fix(cosmic-swingset): inject kernel upgrade events at a safe time

We use a new `Action_Type.KERNEL_UPGRADE_EVENTS` to call
`controller.injectQueuedUpgradeEvents()` at a safe time. The first run
after a chain-halting software upgrade will drain the run-queue of any
leftover work, then the second run will process the kernel upgrade
events. Any embedded core-proposals will be processed in runs after
those finish.

packages/cosmic-swingset/src/launch-chain.js

@@ -216,7 +216,7 @@ export async function buildSwingset(
   }
 
   const pendingCoreProposals = await ensureSwingsetInitialized();
-  upgradeSwingset(kernelStorage);
+  const { modified } = upgradeSwingset(kernelStorage);
   const controller = await makeSwingsetController(
     kernelStorage,
     deviceEndowments,
@@ -237,6 +237,7 @@ export async function buildSwingset(
   return {
     coreProposals: pendingCoreProposals,
     controller,
+    kernelHasUpgradeEvents: modified,
     mb: mailboxDevice,
     bridgeInbound: bridgeDevice.deliverInbound,
     timer: timerDevice,
@@ -409,6 +410,7 @@ export async function launch({
   const {
     coreProposals: bootstrapCoreProposals,
     controller,
+    kernelHasUpgradeEvents,
     mb,
     bridgeInbound,
     timer,
@@ -511,6 +513,14 @@ export async function launch({
     await commit();
   }
 
+  async function doKernelUpgradeEvents(inboundNum) {
+    controller.writeSlogObject({
+      type: 'cosmic-swingset-inject-kernel-upgrade-events',
+      inboundNum,
+    });
+    controller.injectQueuedUpgradeEvents();
+  }
+
   async function deliverInbound(sender, messages, ack, inboundNum) {
     Array.isArray(messages) || Fail`inbound given non-Array: ${messages}`;
     controller.writeSlogObject({
@@ -630,6 +640,11 @@ export async function launch({
         break;
       }
 
+      case ActionType.KERNEL_UPGRADE_EVENTS: {
+        p = doKernelUpgradeEvents(inboundNum);
+        break;
+      }
+
       case ActionType.INSTALL_BUNDLE: {
         p = installBundle(action.bundle);
         break;
@@ -935,6 +950,22 @@ export async function launch({
           await doBootstrap(action);
         }
 
+        // The reboot-time upgradeSwingset() may have generated some
+        // remediation events that need to be injected at the right
+        // time (after catchup, before proposals). Push them onto
+        // runThisBlock before anything else goes there.
+        if (kernelHasUpgradeEvents) {
+          isBootstrap ||
+            upgradeDetails ||
+            Fail`Unexpected kernel upgrade events outside of consensus start`;
+          const txHash = 'x/kernel-upgrade-events';
+          const context = { blockHeight, txHash, msgIdx: 0 };
+          runThisBlock.push({
+            action: { type: ActionType.KERNEL_UPGRADE_EVENTS },
+            context,
+          });
+        }
+
         // Concatenate together any pending core proposals from chain bootstrap
         // with any from this inbound init action, then execute them all.
         const coreProposals = mergeCoreProposals(

packages/internal/src/action-types.js

@@ -16,3 +16,4 @@ export const WALLET_ACTION = 'WALLET_ACTION';
 export const WALLET_SPEND_ACTION = 'WALLET_SPEND_ACTION';
 export const INSTALL_BUNDLE = 'INSTALL_BUNDLE';
 export const VTRANSFER_IBC_EVENT = 'VTRANSFER_IBC_EVENT';
+export const KERNEL_UPGRADE_EVENTS = 'KERNEL_UPGRADE_EVENTS';