@agoric/swingset-liveslots 0.10.3-u17.1 → 0.10.3-u18.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agoric/swingset-liveslots",
-  "version": "0.10.3-u17.1",
+  "version": "0.10.3-u18.1",
   "description": "SwingSet ocap support layer",
   "type": "module",
   "main": "src/index.js",
@@ -17,22 +17,22 @@
     "lint:eslint": "eslint ."
   },
   "dependencies": {
-    "@agoric/internal": "^0.4.0-u17.1",
-    "@agoric/store": "^0.9.3-u17.1",
-    "@endo/env-options": "^1.1.6",
-    "@endo/errors": "^1.2.5",
-    "@endo/eventual-send": "^1.2.5",
-    "@endo/exo": "^1.5.3",
-    "@endo/far": "^1.1.5",
-    "@endo/init": "^1.1.4",
-    "@endo/marshal": "^1.5.3",
-    "@endo/nat": "^5.0.10",
-    "@endo/pass-style": "^1.4.3",
-    "@endo/patterns": "^1.4.3",
-    "@endo/promise-kit": "^1.1.5"
+    "@agoric/internal": "^0.4.0-u18.1",
+    "@agoric/store": "^0.9.3-u18.1",
+    "@endo/env-options": "^1.1.8",
+    "@endo/errors": "^1.2.8",
+    "@endo/eventual-send": "^1.2.8",
+    "@endo/exo": "^1.5.7",
+    "@endo/far": "^1.1.9",
+    "@endo/init": "^1.1.7",
+    "@endo/marshal": "^1.6.2",
+    "@endo/nat": "^5.0.13",
+    "@endo/pass-style": "^1.4.7",
+    "@endo/patterns": "^1.4.7",
+    "@endo/promise-kit": "^1.1.8"
   },
   "devDependencies": {
-    "@agoric/kmarshal": "^0.1.1-u17.1",
+    "@agoric/kmarshal": "^0.1.1-u18.1",
     "ava": "^5.3.0"
   },
   "files": [
@@ -66,7 +66,7 @@
     "access": "public"
   },
   "typeCoverage": {
-    "atLeast": 75.1
+    "atLeast": 75.24
   },
-  "gitHead": "5259430561693bfcf58516c3ea54123895859708"
+  "gitHead": "f8c45b8a2e29a51522a81a6692af25b2d7f6b50f"
 }

package/src/collectionManager.js

@@ -146,56 +146,48 @@ export function makeCollectionManager(
     scalarMapStore: {
       hasWeakKeys: false,
       kindID: 0,
-      // eslint-disable-next-line no-use-before-define
       reanimator: reanimateMapStore,
       durable: false,
     },
     scalarWeakMapStore: {
       hasWeakKeys: true,
       kindID: 0,
-      // eslint-disable-next-line no-use-before-define
       reanimator: reanimateWeakMapStore,
       durable: false,
     },
     scalarSetStore: {
       hasWeakKeys: false,
       kindID: 0,
-      // eslint-disable-next-line no-use-before-define
       reanimator: reanimateSetStore,
       durable: false,
     },
     scalarWeakSetStore: {
       hasWeakKeys: true,
       kindID: 0,
-      // eslint-disable-next-line no-use-before-define
       reanimator: reanimateWeakSetStore,
       durable: false,
     },
     scalarDurableMapStore: {
       hasWeakKeys: false,
       kindID: 0,
-      // eslint-disable-next-line no-use-before-define
       reanimator: reanimateMapStore,
       durable: true,
     },
     scalarDurableWeakMapStore: {
       hasWeakKeys: true,
       kindID: 0,
-      // eslint-disable-next-line no-use-before-define
       reanimator: reanimateWeakMapStore,
       durable: true,
     },
     scalarDurableSetStore: {
       hasWeakKeys: false,
       kindID: 0,
-      // eslint-disable-next-line no-use-before-define
       reanimator: reanimateSetStore,
       durable: true,
     },
     scalarDurableWeakSetStore: {
       hasWeakKeys: true,
       kindID: 0,
-      // eslint-disable-next-line no-use-before-define
       reanimator: reanimateWeakSetStore,
       durable: true,
     },
@@ -218,7 +210,6 @@ export function makeCollectionManager(
       vrm.registerKind(
         kindID,
         storeKindInfo[kind].reanimator,
-        // eslint-disable-next-line no-use-before-define
         deleteCollection,
         storeKindInfo[kind].durable,
       );
@@ -313,7 +304,6 @@ export function makeCollectionManager(
     // * vref(o-4) -> "vc.5.r0000000001:o-4"
 
     const encodeRemotable = remotable => {
-      // eslint-disable-next-line no-use-before-define
       const ordinal = getOrdinal(remotable);
       ordinal !== undefined || Fail`no ordinal for ${remotable}`;
       const ordinalTag = zeroPad(ordinal, BIGINT_TAG_LEN);

package/src/index.js

@@ -11,5 +11,4 @@ export {
   insistVatSyscallResult,
 } from './message.js';
 
-export * from './types.js';
-export * from './vatDataTypes.js';
+export * from './types-index.js';

package/src/liveslots.js

@@ -155,10 +155,8 @@ function build(
     const { type, allocatedByVat, virtual, durable } = parseVatSlot(vref);
     if (type === 'object' && allocatedByVat) {
       if (virtual || durable) {
-        // eslint-disable-next-line no-use-before-define
         vrm.setExportStatus(vref, 'reachable');
       } else {
-        // eslint-disable-next-line no-use-before-define
         const remotable = requiredValForSlot(vref);
         exportedRemotables.add(remotable);
         kernelRecognizableRemotables.add(vref);
@@ -183,7 +181,6 @@ function build(
 
     if (wr && !wr.deref()) {
       // we're in the COLLECTED state, or FINALIZED after a re-introduction
-      // eslint-disable-next-line no-use-before-define
       addToPossiblyDeadSet(baseRef);
       slotToVal.delete(baseRef);
     }
@@ -209,11 +206,9 @@ function build(
         // Support: o~.[prop](...args) remote method invocation
         lsdebug(`makeImportedPresence handler.applyMethod (${slot})`);
         if (disavowedPresences.has(o)) {
-          // eslint-disable-next-line no-use-before-define
           exitVatWithFailure(disavowalError);
           throw disavowalError;
         }
-        // eslint-disable-next-line no-use-before-define
         return queueMessage(slot, prop, args, returnedP);
       },
       applyFunction(o, args, returnedP) {
@@ -222,7 +217,6 @@ function build(
       get(o, prop) {
         lsdebug(`makeImportedPresence handler.get (${slot})`);
         if (disavowedPresences.has(o)) {
-          // eslint-disable-next-line no-use-before-define
           exitVatWithFailure(disavowalError);
           throw disavowalError;
         }
@@ -294,7 +288,6 @@ function build(
           console.error(`mIPromise handler called after resolution`);
           Fail`mIPromise handler called after resolution`;
         }
-        // eslint-disable-next-line no-use-before-define
         return queueMessage(vpid, prop, args, returnedP);
       },
       get(p, prop) {
@@ -347,17 +340,14 @@ function build(
   // use a slot from the corresponding allocateX
 
   function allocateExportID() {
-    // eslint-disable-next-line no-use-before-define
     return vrm.allocateNextID('exportID');
   }
 
   function allocateCollectionID() {
-    // eslint-disable-next-line no-use-before-define
     return vrm.allocateNextID('collectionID');
   }
 
   function allocatePromiseID() {
-    // eslint-disable-next-line no-use-before-define
     const promiseID = vrm.allocateNextID('promiseID');
     return makeVatSlot('promise', true, promiseID);
   }
@@ -385,10 +375,8 @@ function build(
       // do a syscall.resolve when it fires. The caller must finish
       // doing their syscall before this turn finishes, to ensure the
       // kernel isn't surprised by a spurious resolution.
-      // eslint-disable-next-line no-use-before-define
       const p = requiredValForSlot(vpid);
       // if (!knownResolutions.has(p)) { // TODO really?
-      // eslint-disable-next-line no-use-before-define
       followForKernel(vpid, p);
       return true;
     }
@@ -400,7 +388,6 @@ function build(
     return makeVatSlot('object', true, exportID);
   }
 
-  // eslint-disable-next-line no-use-before-define
   const m = makeMarshal(convertValToSlot, convertSlotToVal, {
     marshalName: `liveSlots:${forVatID}`,
     serializeBodyFormat: 'smallcaps',
@@ -413,7 +400,6 @@ function build(
       console.warn('Logging sent error stack', err),
   });
   const unmeteredUnserialize = meterControl.unmetered(m.unserialize);
-  // eslint-disable-next-line no-use-before-define
   const unmeteredConvertSlotToVal = meterControl.unmetered(convertSlotToVal);
 
   function getSlotForVal(val) {
@@ -458,7 +444,6 @@ function build(
     allocateExportID,
     getSlotForVal,
     requiredValForSlot,
-    // eslint-disable-next-line no-use-before-define
     registerValue,
     m.serialize,
     unmeteredUnserialize,
@@ -471,10 +456,8 @@ function build(
     vrm,
     allocateExportID,
     allocateCollectionID,
-    // eslint-disable-next-line no-use-before-define
     convertValToSlot,
     unmeteredConvertSlotToVal,
-    // eslint-disable-next-line no-use-before-define
     registerValue,
     m.serialize,
     unmeteredUnserialize,
@@ -486,7 +469,6 @@ function build(
     vrm,
     vom,
     collectionManager,
-    // eslint-disable-next-line no-use-before-define
     convertValToSlot,
     convertSlotToVal: unmeteredConvertSlotToVal,
     maybeExportPromise,
@@ -516,7 +498,6 @@ function build(
         slot = allocatePromiseID();
       } else {
         if (disavowedPresences.has(val)) {
-          // eslint-disable-next-line no-use-before-define
           exitVatWithFailure(disavowalError);
           throw disavowalError; // cannot reference a disavowed object
         }
@@ -686,7 +667,6 @@ function build(
           const priorResolution = knownResolutions.get(p);
           if (priorResolution && !doneResolutions.has(slot)) {
             const [priorRejected, priorRes] = priorResolution;
-            // eslint-disable-next-line no-use-before-define
             collect(slot, priorRejected, priorRes);
           }
         }
@@ -972,7 +952,6 @@ function build(
       }
       // in both cases, we are now the decider, so treat it like an
       // exported promise
-      // eslint-disable-next-line no-use-before-define
       followForKernel(resultVPID, p);
     }
   }
@@ -1249,7 +1228,6 @@ function build(
     possiblyRetiredSet,
     slotToVal,
     valToSlot,
-    // eslint-disable-next-line no-use-before-define
     afterDispatchActions,
   });
 
@@ -1341,7 +1319,7 @@ function build(
 
   /**
    * @param {import('./types.js').VatDeliveryObject} delivery
-   * @returns {void | Promise<void>}
+   * @returns {undefined | ReturnType<startVat>}
    */
   function dispatchToUserspace(delivery) {
     let result;

package/src/types-index.d.ts

@@ -0,0 +1,4 @@
+// Export all the types this package provides
+// eslint-disable-next-line import/export
+export type * from './types.js';
+export type * from './vatDataTypes.js';

package/src/types-index.js

@@ -0,0 +1,2 @@
+// Empty JS file to correspond with its .d.ts twin
+export {};

package/src/virtualObjectManager.js

@@ -1,5 +1,5 @@
 /* global globalThis */
-/* eslint-disable no-use-before-define, jsdoc/require-returns-type */
+/* eslint-disable jsdoc/require-returns-type */
 
 import { environmentOptionsListHas } from '@endo/env-options';
 import { assert, Fail, q, b } from '@endo/errors';

package/src/virtualReferences.js

@@ -1,4 +1,4 @@
-/* eslint-disable no-use-before-define, jsdoc/require-returns-type */
+/* eslint-disable jsdoc/require-returns-type */
 
 import { assert, Fail } from '@endo/errors';
 import { Nat } from '@endo/nat';

package/src/watchedPromises.js

@@ -235,13 +235,23 @@ export function makeWatchedPromiseManager({
       } else {
         watchedPromiseTable.init(vpid, harden([[watcher, ...args]]));
 
+        promiseRegistrations.init(vpid, p);
+
+        // pseudoThen registers a settlement callback that will remove
+        // this promise from promiseRegistrations and
+        // watchedPromiseTable. To avoid triggering
+        // https://github.com/Agoric/agoric-sdk/issues/10757 and
+        // preventing slotToVal cleanup, the `pseudoThen()` should
+        // precede `maybeExportPromise()`. This isn't foolproof, but
+        // does mitigate in advance of a proper fix. See #10756 for
+        // details of this particular mitigation, and #10757 for the
+        // deeper bug.
+        pseudoThen(p, vpid);
+
         // Ensure that this vat's promises are rejected at termination.
         if (maybeExportPromise(vpid)) {
           syscall.subscribe(vpid);
         }
-
-        promiseRegistrations.init(vpid, p);
-        pseudoThen(p, vpid);
       }
     });
   }

package/test/exo-utils.js

@@ -0,0 +1,70 @@
+import { provideLazy as provide } from '@agoric/store';
+
+// Partially duplicates @agoric/vat-data to avoid circular dependencies.
+export const makeExoUtils = VatData => {
+  const { defineDurableKind, makeKindHandle, watchPromise } = VatData;
+
+  const provideKindHandle = (baggage, kindName) =>
+    provide(baggage, `${kindName}_kindHandle`, () => makeKindHandle(kindName));
+
+  const emptyRecord = harden({});
+  const initEmpty = () => emptyRecord;
+
+  const defineDurableExoClass = (
+    kindHandle,
+    interfaceGuard,
+    init,
+    methods,
+    options,
+  ) =>
+    defineDurableKind(kindHandle, init, methods, {
+      ...options,
+      thisfulMethods: true,
+      interfaceGuard,
+    });
+
+  const prepareExoClass = (
+    baggage,
+    kindName,
+    interfaceGuard,
+    init,
+    methods,
+    options = undefined,
+  ) =>
+    defineDurableExoClass(
+      provideKindHandle(baggage, kindName),
+      interfaceGuard,
+      init,
+      methods,
+      options,
+    );
+
+  const prepareExo = (
+    baggage,
+    kindName,
+    interfaceGuard,
+    methods,
+    options = undefined,
+  ) => {
+    const makeSingleton = prepareExoClass(
+      baggage,
+      kindName,
+      interfaceGuard,
+      initEmpty,
+      methods,
+      options,
+    );
+    return provide(baggage, `the_${kindName}`, () => makeSingleton());
+  };
+
+  return {
+    defineDurableKind,
+    makeKindHandle,
+    watchPromise,
+
+    provideKindHandle,
+    defineDurableExoClass,
+    prepareExoClass,
+    prepareExo,
+  };
+};

package/test/handled-promises.test.js

@@ -2,7 +2,7 @@ import test from 'ava';
 
 import { Fail } from '@endo/errors';
 import { Far } from '@endo/marshal';
-import { M, provideLazy as provide } from '@agoric/store';
+import { M } from '@agoric/store';
 import { makePromiseKit } from '@endo/promise-kit';
 // Disabled to avoid circular dependencies.
 // import { makeStoreUtils } from '@agoric/vat-data/src/vat-data-bindings.js';
@@ -10,79 +10,11 @@ import { makePromiseKit } from '@endo/promise-kit';
 import { kslot, kser } from '@agoric/kmarshal';
 import { setupTestLiveslots } from './liveslots-helpers.js';
 import { makeResolve, makeReject } from './util.js';
+import { makeExoUtils } from './exo-utils.js';
 
 // eslint-disable-next-line no-unused-vars
 const compareEntriesByKey = ([ka], [kb]) => (ka < kb ? -1 : 1);
 
-// Paritally duplicates @agoric/vat-data to avoid circular dependencies.
-const makeExoUtils = VatData => {
-  const { defineDurableKind, makeKindHandle, watchPromise } = VatData;
-
-  const provideKindHandle = (baggage, kindName) =>
-    provide(baggage, `${kindName}_kindHandle`, () => makeKindHandle(kindName));
-
-  const emptyRecord = harden({});
-  const initEmpty = () => emptyRecord;
-
-  const defineDurableExoClass = (
-    kindHandle,
-    interfaceGuard,
-    init,
-    methods,
-    options,
-  ) =>
-    defineDurableKind(kindHandle, init, methods, {
-      ...options,
-      thisfulMethods: true,
-      interfaceGuard,
-    });
-
-  const prepareExoClass = (
-    baggage,
-    kindName,
-    interfaceGuard,
-    init,
-    methods,
-    options = undefined,
-  ) =>
-    defineDurableExoClass(
-      provideKindHandle(baggage, kindName),
-      interfaceGuard,
-      init,
-      methods,
-      options,
-    );
-
-  const prepareExo = (
-    baggage,
-    kindName,
-    interfaceGuard,
-    methods,
-    options = undefined,
-  ) => {
-    const makeSingleton = prepareExoClass(
-      baggage,
-      kindName,
-      interfaceGuard,
-      initEmpty,
-      methods,
-      options,
-    );
-    return provide(baggage, `the_${kindName}`, () => makeSingleton());
-  };
-
-  return {
-    defineDurableKind,
-    makeKindHandle,
-    watchPromise,
-
-    provideKindHandle,
-    defineDurableExoClass,
-    prepareExoClass,
-    prepareExo,
-  };
-};
-
 // cf. packages/SwingSet/test/vat-durable-promise-watcher.js
 const buildPromiseWatcherRootObject = (vatPowers, vatParameters, baggage) => {
   const { VatData } = vatPowers;

package/test/strict-test-env-upgrade.test.js

@@ -0,0 +1,94 @@
+/* global globalThis */
+// eslint-disable-next-line import/order
+import { annihilate, startLife } from '../tools/prepare-strict-test-env.js';
+
+import test from 'ava';
+
+import { makeUpgradeDisconnection } from '@agoric/internal/src/upgrade-api.js';
+import { makeExoUtils } from './exo-utils.js';
+
+test.serial('kind redefinition enforced', async t => {
+  annihilate();
+
+  const { prepareExoClass } = makeExoUtils(globalThis.VatData);
+
+  await startLife(async baggage => {
+    const makeTestExo = prepareExoClass(
+      baggage,
+      'TestExo',
+      undefined,
+      () => ({}),
+      {
+        foo() {
+          return 'bar';
+        },
+      },
+    );
+
+    baggage.init('testExo', makeTestExo());
+  });
+
+  await t.throwsAsync(
+    async () =>
+      startLife(async () => {
+        // Not redefining the kind here
+      }),
+    { message: 'defineDurableKind not called for tags: [TestExo]' },
+  );
+
+  await startLife(async baggage => {
+    prepareExoClass(baggage, 'TestExo', undefined, () => ({}), {
+      foo() {
+        return 'baz';
+      },
+    });
+
+    t.is(baggage.get('testExo').foo(), 'baz');
+  });
+});
+
+test.serial('decided promise rejected', async t => {
+  annihilate();
+
+  const { prepareExo } = makeExoUtils(globalThis.VatData);
+  const { watchPromise } = globalThis.VatData;
+
+  t.plan(1);
+
+  await startLife(async baggage => {
+    const watcher = prepareExo(
+      baggage,
+      'DurablePromiseTestWatcher',
+      undefined,
+      {
+        onFulfilled(value) {
+          t.fail(
+            `First incarnation watcher onFulfilled triggered with value ${value}`,
+          );
+        },
+        onRejected(reason) {
+          t.fail(
+            `First incarnation watcher onRejected triggered with reason ${reason}`,
+          );
+        },
+      },
+    );
+
+    const never = harden(new Promise(() => {}));
+
+    watchPromise(never, watcher);
+  });
+
+  await startLife(async baggage => {
+    prepareExo(baggage, 'DurablePromiseTestWatcher', undefined, {
+      onFulfilled(value) {
+        t.fail(
+          `Second incarnation watcher onFulfilled triggered with value ${value}`,
+        );
+      },
+      onRejected(reason) {
+        t.deepEqual(reason, makeUpgradeDisconnection('vat upgraded', 1));
+      },
+    });
+  });
+});

package/test/virtual-objects/set-debug-label-instances.js

@@ -1,4 +1,4 @@
-/* global process */
+/* eslint-env node */
 
 // put this in a separate module, so we can make it happen before
 // importing virtualObjectManager.js

package/test/virtual-objects/virtualObjectManager.test.js

@@ -127,8 +127,8 @@ test('multifaceted virtual objects', t => {
 
   flushStateCache();
   t.deepEqual(log.splice(0), [
-    `get kindIDID => undefined`,
     `get idCounters => undefined`,
+    `get kindIDID => undefined`,
     `set kindIDID 1`,
     `set vom.vkind.2.descriptor {"kindID":"2","tag":"multithing"}`,
     `set vom.${kid}/1 ${multiThingVal('foo', 1)}`,
@@ -203,8 +203,8 @@ test('virtual object operations', t => {
   // t3-0: 'thing-3' 200 0
   const thing4 = makeThing('thing-4', 300); // [t4-0* t3-0* t2-0* t1-0*]
   // t4-0: 'thing-4' 300 0
-  t.is(log.shift(), `get kindIDID => undefined`);
   t.is(log.shift(), `get idCounters => undefined`);
+  t.is(log.shift(), `get kindIDID => undefined`);
   t.is(log.shift(), `set kindIDID 1`);
   t.is(log.shift(), `set vom.vkind.2.descriptor {"kindID":"2","tag":"thing"}`);
   t.is(log.shift(), `set vom.vkind.3.descriptor {"kindID":"3","tag":"zot"}`);
@@ -468,8 +468,8 @@ test('symbol named methods', t => {
   // t1-0: 'thing-1' 0 0
   const thing2 = makeThing('thing-2', 100); // [t1-0* t2-0*]
   // t2-0: 'thing-2' 100 0
-  t.is(log.shift(), `get kindIDID => undefined`);
   t.is(log.shift(), `get idCounters => undefined`);
+  t.is(log.shift(), `get kindIDID => undefined`);
   t.is(log.shift(), `set kindIDID 1`);
   t.is(
     log.shift(),
@@ -649,8 +649,8 @@ test('virtual object gc', t => {
     },
   });
 
-  t.is(log.shift(), `get kindIDID => undefined`);
   t.is(log.shift(), `get idCounters => undefined`);
+  t.is(log.shift(), `get kindIDID => undefined`);
   t.is(log.shift(), `set kindIDID 1`);
   const skit = [
     'storeKindIDTable',

package/test/watch-promise.test.js

@@ -0,0 +1,42 @@
+import test from 'ava';
+
+import { Far } from '@endo/marshal';
+import { makePromiseKit } from '@endo/promise-kit';
+import { setupTestLiveslots } from './liveslots-helpers.js';
+
+const build = vatPowers => {
+  const { VatData } = vatPowers;
+  const { makeKindHandle, defineDurableKind, watchPromise } = VatData;
+
+  const kh = makeKindHandle('handler');
+  const init = () => ({});
+  const behavior = {
+    onFulfilled: _value => 0,
+    onRejected: _reason => 0,
+  };
+  const makeHandler = defineDurableKind(kh, init, behavior);
+
+  return Far('root', {
+    async run() {
+      const pr = makePromiseKit();
+      const handler = makeHandler();
+      watchPromise(pr.promise, handler);
+      pr.resolve('ignored');
+    },
+  });
+};
+
+test('watched local promises should not leak slotToVal entries', async t => {
+  const { dispatchMessage, testHooks } = await setupTestLiveslots(
+    t,
+    build,
+    'vatA',
+  );
+  const { slotToVal } = testHooks;
+  const initial = slotToVal.size;
+
+  await dispatchMessage('run');
+  t.is(slotToVal.size, initial);
+  await dispatchMessage('run');
+  t.is(slotToVal.size, initial);
+});

package/tools/fakeVirtualObjectManager.js

@@ -23,6 +23,7 @@ export function makeFakeVirtualObjectManager(vrm, fakeStuff) {
     VirtualObjectAwareWeakSet,
     flushStateCache,
     canBeDurable,
+    insistAllDurableKindsReconnected,
   } = makeVirtualObjectManager(
     fakeStuff.syscall,
     vrm,
@@ -43,6 +44,7 @@ export function makeFakeVirtualObjectManager(vrm, fakeStuff) {
     defineDurableKindMulti,
     makeKindHandle,
     canBeDurable,
+    insistAllDurableKindsReconnected,
     VirtualObjectAwareWeakMap,
     VirtualObjectAwareWeakSet,
   };

package/tools/fakeVirtualSupport.js

@@ -28,12 +28,14 @@ class FakeFinalizationRegistry {
 }
 
 class FakeWeakRef {
+  #target;
+
   constructor(target) {
-    this.target = target;
+    this.#target = target;
   }
 
   deref() {
-    return this.target; // strong ref
+    return this.#target; // strong ref
   }
 }
 
@@ -41,6 +43,7 @@ export function makeFakeLiveSlotsStuff(options = {}) {
   let vrm;
   function setVrm(vrmToUse) {
     assert(!vrm, 'vrm already configured');
+    vrmToUse.initializeIDCounters();
     vrm = vrmToUse;
   }
 
@@ -174,6 +177,7 @@ export function makeFakeLiveSlotsStuff(options = {}) {
   // and the WeakRef may or may not contain the target value. Use
   // options={weak:true} to match that behavior, or the default weak:false to
   // keep strong references.
+  const WeakRefForSlot = weak ? RealWeakRef : FakeWeakRef;
   const valToSlot = new WeakMap();
   const slotToVal = new Map();
 
@@ -183,7 +187,7 @@ export function makeFakeLiveSlotsStuff(options = {}) {
 
   function getValForSlot(slot) {
     const d = slotToVal.get(slot);
-    return d && (weak ? d.deref() : d);
+    return d && d.deref();
   }
 
   function requiredValForSlot(slot) {
@@ -193,7 +197,7 @@ export function makeFakeLiveSlotsStuff(options = {}) {
   }
 
   function setValForSlot(slot, val) {
-    slotToVal.set(slot, weak ? new RealWeakRef(val) : val);
+    slotToVal.set(slot, new WeakRefForSlot(val));
   }
 
   function convertValToSlot(val) {
@@ -230,7 +234,6 @@ export function makeFakeLiveSlotsStuff(options = {}) {
         assert.fail('fake liveSlots stuff configured without vrm');
       }
     }
-    // eslint-disable-next-line no-use-before-define
     registerEntry(baseRef, val, facet !== undefined);
     if (!result) {
       result = val;
@@ -275,6 +278,7 @@ export function makeFakeLiveSlotsStuff(options = {}) {
   return {
     syscall,
     allocateExportID,
+    allocatePromiseID,
     allocateCollectionID,
     getSlotForVal,
     requiredValForSlot,
@@ -339,7 +343,7 @@ export function makeFakeWatchedPromiseManager(
  * @param {object} [options]
  * @param {number} [options.cacheSize]
  * @param {boolean} [options.relaxDurabilityRules]
- * @param {Map<any, any>} [options.fakeStore]
+ * @param {Map<string, string>} [options.fakeStore]
  * @param {WeakMapConstructor} [options.WeakMap]
  * @param {WeakSetConstructor} [options.WeakSet]
  * @param {boolean} [options.weak]

package/tools/prepare-strict-test-env.js

@@ -0,0 +1,124 @@
+/**
+ * Prepare Agoric SwingSet vat global strict environment for testing.
+ *
+ * Installs Hardened JS (and does lockdown), plus adds mocks for virtual objects
+ * and stores.
+ *
+ * Exports tools for simulating upgrades.
+ */
+
+import '@agoric/internal/src/install-ses-debug.js';
+
+// eslint-disable-next-line import/order
+import { reincarnate, flushIncarnation } from './setup-vat-data.js';
+
+import { makePromiseKit } from '@endo/promise-kit';
+import { Fail } from '@endo/errors';
+import { eventLoopIteration } from '@agoric/internal/src/testing-utils.js';
+import { makeUpgradeDisconnection } from '@agoric/internal/src/upgrade-api.js';
+
+export { flushIncarnation };
+export { eventLoopIteration as nextCrank };
+
+/**
+ * @import { PromiseKit } from '@endo/promise-kit'
+ * @import { Baggage } from '@agoric/swingset-liveslots'
+ * @import { ReincarnateOptions } from './setup-vat-data.js'
+ */
+
+/** @type {ReincarnateOptions} */
+let incarnation;
+let incarnationNumber = 0;
+
+/** @param {Omit<ReincarnateOptions, 'fakeVomKit' | 'fakeStore'>} [options] */
+export const annihilate = (options = {}) => {
+  // @ts-expect-error fakeStore and fakeVomKit don't exist on type, but drop them if they do at runtime
+  const { fakeStore: _fs, fakeVomKit: _fvk, ...opts } = options;
+  incarnation = reincarnate({ relaxDurabilityRules: false, ...opts });
+  incarnationNumber = 0;
+  return incarnation;
+};
+
+/** @returns {Baggage} */
+export const getBaggage = () => {
+  return incarnation.fakeVomKit.cm.provideBaggage();
+};
+
+/**
+ * @param {ReincarnateOptions} [fromIncarnation]
+ */
+export const nextLife = (fromIncarnation = incarnation) => {
+  incarnation = reincarnate(fromIncarnation);
+  incarnationNumber += 1;
+  return incarnation;
+};
+
+/**
+ * @template {(baggage: Baggage) => Promise<any> | any} B
+ * @param {B} build
+ * @param {(tools: Awaited<ReturnType<B>>) => Promise<void> | void} [run]
+ * @param {object} [options]
+ * @param {ReincarnateOptions} [options.fromIncarnation]
+ * @param {boolean} [options.cleanStart]
+ */
+export const startLife = async (
+  build,
+  run,
+  { fromIncarnation, cleanStart } = {},
+) => {
+  await eventLoopIteration();
+  if (cleanStart) annihilate();
+  const oldIncarnationNumber = incarnationNumber;
+  const oldIncarnation = incarnation;
+  const disconnectionObject = makeUpgradeDisconnection(
+    'vat upgraded',
+    oldIncarnationNumber,
+  );
+  const { fakeVomKit } = nextLife(fromIncarnation);
+  /** @type {Map<string, PromiseKit<any>>} */
+  const previouslyWatchedPromises = new Map();
+  let buildTools;
+  try {
+    buildTools = await build(getBaggage());
+    fakeVomKit.wpm.loadWatchedPromiseTable(vref => {
+      // See revivePromise in liveslots.js
+      const { getValForSlot, valToSlot, setValForSlot } = fakeVomKit.fakeStuff;
+      // Assume all promises were decided by the previous incarnation
+      !getValForSlot(vref) || Fail`Attempting to revive known promise ${vref}`;
+      const pk = makePromiseKit();
+      previouslyWatchedPromises.set(vref, pk);
+      const val = pk.promise;
+      valToSlot.set(val, vref);
+      setValForSlot(vref, val);
+      return val;
+    });
+
+    fakeVomKit.vom.insistAllDurableKindsReconnected();
+
+    await eventLoopIteration();
+    // End of start crank
+  } catch (err) {
+    // Rollback upgrade
+    incarnation = oldIncarnation;
+    incarnationNumber = oldIncarnationNumber;
+    throw err;
+  }
+
+  // Simulate a dispatch of previously decided promise rejections
+  // In real swingset this could happen after some deliveries
+  for (const { reject } of previouslyWatchedPromises.values()) {
+    reject(disconnectionObject);
+  }
+  await eventLoopIteration();
+  // End of resolution dispatch crank
+
+  if (run) {
+    await run(buildTools);
+    await eventLoopIteration();
+  }
+
+  return incarnation;
+};
+
+// Setup the initial incarnation
+annihilate();

package/tools/setup-vat-data.js

@@ -12,7 +12,9 @@ import { makeFakeVirtualStuff } from './fakeVirtualSupport.js';
 
 const { WeakMap, WeakSet } = globalThis;
 
-/** @type {ReturnType<makeFakeVirtualStuff>} */
+/** @typedef {ReturnType<typeof makeFakeVirtualStuff>} FakeVomKit */
+
+/** @type {FakeVomKit} */
 let fakeVomKit;
 
 globalThis.VatData = harden({
@@ -44,18 +46,43 @@ globalThis.VatData = harden({
 
 globalThis[PassStyleOfEndowmentSymbol] = passStyleOf;
 
-export const reincarnate = (options = {}) => {
-  const { fakeStore = new Map(), fakeVomKit: fvk } = options;
+/**
+ * @typedef {import("@agoric/internal").Simplify<
+ *   Omit<NonNullable<Parameters<typeof makeFakeVirtualStuff>[0]>, 'WeakMap' | 'WeakSet'> &
+ *   { fakeVomKit: FakeVomKit; fakeStore: Map<string, string> }
+ * >} ReincarnateOptions
+ */
 
-  if (options.fakeVomKit) {
+/**
+ *
+ * @param {Partial<ReincarnateOptions>} options
+ * @returns {Omit<ReincarnateOptions, 'fakeVomKit'>}
+ */
+export const flushIncarnation = (options = {}) => {
+  const { fakeVomKit: fvk = fakeVomKit, ...fakeStuffOptions } = options;
+
+  if (fvk) {
     fvk.vom.flushStateCache();
     fvk.cm.flushSchemaCache();
     fvk.vrm.flushIDCounters();
   }
 
+  // Clone previous fakeStore (if any) to avoid mutations from previous incarnation
+  const fakeStore = new Map(options.fakeStore);
+
+  return { ...fakeStuffOptions, fakeStore };
+};
+
+/**
+ *
+ * @param {Partial<ReincarnateOptions>} options
+ * @returns {ReincarnateOptions}
+ */
+export const reincarnate = (options = {}) => {
+  const clonedIncarnation = flushIncarnation(options);
+
   fakeVomKit = makeFakeVirtualStuff({
-    ...options,
-    fakeStore,
+    ...clonedIncarnation,
     WeakMap,
     WeakSet,
   });
@@ -65,5 +92,5 @@ export const reincarnate = (options = {}) => {
   // @ts-expect-error ditto
   globalThis.WeakSet = fakeVomKit.vom.VirtualObjectAwareWeakSet;
 
-  return { ...options, fakeStore, fakeVomKit };
+  return { ...clonedIncarnation, fakeVomKit };
 };

package/src/vatDataTypes.d.ts

@@ -1,276 +0,0 @@
-/**
- * @file Types for vat-data
- *
- * Facet is a single object with methods.
- * Behavior is a description when defining a kind of what facets it will have.
- * For the non-multi defineKind, there is just one facet so it doesn't have a key.
- */
-import type {
-  MapStore,
-  SetStore,
-  StoreOptions,
-  WeakMapStore,
-  WeakSetStore,
-} from '@agoric/store';
-import type { Amplify, IsInstance, ReceivePower, StateShape } from '@endo/exo';
-import type { RemotableObject } from '@endo/pass-style';
-import type { RemotableBrand } from '@endo/eventual-send';
-import type { InterfaceGuard, Pattern } from '@endo/patterns';
-import type { makeWatchedPromiseManager } from './watchedPromises.js';
-
-// TODO should be moved into @endo/patterns and eventually imported here
-// instead of this local definition.
-export type InterfaceGuardKit = Record<string, InterfaceGuard>;
-export type { MapStore, Pattern };
-
-// This needs `any` values.  If they were `unknown`, code that uses Baggage
-// would need explicit runtime checks or casts for every fetch, which is
-// onerous.
-export type Baggage = MapStore<string, any>;
-
-type WatchedPromisesManager = ReturnType<typeof makeWatchedPromiseManager>;
-
-type Tail<T extends any[]> = T extends [head: any, ...rest: infer Rest]
-  ? Rest
-  : [];
-
-// used to omit the 'context' parameter
-type OmitFirstArg<F> = F extends (x: any, ...args: infer P) => infer R
-  ? (...args: P) => R
-  : never;
-
-// The type of a passable local object with methods.
-// An internal helper to avoid having to repeat `O`.
-type PrimaryRemotable<O> = O & RemotableObject & RemotableBrand<{}, O>;
-
-export type KindFacet<O> = PrimaryRemotable<{
-  [K in keyof O]: OmitFirstArg<O[K]>; // omit the 'context' parameter
-}>;
-
-export type KindFacets<B> = {
-  [FacetKey in keyof B]: KindFacet<B[FacetKey]>;
-};
-
-export type KindContext<S, F> = { state: S; self: KindFacet<F> };
-export type MultiKindContext<S, B> = { state: S; facets: KindFacets<B> };
-
-export type PlusContext<C, M extends (...args: any[]) => any> = (
-  c: C,
-  ...args: Parameters<M>
-) => ReturnType<M>;
-
-export type FunctionsPlusContext<
-  C,
-  O extends Record<string, (...args: any[]) => any>,
-> = {
-  [K in keyof O]: PlusContext<C, O[K]>;
-};
-
-declare class DurableKindHandleClass {
-  private descriptionTag: string;
-}
-export type DurableKindHandle = DurableKindHandleClass;
-
-/**
- * Grab bag of options that can be provided to `defineDurableKind` and its
- * siblings. Not all options are meaningful in all contexts. See the
- * doc-comments on each option.
- */
-export type DefineKindOptions<C> = {
-  /**
-   * If provided, the `finish` function will be called after the instance is
-   * made and internally registered, but before it is returned. The finish
-   * function is to do any post-intantiation initialization that should be
-   * done before exposing the object to its clients.
-   */
-  finish?: (context: C) => void;
-
-  /**
-   * If provided, it describes the shape of all state records of instances
-   * of this kind.
-   */
-  stateShape?: StateShape;
-
-  /**
-   * If a `receiveAmplifier` function is provided to an exo class kit definition,
-   * it will be called with an `Amplify` function. If provided to the definition
-   * of a normal exo or exo class, the definition will throw, since only
-   * exo kits can be amplified.
-   * An `Amplify` function is a function that takes a facet instance of
-   * this class kit as an argument, in which case it will return the facets
-   * record, giving access to all the facet instances of the same cohort.
-   */
-  receiveAmplifier?: ReceivePower<Amplify>;
-
-  /**
-   * If a `receiveInstanceTester` function is provided, it will be called
-   * during the definition of the exo class or exo class kit with an
-   * `IsInstance` function. The first argument of `IsInstance`
-   * is the value to be tested. When it may be a facet instance of an
-   * exo class kit, the optional second argument, if provided, is
-   * a `facetName`. In that case, the function tests only if the first
-   * argument is an instance of that facet of the associated exo class kit.
-   */
-  receiveInstanceTester?: ReceivePower<IsInstance>;
-
-  // TODO properties above are identical to those in FarClassOptions.
-  // These are the only options that should be exposed by
-  // vat-data's public virtual/durable exo APIs. This DefineKindOptions
-  // should explicitly be a subtype, where the methods below are only for
-  // internal use, i.e., below the exo level.
-
-  /**
-   * As a kind option, intended for internal use only.
-   * Meaningful to `makeScalarBigMapStore` and its siblings. These maker
-   * fuctions will make either virtual or durable stores, depending on
-   * this flag. Defaults to off, making virtual but not durable collections.
-   *
-   * Generally, durable collections are provided with `provideDurableMapStore`
-   * and its sibling, which use this flag internally. If you do not make
-   * durable collections by other means, you can consider this as
-   * intended for internal use only.
-   */
-  durable?: boolean;
-
-  /**
-   * Intended for internal use only.
-   * Should the raw methods receive their `context` argument as their first
-   * argument or as their `this` binding? For `defineDurableKind` and its
-   * siblings (including `prepareSingleton`), this defaults to off, meaning that
-   * their behavior methods receive `context` as their first argument.
-   * `prepareExoClass` and its siblings (including `prepareExo`) use
-   * this flag internally to indicate that their methods receive `context`
-   * as their `this` binding.
-   */
-  thisfulMethods?: boolean;
-
-  /**
-   * Intended for internal use only.
-   * Only applicable if this is a class kind. A class kit kind should use
-   * `interfaceGuardKit` instead.
-   *
-   * If an `interfaceGuard` is provided, then the raw methods passed alongside
-   * it are wrapped by a function that first checks that this method's guard
-   * pattern is satisfied before calling the raw method.
-   *
-   * In `defineDurableKind` and its siblings, this defaults to `undefined`.
-   * Exo classes use this internally to protect their raw class methods
-   * using the provided interface.
-   * In absence, an exo is protected anyway, while a bare kind is
-   * not (detected by `!thisfulMethods`),
-   */
-  interfaceGuard?: InterfaceGuard;
-
-  /**
-   * Intended for internal use only.
-   * Only applicable if this is a class kit kind. A class kind should use
-   * `interfaceGuard` instead.
-   *
-   * If an `interfaceGuardKit` is provided, then each member of the
-   * interfaceGuardKit is used to guard the corresponding facet of the
-   * class kit.
-   *
-   * In `defineDurableKindMulti` and its siblings, this defaults to `undefined`.
-   * Exo class kits use this internally to protect their facets.
-   * In absence, an exo is protected anyway, while a bare kind is
-   * not (detected by `!thisfulMethods`),
-   */
-  interfaceGuardKit?: InterfaceGuardKit;
-};
-
-export type VatData = {
-  // virtual kinds
-  /** @deprecated Use defineVirtualExoClass instead */
-  defineKind: <P extends Array<any>, S, F>(
-    tag: string,
-    init: (...args: P) => S,
-    facet: F,
-    options?: DefineKindOptions<KindContext<S, F>>,
-  ) => (...args: P) => KindFacet<F>;
-
-  /** @deprecated Use defineVirtualExoClassKit instead */
-  defineKindMulti: <P extends Array<any>, S, B>(
-    tag: string,
-    init: (...args: P) => S,
-    behavior: B,
-    options?: DefineKindOptions<MultiKindContext<S, B>>,
-  ) => (...args: P) => KindFacets<B>;
-
-  // durable kinds
-  makeKindHandle: (descriptionTag: string) => DurableKindHandle;
-
-  /** @deprecated Use defineDurableExoClass instead */
-  defineDurableKind: <P extends Array<any>, S, F>(
-    kindHandle: DurableKindHandle,
-    init: (...args: P) => S,
-    facet: F,
-    options?: DefineKindOptions<KindContext<S, F>>,
-  ) => (...args: P) => KindFacet<F>;
-
-  /** @deprecated Use defineDurableExoClassKit instead */
-  defineDurableKindMulti: <P extends Array<any>, S, B>(
-    kindHandle: DurableKindHandle,
-    init: (...args: P) => S,
-    behavior: B,
-    options?: DefineKindOptions<MultiKindContext<S, B>>,
-  ) => (...args: P) => KindFacets<B>;
-
-  providePromiseWatcher: WatchedPromisesManager['providePromiseWatcher'];
-  watchPromise: WatchedPromisesManager['watchPromise'];
-
-  makeScalarBigMapStore: <K, V>(
-    label: string,
-    options?: StoreOptions,
-  ) => MapStore<K, V>;
-  makeScalarBigWeakMapStore: <K, V>(
-    label: string,
-    options?: StoreOptions,
-  ) => WeakMapStore<K, V>;
-
-  makeScalarBigSetStore: <K>(
-    label: string,
-    options?: StoreOptions,
-  ) => SetStore<K>;
-  makeScalarBigWeakSetStore: <K>(
-    label: string,
-    options?: StoreOptions,
-  ) => WeakSetStore<K>;
-  canBeDurable: (specimen: unknown) => boolean;
-};
-
-// The JSDoc is repeated here and at the function definition so it appears
-// in IDEs where it's used, regardless of type resolution.
-export interface PickFacet {
-  /**
-   * When making a multi-facet kind, it's common to pick one facet to
-   * expose. E.g.,
-   *
-   *     const makeFoo = (a, b, c, d) => makeFooBase(a, b, c, d).self;
-   *
-   * This helper reduces the duplication:
-   *
-   *     const makeFoo = pickFacet(makeFooBase, 'self');
-   */
-  <M extends (...args: any[]) => any, F extends keyof ReturnType<M>>(
-    maker: M,
-    facetName: F,
-  ): (...args: Parameters<M>) => ReturnType<M>[F];
-}
-
-/** @deprecated Use prepareExoClass instead */
-export type PrepareKind = <P extends Array<any>, S, F>(
-  baggage: Baggage,
-  tag: string,
-  init: (...args: P) => S,
-  facet: F,
-  options?: DefineKindOptions<KindContext<S, F>>,
-) => (...args: P) => KindFacet<F>;
-
-/** @deprecated Use prepareExoClassKit instead */
-export type PrepareKindMulti = <P extends Array<any>, S, B>(
-  baggage: Baggage,
-  tag: string,
-  init: (...args: P) => S,
-  behavior: B,
-  options?: DefineKindOptions<MultiKindContext<S, B>>,
-) => (...args: P) => KindFacets<B>;

package/src/vatDataTypes.js

@@ -1,2 +0,0 @@
-// Empty JS file to correspond with vatDataTypes.d.ts
-export {};