fix: cheap auxdata

[erights]

Liveslots adds to all remote presences an aux() method.

A remote presence has an aux() method that either returns a promise or a non-promise. The first time it is called, it does an eventual-send of an aux() message to the far object it designates, remembers that promise as its auxdata, and returns that. It also watches that promise to react to its fulfillment. Until that reaction, every time its aux() is called, it will return that same promise. Once it reacts to the promise being fulfilled, if that ever happens, then the fulfillment becomes its new auxdata which gets returned from then on.

Initially only liveslots does this. But the mechanism is in a reusable makeRemotePresence function that should probably move to @endo/marshal so that other things that make remote presences can use it.

A good first test will be for ERTP brands to provide an auxdata object with the things that you can currently ask a brand for that are stable, and that zoe needs to cache before it can register the brand. Zoe's caching logic should then become much simpler as it need only delay registration until a local call to the brand's aux() returns a non-promise. After that, the remote presence's aux() method must always immediately return the same non-promise.

(Some brands are co-located with Zoe, in which case their aux() method may not be similarly stable. But that would be a misbehaving brand. The only brands co-located with the Zoe service are made by Zoe and relied on not to misbehave.)

Back in draft pending needed redesign to play well with virtual and durable storage.

If we believe this approach is adequate for our auxdata needs, then
Fixes: #2069

@Chris-Hibbert @warner @FUDCo @michaelfig @mhofman when this is ready, I'll ask you to review. Until then, please ignore. @Chris-Hibbert I'm leaving you listed since you already commented.

[Chris-Hibbert]

The ERTP/Zoe changes look fine. Someone else should approve the SwingSet changes.

There's a lint (import ordering) failure in CI.

[Chris-Hibbert]

CI failure from lint. Move this up above line 9.

[erights]

Converting to draft because of unintuitive interaction with durable state and upgrade :(

(Will file bugs explaining the problems)

[mhofman]

Liveslots adds to all remote presences an aux() method.

This will require the program to understand, and have a way to test, whether an object is local or remote. Do we have such a predicate today?

method that either returns a promise or a non-promise

Sounds like releasing Zalgo in the worst possible shape. I'd much prefer have a this method return a pseudo promise which is guaranteed to have a stable identity, and have an external promise result memoization helper.

Even then I still don't understand how you'll be able to escape our rules that we never await conditionally. Seems like releasing Zalgo is a design choice here?

Edit: this is based on reading the PR description. I did not read the implementation.

[datadog-full-agoric]

Datadog Report

Branch report: markm-cheap-auxdata
Commit report: 33d0d13

✅ agoric-sdk: 0 Failed, 0 New Flaky, 3556 Passed, 57 Skipped, 15m 27.3s Wall Time

[datadog-full-agoric]

Datadog Report

Branch report: markm-cheap-auxdata
Commit report: 6076b68

✅ agoric-sdk: 0 Failed, 0 New Flaky, 3757 Passed, 53 Skipped, 20m 0.78s Wall Time

[erights]

Closing in favor of an actual solution to this problem, which I need to explain.

[erights]

Reopening, as my "better idea" does not work at all. See #2069 (comment)