CTRLRun · arpanghoshal · Sep 14, 2026 · Sep 14, 2026 · Sep 14, 2026 · Sep 14, 2026
diff --git a/docs.mdx b/docs.mdx
@@ -219,7 +219,7 @@ the framework's own interrupt, and a framework with no such primitive does not n
 
 {/* generated from the suite, pyproject and the soak (mdx) — run the generator */}
 - **Version 0.10.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14.
-- **6,080 tests**, every version specified before it was written and every requirement mutation-tested.
+- **6,096 tests**, every version specified before it was written and every requirement mutation-tested.
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).

diff --git a/docs/CLAIMS.md b/docs/CLAIMS.md
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
@@ -380,7 +380,7 @@ One question: can the record be trusted after the fact, and kept?
 - **Enforcement coverage.** From events already written: policy entries never exercised, gateway tools never routed, `@protect` actions never seen. The runtime half of `ctrlrun scan`, under the same rule — a clean result is not a verdict, no score, no percentage, no badge.
 - **One chain, several receipt schemas.** `ctrlrun.receipt/v7` is the schema today, and the rule since `SPEC-v0.3.md` §12.2 is that every reader upgrades before any writer switches, so an older receipt on disk still parses. v0.8 (the verified approver; the grant id under break-glass), v0.9 (budget consumption) and v0.10 (the hop) each add fields and each bump the version, so a chain kept from v0.6 across them holds **five receipt schema versions**: `v3`, which 0.6 wrote, `v4`, which v0.7 added, and `v5`, `v6` and `v7` after it. This sentence has now gone stale twice and is corrected here rather than quietly both times. It said *three shapes* and named `v3` as the schema today, before v0.7's precondition fields bumped it; v0.7's release pass fixed that and left *four* and `v4`, which v0.10's hop field made wrong again. A count of versions in a document is a number that goes stale at every release, which is the argument for reading `receipt.py`'s constants instead. And nothing yet proves that `verify` walks it end to end, hash by hash, each receipt hashed by the rule its own version wrote. v0.11 proves it, here, because this is the milestone about whether the record can be trusted after the fact. No new field: the version string already exists. What is new is the test, and the rule that a receipt whose version the binary does not know is *named* and not reported as a break — which is the same distinction v0.6 §3.2 draws for a `schema_version` row the binary does not know. Added 2026-09-10.
 
-- **A malformed value in a receipt row blinds every reader of the chain, and one `UPDATE` is enough.** Found while building v0.7's item 5, deferred there with a written decision, and named here because it is the evidence surface and this is the evidence milestone. A receipt whose *schema label* is unknown, and a receipt carrying an *added key*, are each reported at their `seq` and leave every other row readable. A malformed **value** of a key the schema declares is not: a float among a receipt's `controls` raises out of `Receipt.from_dict`, so `ctrlrun receipts`, `receipts --verify-chain`, `ctrlrun inspect`, `ctrlrun stats` and `G11` all stop together, and a single tampered row hides the whole document rather than naming itself. 0.6.1 behaves the same way and v0.7 neither introduced nor widened it. Fixing it needs one of two things, and both are amendments rather than patches: a new name in `CHAIN_BREAKS`, which is a closed set on a `SPEC-v0.6.md` §6.5 surface, or a reader that walks raw rows and reports per row without constructing a `Receipt` at all. `SPEC-v0.7.md` §12.5 carries the argument. Added 2026-09-12.
+- **A malformed value in a receipt row blinded every reader of the chain, and one `UPDATE` was enough. Closed by v0.11's item 1 on 2026-09-14.** Found while building v0.7's item 5, deferred there with a written decision, and named here because it is the evidence surface and this is the evidence milestone. A receipt whose *schema label* is unknown, and a receipt carrying an *added key*, were each already reported at their `seq` and left every other row readable. A malformed **value** of a key the schema declares was not: a float among a receipt's `controls` raised out of `Receipt.from_dict`, so `ctrlrun receipts`, `receipts --verify-chain`, `ctrlrun inspect`, `ctrlrun stats` and the operator MCP server's `receipts` and `stats` tools all stopped together, and a single tampered row hid the whole document rather than naming itself. 0.6.1 behaved the same way and v0.7 neither introduced nor widened it. **The fix is `SPEC-v0.7.md` §12.5's second candidate**, a reader that reports per row: `StateStore.receipts()` hands back a `ctrlrun.receipt.UnreadableReceipt` for a row it cannot construct, naming its `seq` and the type of what refused it. `CHAIN_BREAKS` did **not** grow, and §12.5's first candidate is declined with a reason in `SPEC-v0.11.md` §5.1: `content_altered` already names a document that cannot be canonicalized, so a second name would be two names for one break. **Two corrections this entry earned by being implemented.** It listed `G11` among the readers that stop; `ctrlrun verify` grades `G11` against a scratch store it creates and fills itself, which no `UPDATE` reaches, so `G11` was never blinded by an operator's tampered row. And it omitted the operator MCP server, which is a *network* surface: the same one statement took out the remote console as well as the terminal. Added 2026-09-12, closed 2026-09-14.
 
 **Does not close.** Authorship. An anchor proves the log existed in this form at that time; it does not prove who wrote it, and a malicious administrator who rewrites everything before the next anchor is still out of scope. Signed receipts stay off the roadmap for the reason `SPEC-v0.6.md` §11 gives.
 

diff --git a/docs/production/index.mdx b/docs/production/index.mdx
@@ -28,7 +28,7 @@ need. `test_the_first_line_of_the_section_says_which_store_and_why` asserts the
 
 {/* generated from the suite, pyproject and the soak (full) — run the generator */}
 - **Version 0.10.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14.
-- **6,080 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
+- **6,096 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres).
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak).

diff --git a/docs/production/receipt-integrity.mdx b/docs/production/receipt-integrity.mdx
@@ -19,7 +19,7 @@ database directly.
 
 | Name | What it means | What to do |
 |---|---|---|
-| `content_altered` | receipt *n* no longer hashes to its stored hash | the row was edited; the stored hash says what it was, the row says what it is now |
+| `content_altered` | receipt *n* no longer hashes to its stored hash, **or cannot be read back as a receipt at all** | the row was edited; the stored hash says what it was, the row says what it is now |
-| `content_altered` | receipt *n* no longer hashes to its stored hash, **or cannot be read back as a receipt at all** | the row was edited; the stored hash says what it was, the row says what it is now |
+| `content_altered` | receipt *n* no longer hashes to its stored hash, **or cannot be read back as a receipt at all** | the row was altered or damaged; the stored hash can detect a mismatch but cannot recover the original content |
-| `content_altered` | receipt *n* no longer hashes to its stored hash, **or cannot be read back as a receipt at all** | the row was edited; the stored hash says what it was, the row says what it is now |
+| `content_altered` | receipt *n* no longer hashes to its stored hash, **or cannot be read back as a receipt at all** | the row was altered or damaged; the stored hash can detect a mismatch but cannot recover the original content |
 | `hash_missing` | receipt *n* has a position and no stored hash | the hash column was cleared; nothing can be compared, and this is a failure rather than a skip |
 | `link_broken` | receipt *n*'s link does not match what *n-1* hashes to | a neighbour changed, or two rows were reordered |
 | `missing` | a gap in `seq` | a receipt was deleted from the middle |
@@ -31,6 +31,20 @@ column destroyed every independent copy of every hash, and an earlier reader **s
 comparison it could no longer make and called the chain intact. A check that cannot be evaluated
 is not a check that passed.
 
+## One bad row costs one row
+
+A row can be damaged past reading: one declared key set to the wrong type is enough. Until 0.11
+that raised, and since both stores build every row before handing you any, **one `UPDATE`
+blinded every reader at once** — `ctrlrun inspect` on an untouched action included. Now the row
+is named where it sits and the rest still read:
+
+```
+seq 2  ctr_b9db23088ad0…  UNREADABLE  this row could not be read (InvalidArgument)
+```
+
+`--verify-chain` reports `content_altered` at that `seq`, and `ctrlrun stats` reports the rest
+as `unreadable receipts` rather than dropping them from a total.
+
 `unchained` is never a pass either. Rows from before the chain have no position, so they are read
 separately and reported with their count, and the summary says how many of how many were
 verified. Folding them into a green count would be the same false green in a new costume.
@@ -61,7 +75,8 @@ exception you must handle, and a log with no hole in it.
   created, because a verification tool with a side effect on the thing it verifies is refused.
   `--verify-chain` is the one that reads yours.
 
-**Verified by** `T164` — six tamper cases, each asserted on the **name** and the `seq` and not
+**Verified by** `T510` and `T511` for the readers that no longer blind and the clean store that
+reads exactly as it did, `T164` — six tamper cases, each asserted on the **name** and the `seq` and not
 merely on "invalid", the reordering case included — `T165` for the positive control without which
 every one of those rows would pass against a detector that always says broken, `T167` for
 truncation caught by the head and only by the head, `T168` for the unchained rows that are never

diff --git a/docs/reference/api/Control.mdx b/docs/reference/api/Control.mdx
@@ -5,7 +5,7 @@ description: "Policy, state and evidence composed around a single action (SPEC-v
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Control` — class, defined at `src/ctrlrun/control.py:822`
+`ctrlrun.Control` — class, defined at `src/ctrlrun/control.py:823`
 
 ```python
 from ctrlrun import Control

diff --git a/docs/reference/api/DelegationRecord.mdx b/docs/reference/api/DelegationRecord.mdx
@@ -5,7 +5,7 @@ description: "One row of the `delegations` table (SPEC-v0.3 §5.2)."
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.DelegationRecord` — class, defined at `src/ctrlrun/state.py:386`
+`ctrlrun.DelegationRecord` — class, defined at `src/ctrlrun/state.py:387`
 
 ```python
 from ctrlrun import DelegationRecord

diff --git a/docs/reference/api/EventSink.mdx b/docs/reference/api/EventSink.mdx
@@ -5,7 +5,7 @@ description: "Somewhere a copy of every `Event` and `Receipt` goes (SPEC-v0.2 §
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.EventSink` — class, defined at `src/ctrlrun/receipt.py:800`
+`ctrlrun.EventSink` — class, defined at `src/ctrlrun/receipt.py:898`
 
 ```python
 from ctrlrun import EventSink

diff --git a/docs/reference/api/InMemoryStateStore.mdx b/docs/reference/api/InMemoryStateStore.mdx
@@ -5,7 +5,7 @@ description: "Everything held in process memory: for tests and `ctrlrun demo`."
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.InMemoryStateStore` — class, defined at `src/ctrlrun/state.py:970`
+`ctrlrun.InMemoryStateStore` — class, defined at `src/ctrlrun/state.py:981`
 
 ```python
 from ctrlrun import InMemoryStateStore

diff --git a/docs/reference/api/JSONLEventSink.mdx b/docs/reference/api/JSONLEventSink.mdx
@@ -5,7 +5,7 @@ description: "The JSONL half of the evidence: two append-only files in one direc
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.JSONLEventSink` — class, defined at `src/ctrlrun/receipt.py:819`
+`ctrlrun.JSONLEventSink` — class, defined at `src/ctrlrun/receipt.py:917`
 
 ```python
 from ctrlrun import JSONLEventSink

diff --git a/docs/reference/api/SQLiteStateStore.mdx b/docs/reference/api/SQLiteStateStore.mdx
@@ -5,7 +5,7 @@ description: "Approvals, effects and evidence in one SQLite file (ARCHITECTURE
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.SQLiteStateStore` — class, defined at `src/ctrlrun/state.py:1478`
+`ctrlrun.SQLiteStateStore` — class, defined at `src/ctrlrun/state.py:1489`
 
 ```python
 from ctrlrun import SQLiteStateStore

diff --git a/docs/reference/api/StateStore.mdx b/docs/reference/api/StateStore.mdx
@@ -5,7 +5,7 @@ description: "Durable state behind a `Control` (SPEC-v0.1 §5.3): approvals, eff
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.StateStore` — class, defined at `src/ctrlrun/state.py:636`
+`ctrlrun.StateStore` — class, defined at `src/ctrlrun/state.py:637`
 
 ```python
 from ctrlrun import StateStore
@@ -40,7 +40,7 @@ class StateStore(ApprovalStore, Protocol)
     def put_receipt(receipt: Receipt) -> Receipt
     def chain_head() -> tuple[int, str] | None
     def events() -> tuple[Event, ...]
-    def receipts() -> tuple[Receipt, ...]
+    def receipts() -> tuple[Receipt | UnreadableReceipt, ...]
     def close() -> None
 ```
 

diff --git a/docs/reference/api/context.mdx b/docs/reference/api/context.mdx
@@ -5,7 +5,7 @@ description: "Bind the principal for calls made inside the block."
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.context` — function, defined at `src/ctrlrun/control.py:420`
+`ctrlrun.context` — function, defined at `src/ctrlrun/control.py:421`
 
 ```python
 from ctrlrun import context

diff --git a/docs/reference/api/idempotency_token.mdx b/docs/reference/api/idempotency_token.mdx
@@ -5,7 +5,7 @@ description: "The provider idempotency token for the attempt this executor is ru
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.idempotency_token` — function, defined at `src/ctrlrun/control.py:388`
+`ctrlrun.idempotency_token` — function, defined at `src/ctrlrun/control.py:389`
 
 ```python
 from ctrlrun import idempotency_token

diff --git a/docs/reference/api/postgres-PostgresStateStore.mdx b/docs/reference/api/postgres-PostgresStateStore.mdx
@@ -5,7 +5,7 @@ description: "Approvals, effects and evidence in a Postgres schema (SPEC-v0.6 §
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.postgres.PostgresStateStore` — class, defined at `src/ctrlrun/postgres.py:335`
+`ctrlrun.postgres.PostgresStateStore` — class, defined at `src/ctrlrun/postgres.py:344`
 
 ```python
 from ctrlrun.postgres import PostgresStateStore

diff --git a/docs/reference/api/protect.mdx b/docs/reference/api/protect.mdx
@@ -5,7 +5,7 @@ description: "Bind a function to an action name: every call becomes a decided, r
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.protect` — function, defined at `src/ctrlrun/control.py:4939`
+`ctrlrun.protect` — function, defined at `src/ctrlrun/control.py:4956`
 
 ```python
 from ctrlrun import protect

diff --git a/docs/reference/api/state-Charge.mdx b/docs/reference/api/state-Charge.mdx
@@ -5,7 +5,7 @@ description: "What one reservation spends against one grant's budget (SPEC-v0.9
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.state.Charge` — class, defined at `src/ctrlrun/state.py:513`
+`ctrlrun.state.Charge` — class, defined at `src/ctrlrun/state.py:514`
 
 ```python
 from ctrlrun.state import Charge

diff --git a/docs/reference/api/state-Consumption.mdx b/docs/reference/api/state-Consumption.mdx
@@ -5,7 +5,7 @@ description: "One ledger row, as `consumptions()` hands it back (SPEC-v0.9 §3.3
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.state.Consumption` — class, defined at `src/ctrlrun/state.py:553`
+`ctrlrun.state.Consumption` — class, defined at `src/ctrlrun/state.py:554`
 
 ```python
 from ctrlrun.state import Consumption

diff --git a/docs/reference/api/state-check_charges.mdx b/docs/reference/api/state-check_charges.mdx
@@ -5,7 +5,7 @@ description: "SPEC-v0.9 §3.3.1's predicate, in one place so three backends cann
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.state.check_charges` — function, defined at `src/ctrlrun/state.py:571`
+`ctrlrun.state.check_charges` — function, defined at `src/ctrlrun/state.py:572`
 
 ```python
 from ctrlrun.state import check_charges

diff --git a/docs/reference/api/with_approval.mdx b/docs/reference/api/with_approval.mdx
@@ -5,7 +5,7 @@ description: "Present a granted approval to the calls made inside the block (SPE
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.with_approval` — function, defined at `src/ctrlrun/control.py:443`
+`ctrlrun.with_approval` — function, defined at `src/ctrlrun/control.py:444`
 
 ```python
 from ctrlrun import with_approval

diff --git a/generated/readiness.full.mdx b/generated/readiness.full.mdx
@@ -1,6 +1,6 @@
 {/* generated from the suite, pyproject and the soak (full) — run the generator */}
 - **Version 0.10.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14.
-- **6,080 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
+- **6,096 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres).
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak).

diff --git a/generated/readiness.json b/generated/readiness.json
@@ -18,6 +18,6 @@
     "positive_control": true,
     "unexplained": 0
   },
-  "tests": 6080,
+  "tests": 6096,
   "version": "0.10.0"
 }
diff --git a/generated/readiness.mdx b/generated/readiness.mdx
@@ -1,6 +1,6 @@
 {/* generated from the suite, pyproject and the soak (mdx) — run the generator */}
 - **Version 0.10.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14.
-- **6,080 tests**, every version specified before it was written and every requirement mutation-tested.
+- **6,096 tests**, every version specified before it was written and every requirement mutation-tested.
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).

diff --git a/generated/readiness.readme.md b/generated/readiness.readme.md
@@ -1,6 +1,6 @@
 <!-- generated from the suite, pyproject and the soak (readme) — run the generator -->
 - **Version 0.10.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14.
-- **6,080 tests**, every version specified before it was written and every requirement mutation-tested.
+- **6,096 tests**, every version specified before it was written and every requirement mutation-tested.
 - **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).