ancestors
Walks the parent chain up from the run at key, nearest ancestor first. The run itself is not in the result.
The walk is bounded and cycle-safe, and it needs to be both. limit stops it in a lineage deeper than the caller wants to read. A run already visited stops it outright: a value type can reject a run that is its own parent, but a two-hop cycle needs the other runs to see, so detecting one is the store's job. A store holding a cycle is corrupt; a store that hangs on one is worse.
The walk also stops at the tenant boundary. A parent reference that resolves only in another tenant resolves to nothing here, so a chain read can never leak a neighbour's run.
Return
At most limit ancestors, parent first, ending early at an unresolvable parent or a run already seen. Empty if the run is a root, or is not stored.
Parameters
The run to walk up from.
The most ancestors to return. Must be positive.
Throws
if limit is not positive.