Implement Vows for upgrade-tolerant promise behaviour

[michaelfig]

What is the Problem Being Solved?

Inter-vat promises are sensitive to vat upgrades. If a regular platform promise is created in Alice's vat and sent to Bob's vat, two main cases can cause mayhem:

1. Alice's vat upgrades before the promise is settled, then Bob receives a "vat upgraded" rejection, and has no clear way to recover since Bob doesn't know how much of the request was completed.
2. Bob's vat upgrades before the promise is settled, then Bob's promise reactions are forgotten, and his vat is in an inconsistent state.

Description of the Design

We introduce a form of pseudo-promise, a Vow, (also called PromiseStep in an eventual-send APi redesign slide deck. To make both Vows and their resolvers durable, vows are compatible with Zones.

For case 1, we introduce a when operation and a specialized form of E Bob can use that retries the vow-shortening operation on upgrade failures or intermediate vow objects, resulting eventually in a terminal fulfilment. If Alice creates a durable vow, it can be stored alongside its resolver to be resilient to Alice's upgrades.

For case 2, there already exists a solution for platform promises, watchPromise, but we need to extend its implementation to accommodate Vows by introducing a watch operation Bob can use.

Security Considerations

Vows are not implicitly subscribed to by liveslots, so they cause less implicit behaviour and using them in place of promises may reduce load if adopted at the system level.

Scaling Considerations

A when or watch of a vow that simply rejects all shortening attempts with "vat upgraded" can cause chattiness between vats and never resolving.

Test Plan

Upgrade Considerations

[dckc]

re Scaling Considerations - using the mechanism in case 2 introduces a round-trip, right?

#8742 (comment)