@agoric/swingset-liveslots 0.10.3-dev-129bb20.0 → 0.10.3-dev-4841c87.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agoric/swingset-liveslots",
-  "version": "0.10.3-dev-129bb20.0+129bb20",
+  "version": "0.10.3-dev-4841c87.0+4841c87",
   "description": "SwingSet ocap support layer",
   "type": "module",
   "main": "src/index.js",
@@ -19,8 +19,8 @@
     "postpack": "git clean -f ':!src/types-index.d.ts' '*.d.ts*' '*.tsbuildinfo'"
   },
   "dependencies": {
-    "@agoric/internal": "0.3.3-dev-129bb20.0+129bb20",
-    "@agoric/store": "0.9.3-dev-129bb20.0+129bb20",
+    "@agoric/internal": "0.3.3-dev-4841c87.0+4841c87",
+    "@agoric/store": "0.9.3-dev-4841c87.0+4841c87",
     "@endo/env-options": "^1.1.8",
     "@endo/errors": "^1.2.10",
     "@endo/eventual-send": "^1.3.1",
@@ -34,7 +34,7 @@
     "@endo/promise-kit": "^1.1.10"
   },
   "devDependencies": {
-    "@agoric/kmarshal": "0.1.1-dev-129bb20.0+129bb20",
+    "@agoric/kmarshal": "0.1.1-dev-4841c87.0+4841c87",
     "ava": "^5.3.0"
   },
   "files": [
@@ -68,5 +68,5 @@
   "typeCoverage": {
     "atLeast": 75.24
   },
-  "gitHead": "129bb208d14fe7b03fed190c8a507ed1c7269721"
+  "gitHead": "4841c8738923019bcbd3e4d41900381ba677d55f"
 }

package/src/types.d.ts

@@ -27,9 +27,14 @@ export type MeterControl = {
     unmetered: any;
 };
 export type LiveSlotsOptions = {
-    enableDisavow?: boolean;
-    relaxDurabilityRules?: boolean;
-    allowStateShapeChanges?: boolean;
+    enableDisavow?: boolean | undefined;
+    relaxDurabilityRules?: boolean | undefined;
+    /**
+     * somewhat misnamed; this actually
+     * relates to *arbitrary* changes (per #10200, a non-true value still permits
+     * backwards-compatible addition of new optional fields)
+     */
+    allowStateShapeChanges?: boolean | undefined;
 };
 export type SwingSetCapData = import("@endo/marshal").CapData<string>;
 export type Message = {

package/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["types.js"],"names":[],"mappings":";;;;;;;;;;;;wBAec,MAAM,OAAO;qBACb,GAAC;sBACD,GAAC;;;;wBACD,GAAC;;;;6BACD,GAAC;;;;eACD,GAAC;;+BAIF;IACR,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;8BAES,OAAO,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC;sBAEvC;IACK,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CACpC;iCACF,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;+BAC9C,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAE;gCACzD,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAE;qCACjD,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;uCACtC,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;uCACxC,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;0CACxC,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE;kCAC5D,CAAC,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,CAAE;iCAClD,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAE;0CACpD,CAAC,GAAG,EAAE,kBAAkB,CAAE;gCAC1B,kBAAkB,GAAG,iBAAiB,GAAG,sBAAsB,GAC7D,wBAAwB,GAAG,wBAAwB,GAAG,2BAA2B,GACjF,mBAAmB,GAAG,kBAAkB,GAAG,2BAA2B;+BAGxE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;gCACnB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC,GACtE,CAAc,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;6BAG/D,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;gCAC3C,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC;kCACvE,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAE;gCACjC,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAE;6BAClD,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAE;oCACzD,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAE;2CAClC,CAAC,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,CAAE;oCAC9C,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAE;uCAChD,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAE;oCACrC,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;sCACtC,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;sCACxC,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;uCACxC,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;+BAEzC,cAAc,GAAG,iBAAiB,GAAG,mBAAmB,GAC9D,iBAAiB,GAAG,cAAc,GAAG,qBAAqB,GAAG,4BAA4B,GACzF,qBAAqB,GAAG,wBAAwB,GAAG,qBAAqB,GACxE,uBAAuB,GAAG,uBAAuB,GAAG,wBAAwB;iCAGtE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAE;oCAC9D,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAE;+BAC5B,kBAAkB,GAAG,qBAAqB;gCAE1C,CAAC,GAAG,EAAE,gBAAgB,KAAK,gBAAgB;2BAK5C,CAAC,EACQ,CAAC,SAAT,GAAG,EAAG,gBACN;IAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["types.js"],"names":[],"mappings":";;;;;;;;;;;;wBAec,MAAM,OAAO;qBACb,GAAC;sBACD,GAAC;;;;wBACD,GAAC;;;;6BACD,GAAC;;;;eACD,GAAC;;;;;;;;;;;;8BAWF,OAAO,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC;sBAEvC;IACK,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CACpC;iCACF,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;+BAC9C,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAE;gCACzD,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAE;qCACjD,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;uCACtC,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;uCACxC,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;0CACxC,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE;kCAC5D,CAAC,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,CAAE;iCAClD,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAE;0CACpD,CAAC,GAAG,EAAE,kBAAkB,CAAE;gCAC1B,kBAAkB,GAAG,iBAAiB,GAAG,sBAAsB,GAC7D,wBAAwB,GAAG,wBAAwB,GAAG,2BAA2B,GACjF,mBAAmB,GAAG,kBAAkB,GAAG,2BAA2B;+BAGxE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;gCACnB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC,GACtE,CAAc,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;6BAG/D,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;gCAC3C,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC;kCACvE,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAE;gCACjC,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAE;6BAClD,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAE;oCACzD,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAE;2CAClC,CAAC,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,CAAE;oCAC9C,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAE;uCAChD,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAE;oCACrC,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;sCACtC,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;sCACxC,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;uCACxC,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE;+BAEzC,cAAc,GAAG,iBAAiB,GAAG,mBAAmB,GAC9D,iBAAiB,GAAG,cAAc,GAAG,qBAAqB,GAAG,4BAA4B,GACzF,qBAAqB,GAAG,wBAAwB,GAAG,qBAAqB,GACxE,uBAAuB,GAAG,uBAAuB,GAAG,wBAAwB;iCAGtE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAE;oCAC9D,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAE;+BAC5B,kBAAkB,GAAG,qBAAqB;gCAE1C,CAAC,GAAG,EAAE,gBAAgB,KAAK,gBAAgB;2BAK5C,CAAC,EACQ,CAAC,SAAT,GAAG,EAAG,gBACN;IAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAA;CAAC"}

package/src/types.js

@@ -22,11 +22,12 @@ export {};
  */
 
 /**
- * @typedef {{
- *   enableDisavow?: boolean,
- *   relaxDurabilityRules?: boolean,
- *   allowStateShapeChanges?: boolean,
- * }} LiveSlotsOptions
+ * @typedef {object} LiveSlotsOptions
+ * @property {boolean} [enableDisavow]
+ * @property {boolean} [relaxDurabilityRules]
+ * @property {boolean} [allowStateShapeChanges] somewhat misnamed; this actually
+ *   relates to *arbitrary* changes (per #10200, a non-true value still permits
+ *   backwards-compatible addition of new optional fields)
  *
  * @typedef {import('@endo/marshal').CapData<string>} SwingSetCapData
  *

package/src/virtualObjectManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"virtualObjectManager.d.ts","sourceRoot":"","sources":["virtualObjectManager.js"],"names":[],"mappings":"AA2TO,kDApDI,GAAC,OACD,OAAO,wBAAwB,EAAE,uBAAuB,oBAExD,MAAM,MAAM,iBAEZ,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,sBAGnC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,iBACxB,GAAC,aAED,UAAU,MAAM,CAAC,eACjB,YAAY,MAAM,CAAC,sCACnB,GAAC,qBAED,OAAO,YAAY,EAAE,gBAAgB,yBACrC;IAAE,OAAO,EAAE,yBAAc,CAAC;IAAC,OAAO,EAAE,yBAAc,CAAA;CAAE;;iEAnItC,GAAG,kHAC0B,GAAG;sEAGjB,GAAG,0HAE1B,GAAG;0FAKc,GAAG,kHAEpB,GAAG;+FAIX,GAAG,0HACiB,GAAG;0BAsiCnB,MAAM,KACJ,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqI/B;mCAEa,UAAU,CAAC,OAAO,wBAAwB,CAAC;+BA/zChB,eAAe;iCAAf,eAAe;uCAFpB,4BAA4B;uCAD5B,4BAA4B"}
+{"version":3,"file":"virtualObjectManager.d.ts","sourceRoot":"","sources":["virtualObjectManager.js"],"names":[],"mappings":"AAiWO,kDApDI,GAAC,OACD,OAAO,wBAAwB,EAAE,uBAAuB,oBAExD,MAAM,MAAM,iBAEZ,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,sBAGnC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,iBACxB,GAAC,aAED,UAAU,MAAM,CAAC,eACjB,YAAY,MAAM,CAAC,sCACnB,GAAC,qBAED,OAAO,YAAY,EAAE,gBAAgB,yBACrC;IAAE,OAAO,EAAE,yBAAc,CAAC;IAAC,OAAO,EAAE,yBAAc,CAAA;CAAE;;iEA3KtB,GAAG,kHA+C5C,GA5CG;sEAIe,GAAE,0HAEb,GAAG;0FAK4C,GAAG,kHACU,GAAG;+FAKhC,GAAG,0HACgB,GAAG;0BA6lC/C,MAAM,KACJ,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqI/B;mCAEa,UAAU,CAAC,OAAO,wBAAwB,CAAC;+BAt3ChB,eAAe;iCAAf,eAAe;uCAFpB,4BAA4B;uCAD5B,4BAA4B"}

package/src/virtualObjectManager.js

@@ -7,6 +7,7 @@ import { assertPattern, mustMatch } from '@agoric/store';
 import { defendPrototype, defendPrototypeKit } from '@endo/exo/tools.js';
 import { Far, passStyleOf } from '@endo/marshal';
 import { Nat } from '@endo/nat';
+import { kindOf } from '@endo/patterns';
 import { parseVatSlot, makeBaseRef } from './parseVatSlots.js';
 import { enumerateKeysWithPrefix } from './vatstore-iterators.js';
 import { makeCache } from './cache.js';
@@ -20,6 +21,8 @@ import {
  * @import {DefineKindOptions} from '@agoric/swingset-liveslots'
  * @import {ClassContextProvider, KitContextProvider} from '@endo/exo'
  * @import {ToCapData, FromCapData} from '@endo/marshal';
+ * @import {Pattern} from '@endo/patterns';
+ * @import {SwingSetCapData} from './types.js';
  */
 
 const {
@@ -241,12 +244,47 @@ const insistDurableCapdata = (vrm, what, capdata, valueFor) => {
   }
 };
 
-const insistSameCapData = (oldCD, newCD) => {
-  // NOTE: this assumes both were marshalled with the same format
-  // (e.g. smallcaps vs pre-smallcaps). To somewhat tolerate new
-  // formats, we'd need to `serialize(unserialize(oldCD))`.
+const isUndefinedPatt = patt =>
+  patt === undefined ||
+  (kindOf(patt) === 'match:kind' && patt.payload === 'undefined');
+
+/**
+ * Assert that a new stateShape either matches the old, or only differs in the
+ * addition of new clearly-optional top-level fields as conveyed by an
+ * [Endo `M.or`]{@link https://endojs.github.io/endo/interfaces/_endo_patterns.PatternMatchers.html#or}
+ * Pattern with at least one `undefined` alternative.
+ *
+ * @param {SwingSetCapData} oldCD
+ * @param {SwingSetCapData} newCD
+ * @param {{ newShape: Record<string, Pattern>, serialize: ToCapData<string>, unserialize: FromCapData<string> }} powers
+ */
+const insistCompatibleShapeCapData = (
+  oldCD,
+  newCD,
+  { newShape, serialize, unserialize },
+) => {
   if (oldCD.body !== newCD.body) {
-    Fail`durable Kind stateShape mismatch (body)`;
+    // Allow introduction of any clearly-optional new field at top level.
+    const oldShape =
+      unserialize(oldCD) ||
+      Fail`durable Kind stateShape mismatch (no old shape)`;
+    passStyleOf(oldShape) === 'copyRecord' ||
+      Fail`durable Kind stateShape mismatch (invalid old shape)`;
+    assertPattern(oldShape);
+    for (const [name, oldPatt] of Object.entries(oldShape)) {
+      // Assert presence and CapData shape, but save slots for their own clause.
+      (Object.hasOwn(newShape, name) &&
+        serialize(newShape[name]).body === serialize(oldPatt).body) ||
+        Fail`durable Kind stateShape mismatch (body ${name})`;
+    }
+    for (const [name, newPatt] of Object.entries(newShape)) {
+      if (Object.hasOwn(oldShape, name)) continue;
+      kindOf(newPatt) === 'match:or' ||
+        Fail`durable Kind stateShape mismatch (body new field ${name})`;
+      // @ts-expect-error A "match:or" pattern has a `payload` array of Patterns
+      newPatt.payload.some(patt => isUndefinedPatt(patt)) ||
+        Fail`durable Kind stateShape mismatch (body ${name})`;
+    }
   }
   if (oldCD.slots.length !== newCD.slots.length) {
     Fail`durable Kind stateShape mismatch (slots.length)`;
@@ -532,7 +570,7 @@ export const makeVirtualObjectManager = (
    *  tag: string,
    *  unfaceted?: boolean,
    *  facets?: string[],
-   *  stateShapeCapData?: import('./types.js').SwingSetCapData
+   *  stateShapeCapData?: SwingSetCapData
    * }} DurableKindDescriptor
    */
 
@@ -803,7 +841,11 @@ export const makeVirtualObjectManager = (
 
       const oldStateShapeSlots = oldShapeCD ? oldShapeCD.slots : [];
       if (oldShapeCD && !allowStateShapeChanges) {
-        insistSameCapData(oldShapeCD, newShapeCD);
+        insistCompatibleShapeCapData(oldShapeCD, newShapeCD, {
+          newShape: /** @type {Record<string, Pattern>} */ (stateShape),
+          serialize,
+          unserialize,
+        });
       }
       const newStateShapeSlots = newShapeCD.slots;
       vrm.updateReferenceCounts(oldStateShapeSlots, newStateShapeSlots);
@@ -859,9 +901,11 @@ export const makeVirtualObjectManager = (
           const baseRef = getBaseRef(this);
           const record = dataCache.get(baseRef);
           assert(record !== undefined);
-          const { valueMap, capdatas } = record;
+          const { capdatas, valueMap } = record;
           if (!valueMap.has(prop)) {
-            const value = harden(unserialize(capdatas[prop]));
+            const value = hasOwn(capdatas, prop)
+              ? harden(unserialize(capdatas[prop]))
+              : undefined;
             checkStatePropertyValue(value, prop);
             valueMap.set(prop, value);
           }
@@ -877,12 +921,19 @@ export const makeVirtualObjectManager = (
           }
           const record = dataCache.get(baseRef); // mutable
           assert(record !== undefined);
-          const oldSlots = record.capdatas[prop].slots;
+          const { capdatas, valueMap } = record;
+          const oldSlots = hasOwn(capdatas, prop) ? capdatas[prop].slots : [];
           const newSlots = capdata.slots;
           vrm.updateReferenceCounts(oldSlots, newSlots);
-          record.capdatas[prop] = capdata; // modify in place ..
-          record.valueMap.set(prop, value);
-          dataCache.set(baseRef, record); // .. but mark as dirty
+          // modify in place, but mark as dirty
+          defineProperty(capdatas, prop, {
+            value: capdata,
+            writable: true,
+            enumerable: true,
+            configurable: false,
+          });
+          valueMap.set(prop, value);
+          dataCache.set(baseRef, record);
         },
         enumerable: true,
         configurable: false,
@@ -1073,7 +1124,12 @@ export const makeVirtualObjectManager = (
         }
         // eslint-disable-next-line github/array-foreach
         valueCD.slots.forEach(vrm.addReachableVref);
-        capdatas[prop] = valueCD;
+        defineProperty(capdatas, prop, {
+          value: valueCD,
+          writable: true,
+          enumerable: true,
+          configurable: false,
+        });
         valueMap.set(prop, value);
       }
       // dataCache contents remain mutable: state setter modifies in-place

package/test/util.d.ts

@@ -12,7 +12,7 @@ export function buildDispatch(onDispatchCallback?: (d: unknown) => void): {
  * @param {unknown} result
  */
 export function makeMessage(target: unknown, method: string | symbol, args?: any[], result?: unknown): unknown[];
-export function makeStartVat(vatParameters: any): any[];
+export function makeStartVat(vatParametersCapData?: import("@endo/marshal").CapData<string>): (string | import("@endo/marshal").CapData<string>)[];
 export function makeBringOutYourDead(): string[];
 export function makeResolutions(resolutions: any): any[];
 export function makeResolve(target: any, result: any): any[];

package/test/util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["util.js"],"names":[],"mappings":"AAKA;;GAEG;AACH,mDAFW,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI;;;EAwC9B;AAED;;;;;GAKG;AACH,oCALW,OAAO,UACP,MAAM,GAAG,MAAM,SACf,GAAG,EAAE,WACL,OAAO,aAOjB;AAED,wDAEC;AAED,iDAEC;AAED,yDAGC;AAED,6DAGC;AAED,2EAIC;AAED,qEAGC;AAED,uEAGC;AAED,uEAGC;;qBAjGoB,eAAe"}
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["util.js"],"names":[],"mappings":"AAKA;;GAEG;AACH,mDAFW,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI;;;EAwC9B;AAED;;;;;GAKG;AACH,oCALW,OAAO,UACP,MAAM,GAAG,MAAM,SACf,GAAG,EAAE,WACL,OAAO,aAOjB;AAED,mJAEC;AAED,iDAEC;AAED,yDAGC;AAED,6DAGC;AAED,2EAIC;AAED,qEAGC;AAED,uEAGC;AAED,uEAGC;;qBAjGoB,eAAe"}

package/test/util.js

@@ -59,8 +59,8 @@ export function makeMessage(target, method, args = [], result = null) {
   return vatDeliverObject;
 }
 
-export function makeStartVat(vatParameters) {
-  return harden(['startVat', vatParameters]);
+export function makeStartVat(vatParametersCapData = kser(undefined)) {
+  return harden(['startVat', vatParametersCapData]);
 }
 
 export function makeBringOutYourDead() {

package/test/virtual-objects/state-shape.test.js

@@ -1,8 +1,9 @@
 // @ts-nocheck
 import test from 'ava';
 
+import { Fail } from '@endo/errors';
 import { Far } from '@endo/marshal';
-import { kser, kslot } from '@agoric/kmarshal';
+import { kser, kslot, kunser } from '@agoric/kmarshal';
 import { M } from '@agoric/store';
 import { makeLiveSlots } from '../../src/liveslots.js';
 import { buildSyscall } from '../liveslots-helpers.js';
@@ -10,160 +11,176 @@ import { makeStartVat, makeMessage } from '../util.js';
 import { makeMockGC } from '../mock-gc.js';
 import { makeFakeVirtualStuff } from '../../tools/fakeVirtualSupport.js';
 
-function makeGenericRemotable(typeName) {
-  return Far(typeName, {
-    aMethod() {
-      return 'whatever';
-    },
-  });
-}
-const eph1 = makeGenericRemotable('ephemeral1');
-const eph2 = makeGenericRemotable('ephemeral2');
+/** @import {VatOneResolution} from '../../src/types.js'; */
+/** @import {VatData} from '../../src/vatDataTypes.js'; */
+
+let lastPnum = 100;
+/**
+ * Send a "message" syscall into a liveslots instance and return the
+ * unserialized result, or an error if the result is unsettled or rejected.
+ *
+ * @param {ReturnType<typeof makeLiveSlots>} ls
+ * @param {ReturnType<typeof buildSyscall>['log']} syscallLog
+ * @param {[target: unknown, method: string | symbol, args?: unknown[]]} message
+ */
+const dispatchForResult = async (ls, syscallLog, message) => {
+  const oldSyscallCount = syscallLog.length;
+  lastPnum += 1;
+  const resultVpid = `p-${lastPnum}`;
+  const vdo = makeMessage(...message.concat(undefined).slice(0, 3), resultVpid);
+  await ls.dispatch(vdo);
+  const newSyscalls = syscallLog.slice(oldSyscallCount);
+  /** @type {VatOneResolution[]} */
+  const newResolutions = newSyscalls.flatMap(vso =>
+    vso.type === 'resolve' ? vso.resolutions : [],
+  );
+  const [_vpid, isRejection, capdata] =
+    newResolutions.find(resolution => resolution[0] === resultVpid) ||
+    Fail`unsettled by syscalls ${syscallLog.slice(oldSyscallCount)}`;
+  if (isRejection) throw Error('rejected', { cause: kunser(capdata) });
+  return kunser(capdata);
+};
 
-const init = value => ({ value });
-const behavior = {
-  set: ({ state }, value) => (state.value = value),
+const eph1 = Far('ephemeral1');
+const eph2 = Far('ephemeral2');
+
+const initHolder = fields => ({ ...fields });
+const holderMethods = {
+  get: ({ state }, ...fields) =>
+    // We require fields to be explicit because they are currently defined on
+    // the state *prototype*.
+    Object.fromEntries(
+      fields.flatMap(key => (key in state ? [[key, state[key]]] : [])),
+    ),
+  set: ({ state }, fields) => {
+    Object.assign(state, fields);
+  },
 };
+/**
+ * Define a virtual or durable kind for getting and setting state constrained
+ * by the provided shape.
+ *
+ * @template {VatData.defineKind | VatData.defineDurableKind} D
+ * @param {D} defineKind
+ * @param {Parameters<D>[0]} kindIdentifier
+ * @param {import('@endo/patterns').Pattern} stateShape
+ */
+const defineHolder = (defineKind, kindIdentifier, stateShape) =>
+  defineKind(kindIdentifier, initHolder, holderMethods, { stateShape });
 
 // virtual/durable Kinds can specify a 'stateShape', which should be
-// enforced, both during initialization and subsequent state changes
-
-test('constrain state shape', t => {
+// enforced at both initialization and subsequent state changes
+const testStateShape = test.macro((t, valueShape, config) => {
+  const { goodValues, badValues, throwsExpectation } = config;
   const { vom } = makeFakeVirtualStuff();
   const { defineKind } = vom;
-  const any = { value: M.any() };
-  const number = { value: M.number() };
-  const string = { value: M.string() };
-  const remotable = { value: M.remotable() };
-  const eph = { value: eph1 };
-
-  // M.any() allows anything
-  const makeA = defineKind('kindA', init, behavior, { stateShape: any });
-  makeA(eph1);
-  makeA(1);
-  makeA('string');
-  const a = makeA(1);
-  a.set(eph1);
-  a.set(2);
-  a.set('other string');
-
-  // M.number() requires a number
-  const numberFail = { message: /Must be a number/ };
-  const makeB = defineKind('kindB', init, behavior, { stateShape: number });
-  t.throws(() => makeB(eph1), numberFail);
-  const b = makeB(1);
-  t.throws(() => makeB('string'), numberFail);
-  t.throws(() => b.set(eph1), numberFail);
-  t.throws(() => b.set('string'), numberFail);
-
-  // M.string() requires a string
-  const stringFail = { message: /Must be a string/ };
-  const makeC = defineKind('kindC', init, behavior, { stateShape: string });
-  t.throws(() => makeC(eph1), stringFail);
-  const c = makeC('string');
-  t.throws(() => makeC(1), stringFail);
-  t.throws(() => c.set(eph1), stringFail);
-  t.throws(() => c.set(2), stringFail);
-
-  // M.remotable() requires any Remotable
-  const remotableFail = { message: /Must be a remotable/ };
-  const makeD = defineKind('kindD', init, behavior, { stateShape: remotable });
-  const d = makeD(eph1);
-  makeD(eph2);
-  t.throws(() => makeD(1), remotableFail);
-  t.throws(() => makeD('string'), remotableFail);
-  d.set(eph2);
-  t.throws(() => d.set(2), remotableFail);
-  t.throws(() => d.set('string'), remotableFail);
-
-  // using a specific Remotable object requires that exact object
-  const eph1Fail = { message: /Must be:.*Alleged: ephemeral1/ };
-  const makeE = defineKind('kindE', init, behavior, { stateShape: eph });
-  const e = makeE(eph1);
-  t.throws(() => makeE(eph2), eph1Fail);
-  t.throws(() => makeE(1), eph1Fail);
-  t.throws(() => makeE('string'), eph1Fail);
-  e.set(eph1);
-  t.throws(() => e.set(eph2), eph1Fail);
-  t.throws(() => e.set(2), eph1Fail);
-  t.throws(() => e.set('string'), eph1Fail);
+  const makeHolder = defineHolder(defineKind, 'kindTag', { value: valueShape });
+  const instance = goodValues.map(value => makeHolder({ value })).at(-1);
+  for (const value of goodValues) {
+    instance.set({ value });
+  }
+  for (const value of badValues || []) {
+    t.throws(() => makeHolder({ value }), throwsExpectation);
+    t.throws(() => instance.set({ value }), throwsExpectation);
+  }
+  t.pass();
+});
+test('constrain state shape - M.any()', testStateShape, M.any(), {
+  goodValues: [eph1, eph2, 1, 2, 'string'],
+});
+test('constrain state shape - M.number()', testStateShape, M.number(), {
+  goodValues: [1],
+  badValues: [eph1, 'string'],
+  throwsExpectation: { message: /Must be a number/ },
+});
+test('constrain state shape - M.string()', testStateShape, M.string(), {
+  goodValues: ['string'],
+  badValues: [eph1, 1, 2],
+  throwsExpectation: { message: /Must be a string/ },
+});
+test('constrain state shape - M.remotable()', testStateShape, M.remotable(), {
+  goodValues: [eph1, eph2],
+  badValues: ['string', 1, 2],
+  throwsExpectation: { message: /Must be a remotable/ },
+});
+test('constrain state shape - specific remotable', testStateShape, eph1, {
+  goodValues: [eph1],
+  badValues: ['string', 1, 2],
+  throwsExpectation: { message: /Must be:.*Alleged: ephemeral1/ },
 });
 
 // durable Kinds serialize and store their stateShape, which must
 // itself be durable
-
 test('durable state shape', t => {
   // note: relaxDurabilityRules defaults to true in fake tools
   const { vom } = makeFakeVirtualStuff({ relaxDurabilityRules: false });
   const { makeKindHandle, defineDurableKind } = vom;
 
-  const make = (which, stateShape) => {
-    const kh = makeKindHandle(`kind${which}`);
-    return defineDurableKind(kh, init, behavior, { stateShape });
+  let kindNumber = 0;
+  const defineNextKind = valueShape => {
+    kindNumber += 1;
+    const kh = makeKindHandle(`kind${kindNumber}`);
+    return defineHolder(defineDurableKind, kh, { value: valueShape });
   };
 
-  const makeKind1 = make(1);
-  makeKind1();
+  const makeKind1 = defineNextKind();
+  makeKind1({ value: undefined });
 
-  const makeKind2 = make(2);
+  const makeKind2 = defineNextKind();
   makeKind2();
 
-  const makeKind3 = make(3, { value: M.any() });
+  const makeKind3 = defineNextKind(M.any());
   const obj3 = makeKind3();
 
-  const makeKind4 = make(4, { value: M.string() });
-  const obj4 = makeKind4('string');
+  const makeKind4 = defineNextKind(M.string());
+  const obj4 = makeKind4({ value: 'string' });
 
-  const makeKind5 = make(5, { value: M.remotable() });
+  const makeKind5 = defineNextKind(M.remotable());
   const durableValueFail = { message: /value for "value" is not durable/ };
-  t.throws(() => makeKind5(eph1), durableValueFail);
+  t.throws(() => makeKind5({ value: eph1 }), durableValueFail);
 
   const durableShapeFail = { message: /stateShape.*is not durable: slot 0 of/ };
-  t.throws(() => make(6, { value: eph1 }), durableShapeFail);
+  t.throws(() => defineNextKind(eph1), durableShapeFail);
 
-  const makeKind7 = make(7, { value: obj4 }); // obj4 is durable
-  makeKind7(obj4);
+  const makeKind7 = defineNextKind(obj4); // obj4 is durable
+  makeKind7({ value: obj4 });
   const specificRemotableFail = { message: /kind3.*Must be:.*kind4/ };
-  t.throws(() => makeKind7(obj3), specificRemotableFail);
+  t.throws(() => makeKind7({ value: obj3 }), specificRemotableFail);
 });
 
 // durable Kinds maintain refcounts on their serialized stateShape
-
 test('durable stateShape refcounts', async t => {
   const kvStore = new Map();
   const { syscall: sc1 } = buildSyscall({ kvStore });
   const gcTools = makeMockGC();
 
-  function build1(vatPowers, _vp, baggage) {
-    const { VatData } = vatPowers;
-    const { makeKindHandle, defineDurableKind } = VatData;
-
-    return Far('root', {
-      accept: _standard1 => 0, // assign it a vref
-      create: standard1 => {
-        const kh = makeKindHandle('shaped');
-        baggage.init('kh', kh);
-        const stateShape = { value: standard1 };
-        defineDurableKind(kh, init, behavior, { stateShape });
-      },
-    });
-  }
-
-  const makeNS1 = () => ({ buildRootObject: build1 });
-  const ls1 = makeLiveSlots(sc1, 'vatA', {}, {}, gcTools, undefined, makeNS1);
-  const startVat1 = makeStartVat(kser());
-  await ls1.dispatch(startVat1);
-  const rootA = 'o+0';
-
-  const standard1Vref = 'o-1';
-  await ls1.dispatch(makeMessage(rootA, 'accept', []));
-  t.falsy(ls1.testHooks.getReachableRefCount(standard1Vref));
+  const ls1 = makeLiveSlots(sc1, 'vatA', {}, {}, gcTools, undefined, () => {
+    const buildRootObject = (vatPowers, _vatParameters, baggage) => {
+      const { VatData } = vatPowers;
+      const { makeKindHandle, defineDurableKind } = VatData;
+
+      return Far('root', {
+        acceptRef: _ref => {}, // assigns a vref
+        defineDurableKind: valueShape => {
+          const kh = makeKindHandle('shaped');
+          baggage.init('kh', kh);
+          defineHolder(defineDurableKind, kh, { value: valueShape });
+        },
+      });
+    };
+    return { buildRootObject };
+  });
+  await ls1.dispatch(makeStartVat());
+  const root = 'o+0';
 
-  await ls1.dispatch(makeMessage(rootA, 'create', [kslot(standard1Vref)]));
+  // accepting a ref but doing nothing with it does not increment its refcount
+  const vref1 = 'o-1';
+  await ls1.dispatch(makeMessage(root, 'acceptRef', [kslot(vref1)]));
+  t.is(ls1.testHooks.getReachableRefCount(vref1), 0);
 
-  // using our 'standard1' object in stateShape causes its refcount to
-  // be incremented
-  t.is(ls1.testHooks.getReachableRefCount(standard1Vref), 1);
+  // ...but using it in stateShape does
+  await ls1.dispatch(makeMessage(root, 'defineDurableKind', [kslot(vref1)]));
+  t.is(ls1.testHooks.getReachableRefCount(vref1), 1);
 
   // ------
 
@@ -171,128 +188,202 @@ test('durable stateShape refcounts', async t => {
   const clonedStore = new Map(kvStore);
   const { syscall: sc2 } = buildSyscall({ kvStore: clonedStore });
 
-  function build2(vatPowers, vatParameters, baggage) {
-    const { VatData } = vatPowers;
-    const { defineDurableKind } = VatData;
-    const { standard2 } = vatParameters;
-    const kh = baggage.get('kh');
-    const stateShape = { value: standard2 };
-    defineDurableKind(kh, init, behavior, { stateShape });
-
-    return Far('root', {});
-  }
-
   // to test refcount increment/decrement, we need to override the
   // usual rule that the new version must exactly match the original
   // stateShape
-  const options = { allowStateShapeChanges: true };
-  const makeNS2 = () => ({ buildRootObject: build2 });
-  const ls2 = makeLiveSlots(
-    sc2,
-    'vatA',
-    {},
-    options,
-    gcTools,
-    undefined,
-    makeNS2,
-  );
-
-  const standard2Vref = 'o-2';
-  const vp = { standard2: kslot(standard2Vref) };
-  const startVat2 = makeStartVat(kser(vp));
-  await ls2.dispatch(startVat2);
-
-  // redefining the durable kind, with a different 'standard' object,
-  // will decrement the standard1 refcount, and increment that of
-  // standard2
+  const opts = { allowStateShapeChanges: true };
+  const ls2 = makeLiveSlots(sc2, 'vatA', {}, opts, gcTools, undefined, () => {
+    const buildRootObject = (vatPowers, vatParameters, baggage) => {
+      const { VatData } = vatPowers;
+      const { defineDurableKind } = VatData;
+      const { valueShape } = vatParameters;
+      const kh = baggage.get('kh');
+      defineHolder(defineDurableKind, kh, { value: valueShape });
+
+      return Far('root', {});
+    };
+    return { buildRootObject };
+  });
 
-  t.falsy(ls2.testHooks.getReachableRefCount(standard1Vref));
-  t.is(ls2.testHooks.getReachableRefCount(standard2Vref), 1);
+  // redefining the durable kind's stateShape to replace its vref1 reference
+  // with a vref2 reference will decrement the former refcount and increment the
+  // latter
+  const vref2 = 'o-2';
+  const vatParameters = { valueShape: kslot(vref2) };
+  await ls2.dispatch(makeStartVat(kser(vatParameters)));
+  t.is(ls2.testHooks.getReachableRefCount(vref1), 0);
+  t.is(ls2.testHooks.getReachableRefCount(vref2), 1);
 });
 
-test('durable stateShape must match', async t => {
-  const kvStore = new Map();
-  const { syscall: sc1 } = buildSyscall({ kvStore });
+test('durable stateShape must match or extend', async t => {
+  const store1 = new Map();
+  const { syscall: sc1, log: log1 } = buildSyscall({ kvStore: store1 });
   const gcTools = makeMockGC();
 
-  function build1(vatPowers, _vp, baggage) {
-    const { VatData } = vatPowers;
-    const { makeKindHandle, defineDurableKind } = VatData;
-
-    return Far('root', {
-      create: (obj1, obj2) => {
-        const kh = makeKindHandle('shaped');
-        baggage.init('kh', kh);
-        const stateShape = { x: obj1, y: obj2 };
-        defineDurableKind(kh, init, behavior, { stateShape });
-      },
-    });
-  }
-
-  const makeNS1 = () => ({ buildRootObject: build1 });
-  const ls1 = makeLiveSlots(sc1, 'vatA', {}, {}, gcTools, undefined, makeNS1);
-  const startVat1 = makeStartVat(kser());
-  await ls1.dispatch(startVat1);
-  const rootA = 'o+0';
+  const fields = ['x', 'x2', 'y']; // but "x2" is not initially present
+  const ls1 = makeLiveSlots(sc1, 'vatA', {}, {}, gcTools, undefined, () => {
+    const buildRootObject = (vatPowers, _vatParameters, baggage) => {
+      const { VatData } = vatPowers;
+      const { makeKindHandle, defineDurableKind } = VatData;
+
+      return Far('root', {
+        makeShapedDurable: (x, y) => {
+          const kh = makeKindHandle('shaped');
+          baggage.init('kh', kh);
+          const makeInstance = defineHolder(defineDurableKind, kh, { x, y });
+          return makeInstance(harden({ x, y }));
+        },
+      });
+    };
+    return { buildRootObject };
+  });
+  await ls1.dispatch(makeStartVat());
+  const root = 'o+0';
 
   const vref1 = 'o-1';
   const vref2 = 'o-2';
-  await ls1.dispatch(
-    makeMessage(rootA, 'create', [kslot(vref1), kslot(vref2)]),
+  const passables = new Map([
+    [vref1, kslot(vref1, vref1)],
+    [vref2, kslot(vref2, vref2)],
+  ]);
+  const instance1 = await dispatchForResult(ls1, log1, [
+    root,
+    'makeShapedDurable',
+    [passables.get(vref1), passables.get(vref2)],
+  ]);
+  const objRef = instance1.getKref();
+  const state1 = await dispatchForResult(ls1, log1, [objRef, 'get', fields]);
+  t.deepEqual(
+    kser(state1),
+    kser({ x: passables.get(vref1), y: passables.get(vref2) }),
   );
 
-  // the first version's state is { x: vref1, y: vref2 }
-
   // ------
 
   // Simulate upgrade by starting from the non-empty kvStore.
-  const clonedStore = new Map(kvStore);
-  const { syscall: sc2 } = buildSyscall({ kvStore: clonedStore });
+  const store2 = new Map(store1);
+  const { syscall: sc2, log: log2 } = buildSyscall({ kvStore: store2 });
 
-  function build2(vatPowers, vatParameters, baggage) {
-    const { VatData } = vatPowers;
-    const { defineDurableKind } = VatData;
-    const { obj1, obj2 } = vatParameters;
-    const kh = baggage.get('kh');
-    // several shapes that are not compatible
-    const shape1 = { x: obj1, y: M.any() };
-    const shape2 = { x: obj1 };
-    const shape3 = { x: obj1, y: obj2, z: M.string() };
-    const shape4 = { x: M.or(obj1, M.string()), y: obj2 };
-    const shape5 = { x: obj2, y: obj1 }; // wrong slots
-    const trial = shape => {
-      t.throws(
-        () => defineDurableKind(kh, init, behavior, { stateShape: shape }),
-        { message: /durable Kind stateShape mismatch/ },
-      );
+  // we do *not* override allowStateShapeChanges
+  // const opts = { allowStateShapeChanges: true };
+  const opts = undefined;
+  const stateShapeMismatch = { message: /durable Kind stateShape mismatch/ };
+  const ls2 = makeLiveSlots(sc2, 'vatA', {}, opts, gcTools, undefined, () => {
+    const buildRootObject = (vatPowers, vatParameters, baggage) => {
+      const { VatData } = vatPowers;
+      const { x, y } = vatParameters;
+      const kh = baggage.get('kh');
+      const redefineDurableKind = stateShape =>
+        defineHolder(VatData.defineDurableKind, kh, stateShape);
+      // several shapes that are not compatible
+      const badShapes = [
+        { x, y: M.any() },
+        { x },
+        { x, y, z: M.string() },
+        { x: M.or(x, M.string()), y },
+        { x: y, y: x }, // wrong slots
+      ];
+      for (const stateShape of badShapes) {
+        t.throws(() => redefineDurableKind(stateShape), stateShapeMismatch);
+      }
+      // the correct shape
+      redefineDurableKind({ x, y });
+
+      return Far('root', {});
     };
-    trial(shape1);
-    trial(shape2);
-    trial(shape3);
-    trial(shape4);
-    trial(shape5);
-    const stateShape = { x: obj1, y: obj2 }; // the correct shape
-    defineDurableKind(kh, init, behavior, { stateShape });
-    t.pass();
-
-    return Far('root', {});
-  }
+    return { buildRootObject };
+  });
 
-  // we do *not* override allowStateShapeChanges
-  // const options = { allowStateShapeChanges: true };
-  const options = undefined;
-  const makeNS2 = () => ({ buildRootObject: build2 });
-  const ls2 = makeLiveSlots(
-    sc2,
-    'vatA',
-    {},
-    options,
-    gcTools,
-    undefined,
-    makeNS2,
-  );
+  const vatParameters2 = { x: passables.get(vref1), y: passables.get(vref2) };
+  await ls2.dispatch(makeStartVat(kser(vatParameters2)));
+
+  const state2 = await dispatchForResult(ls2, log2, [objRef, 'get', fields]);
+  t.deepEqual(kser(state2), kser(state1));
 
-  const vp = { obj1: kslot(vref1), obj2: kslot(vref2) };
-  const startVat2 = makeStartVat(kser(vp));
-  await ls2.dispatch(startVat2);
+  // ------
+
+  // Now upgrade again, first to add a new optional stateShape field x2 and then
+  // to preserve the new shape.
+  const store3 = new Map(store2);
+  const { syscall: sc3, log: log3 } = buildSyscall({ kvStore: store3 });
+  const ls3 = makeLiveSlots(sc3, 'vatA', {}, {}, gcTools, undefined, () => {
+    const buildRootObject = ({ VatData }, vatParameters, baggage) => {
+      const { x, y } = vatParameters;
+      const kh = baggage.get('kh');
+      const redefineDurableKind = stateShape =>
+        defineHolder(VatData.defineDurableKind, kh, stateShape);
+      const badShapes = [{ x, x2: x, y }];
+      for (const stateShape of badShapes) {
+        t.throws(() => redefineDurableKind(stateShape), stateShapeMismatch);
+      }
+      redefineDurableKind({ x, x2: M.or(M.undefined(), x), y });
+      return Far('root', {});
+    };
+    return { buildRootObject };
+  });
+  const vatParameters3 = { x: passables.get(vref1), y: passables.get(vref2) };
+  await ls3.dispatch(makeStartVat(kser(vatParameters3)));
+
+  const state3 = await dispatchForResult(ls3, log3, [objRef, 'get', fields]);
+  t.deepEqual(kser(state3), kser({ ...state1, x2: undefined }));
+  const makeVerificationCase = (x, x2, y, throwsMessage) => [
+    `{ x: ${x}, x2: ${x2}, y: ${y} }`,
+    { x: passables.get(x), x2: passables.get(x2), y: passables.get(y) },
+    throwsMessage,
+  ];
+  const verifications = [
+    makeVerificationCase(vref1, vref2, vref2, 'rejected'),
+    makeVerificationCase(vref1, vref1, vref2),
+    makeVerificationCase(vref1, undefined, vref2),
+  ];
+  let lastState = state3;
+  for (const [label, value, message] of verifications) {
+    const tryUpdate = () =>
+      dispatchForResult(ls3, log3, [objRef, 'set', [value]]);
+    await (message
+      ? t.throwsAsync(tryUpdate, { message }, `${label} ${message}`)
+      : tryUpdate());
+    const state = await dispatchForResult(ls3, log3, [objRef, 'get', fields]);
+    const expectState = message ? lastState : value;
+    t.deepEqual(kser(state), kser(expectState), `${label}`);
+    lastState = state;
+  }
+
+  const store4 = new Map(store3);
+  const { syscall: sc4, log: log4 } = buildSyscall({ kvStore: store4 });
+  const ls4 = makeLiveSlots(sc4, 'vatA', {}, {}, gcTools, undefined, () => {
+    const buildRootObject = ({ VatData }, vatParameters, baggage) => {
+      const { x, y } = vatParameters;
+      const kh = baggage.get('kh');
+      const redefineDurableKind = stateShape =>
+        defineHolder(VatData.defineDurableKind, kh, stateShape);
+      const badShapes = [
+        // Removing optionality from x2.
+        { x, x2: x, y },
+        // Equivalent but not *equal* to M.or(M.undefined(), x).
+        { x, x2: M.or(undefined, x), y },
+        { x, x2: M.or(x, M.undefined()), y },
+      ];
+      for (const stateShape of badShapes) {
+        t.throws(() => redefineDurableKind(stateShape), stateShapeMismatch);
+      }
+      redefineDurableKind({ x, x2: M.or(M.undefined(), x), y });
+      return Far('root', {});
+    };
+    return { buildRootObject };
+  });
+  const vatParameters4 = { x: passables.get(vref1), y: passables.get(vref2) };
+  await ls4.dispatch(makeStartVat(kser(vatParameters4)));
+
+  for (const [label, value, message] of verifications) {
+    const tryUpdate = () =>
+      dispatchForResult(ls4, log4, [objRef, 'set', [value]]);
+    await (message
+      ? t.throwsAsync(tryUpdate, { message }, `${label} ${message}`)
+      : tryUpdate());
+    const state = await dispatchForResult(ls4, log4, [objRef, 'get', fields]);
+    const expectState = message ? lastState : value;
+    t.deepEqual(kser(state), kser(expectState), `${label}`);
+    lastState = state;
+  }
 });