 110 is now built
   (precedence_ef.ml's own [rg110_additions]/[rg110_companion_slug]), and
   this window's one visible instance -- 22 February 2027 -- no longer
   diverges from missalemeum on [Comm_count] at all: colitur now shows the
   privileged Lent feria's own commemoration AND "St. Paul", same COUNT
   (two) as missalemeum. Removed rather than kept as a dead 0-row citation,
   the SAME shape M17's own removal already established (this file's own
   header): the count pin now enforces that this exact divergence cannot
   silently reappear. NOT closed with zero remaining difference, though --
   see M15's own widened date list immediately below: once count agrees,
   IDENTITY comparison is reached for the first time on this date, and
   trips a SEPARATE, pre-existing, unrelated comparator limit (one of
   colitur's two admitted commemorations, [ef-lent-2-monday], is
   TEMPORAL-origin and carries no English name) -- a newly-exposed
   instance of M15's own gap, not a new one, folded into M15's date list
   rather than kept here under RG 110's own citation, which no longer
   explains ANY part of this row's remaining diff. *)

(* M13 -- OPEN, NOT adjudicated (the brief's own explicit permission,
   "say so as an open item rather than absorbing it"). 19 March 2027: St
   Joseph (I class, 19 March) falls on the Friday of Passion Week. The
   1962 calendarium's own March table carries a standing note, "Feria VI
   post dominicam I Passionis: Commemoratio septem Dolorum B. Mariae
   Virg." (a fixed commemoration of Our Lady's Seven Sorrows for that
   Friday, EVERY year, confirmed real) -- and missalemeum shows Joseph
   entirely DISPLACED that year, with the Friday's own office (III class,
   violet) observed and the Seven Sorrows commemorated instead. RG 91's
   plain table (entry 11-13, I-class feast, vs entry 22, an ordinary III-
   class Passiontide feria) gives Joseph the day outright, with no general
   RG 96 collision requiring a transfer -- so either (a) colitur's plain
   reading is right and missalemeum is wrong, (b) a MORE SPECIFIC rubric
   (most plausibly attached to St Joseph's own Proprium Sanctorum entry,
   the same shape as the Annunciation's own Attamen clause, register §4)
   overrides the general table for this exact collision and this task did
   not find its text, or (c) the Seven Sorrows commemoration itself
   somehow outranks an ordinary I-class feast on this one Friday, which
   nothing found here supports either. Extensive but non-exhaustive
   primary-source search (see the task report) did not settle it.
   Separately, but confirmed regardless of the adjudication above: colitur
   does not implement the Seven-Sorrows-of-Passion-Friday commemoration at
   all, in any year -- a real, primary-attested gap, register §6 open
   item. *)
let m13_dates = [ "2027-03-19" ]

(* M15 -- Task B (branch ef-rg16a), NOT a rubric dispute and NOT a data gap
   either engine is wrong about: a genuine LIMIT of this comparator, honestly
   counted rather than silently passed (the brief's own explicit
   instruction: "a day whose commemoration cannot be matched must be
   visibly counted and reported, not quietly passed"). On 19 of these 20
   rows, colitur's own admitted commemoration is TEMPORAL-origin (an
   impeded Advent/Lent feria) -- Rite_ef.Temporal_ef's own [build]
   (temporal_ef.ml) never sets a celebration's [names] field, so there is no
   English string on colitur's side to compare against missalemeum's title
   text at all (this file's own header, "THE MAPPING, AND EXACTLY WHAT IT
   CANNOT RESOLVE"). Every one of those 19 oracle titles reads as a plain
   prose description of the SAME temporal ferial slot colitur independently
   computes for that date (e.g. 2 Dec 2026: oracle "Feria IV after I Sunday
   of Advent" against colitur's own [ef-advent-1-wednesday]; 4 Dec 2027:
   oracle "Sabbato after I Sunday of Advent" against [ef-advent-1-saturday])
   -- suggestive corroboration, recorded here for a human reader, but NOT
   proof: this comparator has no mechanism to verify English prose against
   an opaque slug, so it does not claim these as verified matches, only as
   unresolved. Fixing this at the ROOT (giving every temporal-cycle
   candidate an English name) is a data/lectionary-bootstrap task, not
   something this comparator can do for itself -- register §6, "RG 113
   tie-break" section's own neighbour, records it as an open item.

   ADDED, ef-holyname-rg110 task: 2027-02-22 -- the closed M12's own date,
   above. NOT the same shape as the other 19 (colitur admits TWO
   commemorations there, not one -- [paul], sanctoral-origin and
   resolvable, and [ef-lent-2-monday], temporal-origin and not): the
   comparator's own [identity_diff] bails out to [Comm_identity_unresolved]
   the moment ANY admitted commemoration is unresolvable, regardless of how
   many others resolve cleanly (test_oracle.ml's own [identity_diff],
   "[List.exists] ... name = None"), so this row reaches the identical
   diagnosis for the identical structural reason, once RG 110 stopped
   [Comm_count] from masking it. Genuinely newly-EXPOSED by this task's own
   fix, not newly-CAUSED by it: the underlying gap (no English name for a
   temporal-cycle candidate) is exactly M15's own pre-existing one. *)
let m15_dates =
  [ "2026-02-24"; "2026-03-19"; "2026-03-25"; "2026-12-02"; "2026-12-03"; "2026-12-04";
    "2026-12-07"; "2026-12-11"; "2026-12-21"; "2027-02-22"; "2027-02-24"; "2027-12-02";
    "2027-12-03"; "2027-12-04"; "2027-12-06"; "2027-12-07"; "2027-12-11"; "2027-12-13";
    "2027-12-16"; "2027-12-21" ]

(* M16 -- Task B: a genuine IDENTITY mismatch, both sides otherwise agreeing
   on rank/colour/count/presence. 27 March 2026 (Friday of Passion Week):
   colitur admits "St. John Damascene" (a real Class3 universal feast that
   genuinely falls that day); missalemeum shows "For Our Lady of the Seven
   Sorrows" instead. The SAME standing gap M13 above already names ("the
   1962 calendarium's own March table carries... 'Feria VI post dominicam I
   Passionis: Commemoratio septem Dolorum B. Mariae Virg.'... a fixed
   commemoration... EVERY year") -- confirmed real, and confirmed
   UNIMPLEMENTED in this codebase (no candidate for it is ever constructed
   in temporal_ef.ml), so colitur has nothing to admit in the Seven
   Sorrows' place and falls back to whichever ordinary Class3 saint
   actually wins that Friday instead. Verdict missalemeum: colitur is
   missing a real, primary-cited office, not differently opinioned.
   Register §6 open item (same one M13/M16's own primary-source note
   already tracks). Only 2026 shows here -- 2027's Friday of Passion Week
   IS 19 March, M13's own date, where the identity axis cannot even be
   reached (M13's own rank/colour mismatch already excludes that day from
   count-matched identity comparison).

   NOTE for whoever builds the office (fix round 1, coordinator finding 7):
   27 March 2026 is a III-class day, where RG 111(d) admits TWO
   commemorations, not one -- yet missalemeum admits only the Seven Sorrows
   and DISPLACES John Damascene entirely (its own "displaced" list carries
   his title that day), not merely drops him to second place. Implementing
   the Seven Sorrows candidate naively (as one more ordinary III-class
   commemoration competing for the day's two slots) will not reproduce
   this: John Damascene would still win one of the two admitted slots by
   dignity/band, giving colitur TWO commemorations where missalemeum shows
   one. Whatever privilege or precedence the Seven Sorrows commemoration
   carries must itself explain the exclusion, not just the admission --
   register §6's own open item for this office should carry this caveat
   forward. *)
let m16_dates = [ "2026-03-27" ]

(* M17 was DELETED, fix round 1 (Task B): the "genuine tie" it adjudicated
   as [open] was itself wrong. 22 September (any year the September Ember
   Wednesday falls on the 22nd -- 2027 in this window): colitur used to
   admit "St. Maurice and Companions, Martyrs" (Commemoration_only, Class3)
   where missalemeum shows "St. Thomas of Villanova" (Feast, Class3) --
   NOT because RG 113 runs out of instruction between two same-rank
   candidates (the framing this entry used to carry), but because
   {!Precedence_ef.band} used to lend a [Commemoration_only] candidate the
   SAME table entry (24) as a genuine [Feast] of its own rank, manufacturing
   a tie the primary text never creates: RG 91's own table enumerates only
   "dies liturgici" (entry 24: "Festa III classis..." -- FEASTS), and the
   calendarium's own 22 September row confirms it in its own notation --
   "S. Thomae de Villanova Ep. et Conf., III classis. / Commemoratio Ss.
   Mauritii et Soc. Mm." -- Thomas carries a class number, Maurice carries
   none. Fixed at the source ([band] itself now returns [Precedence_ef
   .unclassified] for any [Commemoration_only] candidate, docs/research/
   rules-register.md §6.1's own corrected account) rather than here: 22
   September now resolves identically on both sides with no allow-list
   entry needed at all -- removed, not re-adjudicated to a different
   verdict, since there is no longer a divergence to name. *)

(* M18 -- ef-rg112-rg110 task: the gap this file's own header now names under
   "COMMEMORATION IDENTITY", restated for the OBSERVED axis. colitur's own
   observed celebration carries an English name ({!Celebration.t}.names)
   ONLY for a SANCTORAL-origin day (a saint's feast winning outright); a
   TEMPORAL-origin one -- an ordinary Sunday, a feria, a movable named feast
   including Holy Family itself -- never does ({!Rite_ef.Temporal_ef}'s own
   [build] has no [en "..."] string anywhere in it, this file's own header
   again). CORRECTED, fix round 1 (coordinator finding 8) -- the precise
   breakdown: of this window's 730 days, 331 are RESOLVED (330 matching, 1
   mismatched, [M13]); 399 are UNRESOLVED, split between this entry's own
   373 (the axis's sole disagreement) and 26 absorbed inside [M1]/[M2]/[M3]/
   [M16]'s own widened subsets, where it fires ALONGSIDE their pre-existing
   citation. The BLIND SPOT this axis exists to close, stated precisely: a
   TEMPORAL-origin observed day silently replaced by a DIFFERENT
   temporal-origin observed day of the SAME RANK AND COLOUR -- exactly the
   shape that hid Holy Family from every layer before this task. This is
   the OVERWHELMING majority of days in any calendar (saints' feasts are
   common, but far from every day), so this is a single STRUCTURAL
   predicate -- [Observed_identity_unresolved] alone, nothing else
   disagreeing -- not a literal date list the way every other entry in this
   file is: at this population size, a list would be exactly the
   "range/pattern that could silently widen" this file's own header
   explicitly avoids elsewhere, for the OPPOSITE reason a range is normally
   risky here -- the predicate itself (colitur's own name is [None]) is the
   precise, falsifiable evidence, the same shape [M2]'s own title-substring
   predicate already uses instead of a date list, just keyed on
   presence-of-a-name rather than a title string. NOT a rubric dispute and
   NOT a data gap either engine is wrong about -- a LIMIT of this comparator
   itself, honestly counted rather than silently passed, per the brief's own
   explicit instruction ("a day whose observed identity cannot be resolved
   must be a counted, allow-listed outcome, never a silent skip"), the SAME
   discipline [M15] already established for an unresolvable COMMEMORATION,
   applied here for the first time to the OBSERVED day. The count pin below
   ([test_layer_m_counts_match_citations]) is what stands guard against this
   population growing (or shrinking) silently -- it cannot say WHICH day
   moved or why, only that the total did. Fixing this at the root (giving
   every temporal-cycle candidate an English name) is a data/lectionary-
   bootstrap task (Plan 4), not something this comparator can do for itself
   -- register §6 tracks it, the same open item
   [M15]'s own note already points to. *)
(* M19 -- ef-holyname-rg110 task: RG 110's OTHER direction, 30 June (this
   window's two instances -- both years -- of
   [in-commemoratione-sancti-pauli-apostoli], data/ef/adjustments.sexp's
   own `Add commemoration-of-st-peter` directive; see that file's own
   citation for the full scan quote). Unlike 22 February above,
   missalemeum's own row for both dates shows an EMPTY commemorations array
   ("St. Peter" absent, and not even listed as "displaced" -- nothing
   competes for the slot on either side, so there is no candidate for
   missalemeum's own engine to have rejected, only one it never
   constructed): missalemeum has the SAME gap this task's own scan found in
   lectio's source data (`~/git/projects/lectio/internal/caldata/
   tridentine-calendar.ini` has no 06-30 companion entry either) -- a
   genuine feature gap, verdict colitur, the SAME shape as M1/M3/M8/M10
   above (each already "missalemeum does not implement X"), not a
   citation-count coincidence: RG 110's own text is unconditional ("in
   Officio et Missa S. Petri semper fit commemoratio S. Pauli, ET
   VICISSIM"), and the calendarium's own June table states the SAME
   pattern already built for the other two pairs, word for word.

   IDENTITY-GATED, fix round 1 (coordinator finding F2): the predicate
   below now also requires [c.c_commemorations] to be EXACTLY the single
   entry [commemoration-of-st-peter] -- not merely that some [Comm_presence]
   diff exists on these two dates. Proved necessary, not decorative: the
   reviewer added a SECOND, fabricated `Add` directive on 30 June (a
   `bogus-fabricated-companion` slug) to a scratch copy of
   data/ef/adjustments.sexp and found the whole suite stayed green with the
   pre-fix, presence-only predicate -- the exact C6/C14 failure mode (a
   Layer-C-style predicate that pins a date and a diff SHAPE but not WHICH
   candidate). This matters more here than for any other entry in this
   file: `commemoration-of-st-peter` is corroborated by NEITHER oracle (it
   rests on a scan reading alone, data/ef/adjustments.sexp's own citation),
   so this allow-list predicate is the only place in the whole suite that
   could assert what colitur actually emits here -- and, pre-fix, asserted
   nothing about it. Mirrors C16's own identity guard
   (`String.equal c.slug "ef-holy-name"`, test_differential.ml) at the
   analogous decision point in this file. *)
let m19_dates = [ "2026-06-30"; "2027-06-30" ]

let m19_commemoration_matches (c : colitur_row) =
  match c.c_commemorations with
  | [ (slug, _, _, _) ] -> String.equal slug "commemoration-of-st-peter"
  | _ -> false

(* M21 -- ef-sanctoral-audit task (2026-08-14): the SAME closed 14-slug list
   test_differential.ml's own [audit_colour_corrected_slugs] uses (RG 124,
   data/ef/adjustments.sexp's own audit-block comment has the full
   citation), now checked against THIS window's own oracle. Two of the
   fourteen (`apollinaris`, 23 July; `josaphat`, 14 November) and one
   further entry not on the Feast-status list at all (`chair-of-st-peter`,
   22 February, a Feast in its own right, RG124(b)) disagree with
   missalemeum's own colour TOO, not merely lectio's -- a SECOND,
   independent data source repeating the same defect (Apollinaris and
   Josaphat are each martyr-bishops, RG 124(e); Peter's Chair is an
   Apostle's own feast day, RG 124(b) -- both scan-verified word for word,
   data/ef/adjustments.sexp's own comment), so this is not a case of
   "missalemeum corroborates colitur, only lectio disagrees": the primary
   TEXT is what decides it, and missalemeum is simply wrong on these three
   the same way lectio is on all fourteen. [Comm_identity_unresolved] is
   allowed alongside on 22 February specifically: that date's OTHER
   commemoration (the ordinary Lenten feria RG 110 rides in alongside Paul)
   is TEMPORAL-origin and already unresolved for identity, the same
   pre-existing gap [M15]/[M18] elsewhere in this file document -- a
   different axis, not something this entry's own citation explains, so it
   is admitted by the subset check rather than folded into the citation. *)
let m21_colour_slugs =
  [ "conversion-of-st-paul"; "chair-of-st-peter"; "john-of-san-fecundo"; "ephrem-of-syria";
    "julia-of-falconieri"; "john-gualbert"; "camillus-de-lellis"; "jerome-emiliani"; "apollinaris";
    "martha"; "alphonsus-liguori"; "augustine"; "rose-of-lima"; "josaphat" ]

(* M22 -- ef-sanctoral-audit task: `barbara` (4 December, data/ef/
   adjustments.sexp's own new `Add`) is a genuine DATA GAP in missalemeum
   too, the identical shape M1/M3/M8/M10/M19 above already document (each
   "missalemeum does not implement X"): both years' own 4 December row
   shows only the Advent feria's own temporal commemoration, no Barbara at
   all, not even displaced -- missalemeum never constructed a candidate for
   her either, the same absence lectio's own tridentine-calendar.ini has
   (data/ef/adjustments.sexp's own `Add barbara` comment). Identity-gated
   the same way [M19] is (coordinator finding F2): the predicate requires
   colitur's own admitted set to be EXACTLY the temporal feria plus
   `barbara`, not merely that SOME count diff exists on this date, so a
   future unrelated regression on 4 December cannot silently hide behind
   this citation. *)
let m22_dates = [ "2026-12-04"; "2027-12-04" ]

let m22_commemoration_matches (c : colitur_row) =
  match List.map (fun (slug, _, _, _) -> slug) c.c_commemorations with
  | [ a; b ] -> (String.equal a "barbara") <> (String.equal b "barbara")
  | _ -> false

(* [_o] (the oracle's own row) is unused now that M2 -- its one reader, via
   [o.o_title] -- is closed/removed (see the comment above [m1_dates]):
   every remaining predicate below reads only [c]/[diffs]. Kept as a named,
   typed parameter (not dropped from the signature) so a FUTURE oracle-title
   predicate has somewhere to plug back in without a signature change. *)
let layer_m_reason (c : colitur_row) (_o : oracle_row) diffs =
  if diffs = [] then None
  (* M1's own subset widened (this task): colitur's observed day on both
     dates is TEMPORAL-origin (the Sunday itself, RG33's own point -- the
     vigil should never have displaced it), so it now ALSO carries
     [Observed_identity_unresolved] -- the same root cause the file's other
     widened entries below share, restated for this one's own shape. *)
  else if List.mem c.c_date m1_dates
          && subset diffs [ Rank; Colour_f; Comm_presence; Observed_identity_unresolved ]
  then Some "M1"
  (* M2 -- CLOSED, REMOVED (ef-bvm-saturday task): see this file's own M2
     note above (near [m1_dates]) for the full account -- the RG 91 entry 27
     office is now built, so every one of these 22 dates now falls through
     to [M18]'s own generic predicate below instead ([diffs = [
     Observed_identity_unresolved ]] exactly), which is what actually
     catches them now. *)
  (* M3's own subset widened (this task): the Rogation Monday feria colitur
     observes is temporal-origin, same root cause as M1/M2 above. *)
  else if List.mem c.c_date m3_dates && subset diffs [ Colour_f; Observed_identity_unresolved ] then
    Some "M3"
  else if List.mem c.c_date m5_dates && diffs = [ Comm_identity_mismatch ] && m5_commemoration_matches c then
    Some "M5"
  else if List.mem c.c_date m8_dates && diffs = [ Comm_presence ] then Some "M8"
  else if List.mem c.c_date m10_dates && diffs = [ Comm_presence ] then Some "M10"
  else if List.mem c.c_date m11_dates && diffs = [ Comm_presence ] then Some "M11"
  (* M13's own subset widened AGAIN (this task, following the SAME pattern
     Task B's own widening comment below records): colitur's observed
     celebration here is Joseph, SANCTORAL-origin, so its name IS
     resolvable -- and disagrees with missalemeum's own title outright
     ([Observed_identity_mismatch], not [_unresolved]), the SAME underlying
     gap (the Seven Sorrows commemoration is never constructed, so colitur
     has no candidate to observe OR commemorate in its place) now visible
     on a THIRD axis. *)
  else if List.mem c.c_date m13_dates
          && subset diffs [ Rank; Colour_f; Comm_identity_unresolved; Observed_identity_mismatch ]
  then Some "M13"
  else if List.mem c.c_date m15_dates && diffs = [ Comm_identity_unresolved ] then Some "M15"
  (* M16's own subset widened (this task): colitur's observed celebration
     here is the temporal Passiontide feria (John Damascene is only a
     COMMEMORATION on this Feast-status-losing day -- band picks the
     temporal candidate outright at Class3 rank, register's own account of
     this date), so [Observed_identity_unresolved] now fires alongside the
     pre-existing [Comm_identity_mismatch]. *)
  else if List.mem c.c_date m16_dates
          && subset diffs [ Comm_identity_mismatch; Observed_identity_unresolved ]
  then Some "M16"
  else if diffs = [ Observed_identity_unresolved ] then Some "M18"
  else if List.mem c.c_date m19_dates && diffs = [ Comm_presence ] && m19_commemoration_matches c then
    Some "M19"
  else if
    List.mem c.c_observed_slug m21_colour_slugs && diffs = [ Colour_f ]
  then Some "M21"
  else if List.mem c.c_date m22_dates && diffs = [ Comm_count ] && m22_commemoration_matches c then
    Some "M22"
  else if
    List.mem c.c_date m20_dates
    && subset diffs [ Comm_identity_mismatch; Observed_identity_unresolved ]
    && m20_commemoration_matches c
  then Some "M20"
  else None

(* ---------------------------------------------------------------------- *)
(* data/ef/expected-divergences-missalemeum.sexp loading -- same shape as  *)
(* test_differential.ml's own [allow_entry]/[load_allow_list]. *)
(* ---------------------------------------------------------------------- *)

open Sexplib0.Sexp_conv

type allow_entry = { id : string; citation : string; verdict : string; note : string; expected_rows : int }
[@@deriving sexp]

let load_allow_list () =
  let sexps =
    try Sexplib.Sexp.load_sexps allow_list_path
    with e -> Alcotest.failf "%s: failed to load: %s" allow_list_path (Printexc.to_string e)
  in
  List.map allow_entry_of_sexp sexps

(* ---------------------------------------------------------------------- *)
(* The comparison itself. *)
(* ---------------------------------------------------------------------- *)

type outcome = Matched | Explained of string | Unexplained of field list

let compare_streams () =
  let oracle = oracle_rows () in
  let colitur = colitur_rows_2026_2027 () in
  (oracle, colitur)

let classify oracle colitur =
  List.map2
    (fun (o : oracle_row) (c : colitur_row) ->
      if not (String.equal o.o_date c.c_date) then
        Alcotest.failf "streams misaligned: oracle %s vs colitur %s" o.o_date c.c_date;
      let diffs = diff_fields c o in
      if diffs = [] then (c, o, Matched)
      else
        match layer_m_reason c o diffs with
        | Some id -> (c, o, Explained id)
        | None -> (c, o, Unexplained diffs))
    oracle colitur

let status_to_string = function Cel.Feast -> "Feast" | Cel.Commemoration_only -> "Commemoration_only"

let describe_comm (slug, rank, status, name) =
  Printf.sprintf "%s(rank=%d,status=%s,name=%s)" slug rank (status_to_string status)
    (match name with Some n -> Printf.sprintf "%S" n | None -> "NONE")

let describe_unexplained (c : colitur_row) (o : oracle_row) diffs =
  Printf.sprintf "%s: %s differ -- colitur=(rank=%d colour=%c comms=[%s]) oracle=(rank=%d colours=[%s] \
                   title=%S comms=[%s] comm_ids=[%s] displaced=[%s])"
    c.c_date
    (String.concat "," (List.map field_name diffs))
    c.c_rank c.c_colour
    (String.concat ";" (List.map describe_comm c.c_commemorations))
    o.o_rank
    (String.concat "" (List.map (String.make 1) o.o_colours))
    o.o_title
    (String.concat ";" o.o_commemorations)
    (String.concat ";" o.o_commemoration_ids)
    (String.concat ";" o.o_displaced)

let test_fixture_checksum () =
  Alcotest.(check string) "fixture SHA-256 matches its provenance note" fixture_sha256
    (sha256_of_file fixture_path)

let test_dates_align () =
  let oracle, colitur = compare_streams () in
  Alcotest.(check int) "both streams have 730 rows (2026 + 2027, both non-leap)" 730 (List.length oracle);
  Alcotest.(check int) "colitur recomputed the same number of rows" (List.length oracle) (List.length colitur);
  let mismatched =
    List.filter_map
      (fun (o, c) -> if String.equal o.o_date c.c_date then None else Some (o.o_date, c.c_date))
      (List.combine oracle colitur)
  in
  Alcotest.(check (list (pair string string))) "no misaligned dates" [] mismatched

(* The core assertion: every one of the 63 raw differences across all six
   axes (rank, colour-membership, commemoration-presence, commemoration-
   count, and, since Task B/ef-rg16a, commemoration-identity-mismatch and
   commemoration-identity-unresolved) is named in the cited allow-list.
   Nothing else passes silently. *)
let test_no_unexplained_differences () =
  let oracle, colitur = compare_streams () in
  let classified = classify oracle colitur in
  let unexplained =
    List.filter_map
      (fun (c, o, outcome) ->
        match outcome with Unexplained diffs -> Some (describe_unexplained c o diffs) | _ -> None)
      classified
  in
  Alcotest.(check (list string)) "no differences outside the cited allow-list" [] unexplained

(* Teeth, not just green: EVERY allow-list id's actual row count over this
   fixture must equal what data/ef/expected-divergences-missalemeum.sexp
   declares, in BOTH directions -- the same double-check test_differential
   .ml's own "Layer C counts match citations" test makes for the lectio
   allow-list. *)
let test_layer_m_counts_match_citations () =
  let oracle, colitur = compare_streams () in
  let classified = classify oracle colitur in
  let actual_counts = Hashtbl.create 16 in
  List.iter
    (fun (_, _, outcome) ->
      match outcome with
      | Explained id ->
          Hashtbl.replace actual_counts id (1 + Option.value ~default:0 (Hashtbl.find_opt actual_counts id))
      | _ -> ())
    classified;
  let declared = load_allow_list () in
  let expected = List.sort compare (List.map (fun e -> (e.id, e.expected_rows)) declared) in
  let actual = List.sort compare (Hashtbl.fold (fun id n acc -> (id, n) :: acc) actual_counts []) in
  Alcotest.(check (list (pair string int)))
    "every allow-list id's actual row count matches its citation's expected_rows, and no id is unused or \
     undeclared"
    expected actual

(* Corroboration (Task B): for every day where the identity axis is CLEAN
   (no [Comm_identity_mismatch]/[Comm_identity_unresolved] -- titles matched
   as a set), independently cross-check missalemeum's own id-embedded rank
   digit against colitur's OWN candidate rank for that SAME title -- a
   SECOND, independent signal beyond string equality (this file's own
   header: "used only as a corroborating check, never as the primary
   signal"). Restricted to "sancti:"-origin ids (a TEMPORAL-origin oracle
   commemoration has no colitur-side name to pair it with in the first
   place, see [Comm_identity_unresolved]'s own days, which never reach here
   since their identity axis is not clean).

   SPLIT BY STATUS -- a genuine finding from running this check, not the
   originally-planned single assertion: EVERY ONE of colitur's 114
   [Commemoration_only] sanctoral entries carries a bootstrap-assigned
   [rank Class3] (verified: `grep -c "status Commemoration_only"` and
   `grep -B3 ... | grep -oP "rank Class\d" | sort | uniq -c` both give
   114/114 Class3, data/ef/sanctoral.sexp) -- but missalemeum's OWN id-rank
   for a [Commemoration_only] match is NOT itself uniform: of the 175
   examined, 17 genuinely AGREE (oracle_rank = colitur_rank = 3, real
   corroboration) and 158 show oracle_rank 4 against colitur's bootstrapped
   3 -- CORRECTED after the first version of this comment overclaimed "id
   consistently encodes 4 for every entry" from the 158-strong failure list
   alone, before the 17 agreeing rows (then hidden inside a too-strict
   assertion) were found. Two acceptable shapes, then, not one: either the
   ranks genuinely agree, or the specific oracle=4/colitur=3 gap holds. This
   is not evidence of a title-matching error, and not new: it independently
   corroborates the register's own already-open item (§6, "Commemoration-
   only entries' inferred STATUS, not only rank" -- Task 16's own data
   audit already flagged these ranks as bootstrap inferences, never
   individually Missal-verified). Auditing which of the 114 are genuinely
   Class3 and which were silently defaulted to it is that item's own scope,
   not this task's -- so rather than either asserting a false universal
   equality (which fails on the 158 KNOWN, tracked, out-of-scope rows) or
   silently dropping the check, this pins the discovered SHAPE itself:
   every [Commemoration_only] match is EITHER a real agreement OR the known
   gap, with no THIRD pattern -- a real, falsifiable claim (any other
   combination would break it) that stays honest about what remains
   unverified.

   WHAT THIS DOES NOT PIN (coordinator finding 8, fix round 1, honestly
   named rather than left implicit): the [oracle_rank = colitur_rank]
   branch accepts ANY genuine agreement, including one this check cannot
   independently verify is the CORRECT rank -- a regression that silently
   flipped some entry's [rank] from [Class3] to [Class4] would land in the
   agreement branch and pass cleanly if missalemeum's own id happened to
   read 4 for that entry too (data drift on one side coinciding with data
   drift on the other is not ruled out by this check, only coincidence
   independent of any real cause is). This test pins "no third pattern
   appears", not "every individual rank is correct" -- a narrower, still
   genuinely useful claim (see the [> 50] population guard below, which
   confirms the pinned shape is actually exercised at scale, not vacuously
   true over an empty or trivial set), and this comment says so rather than
   letting the assertion's own name imply more than it checks.

   [Feast]-status candidates get the ORIGINAL, unrestricted check (any
   disagreement at all is unexpected). CORRECTED (fix round 1, coordinator
   finding 1): this comment previously claimed this branch was unreachable
   in the 2026-2027 window (checked: 0) because its one candidate, Thomas
   of Villanova on 22 September, was M17's own mismatch -- WRONG, once
   traced further: M17 itself was wrong (see {!Precedence_ef.band}'s own
   fidelity fix, register §6.1), and fixing it made 22 September resolve
   cleanly on both sides, reachable here after all. Measured, not assumed:
   22 Feast-status commemorations are now examined by this branch (not
   only Thomas of Villanova -- every OTHER genuinely clean Feast-status
   match in the window reaches it too, which the earlier version of this
   comment did not check for before asserting "0"). All 22 agree. *)
let test_identity_rank_corroboration () =
  let oracle, colitur = compare_streams () in
  let feast_checked = ref 0 in
  let feast_mismatches = ref [] in
  let commemoration_only_checked = ref 0 in
  let commemoration_only_surprises = ref [] in
  List.iter2
    (fun (o : oracle_row) (c : colitur_row) ->
      if
        identity_diff c o = None && c.c_commemorations <> [] && o.o_commemorations <> []
        && List.length c.c_commemorations = List.length o.o_commemorations
      then
        List.iter2
          (fun title id ->
            if is_sancti_id id then
              match id_rank id with
              | None -> ()
              | Some oracle_rank -> (
                  match List.find_opt (fun (_, _, _, n) -> n = Some title) c.c_commemorations with
                  | Some (slug, colitur_rank, Cel.Feast, _) ->
                      incr feast_checked;
                      if colitur_rank <> oracle_rank then
                        feast_mismatches :=
                          Printf.sprintf "%s: %s oracle-id-rank=%d colitur-rank=%d" c.c_date slug
                            oracle_rank colitur_rank
                          :: !feast_mismatches
                  | Some (slug, colitur_rank, Cel.Commemoration_only, _) ->
                      incr commemoration_only_checked;
                      (* Two ACCEPTABLE shapes, not one -- corrected after first running this
                         check: most Commemoration_only entries genuinely agree
                         (oracle_rank = colitur_rank, real corroboration, 17 of the
                         population checked), and the rest show the KNOWN
                         oracle=4/colitur=3 convention gap (this comment's own header).
                         Anything OUTSIDE those two shapes (e.g. oracle=2 or a THIRD
                         colitur rank paired with a non-4 oracle rank) is a genuine
                         surprise. *)
                      if not (oracle_rank = colitur_rank || (oracle_rank = 4 && colitur_rank = 3)) then
                        commemoration_only_surprises :=
                          Printf.sprintf "%s: %s oracle-id-rank=%d colitur-rank=%d (neither agrees nor \
                                          fits the known oracle=4/colitur=3 pattern)"
                            c.c_date slug oracle_rank colitur_rank
                          :: !commemoration_only_surprises
                  | None -> ()))
          o.o_commemorations o.o_commemoration_ids)
    oracle colitur;
  Alcotest.(check (list string))
    "Feast-status matches: oracle id-rank agrees with colitur's own rank" [] (List.rev !feast_mismatches);
  Alcotest.(check (list string))
    "Commemoration_only-status matches: every one fits the KNOWN oracle=4/colitur=3 convention gap -- any \
     other combination would be a genuine, new surprise"
    [] (List.rev !commemoration_only_surprises);
  (* Vacuity guard: BOTH branches must actually run now. CORRECTED (fix
     round 1, coordinator finding 1): the [Feast] branch used to be
     unreachable in this window (checked: 0) because its one candidate,
     Thomas of Villanova on 22 September, was M17's own mismatch (excluded
     by the [identity_diff = None] guard above). Fixing {!Precedence_ef
     .band}'s Commemoration_only fidelity (register §6.1) made that day
     resolve cleanly, so it is reachable here too -- this guard now expects
     at least 1, not merely documents the branch as dormant (measured: 22
     Feast-status commemorations now examined, up from 0). *)
  Alcotest.(check bool) "the Feast-status population actually examined is non-trivial" true (!feast_checked > 0);
  Alcotest.(check bool) "the Commemoration_only population actually examined is non-trivial" true
    (!commemoration_only_checked > 50)

let suite =
  ( "oracle (missalemeum, EF, 2026-2027)",
    [ Alcotest.test_case "fixture SHA-256 matches its provenance note" `Quick test_fixture_checksum;
      Alcotest.test_case "streams are 730 rows each, dates aligned 1:1" `Quick test_dates_align;
      Alcotest.test_case "every difference is named in the cited allow-list -- none unexplained" `Quick
        test_no_unexplained_differences;
      Alcotest.test_case "allow-list counts match data/ef/expected-divergences-missalemeum.sexp exactly"
        `Quick test_layer_m_counts_match_citations;
      Alcotest.test_case
        "identity corroboration: matched titles' oracle id-rank agrees with colitur's own rank" `Quick
        test_identity_rank_corroboration
    ] )