vat-vaultFactory may believe governance is broken when vat-auctioneer is upgraded

[warner]

As part of #8499 (comment) (look for v45-auctioneer-v48-vaultfactory), we observe that v48-vaultFactory follows (is a subscriber to) a governance-parameter notifier that lives in v45-auctioneer. The v45-auctioneer's @agoric/governance code is not durable, so when v45-auctioneer is upgraded, that notifier will be deleted/abandoned, and v48-vaultFactory may believe that governance has broken.

The subscriber code is probably set up here: https://github.com/Agoric/agoric-sdk/blob/release-mainnet1B/packages/inter-protocol/src/vaultFactory/liquidation.js#L211 . It uses observeIteration, so if v45-auctioneer's governance objects were durable, this would be safe against v45-auctioneer being upgraded. And it looks like this is called from a start method that will be called on each upgrade of v48-vaultFactory, so it should be safe against v48-vaultFactory upgrades.

To address this, I think the subscribeEach needs some sort of error-handling case, which can notice that the promise was disconnected (and perhaps check that the incarnation number is new), and react by requesting a new subscription from the (hopefully durable) auctioneerPublicFacet.

(#8079 might overlap with this, but is mainly about v48-vaultFactory not yet being upgradable, rather than what additional safeguards it needs against other vats being upgraded)

The tasks are:

• change watchForGovernanceChange in v48-vaultFactory to tolerate upgrades of the upstream v45-auctioneer
• demonstrate (via a3p?) upgrading v45-auctioneer, then making a governance change, then observing that v48-vaultFactory correctly notices the governance change

We must deploy the v48-vaultFactory fix before we can safely upgrade v45-auctioneer.

[dckc]

see also

• vaultFactory contract not upgradable #8079

[Chris-Hibbert]

The auctioneer isn't designed to be upgraded. The plan is to replace it with a new instance. This means the steps are

• start a new auctioneer
• upgrade vaultFactory with new terms pointing to the new auctioneer (inform VaultFactory about new Auctioneer #8735, Upgrade VaultFactory in A3P, and use new auctions and price feeds #8757)
• Figure out how to retire the unused auctioneer

It might still be helpful to enhance watchForGovernanceChange to give the iterationObserver fail and finish methods, but I don't think they could do more than announce that the VaultManager has lost contact with the auction schedule.

[Chris-Hibbert]

#9283 demonstrates that this is not an issue.

[dckc]

changing "completed" to "not planned"...