[kvlonge]

Three checker changes, gated together.

1. Never-submitted unobservable entries

Adds an optional cause = "not_submitted" to [[unobservable]] entries for obligations whose cases are never submitted, such as side-effecting functions a capture guard holds.

• Such an entry needs a construct, a reason and at least one case. Its runs and probes must be empty, and each case must still exist with its sql_sha256 and cite the obligation.
• The obligation reports a new reason, unverifiable_not_submitted. It stays in the denominator and never counts as satisfied.
• An absent cause keeps today's 603 meaning and rules, including at least one run. Any other value is refused when the file loads.

Tests cover: a never-submitted obligation reporting its own reason; a stale case hash; an entry listing a run (refused); an unknown cause (refused); and a 603 entry without runs (still refused). Mutating the reason mapping or the runs check makes them fail.

2. Readings in the definition hash (D118 follow-up)

A form's definition_sha256 now covers its [[reading]] from coverage/syntax/limits.toml, so editing a reading makes that form's per-form review stale and no other form's. Forms without a reading keep their hash.

• limits.toml is required. A misspelt table, a form read twice, or a reading of a form that isn't catalogued is refused.
• grammar_sha256 is the form's grammar hash or prose:<heading>. grammar lines must not be blank, and the list may be empty for a lexical form whose reason explains it. On the catalogue, 30 readings are prose and 12 are lexical. The second commit's message says 54; the correct total is 42.
• Tests: editing the form's own reading makes its review stale; editing another form's reading leaves it current. Mutating the hash to ignore readings fails the first test.
• Rollout, measured on catalogue 72ccd4f, evidence 6ffe5bf and audit 03c9634, comparing main be4dfac's checker with this branch's (same parser tree, 359f8b8a): 64 forms become stale, exactly the forms with a reading under a per-form review. A 65th, object-agg, was already stale. Verified goes from 1,079 to 1,015, satisfied obligations are unchanged, and there are 0 problems.

3. Receipt account_state (D120)

Receipts may carry an optional account_state: account parameters by name, each { "value": string | null, "basis": string }. A null value means the receipt has no usable recorded_at. It is validated (at least one parameter, a non-blank basis, no unknown fields, no account, host, URL or address) and carried onto each case result in family --json, so a phase that differs under another account state can be told apart. It changes no verdict.

Tests cover a valued and a null parameter carried only by their case, a blank basis, an address in the basis, and an unknown field. Mutations that drop the carry-through or the address check make them fail.

All three are documented in docs/syntax-coverage.md.

[kvlonge]

Folded into #38 under D122 and landed with it in a2c64d6 at the gated tree, with a local gate (make check-merge RECORDER=0, exit 0 on 736cf93). GitHub marks this PR merged because its head is in main.