Documentation

makeRevocable sup cap returns a pair (wrappedCap, revoke), such that wrappedCap is cap wrapped by a membrane which forwards all method invocations along until revoke is executed, after which all methods that cross the membrane (in either direction) will return errors.

Note that, as per usual with membranes, the membrane will wrap any objects returned by method calls. So revoke cuts off access to the entire object graph reached through cap.