feat(kernel-utils): narrow

[ci-belphegor]

Explanation

Wraps the guard algebra in an exo. narrow reads the base's interface guard through E(), derives the narrowed guard, and returns an exo whose methods forward to the base.

Enforcement is the returned exo's own guard checking — there is no separate check step. That is not only an economy: because narrow constructs AND(guard(base), X) rather than verifying a caller-supplied guard, guard(B) ≤ guard(A) holds by construction, which is what makes join sound without a pattern subtyping decision procedure.

The guard is fetched over E() whether or not the base is local, so one code path survives the base later being a cross-vat presence.

Provenance and flattening. A module-level WeakMap records { base, delta, baseGuard } per minted exo. Narrowing a narrowing flattens: the result forwards straight to the original base under the conjunction of both deltas, so a chain of any depth costs one guard fetch and stays one hop deep, and join reaches across the whole narrowing tree rather than only between siblings.

Unmarks three ratchet cases.

Notes for reviewers

The forwarder cannot be hoisted, and this is load-bearing. An earlier attempt lifted the lookup out of the returned closure:

const invoke = E(target)[methodName]!;
return async (...args) => invoke(...args);

That looks equivalent and is not — E() refuses an invoker called detached from the proxy that produced it, and the working case came back rejected:Unexpected receiver for "read" method of E("[Alleged: Store]"). The JSDoc records this so it is not reintroduced.

The non-null assertion on the method lookup is deliberate and narrowly disabled: noUncheckedIndexedAccess makes indexing a string-keyed record yield | undefined, but the E() proxy's get handler manufactures an invoker for any property name and never returns undefined, so the optionality is purely type-level. An optional call (?.) was rejected here on purpose — after PR 8, a misspelled method on a default-guarded base must reject, not silently return undefined.

conjoinDeltas takes its keys from the incoming delta alone and throws when the incoming names a key the existing lacks. Without that, narrowing a narrowing that had dropped a method would compute against the original base's guard and hand back authority the intermediate never had.

Observed after unmarking: ok:read:srv/data/x; rejected:… arg 0: "etc" - Must be: "srv"; rejected:target has no method "stat", has ["__getInterfaceGuard__","__getMethodNames__","read"].

Stack

PR 6 of 12. Base: #1051.