sources: archive upstream generator data for offline reproducibility

Snapshot the raw third-party responses the gen*/oracle scripts fetch, so
lectio's liturgical data can be regenerated and re-audited offline if the
sites change or vanish (the 25-year-longevity aim). Reading references are
facts, not creative works -- this is a provenance cache, not redistribution.

scripts/snapshot-sources.sh (idempotent, manifest.tsv with sha256) archives:
- catholic-resources.org: all 14 OF lectionary tables (browser UA; its WAF
  465s unusual agents)
- missalemeum en+pl, per-date 2026-2027 (1460 files, EF calendar/propers/pl
  names; widen MM_FROM/MM_TO for the full 2024-2029 harvest)
- litcal whole-year OF calendars 2024-2035
- get.bible Douay-Rheims deuterocanon (Tobit..2 Maccabees)
sources/README.md documents provenance, coverage, and the one gap:
calapi.inadiutorium.cz is IPv6-only/unreachable here (litcal covers OF).

1 files changed, 40 insertions, 0 deletions

diff --git a/sources/README.md b/sources/README.md
new file mode 100644
index 0000000..b177c3d
--- /dev/null
+++ b/sources/README.md
@@ -0,0 +1,40 @@
+# sources/ — archived upstream data
+
+Raw responses from the third-party sites the `scripts/gen*` / `build-oracle*`
+generators fetch. Archived so lectio's liturgical data (the calendars, the
+lectionary tables, the deuterocanon backfill) can be **regenerated and
+re-audited offline** if those sites change, move, or disappear — the project's
+25-year-longevity aim. Reading references are facts, not creative works; this is
+a provenance cache, not redistribution of anyone's edition.
+
+Refresh or extend with `sh scripts/snapshot-sources.sh [provider ...]`
+(idempotent: existing non-empty files are skipped). Every file is recorded in
+`manifest.tsv` (path, url, sha256, bytes). First archived **2026-07-29**.
+
+## What's here
+
+| dir | provider | feeds | coverage |
+|-----|----------|-------|----------|
+| `catholic-resources/` | catholic-resources.org (Fr. Felix Just, S.J.) | OF lectionary: Sundays A/B/C, seasons, OT-I/II weekdays, sanctoral (`genlect-of-*.py`, `gen-of-sanctoral-readings.py`) | all 14 tables (complete) |
+| `missalemeum/{en,pl}/` | missalemeum.com (Divinum Officium data) | EF calendar, EF propers, EF Polish saint names (`gen-sanctoral-ef.go`, `genlect.go`) | per-date 2026-01-01 … 2027-12-31, en + pl |
+| `litcal/` | litcal.johnromanodorazio.com | OF calendar validation oracle (`validate-engine.py`) | whole-year JSON 2024–2035, en |
+| `getbible/` | api.getbible.net | Douay-Rheims deuterocanon backfill (`gen-deutero.py`) | Tobit/Judith/Wisdom/Sirach/Baruch/1–2 Maccabees, all chapters |
+
+## Coverage notes / gaps
+
+- **calapi.inadiutorium.cz — NOT archived (unreachable here: IPv6-only).** It is
+  the original source for `gen-sanctoral.go` (OF sanctoral) and `build-oracle.sh`
+  (OF season oracle). The reachable **litcal** feed above is the equivalent OF
+  calendar and is what current validation uses; the OF season oracle itself is
+  already committed at `internal/calendar/testdata/oracle-2020-2040.json`.
+- **missalemeum** is per-date only and bounded to a representative 2-year span
+  (the EF Polish names were sourced from 2026–2027). The full EF harvest spans
+  2024–2029; widen with `MM_FROM=2024-01-01 MM_TO=2029-12-31 sh
+  scripts/snapshot-sources.sh missalemeum`. Its WAF needs a timeout-bearing
+  client (a hanging worker is the classic failure); the script sets `--max-time`.
+- **catholic-resources.org** answers HTTP 465 to unusual User-Agents; the script
+  fetches it with a plain browser UA (every other provider takes the descriptive
+  archive UA).
+- **wuj / biblia.info.pl** is deliberately absent: the Wujek corpus is defective
+  and dropped from auto-rendering, and no clean public-domain verse-structured
+  Wujek source exists (see the epic notes).