@agoric/cosmic-swingset 0.42.0-upgrade-16-dev-12b78e3.0 → 0.42.0-upgrade-17-dev-a61cdab.0

package/CHANGELOG.md

@@ -3,29 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
-## [0.42.0-u16.1](https://github.com/Agoric/agoric-sdk/compare/@agoric/cosmic-swingset@0.42.0-u16.0...@agoric/cosmic-swingset@0.42.0-u16.1) (2024-07-10)
-
-
-### Bug Fixes
-
-* adopt `VTRANSFER_IBC_EVENT` as an action-type ([#9671](https://github.com/Agoric/agoric-sdk/issues/9671)) ([67569d4](https://github.com/Agoric/agoric-sdk/commit/67569d4a2461c5415b3cc33f5faee9070f8d3c2e)), closes [#9670](https://github.com/Agoric/agoric-sdk/issues/9670)
-* **vm-config:** always use `init-localchain` and `init-transfer` ([1db4ed6](https://github.com/Agoric/agoric-sdk/commit/1db4ed635299cca315ff349ba8a0f3b26b605bf2))
-
-
-
-## [0.42.0-u16.0](https://github.com/Agoric/agoric-sdk/compare/@agoric/cosmic-swingset@0.41.3...@agoric/cosmic-swingset@0.42.0-u16.0) (2024-07-02)
+## [0.42.0-u17.0](https://github.com/Agoric/agoric-sdk/compare/@agoric/cosmic-swingset@0.41.3...@agoric/cosmic-swingset@0.42.0-u17.0) (2024-09-17)
 
 
 ### ⚠ BREAKING CHANGES
 
+* **cosmic-swingset:** Exclude non-consensus configuration from bootstrap vat arguments
 * **cosmos:** add required export-dir export cmd option
 * remove deprecated `ag-cosmos-helper`
 
 ### Features
 
+* Add consensus-independent vat snapshot archiving configuration to AG_COSMOS_INIT ([ffc594f](https://github.com/Agoric/agoric-sdk/commit/ffc594f9441a9374646c43b69d289cc560962f64)), closes [#10036](https://github.com/Agoric/agoric-sdk/issues/10036)
+* Add consensus-independent vat snapshot retention configuration to AG_COSMOS_INIT ([a5311b5](https://github.com/Agoric/agoric-sdk/commit/a5311b5a9eb257d4dfb4f18272608f00c1616abb)), closes [#9386](https://github.com/Agoric/agoric-sdk/issues/9386)
+* Add consensus-independent vat transcript archiving configuration to AG_COSMOS_INIT ([d2d5803](https://github.com/Agoric/agoric-sdk/commit/d2d5803baab6e6379d179723244b2e92aac6319a)), closes [#10036](https://github.com/Agoric/agoric-sdk/issues/10036)
+* Add consensus-independent vat transcript span retention configuration to AG_COSMOS_INIT ([3cf6b57](https://github.com/Agoric/agoric-sdk/commit/3cf6b57d9e1968c6197147419d5d177b5c42e62b)), closes [#9174](https://github.com/Agoric/agoric-sdk/issues/9174) [#9386](https://github.com/Agoric/agoric-sdk/issues/9386)
 * add exporter.getHostKV() API ([eb564f9](https://github.com/Agoric/agoric-sdk/commit/eb564f9635397c0706e1f8255b3e125681e2d031)), closes [#8523](https://github.com/Agoric/agoric-sdk/issues/8523)
 * Add tooling for standalone performance benchmarks ([058e54a](https://github.com/Agoric/agoric-sdk/commit/058e54aad93c04b57dfb3a411bff85c223ab5dd7))
 * **agd:** try harder to find cosmic-swingset ([dd547f0](https://github.com/Agoric/agoric-sdk/commit/dd547f0a8057109a0bbe27a814fb3fc403ad3fd1))
+* **cosmic-swingset:** Accept slogfile configuration in AG_COSMOS_INIT messages ([1c72193](https://github.com/Agoric/agoric-sdk/commit/1c72193c54126cff8a35f36b094743a415ab19aa))
 * **cosmic-swingset:** add begin block check and transaction ([#8432](https://github.com/Agoric/agoric-sdk/issues/8432)) ([a9d113a](https://github.com/Agoric/agoric-sdk/commit/a9d113a09dfd93889ae985533535df53fdc771e7))
 * **cosmic-swingset:** add JS upgrade plan handler stub ([655133e](https://github.com/Agoric/agoric-sdk/commit/655133ed909b5d632dc033e992214a7b6a1b5ab1))
 * **cosmic-swingset:** add repair-metadata snapshot restore option ([4fc0113](https://github.com/Agoric/agoric-sdk/commit/4fc01134fab9402d5916f0593728acce4697da9e))
@@ -37,6 +33,9 @@ See [Conventional Commits](https://conventionalcommits.org) for commit guideline
 * **cosmos:** support core proposals set by upgrade handler ([605eb4b](https://github.com/Agoric/agoric-sdk/commit/605eb4b8f33d7646c3a9084d43ecd51029e12b80))
 * **cosmos:** wire new swingset port handler ([ea582bf](https://github.com/Agoric/agoric-sdk/commit/ea582bf7738f82d0abe5529ee1ac9f2e117c957a))
 * new 'boot' package with bootstrap configs ([8e3173b](https://github.com/Agoric/agoric-sdk/commit/8e3173b0b86a3dc90b31164bc4272c54e46a6641))
+* Plumb maxVatsOnline from cosmos-sdk config to JS side of swingset ([50b22be](https://github.com/Agoric/agoric-sdk/commit/50b22be79a2fe62a20666c30d86cc5bb8c4f41b7)), closes [#9574](https://github.com/Agoric/agoric-sdk/issues/9574)
+* Share cosmos-sdk runtime [viper] configuration with the cosmic-swingset VM ([950511e](https://github.com/Agoric/agoric-sdk/commit/950511ef1b9b7520bd3eaf8e97cbc315a945b836)), closes [#9946](https://github.com/Agoric/agoric-sdk/issues/9946)
+* Share cosmos-sdk runtime [viper] configuration with the cosmic-swingset VM ([f8c6d50](https://github.com/Agoric/agoric-sdk/commit/f8c6d50e0f20a523caf0366d0ec7ac8b0a731b8e)), closes [#9946](https://github.com/Agoric/agoric-sdk/issues/9946)
 * Simple removal of lien primarilly through code search ([#8988](https://github.com/Agoric/agoric-sdk/issues/8988)) ([695c440](https://github.com/Agoric/agoric-sdk/commit/695c440c0f48a3591b15a43665682c5f1ebbad9d))
 * support `coreProposals.steps` ([80fa3d1](https://github.com/Agoric/agoric-sdk/commit/80fa3d14494706d825f51ac22e1bbf4ec68ce404))
 * **vat-transfer:** first cut at working proposal ([2864bd5](https://github.com/Agoric/agoric-sdk/commit/2864bd5c12300c3595df9676bcfde894dbe59b29))
@@ -45,17 +44,24 @@ See [Conventional Commits](https://conventionalcommits.org) for commit guideline
 
 ### Bug Fixes
 
+* adopt `VTRANSFER_IBC_EVENT` as an action-type ([#9671](https://github.com/Agoric/agoric-sdk/issues/9671)) ([217005a](https://github.com/Agoric/agoric-sdk/commit/217005a921dcac6928c999e6bfe06330a5947ac5)), closes [#9670](https://github.com/Agoric/agoric-sdk/issues/9670)
+* **cosmic-swingset:** add exportCallback interlock ([6547c83](https://github.com/Agoric/agoric-sdk/commit/6547c8318d83ca58704a4c911608706c25795c68)), closes [#9655](https://github.com/Agoric/agoric-sdk/issues/9655)
+* **cosmic-swingset:** add missing bits for maxVatsOnline ([8c0c177](https://github.com/Agoric/agoric-sdk/commit/8c0c17752f7439db6f7aee9f88be1dedce2a1bf1))
 * **cosmic-swingset:** backwards param compat in import/export ([bd49484](https://github.com/Agoric/agoric-sdk/commit/bd49484e5777b8675ed3be5e78e46f6a5d89b7db))
+* **cosmic-swingset:** call upgradeSwingset at startup ([c769606](https://github.com/Agoric/agoric-sdk/commit/c7696069d0bebaf039a2f3e1a45ebdd8dc5198a2))
+* **cosmic-swingset:** Exclude non-consensus configuration from bootstrap vat arguments ([08b3abb](https://github.com/Agoric/agoric-sdk/commit/08b3abb4d5ba183a45e84353406e67bbcc00a076)), closes [#9946](https://github.com/Agoric/agoric-sdk/issues/9946)
 * **cosmic-swingset:** log level for swing-store export ([33c4a51](https://github.com/Agoric/agoric-sdk/commit/33c4a517f079c4ad17c30f9d1d13f181b06f112f))
 * **cosmic-swingset:** merge `coreProposals` from bootstrap and upgrade plan ([2b38ebc](https://github.com/Agoric/agoric-sdk/commit/2b38ebc378847a878725419db37580405df0a28e))
 * **cosmic-swingset:** only require vatconfig if uninitialized ([cfb72f3](https://github.com/Agoric/agoric-sdk/commit/cfb72f337cf650f303adfebaeffb1ee9ad0c0a92))
 * **cosmic-swingset:** only search for the `vatconfig` on init ([b14ca40](https://github.com/Agoric/agoric-sdk/commit/b14ca404ea5bc314f99372a3eba878926f94f679))
+* **cosmic-swingset:** plumbing for maxVatsOnline ([45a759a](https://github.com/Agoric/agoric-sdk/commit/45a759a71c8abc724618a12dfd8ae72552b9783e))
 * **cosmic-swingset:** send started event before beginning actual export ([3c94159](https://github.com/Agoric/agoric-sdk/commit/3c94159bbe4b27a14eeb27612c4a73afa556c472))
 * DEBUG harmony ([#8136](https://github.com/Agoric/agoric-sdk/issues/8136)) ([d2ea4b4](https://github.com/Agoric/agoric-sdk/commit/d2ea4b46b9efa61e97eec8711830d9fdd741ca55))
-* endow with original unstructured `assert` ([#9514](https://github.com/Agoric/agoric-sdk/issues/9514)) ([ce64840](https://github.com/Agoric/agoric-sdk/commit/ce64840f599ee7b73cbe455cc41eecec3464430a)), closes [#9515](https://github.com/Agoric/agoric-sdk/issues/9515) [#5672](https://github.com/Agoric/agoric-sdk/issues/5672) [#8332](https://github.com/Agoric/agoric-sdk/issues/8332) [#9513](https://github.com/Agoric/agoric-sdk/issues/9513) [#5672](https://github.com/Agoric/agoric-sdk/issues/5672) [#8332](https://github.com/Agoric/agoric-sdk/issues/8332) [#9513](https://github.com/Agoric/agoric-sdk/issues/9513) [#9515](https://github.com/Agoric/agoric-sdk/issues/9515) [#5672](https://github.com/Agoric/agoric-sdk/issues/5672) [#5672](https://github.com/Agoric/agoric-sdk/issues/5672) [#9513](https://github.com/Agoric/agoric-sdk/issues/9513) [#9513](https://github.com/Agoric/agoric-sdk/issues/9513)
+* endow with original unstructured `assert` ([#9514](https://github.com/Agoric/agoric-sdk/issues/9514)) ([f908f89](https://github.com/Agoric/agoric-sdk/commit/f908f89186162df83b540f6aeb1f4c665c3a56b4)), closes [#9515](https://github.com/Agoric/agoric-sdk/issues/9515) [#5672](https://github.com/Agoric/agoric-sdk/issues/5672) [#8332](https://github.com/Agoric/agoric-sdk/issues/8332) [#9513](https://github.com/Agoric/agoric-sdk/issues/9513) [#5672](https://github.com/Agoric/agoric-sdk/issues/5672) [#8332](https://github.com/Agoric/agoric-sdk/issues/8332) [#9513](https://github.com/Agoric/agoric-sdk/issues/9513) [#9515](https://github.com/Agoric/agoric-sdk/issues/9515) [#5672](https://github.com/Agoric/agoric-sdk/issues/5672) [#5672](https://github.com/Agoric/agoric-sdk/issues/5672) [#9513](https://github.com/Agoric/agoric-sdk/issues/9513) [#9513](https://github.com/Agoric/agoric-sdk/issues/9513)
 * export state-sync snapshot without a DB write-lock ([3bc3799](https://github.com/Agoric/agoric-sdk/commit/3bc37990fd813136dab33dd93a1dcec073b187f9)), closes [#8523](https://github.com/Agoric/agoric-sdk/issues/8523)
 * **sim-params:** power_flag casing ([66955c1](https://github.com/Agoric/agoric-sdk/commit/66955c1e70b63e6525ea10bc946f7c1a84e1e869))
 * update for `[@jessie](https://github.com/jessie).js/safe-await-separator` ([94c6b3c](https://github.com/Agoric/agoric-sdk/commit/94c6b3c83a5326594f1e2886ae01d6a703a7a68f))
+* **vm-config:** always use `init-localchain` and `init-transfer` ([870d205](https://github.com/Agoric/agoric-sdk/commit/870d2052ce1ca6778f6afa4396e01d5833b7ef38))
 * **x/swingset:** switch export/import to replay artifact level ([6ab24b2](https://github.com/Agoric/agoric-sdk/commit/6ab24b299f31affc0a638cc6352678a2c167044c))
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agoric/cosmic-swingset",
-  "version": "0.42.0-upgrade-16-dev-12b78e3.0+12b78e3",
+  "version": "0.42.0-upgrade-17-dev-a61cdab.0+a61cdab",
   "description": "Agoric's Cosmos blockchain integration",
   "type": "module",
   "bin": {
@@ -22,24 +22,25 @@
   "author": "Agoric",
   "license": "Apache-2.0",
   "dependencies": {
-    "@agoric/assert": "0.6.1-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@agoric/builders": "0.2.0-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@agoric/cosmos": "0.35.0-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@agoric/deploy-script-support": "0.10.4-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@agoric/internal": "0.4.0-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@agoric/store": "0.9.3-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@agoric/swing-store": "0.9.2-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@agoric/swingset-vat": "0.33.0-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@agoric/telemetry": "0.6.3-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@agoric/vm-config": "0.1.1-upgrade-16-dev-12b78e3.0+12b78e3",
-    "@endo/bundle-source": "^3.2.3",
-    "@endo/env-options": "^1.1.4",
-    "@endo/far": "^1.1.2",
-    "@endo/import-bundle": "^1.1.2",
-    "@endo/init": "^1.1.2",
-    "@endo/marshal": "^1.5.0",
-    "@endo/nat": "^5.0.7",
-    "@endo/promise-kit": "^1.1.2",
+    "@agoric/builders": "0.2.0-upgrade-17-dev-a61cdab.0+a61cdab",
+    "@agoric/cosmos": "0.35.0-upgrade-17-dev-a61cdab.0+a61cdab",
+    "@agoric/deploy-script-support": "0.10.4-upgrade-17-dev-a61cdab.0+a61cdab",
+    "@agoric/internal": "0.4.0-upgrade-17-dev-a61cdab.0+a61cdab",
+    "@agoric/store": "0.9.3-upgrade-17-dev-a61cdab.0+a61cdab",
+    "@agoric/swing-store": "0.9.2-upgrade-17-dev-a61cdab.0+a61cdab",
+    "@agoric/swingset-vat": "0.33.0-upgrade-17-dev-a61cdab.0+a61cdab",
+    "@agoric/telemetry": "0.6.3-upgrade-17-dev-a61cdab.0+a61cdab",
+    "@agoric/vm-config": "0.1.1-upgrade-17-dev-a61cdab.0+a61cdab",
+    "@endo/bundle-source": "^3.4.0",
+    "@endo/env-options": "^1.1.6",
+    "@endo/errors": "^1.2.5",
+    "@endo/far": "^1.1.5",
+    "@endo/import-bundle": "^1.2.2",
+    "@endo/init": "^1.1.4",
+    "@endo/marshal": "^1.5.3",
+    "@endo/nat": "^5.0.10",
+    "@endo/patterns": "^1.4.3",
+    "@endo/promise-kit": "^1.1.5",
     "@iarna/toml": "^2.2.3",
     "@opentelemetry/api": "~1.3.0",
     "@opentelemetry/sdk-metrics": "~1.9.0",
@@ -68,7 +69,7 @@
     "timeout": "20m"
   },
   "typeCoverage": {
-    "atLeast": 80.49
+    "atLeast": 80.53
   },
-  "gitHead": "12b78e307e22d0dc0c95f40099300e16655781c4"
+  "gitHead": "a61cdabb23bd2c846e003dee7326018a7462a929"
 }

package/src/chain-main.js

@@ -1,16 +1,20 @@
 // @ts-check
 
-import { resolve as pathResolve } from 'path';
+import path from 'node:path';
 import v8 from 'node:v8';
 import process from 'node:process';
 import fs from 'node:fs';
 import fsPromises from 'node:fs/promises';
-import { performance } from 'perf_hooks';
-import { resolve as importMetaResolve } from 'import-meta-resolve';
-import tmpfs from 'tmp';
+import { performance } from 'node:perf_hooks';
 import { fork } from 'node:child_process';
+import { resolve as importMetaResolve } from 'import-meta-resolve';
+import tmp from 'tmp';
 
+import { Fail, q } from '@endo/errors';
 import { E } from '@endo/far';
+import { makeMarshal } from '@endo/marshal';
+import { isNat } from '@endo/nat';
+import { M, mustMatch } from '@endo/patterns';
 import engineGC from '@agoric/internal/src/lib-nodejs/engine-gc.js';
 import { waitUntilQuiescent } from '@agoric/internal/src/lib-nodejs/waitUntilQuiescent.js';
 import {
@@ -18,19 +22,21 @@ import {
   exportMailbox,
 } from '@agoric/swingset-vat/src/devices/mailbox/mailbox.js';
 
-import { Fail, q } from '@agoric/assert';
 import { makeSlogSender, tryFlushSlogSender } from '@agoric/telemetry';
 
 import {
   makeChainStorageRoot,
   makeSerializeToStorage,
 } from '@agoric/internal/src/lib-chainStorage.js';
-import { makeMarshal } from '@endo/marshal';
 import { makeShutdown } from '@agoric/internal/src/node/shutdown.js';
 
 import * as STORAGE_PATH from '@agoric/internal/src/chain-storage-paths.js';
 import * as ActionType from '@agoric/internal/src/action-types.js';
 import { BridgeId, CosmosInitKeyToBridgeId } from '@agoric/internal';
+import {
+  makeArchiveSnapshot,
+  makeArchiveTranscript,
+} from '@agoric/swing-store';
 import {
   makeBufferedStorage,
   makeReadCachingStorage,
@@ -48,6 +54,8 @@ import {
   validateImporterOptions,
 } from './import-kernel-db.js';
 
+const ignore = () => {};
+
 // eslint-disable-next-line no-unused-vars
 let whenHellFreezesOver = null;
 
@@ -62,6 +70,66 @@ const toNumber = specimen => {
   return number;
 };
 
+/**
+ * The swingset config object parsed and resolved by cosmos in
+ * `golang/cosmos/x/swingset/config.go`. The shape should be kept in sync
+ * with `SwingsetConfig` defined there.
+ *
+ * @typedef {object} CosmosSwingsetConfig
+ * @property {string} [slogfile]
+ * @property {number} [maxVatsOnline]
+ * @property {'debug' | 'operational'} [vatSnapshotRetention]
+ * @property {'archival' | 'operational'} [vatTranscriptRetention]
+ * @property {string} [vatSnapshotArchiveDir]
+ * @property {string} [vatTranscriptArchiveDir]
+ */
+const SwingsetConfigShape = M.splitRecord(
+  // All known properties are optional, but unknown properties are not allowed.
+  {},
+  {
+    slogfile: M.string(),
+    maxVatsOnline: M.number(),
+    vatSnapshotRetention: M.or('debug', 'operational'),
+    vatTranscriptRetention: M.or('archival', 'operational'),
+    vatSnapshotArchiveDir: M.string(),
+    vatTranscriptArchiveDir: M.string(),
+  },
+  {},
+);
+const validateSwingsetConfig = swingsetConfig => {
+  mustMatch(swingsetConfig, SwingsetConfigShape);
+  const { maxVatsOnline } = swingsetConfig;
+  maxVatsOnline === undefined ||
+    (isNat(maxVatsOnline) && maxVatsOnline > 0) ||
+    Fail`maxVatsOnline must be a positive integer`;
+};
+
+/**
+ * A boot message consists of cosmosInitAction fields that are subject to
+ * consensus. See cosmosInitAction in {@link ../../../golang/cosmos/app/app.go}.
+ *
+ * @param {any} initAction
+ */
+const makeBootMsg = initAction => {
+  const {
+    type,
+    blockTime,
+    blockHeight,
+    chainID,
+    params,
+    // NB: resolvedConfig is independent of consensus and MUST NOT be included
+    supplyCoins,
+  } = initAction;
+  return {
+    type,
+    blockTime,
+    blockHeight,
+    chainID,
+    params,
+    supplyCoins,
+  };
+};
+
 /**
  * @template {unknown} [T=unknown]
  * @param {(req: string) => string} call
@@ -99,8 +167,8 @@ const makePrefixedBridgeStorage = (
       return fromBridgeStringValue(ret);
     },
     set: (key, value) => {
-      const path = `${prefix}${key}`;
-      const entry = [path, toBridgeStringValue(value)];
+      const fullPath = `${prefix}${key}`;
+      const entry = [fullPath, toBridgeStringValue(value)];
       call(
         stringify({
           method: setterMethod,
@@ -109,8 +177,8 @@ const makePrefixedBridgeStorage = (
       );
     },
     delete: key => {
-      const path = `${prefix}${key}`;
-      const entry = [path];
+      const fullPath = `${prefix}${key}`;
+      const entry = [fullPath];
       call(
         stringify({
           method: setterMethod,
@@ -214,7 +282,7 @@ export default async function main(progname, args, { env, homedir, agcc }) {
 
   const clearChainSends = async () => {
     // Cosmos should have blocked before calling commit, but wait just in case
-    await stateSyncExport?.exporter?.onStarted().catch(() => {});
+    await stateSyncExport?.exporter?.onStarted().catch(ignore);
 
     const chainSends = savedChainSends;
     savedChainSends = [];
@@ -246,10 +314,33 @@ export default async function main(progname, args, { env, homedir, agcc }) {
   /** @type {((obj: object) => void) | undefined} */
   let writeSlogObject;
 
-  // the storagePort used to change for every single message. It's defined out
+  // In the past, storagePort could change with every message. It's defined out
   // here so 'sendToChainStorage' can close over the single mutable instance,
   // when we updated the 'portNums.storage' value each time toSwingSet was called.
-  async function launchAndInitializeSwingSet(bootMsg) {
+  async function launchAndInitializeSwingSet(initAction) {
+    const { XSNAP_KEEP_SNAPSHOTS, NODE_HEAP_SNAPSHOTS = -1 } = env;
+
+    /** @type {CosmosSwingsetConfig} */
+    const swingsetConfig = harden(initAction.resolvedConfig || {});
+    validateSwingsetConfig(swingsetConfig);
+    const {
+      slogfile,
+      vatSnapshotRetention,
+      vatTranscriptRetention,
+      vatSnapshotArchiveDir,
+      vatTranscriptArchiveDir,
+    } = swingsetConfig;
+    const keepSnapshots = vatSnapshotRetention
+      ? vatSnapshotRetention !== 'operational'
+      : ['1', 'true'].includes(XSNAP_KEEP_SNAPSHOTS);
+    const keepTranscripts = vatTranscriptRetention
+      ? vatTranscriptRetention !== 'operational'
+      : false;
+
+    // As a kludge, back-propagate selected configuration into environment variables.
+    // eslint-disable-next-line dot-notation
+    if (slogfile) env['SLOGFILE'] = slogfile;
+
     const sendToChainStorage = msg => chainSend(portNums.storage, msg);
     // this object is used to store the mailbox state.
     const fromBridgeMailbox = data => {
@@ -363,7 +454,7 @@ export default async function main(progname, args, { env, homedir, agcc }) {
     };
 
     const argv = {
-      bootMsg,
+      bootMsg: makeBootMsg(initAction),
     };
     const getVatConfig = async () => {
       const vatHref = await importMetaResolve(
@@ -384,7 +475,6 @@ export default async function main(progname, args, { env, homedir, agcc }) {
       serviceName: TELEMETRY_SERVICE_NAME,
     });
 
-    const { XSNAP_KEEP_SNAPSHOTS, NODE_HEAP_SNAPSHOTS = -1 } = env;
     const slogSender = await makeSlogSender({
       stateDir: stateDBDir,
       env,
@@ -394,17 +484,14 @@ export default async function main(progname, args, { env, homedir, agcc }) {
     const swingStoreTraceFile = processValue.getPath({
       envName: 'SWING_STORE_TRACE',
       flagName: 'trace-store',
-      trueValue: pathResolve(stateDBDir, 'store-trace.log'),
+      trueValue: path.resolve(stateDBDir, 'store-trace.log'),
     });
 
-    const keepSnapshots =
-      XSNAP_KEEP_SNAPSHOTS === '1' || XSNAP_KEEP_SNAPSHOTS === 'true';
-
     const nodeHeapSnapshots = Number.parseInt(NODE_HEAP_SNAPSHOTS, 10);
 
     let lastCommitTime = 0;
     let commitCallsSinceLastSnapshot = NaN;
-    const snapshotBaseDir = pathResolve(stateDBDir, 'node-heap-snapshots');
+    const snapshotBaseDir = path.resolve(stateDBDir, 'node-heap-snapshots');
 
     if (nodeHeapSnapshots >= 0) {
       fs.mkdirSync(snapshotBaseDir, { recursive: true });
@@ -440,7 +527,7 @@ export default async function main(progname, args, { env, homedir, agcc }) {
         ) {
           commitCallsSinceLastSnapshot = 0;
           heapSnapshot = `Heap-${process.pid}-${Date.now()}.heapsnapshot`;
-          const snapshotPath = pathResolve(snapshotBaseDir, heapSnapshot);
+          const snapshotPath = path.resolve(snapshotBaseDir, heapSnapshot);
           v8.writeHeapSnapshot(snapshotPath);
           heapSnapshotTime = performance.now() - t3;
         }
@@ -463,6 +550,14 @@ export default async function main(progname, args, { env, homedir, agcc }) {
       }
     };
 
+    const fsPowers = { fs, path, tmp };
+    const archiveSnapshot = vatSnapshotArchiveDir
+      ? makeArchiveSnapshot(vatSnapshotArchiveDir, fsPowers)
+      : undefined;
+    const archiveTranscript = vatTranscriptArchiveDir
+      ? makeArchiveTranscript(vatTranscriptArchiveDir, fsPowers)
+      : undefined;
+
     const s = await launch({
       actionQueueStorage,
       highPriorityQueueStorage,
@@ -481,7 +576,11 @@ export default async function main(progname, args, { env, homedir, agcc }) {
       swingStoreExportCallback,
       swingStoreTraceFile,
       keepSnapshots,
+      keepTranscripts,
+      archiveSnapshot,
+      archiveTranscript,
       afterCommitCallback,
+      swingsetConfig,
     });
 
     const { blockingSend, shutdown } = s;
@@ -489,21 +588,19 @@ export default async function main(progname, args, { env, homedir, agcc }) {
 
     let pendingBlockingSend = Promise.resolve();
 
-    registerShutdown(async interrupted =>
-      Promise.all([
+    registerShutdown(async interrupted => {
+      await Promise.all([
         interrupted && pendingBlockingSend.then(shutdown),
         discardStateSyncExport(),
-      ]).then(() => {}),
-    );
+      ]);
+    });
 
-    return async action => {
+    const blockingSendSpy = async action => {
       const result = blockingSend(action);
-      pendingBlockingSend = Promise.resolve(result).then(
-        () => {},
-        () => {},
-      );
+      pendingBlockingSend = Promise.resolve(result).then(ignore, ignore);
       return result;
     };
+    return blockingSendSpy;
   }
 
   /** @type {Awaited<ReturnType<typeof launch>>['blockingSend'] | undefined} */
@@ -534,7 +631,7 @@ export default async function main(progname, args, { env, homedir, agcc }) {
         );
         return performStateSyncImport(options, {
           fs: { ...fs, ...fsPromises },
-          pathResolve,
+          pathResolve: path.resolve,
           log: null,
         });
       }
@@ -558,7 +655,7 @@ export default async function main(progname, args, { env, homedir, agcc }) {
         stateSyncExport = exportData;
 
         await new Promise((resolve, reject) => {
-          tmpfs.dir(
+          tmp.dir(
             {
               prefix: `agd-state-sync-${blockHeight}-`,
               unsafeCleanup: true,
@@ -658,6 +755,7 @@ export default async function main(progname, args, { env, homedir, agcc }) {
 
         !blockingSend || Fail`Swingset already initialized`;
 
+        // Capture "port numbers" for communicating with cosmos modules.
         for (const [key, value] of Object.entries(action)) {
           const portAlias = CosmosInitKeyToBridgeId[key];
           if (portAlias) {

package/src/export-kernel-db.js

@@ -10,8 +10,8 @@ import fsPower from 'fs/promises';
 import pathPower from 'path';
 import { fileURLToPath } from 'url';
 
+import { Fail, q } from '@endo/errors';
 import { makePromiseKit } from '@endo/promise-kit';
-import { Fail, q } from '@agoric/assert';
 import { makeShutdown } from '@agoric/internal/src/node/shutdown.js';
 import { waitUntilQuiescent } from '@agoric/internal/src/lib-nodejs/waitUntilQuiescent.js';
 import { makeSwingStoreExporter } from '@agoric/swing-store';

package/src/export-storage.js

@@ -1,6 +1,6 @@
 import * as STORAGE_PATH from '@agoric/internal/src/chain-storage-paths.js';
 
-const { Fail, quote: q } = assert;
+import { Fail, q } from '@endo/errors';
 
 /**
  * Export any specified storage subtrees, then delete the ones marked to clear.

package/src/helpers/bufferedStorage.js

@@ -1,6 +1,6 @@
 // @ts-check
 
-import { assert, Fail } from '@agoric/assert';
+import { assert, Fail } from '@endo/errors';
 
 // XXX Do these "StorageAPI" functions belong in their own package?
 

package/src/helpers/make-queue.js

@@ -1,6 +1,6 @@
 // @ts-check
 
-import { Fail } from '@agoric/assert';
+import { Fail } from '@endo/errors';
 
 /**
  * @typedef {object} QueueStorage

package/src/import-kernel-db.js

@@ -11,8 +11,8 @@ import fsPower from 'fs';
 import fsPromisesPower from 'fs/promises';
 import pathPower from 'path';
 
+import { Fail, q } from '@endo/errors';
 import BufferLineTransform from '@agoric/internal/src/node/buffer-line-transform.js';
-import { Fail, q } from '@agoric/assert';
 import { importSwingStore, openSwingStore } from '@agoric/swing-store';
 
 import { isEntrypoint } from './helpers/is-entrypoint.js';

package/src/kernel-stats.js

@@ -316,13 +316,13 @@ export function exportKernelStats({
     }
     kernelStatsLast = now;
     kernelStatsCache = controller.getStats();
-    Object.keys(kernelStatsCache).forEach(key => {
+    for (const key of Object.keys(kernelStatsCache)) {
       warnUnexpectedKernelStat(key);
-    });
+    }
     return kernelStatsCache;
   };
 
-  KERNEL_STATS_SUM_METRICS.forEach(({ key, name, sub, ...options }) => {
+  for (const { key, name, sub, ...options } of KERNEL_STATS_SUM_METRICS) {
     expectedKernelStats.add(key);
     let counter = kernelStatsCounters.get(name);
     if (!counter) {
@@ -337,9 +337,9 @@ export function exportKernelStats({
       observableResult.observe(getKernelStats()[key], reportedAttributes);
     });
     kernelStatsMetrics.add(key);
-  });
+  }
 
-  KERNEL_STATS_UPDOWN_METRICS.forEach(({ key, name, sub, ...options }) => {
+  for (const { key, name, sub, ...options } of KERNEL_STATS_UPDOWN_METRICS) {
     expectedKernelStats.add(key);
     expectedKernelStats.add(`${key}Up`);
     expectedKernelStats.add(`${key}Down`);
@@ -357,7 +357,7 @@ export function exportKernelStats({
       observableResult.observe(getKernelStats()[key], reportedAttributes);
     });
     kernelStatsMetrics.add(key);
-  });
+  }
 
   if (inboundQueueMetrics) {
     // These are not kernelStatsMetrics, they're outside the kernel.
@@ -425,13 +425,13 @@ export function exportKernelStats({
 
   function checkKernelStats(stats) {
     const notYetFoundKernelStats = new Set(kernelStatsMetrics.keys());
-    Object.keys(stats).forEach(key => {
+    for (const key of Object.keys(stats)) {
       notYetFoundKernelStats.delete(key);
       warnUnexpectedKernelStat(key);
-    });
-    notYetFoundKernelStats.forEach(key => {
+    }
+    for (const key of notYetFoundKernelStats) {
       log.warn(`Expected SwingSet kernel statistic`, key, `not found`);
-    });
+    }
   }
 
   // We check everything on initialization.  Other checks happen when scraping.

package/src/launch-chain.js

@@ -7,11 +7,10 @@ import '@agoric/builders';
 
 import anylogger from 'anylogger';
 
+import { assert, Fail } from '@endo/errors';
 import { E } from '@endo/far';
 import bundleSource from '@endo/bundle-source';
 
-/** @import {RunPolicy} from '@agoric/swingset-vat' */
-
 import {
   buildMailbox,
   buildMailboxStateMap,
@@ -22,9 +21,9 @@ import {
   makeSwingsetController,
   loadBasedir,
   loadSwingsetConfigFile,
+  upgradeSwingset,
 } from '@agoric/swingset-vat';
 import { waitUntilQuiescent } from '@agoric/internal/src/lib-nodejs/waitUntilQuiescent.js';
-import { assert, Fail } from '@agoric/assert';
 import { openSwingStore } from '@agoric/swing-store';
 import { BridgeId as BRIDGE_ID } from '@agoric/internal';
 import { makeWithQueue } from '@agoric/internal/src/queue.js';
@@ -53,6 +52,8 @@ import { makeQueue, makeQueueStorageMock } from './helpers/make-queue.js';
 import { exportStorage } from './export-storage.js';
 import { parseLocatedJson } from './helpers/json.js';
 
+/** @import {RunPolicy} from '@agoric/swingset-vat' */
+
 const console = anylogger('launch-chain');
 const blockManagerConsole = anylogger('block-manager');
 
@@ -96,7 +97,7 @@ const getHostKey = path => `host.${path}`;
 
 /**
  * @param {Map<*, *>} mailboxStorage
- * @param {undefined | ((dstID: string, obj: any) => any)} bridgeOutbound
+ * @param {((dstID: string, obj: any) => any)} bridgeOutbound
  * @param {SwingStoreKernelStorage} kernelStorage
  * @param {string | (() => string | Promise<string>)} vatconfig absolute path or thunk
  * @param {unknown} bootstrapArgs JSON-serializable data
@@ -118,22 +119,21 @@ export async function buildSwingset(
     verbose,
     profileVats,
     debugVats,
+    warehousePolicy,
   },
 ) {
   const debugPrefix = debugName === undefined ? '' : `${debugName}:`;
   const mbs = buildMailboxStateMap(mailboxStorage);
 
-  const bridgeDevice = bridgeOutbound && buildBridge(bridgeOutbound);
+  const bridgeDevice = buildBridge(bridgeOutbound);
   const mailboxDevice = buildMailbox(mbs);
   const timerDevice = buildTimer();
 
   const deviceEndowments = {
     mailbox: { ...mailboxDevice.endowments },
     timer: { ...timerDevice.endowments },
+    bridge: { ...bridgeDevice.endowments },
   };
-  if (bridgeDevice) {
-    deviceEndowments.bridge = { ...bridgeDevice.endowments };
-  }
 
   async function ensureSwingsetInitialized() {
     if (swingsetIsInitialized(kernelStorage)) {
@@ -175,18 +175,16 @@ export async function buildSwingset(
     const bootVat =
       swingsetConfig.vats[swingsetConfig.bootstrap || 'bootstrap'];
 
-    if (bridgeOutbound) {
-      const batchChainStorage = (method, args) =>
-        bridgeOutbound(BRIDGE_ID.STORAGE, { method, args });
+    const batchChainStorage = (method, args) =>
+      bridgeOutbound(BRIDGE_ID.STORAGE, { method, args });
 
-      // Extract data from chain storage as [path, value?] pairs.
-      const chainStorageEntries = exportStorage(
-        batchChainStorage,
-        exportStorageSubtrees,
-        clearStorageSubtrees,
-      );
-      bootVat.parameters = { ...bootVat.parameters, chainStorageEntries };
-    }
+    // Extract data from chain storage as [path, value?] pairs.
+    const chainStorageEntries = exportStorage(
+      batchChainStorage,
+      exportStorageSubtrees,
+      clearStorageSubtrees,
+    );
+    bootVat.parameters = { ...bootVat.parameters, chainStorageEntries };
 
     // Since only on-chain swingsets like `agd` have a bridge (and thereby
     // `CORE_EVAL` support), things like `ag-solo` will need to do the
@@ -217,7 +215,8 @@ export async function buildSwingset(
     return bridgedCoreProposals;
   }
 
-  const coreProposals = await ensureSwingsetInitialized();
+  const pendingCoreProposals = await ensureSwingsetInitialized();
+  upgradeSwingset(kernelStorage);
   const controller = await makeSwingsetController(
     kernelStorage,
     deviceEndowments,
@@ -228,6 +227,7 @@ export async function buildSwingset(
       verbose,
       profileVats,
       debugVats,
+      warehousePolicy,
     },
   );
 
@@ -235,10 +235,10 @@ export async function buildSwingset(
   // (either on bootstrap block (0) or in endBlock).
 
   return {
-    coreProposals,
+    coreProposals: pendingCoreProposals,
     controller,
     mb: mailboxDevice,
-    bridgeInbound: bridgeDevice && bridgeDevice.deliverInbound,
+    bridgeInbound: bridgeDevice.deliverInbound,
     timer: timerDevice,
   };
 }
@@ -331,10 +331,33 @@ export async function launch({
   swingStoreTraceFile,
   swingStoreExportCallback,
   keepSnapshots,
+  keepTranscripts,
+  archiveSnapshot,
+  archiveTranscript,
   afterCommitCallback = async () => ({}),
+  swingsetConfig,
 }) {
   console.info('Launching SwingSet kernel');
 
+  // The swingstore export-data callback gives us export-data records,
+  // which must be written into IAVL by sending them over to the
+  // golang side with swingStoreExportCallback . However, that
+  // callback isn't ready right away, so if e.g. openSwingStore() were
+  // to invoke it, we might lose those records. Likewise
+  // saveOutsideState() gathers the chainSends just before calling
+  // commit, so if the callback were invoked during commit(), those
+  // records would be left for a subsequent block, which would break
+  // consensus if the node crashed before the next commit. So this
+  // `allowExportCallback` flag serves to catch these two cases.
+  //
+  // Note that swingstore is within its rights to call exportCallback
+  // during openSwingStore() or commit(), it just happens to not do so
+  // right now. If that changes under maintenance, this guard should
+  // turn a corruption bug into a crash bug. See
+  // https://github.com/Agoric/agoric-sdk/issues/9655 for details
+
+  let allowExportCallback = false;
+
   // The swingStore's exportCallback is synchronous, however we allow the
   // callback provided to launch-chain to be asynchronous. The callbacks are
   // invoked sequentially like if they were awaited, and the block manager
@@ -345,6 +368,7 @@ export async function launch({
   const swingStoreExportSyncCallback =
     swingStoreExportCallback &&
     (updates => {
+      assert(allowExportCallback, 'export-data callback called at bad time');
       pendingSwingStoreExport = swingStoreExportCallbackWithQueue(updates);
     });
 
@@ -352,6 +376,9 @@ export async function launch({
     traceFile: swingStoreTraceFile,
     exportCallback: swingStoreExportSyncCallback,
     keepSnapshots,
+    keepTranscripts,
+    archiveSnapshot,
+    archiveTranscript,
   });
   const { kvStore, commit } = hostStorage;
 
@@ -376,6 +403,9 @@ export async function launch({
   });
 
   console.debug(`buildSwingset`);
+  const warehousePolicy = {
+    maxVatsOnline: swingsetConfig.maxVatsOnline,
+  };
   const {
     coreProposals: bootstrapCoreProposals,
     controller,
@@ -393,6 +423,7 @@ export async function launch({
       debugName,
       slogCallbacks,
       slogSender,
+      warehousePolicy,
     },
   );
 
@@ -472,6 +503,7 @@ export async function launch({
   }
 
   async function saveOutsideState(blockHeight) {
+    allowExportCallback = false;
     const chainSends = await clearChainSends();
     kvStore.set(getHostKey('height'), `${blockHeight}`);
     kvStore.set(getHostKey('chainSends'), JSON.stringify(chainSends));
@@ -549,8 +581,15 @@ export async function launch({
   let savedBeginHeight = Number(
     kvStore.get(getHostKey('beginHeight')) || savedHeight,
   );
+  /**
+   * duration of the latest swingset execution in either END_BLOCK or
+   * once-per-chain bootstrap (the latter excluding "bridged" core proposals
+   * that run outside the bootstrap vat)
+   */
   let runTime = 0;
+  /** duration of the latest saveChainState(), which commits mailbox data to chain storage */
   let chainTime;
+  /** duration of the latest saveOutsideState(), which commits to swing-store host storage */
   let saveTime = 0;
   let endBlockFinish = 0;
   let blockParams;
@@ -705,33 +744,16 @@ export async function launch({
 
   /**
    * @template T
-   * @param {string} type
+   * @param {string} label
    * @param {() => Promise<T>} fn
+   * @param {() => void} onSettled
    */
-  async function processAction(type, fn) {
-    const start = Date.now();
-    const finish = res => {
-      // blockManagerConsole.error(
-      //   'Action',
-      //   action.type,
-      //   action.blockHeight,
-      //   'is done!',
-      // );
-      runTime += Date.now() - start;
-      return res;
-    };
-
+  function withErrorLogging(label, fn, onSettled) {
     const p = fn();
-    // Just attach some callbacks, but don't use the resulting neutered result
-    // promise.
-    void E.when(p, finish, e => {
-      // None of these must fail, and if they do, log them verbosely before
-      // returning to the chain.
-      blockManagerConsole.error(type, 'error:', e);
-      finish();
+    void E.when(p, onSettled, err => {
+      blockManagerConsole.error(label, 'error:', err);
+      onSettled();
     });
-    // Return the original promise so that the caller gets the original
-    // resolution or rejection.
     return p;
   }
 
@@ -802,8 +824,13 @@ export async function launch({
       // Start a block transaction, but without changing state
       // for the upcoming begin block check
       saveBeginHeight(savedBeginHeight);
-      await processAction(action.type, async () =>
-        bootstrapBlock(blockHeight, blockTime, bootstrapBlockParams),
+      const start = Date.now();
+      await withErrorLogging(
+        action.type,
+        () => bootstrapBlock(blockHeight, blockTime, bootstrapBlockParams),
+        () => {
+          runTime += Date.now() - start;
+        },
       );
     } finally {
       controller.writeSlogObject({
@@ -891,6 +918,7 @@ export async function launch({
     // );
     switch (action.type) {
       case ActionType.AG_COSMOS_INIT: {
+        allowExportCallback = true; // cleared by saveOutsideState in COMMIT_BLOCK
         const { blockHeight, isBootstrap, upgradeDetails } = action;
 
         if (!blockNeedsExecution(blockHeight)) {
@@ -907,17 +935,16 @@ export async function launch({
           await doBootstrap(action);
         }
 
-        // Merge the core proposals from the bootstrap block with the
-        // ones from the upgrade.
+        // Concatenate together any pending core proposals from chain bootstrap
+        // with any from this inbound init action, then execute them all.
         const coreProposals = mergeCoreProposals(
           bootstrapCoreProposals,
           softwareUpgradeCoreProposals,
           upgradeInfoCoreProposals,
         );
-
         if (coreProposals.steps.length) {
-          upgradeDetails ||
-            isBootstrap ||
+          isBootstrap ||
+            upgradeDetails ||
             Fail`Unexpected core proposals outside of consensus start`;
           await doCoreProposals(action, coreProposals);
         }
@@ -944,9 +971,9 @@ export async function launch({
         });
 
         // Save the kernel's computed state just before the chain commits.
-        const start2 = Date.now();
+        const start = Date.now();
         await saveOutsideState(savedHeight);
-        saveTime = Date.now() - start2;
+        saveTime = Date.now() - start;
 
         blockParams = undefined;
 
@@ -977,6 +1004,7 @@ export async function launch({
       }
 
       case ActionType.BEGIN_BLOCK: {
+        allowExportCallback = true; // cleared by saveOutsideState in COMMIT_BLOCK
         const { blockHeight, blockTime, params } = action;
         blockParams = parseParams(params);
         verboseBlocks &&
@@ -1043,14 +1071,19 @@ export async function launch({
 
           provideInstallationPublisher();
 
-          await processAction(action.type, async () =>
-            endBlock(blockHeight, blockTime, blockParams),
+          const start = Date.now();
+          await withErrorLogging(
+            action.type,
+            () => endBlock(blockHeight, blockTime, blockParams),
+            () => {
+              runTime += Date.now() - start;
+            },
           );
 
           // We write out our on-chain state as a number of chainSends.
-          const start = Date.now();
+          const start2 = Date.now();
           await saveChainState();
-          chainTime = Date.now() - start;
+          chainTime = Date.now() - start2;
 
           // Advance our saved state variables.
           savedHeight = blockHeight;

package/src/params.js

@@ -1,7 +1,7 @@
 // @ts-check
 // @jessie-check
 
-import { Fail } from '@agoric/assert';
+import { Fail } from '@endo/errors';
 import { Nat, isNat } from '@endo/nat';
 
 export const stringToNat = s => {

package/src/sim-chain.js

@@ -1,6 +1,7 @@
 /* global process setTimeout clearTimeout */
 import path from 'path';
 import fs from 'fs';
+import { Fail } from '@endo/errors';
 import {
   importMailbox,
   exportMailbox,
@@ -11,7 +12,6 @@ import anylogger from 'anylogger';
 import { makeSlogSender } from '@agoric/telemetry';
 
 import { resolve as importMetaResolve } from 'import-meta-resolve';
-import { Fail } from '@agoric/assert';
 import { makeWithQueue } from '@agoric/internal/src/queue.js';
 import { makeBatchedDeliver } from '@agoric/internal/src/batched-deliver.js';
 import stringify from './helpers/json-stable-stringify.js';