CTRLRun · arpanghoshal · Sep 13, 2026
diff --git a/docs.mdx b/docs.mdx
@@ -219,7 +219,7 @@ the framework's own interrupt, and a framework with no such primitive does not n
 
 {/* generated from the suite, pyproject and the soak (mdx) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **6,019 tests**, every version specified before it was written and every requirement mutation-tested.
+- **6,033 tests**, every version specified before it was written and every requirement mutation-tested.
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).

diff --git a/docs/CLAIMS.md b/docs/CLAIMS.md
diff --git a/docs/production/index.mdx b/docs/production/index.mdx
@@ -28,7 +28,7 @@ need. `test_the_first_line_of_the_section_says_which_store_and_why` asserts the
 
 {/* generated from the suite, pyproject and the soak (full) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **6,019 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
+- **6,033 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres).
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak).

diff --git a/docs/reference/api/Authority.mdx b/docs/reference/api/Authority.mdx
@@ -5,7 +5,7 @@ description: "The `authority:` section, loaded and evaluable (SPEC-v0.3 §4)."
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Authority` — class, defined at `src/ctrlrun/authority.py:1191`
+`ctrlrun.Authority` — class, defined at `src/ctrlrun/authority.py:1229`
 
 ```python
 from ctrlrun import Authority

diff --git a/docs/reference/api/Control.mdx b/docs/reference/api/Control.mdx
@@ -5,7 +5,7 @@ description: "Policy, state and evidence composed around a single action (SPEC-v
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Control` — class, defined at `src/ctrlrun/control.py:718`
+`ctrlrun.Control` — class, defined at `src/ctrlrun/control.py:825`
 
 ```python
 from ctrlrun import Control

diff --git a/docs/reference/api/context.mdx b/docs/reference/api/context.mdx
@@ -5,7 +5,7 @@ description: "Bind the principal for calls made inside the block."
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.context` — function, defined at `src/ctrlrun/control.py:363`
+`ctrlrun.context` — function, defined at `src/ctrlrun/control.py:368`
 
 ```python
 from ctrlrun import context

diff --git a/docs/reference/api/idempotency_token.mdx b/docs/reference/api/idempotency_token.mdx
@@ -5,7 +5,7 @@ description: "The provider idempotency token for the attempt this executor is ru
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.idempotency_token` — function, defined at `src/ctrlrun/control.py:331`
+`ctrlrun.idempotency_token` — function, defined at `src/ctrlrun/control.py:336`
 
 ```python
 from ctrlrun import idempotency_token

diff --git a/docs/reference/api/protect.mdx b/docs/reference/api/protect.mdx
@@ -5,7 +5,7 @@ description: "Bind a function to an action name: every call becomes a decided, r
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.protect` — function, defined at `src/ctrlrun/control.py:4795`
+`ctrlrun.protect` — function, defined at `src/ctrlrun/control.py:4902`
 
 ```python
 from ctrlrun import protect

diff --git a/docs/reference/api/with_approval.mdx b/docs/reference/api/with_approval.mdx
@@ -5,7 +5,7 @@ description: "Present a granted approval to the calls made inside the block (SPE
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.with_approval` — function, defined at `src/ctrlrun/control.py:386`
+`ctrlrun.with_approval` — function, defined at `src/ctrlrun/control.py:391`
 
 ```python
 from ctrlrun import with_approval

diff --git a/docs/reference/cli.mdx b/docs/reference/cli.mdx
@@ -166,6 +166,8 @@ Usage: ctrlrun inspect [OPTIONS] [ACTION_ID]
 Options:
   --grant TEXT      Show this grant's budgets instead: consumed, held, and what
                     holds it.
+  --hop TEXT        Show this hop or delegation instead: who issued it, and what
+                    each link narrowed.
   --json            Emit one JSON object instead.
   --store-url TEXT  The store to open. Default: $CTRLRUN_STORE_URL, else the
                     SQLite database beside the policy (.ctrlrun/state.db, or

diff --git a/generated/readiness.full.mdx b/generated/readiness.full.mdx
@@ -1,6 +1,6 @@
 {/* generated from the suite, pyproject and the soak (full) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **6,019 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
+- **6,033 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres).
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak).

diff --git a/generated/readiness.json b/generated/readiness.json
@@ -9,6 +9,6 @@
     "positive_control": true,
     "unexplained": 0
   },
-  "tests": 6019,
+  "tests": 6033,
   "version": "0.9.0"
 }
diff --git a/generated/readiness.mdx b/generated/readiness.mdx
@@ -1,6 +1,6 @@
 {/* generated from the suite, pyproject and the soak (mdx) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **6,019 tests**, every version specified before it was written and every requirement mutation-tested.
+- **6,033 tests**, every version specified before it was written and every requirement mutation-tested.
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).

diff --git a/generated/readiness.readme.md b/generated/readiness.readme.md
@@ -1,6 +1,6 @@
 <!-- generated from the suite, pyproject and the soak (readme) — run the generator -->
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **6,019 tests**, every version specified before it was written and every requirement mutation-tested.
+- **6,033 tests**, every version specified before it was written and every requirement mutation-tested.
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).