path: root/test/test_oracle.ml

(* Task 16: oracle harness vs missalemeum (sibling project's snapshot of
   missalemeum.com/Divinum Officium data), EF only, 2026-2027 -- validation
   layer 4 of the design spec's five (colitur CLAUDE.md "Validation" section;
   layer 3, the lectio differential, is test_differential.ml, already green).

   *** WIP, 2026-08-13, branch ef-rg112-rg110: this file is EXPECTED RED
   right now. [Observed_identity_mismatch]/[Observed_identity_unresolved]
   (below) are new -- this layer used to compare the observed day's rank and
   colour and stop there, never whether it is actually the RIGHT day (Holy
   Family, 11 January 2026, is rank 2/white on both sides purely by
   coincidence -- an ordinary unnamed Sunday and Holy Family share both).
   Landing the strengthened comparator FIRST, red, before touching any
   production code, is the point: it is the regression net the rest of this
   task's fix commits are checked against, not a change bundled in alongside
   the fix. The very next commits make it green again (data/ef/expected-
   divergences-missalemeum.sexp's own M-series entries below, and this
   file's own [layer_m_reason] widening) -- see that file and
   docs/research/rules-register.md for the running account.

   *** WHY THIS LAYER EXISTS, AND WHAT IT CAN DO THAT THE LECTIO DIFFERENTIAL
   CANNOT (test_differential.ml's own header comment, limit 1) ***

   The lectio differential compares colitur against data colitur was itself
   BOOTSTRAPPED from (data/ef/sanctoral.sexp comes from lectio's tridentine-
   calendar.ini) -- it cannot catch an error inherited from that bootstrap,
   and it explicitly does not compare commemorations at all (lectio's
   trailing tokens are losing candidates, not an RG 111 admitted set, per
   that file's own limit 1). missalemeum is INDEPENDENT of colitur's
   bootstrap chain, and its JSON carries a real admitted-commemorations
   array (its own RG 111-shaped selection, not lectio's rejects) -- so this
   file compares axes the lectio differential cannot touch at all: rank,
   colour (as SET membership, see below), commemoration presence, count,
   and (CORRECTED 2026-08-12, Task B, branch ef-rg16a -- see below) IDENTITY
   -- WHICH commemoration is admitted, not only how many.

   *** THE FIXTURE'S OWN SHAPE (fixtures/missalemeum-ef-2026-2027.txt,
   fixtures/missalemeum-ef-2026-2027.provenance, tools/
   extract_missalemeum_oracle.py) ***

   info.id (e.g. "sancti:01-02:1:w") encodes the PROPERS REUSED that day,
   not the day's own rank or colour -- 137 of 730 days (19%) disagree
   between the id-embedded rank and info.rank itself (task brief's own
   premise was wrong here; the brief's extraction note has been corrected).
   This file, like the extraction script, reads ONLY info.rank and
   info.colors for the DAY's own rank/colour, never parses anything out of
   info.id for that purpose.

   *** COMMEMORATION IDENTITY (added 2026-08-12, Task B, branch ef-rg16a)
   -- CORRECTING the previous header's own "deliberately NOT compared"
   claim ***

   The gap this correction closes: layer 4 used to compare commemoration
   PRESENCE and List.length ONLY -- cardinality, never identity. A reviewer
   proved this was vacuous by reversing admit's own dignity/precedence sort
   (Rite_ef.Precedence_ef, so the engine admits the WORST candidate, an
   outright RG 111 violation) and finding every assertion in this file
   still green across all 730 days (see the perturbation record in the task
   report, reproduced and reverted, not left in the tree). This file now
   also compares WHICH commemoration is admitted, using two independent
   signals from missalemeum's own JSON: the commemoration's title text
   (English, exact string) and, for a sancti-origin commemoration, its own
   [id]'s embedded rank digit (used only as a corroborating check, never as
   the primary signal -- see [Comm_identity] below).

   THE MAPPING, AND EXACTLY WHAT IT CANNOT RESOLVE: missalemeum identifies
   a commemoration by an English TITLE string; colitur identifies one by a
   SLUG. There is no hand-built slug<->title lookup table here -- colitur's
   own {!Celebration.t}.names already carries an English name for every
   SANCTORAL-origin celebration (bootstrapped from lectio's own English
   titles, which verifiably match missalemeum's titles character-for-
   character on every checked row), so the comparison reads that name
   directly off colitur's own resolved output, the same field
   test_differential.ml already treats as authoritative for OF/EF display
   text. This resolves identity for every SANCTORAL-origin commemoration.
   It CANNOT resolve a TEMPORAL-origin commemoration (an impeded feria, a
   privileged Sunday, an Ember/Rogation day, etc.): {!Rite_ef.Temporal_ef}'s
   own [build] never sets a celebration's [names] field (rite_ef/
   temporal_ef.ml has no [en "..."] string anywhere in it), so every such
   candidate's own title is empty on colitur's side -- there is nothing to
   compare against missalemeum's title text, and no principled way to
   invent one without duplicating missalemeum's own English-prose
   convention ("Feria III after the I Sunday of Lent") as a second,
   unverified source of truth. THIS CASE IS NEVER SILENTLY SKIPPED: see
   [Comm_identity_unresolved] below -- it is counted, reported, and must be
   named in the allow-list like any other difference, exactly the discipline
   the brief demands ("a day whose commemoration cannot be matched must be
   visibly counted and reported, not quietly passed").

   Identity is only even ATTEMPTED once presence and count already agree
   (both non-empty, same length) -- a cardinality mismatch is already
   [Comm_presence]/[Comm_count]'s own business (see [diff_fields] below),
   and comparing SETS of different size would just restate that mismatch
   under a third name, not add information. Compared as a SORTED MULTISET
   of titles, not a sequence: missalemeum's own [commemorations] array order
   is not independently verified against RG 113's own "commemoratio de
   Tempore fit primo loco" ordering rule here, so this axis proves WHICH
   commemorations are admitted, not what order they are listed in.

   info.colors is an ARRAY -- 14 of 730 days carry two colours (rose+violet
   on Gaudete/Laetare per RG 131's indult, red+violet on Palm Sunday, black+
   violet on Good Friday, violet+white on Holy Saturday -- one colour per
   liturgical ACTION within that one civil day, which colitur's one-colour-
   per-day model cannot represent, register §3b's own RG 126 note). So the
   colour axis below is MEMBERSHIP (colitur's single colour must be one of
   the oracle's set), never equality.

   Four days carry more than one Mass in the JSON array (Christmas, All
   Souls) -- the extraction script takes entry[0] throughout, VERIFIED
   (not assumed) identical to every other Mass of the same day on every
   field this file reads (see that script's own header and the task
   report).

   *** THE ALLOW-LIST (data/ef/expected-divergences-missalemeum.sexp) ***

   A SEPARATE file from data/ef/expected-divergences.sexp (the lectio
   allow-list): the two oracles disagree with colitur in different places
   and for different reasons, and this file's own convention differs in one
   deliberate way -- [verdict] is not always "colitur". Some entries are
   genuine DATA GAPS this task found and could not fix here (data/ef/
   sanctoral.sexp is bootstrapped from lectio, which is itself missing the
   entries; RG 110's inseparable-Peter/Paul commemoration is unimplemented
   code, a real feature this task did not build) -- honestly verdicted
   [missalemeum] (colitur is short a feature or a row, not right), never
   silently absorbed as if colitur were correct. TWO entries (M11 and M13)
   are [verdict open] -- CORRECTED, final fix wave, item 7: this comment
   previously said "one entry (M13)", missing M11, whose own verdict was
   changed from [colitur] to [open] in fix round 1 (see M11's own entry
   below for why) but this summary was never updated to match. Task B
   (branch ef-rg16a) briefly added a THIRD, M17 (the same-band tie-break
   between Maurice and Thomas of Villanova, 22 September) -- CORRECTED,
   fix round 1 of that same task: M17 was itself wrong. The "tie" was
   manufactured by {!Precedence_ef.band} lending a [Commemoration_only]
   candidate the same table entry as a genuine [Feast] of its own rank
   (RG 91's table has no row for a bare commemoration at all -- fixed in
   [band] itself, not here); once fixed, 22 September resolves cleanly on
   both sides and M17 was deleted, not merely re-adjudicated. ONE entry
   (M15) carries its own fourth verdict, [unresolvable] -- not a rubric
   dispute or a data gap either engine is wrong about, but a LIMIT of this
   comparator itself (see M15's own entry). All remaining OPEN entries are
   adjudicated as unresolved/unresolvable, not resolved either way -- the
   brief's own explicit permission ("say so as an open item") used for real,
   not
   defaulted past. See the task report for every entry's full
   reasoning and primary-source citation. *)

module Cal = Colitur_kernel.Calendar
module Layer = Colitur_kernel.Layer
module Overlay = Colitur_kernel.Overlay
module LD = Colitur_kernel.Liturgical_day
module Slug = Colitur_kernel.Slug
module Date = Colitur_kernel.Date
module Cel = Colitur_kernel.Celebration
module Colour = Colitur_kernel.Colour
module Names = Colitur_kernel.Names
module Lang = Colitur_kernel.Lang
module Citation = Colitur_kernel.Citation
module V = Rite_ef.Vocab_ef

(* Same relative paths test_differential.ml uses: dune test runs from
   _build/default/test/. *)
let sanctoral_path = "../data/ef/sanctoral.sexp"
let adjustments_path = "../data/ef/adjustments.sexp"
let fixture_path = "fixtures/missalemeum-ef-2026-2027.txt"
let allow_list_path = "../data/ef/expected-divergences-missalemeum.sexp"

(* fixtures/missalemeum-ef-2026-2027.provenance carries the same digest and
   the exact regeneration command. Asserted (not merely documented) for the
   same reason test_differential.ml's own [fixture_sha256] is: a hand-edit
   or partial re-extraction would otherwise silently turn the oracle into
   an unlabelled snapshot of whatever someone last ran. *)
(* CORRECTED 2026-08-12, Task B (branch ef-rg16a): field 9
   (commemoration_ids) appended to the fixture (tools/
   extract_missalemeum_oracle.py's own header) so this file can compare
   commemoration IDENTITY, not merely presence/count -- see this file's own
   header comment, rewritten below. Regenerated from the SAME underlying
   snapshot (fixtures/missalemeum-ef-2026-2027.provenance: still lectio
   commit d7da4b0, re-verified, first 8 fields byte-identical) -- only field
   9 is new content, so this digest changes but the fixture's own data does
   not.

   UPDATED 2026-08-17, Task 9 (branch ef-lectionary): fields 10-11
   (first/gospel citations) appended, same snapshot, same provenance --
   first 9 fields re-verified byte-identical. *)
let fixture_sha256 = "350199498ce197c93dfee23bea62a47811995c3c70eec66707c123dd9e9c37fb"

(* Identical technique to test_differential.ml's own [sha256_of_file]
   (that file's own comment explains why: shelling out to [sha256sum]
   rather than adding a crypto library dependency Task 15/16's frozen deps
   do not include). Duplicated, not shared, for the same reason
   [real_layer] below is -- neither file exposes an .mli the other could
   depend on, and this is three lines. *)
let sha256_of_file path =
  let tmp = Filename.temp_file "colitur_oracle_sha256" ".txt" in
  Fun.protect
    ~finally:(fun () -> try Sys.remove tmp with Sys_error _ -> ())
    (fun () ->
      let cmd = Printf.sprintf "sha256sum %s > %s" (Filename.quote path) (Filename.quote tmp) in
      let rc = Sys.command cmd in
      if rc <> 0 then Alcotest.failf "sha256sum exited %d for %s (is it on PATH?)" rc path;
      let ic = open_in tmp in
      let line =
        try input_line ic
        with End_of_file ->
          close_in ic;
          Alcotest.failf "sha256sum produced no output for %s" path
      in
      close_in ic;
      match String.index_opt line ' ' with
      | Some i -> String.sub line 0 i
      | None -> Alcotest.failf "unexpected sha256sum output for %s: %S" path line)

let real_layer () =
  let layer =
    match Layer.load V.rank_of_sexp sanctoral_path with
    | Ok l -> l
    | Error e -> Alcotest.failf "%s: failed to load: %s" sanctoral_path e
  in
  let overlay =
    match Overlay.load V.rank_of_sexp adjustments_path with
    | Ok o -> o
    | Error e -> Alcotest.failf "%s: failed to load: %s" adjustments_path e
  in
  let layer, diagnostics = Overlay.apply layer overlay in
  Alcotest.(check (list string)) "the committed overlay applies cleanly, no diagnostics" []
    (List.map Overlay.diagnostic_to_string diagnostics);
  layer

(* [Rite_ef.context] takes [~lectionary] (fix round 1, coordinator review) --
   caller-supplied, same as [real_layer] above. *)
let real_lectionary () =
  match Colitur_kernel.Lectionary.load "../data/ef/lectionary.sexp" with
  | Ok l -> l
  | Error e -> Alcotest.failf "../data/ef/lectionary.sexp: failed to load: %s" e

(* The Commons (data/ef/commons.sexp) travel the same caller-supplied seam
   as the lectionary above, and [~commons] is required rather than defaulted
   so that no caller can silently run with none. CORRECTED, fix round 1
   (coordinator review): this used to claim "nothing in layers 3-5 compares
   reading citations" -- stale since Task 8 (layer 3) and this task itself
   (layer 4, this file). Layer 5 (test_golden.ml's own [describe]) still
   has no citation field at all, so it alone would still miss a rite
   quietly missing its Commons; layers 3/4 compare citations directly and
   would not. Loaded here even where this file asserts nothing about
   readings, so that the rite under test is the same one bin/main.ml
   assembles. *)
let real_commons () =
  match Rite_ef.Lectionary_ef.Commons.load "../data/ef/commons.sexp" with
  | Ok c -> c
  | Error e -> Alcotest.failf "../data/ef/commons.sexp: failed to load: %s" e

(* ---------------------------------------------------------------------- *)
(* The oracle side: one line per day, as tools/extract_missalemeum_oracle  *)
(* .py's own header documents.                                            *)
(* ---------------------------------------------------------------------- *)

type oracle_row = {
  o_date : string;
  o_rank : int;
  o_colours : char list;
  o_title : string;
  o_commemorations : string list;
  o_commemoration_ids : string list;  (** parallel to [o_commemorations], see field 9's own doc above *)
  o_displaced : string list;
  o_first : string option;
      (** Task 9, fields 10-11: the day's Epistle and Gospel citations, extracted
          verbatim from missalemeum's own "Lectio"/"Evangelium" sections
          (tools/extract_missalemeum_oracle.py's own header has the extraction
          method and its exhaustive verification). [None] for the fixture's own
          "-" sentinel -- the 2 Good Friday rows, which have no such section at
          all (a multi-lesson "Missa Praesanctificatorum" structure instead),
          the SAME shape colitur's own test_lectionary.ml already records for
          its own hand-authored Holy Week data. *)
  o_gospel : string option;
}

let explode s = List.init (String.length s) (String.get s)

let split_list_field f = if f = "-" then [] else String.split_on_char ';' f

(* A commemoration id's own trailing "rank" field, e.g. "sancti:01-05:4:r" ->
   [Some 4] -- the SECOND, corroborating identity signal this file's own
   header describes (test_identity_rank_corroboration, near the bottom of
   this file). [None] for any id that does not have exactly 4 ':'-separated
   parts (defensive; every id checked so far does). *)
let id_rank id =
  match String.split_on_char ':' id with [ _; _; rank; _ ] -> int_of_string_opt rank | _ -> None

let is_sancti_id id = String.length id >= 7 && String.sub id 0 7 = "sancti:"

(* Task 9: "-" -> [None], anything else -> [Some _] verbatim -- the same
   sentinel convention test_differential.ml's own first/gospel columns
   already use (that file's [decode_field]/[row] comment), here kept as an
   [option] rather than a bare "-" string so a comparator bug cannot
   accidentally compare two absent readings as if they were the SAME
   present reading "-". *)
let opt_field f = if f = "-" then None else Some f

let oracle_row_of_line line =
  match String.split_on_char '|' line with
  | [ date; rank; colours; title; _tempora; commemorations; displaced; _n_masses; commemoration_ids; first;
      gospel ] ->
      { o_date = date;
        o_rank = int_of_string rank;
        o_colours = explode colours;
        o_title = title;
        o_commemorations = split_list_field commemorations;
        o_commemoration_ids = split_list_field commemoration_ids;
        o_displaced = split_list_field displaced;
        o_first = opt_field first;
        o_gospel = opt_field gospel
      }
  | _ -> Alcotest.failf "malformed fixture line (expected 11 '|'-separated fields): %S" line

let read_lines path =
  let ic = open_in path in
  let rec loop acc =
    match input_line ic with
    | line -> loop (line :: acc)
    | exception End_of_file ->
        close_in ic;
        List.rev acc
  in
  loop []

let oracle_rows () = List.map oracle_row_of_line (read_lines fixture_path)

(* ---------------------------------------------------------------------- *)
(* The colitur side: the SAME pipeline bin/main.ml's `colitur day` and     *)
(* test_differential.ml's own [colitur_rows_2005_2050] use --              *)
(* Colitur_kernel.Calendar over the real committed data. Restricted to     *)
(* 2026-2027 (indexing 2025 too, for the same reason test_differential.ml  *)
(* indexes [y-1]: Calendar.year resolves one Advent-anchored liturgical    *)
(* year, which straddles two civil years). *)
(* ---------------------------------------------------------------------- *)

(* [c_commemorations]: one entry per admitted commemoration, carrying its
   own slug, RG 8 rank, STATUS, AND its English name if colitur's own
   {!Celebration.t}.names has one -- [None] for a TEMPORAL-origin
   candidate, which [Rite_ef.Temporal_ef] never names (this file's own
   header, "THE MAPPING, AND EXACTLY WHAT IT CANNOT RESOLVE"). The [None]
   case is what [Comm_identity_unresolved] below reads; [status] is read by
   [test_identity_rank_corroboration]'s own scope guard, see its comment. *)
type colitur_row = {
  c_date : string;
  c_rank : int;
  c_colour : char;
  c_observed_slug : string;
  c_observed_name : string option;
      (** colitur's own resolved English name for the OBSERVED celebration --
          [None] for a TEMPORAL-origin day (an ordinary Sunday, a feria, a
          movable named feast: {!Rite_ef.Temporal_ef}'s own [build] never
          sets [names], the SAME gap this file's header already documents
          for commemorations, see [Comm_identity_unresolved]), the same
          [Names.find ... en] read [c_commemorations] below already uses,
          applied to [LD.observed] instead of a commemoration candidate. *)
  c_commemorations : (string * int * Cel.status * string option) list;
      (** slug, rank, status, English name *)
  c_first : string option;
      (** Task 9: colitur's own resolved Epistle citation ({!Citation.First}),
          the same [None]-for-absent convention as {!oracle_row}'s own
          [o_first] -- read off [LD.citations] exactly the way
          test_differential.ml's own [colitur_rows_2005_2050] already does
          (that file's own [citation_ref], duplicated here rather than
          shared, same reasoning as [real_layer]/[sha256_of_file] above). *)
  c_gospel : string option;
}

let rank_to_int = function V.Class1 -> 1 | V.Class2 -> 2 | V.Class3 -> 3 | V.Class4 -> 4

let colour_to_char = function
  | Colour.White -> 'w'
  | Colour.Red -> 'r'
  | Colour.Green -> 'g'
  | Colour.Violet -> 'v'
  | Colour.Rose -> 'p'
  | Colour.Black -> 'b'

let en = Lang.of_string_exn "en"

(* Parameterised by year (the 2038 oracle extension, 2026-08-17): this used
   to be [colitur_rows_2026_2027], hardcoded to the one fixture window. The
   resolution walk starts a year EARLY -- [from_year - 1] -- because a
   liturgical year is Advent-anchored and straddles two civil years, so
   1 January of [from_year] belongs to the liturgical year that opened the
   previous November (calendar.mli, and bin/main.ml's own [day_report] does
   exactly the same for the same reason). *)
let colitur_rows ~from_year ~to_year =
  let layer = real_layer () in
  let rite = Rite_ef.context ~lectionary:(real_lectionary ()) ~commons:(real_commons ()) in
  let by_rata : (int, (V.season, V.rank) LD.t) Hashtbl.t = Hashtbl.create 800 in
  for y = from_year - 1 to to_year do
    let days = Cal.year rite layer y in
    Array.iter (fun (d : (V.season, V.rank) LD.t) -> Hashtbl.replace by_rata (Date.to_rata d.LD.date) d) days
  done;
  let mk y m d = match Date.make ~year:y ~month:m ~day:d with Ok t -> t | Error e -> failwith e in
  let rows = ref [] in
  let d = ref (mk from_year 1 1) in
  let stop = mk to_year 12 31 in
  while Date.compare !d stop <= 0 do
    (match Hashtbl.find_opt by_rata (Date.to_rata !d) with
    | Some day ->
        let cel = day.LD.observed in
        let commemorations =
          List.map
            (fun (c, _) ->
              (Slug.to_string c.Cel.slug, rank_to_int c.Cel.rank, c.Cel.status, Names.find c.Cel.names en))
            day.LD.commemorations
        in
        let citation_ref part =
          match List.find_opt (fun (c : Citation.t) -> c.Citation.part = part) day.LD.citations with
          | Some c -> Some c.Citation.reference
          | None -> None
        in
        rows :=
          { c_date = Date.to_iso8601 day.LD.date;
            c_rank = rank_to_int cel.Cel.rank;
            c_colour = colour_to_char cel.Cel.colour;
            c_observed_slug = Slug.to_string cel.Cel.slug;
            c_observed_name = Names.find cel.Cel.names en;
            c_commemorations = commemorations;
            c_first = citation_ref Citation.First;
            c_gospel = citation_ref Citation.Gospel
          }
          :: !rows
    | None -> Alcotest.failf "internal error: no resolved day for %s" (Date.to_iso8601 !d));
    d := Date.add_days !d 1
  done;
  List.rev !rows

(* ---------------------------------------------------------------------- *)
(* Field-diff computation: the axes the oracle supports, RANK/COLOUR/      *)
(* PRESENCE/COUNT as before, plus (Task B) IDENTITY -- see this file's own *)
(* header for the mapping and its exact limits. *)
(* ---------------------------------------------------------------------- *)

type field =
  | Rank
  | Colour_f
  | Comm_presence
  | Comm_count
  | Comm_identity_mismatch
  | Comm_identity_unresolved
  | Observed_identity_mismatch
  | Observed_identity_unresolved
  | First_mismatch
  | First_unresolved
  | Gospel_mismatch
  | Gospel_unresolved

let field_name = function
  | Rank -> "rank"
  | Colour_f -> "colour"
  | Comm_presence -> "commemoration-presence"
  | Comm_count -> "commemoration-count"
  | Comm_identity_mismatch -> "commemoration-identity-mismatch"
  | Comm_identity_unresolved -> "commemoration-identity-unresolved"
  | Observed_identity_mismatch -> "observed-identity-mismatch"
  | Observed_identity_unresolved -> "observed-identity-unresolved"
  | First_mismatch -> "first-mismatch"
  | First_unresolved -> "first-unresolved"
  | Gospel_mismatch -> "gospel-mismatch"
  | Gospel_unresolved -> "gospel-unresolved"

(* CORRECTING the gap this file's own header names (added under this task,
   branch ef-rg112-rg110): the axes above all compare the day's OBSERVED
   celebration's rank and colour ([Rank]/[Colour_f]) and the admitted
   COMMEMORATIONS' identity ([Comm_identity_*]) -- nothing until now compared
   the OBSERVED celebration's own identity, WHICH day is actually being kept,
   only what class/colour it happens to carry. Holy Family (11 January 2026:
   oracle title "The Holy Family: Jesus, Mary & Joseph", colitur's own
   observed slug the plain "ef-time-after-epiphany-sunday-1", BOTH rank 2 and
   colour white on both sides) is exactly the shape this axis exists to
   catch -- rank and colour already agreed by coincidence (an ordinary,
   unnamed II-class Sunday and Holy Family share both), so nothing above
   ever saw a difference. Same mapping and the same honesty about its limit
   as [identity_diff] just above: colitur identifies a day by SLUG,
   missalemeum by an English TITLE string, and the bridge is
   {!Celebration.t}.names, read directly off [LD.observed] by
   [colitur_rows_2026_2027] into [c_observed_name] -- resolvable for a
   SANCTORAL-origin observed day (a saint's feast winning the day outright),
   NEVER for a TEMPORAL-origin one (an ordinary Sunday, a feria, a movable
   named feast -- {!Rite_ef.Temporal_ef}'s own [build] never sets [names]).
   [Observed_identity_unresolved] is that TEMPORAL-origin case: counted and
   reported, never silently skipped, the same discipline
   [Comm_identity_unresolved] already established and the brief demands
   again here ("a day whose observed identity cannot be resolved must be a
   counted, allow-listed outcome, never a silent skip"). Unlike commemoration
   identity, this axis needs no presence/count gate first -- there is always
   exactly one observed day on each side, no list-length ambiguity to
   resolve before a title comparison is even meaningful. *)
let observed_identity_diff (c : colitur_row) (o : oracle_row) =
  match c.c_observed_name with
  | None -> Some Observed_identity_unresolved
  | Some name -> if String.equal name o.o_title then None else Some Observed_identity_mismatch

(* Identity (Task B): only even attempted once presence AND count already
   agree (both non-empty, same length) -- see this file's own header,
   "Identity is only even ATTEMPTED...". Two outcomes beyond a clean match:
   [Comm_identity_unresolved] when ANY of colitur's own admitted
   commemorations carries no English name to compare (a TEMPORAL-origin
   candidate -- counted and reported, never silently skipped, per the
   brief); [Comm_identity_mismatch] when every name IS resolvable but the
   SORTED MULTISET of titles still disagrees with missalemeum's own. *)
let identity_diff (c : colitur_row) (o : oracle_row) =
  let c_has = c.c_commemorations <> [] and o_has = o.o_commemorations <> [] in
  if not (c_has && o_has) || List.length c.c_commemorations <> List.length o.o_commemorations then None
  else
    let unresolved = List.exists (fun (_, _, _, name) -> name = None) c.c_commemorations in
    if unresolved then Some Comm_identity_unresolved
    else
      let c_titles = List.sort compare (List.filter_map (fun (_, _, _, n) -> n) c.c_commemorations) in
      let o_titles = List.sort compare o.o_commemorations in
      if c_titles = o_titles then None else Some Comm_identity_mismatch

(* Task 9: reading-citation comparison. colitur and missalemeum are both,
   independently, English-abbreviated "Book chapter:verse-verse" citations
   (unlike the commemoration/observed TITLE axes above, there is no
   vocabulary gap to bridge here -- see tools/extract_missalemeum_oracle.py's
   own header for the extraction, and data/ef/commons.sexp's own header for
   colitur's side of the same convention) -- but the two sources punctuate
   the identical reference differently often enough that a bare
   [String.equal] would drown every genuine divergence in typographic noise:
   a trailing full stop missalemeum's own source sentence happens to end
   with ("1 Cor 1:17-25." vs colitur's "1 Cor. 1:17-25"), an abbreviation dot
   after the book name (present on one side, absent on the other, with no
   consistent rule EITHER side follows -- missalemeum alone has both "1 Cor"
   and "1 Cor." in its own fixture), and a chapter/verse separator that is
   sometimes "." instead of ":" ("John 20. 19-31"). [normalize_citation]
   collapses exactly these three -- PURE typography, never the substantive
   book/chapter/verse content -- so the identity axis below compares what
   the reference actually IS, not how either source happened to punctuate
   it that day. Order matters: the digit-period-digit rewrite (chapter.verse
   -> chapter:verse) runs BEFORE the letter-period strip, so "20. 19-31"
   becomes "20:19-31" before the (now absent) letter-period pass would have
   nothing left to touch it. *)
let normalize_citation s =
  let s = String.trim s in
  let buf = Buffer.create (String.length s) in
  String.iter (fun c -> if c = '\t' || c = '\n' then Buffer.add_char buf ' ' else Buffer.add_char buf c) s;
  let s = Buffer.contents buf in
  (* Collapse runs of whitespace to one space. *)
  let s =
    let b = Buffer.create (String.length s) in
    let prev_space = ref false in
    String.iter
      (fun c ->
        if c = ' ' then (
          if not !prev_space then Buffer.add_char b ' ';
          prev_space := true)
        else (
          Buffer.add_char b c;
          prev_space := false))
      s
    |> fun () -> Buffer.contents b
  in
  (* digit "." (optional space) digit -> digit ":" digit (the chapter/verse
     separator seen as "." on missalemeum's side, e.g. "John 20. 19-31"). *)
  let is_digit c = c >= '0' && c <= '9' in
  let n = String.length s in
  let b = Buffer.create n in
  let i = ref 0 in
  while !i < n do
    let c = s.[!i] in
    if c = '.' && !i > 0 && is_digit s.[!i - 1] then (
      let j = ref (!i + 1) in
      if !j < n && s.[!j] = ' ' then incr j;
      if !j < n && is_digit s.[!j] then (
        Buffer.add_char b ':';
        i := !j)
      else (
        Buffer.add_char b c;
        incr i))
    else (
      Buffer.add_char b c;
      incr i)
  done;
  let s = Buffer.contents b in
  (* Any remaining "." is either an abbreviation dot (letter, e.g. "Cor.")
     or a bare trailing full stop -- neither carries reference content, so
     both are simply dropped. *)
  let b = Buffer.create (String.length s) in
  String.iter (fun c -> if c <> '.' then Buffer.add_char b c) s;
  String.trim (Buffer.contents b)

(* [None] (unresolved) is reported separately from a genuine mismatch
   between two present values -- the same [Comm_identity_unresolved] /
   [Comm_identity_mismatch] split above, applied to a single reference
   string instead of a multiset of titles. The ONLY unresolved case either
   side of this whole fixture ever produces is missalemeum's own 2 Good
   Friday rows (extract_missalemeum_oracle.py's own header); colitur itself
   never emits [None] for First/Gospel anywhere in this window (Task 8:
   "domain-wide there are now ZERO days with empty citations"), so this is
   the FIRST time a [_unresolved] outcome in this file can fire on the
   colitur side too, in principle, and both are covered. *)
let citation_diff ~mismatch ~unresolved (c : string option) (o : string option) =
  match (c, o) with
  | None, None -> None
  | (None, Some _ | Some _, None) -> Some unresolved
  | Some cs, Some os -> if String.equal (normalize_citation cs) (normalize_citation os) then None else Some mismatch

let diff_fields (c : colitur_row) (o : oracle_row) =
  let c_has = c.c_commemorations <> [] and o_has = o.o_commemorations <> [] in
  List.filter_map
    (fun x -> x)
    [ (if c.c_rank = o.o_rank then None else Some Rank);
      (if List.mem c.c_colour o.o_colours then None else Some Colour_f);
      (if c_has = o_has then None else Some Comm_presence);
      (* Count is only meaningful once presence already agrees (both non-empty):
         a presence mismatch already flags the row via [Comm_presence] above,
         and comparing lengths across a 0-vs-N split would just restate that
         same disagreement under a second name. *)
      (if c_has && o_has && List.length c.c_commemorations <> List.length o.o_commemorations then
         Some Comm_count
       else None);
      identity_diff c o;
      observed_identity_diff c o;
      citation_diff ~mismatch:First_mismatch ~unresolved:First_unresolved c.c_first o.o_first;
      citation_diff ~mismatch:Gospel_mismatch ~unresolved:Gospel_unresolved c.c_gospel o.o_gospel
    ]

(* ---------------------------------------------------------------------- *)
(* The cited allow-list (data/ef/expected-divergences-missalemeum.sexp).  *)
(* Each predicate is gated on an EXACT, literal date set (never a date    *)
(* range or a slug pattern -- with at most 4 dates per id, a literal list *)
(* costs nothing and cannot silently widen to absorb an unrelated future  *)
(* mismatch the way a range could), AND an exact/subset diff shape, the   *)
(* same double-gate test_differential.ml's own [layer_c_reason] uses.     *)
(* ---------------------------------------------------------------------- *)

let subset xs ys = List.for_all (fun x -> List.mem x ys) xs

let contains_substring s ~needle =
  let ls = String.length s and ln = String.length needle in
  let rec at i = i + ln <= ls && (String.sub s i ln = needle || at (i + 1)) in
  ln = 0 || at 0

(* M1 -- RG 33 (corrected, precedence_ef.ml's own [is_omissible_vigil]):
   missalemeum does not implement RG 33's mandatory omission of a II/III-
   class vigil impeded by a Sunday -- 28 June 2026 (Vigil of Sts Peter &
   Paul, II class) still shows a commemoration of the vigil on the V Sunday
   after Pentecost; 9 August 2026 (Vigil of St Lawrence, III class) shows
   the vigil as the day's FULL OBSERVED OFFICE, not merely a commemoration,
   displacing the XI Sunday after Pentecost entirely. Both wrong per RG 33's
   own "in dominica quavis" (ANY Sunday, unqualified) -- verdict colitur. *)
let m1_dates = [ "2026-06-28"; "2026-08-09" ]

(* M2 -- CLOSED, REMOVED (ef-bvm-saturday task), same shape as M12/M17's own
   removal elsewhere in this suite (not re-adjudicated to a different
   verdict, gone because the underlying divergence stopped occurring): RG 91
   entry 27 ("Officium sanctae Mariae in sabbato") is now built
   (Rite_ef.Temporal_ef's own [bvm_saturday_names] citation has the full RG
   78/RG 120(b) argument) -- white, unconditionally, on every otherwise-
   unoccupied IV-class Saturday, so [Colour_f] no longer appears in this
   predicate's own diff set on ANY of these 22 dates (checked: 0 of them
   retain it). What is left on every one of them is [Observed_identity_
   unresolved] ALONE -- colitur's own BVM-Saturday candidate is
   temporal-origin and deliberately carries no ENGLISH name (Latin only,
   the same zero-circularity discipline Holy Family/Holy Name/the Sacred
   Triduum already established) -- which is EXACTLY [M18]'s own shape
   ([diffs = [ Observed_identity_unresolved ]], nothing else disagreeing),
   not a distinct citation any more. Kept as a separate id here would have
   been the same "count proving cardinality where identity was required"
   trap this project's own review process watches for: [subset] admits a
   SMALLER diff set than the one named, so this branch would have kept
   silently absorbing these 22 rows under a stale "colour differs" citation
   even though that citation's own reason no longer fires -- checked
   directly, not assumed: removing this branch and re-running moves the
   count from M2's own former 22 to M18's own count rising by exactly 22
   (373 -> 395, see M18's own note below), with the "no unexplained
   differences" test staying green throughout. *)

(* M3 -- RG 87 (Minor Litanies/Rogations): the SAME gap the lectio
   differential's own C8 already names (data/ef/expected-divergences.sexp)
   -- missalemeum, like lectio, computes no Rogation day at all and shows
   the plain paschaltide-week feria instead. Only ONE date in this window
   shows it (3 May 2027, Rogation Monday) because every other Rogation day
   here is won by a saint anyway (both sides then agree on the SAINT's own
   identity, with only the underlying temporal identity differing, which
   this comparator's rank/colour/commemoration axes do not expose). Verdict
   colitur, same citation as lectio's own C8. *)
let m3_dates = [ "2027-05-03" ]

(* M4 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note for the
   full account (agnes-secundo now present in data/ef/sanctoral.sexp,
   sourced from lectio's independently-fixed generator; the divergence no
   longer occurs on either 2026-01-28 or 2027-01-28). *)

(* M5 -- CORRECTED (ef-major-litanies task): the Major Litanies (RG 80,
   Caput X "De Litaniis maioribus et minoribus") are now built
   (Rite_ef.Precedence_ef's own [major_litanies_slug]/[disposition]/
   [privilege_of] RG 109(f) branch/[transfer_target] RG 80 branch,
   data/ef/adjustments.sexp's matching [Add] entry). This note's own
   PRIOR text (struck below, kept for the record of what was corrected)
   claimed missalemeum's single admitted commemoration on 25 April 2027
   (the Sunday-conflict shape) was "the Major Litanies" -- CHECKED AGAINST
   THE RAW FIXTURE ROW DIRECTLY while adjudicating this task's own new
   divergence (test/fixtures/missalemeum-ef-2026-2027.txt, the 2027-04-25
   line: "...|IV Sunday after Easter|-|St. Mark|Pro rogationibus|1|
   sancti:04-25:2:r") and found BACKWARDS: missalemeum's own
   [commemorations] field for that row is "St. Mark", and "Pro
   rogationibus" (the Litanies) is the one listed in [displaced]. The
   note had the two swapped -- a genuine source-fidelity slip in this
   file's own prior authorship, not a re-reading of a primary document,
   but corrected on the same "read positively, quote it" discipline this
   project applies to the primary scans. See [M20] below for the fix
   this correction actually motivates (2027's own now-real divergence,
   colitur=Litanies vs missalemeum=Mark, adjudicated separately).

   What THIS entry (M5) still covers, unchanged in kind: 25 April 2026 (an
   ordinary, non-Sunday year -- Mark wins the day outright on both sides,
   uncontested). Both engines now admit a commemoration there (colitur:
   [major-litanies]; missalemeum: "Pro rogationibus") -- PRESENCE now
   agrees (closing the register §6 gap this entry used to track), but the
   two engines name the SAME real-world observance in different registers:
   colitur's own English descriptive name (data/ef/adjustments.sexp's own
   honestly-flagged, not-primary-sourced "The Major Litanies") against
   missalemeum's Latin-ish "Pro rogationibus" ("for the Rogations") --
   never going to match as literal strings, and not a rubric dispute at
   all (RG 80/81 do not prescribe an English title for this observance;
   this comparator's own [identity_diff] can only ever compare exact
   strings, the same declared limit [M15]/[M18] already document for
   temporal-origin candidates, now hit here for a different structural
   reason -- a real candidate on both sides, just two different
   vocabularies). Verdict colitur (the identity axis's own declared limit,
   not an error): {!m5_commemoration_matches} pins WHICH candidate colitur
   actually admits here, not merely that some [Comm_identity_mismatch]
   diff exists, the same discipline [M19]'s own identity guard already
   established. *)
let m5_dates = [ "2026-04-25" ]

let m5_commemoration_matches (c : colitur_row) =
  match c.c_commemorations with [ (slug, _, _, _) ] -> String.equal slug "major-litanies" | _ -> false

(* M20 -- ef-major-litanies task, NEW. 25 April 2027: the Sunday-conflict
   shape (RG 80's own condition -- 25 April is Easter Sunday or Monday --
   does NOT fire this year, so the Litanies stay put on 25 April itself,
   which this year happens to be an ordinary II-class Sunday, RG 91 entry
   15). St Mark (II class, RG 91 entry 16) also loses to the Sunday. Two
   losing candidates, ONE slot (RG 111(b)): colitur admits the Litanies,
   NOT Mark; missalemeum's raw fixture row shows the reverse (verified
   directly, not inferred -- see [M5]'s own corrected note above for the
   exact line).

   ADJUDICATED: verdict colitur, RG 109(f) + RG 111(b) (docs/research/
   rules-register.md §4 "Commemorations", both primary-source-verified
   word for word, all three documents): RG 109(f), Caput XVI "De
   Commemorationibus", places "de Litaniis maioribus, in Missa" in the
   SAME closed list as (a)-(e), with equal grammatical standing -- no
   textual qualifier narrows its privilege relative to theirs. RG 111(b),
   same chapter: "in dominicis II classis, una tantum admittitur
   commemoratio, scilicet de festo II classis, QUÆ TAMEN OMITTITUR SI
   COMMEMORATIO PRIVILEGIATA FACIENDA SIT" -- the II-class-feast
   commemoration is DROPPED if a privileged commemoration is due, full
   stop; the clause names no table-order qualifier ("whichever ranks
   higher"), only the categorical fact of a privileged commemoration being
   due. This is the SAME mechanism {!Precedence_ef.admit}'s [Class2, true]
   branch already implements and this project's OWN prior work already
   primary-source-verified for this exact clause (precedence_ef.ml's own
   "Fix, Task 16" comment) -- not new code, not a special case written for
   the Litanies; St Mark simply meets the same fate any other ordinary
   Class2 commemoration meets when a privileged one is also due that
   Sunday (RG 16(a)'s Transfiguration/Sixtus shape is the nearest existing
   witness, though there the privileged side wins the DAY, not merely the
   commemoration slot).

   HONESTLY FLAGGED, not overclaimed: this is the FIRST real, independent
   (non-synthetic) data point this codebase has for "an ordinary Class2
   feast candidate and a privileged non-feast commemoration candidate,
   both losing to the identical Sunday" -- every other witness for
   [admit]'s Class2-Sunday privilege-override branch in this suite's own
   test_precedence_ef.ml is hand-built (real slugs/ranks, but a
   constructed collision, not one the calendar itself produces). Read
   plainly, RG 111(b)'s text supports colitur's outcome; missalemeum's own
   divergence here is consistent with this project's ALREADY-DOCUMENTED
   pattern of RG 108-111 gaps in that oracle (M1: RG 33's Sunday omission
   not implemented; M8: RG 109(a)+RG 111(a) not implemented for an impeded
   I-class Sunday; M10: RG 109(e) inconsistently applied) -- plausibly one
   more instance of the same generator not modelling RG 109(f)'s privilege
   for this one rare, single-date observance, not evidence the general
   RG 111(b) mechanism itself is mis-read. Recorded as an adjudicated
   verdict, not a certainty: if a future primary-source pass finds
   textual grounds narrowing RG 109(f)'s privilege specifically (e.g. a
   clause this task's own scan reading did not surface), this entry is
   the one to revisit first. *)
let m20_dates = [ "2027-04-25" ]

let m20_commemoration_matches (c : colitur_row) =
  match c.c_commemorations with [ (slug, _, _, _) ] -> String.equal slug "major-litanies" | _ -> false

(* M6 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note. Eusebius
   Confessor (14 Aug) is now present in data/ef/sanctoral.sexp
   (eusebius-confessor), so the divergence no longer occurs. *)

(* M7 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note. St
   Evaristus (26 Oct) is now present in data/ef/sanctoral.sexp
   (evaristus), so the divergence no longer occurs. *)

(* M8 -- RG 109(a) ("of a Sunday" is always privileged) + RG 111(a) ("on
   I-class days... none save one privileged"): when a FIXED I-class feast
   (All Saints, 1 Nov; the Assumption, 15 Aug) lands on an ordinary Sunday,
   the impeded Sunday IS the one privileged commemoration RG 111(a) admits
   -- already an established, independently-tested rule in this codebase
   (test_precedence_ef.ml's "RG95/RG109(a): an impeded I-class SUNDAY does
   NOT transfer -- it is Commemorated and Privileged"). missalemeum shows
   no commemoration at all on either occurrence in this window. Verdict
   colitur. *)
let m8_dates = [ "2026-11-01"; "2027-08-15" ]

(* M28 -- the 1962 Missal's own two Judith citations, primary-source-verified
   against the photographic scans this task (branch ef-lectionary) read
   directly, after a live-missalemeum full-year sweep surfaced them:

     Assumption (15 Aug)     scan1:35357, under "IN ASSUMPTIONE BEATAE
                             MARIAE VIRGINIS" -- "Iudith 13, 22-25; 15, 10"
     Seven Sorrows (15 Sep)  scan1:36938, corroborated independently at
                             scan1:28468 -- "Iudith 13, 22 et 23-25"

   Both engines used to carry a chapter-carry-over defect here: lectio's own
   generator emitted "Judith 13:22-25; 13:15; 13:10" for the Assumption
   (inventing two verses out of the second citation's own "15, 10" by
   re-applying chapter 13) and "Judith 13:22; 13:25" for the Seven Sorrows
   (dropping the "et 23-" range). colitur inherited both through its own
   bootstrap -- the "Holy Thursday was violet in both" shared-lineage shape
   this project's own CLAUDE.md names, and the reason layer 3 could never
   have found this: lectio IS the other side of that comparison. Fixed
   upstream in lectio (v0.46.1+) and re-bootstrapped here; missalemeum
   still serves the defective form, so the divergence is now visible on
   layer 4 and adjudicated colitur.

   The predicate pins BOTH sides literally, not merely the diff shape -- the
   C6/C14 failure mode this file's own header documents (a date-and-shape
   gate that would silently swallow a DIFFERENT citation divergence landing
   on the same date). It is also the first reader of [layer_m_reason]'s own
   oracle-row parameter since M2 closed; that parameter was deliberately
   kept named and typed for exactly this ("so a FUTURE oracle-title
   predicate has somewhere to plug back in without a signature change"). *)
let judith_divergence (c : colitur_row) (o : oracle_row) =
  match (c.c_first, o.o_first) with
  (* Assumption *)
  | Some "Judith 13:22-25; 15:10", Some "Judith 13:22-25; 13:15; 13:10" -> true
  (* Seven Sorrows *)
  | Some "Judith 13:22; 13:23-25", Some "Judith 13:22; 13:25" -> true
  | _ -> false

(* 2027-08-15 is deliberately ABSENT here: it carries this divergence AND
   M8's own, independently-caused one (the Assumption falls on a Sunday that
   year), and the classifier admits one entry per day. It is accounted under
   M8, whose own gate names this predicate explicitly rather than widening
   to [First_mismatch] blindly -- neither cause is silently absorbed into
   the other, the same discipline C15's own split from C1 already set. *)
let m28_dates = [ "2026-08-15"; "2026-09-15"; "2027-09-15" ]

(* M9 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note. St
   Theodore (9 Nov) is now present in data/ef/sanctoral.sexp (theodore),
   so the divergence no longer occurs. *)

(* M14 -- REMOVED, ef-rebootstrap (2026-08-12): see data/ef/expected-
   divergences-missalemeum.sexp's own "FIVE MORE REMOVED" note. St
   Boniface Martyr (14 May) is now present in data/ef/sanctoral.sexp
   (boniface-martyr), so the divergence no longer occurs. *)

(* M10 -- RG 109(e), unqualified text ("de feriis Adventus, Quadragesimae
   et Passionis" -- OF THE FERIAS OF ADVENT, not "of the Advent ferias 17-
   23 December only"; that narrower window is RG 91 entry 18's own
   OCCURRENCE-table dignity, a different axis from RG 109's commemoration-
   privilege list, register §4's own citations keep the two separate).
   colitur commemorates the losing early-Advent feria (the Monday after
   Advent I, 30 Nov; the Tuesday/Wednesday after Advent II, 8 Dec) when a
   saint wins those days -- missalemeum shows nothing on these specific
   four rows, even though it DOES show equivalent later-Advent-feria
   commemorations elsewhere in this same window (2-21 December, matching
   colitur exactly on every one of those -- see the task report), which is
   why this reads as a missalemeum-side inconsistency on these four
   particular rows rather than a textually-narrower rule this task missed.
   Verdict colitur. *)
let m10_dates = [ "2026-11-30"; "2027-11-30"; "2026-12-08"; "2027-12-08" ]

(* M11 -- CORRECTED, fix round 1 (F3): this used to claim "no RG paragraph
   found" and verdict colitur. WRONG. RG 67 ("dies infra octavam sunt II
   classis") + RG 109(c) ("de diebus infra octavam Nativitatis Domini") +
   the calendarium's own explicit note under 26/27/28 December ("S.
   STEPHANI PROTOMARTYRIS, II classis. / Com. octavae Nativitatis.", same
   pattern for John the Evangelist and the Holy Innocents) all confirm a
   REAL commemoration is due here -- and it is a genuine regression: before
   Task 16's own commemoration-eligibility fix, colitur happened to
   commemorate the day's generic Christmastide loser unconditionally
   (matching presence, for the wrong reason); the fix (correctly) stopped
   that, but the 26-28 December window's own temporal candidate has the
   WRONG ferial rank to begin with ([ferial_rank]'s Christmastide catch-all
   gives it Class4; RG 67 says II) -- and a naive fix gets RG 69's Sunday
   case backwards (the Sunday, when this window falls on one, commemorates
   the NAMED feast, not the generic octave placeholder). Needs new
   architecture (a commemoration attached to whichever named feast wins,
   not a competing RG 92-95 candidate) or a more careful fix than this
   round attempted. Verdict now OPEN, not colitur -- see the sexp entry's
   own full note and the task report. *)
let m11_dates = [ "2026-12-26"; "2026-12-28"; "2027-12-27"; "2027-12-28" ]

(* M12 -- CLOSED (ef-holyname-rg110 task): RG 110 is now built
   (precedence_ef.ml's own [rg110_additions]/[rg110_companion_slug]), and
   this window's one visible instance -- 22 February 2027 -- no longer
   diverges from missalemeum on [Comm_count] at all: colitur now shows the
   privileged Lent feria's own commemoration AND "St. Paul", same COUNT
   (two) as missalemeum. Removed rather than kept as a dead 0-row citation,
   the SAME shape M17's own removal already established (this file's own
   header): the count pin now enforces that this exact divergence cannot
   silently reappear. NOT closed with zero remaining difference, though --
   see M15's own widened date list immediately below: once count agrees,
   IDENTITY comparison is reached for the first time on this date, and
   trips a SEPARATE, pre-existing, unrelated comparator limit (one of
   colitur's two admitted commemorations, [ef-lent-2-monday], is
   TEMPORAL-origin and carries no English name) -- a newly-exposed
   instance of M15's own gap, not a new one, folded into M15's date list
   rather than kept here under RG 110's own citation, which no longer
   explains ANY part of this row's remaining diff. *)

(* M13 -- OPEN, NOT adjudicated (the brief's own explicit permission,
   "say so as an open item rather than absorbing it"). 19 March 2027: St
   Joseph (I class, 19 March) falls on the Friday of Passion Week. The
   1962 calendarium's own March table carries a standing note, "Feria VI
   post dominicam I Passionis: Commemoratio septem Dolorum B. Mariae
   Virg." (a fixed commemoration of Our Lady's Seven Sorrows for that
   Friday, EVERY year, confirmed real) -- and missalemeum shows Joseph
   entirely DISPLACED that year, with the Friday's own office (III class,
   violet) observed and the Seven Sorrows commemorated instead. RG 91's
   plain table (entry 11-13, I-class feast, vs entry 22, an ordinary III-
   class Passiontide feria) gives Joseph the day outright, with no general
   RG 96 collision requiring a transfer -- so either (a) colitur's plain
   reading is right and missalemeum is wrong, (b) a MORE SPECIFIC rubric
   (most plausibly attached to St Joseph's own Proprium Sanctorum entry,
   the same shape as the Annunciation's own Attamen clause, register §4)
   overrides the general table for this exact collision and this task did
   not find its text, or (c) the Seven Sorrows commemoration itself
   somehow outranks an ordinary I-class feast on this one Friday, which
   nothing found here supports either. Extensive but non-exhaustive
   primary-source search (see the task report) did not settle it.
   Separately, but confirmed regardless of the adjudication above: colitur
   does not implement the Seven-Sorrows-of-Passion-Friday commemoration at
   all, in any year -- a real, primary-attested gap, register §6 open
   item. *)
let m13_dates = [ "2027-03-19" ]

(* M15 -- Task B (branch ef-rg16a), NOT a rubric dispute and NOT a data gap
   either engine is wrong about: a genuine LIMIT of this comparator, honestly
   counted rather than silently passed (the brief's own explicit
   instruction: "a day whose commemoration cannot be matched must be
   visibly counted and reported, not quietly passed"). On 19 of these 20
   rows, colitur's own admitted commemoration is TEMPORAL-origin (an
   impeded Advent/Lent feria) -- Rite_ef.Temporal_ef's own [build]
   (temporal_ef.ml) never sets a celebration's [names] field, so there is no
   English string on colitur's side to compare against missalemeum's title
   text at all (this file's own header, "THE MAPPING, AND EXACTLY WHAT IT
   CANNOT RESOLVE"). Every one of those 19 oracle titles reads as a plain
   prose description of the SAME temporal ferial slot colitur independently
   computes for that date (e.g. 2 Dec 2026: oracle "Feria IV after I Sunday
   of Advent" against colitur's own [ef-advent-1-wednesday]; 4 Dec 2027:
   oracle "Sabbato after I Sunday of Advent" against [ef-advent-1-saturday])
   -- suggestive corroboration, recorded here for a human reader, but NOT
   proof: this comparator has no mechanism to verify English prose against
   an opaque slug, so it does not claim these as verified matches, only as
   unresolved. Fixing this at the ROOT (giving every temporal-cycle
   candidate an English name) is a data/lectionary-bootstrap task, not
   something this comparator can do for itself -- register §6, "RG 113
   tie-break" section's own neighbour, records it as an open item.

   ADDED, ef-holyname-rg110 task: 2027-02-22 -- the closed M12's own date,
   above. NOT the same shape as the other 19 (colitur admits TWO
   commemorations there, not one -- [paul], sanctoral-origin and
   resolvable, and [ef-lent-2-monday], temporal-origin and not): the
   comparator's own [identity_diff] bails out to [Comm_identity_unresolved]
   the moment ANY admitted commemoration is unresolvable, regardless of how
   many others resolve cleanly (test_oracle.ml's own [identity_diff],
   "[List.exists] ... name = None"), so this row reaches the identical
   diagnosis for the identical structural reason, once RG 110 stopped
   [Comm_count] from masking it. Genuinely newly-EXPOSED by this task's own
   fix, not newly-CAUSED by it: the underlying gap (no English name for a
   temporal-cycle candidate) is exactly M15's own pre-existing one. *)
let m15_dates =
  [ "2026-02-24"; "2026-03-19"; "2026-03-25"; "2026-12-02"; "2026-12-03"; "2026-12-04";
    "2026-12-07"; "2026-12-11"; "2026-12-21"; "2027-02-22"; "2027-02-24"; "2027-12-02";
    "2027-12-03"; "2027-12-04"; "2027-12-06"; "2027-12-07"; "2027-12-11"; "2027-12-13";
    "2027-12-16"; "2027-12-21";
    (* WIDENED (Nativity-Octave fix, 2026-08-18): the four days on which
       colitur now commemorates the day within the Octave of the Nativity
       (RG 67/109(c), the calendarium's own "Com. octavae Nativitatis"
       under 26/27/28 December). Both streams commemorate it -- this fix
       closed M11, which existed because colitur commemorated NOTHING
       there -- but the candidate is TEMPORAL-origin, so Temporal_ef sets
       no English name and the comparator cannot resolve its identity
       against missalemeum's "For Octave of the Nativity". Exactly this
       entry's own limit, on four more dates. *)
    "2026-12-26"; "2026-12-28"; "2027-12-27"; "2027-12-28" ]

(* M16 -- Task B: a genuine IDENTITY mismatch, both sides otherwise agreeing
   on rank/colour/count/presence. 27 March 2026 (Friday of Passion Week):
   colitur admits "St. John Damascene" (a real Class3 universal feast that
   genuinely falls that day); missalemeum shows "For Our Lady of the Seven
   Sorrows" instead. The SAME standing gap M13 above already names ("the
   1962 calendarium's own March table carries... 'Feria VI post dominicam I
   Passionis: Commemoratio septem Dolorum B. Mariae Virg.'... a fixed
   commemoration... EVERY year") -- confirmed real, and confirmed
   UNIMPLEMENTED in this codebase (no candidate for it is ever constructed
   in temporal_ef.ml), so colitur has nothing to admit in the Seven
   Sorrows' place and falls back to whichever ordinary Class3 saint
   actually wins that Friday instead. Verdict missalemeum: colitur is
   missing a real, primary-cited office, not differently opinioned.
   Register §6 open item (same one M13/M16's own primary-source note
   already tracks). Only 2026 shows here -- 2027's Friday of Passion Week
   IS 19 March, M13's own date, where the identity axis cannot even be
   reached (M13's own rank/colour mismatch already excludes that day from
   count-matched identity comparison).

   NOTE for whoever builds the office (fix round 1, coordinator finding 7):
   27 March 2026 is a III-class day, where RG 111(d) admits TWO
   commemorations, not one -- yet missalemeum admits only the Seven Sorrows
   and DISPLACES John Damascene entirely (its own "displaced" list carries
   his title that day), not merely drops him to second place. Implementing
   the Seven Sorrows candidate naively (as one more ordinary III-class
   commemoration competing for the day's two slots) will not reproduce
   this: John Damascene would still win one of the two admitted slots by
   dignity/band, giving colitur TWO commemorations where missalemeum shows
   one. Whatever privilege or precedence the Seven Sorrows commemoration
   carries must itself explain the exclusion, not just the admission --
   register §6's own open item for this office should carry this caveat
   forward. *)
let m16_dates = [ "2026-03-27" ]

(* M17 was DELETED, fix round 1 (Task B): the "genuine tie" it adjudicated
   as [open] was itself wrong. 22 September (any year the September Ember
   Wednesday falls on the 22nd -- 2027 in this window): colitur used to
   admit "St. Maurice and Companions, Martyrs" (Commemoration_only, Class3)
   where missalemeum shows "St. Thomas of Villanova" (Feast, Class3) --
   NOT because RG 113 runs out of instruction between two same-rank
   candidates (the framing this entry used to carry), but because
   {!Precedence_ef.band} used to lend a [Commemoration_only] candidate the
   SAME table entry (24) as a genuine [Feast] of its own rank, manufacturing
   a tie the primary text never creates: RG 91's own table enumerates only
   "dies liturgici" (entry 24: "Festa III classis..." -- FEASTS), and the
   calendarium's own 22 September row confirms it in its own notation --
   "S. Thomae de Villanova Ep. et Conf., III classis. / Commemoratio Ss.
   Mauritii et Soc. Mm." -- Thomas carries a class number, Maurice carries
   none. Fixed at the source ([band] itself now returns [Precedence_ef
   .unclassified] for any [Commemoration_only] candidate, docs/research/
   rules-register.md §6.1's own corrected account) rather than here: 22
   September now resolves identically on both sides with no allow-list
   entry needed at all -- removed, not re-adjudicated to a different
   verdict, since there is no longer a divergence to name. *)

(* M18 -- ef-rg112-rg110 task: the gap this file's own header now names under
   "COMMEMORATION IDENTITY", restated for the OBSERVED axis. colitur's own
   observed celebration carries an English name ({!Celebration.t}.names)
   ONLY for a SANCTORAL-origin day (a saint's feast winning outright); a
   TEMPORAL-origin one -- an ordinary Sunday, a feria, a movable named feast
   including Holy Family itself -- never does ({!Rite_ef.Temporal_ef}'s own
   [build] has no [en "..."] string anywhere in it, this file's own header
   again). CORRECTED, fix round 1 (coordinator finding 8) -- the precise
   breakdown: of this window's 730 days, 331 are RESOLVED (330 matching, 1
   mismatched, [M13]); 399 are UNRESOLVED, split between this entry's own
   373 (the axis's sole disagreement) and 26 absorbed inside [M1]/[M2]/[M3]/
   [M16]'s own widened subsets, where it fires ALONGSIDE their pre-existing
   citation. The BLIND SPOT this axis exists to close, stated precisely: a
   TEMPORAL-origin observed day silently replaced by a DIFFERENT
   temporal-origin observed day of the SAME RANK AND COLOUR -- exactly the
   shape that hid Holy Family from every layer before this task. This is
   the OVERWHELMING majority of days in any calendar (saints' feasts are
   common, but far from every day), so this is a single STRUCTURAL
   predicate -- [Observed_identity_unresolved] alone, nothing else
   disagreeing -- not a literal date list the way every other entry in this
   file is: at this population size, a list would be exactly the
   "range/pattern that could silently widen" this file's own header
   explicitly avoids elsewhere, for the OPPOSITE reason a range is normally
   risky here -- the predicate itself (colitur's own name is [None]) is the
   precise, falsifiable evidence, the same shape [M2]'s own title-substring
   predicate already uses instead of a date list, just keyed on
   presence-of-a-name rather than a title string. NOT a rubric dispute and
   NOT a data gap either engine is wrong about -- a LIMIT of this comparator
   itself, honestly counted rather than silently passed, per the brief's own
   explicit instruction ("a day whose observed identity cannot be resolved
   must be a counted, allow-listed outcome, never a silent skip"), the SAME
   discipline [M15] already established for an unresolvable COMMEMORATION,
   applied here for the first time to the OBSERVED day. The count pin below
   ([test_layer_m_counts_match_citations]) is what stands guard against this
   population growing (or shrinking) silently -- it cannot say WHICH day
   moved or why, only that the total did. Fixing this at the root (giving
   every temporal-cycle candidate an English name) is a data/lectionary-
   bootstrap task (Plan 4), not something this comparator can do for itself
   -- register §6 tracks it, the same open item
   [M15]'s own note already points to. *)
(* M19 -- ef-holyname-rg110 task: RG 110's OTHER direction, 30 June (this
   window's two instances -- both years -- of
   [in-commemoratione-sancti-pauli-apostoli], data/ef/adjustments.sexp's
   own `Add commemoration-of-st-peter` directive; see that file's own
   citation for the full scan quote). Unlike 22 February above,
   missalemeum's own row for both dates shows an EMPTY commemorations array
   ("St. Peter" absent, and not even listed as "displaced" -- nothing
   competes for the slot on either side, so there is no candidate for
   missalemeum's own engine to have rejected, only one it never
   constructed): missalemeum has the SAME gap this task's own scan found in
   lectio's source data (`~/git/projects/lectio/internal/caldata/
   tridentine-calendar.ini` has no 06-30 companion entry either) -- a
   genuine feature gap, verdict colitur, the SAME shape as M1/M3/M8/M10
   above (each already "missalemeum does not implement X"), not a
   citation-count coincidence: RG 110's own text is unconditional ("in
   Officio et Missa S. Petri semper fit commemoratio S. Pauli, ET
   VICISSIM"), and the calendarium's own June table states the SAME
   pattern already built for the other two pairs, word for word.

   IDENTITY-GATED, fix round 1 (coordinator finding F2): the predicate
   below now also requires [c.c_commemorations] to be EXACTLY the single
   entry [commemoration-of-st-peter] -- not merely that some [Comm_presence]
   diff exists on these two dates. Proved necessary, not decorative: the
   reviewer added a SECOND, fabricated `Add` directive on 30 June (a
   `bogus-fabricated-companion` slug) to a scratch copy of
   data/ef/adjustments.sexp and found the whole suite stayed green with the
   pre-fix, presence-only predicate -- the exact C6/C14 failure mode (a
   Layer-C-style predicate that pins a date and a diff SHAPE but not WHICH
   candidate). This matters more here than for any other entry in this
   file: `commemoration-of-st-peter` is corroborated by NEITHER oracle (it
   rests on a scan reading alone, data/ef/adjustments.sexp's own citation),
   so this allow-list predicate is the only place in the whole suite that
   could assert what colitur actually emits here -- and, pre-fix, asserted
   nothing about it. Mirrors C16's own identity guard
   (`String.equal c.slug "ef-holy-name"`, test_differential.ml) at the
   analogous decision point in this file. *)
let m19_dates = [ "2026-06-30"; "2027-06-30" ]

let m19_commemoration_matches (c : colitur_row) =
  match c.c_commemorations with
  | [ (slug, _, _, _) ] -> String.equal slug "commemoration-of-st-peter"
  | _ -> false

(* M21 -- ef-sanctoral-audit task (2026-08-14): the SAME closed 14-slug list
   test_differential.ml's own [audit_colour_corrected_slugs] uses (RG 124,
   data/ef/adjustments.sexp's own audit-block comment has the full
   citation), now checked against THIS window's own oracle. Two of the
   fourteen (`apollinaris`, 23 July; `josaphat`, 14 November) and one
   further entry not on the Feast-status list at all (`chair-of-st-peter`,
   22 February, a Feast in its own right, RG124(b)) disagree with
   missalemeum's own colour TOO, not merely lectio's -- a SECOND,
   independent data source repeating the same defect (Apollinaris and
   Josaphat are each martyr-bishops, RG 124(e); Peter's Chair is an
   Apostle's own feast day, RG 124(b) -- both scan-verified word for word,
   data/ef/adjustments.sexp's own comment), so this is not a case of
   "missalemeum corroborates colitur, only lectio disagrees": the primary
   TEXT is what decides it, and missalemeum is simply wrong on these three
   the same way lectio is on all fourteen. [Comm_identity_unresolved] is
   allowed alongside on 22 February specifically: that date's OTHER
   commemoration (the ordinary Lenten feria RG 110 rides in alongside Paul)
   is TEMPORAL-origin and already unresolved for identity, the same
   pre-existing gap [M15]/[M18] elsewhere in this file document -- a
   different axis, not something this entry's own citation explains, so it
   is admitted by the subset check rather than folded into the citation. *)
let m21_colour_slugs =
  [ "conversion-of-st-paul"; "chair-of-st-peter"; "john-of-san-fecundo"; "ephrem-of-syria";
    "julia-of-falconieri"; "john-gualbert"; "camillus-de-lellis"; "jerome-emiliani"; "apollinaris";
    "martha"; "alphonsus-liguori"; "augustine"; "rose-of-lima"; "josaphat" ]

(* M22 -- ef-sanctoral-audit task: `barbara` (4 December, data/ef/
   adjustments.sexp's own new `Add`) is a genuine DATA GAP in missalemeum
   too, the identical shape M1/M3/M8/M10/M19 above already document (each
   "missalemeum does not implement X"): both years' own 4 December row
   shows only the Advent feria's own temporal commemoration, no Barbara at
   all, not even displaced -- missalemeum never constructed a candidate for
   her either, the same absence lectio's own tridentine-calendar.ini has
   (data/ef/adjustments.sexp's own `Add barbara` comment). Identity-gated
   the same way [M19] is (coordinator finding F2): the predicate requires
   colitur's own admitted set to be EXACTLY the temporal feria plus
   `barbara`, not merely that SOME count diff exists on this date, so a
   future unrelated regression on 4 December cannot silently hide behind
   this citation. *)
let m22_dates = [ "2026-12-04"; "2027-12-04" ]

let m22_commemoration_matches (c : colitur_row) =
  match List.map (fun (slug, _, _, _) -> slug) c.c_commemorations with
  | [ a; b ] -> (String.equal a "barbara") <> (String.equal b "barbara")
  | _ -> false

(* M23 -- Task 9 (branch ef-lectionary, layer-4 oracle): Good Friday, both
   years. missalemeum's own JSON has no "Lectio"/"Evangelium" section at
   all for this one day (a multi-lesson "Missa Praesanctificatorum"
   structure instead, "Lectiones"/"Passio", the SAME shape colitur's own
   Holy Week data hit at bootstrap time -- tools/
   extract_missalemeum_oracle.py's own header has the extraction detail)
   -- a comparator-structural absence on the ORACLE side, the mirror image
   of [Comm_identity_unresolved]'s own colitur-side absence, not a rubric
   dispute: colitur's own citation (Ex 12:1-11/John 18:1-40; 19:1-42,
   tools/bootstrap_lectionary.ml's own [holy_week_entries], Missal-verified
   twice) is correct and complete, missalemeum's fixture simply has nothing
   comparable to check it against. *)
let m23_dates = [ "2026-04-03"; "2027-03-26" ]

(* M24 -- Task 9: four Holy Week rows where missalemeum's own Gospel
   citation embeds a LATIN book abbreviation ("Luc"/"Joann") instead of its
   own usual English one ("Luke"/"John") -- checked directly against the
   raw JSON, not assumed: every OTHER citation in the fixture, including
   these same four rows' own Epistle, uses English throughout. A source
   presentation quirk on missalemeum's own side (its English-translation
   layer appears to have a template gap for these four Gospel citations
   specifically), not a different Scripture reference -- the same
   underlying verses, same chapter/verse numbers, confirmed identical
   after every OTHER normalisation this file's own [normalize_citation]
   already applies. Not folded into that function (a two-entry Latin/
   English book-name table would be the first step of a general
   translation layer this project's own citation discipline deliberately
   does not build -- the SAME limit M5 already names for a different
   vocabulary gap) -- named here instead, narrowly, as what it is. *)
let m24_dates = [ "2026-04-01"; "2026-04-02"; "2027-03-24"; "2027-03-25" ]

(* M25 -- Task 9: four Lenten rows where the underlying verse range is
   IDENTICAL but the two sources punctuate its own internal boundary
   differently -- "4 Kings 5:1-15" (colitur) vs "4 Kings, 5:1-15"
   (missalemeum, a spurious comma after the book name with no citation
   content of its own) on 2026-03-09/2027-03-01; "Dan 14:27, 28-42"
   (colitur, verse 27 named separately then 28-42) vs "Dan 14:27-42"
   (missalemeum, the identical span as one contiguous range) on
   2026-03-24/2027-03-16. Neither is a book/chapter/verse-NUMBER
   difference [normalize_citation] could safely absorb without also
   risking silently equating two GENUINELY different verse lists
   elsewhere in the fixture (e.g. a real "12, 15-20" vs "12-20" would
   look identical to this rule but mean different things) -- named
   individually instead, the same discipline M5's own identity-gated
   predicate already applies to a citation-vocabulary gap. *)
let m25_dates = [ "2026-03-09"; "2026-03-24"; "2027-03-01"; "2027-03-16" ]

(* M26 -- Task 9: the remaining population, one root cause,
   TWO NAMEABLE SHAPES -- CORRECTED, fix round 1 (coordinator review,
   Important 3): a prior version of this entry described three shapes,
   the third an unexplained "23-row residue... not narrowed to a single
   citable rule at all". That bucket was EMPTY -- every one of the 30
   dates classifies cleanly into one of the two shapes below; the
   "residue" framing buried a real, nameable defect instead of recording
   it. {!Rite_ef.Lectionary_ef.readings}'s own header comment already
   names the underlying LIMIT, not a rubric dispute this task settled:
   step 3 ("a feria with no proper says the preceding SUNDAY's Mass") is
   colitur's only fallback mechanism, and its own WARRANT is "lectio's
   own observed behaviour... not a confirmed Missal citation" --
   register's own standing note. missalemeum's own ferial-Mass selection
   is more granular than that single rule in two distinct, CONFIRMED ways
   (the same "needs a season-keyed selection mechanism, new behaviour not
   new data" shape data/ef/expected-divergences.sexp's own C6/C25 entries
   already carry for the sibling lectio differential, and Task 6's own
   residual concern 4/5, "the BVM Saturday Office still emits its feria's
   Mass... needs... a season-keyed selection among five formularies" --
   RG 309(a), "iuxta temporum diversitatem"):

   SHAPE 1 -- 21 rows, EVERY ONE A SATURDAY: a rotating VOTIVE MASS OF THE
   BVM ("Missae de sancta Maria in sabbato" I-V, missalemeum's own
   "II/III/V Mass of the B. V. M." titles) on an otherwise-unoccupied
   IV-class Saturday -- RG 78's own Office throughout, and RG 309(a)'s own
   "iuxta temporum diversitatem" selection of WHICH of the five Masses it
   says.

   CORRECTED, fix round 2: this read "on an otherwise-unoccupied feria, not
   only a Saturday", and split the 21 into 4 BVM-Saturday rows plus "the
   other 17 ... ordinary weekday ferias in Time after Pentecost". Both
   halves of that are wrong, and the error was not merely verbal -- it made
   the gap look BROADER than a single cause, and pointed the diagnosis away
   from the one rule that actually explains all 21. Every date was checked
   individually against `date -d`, not inferred: the 17
   (2026-02-14/06-20/06-27/07-04/07-11/08-01/10-31/11-07/11-28;
   2027-07-17/07-24/09-04/09-11/10-30/11-06/11-13/11-27) are Saturdays
   exactly like the four January ones. The real distinction between the two
   sub-groups is SEASON, not weekday, and it matters only for what colitur
   shows in the votive Mass's place: the four Christmastide rows
   (2026-01-03/2027-01-09, `ef-christmas-1-saturday`, C25's own unchanged
   population in the sibling lectio differential; 2026-01-10/2027-01-02,
   `ef-christmas-2-saturday`) show its own step-3 ferial fallback, the 17
   Time-after-Pentecost rows its own season fallback. ONE gap, not two:
   colitur builds the Office itself (RG 91 entry 27, register §6.4) but not
   the seasonal selection among the five Masses, which that task
   deliberately deferred to the lectionary as a Mass-propers question
   rather than an office question.

   SHAPE 2 -- 9 rows, a SECOND, DIFFERENT and DISTINCT gap: ferias of a
   week whose own Sunday was DISPLACED that year by a movable, named
   temporal-cycle feast, where the Missal requires the DISPLACED
   Sunday's own Mass to continue informing that week's ferias, but step 3
   walks back to the DISPLACING feast's citation instead (the SAME
   Sunday's own OFFICE is displaced; its own reading is not). Two
   witnessed instances, not a residue: (a) 2026-06-02/03 and 2027-05-24,
   the ferias between Trinity Sunday and Corpus Christi -- the Missal
   prints a named formula for exactly this week, "Missa Dominicae I post
   Pentecosten" (1 Ioann. 4,8-21 / Luc. 6,36-42, docs/research/
   scan1.txt:21758-21830, found while researching Corpus Christi's own
   Mass immediately following it) -- but colitur's step 3 walks back to
   Trinity SUNDAY's own citation (Rom 11:33-36, the generic Time-after-
   Pentecost fallback), not this named formula, since [ef-corpus-christi]
   now correctly interrupts Trinity's own week at step 2 (this task's own
   fix) and step 3's walkback from the Tuesday/Wednesday after it lands
   one Sunday further back than the week actually calls for; (b)
   2026-10-26/27/29/30 and 2027-11-03/05, the ferias of the week Christ
   the King (I class, movable, "Dominica ultima octobris") displaces --
   colitur's own citation on all six is LITERALLY Christ the King's own
   Gospel (John 18:33-37, "Art thou a king?"), confirming step 3 walked
   back to the DISPLACING feast, not the displaced ordinary Sunday;
   missalemeum shows a different citation each row (the displaced
   Sunday's own, varying by year). No Missal-propers rubric for Christ
   the King's own week ferias was found the way Holy Name/Holy Family's
   own each carry one (checked: no rubric text precedes Christ the
   King's own Mass heading, scan1.txt:39140-39163, unlike the two
   feasts C30/C31/C32 above document) -- this half is named from the
   OBSERVED citation evidence itself (colitur's own value IS the
   displacing feast's, missalemeum's is not), not from a located
   propers rubric; the general mechanism (a week's own ferias follow its
   OWN Sunday's temporal identity even when that Sunday is impeded that
   year) is the same shape RG 69 already establishes for the Nativity
   Octave (C6's own citation) and RG 96's own general transfer framework
   assumes throughout, but no citation SPECIFIC to Christ the King's own
   week was found or is claimed here.

   Neither shape is safe to fix inside this task's own scope (extending
   layer 4 + triage) without the same real, dedicated, TDD/mutation-tested
   unit of work C6/C25 and Task 6's own open item already call for.
   Verdict open, the SAME fourth verdict M15/M18 already establish for a
   genuine comparator/architecture LIMIT, honestly counted and NAMED
   rather than silently absorbed, left failing, or buried in an
   unexplained residue. A literal date list, not a shape predicate (no
   single structural signal -- unlike C17's own [subject = bvm] -- exists
   to distinguish this population from a genuinely new, unrelated
   citation bug on some other Time-after-Pentecost feria): the SAME
   discipline this file's own header names for every other entry here. *)
let m26_dates =
  [ "2026-01-03"; "2026-01-10"; "2026-02-14"; "2026-06-02"; "2026-06-03"; "2026-06-20"; "2026-06-27";
    "2026-07-04";
    "2026-07-11"; "2026-08-01"; "2026-10-26"; "2026-10-27"; "2026-10-29"; "2026-10-30"; "2026-10-31";
    "2026-11-07"; "2026-11-28"; "2027-01-02"; "2027-01-09"; "2027-05-24"; "2027-07-17"; "2027-07-24";
    "2027-09-04"; "2027-09-11"; "2027-10-30"; "2027-11-03"; "2027-11-05"; "2027-11-06"; "2027-11-13";
    "2027-11-27" ]

(* M27 -- Task 9: Christmas Day, both years. Christmas has THREE Masses in
   the 1962 Missal (Midnight/"in nocte", Dawn/"in aurora", Day/"in die"),
   each with its own distinct Epistle+Gospel -- missalemeum's own JSON
   array has all three, but tools/extract_missalemeum_oracle.py's own
   convention (documented in its header, verified for every OTHER field
   this fixture reads) takes entry[0] uniformly, which for THIS one day is
   the Midnight Mass (Titus 2:11-15/Luke 2:1-14) -- colitur's own citation
   (Heb 1:1-12/John 1:1-14, bootstrapped from lectio, matching the
   Day Mass, the conventional "default" answer to "what does 25 December
   read") is a DIFFERENT, also-genuine Mass of the identical day, not a
   wrong one. A comparator/fixture-extraction artefact (which of several
   equally-real Masses a multi-Mass day's own entry[0] happens to be), the
   SAME limit family as M23's own oracle-side absence -- not a rubric
   dispute, and not fixed by changing the extractor's own array-index
   convention, which the extraction script's own header already
   documents as deliberate and verified for every OTHER field this
   fixture reads (rank/colours/tempora/commemorations/displaced, all
   confirmed IDENTICAL across a day's own multiple Masses -- only the
   citation fields are not, discovered by this task). *)
let m27_dates = [ "2026-12-25"; "2027-12-25" ]

(* The oracle's own row went unused when M2 -- its one reader, via
   [o.o_title] -- was closed/removed (see the comment above [m1_dates]), and
   was kept as a named, typed parameter rather than dropped from the
   signature "so a FUTURE oracle-title predicate has somewhere to plug back
   in without a signature change". Task 9 (branch ef-lectionary) is that
   future: {!judith_divergence} pins the ORACLE's own citation as well as
   colitur's, so the parameter is live again and no longer underscored. *)
let layer_m_reason (c : colitur_row) (o : oracle_row) diffs =
  if diffs = [] then None
  (* M1's own subset widened (this task): colitur's observed day on both
     dates is TEMPORAL-origin (the Sunday itself, RG33's own point -- the
     vigil should never have displaced it), so it now ALSO carries
     [Observed_identity_unresolved] -- the same root cause the file's other
     widened entries below share, restated for this one's own shape.
     WIDENED AGAIN, Task 9 (branch ef-lectionary, layer-4 oracle):
     [First_mismatch]/[Gospel_mismatch] join the accepted set -- once the
     OBSERVED day itself differs (the vigil vs the Sunday RG 33 requires),
     its own reading citation is a natural CONSEQUENCE of that same
     identity divergence, not a second, independent cause (the same
     "identity already differs, so citation differs too" reasoning
     test_differential.ml's own C14/C15/C16/C29 already establish). *)
  else if List.mem c.c_date m1_dates
          && subset diffs
               [ Rank; Colour_f; Comm_presence; Observed_identity_unresolved; First_mismatch; Gospel_mismatch ]
  then Some "M1"
  (* M2 -- CLOSED, REMOVED (ef-bvm-saturday task): see this file's own M2
     note above (near [m1_dates]) for the full account -- the RG 91 entry 27
     office is now built, so every one of these 22 dates now falls through
     to [M18]'s own generic predicate below instead ([diffs = [
     Observed_identity_unresolved ]] exactly), which is what actually
     catches them now. *)
  (* M3's own subset widened (this task): the Rogation Monday feria colitur
     observes is temporal-origin, same root cause as M1/M2 above. *)
  else if List.mem c.c_date m3_dates && subset diffs [ Colour_f; Observed_identity_unresolved ] then
    Some "M3"
  else if List.mem c.c_date m5_dates && diffs = [ Comm_identity_mismatch ] && m5_commemoration_matches c then
    Some "M5"
  (* M8's own gate widened, Task 9 fix (branch ef-lectionary): 2027-08-15 is
     BOTH an impeded-Sunday day (M8's own cause) and a Judith-citation day
     (M28's), and the classifier admits one entry per day. [Comm_presence]
     stays REQUIRED -- M8's own divergence must actually be present, so this
     can never degrade into a bare citation gate -- and [First_mismatch] is
     admitted only when it is exactly the M28 shape, both sides pinned. A
     citation divergence of any OTHER shape, on either M8 date, still
     escapes to unexplained. *)
  else if
    List.mem c.c_date m8_dates
    && subset diffs [ Comm_presence; First_mismatch ]
    && List.mem Comm_presence diffs
    && ((not (List.mem First_mismatch diffs)) || judith_divergence c o)
  then Some "M8"
  else if List.mem c.c_date m28_dates && diffs = [ First_mismatch ] && judith_divergence c o then Some "M28"
  else if List.mem c.c_date m10_dates && diffs = [ Comm_presence ] then Some "M10"
  else if List.mem c.c_date m11_dates && diffs = [ Comm_presence ] then Some "M11"
  (* M13's own subset widened AGAIN (this task, following the SAME pattern
     Task B's own widening comment below records): colitur's observed
     celebration here is Joseph, SANCTORAL-origin, so its name IS
     resolvable -- and disagrees with missalemeum's own title outright
     ([Observed_identity_mismatch], not [_unresolved]), the SAME underlying
     gap (the Seven Sorrows commemoration is never constructed, so colitur
     has no candidate to observe OR commemorate in its place) now visible
     on a THIRD axis. *)
  (* WIDENED AGAIN, Task 9 (branch ef-lectionary, layer-4 oracle):
     [First_mismatch]/[Gospel_mismatch] join the accepted set -- colitur's
     OBSERVED day here is Joseph, whose own citations differ from
     missalemeum's own Seven-Sorrows-of-Passion-Friday citation for the
     identical, already-named reason (the Seven Sorrows commemoration is
     never constructed, so colitur observes Joseph outright instead), not
     a fourth, independent cause. *)
  else if List.mem c.c_date m13_dates
          && subset diffs
               [ Rank; Colour_f; Comm_identity_unresolved; Observed_identity_mismatch; First_mismatch;
                 Gospel_mismatch
               ]
  then Some "M13"
  else if List.mem c.c_date m15_dates && diffs = [ Comm_identity_unresolved ] then Some "M15"
  (* M16's own subset widened (this task): colitur's observed celebration
     here is the temporal Passiontide feria (John Damascene is only a
     COMMEMORATION on this Feast-status-losing day -- band picks the
     temporal candidate outright at Class3 rank, register's own account of
     this date), so [Observed_identity_unresolved] now fires alongside the
     pre-existing [Comm_identity_mismatch]. *)
  (* M16 RE-ADJUDICATED (2026-08-17): the diff SHAPE changed because the cause
     did. colitur now builds the Seven Sorrows commemoration of Passion Friday
     (data/ef/adjustments.sexp), so the old [Comm_identity_mismatch] -- colitur
     admitting John Damascene where missalemeum showed the Seven Sorrows -- is
     gone: both streams now name the Seven Sorrows. What remains is a COUNT
     difference running the other way, colitur admitting two commemorations
     against missalemeum's one. [Comm_count] is REQUIRED so this cannot quietly
     absorb a day whose only difference is the unresolved observed identity,
     which is M18's own generic shape. *)
  else if
    List.mem c.c_date m16_dates
    && subset diffs [ Comm_count; Observed_identity_unresolved ]
    && List.mem Comm_count diffs
  then Some "M16"
  else if diffs = [ Observed_identity_unresolved ] then Some "M18"
  else if List.mem c.c_date m19_dates && diffs = [ Comm_presence ] && m19_commemoration_matches c then
    Some "M19"
  else if
    List.mem c.c_observed_slug m21_colour_slugs && diffs = [ Colour_f ]
  then Some "M21"
  else if List.mem c.c_date m22_dates && diffs = [ Comm_count ] && m22_commemoration_matches c then
    Some "M22"
  else if
    List.mem c.c_date m20_dates
    && subset diffs [ Comm_identity_mismatch; Observed_identity_unresolved ]
    && m20_commemoration_matches c
  then Some "M20"
  else if
    List.mem c.c_date m23_dates
    && subset diffs [ Observed_identity_unresolved; First_unresolved; Gospel_unresolved ]
  then Some "M23"
  else if List.mem c.c_date m24_dates && subset diffs [ Observed_identity_unresolved; First_mismatch; Gospel_mismatch ]
  then Some "M24"
  else if List.mem c.c_date m25_dates && subset diffs [ Observed_identity_unresolved; First_mismatch ] then
    Some "M25"
  else if
    List.mem c.c_date m26_dates
    && subset diffs [ Observed_identity_unresolved; First_mismatch; Gospel_mismatch ]
  then Some "M26"
  else if
    List.mem c.c_date m27_dates
    && subset diffs [ Observed_identity_unresolved; First_mismatch; Gospel_mismatch ]
  then Some "M27"
  else None

(* ---------------------------------------------------------------------- *)
(* data/ef/expected-divergences-missalemeum.sexp loading -- same shape as  *)
(* test_differential.ml's own [allow_entry]/[load_allow_list]. *)
(* ---------------------------------------------------------------------- *)

open Sexplib0.Sexp_conv

type allow_entry = { id : string; citation : string; verdict : string; note : string; expected_rows : int }
[@@deriving sexp]

let load_allow_list () =
  let sexps =
    try Sexplib.Sexp.load_sexps allow_list_path
    with e -> Alcotest.failf "%s: failed to load: %s" allow_list_path (Printexc.to_string e)
  in
  List.map allow_entry_of_sexp sexps

(* ---------------------------------------------------------------------- *)
(* The comparison itself. *)
(* ---------------------------------------------------------------------- *)

type outcome = Matched | Explained of string | Unexplained of field list

let compare_streams () =
  let oracle = oracle_rows () in
  let colitur = colitur_rows ~from_year:2026 ~to_year:2027 in
  (oracle, colitur)

let classify oracle colitur =
  List.map2
    (fun (o : oracle_row) (c : colitur_row) ->
      if not (String.equal o.o_date c.c_date) then
        Alcotest.failf "streams misaligned: oracle %s vs colitur %s" o.o_date c.c_date;
      let diffs = diff_fields c o in
      if diffs = [] then (c, o, Matched)
      else
        match layer_m_reason c o diffs with
        | Some id -> (c, o, Explained id)
        | None -> (c, o, Unexplained diffs))
    oracle colitur

let status_to_string = function Cel.Feast -> "Feast" | Cel.Commemoration_only -> "Commemoration_only"

let describe_comm (slug, rank, status, name) =
  Printf.sprintf "%s(rank=%d,status=%s,name=%s)" slug rank (status_to_string status)
    (match name with Some n -> Printf.sprintf "%S" n | None -> "NONE")

let describe_opt = function Some s -> Printf.sprintf "%S" s | None -> "NONE"

let describe_unexplained (c : colitur_row) (o : oracle_row) diffs =
  Printf.sprintf "%s: %s differ -- colitur=(rank=%d colour=%c comms=[%s] first=%s gospel=%s) \
                   oracle=(rank=%d colours=[%s] title=%S comms=[%s] comm_ids=[%s] displaced=[%s] first=%s \
                   gospel=%s)"
    c.c_date
    (String.concat "," (List.map field_name diffs))
    c.c_rank c.c_colour
    (String.concat ";" (List.map describe_comm c.c_commemorations))
    (describe_opt c.c_first) (describe_opt c.c_gospel)
    o.o_rank
    (String.concat "" (List.map (String.make 1) o.o_colours))
    o.o_title
    (String.concat ";" o.o_commemorations)
    (String.concat ";" o.o_commemoration_ids)
    (String.concat ";" o.o_displaced)
    (describe_opt o.o_first) (describe_opt o.o_gospel)

let test_fixture_checksum () =
  Alcotest.(check string) "fixture SHA-256 matches its provenance note" fixture_sha256
    (sha256_of_file fixture_path)

let test_dates_align () =
  let oracle, colitur = compare_streams () in
  Alcotest.(check int) "both streams have 730 rows (2026 + 2027, both non-leap)" 730 (List.length oracle);
  Alcotest.(check int) "colitur recomputed the same number of rows" (List.length oracle) (List.length colitur);
  let mismatched =
    List.filter_map
      (fun (o, c) -> if String.equal o.o_date c.c_date then None else Some (o.o_date, c.c_date))
      (List.combine oracle colitur)
  in
  Alcotest.(check (list (pair string string))) "no misaligned dates" [] mismatched

(* The core assertion: every one of the 63 raw differences across all six
   axes (rank, colour-membership, commemoration-presence, commemoration-
   count, and, since Task B/ef-rg16a, commemoration-identity-mismatch and
   commemoration-identity-unresolved) is named in the cited allow-list.
   Nothing else passes silently. *)
let test_no_unexplained_differences () =
  let oracle, colitur = compare_streams () in
  let classified = classify oracle colitur in
  let unexplained =
    List.filter_map
      (fun (c, o, outcome) ->
        match outcome with Unexplained diffs -> Some (describe_unexplained c o diffs) | _ -> None)
      classified
  in
  Alcotest.(check (list string)) "no differences outside the cited allow-list" [] unexplained

(* Teeth, not just green: EVERY allow-list id's actual row count over this
   fixture must equal what data/ef/expected-divergences-missalemeum.sexp
   declares, in BOTH directions -- the same double-check test_differential
   .ml's own "Layer C counts match citations" test makes for the lectio
   allow-list. *)
let test_layer_m_counts_match_citations () =
  let oracle, colitur = compare_streams () in
  let classified = classify oracle colitur in
  let actual_counts = Hashtbl.create 16 in
  List.iter
    (fun (_, _, outcome) ->
      match outcome with
      | Explained id ->
          Hashtbl.replace actual_counts id (1 + Option.value ~default:0 (Hashtbl.find_opt actual_counts id))
      | _ -> ())
    classified;
  let declared = load_allow_list () in
  let expected = List.sort compare (List.map (fun e -> (e.id, e.expected_rows)) declared) in
  let actual = List.sort compare (Hashtbl.fold (fun id n acc -> (id, n) :: acc) actual_counts []) in
  Alcotest.(check (list (pair string int)))
    "every allow-list id's actual row count matches its citation's expected_rows, and no id is unused or \
     undeclared"
    expected actual

(* Corroboration (Task B): for every day where the identity axis is CLEAN
   (no [Comm_identity_mismatch]/[Comm_identity_unresolved] -- titles matched
   as a set), independently cross-check missalemeum's own id-embedded rank
   digit against colitur's OWN candidate rank for that SAME title -- a
   SECOND, independent signal beyond string equality (this file's own
   header: "used only as a corroborating check, never as the primary
   signal"). Restricted to "sancti:"-origin ids (a TEMPORAL-origin oracle
   commemoration has no colitur-side name to pair it with in the first
   place, see [Comm_identity_unresolved]'s own days, which never reach here
   since their identity axis is not clean).

   SPLIT BY STATUS -- a genuine finding from running this check, not the
   originally-planned single assertion: EVERY ONE of colitur's 114
   [Commemoration_only] sanctoral entries carries a bootstrap-assigned
   [rank Class3] (verified: `grep -c "status Commemoration_only"` and
   `grep -B3 ... | grep -oP "rank Class\d" | sort | uniq -c` both give
   114/114 Class3, data/ef/sanctoral.sexp) -- but missalemeum's OWN id-rank
   for a [Commemoration_only] match is NOT itself uniform: of the 175
   examined, 17 genuinely AGREE (oracle_rank = colitur_rank = 3, real
   corroboration) and 158 show oracle_rank 4 against colitur's bootstrapped
   3 -- CORRECTED after the first version of this comment overclaimed "id
   consistently encodes 4 for every entry" from the 158-strong failure list
   alone, before the 17 agreeing rows (then hidden inside a too-strict
   assertion) were found. Two acceptable shapes, then, not one: either the
   ranks genuinely agree, or the specific oracle=4/colitur=3 gap holds. This
   is not evidence of a title-matching error, and not new: it independently
   corroborates the register's own already-open item (§6, "Commemoration-
   only entries' inferred STATUS, not only rank" -- Task 16's own data
   audit already flagged these ranks as bootstrap inferences, never
   individually Missal-verified). Auditing which of the 114 are genuinely
   Class3 and which were silently defaulted to it is that item's own scope,
   not this task's -- so rather than either asserting a false universal
   equality (which fails on the 158 KNOWN, tracked, out-of-scope rows) or
   silently dropping the check, this pins the discovered SHAPE itself:
   every [Commemoration_only] match is EITHER a real agreement OR the known
   gap, with no THIRD pattern -- a real, falsifiable claim (any other
   combination would break it) that stays honest about what remains
   unverified.

   WHAT THIS DOES NOT PIN (coordinator finding 8, fix round 1, honestly
   named rather than left implicit): the [oracle_rank = colitur_rank]
   branch accepts ANY genuine agreement, including one this check cannot
   independently verify is the CORRECT rank -- a regression that silently
   flipped some entry's [rank] from [Class3] to [Class4] would land in the
   agreement branch and pass cleanly if missalemeum's own id happened to
   read 4 for that entry too (data drift on one side coinciding with data
   drift on the other is not ruled out by this check, only coincidence
   independent of any real cause is). This test pins "no third pattern
   appears", not "every individual rank is correct" -- a narrower, still
   genuinely useful claim (see the [> 50] population guard below, which
   confirms the pinned shape is actually exercised at scale, not vacuously
   true over an empty or trivial set), and this comment says so rather than
   letting the assertion's own name imply more than it checks.

   [Feast]-status candidates get the ORIGINAL, unrestricted check (any
   disagreement at all is unexpected). CORRECTED (fix round 1, coordinator
   finding 1): this comment previously claimed this branch was unreachable
   in the 2026-2027 window (checked: 0) because its one candidate, Thomas
   of Villanova on 22 September, was M17's own mismatch -- WRONG, once
   traced further: M17 itself was wrong (see {!Precedence_ef.band}'s own
   fidelity fix, register §6.1), and fixing it made 22 September resolve
   cleanly on both sides, reachable here after all. Measured, not assumed:
   22 Feast-status commemorations are now examined by this branch (not
   only Thomas of Villanova -- every OTHER genuinely clean Feast-status
   match in the window reaches it too, which the earlier version of this
   comment did not check for before asserting "0"). All 22 agree. *)
let test_identity_rank_corroboration () =
  let oracle, colitur = compare_streams () in
  let feast_checked = ref 0 in
  let feast_mismatches = ref [] in
  let commemoration_only_checked = ref 0 in
  let commemoration_only_surprises = ref [] in
  List.iter2
    (fun (o : oracle_row) (c : colitur_row) ->
      if
        identity_diff c o = None && c.c_commemorations <> [] && o.o_commemorations <> []
        && List.length c.c_commemorations = List.length o.o_commemorations
      then
        List.iter2
          (fun title id ->
            if is_sancti_id id then
              match id_rank id with
              | None -> ()
              | Some oracle_rank -> (
                  match List.find_opt (fun (_, _, _, n) -> n = Some title) c.c_commemorations with
                  | Some (slug, colitur_rank, Cel.Feast, _) ->
                      incr feast_checked;
                      if colitur_rank <> oracle_rank then
                        feast_mismatches :=
                          Printf.sprintf "%s: %s oracle-id-rank=%d colitur-rank=%d" c.c_date slug
                            oracle_rank colitur_rank
                          :: !feast_mismatches
                  | Some (slug, colitur_rank, Cel.Commemoration_only, _) ->
                      incr commemoration_only_checked;
                      (* Two ACCEPTABLE shapes, not one -- corrected after first running this
                         check: most Commemoration_only entries genuinely agree
                         (oracle_rank = colitur_rank, real corroboration, 17 of the
                         population checked), and the rest show the KNOWN
                         oracle=4/colitur=3 convention gap (this comment's own header).
                         Anything OUTSIDE those two shapes (e.g. oracle=2 or a THIRD
                         colitur rank paired with a non-4 oracle rank) is a genuine
                         surprise. *)
                      if not (oracle_rank = colitur_rank || (oracle_rank = 4 && colitur_rank = 3)) then
                        commemoration_only_surprises :=
                          Printf.sprintf "%s: %s oracle-id-rank=%d colitur-rank=%d (neither agrees nor \
                                          fits the known oracle=4/colitur=3 pattern)"
                            c.c_date slug oracle_rank colitur_rank
                          :: !commemoration_only_surprises
                  | None -> ()))
          o.o_commemorations o.o_commemoration_ids)
    oracle colitur;
  Alcotest.(check (list string))
    "Feast-status matches: oracle id-rank agrees with colitur's own rank" [] (List.rev !feast_mismatches);
  Alcotest.(check (list string))
    "Commemoration_only-status matches: every one fits the KNOWN oracle=4/colitur=3 convention gap -- any \
     other combination would be a genuine, new surprise"
    [] (List.rev !commemoration_only_surprises);
  (* Vacuity guard: BOTH branches must actually run now. CORRECTED (fix
     round 1, coordinator finding 1): the [Feast] branch used to be
     unreachable in this window (checked: 0) because its one candidate,
     Thomas of Villanova on 22 September, was M17's own mismatch (excluded
     by the [identity_diff = None] guard above). Fixing {!Precedence_ef
     .band}'s Commemoration_only fidelity (register §6.1) made that day
     resolve cleanly, so it is reachable here too -- this guard now expects
     at least 1, not merely documents the branch as dormant (measured: 22
     Feast-status commemorations now examined, up from 0). *)
  Alcotest.(check bool) "the Feast-status population actually examined is non-trivial" true (!feast_checked > 0);
  Alcotest.(check bool) "the Commemoration_only population actually examined is non-trivial" true
    (!commemoration_only_checked > 50)

let suite =
  ( "oracle (missalemeum, EF, 2026-2027)",
    [ Alcotest.test_case "fixture SHA-256 matches its provenance note" `Quick test_fixture_checksum;
      Alcotest.test_case "streams are 730 rows each, dates aligned 1:1" `Quick test_dates_align;
      Alcotest.test_case "every difference is named in the cited allow-list -- none unexplained" `Quick
        test_no_unexplained_differences;
      Alcotest.test_case "allow-list counts match data/ef/expected-divergences-missalemeum.sexp exactly"
        `Quick test_layer_m_counts_match_citations;
      Alcotest.test_case
        "identity corroboration: matched titles' oracle id-rank agrees with colitur's own rank" `Quick
        test_identity_rank_corroboration
    ] )

(* ====================================================================== *)
(* The 2038 oracle extension (2026-08-17)                                 *)
(* ====================================================================== *)

(* A SECOND, INDEPENDENT oracle year, deliberately kept apart from the
   2026-2027 comparison above rather than folded into it.

   WHY 2038. Register §6.7 recorded that step 4 of the reading chain -- the
   Common route -- had no external witness at all. Only five saints route
   through a Common, and across 2005-2050 they are the OBSERVED office on
   five days total; not one falls in the 2026-2027 window. 2038 is the year
   covering TWO of the five at once (`sts-felicitas-perpetua` 6 March,
   `frances-rome` 9 March), which is why it and not 2035 or 2046.

   WHY SEPARATE. This fixture is a LIVE capture of missalemeum, where the
   2026-2027 one is derived from lectio's archived snapshot, and
   docs/research/sources.md already records that the live endpoint HAS
   DRIFTED from that snapshot. Merging them would put two versions of the
   same source behind one set of expectations, and a future disagreement
   could not be attributed to either the calendar or the drift.

   WHY A NARROWER COMPARISON. This compares rank, colour, and the two
   reading citations -- NOT commemorations or observed-identity. Those axes
   are worth having, but the machinery above that implements them is built
   around a hand-built, date-literal allow-list of 28 entries specific to
   2026-2027, and re-deriving an equivalent for a second year is its own
   task. What is asserted here is asserted fully; what is not compared is
   named, here, rather than left to be discovered. *)

let fixture_2038_path = "fixtures/missalemeum-ef-2038.txt"
let fixture_2038_sha256 = "2ac17136be5f6a831bb115ab62f0bb993f69973fdd847d269b43915746ef2151"

(* Citation notation differs between the two sources in ways that are not
   calendar disagreements at all: book abbreviations ("Ecclus"/"Sir",
   "Joann"/"John", "Luc"/"Luke") and punctuation of the same verse range.
   Layer 3 normalises the same way and for the same reason
   (test_differential.ml's own A/B normalisation). Normalising here keeps
   this comparison about WHICH VERSES, which is the thing under test. *)
let norm_citation s =
  let s = String.lowercase_ascii s in
  (* Each pair maps the LONGER/rarer spelling onto the shorter one used by
     the other side. Checked for self-collision: no replacement's target
     contains its own source as a substring ("luke" does not contain "luc",
     "mark" does not contain "marc"), so applying them is idempotent and
     order-independent. Every entry here was added because a real 2038 row
     needed it, never speculatively. *)
  let subst =
    [ ("ecclus", "sir"); ("eccli", "sir"); ("joann", "john"); ("matth", "matt");
      ("luc", "luke"); ("marc", "mark") ]
  in
  let s = List.fold_left (fun acc (a, b) ->
      let bl = String.length a in
      let buf = Buffer.create (String.length acc) in
      let i = ref 0 in
      while !i < String.length acc do
        if !i + bl <= String.length acc && String.sub acc !i bl = a then begin
          Buffer.add_string buf b; i := !i + bl end
        else begin Buffer.add_char buf acc.[!i]; incr i end
      done;
      Buffer.contents buf) s subst
  in
  String.to_seq s
  |> Seq.filter (fun ch -> (ch >= 'a' && ch <= 'z') || (ch >= '0' && ch <= '9'))
  |> String.of_seq

(* Every 2038 divergence class, each pointing at where it is adjudicated.
   These are NOT new rulings: all six were already decided, and 2038 is an
   independent year re-confirming them. The counts are pinned so a change in
   any class fails loudly. *)
let m21_2038_slugs = m21_colour_slugs

let classify_2038 (c : colitur_row) (o : oracle_row) diffs =
  let has_comm slug = List.exists (fun (s, _, _, _) -> s = slug) c.c_commemorations in
  let has_comm_prefix p =
    List.exists
      (fun (s, _, _, _) -> String.length s >= String.length p && String.sub s 0 (String.length p) = p)
      c.c_commemorations
  in
  let title = o.o_title in
  let contains hay needle =
    let nh = String.length needle and lh = String.length hay in
    let rec at i = i + nh <= lh && (String.sub hay i nh = needle || at (i + 1)) in
    nh = 0 || at 0
  in
  let first_is s = match c.c_first with Some f -> contains f s | None -> false in
  if contains title "Mass of the B. V. M." then Some "BVM-SATURDAY-MASS (M26 shape 1)"
  else if first_is "Col 1:12-20" then Some "CHRIST-THE-KING-WEEK (M26 shape 2b)"
  else if diffs = [ Colour_f ] && List.mem c.c_observed_slug m21_2038_slugs then Some "COLOUR (M21)"
  else if first_is "Judith" then Some "JUDITH (M28, register 6.6)"
  else if c.c_observed_slug = "sts-felicitas-perpetua" then Some "PERPETUA-COMMON (register 6.8)"
  else if c.c_observed_slug = "ef-nativity" then Some "CHRISTMAS-MULTI-MASS (M27)"
  else if first_is "Dan 14:27, 28-42" then Some "MISSAL-TWO-PART-CITATION (register 6.9)"
  (* Both saints transferred out of Holy Week, landing on adjacent days in the
     opposite ORDER from missalemeum's: colitur puts the Annunciation first,
     the oracle puts Joseph first. Neither stream loses a feast -- the pair is
     the same, the sequence differs. This is the collision C14 already cites on
     the differential side (Joseph's own transfer against the Annunciation's
     fixed "sedes propria", RG 96); it simply had no oracle window until a
     live-capture year happened to contain it. Recognised by the pair of
     slugs, not by date, so a year where only ONE of them moved would not
     match and would surface as unexplained. *)
  else if
    c.c_observed_slug = "annunciation-of-the-blessed-virgin-mary"
    || c.c_observed_slug = "joseph-spouse-of-the-bl-virgin-mary"
  then Some "JOSEPH-ANNUNCIATION-TRANSFER-ORDER (C14's own collision)"
  (* RG 69's Sunday within the Octave of the Nativity against colitur's own
     numbered octave-day slug -- C6's family on the differential side, and the
     same disagreement about which office a late-December Sunday carries. *)
  else if
    String.length c.c_observed_slug > 19
    && String.sub c.c_observed_slug 0 19 = "ef-nativity-octave-"
  then Some "NATIVITY-OCTAVE-SUNDAY (C6's family, RG 69)"
  (* ---- commemoration classes (2026-08-18) ------------------------------
     Every one below is an already-cited family from the 2026-2027
     allow-list, re-appearing in a live window now that these compare
     commemorations. None is a new adjudication; each points at the entry
     that decided it. *)
  else if has_comm "commemoration-of-the-seven-sorrows" || has_comm "major-litanies" then
    (* Same entity, different English name form: colitur's own resolved name
       ("The Seven Sorrows of the Blessed Virgin Mary", "The Major Litanies")
       against missalemeum's ("For Our Lady of the Seven Sorrows", "Pro
       rogationibus"). Both streams commemorate the SAME thing. Counted as a
       divergence because the comparator matches on name text, which is the
       only identity signal available -- not because the calendars differ. *)
    Some "COMM-NAME-FORM (same entity, different English name)"
  else if has_comm "commemoration-of-st-peter" then
    Some "PETER-COMPANION-ABSENT-UPSTREAM (M19)"
  else if has_comm "barbara" then Some "BARBARA-ABSENT-UPSTREAM (M22)"
  else if has_comm_prefix "ef-advent-" then Some "ADVENT-FERIA-COMM (M10)"
  else if
    List.mem Comm_presence diffs && c.c_commemorations = []
    && String.length c.c_observed_slug > 3
  then Some "NATIVITY-OCTAVE-COMM-MISSING (M11, colitur's own gap, verdict open)"
  (* THE ONE GENUINELY NEW FINDING of this extension, and it is not a naming
     artefact. 2038-06-02: the Ascension Vigil (II class) admits ONE
     commemoration under RG 111(c), and TWO candidates compete --
     `rogation-wednesday` and `sts-marcellinus-peter-erasmus`. BOTH are
     Commemoration_only, so neither has a row in RG 91's table and [band]
     returns [unclassified] for both; RG 113's "servetur ordo tabellae
     praecedentiae" has nothing to order by, and [admit] falls through to its
     alphabetical slug tie-break, which picks the Rogation. missalemeum picks
     the saints.

     This is the tie-break CLAUDE.md records as "only ever exercised between
     two Commemoration_only candidates, neither of which has any RG 91 table
     position" -- and this is its FIRST live, externally-witnessed instance.
     The decision is currently made by slug alphabet, which is arbitrary and
     not rubrical.

     There may be a real rule: RG 113's own FIRST sentence is "Commemoratio de
     Tempore fit primo loco", and a Rogation is arguably de Tempore, which
     would make colitur right for a reason it is not currently using. That
     turns on whether the entry should carry subject Temporal rather than the
     Saint it inherited from the Major Litanies precedent -- a question the
     movable-date-specs spec explicitly deferred as "behaviourally inert",
     which it no longer is. NOT decided here: recorded, cited, and left for a
     dedicated task rather than settled by whichever answer happens to match
     the oracle. *)
  else if has_comm "rogation-wednesday" then
    Some "COMM-ONLY-TIE-BREAK (RG-under-determined convention -- register 6.16)"
  (* The documented comparator LIMIT, not a calendar disagreement: colitur
     resolves a commemoration's identity through its own English name, and a
     TEMPORAL-origin commemoration (an impeded feria, an Ember or Rogation
     day) has none -- Temporal_ef never sets one. M15 carries the same shape
     in the 2026-2027 window. Counted and named rather than skipped, so the
     population is visible instead of silently passing. *)
  (* M8's own shape: a fixed I-class feast landing on an ordinary Sunday. RG
     109(a) makes "of a Sunday" always privileged and RG 111(a) admits exactly
     one privileged commemoration on a I-class day, so the impeded Sunday IS
     that one. missalemeum shows no commemoration at all. M8 names All Saints
     and the Assumption in the 2026-2027 window; this is the same rule
     reaching a different feast. *)
  else if has_comm_prefix "ef-" && List.mem Comm_presence diffs && c.c_rank = 1 then
    Some "IMPEDED-SUNDAY-COMM (M8's rule, RG 109(a)/111(a))"
  else if List.mem Comm_identity_unresolved diffs then
    Some "COMM-IDENTITY-UNRESOLVED (temporal-origin, no English name -- M15's limit)"
  else None

(* COMMEMORATIONS join the live-window comparison (2026-08-18).

   Until now the live windows compared rank, colour and the two citations
   only, and commemorations were checked against an oracle in the 2026-2027
   fixture alone -- 227 days out of the ~968 000 commemoration-bearing days in
   the domain, about 0.02%. That was by some distance the thinnest axis in the
   project, and the reason is worth restating: layer 3 (16 801 days) compares
   NO commemorations at all and never can, because lectio's own trailing
   "+slug" tokens are its LOSING candidates rather than an RG 111 admitted
   set, so the largest evidence source is structurally silent here. Roughly a
   third of all days carry at least one commemoration, and `admit` is the most
   intricate code in the engine, so the gap mattered.

   Presence, count and IDENTITY are compared, reusing [identity_diff] --
   the same function the 2026-2027 comparator uses, with the same limits: it
   resolves a SANCTORAL-origin commemoration by colitur's own English name and
   returns [Comm_identity_unresolved] for a temporal-origin one, which carries
   no name to match. Unresolved is a counted, classified outcome, never a
   silent pass.

   OBSERVED-identity is deliberately still NOT compared in the live windows.
   That axis is a separate, already-understood limit (M18's own shape: a
   temporal-origin observed day has no English name either), and folding it in
   here would flood these windows with a divergence class that says nothing
   about commemorations. *)
let diffs_2038 (c : colitur_row) (o : oracle_row) =
  let d = ref [] in
  if c.c_rank <> o.o_rank then d := Rank :: !d;
  if not (List.mem c.c_colour o.o_colours) then d := Colour_f :: !d;
  let c_has = c.c_commemorations <> [] and o_has = o.o_commemorations <> [] in
  if c_has <> o_has then d := Comm_presence :: !d;
  if c_has && o_has && List.length c.c_commemorations <> List.length o.o_commemorations then
    d := Comm_count :: !d;
  (match identity_diff c o with Some f -> d := f :: !d | None -> ());
  (match (c.c_first, o.o_first) with
   | Some a, Some b when norm_citation a <> norm_citation b -> d := First_mismatch :: !d
   | _ -> ());
  (match (c.c_gospel, o.o_gospel) with
   | Some a, Some b when norm_citation a <> norm_citation b -> d := Gospel_mismatch :: !d
   | _ -> ());
  List.rev !d

(* Parameterised over (fixture, year) so a second live-capture year costs a
   fixture and a count list, not a copy of the comparator. 2035 was added for
   `isidore-of-seville`, the last Common-routed saint reachable in any year the
   differential covers. *)
let compare_live ~fixture ~year =
  let oracle = List.map oracle_row_of_line (read_lines fixture) in
  let colitur = colitur_rows ~from_year:year ~to_year:year in
  let by_date = Hashtbl.create 400 in
  List.iter (fun (c : colitur_row) -> Hashtbl.replace by_date c.c_date c) colitur;
  List.filter_map
    (fun (o : oracle_row) ->
      match Hashtbl.find_opt by_date o.o_date with
      | None -> None
      | Some c ->
          let diffs = diffs_2038 c o in
          if diffs = [] then None else Some (o.o_date, diffs, classify_2038 c o diffs, c, o))
    oracle

let compare_2038 () = compare_live ~fixture:fixture_2038_path ~year:2038

let test_2038_fixture_checksum () =
  Alcotest.(check string) "2038 fixture SHA-256 matches its provenance note" fixture_2038_sha256
    (sha256_of_file fixture_2038_path)

let test_2038_dates_align () =
  let oracle = List.map oracle_row_of_line (read_lines fixture_2038_path) in
  let colitur = colitur_rows ~from_year:2038 ~to_year:2038 in
  Alcotest.(check int) "oracle is 365 rows" 365 (List.length oracle);
  Alcotest.(check int) "colitur is 365 rows" 365 (List.length colitur);
  Alcotest.(check (list string)) "dates align 1:1"
    (List.map (fun (o : oracle_row) -> o.o_date) oracle)
    (List.map (fun (c : colitur_row) -> c.c_date) colitur)

let test_2038_every_difference_is_classified () =
  let unexplained =
    compare_2038 ()
    |> List.filter_map (fun (date, diffs, cls, c, o) ->
           match cls with
           | Some _ -> None
           | None ->
               Some
                 (Printf.sprintf "%s: %s -- colitur=(%s rank=%d colour=%c first=%s) oracle=(%s rank=%d first=%s)"
                    date
                    (String.concat "," (List.map field_name diffs))
                    c.c_observed_slug c.c_rank c.c_colour
                    (Option.value c.c_first ~default:"-")
                    o.o_title o.o_rank
                    (Option.value o.o_first ~default:"-")))
  in
  Alcotest.(check (list string)) "every 2038 difference falls in a named, adjudicated class" []
    unexplained

let test_2038_class_counts () =
  let tbl = Hashtbl.create 8 in
  List.iter
    (fun (_, _, cls, _, _) ->
      match cls with
      | Some k -> Hashtbl.replace tbl k (1 + Option.value (Hashtbl.find_opt tbl k) ~default:0)
      | None -> ())
    (compare_2038 ());
  let actual = Hashtbl.fold (fun k n acc -> (k, n) :: acc) tbl [] |> List.sort compare in
  (* Measured 2026-08-17 against the live capture this fixture pins. Each
     class is adjudicated elsewhere and merely RE-CONFIRMED here, in a year
     entirely independent of the one those rulings were made in. *)
  let expected =
      (* BVM-SATURDAY-MASS (M26 shape 1) is GONE from this list, not zeroed:
         colitur now says RG 309(a) own Mass on the BVM Saturday office, so
         those 13 days no longer differ at all. An id with no rows must not be
         declared -- the count assertion rejects an unused one, which is what
         keeps this list honest. *)
      [ ("ADVENT-FERIA-COMM (M10)", 10);
        ("BARBARA-ABSENT-UPSTREAM (M22)", 1);
        ("CHRIST-THE-KING-WEEK (M26 shape 2b)", 2);
        ("CHRISTMAS-MULTI-MASS (M27)", 1);
        ("COLOUR (M21)", 7);
        ("COMM-NAME-FORM (same entity, different English name)", 2);
        ("COMM-ONLY-TIE-BREAK (RG-under-determined convention -- register 6.16)", 1);
        ("JOSEPH-ANNUNCIATION-TRANSFER-ORDER (C14's own collision)", 2);
        ("JUDITH (M28, register 6.6)", 2);
        ("MISSAL-TWO-PART-CITATION (register 6.9)", 1);
        ("COMM-IDENTITY-UNRESOLVED (temporal-origin, no English name -- M15's limit)", 2);
        ("PERPETUA-COMMON (register 6.8)", 1);
        ("PETER-COMPANION-ABSENT-UPSTREAM (M19)", 1)
      ]
    |> List.sort compare
  in
  Alcotest.(check (list (pair string int))) "2038 divergence classes and their counts" expected actual

(* The point of the whole exercise: 2038 is the only year in 2005-2050 where
   a Common-routed saint is the observed office AND an oracle exists for it.
   Both days are asserted directly, by date, so a regression in step 4 cannot
   hide inside an aggregate count. Perpetua is a KNOWN divergence (register
   §6.8 -- missalemeum has the two martyrs classified as Virgins and serves
   the Virgins Common; the Missal directs "de Communi non Virginum I loco",
   scan1:27634-27635); Frances of Rome must MATCH outright. *)
let test_2038_common_route_days () =
  let rows = compare_2038 () in
  let diff_for d = List.find_opt (fun (date, _, _, _, _) -> date = d) rows in
  (match diff_for "2038-03-09" with
  | None -> ()
  | Some (_, diffs, _, c, o) ->
      Alcotest.failf "2038-03-09 (frances-rome, Common of Non-Virgins II) should agree: %s (colitur first=%s, oracle first=%s, oracle title=%s)"
        (String.concat "," (List.map field_name diffs))
        (Option.value c.c_first ~default:"-")
        (Option.value o.o_first ~default:"-")
        o.o_title);
  match diff_for "2038-03-06" with
  | Some (_, _, Some cls, _, _) ->
      Alcotest.(check string) "2038-03-06 is the adjudicated Perpetua divergence"
        "PERPETUA-COMMON (register 6.8)" cls
  | _ -> Alcotest.fail "2038-03-06 was expected to differ (register §6.8) and did not"

let suite_2038 =
  ( "oracle (missalemeum, EF, 2038 -- the Common route)",
    [ Alcotest.test_case "2038 fixture SHA-256 matches its provenance note" `Quick
        test_2038_fixture_checksum;
      Alcotest.test_case "streams are 365 rows each, dates aligned 1:1" `Quick test_2038_dates_align;
      Alcotest.test_case "every difference falls in a named, adjudicated class" `Quick
        test_2038_every_difference_is_classified;
      Alcotest.test_case "divergence classes and their counts are pinned" `Quick test_2038_class_counts;
      Alcotest.test_case "the two Common-route days: Frances agrees, Perpetua is the known divergence"
        `Quick test_2038_common_route_days
    ] )

(* ====================================================================== *)
(* The 2035 oracle extension (2026-08-17)                                 *)
(* ====================================================================== *)

(* A THIRD comparison window, and the one that finally witnesses the last
   reachable Common-routed saint.

   Register §6.7 recorded step 4 -- the Common route -- as having no external
   witness at all. 2038 (§6.9) closed two of the five saints,
   `sts-felicitas-perpetua` and `frances-rome`. `isidore-of-seville` is the
   third and last that ANY year in 2005-2050 can witness: he is the observed
   office on 2008-04-04, 2035-04-04 and 2046-04-04 and nowhere else, and he is
   the only saint routing through `common-of-doctors`, which no other fixture
   touches. The remaining two, `gregory-the-great` and `patrick`, are never
   the observed office in any of those 46 years -- both sit in March and are
   impeded by Lent's privileged ferias every year -- so no fixture in that
   range can reach them by construction, and this is as far as the method
   goes.

   Same provenance shape as 2038: a live capture, kept separate from the
   snapshot-derived 2026-2027 fixture because the endpoint has drifted from
   it. Same narrower comparison too (rank, colour, Epistle, Gospel), for the
   same reason -- the commemoration and observed-identity axes are built round
   a date-literal allow-list specific to 2026-2027. *)

let fixture_2035_path = "fixtures/missalemeum-ef-2035.txt"
let fixture_2035_sha256 = "39b000827f45cb0c2c712625fd9514a8c0e71e8a94fc9f69df4a97d91f90014d"
let compare_2035 () = compare_live ~fixture:fixture_2035_path ~year:2035

let test_2035_fixture_checksum () =
  Alcotest.(check string) "2035 fixture SHA-256 matches its provenance note" fixture_2035_sha256
    (sha256_of_file fixture_2035_path)

let test_2035_dates_align () =
  let oracle = List.map oracle_row_of_line (read_lines fixture_2035_path) in
  let colitur = colitur_rows ~from_year:2035 ~to_year:2035 in
  Alcotest.(check int) "oracle is 365 rows" 365 (List.length oracle);
  Alcotest.(check (list string)) "dates align 1:1"
    (List.map (fun (o : oracle_row) -> o.o_date) oracle)
    (List.map (fun (c : colitur_row) -> c.c_date) colitur)

(* The whole point of this fixture. `common-of-doctors` has never been
   compared against any external source, in any window, until now: it is the
   one Common that only `isidore-of-seville` routes through, and he is the
   observed office on exactly three days in 2005-2050. The scan says
   "2 Tim. 4, 1-8" / "Mt. 5, 13-19" (Commune Doctorum, scan1.txt:41878 ff);
   colitur says the same; this asserts missalemeum does too. *)
let test_2035_isidore_common_of_doctors () =
  match List.find_opt (fun (d, _, _, _, _) -> d = "2035-04-04") (compare_2035 ()) with
  | None -> ()
  | Some (_, diffs, _, c, o) ->
      Alcotest.failf
        "2035-04-04 (isidore-of-seville, the ONLY common-of-doctors witness) should agree: %s -- colitur \
         first=%s gospel=%s, oracle title=%s first=%s gospel=%s"
        (String.concat "," (List.map field_name diffs))
        (Option.value c.c_first ~default:"-")
        (Option.value c.c_gospel ~default:"-")
        o.o_title
        (Option.value o.o_first ~default:"-")
        (Option.value o.o_gospel ~default:"-")

let test_2035_every_difference_is_classified () =
  let unexplained =
    compare_2035 ()
    |> List.filter_map (fun (date, diffs, cls, c, o) ->
           match cls with
           | Some _ -> None
           | None ->
               Some
                 (Printf.sprintf "%s: %s -- colitur=(%s rank=%d colour=%c first=%s) oracle=(%s rank=%d first=%s)"
                    date
                    (String.concat "," (List.map field_name diffs))
                    c.c_observed_slug c.c_rank c.c_colour
                    (Option.value c.c_first ~default:"-")
                    o.o_title o.o_rank
                    (Option.value o.o_first ~default:"-")))
  in
  Alcotest.(check (list string)) "every 2035 difference falls in a named, adjudicated class" [] unexplained

let suite_2035 =
  ( "oracle (missalemeum, EF, 2035 -- common-of-doctors)",
    [ Alcotest.test_case "2035 fixture SHA-256 matches its provenance note" `Quick
        test_2035_fixture_checksum;
      Alcotest.test_case "streams are 365 rows each, dates aligned 1:1" `Quick test_2035_dates_align;
      Alcotest.test_case "isidore-of-seville: the only common-of-doctors witness agrees" `Quick
        test_2035_isidore_common_of_doctors;
      Alcotest.test_case "every difference falls in a named, adjudicated class" `Quick
        test_2035_every_difference_is_classified
    ] )