feat(gen): teach the EF generator to preserve the Missal corrections

The four calendar corrections adopted from colitur are not in missalemeum, so
re-running gen-sanctoral-ef.go silently reverted them. Warning about that in
three places was the stopgap; this fixes it.

The generator now carries a missalOverrides table -- slug, field, required
value, and the authority for it -- applied after every harvest and collision
fix-up has settled, so the Missal's value is the last word. Regenerating is
now safe; hand-editing the generated file is not, and both the file's header
and the generator's comment now say which way round that is.

An explicit table rather than "preserve whatever the existing file had",
which is how the name.<lang> preservation beside it works and would have been
less code. Preserving from the file cannot distinguish a deliberate
correction from staleness: if missalemeum ever fixes one of these, a
preserve-from-file rule would keep overriding it forever with nobody the
wiser. Naming each override with its rubric makes an obsolete one findable by
reading four lines. The apply step reports "already correct upstream" when it
finds one, which is the signal to retire it.

It FAILS rather than warns when an override names a slug the run did not
harvest. A rename upstream would otherwise drop a correction silently, which
is the precise accident the table exists to prevent.

TestTridentineMissalOverrides pins all four values from the other side, so a
regeneration that stopped applying them fails the suite rather than only
failing quietly. Mutation-tested: reverting the Assumption vigil to
missalemeum's white reddens it with a message naming the cause. It also
asserts the Ascension's vigil is NOT violet -- RG 128's rule is "outside
Paschaltide" and that one is inside it -- so a careless "make every vigil
violet" fix fails too.

2 files changed, 64 insertions, 6 deletions

diff --git a/internal/caldata/caldata_test.go b/internal/caldata/caldata_test.go
index 7dbbf84..c0e2d50 100644
--- a/internal/caldata/caldata_test.go
+++ b/internal/caldata/caldata_test.go
@@ -402,3 +402,57 @@ func TestTridentineNamesPreservedAcrossRegeneration(t *testing.T) {
 		t.Errorf("assumption-of-the-blessed-virgin-mary: name.pl = %q, want the preserved Polish name", got)
 	}
 }
+
+// TestTridentineMissalOverrides pins the four fields where the 1962 MISSALE
+// ROMANUM decides against missalemeum, and the Missal wins.
+//
+// This is the safety net for a specific accident. This file is generated by
+// scripts/gen-sanctoral-ef.go from missalemeum, which does NOT carry any of
+// these values; the generator re-applies them from its own missalOverrides
+// table on every run. If that table is ever removed, or a slug is renamed
+// upstream so an override silently stops matching, the generated file quietly
+// reverts to missalemeum's values and nothing else in this repository would
+// notice. This test notices.
+//
+// Each was found by the sibling project colitur, which validates this data
+// against the Missal and its Rubricae Generales rather than against another
+// calendar program:
+//
+//   - ubaldus and didacus: the Missal's own universal calendarium ranks both
+//     "III classis" outright, with no commemoration rubric, and each has a
+//     Mass entry of its own in the Proprium taking its readings from a Common
+//     -- which a bare commemoration never has.
+//   - the two August vigils: RG 128 gives violet to "vigils of II and III
+//     class outside Paschaltide". Both qualify. The rule's sole exception is
+//     the Ascension's vigil, inside Paschaltide, which is white -- and which
+//     is therefore checked here too, in the opposite direction, so that a
+//     careless "make every vigil violet" fix would fail rather than pass.
+func TestTridentineMissalOverrides(t *testing.T) {
+	l := Tridentine()
+	for _, c := range []struct{ slug, field, want, why string }{
+		{"ubaldus", "rank", "class-3", "Missal calendarium: S. Ubaldi Ep. et Conf., III classis"},
+		{"didacus", "rank", "class-3", "Missal calendarium: S. Didaci Conf., III classis"},
+		{"vigil-of-st-lawrence", "colour", "violet", "RG 128: III-class vigil outside Paschaltide"},
+		{"vigil-of-the-assumption", "colour", "violet", "RG 128: II-class vigil outside Paschaltide"},
+	} {
+		rc, ok := l.Cels[c.slug]
+		if !ok {
+			t.Errorf("missing %q -- if the slug was renamed upstream, the generator's "+
+				"missalOverrides entry must be renamed with it, or the correction is lost", c.slug)
+			continue
+		}
+		if got := rc.Fields[c.field]; got != c.want {
+			t.Errorf("%s: %s = %q, want %q (%s). This is a MISSAL correction that "+
+				"missalemeum does not carry -- if it reverted, the generator's "+
+				"missalOverrides table has stopped being applied", c.slug, c.field, got, c.want, c.why)
+		}
+	}
+	// The exception, asserted in the other direction: RG 128's vigil rule is
+	// "outside Paschaltide", and the Ascension's vigil is inside it.
+	if rc, ok := l.Cels["vigil-of-the-ascension"]; ok {
+		if got := rc.Fields["colour"]; got != "" && got != "white" {
+			t.Errorf("vigil-of-the-ascension: colour = %q, want white -- RG 128's "+
+				"violet rule is for vigils OUTSIDE Paschaltide and this one is inside it", got)
+		}
+	}
+}
diff --git a/internal/caldata/tridentine-calendar.ini b/internal/caldata/tridentine-calendar.ini
index 2786125..51b931a 100644
--- a/internal/caldata/tridentine-calendar.ini
+++ b/internal/caldata/tridentine-calendar.ini
@@ -8,12 +8,16 @@
 ; name.<lang> (missalemeum supplies English only) is preserved verbatim from
 ; whatever this file already carried before regeneration. See NOTICE.
 ;
-; NO LONGER PURELY GENERATED -- READ BEFORE RE-RUNNING THE GENERATOR.
-; Four fields below are HAND CORRECTIONS against the 1962 Missale Romanum
-; itself, adopted 2026-08-18 from the sibling project colitur, which validated
-; this data against the Missal and found missalemeum wrong on each. They are
-; NOT in missalemeum and a regeneration WILL SILENTLY REVERT THEM. Re-apply
-; them, or teach the generator to, before committing regenerated output:
+; FOUR FIELDS ARE NOT FROM missalemeum. They are corrections against the 1962
+; Missale Romanum itself, adopted 2026-08-18 from the sibling project colitur,
+; which validated this data against the Missal and found missalemeum wrong on
+; each. missalemeum does not carry them.
+;
+; REGENERATING THIS FILE IS SAFE. gen-sanctoral-ef.go re-applies all four from
+; its own missalOverrides table on every run, and fails loudly rather than
+; silently dropping one whose slug has been renamed upstream.
+; EDITING THEM HERE BY HAND IS NOT SAFE -- the next run puts them back. Change
+; the table. TestTridentineMissalOverrides pins all four either way:
 ;
 ;   [ubaldus]                  rank   commemoration -> class-3
 ;   [didacus]                  rank   commemoration -> class-3