aontu 0.53.0 → 0.55.0

package/src/val/PathVal.ts

@@ -0,0 +1,221 @@
+/* Copyright (c) 2025 Richard Rodger, MIT License */
+
+// FIRST-CLASS PATHS (docs/design/PATHS.0.md). A PathVal is the value
+// `path(p)` captures: a tree address as DATA -- the spelling, never
+// the resolution. It is a scalar whose peg is the address string in
+// exactly the grammar `refer` reads (`$.a.b` from the root, `.b` from
+// the sibling scope, one more leading dot per parent step), which is
+// what lets a captured path meet the checking machinery unchanged.
+//
+// Meets are SYNTACTIC, by the PREFIX rule (amended, ADR-016): two
+// path values meet when one spells a prefix of the other -- same
+// anchor, the shorter's segments opening the longer's -- and the
+// result is the LONGER: a path can always be told more precisely.
+// Incomparable spellings refuse as any two unequal scalars do.
+// Resolving during a meet would make the meet depend on the value's
+// position, which is the property the staging machinery exists to
+// quarantine -- resolution stays the business of `refer`, `rel` and
+// the graph.
+//
+// The kind sits UNDER string (ScalarKindVal.KIND_PARENT), so `string`
+// admits a path value and the string constraints keep working; a
+// plain string LITERAL and a path value refuse each other, exactly as
+// the number tower's leaves do. A bare string is NEVER a path
+// (ADR-016): `path("...")` -- the call's own string argument -- is
+// the one conversion the language has.
+
+import type {
+  Val,
+  ValSpec,
+} from '../type'
+
+import {
+  AontuContext,
+} from '../ctx'
+
+import { makeNilErr } from '../err'
+
+import { propagateMarks } from '../utility'
+
+import { ScalarVal } from './ScalarVal'
+import { ScalarKindVal, Path } from './ScalarKindVal'
+
+
+
+// A segment of a tree path: a map key or a list index. The same
+// grammar the rest of the engine spells keys with, and a leading digit
+// is legitimate because a list index is one.
+const ADDR_SEGMENT = /^[A-Za-z0-9_-]+$/
+
+export type Address = {
+  // Anchored at the document root (`$.a.b`) rather than at the link's
+  // own position (`.a.b`).
+  absolute: boolean
+  // Parent steps, for a relative address that climbs (`..a` is one).
+  up: number
+  // The written segments, below the anchor.
+  parts: string[]
+}
+
+
+// The address a string spells, or undefined when it does not spell
+// one. An address is a TREE PATH, in exactly the two spellings a
+// reference uses: `$.services.auth` from the root, `.auth` from the
+// link's own sibling scope. The tree is the only namespace -- which is
+// what makes a model instantiable more than once, each instance
+// resolving its relative links inside itself (ADR-014).
+export function parseAddress(s: string): Address | undefined {
+  if ('$' === s) {
+    // The whole document is not a relation's target: an address must
+    // name something with a position to be written back into.
+    return undefined
+  }
+  if (s.startsWith('$.')) {
+    const parts = s.slice(2).split('.')
+    for (const seg of parts) {
+      if (!ADDR_SEGMENT.test(seg)) {
+        return undefined
+      }
+    }
+    return { absolute: true, up: 0, parts }
+  }
+  if (!s.startsWith('.')) {
+    return undefined
+  }
+  // A relative address: the leading dot anchors it at the sibling
+  // scope, and every FURTHER leading dot is one step up from there --
+  // the same reduction a relative reference's `.` segments perform.
+  let up = 0
+  let rest = s.slice(1)
+  while (rest.startsWith('.')) {
+    up++
+    rest = rest.slice(1)
+  }
+  if ('' === rest) {
+    return undefined
+  }
+  const parts = rest.split('.')
+  for (const seg of parts) {
+    if (!ADDR_SEGMENT.test(seg)) {
+      return undefined
+    }
+  }
+  return { absolute: false, up, parts }
+}
+
+
+// The spelling string TEXT converts by, inside a `path(...)` call:
+// text that carries no anchor is RELATIVE (`"a.b"` is the address
+// `.a.b`), matching the raw form (`path(a.b)` captures `.a.b`). Only
+// the anchor is supplied -- the result still has to parse, so
+// malformed text (`""`, `"a..b"`, a bad `$` spelling) refuses as
+// before. The prefix is not applied to text that claims an anchor:
+// `"$x"` is a broken absolute address, not a relative one.
+export function textAddress(s: string): string {
+  return ('$' === s[0] || '.' === s[0]) ? s : '.' + s
+}
+
+
+// The LONGER of two addresses when one spells a prefix of the other
+// (docs/design/PATHS.0.md, amended): same anchor -- absolute or the
+// same number of parent steps -- and the shorter's segments open the
+// longer's. The meet of two path values, and of a refer's address
+// with a later path peer: a path can always be told more precisely,
+// and the more precise spelling is the result. Undefined when the two
+// are not comparable, which refuses as any two unequal scalars do.
+// Both arguments must already be valid addresses: every caller hands
+// over a PathVal peg or a refer addrsrc, and both are validated at
+// capture or conversion -- the same trust `unify`'s own address arm
+// extends (`parseAddress(p.peg) as Address`).
+export function prefixMeet(a: string, b: string): string | undefined {
+  const pa = parseAddress(a) as Address
+  const pb = parseAddress(b) as Address
+  if (pa.absolute !== pb.absolute || pa.up !== pb.up) {
+    return undefined
+  }
+  const short = pa.parts.length <= pb.parts.length ? pa : pb
+  const long = short === pa ? pb : pa
+  for (let i = 0; i < short.parts.length; i++) {
+    if (short.parts[i] !== long.parts[i]) {
+      return undefined
+    }
+  }
+  return short === pa ? b : a
+}
+
+
+
+class PathVal extends ScalarVal {
+  isPath = true
+
+  constructor(
+    spec: ValSpec,
+    ctx?: AontuContext
+  ) {
+    super({ peg: spec.peg, kind: Path }, ctx)
+  }
+
+  // Two path values meet by the PREFIX rule (ADR-016): the longer
+  // when one opens the other, refusal otherwise. Exactly equal pegs
+  // are absorbed by unite's fast path before this runs, so the arm
+  // sees the unequal pairs; the winner carries both sides' marks, as
+  // the equal-scalar arm has always ratcheted them.
+  unify(peer: Val, ctx: AontuContext): Val {
+    const p: any = peer
+    if (true === p.isPath) {
+      const merged = prefixMeet(this.peg, p.peg)
+      if (undefined === merged) {
+        return makeNilErr(ctx, 'scalar_value', this, peer)
+      }
+      const out = merged === this.peg ? this : p
+      const other = out === this ? p : this
+      propagateMarks(other, out)
+      return out
+    }
+    return super.unify(peer, ctx)
+  }
+
+  // Reparses to the same VALUE: the call form is the literal syntax
+  // for this kind, so canon renders it back. The peg is already the
+  // address grammar, which the argument grammar also accepts.
+  get canon() {
+    return 'path(' + this.peg + ')'
+  }
+
+  // The super() ladder lifts a path value to its own kind, and the
+  // kind must render as `path()` -- the bare word `path` is an
+  // ordinary string. ScalarVal.superior would mint the plain
+  // ScalarKindVal, whose canon is the bare word.
+  superior() {
+    return this.place(new PathKindVal({}))
+  }
+
+} /* node:coverage ignore next 4 */
+
+
+// The path KIND, `path()`: admits every path value and defaults to
+// nothing, as `string` does. It does NOT promote (ADR-016): a bare
+// string meeting the kind refuses through the generic kind ladder,
+// exactly as `integer & "x"` does -- `path("...")` is the one string
+// conversion, and it happens at the call.
+class PathKindVal extends ScalarKindVal {
+  isPathKind = true
+
+  constructor(
+    spec: ValSpec,
+    ctx?: AontuContext
+  ) {
+    super({ ...spec, peg: Path }, ctx)
+  }
+
+  get canon() {
+    return 'path()'
+  }
+
+} /* node:coverage ignore next 6 */
+
+
+export {
+  PathVal,
+  PathKindVal,
+}

package/src/val/PlusOpVal.ts

@@ -59,6 +59,61 @@ function isBig(k: OpKind): boolean {
 }
 
 
+// Only concrete scalar operands are valid: anything else (kinds, maps,
+// lists, null, top, funcs) must not coerce — the JS `+` would leak
+// internals like "[object Object]" into output. A non-scalar operand
+// leaves the op unresolved, which generate() reports.
+//
+// A pref operand contributes its preferred value (`pref(1)+2`), and
+// therefore that value's kind too.
+function operand(v: any) {
+  while (v?.isPref) {
+    v = v.peg
+  }
+  return v
+}
+
+
+// The operand's LEAF, not the JavaScript type of its peg: integer and
+// float share `number`, while the exact leaves are told apart from each
+// other and from everything else by their own flags. The whole ladder in
+// `operate` dispatches on this and never on `typeof`.
+function opkind(v: any): OpKind | undefined {
+  if (!(v?.isVal && v.isScalar)) {
+    return undefined
+  }
+  if (v.isBigInteger) {
+    return 'biginteger'
+  }
+  if (v.isBigDecimal) {
+    return 'bigdecimal'
+  }
+  if (v.isInteger) {
+    return 'integer'
+  }
+  const t = typeof v.peg
+  return 'number' === t ? 'float' :
+    'string' === t ? 'string' :
+      'boolean' === t ? 'boolean' :
+        undefined
+}
+
+
+// THE TEXT `+` WOULD MAKE OF THIS OPERAND, or undefined if `+` would not
+// take it at all.
+//
+// `join` folds with `+` seeded with `""`, so every member goes through
+// concatenation's string branch — and this is the function that branch
+// calls. Exported so that the fold and the operator cannot drift into
+// two answers to "how does a number become text": there is one
+// rendering, `digits` below, and both reach it here.
+function plusText(v: Val): string | undefined {
+  const o: any = operand(v)
+  const k = opkind(o)
+  return undefined === k ? undefined : digits(o, k)
+}
+
+
 class PlusOpVal extends OpBaseVal {
   isPlusOp = true
 
@@ -80,43 +135,6 @@ class PlusOpVal extends OpBaseVal {
 
 
   operate(ctx: AontuContext, args: Val[]) {
-    // Only concrete scalar operands are valid: anything else (kinds,
-    // maps, lists, null, top, funcs) must not coerce — the JS `+` would
-    // leak internals like "[object Object]" into output. A non-scalar
-    // operand leaves the op unresolved, which generate() reports.
-    const operand = (v: any) => {
-      // A pref operand contributes its preferred value (`pref(1)+2`),
-      // and therefore that value's kind too.
-      while (v?.isPref) {
-        v = v.peg
-      }
-      return v
-    }
-
-    // The operand's LEAF, not the JavaScript type of its peg: integer
-    // and float share `number`, while the exact leaves are told apart
-    // from each other and from everything else by their own flags. The
-    // whole ladder below dispatches on this and never on `typeof`.
-    const opkind = (v: any): OpKind | undefined => {
-      if (!(v?.isVal && v.isScalar)) {
-        return undefined
-      }
-      if (v.isBigInteger) {
-        return 'biginteger'
-      }
-      if (v.isBigDecimal) {
-        return 'bigdecimal'
-      }
-      if (v.isInteger) {
-        return 'integer'
-      }
-      const t = typeof v.peg
-      return 'number' === t ? 'float' :
-        'string' === t ? 'string' :
-          'boolean' === t ? 'boolean' :
-            undefined
-    }
-
     const av: any = operand(args[0])
     const bv: any = operand(args[1])
     const ak = opkind(av)
@@ -251,4 +269,5 @@ function decimal(v: any, k: OpKind): Decimal {
 
 export {
   PlusOpVal,
+  plusText,
 }

package/src/val/PrefVal.ts

@@ -11,18 +11,20 @@ import {
 
 import { AontuContext } from '../ctx'
 import { unite } from '../unify'
-import { AontuError } from '../err'
+import { AontuError, makeNilErr } from '../err'
 
 import {
   explainOpen,
   ec,
-  explainClose,
+  explainClose
 } from '../utility'
 
 
 import { top } from './top'
 
 import { FeatureVal } from './FeatureVal'
+import { trialUnify } from './FuncBaseVal'
+import { superOf } from './SuperFuncVal'
 
 
 // The innermost preferred value under every pref layer: the value a
@@ -39,6 +41,22 @@ function prefInnerPeg(v: Val): Val {
 }
 
 
+// A CONTAINER DEFAULT IS LEAFWISE (ADR-011 R3,
+// docs/design/DEFAULTS.0.md): `*{p:1}` MEANS `{p: *1}` and `*[1]`
+// means `[*1]`, so there is no such thing as a preference whose
+// preferred value is a bag. Shape is not a value and takes no star --
+// key optionality, closedness and a `&:` spread template ride through
+// untouched; only the values a reader could override are defaulted.
+//
+// This is the rule `pref()` already had (its resolve walked and
+// wrapped every scalar child) and the star prefix did not, so the two
+// spellings of one operator disagreed: `pref({p:1}) & {q:2}` kept the
+// `p` default and `*{p:1} & {q:2}` dropped it. Both spellings and the
+// resolve-time case (`*$.shape`) come through here now, so they
+// cannot drift apart again. Wrapping the non-bag arm rather than
+// walking for scalars also closes the other half of that gap:
+// `pref(integer)` and `pref(min(3))` used to answer the bare value,
+// losing the preference outright.
 class PrefVal extends FeatureVal {
   isPref = true
   isGenable = true
@@ -75,6 +93,15 @@ class PrefVal extends FeatureVal {
 
   rank: number = 0
 
+  // THE OVERRIDE SPACE, NARROWED (ADR-011 R1). The second arm of the
+  // distribution -- `super(x) & every peer met so far` -- kept here as
+  // well as in `superpeg`, because resuper() recomputes the gate from
+  // the peg whenever the peg resolves and would otherwise widen it
+  // back to `super(x)`: a rank>=2 default, whose peg is itself a
+  // preference and so is re-driven, lost its narrowing that way and
+  // let a pinned `***false & false` be overridden by `true`.
+  narrowed?: Val
+
   constructor(
     spec: ValSpec,
     ctx?: AontuContext
@@ -88,14 +115,23 @@ class PrefVal extends FeatureVal {
       this.rank = 1 + spec.peg.rank
     }
 
-    this.resuper()
+    this.resuper(ctx)
     // console.log('PVC', this.peg.canon, this.superpeg.canon)
   }
 
 
   // Recompute the type yardstick and the override gate from the current
   // peg. Called again whenever the peg resolves (e.g. a ref).
-  private resuper() {
+  //
+  // THE GATE IS super() (ADR-011 R4, docs/design/DEFAULTS.0.md). `*x`
+  // is sugar for `*x | super(x)`, so the type an overriding peer must
+  // pass is the one the long form spells out loud -- one function, not
+  // a second implementation that agrees with it on the common case.
+  // Two special cases retired with the switch: a KIND peg gated
+  // nothing (`*integer` was overridden by `"s"`) and a CONSTRAINT peg
+  // had no gate at all, both written when a kind's superior was top.
+  // `super(integer)` is `number`, so `7` still wins and `"s"` refuses.
+  private resuper(ctx?: AontuContext) {
     // THE RANK-UNIFORM MEET (ADR-004). The yardstick is the INNERMOST
     // preferred value's kind, whatever the preference's rank: `**1.5`
     // defends `float` exactly as `*1.5` does. The old rule read the
@@ -107,25 +143,38 @@ class PrefVal extends FeatureVal {
     // rank-1 spelling of the same document kept it. One rule, every
     // rank. Pinned by test/spec/pref.tsv (pref-rank2-* rows, and the
     // flipped pref-nested-concrete-wins).
+    // THE RANK-UNIFORM MEET (ADR-004) is unchanged: the yardstick is
+    // the INNERMOST preferred value, whatever the rank, so `**1.5`
+    // defends `float` exactly as `*1.5` does.
     let peg: any = this.peg
     while (true === peg?.isPref) {
       peg = peg.peg
     }
 
-    // A preference whose peg is ITSELF a kind (`*integer`) constrains
-    // nothing: there is no type-of-a-type in this lattice, so any peer
-    // wins. (Pinned by test/spec/var.tsv:var-pref-kind-narrow. Before
-    // the tower this fell out of a ScalarKindVal's superior being top;
-    // now that a leaf kind lifts to `number`, it has to be said.)
-    if (true === peg.isScalarKind) {
-      this.superpeg = top()
-      return
-    }
+    const base = superOf(ctx as AontuContext, peg)
+
+    // A gate that a meet has already narrowed stays narrowed: the
+    // override space only ever shrinks.
+    this.superpeg = null == this.narrowed ? base
+      : unite(ctx as AontuContext, base, this.narrowed,
+        'pref-narrow/' + this.id)
+  }
+
 
-    // No optional chain: superior() is contractually non-null (every
-    // Val returns one, a NilVal returning itself), so guarding against
-    // nullish here would claim a possibility the type does not have.
-    this.superpeg = peg.superior()
+  // The default, standing but NARROWED: `*integer & 7` is `*7`, which
+  // is what the long form answers (`(integer&7) | (number&7)` keeps
+  // the star on the arm that survived). The rank rides across -- a
+  // ladder rung that narrows is still that rung.
+  // The rank is REBUILT as nesting rather than stamped: canon renders
+  // one star per layer (`'*' + peg.canon`), so a rank set directly on
+  // a single layer would print `*x` for a rank-2 default and the
+  // document would no longer round-trip.
+  private restand(met: Val, ctx: AontuContext): Val {
+    let out: Val = met
+    for (let rI = 0; rI <= this.rank; rI++) {
+      out = new PrefVal({ peg: out }, ctx)
+    }
+    return this.place(out)
   }
 
 
@@ -143,9 +192,27 @@ class PrefVal extends FeatureVal {
         this.peg, top(), 'pref/resolve')
       // console.log('PREF-RESOLVED', this.peg.canon, '->', resolved)
       this.peg = resolved
-      this.resuper()
+      this.resuper(ctx)
     }
 
+    // A CONTAINER DEFAULT IS LEAFWISE IN EFFECT (ADR-011 R3), and it
+    // gets there through the meet above rather than through a rewrite.
+    // `*{p:1}` keeps its written shape -- canon prints `*{"p":1}` and
+    // reparses to itself, which a rewrite to `{p:*1}` would break, and
+    // an alternative still has a star for a disjunction to choose by.
+    // What makes it leafwise is that the two arms decide:
+    //
+    //   `& {q:2}`  the preferred value ITSELF admits the peer (maps
+    //              merge), so the default stands as `*{p:1,q:2}` and
+    //              `p` survives -- it used to be REPLACED outright.
+    //   `& {p:2}`  the preferred value refuses, so the gate answers:
+    //              `super({p:1})` is `{p:integer}`, which admits it.
+    //   `& "s"`    both arms are empty, so the whole default is --
+    //              a string used to override a map default silently.
+    //
+    // Which is every rule R3 asks for, with no bag ever standing where
+    // the author wrote a scalar and no canon that fails to round-trip.
+
     if (peer instanceof PrefVal) {
       why += 'pref-'
       if (this.id === peer.id) {
@@ -173,9 +240,20 @@ class PrefVal extends FeatureVal {
         //   peer.peg.id, peer.peg, peer.peg.done,
         // )
 
-        let peg = unite(te ? ctx.clone({ explain: ec(te, 'PREF-PEER') }) : ctx,
-          this.peg, peer.peg, 'pref-peer/' + this.id)
-        out = new PrefVal({ peg }, ctx)
+        const peg = trialUnify(ctx, prefInnerPeg(this).clone(ctx),
+          prefInnerPeg(peer))
+
+        // TWO DEFAULTS OF EQUAL RANK THAT CANNOT AGREE (ADR-011 R2):
+        // the refusal is about the DEFAULTS, not about the values they
+        // happen to hold, and its hint names the fix -- rank one of
+        // them. Compatible pegs still fold (`*1 & *integer` is `*1`),
+        // and identical ones collapse, so only a real disagreement
+        // reaches this arm. The three spellings of it -- `*1 & *7`,
+        // `(*1|integer) & *7` and `*1|*7` -- used to answer a value
+        // conflict, the newcomer, and the newcomer again.
+        out = undefined === peg
+          ? makeNilErr(ctx, 'pref_rank_clash', this, peer, 'unify')
+          : this.restand(peg, ctx)
         // console.log('PREF-RANK-SAME-OUT', peg, peg.done, out, out.done)
         why += 'rank-same'
       }
@@ -183,25 +261,84 @@ class PrefVal extends FeatureVal {
     else if (!peer.isTop) {
       why += 'super-'
 
-      out = unite(te ? ctx.clone({ explain: ec(te, 'SUPER') }) : ctx,
-        this.superpeg, peer, 'pref-super/' + this.id)
-
-      // The peer added nothing beyond a type the preferred value already
-      // satisfies (`*1 & integer`, `*1 & number`), so the preference
-      // stands — as ITSELF, rank intact (ADR-004). Returning the peg
-      // here (the old rule) demoted the preference to a concrete value
-      // at rank 0 and to a lower rank above it, which both destroyed
-      // overridability (`*1 & integer` then `2` was a conflict) and
-      // broke the layered-defaults ladder: a team's `**debug|string`
-      // meeting an env's `string` branch produced a rank-0 `*debug`
-      // that then fought the env's own rank-0 `*warn` as an equal.
-      // Anything else is a concrete override and wins (subject to the
-      // disjunct admission gate in DisjunctVal).
-      if (out.same(this.superpeg)) {
-        out = this
-        why += 'same'
+      // THE MEET IS THE DESUGARING, DISTRIBUTED (ADR-011 R1,
+      // docs/design/DEFAULTS.0.md). `*x` stands for `*x | super(x)`,
+      // and a peer meets a disjunction arm by arm:
+      //
+      //     (x & peer)  |  (super(x) & peer)
+      //
+      // THE FIRST ARM DECIDES. When the preferred value itself still
+      // satisfies the peer the default STANDS -- `*1 & integer`,
+      // `*8080 & min(1024)`, `**2 & neq(1)`: the peer narrowed the
+      // type without ruling the default out, which is the whole point
+      // of writing one. Only when that arm is empty does the second
+      // answer, and that is the override. When BOTH are empty nothing
+      // remains of the disjunction the star stands for -- `empty`,
+      // the same refusal the written-out long form gives.
+      //
+      // The old rule asked instead whether the peer resolved to
+      // exactly `super(x)`, so any narrowing at all counted as an
+      // override: `*1 & integer` stood (the peer WAS the gate) but
+      // `*8080 & min(1024)` silently dropped the default and answered
+      // the bare constraint, and a rank ladder lost its weaker arm to
+      // the same rule the moment anything narrowed it.
+      //
+      // Trialled against a CLONE, on the innermost value (the
+      // rank-uniform meet): the preferred value must stay pristine for
+      // the arm that stands, and a failed trial must not leave its
+      // errors on the context -- the DisjunctVal admission gate's own
+      // precedent, and its mechanism.
+      const met = trialUnify(ctx, prefInnerPeg(this).clone(ctx), peer)
+
+      if (undefined !== met) {
+        // THE SECOND ARM IS CARRIED FORWARD, not discarded. It is the
+        // override space -- everything the peer would still admit
+        // INSTEAD of the default -- and meeting a peer narrows it just
+        // as it narrows the default: two successive meets compose to
+        // `(x & p1 & p2) | (super(x) & p1 & p2)`, which is the
+        // distribution over both. Dropping it let a constraint that
+        // arrived beside a default vanish: `r:*2` with `r:max(20)`
+        // stood as a bare `*2`, and `r:40` then overrode it through a
+        // gate that no longer remembered the bound.
+        //
+        // It cannot fail: the first arm succeeded, so `x & peer` has a
+        // value, and that value satisfies `super(x)` and `peer` both.
+        const gate = unite(te ? ctx.clone({ explain: ec(te, 'GATE') }) : ctx,
+          this.superpeg.clone(ctx), peer, 'pref-gate/' + this.id)
+
+        // Unchanged on both counts is the SAME preference, returned as
+        // itself: minting a new one every pass would keep the fixpoint
+        // moving for ever.
+        if (met.same(prefInnerPeg(this)) && gate.same(this.superpeg)) {
+          out = this
+        }
+        else {
+          const stood = this.restand(met, ctx) as PrefVal
+          stood.narrowed = gate
+          stood.superpeg = gate
+          out = stood
+        }
+
+        why += 'stands'
+        explainClose(te, out)
+        out.dc = DONE
+        return out
       }
 
+      // The override arm is trialled too: its failure is not the
+      // answer, it is half of the reason the answer is `empty`, and a
+      // recorded `no_scalar_unify` would be the code the reader sees
+      // however the refusal is relabelled afterwards.
+      const over = trialUnify(ctx, this.superpeg.clone(ctx), peer)
+
+      out = undefined !== over ? over
+        // A peer that arrived already failed keeps its own refusal:
+        // that is its failure, not the default's.
+        : peer.isNil ? peer
+          : makeNilErr(ctx, 'empty', this, peer, 'unify')
+
+
+
       // }
     }
     else {
@@ -234,6 +371,17 @@ class PrefVal extends FeatureVal {
 
   clone(ctx: AontuContext, spec?: ValSpec): Val {
     let out = (super.clone(ctx, spec) as PrefVal)
+
+    // THE NARROWED OVERRIDE SPACE TRAVELS WITH THE COPY (ADR-011 R1).
+    // A default a meet has pinned stays pinned through a reference:
+    // without this, `T:{e:***false & false}` copied by `f:$.T` handed
+    // back a default whose gate had widened again to `boolean`, and
+    // `f:{e:true}` overrode a value the author had pinned. The Go
+    // twin carries the same two fields explicitly (clone.go).
+    if (null != this.narrowed) {
+      out.narrowed = this.narrowed
+      out.superpeg = this.superpeg
+    }
     // THE PER-DESTINATION INSTANTIATION RULE (ADR-005). The default
     // clone shares the preferred value (`peg: this.peg` in Val.clone)
     // — a cloned pref spread template resolves its inner value at the