docs(kernel-utils): fix sheaf doc errors from revocation removal

- Remove stale revokePoint/revokeAll/getExported references from README.md
  and USAGE.md (the revocation API was removed in the preceding commit but
  the docs were not updated)
- Fix withRanking/withFilter signatures in USAGE.md: the combinators are
  curried — withRanking(comparator)(inner), not withRanking(comparator, inner)
- Correct the fallthrough doc comment: liftB does receive accumulated errors
  from liftA's attempts via yield* after its own failures (the test at
  compose.test.ts:337 confirms this); liftB is only unaware of them at its
  prime call
- Document the germ identity invariant in LIFT.md: the lift must yield
  elements from its input germs array, not reconstructed objects, because the
  sheaf resolves the dispatch target by object identity

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: grypez

packages/kernel-utils/src/sheaf/LIFT.md

@@ -21,7 +21,10 @@ The sheaf drives it with the following protocol:
 
 1. **Prime** — `gen.next([])` starts the coroutine. The empty array is
    discarded; it exists only to satisfy the generator type.
-2. **Yield** — the coroutine yields a candidate germ to try next.
+2. **Yield** — the coroutine yields a candidate germ to try next. The yielded
+   value must be an element of the `germs` array received on entry — the sheaf
+   uses object identity to map it back to the original section, so constructing
+   a new object with the same shape will produce "lift yielded an unknown germ".
 3. **Attempt** — the sheaf calls the candidate's exo method.
 4. **Success** — the result is returned; the generator is abandoned.
 5. **Failure** — the sheaf calls `gen.next(errors)`, passing the ordered list

packages/kernel-utils/src/sheaf/README.md

@@ -3,9 +3,8 @@
 Runtime capability routing adapted from sheaf theory in algebraic topology.
 
 `sheafify({ name, sections })` produces a **sheaf** — an authority manager
-over a presheaf of capabilities. The sheaf grants revocable dispatch sections
-via `getSection`, tracks all delegated authority, and supports point-wise
-revocation.
+over a presheaf of capabilities. The sheaf grants dispatch sections via
+`getSection` and tracks all delegated authority.
 
 See [USAGE.md](./USAGE.md) for annotated examples and [LIFT.md](./LIFT.md) for
 the lift coroutine protocol and semantic equivalence assumption.
@@ -59,12 +58,8 @@ data (captured at construction time) and a registry of all granted sections.
 const sheaf = sheafify({ name: 'Wallet', sections });
 ```
 
-- `sheaf.getSection({ guard, lift })` — produce a revocable dispatch exo
+- `sheaf.getSection({ guard, lift })` — produce a dispatch exo
 - `sheaf.getDiscoverableSection({ guard, lift, schema })` — same, but the exo exposes its guard
-- `sheaf.revokePoint(method, ...args)` — revoke every granted section whose
-  guard covers the point
-- `sheaf.getExported()` — union guard of all active (non-revoked) sections
-- `sheaf.revokeAll()` — revoke every granted section
 
 ## Dispatch pipeline
 

packages/kernel-utils/src/sheaf/USAGE.md

@@ -31,7 +31,7 @@ const sheaf = sheafify({
 });
 
 const section = sheaf.getSection({ guard: priceGuard, lift: noop });
-// section is a revocable dispatch exo; call it like any capability
+// section is a dispatch exo; call it like any capability
 const price = await E(section).getPrice('ETH');
 ```
 
@@ -119,19 +119,6 @@ sections are assembled dynamically (e.g., rebuilt at runtime from a set of
 grants that changes) and the union guard isn't known until after `sheafify`
 runs, the global variants are the right choice.
 
-## Revocation
-
-```ts
-// revoke every granted section whose guard covers this invocation point
-sheaf.revokePoint('getPrice', 'ETH');
-
-// revoke all granted sections at once
-sheaf.revokeAll();
-
-// union guard of all currently active (non-revoked) sections
-const exported = sheaf.getExported();
-```
-
 ## Remote sections
 
 `makeRemoteSection` wraps a CapTP remote reference as a `PresheafSection`,
@@ -167,9 +154,9 @@ import {
 } from '@metamask/kernel-utils';
 ```
 
-- **`withRanking(comparator, inner)`** — sort germs by comparator before
+- **`withRanking(comparator)(inner)`** — sort germs by comparator before
   passing to `inner`
-- **`withFilter(predicate, inner)`** — remove germs that fail `predicate`
+- **`withFilter(predicate)(inner)`** — remove germs that fail `predicate`
   before passing to `inner`
 - **`fallthrough(liftA, liftB)`** — try all candidates from `liftA` first;
   if all fail, try `liftB`

packages/kernel-utils/src/sheaf/compose.ts

@@ -89,8 +89,9 @@ export const withRanking =
  * `.next(value)` to the inner iterator, so error arrays are correctly
  * threaded through each inner lift.
  *
- * liftB starts fresh and only sees errors from its own failed attempts,
- * not from liftA's attempts.
+ * liftB is not informed of liftA's failures at its prime call, but via
+ * `yield*` it receives all accumulated errors (including liftA's) as the
+ * argument to each subsequent `next(errors)` after its own failed attempts.
  *
  * @param liftA - First lift; its candidates are tried before liftB's.
  * @param liftB - Fallback lift; only invoked after liftA is exhausted.