feat: Zoe use watchPromise() to wait for contract finish

[Chris-Hibbert]

fixes: #8387
fixes: #8265
fixes: #8263
fixes: #8915

Description

Zoe wants to exit all seats when the contract completes. It currently attempts to do that with an ephemeral promise, which will break when Zoe itself is upgraded. This uses durable watched promises to surmount that problem.

Security Considerations

Zoe's durability guarantees, and ability to maintain payout liveness when a contract crashes.

Scaling Considerations

Not a major issue.

Documentation Considerations

N/A

Testing Considerations

There are two tests of upgrade in zoe (test-zoe-upgrade and upgrade-covered-call). These tests invoke the new onFulfilled handler.

This PR updates test-zoe-upgrade to include a restart (null upgrade) of the vat-admin vat. With that and a fix (581e9ad8) to the test, the old code fails the upgrade, and the new code passes.

Upgrade Considerations

It's all about upgrade.

[turadg]

Agoric/agoric-3-proposals#18 tests upgrading agoric-3 with this version of Zoe.

The upgrade is failing due to: "durable Kind stateShape mismatch (body)"

#102 37.46 2023-11-08T23:27:35.351Z SwingSet: vat: v1: evaluateBundleCap { manifestBundleRef: { bundleID: 'b1-a3dc21c56535b4bebdf8c8413650eec2b37a6d9f5669b27f8c571601a6f641ffae2b925dd7e3d67c6953a1f8122c8ba814305e034c9087056816a6f05dd41069' }, exportedGetManifest: 'getManifestForUpgradingZoe', vatAdminSvc: Promise [Promise] {} }
#102 37.53 2023-11-08T23:27:35.421Z SwingSet: vat: v1: execute { exportedGetManifest: 'getManifestForUpgradingZoe', behaviors: [ 'getManifestForUpgradingZoe', 'upgradeZoe' ] }
#102 37.53 2023-11-08T23:27:35.422Z SwingSet: vat: v1: coreProposal: upgradeZoe
#102 37.54 2023-11-08T23:27:35.432Z SwingSet: vat: v1: ZOE BUNDLE ID:  b1-31f084378c798adc3018ac20670b43774adeb2c17e67c5676909a7ae7a806cb3c23cb671252d829a65f12ca052be8ef796dd9815d651b9e0372cfb8699e6e939
#102 38.20 block produced
#102 38.24 Waiting for proposal 7 to pass (status=PROPOSAL_STATUS_VOTING_PERIOD)
#102 38.24 1
#102 38.50 2023-11-08T23:27:36.391Z SwingSet: xsnap: v9: error during vat dispatch() of startVat,[object Object] (Error#1)
#102 38.50 2023-11-08T23:27:36.391Z SwingSet: xsnap: v9: Error#1: durable Kind stateShape mismatch (body)
#102 38.50 2023-11-08T23:27:36.391Z SwingSet: xsnap: v9: Error: durable Kind stateShape mismatch (body)
#102 38.50  at construct ()
#102 38.50  at Error (/bundled-source/.../node_modules/ses/src/error/tame-error-constructor.js:56)
#102 38.50  at makeError (/bundled-source/.../node_modules/ses/src/error/assert.js:243)
#102 38.50  at fail (/bundled-source/.../node_modules/ses/src/error/assert.js:357)
#102 38.50  at insistSameCapData (/bundled-source/.../packages/swingset-liveslots/src/virtualObjectManager.js:279)
#102 38.50  at defineKindInternal (/bundled-source/.../packages/swingset-liveslots/src/virtualObjectManager.js:799)
#102 38.50  at defineDurableKind (/bundled-source/.../packages/swingset-liveslots/src/virtualObjectManager.js:1155)
#102 38.50  at makeStartInstance (.../zoe/src/zoeService/startInstance.js:213)
#102 38.50  at makeDurableZoeKit (.../zoe/src/zoeService/zoe.js:154)
#102 38.50  at buildRootObject (.../vats/src/vat-zoe.js:21)
#102 38.50  at startVat (/bundled-source/.../packages/swingset-liveslots/src/liveslots.js:1476)
#102 38.50  at ()
#102 38.50  at ()
#102 38.50
#102 38.50 2023-11-08T23:27:36.391Z SwingSet: xsnap: v9: UnhandledPromiseRejectionWarning: (Error#1)
#102 38.51 2023-11-08T23:27:36.395Z SwingSet: kernel: WARNING: vat v9 failed to upgrade from incarnation 0 (startVat)

[turadg]

The upgrade is failing due to: "durable Kind stateShape mismatch (body)"

Fixed by reverting the string in the M.remotable within InstanceAdminShape. I amended and force-pushed. Now it just has a comment.

[Chris-Hibbert]

PTAL, @erights @warner @turadg
This is the primary PR on the path to upgrading Zoe. Once it's approved for the branch master, I'll make a rebase to the dev-branch for staging for release to the chain.

[turadg]

This param isn't used. I thought we could remove it, but then remembered that in the latest Endo, Exo methods fail if they are passed extra arguments. Filing for future work: #8709

[Chris-Hibbert]

I'm getting conflicting opinions from tslint. If I have the following ts-expect-error in startInstance.js

          // @ts-expect-error XXX reason isn't necessarily an Error
          instanceAdmin.failAllSeats(reason);

then yarn lint from packages/zoe is happy, but when run from packages/vats, it complains ../zoe/src/zoeService/startInstance.js:92:11 - error TS2578: Unused '@ts-expect-error' directive.

If I leave out the ts-expect-error, then lint from .../vats is happy, but from .../zoe is complains src/zoeService/startInstance.js:92:38 - error TS2345: Argument of type 'unknown' is not assignable to parameter of type 'Error'.

Somehow CI runs both checks. Is there a way to make them both happy?