…ESCRIPTION

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…tion

`getSection({ guard, lift })` now requires an explicit interface guard,
mirroring how `makeExo` always requires one. `getGlobalSection({ lift })`
is the new convenience wrapper that computes the full union guard from
all presheaf sections, analogous to `makeDefaultExo`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… dispatch

Replace string-log side-channels and return-value inference with explicit
vi.fn() spy assertions. Each section's handler is a named mock; tests call
expect(spy).toHaveBeenCalledWith(...) and .not.toHaveBeenCalled() to verify
routing directly rather than inferring it from coincident return values.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…rg sections

`getGuardAt` was returning `undefined` for positions beyond a section's
fixed argument range, even when a `restArgGuard` was present. This caused
rest-arg sections to be absent from optional-position unions, producing
a false negative: e.g. `M.call().rest(M.string())` would not cover
position 0 in the union, so a call `['hello']` would fail the collected
guard even though the section accepts it.

Fix: fall through to `payload.restArgGuard` after exhausting the optional
array, so rest-arg sections contribute to every optional position in the
union.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add MetaDataSpec<M> discriminated union (constant | source | callable) so
that sheaf metadata can vary with call arguments rather than being static.

- constant(v)   — static value, evaluated once
- source(s)     — JS source string compiled via Compartment at sheafify
                  construction time, called at dispatch time
- callable(fn)  — live function called at dispatch time

PresheafSection.metadata changes from M to MetaDataSpec<M> (breaking).
A new EvaluatedSection<M> type carries post-evaluation metadata and is
what Lift receives as its germs array.  EvaluatedSection is distinct from
PresheafSection because the "germ" in the sheaf-theoretic sense only
exists after quotienting by the metadata-equivalence relation (the
collapseEquivalent step); EvaluatedSection describes the pre-collapse
stage where the spec has been applied to the invocation args.

getStalk is generalised to <T extends { exo: Section }> so it works over
ResolvedSection (the internal post-resolution type) without a cast.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- getStalk: accept readonly T[] to allow frozen section arrays
- evaluatedStalk map: omit metadata when undefined via ifDefined for
  exactOptionalPropertyTypes (metadata?: M ≠ metadata: M | undefined)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Made-with: Cursor

- evaluateMetadata returns a plain object; missing spec and nullish raw → {}
- reject primitives, arrays, and non-plain objects; hint { value: myValue }
- require EvaluatedSection.metadata; MetaData extends Record<string, unknown>
- simplify metadataKey and decomposeMetadata; drop ifDefined in dispatch

Made-with: Cursor

Replace the one-shot `Lift<M> = (...) => Promise<number>` with an
AsyncGenerator coroutine protocol. The lift receives a snapshot of the
accumulated error array on each `gen.next(errors)` call, yields
candidates one at a time, and can stop early or fall through based on
the error history.

Add `drive.ts` with `driveLift` to encapsulate the retry loop used by
`sheafify.ts`. Add `compose.ts` with `proxyLift`, `withFilter`,
`withRanking`, and `fallthrough` as composition primitives. Export all
four from `index.ts`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Cover proxyLift, withFilter, withRanking, fallthrough, and composed
combinations in compose.test.ts. Includes driveToExhaustion and
driveWithSuccessOn test helpers that pass error snapshots (not mutable
references) to gen.next, so inner generators can safely store the
received arrays.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

On exhaustion, throw a new Error with the full errors array as `cause`
rather than re-throwing the last error. This preserves the complete
failure history for diagnostics.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add a Sheaf Module section covering sheafify, metadata kinds, lift
authoring, composition helpers, and error handling on exhaustion.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…eaf sections

Adds `makeRemoteSection(name, remoteRef, metadata?)` which asynchronously
fetches the interface guard from a CapTP remote ref via E()[GET_INTERFACE_GUARD]()
and returns a PresheafSection with a local forwarding exo — eliminating the
boilerplate of building per-method handlers by hand when wrapping remote caps.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ion methods

Adds getDiscoverableSection and getDiscoverableGlobalSection to the Sheaf API
so callers can attach a MethodSchema (for __getDescription__) to the
caller-facing dispatch section rather than inside individual capability wrappers.
Marks getGlobalSection and getDiscoverableGlobalSection as @deprecated —
callers should supply an explicit InterfaceGuard via getSection/getDiscoverableSection
instead of relying on the auto-computed union.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…terfaces

The async interface guard synthesized for a sheaf section must admit implicit
exo methods like __getDescription__ that @endo/exo adds to every discoverable
exo. Without passable default guards, those methods are rejected at dispatch
time, preventing sheafs from being sent across a CapTP connection.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Detaching a method via destructuring or assignment strips the CapTP receiver
binding and the remote rejects the call as an "Unexpected receiver". Invoke
each method through a fresh E(remote)[method] access so the receiver is
preserved on every dispatch.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…n makeRemoteSection

The E() proxy index lookup returns T|undefined under noUncheckedIndexedAccess,
but method is always present — it comes from Object.keys(methodGuards).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…wedHosts

URL.host includes the port ('127.0.0.1:PORT') but makeHostCaveat checks
URL.hostname which strips the port. Same regression as the docker e2e fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>