Vats can be shut down to reap their objects using the adminNode.

[Chris-Hibbert]

What is the Problem Being Solved?

In #8400 and #8401, we discuss some problems with uncollected objects that accumulates over time. We're looking for ways to stop the accumulation and then drop the objects. The current plan is to replace some vats with versions that will do a better job of cleaning up, stranding the old objects. Eventually we'll terminate the vats (#8928), and free the remaining objects gradually. One remaining question is whether we already have a mechanism to terminating vats from the outside.

A contract can kill the vat it's in by calling zcf.shutdown() or zcf.shutdownWithFailure(), but there's no way to invoke that from outside.

Description of the Design

The vat's adminNode (= VatAdminFacet) has terminateWithFailure() as well as upgrade() and done(). We save these facets in the bootstrap space, so they're available to core proposals.

Security Considerations

closely held.

Scaling Considerations

It's about chain sustainabilty.

Test Plan

A3P, if necessary.

Upgrade Considerations

yes.