Implement embargoes.

c++/src/capnp/capability.c++

@@ -203,7 +203,9 @@ public:
         selfResolutionOp(loop.there(this->promise.addBranch(),
             [this](kj::Own<const ClientHook>&& inner) {
               *redirect.lockExclusive() = kj::mv(inner);
-            })) {}
+            })) {
+    selfResolutionOp.eagerlyEvaluate(loop);
+  }
 
   Request<ObjectPointer, ObjectPointer> newCall(
       uint64_t interfaceId, uint16_t methodId, uint firstSegmentWordSize) const override {
@@ -449,4 +451,9 @@ kj::Own<const ClientHook> Capability::Client::makeLocalClient(
   return kj::refcounted<LocalClient>(eventLoop, kj::mv(server));
 }
 
+kj::Own<ClientHook> newLocalPromiseClient(kj::Promise<kj::Own<const ClientHook>>&& promise,
+                                          const kj::EventLoop& loop) {
+  return kj::refcounted<QueuedClient>(loop, kj::mv(promise));
+}
+
 }  // namespace capnp

c++/src/capnp/capability.h

@@ -353,6 +353,12 @@ public:
   virtual kj::Own<CallContextHook> addRef() = 0;
 };
 
+kj::Own<ClientHook> newLocalPromiseClient(kj::Promise<kj::Own<const ClientHook>>&& promise,
+                                          const kj::EventLoop& loop = kj::EventLoop::current());
+// Returns a ClientHook that queues up calls until `promise` resolves, then forwards them to
+// the new client.  This hook's `getResolved()` and `whenMoreResolved()` methods will reflect the
+// redirection to the eventual replacement client.
+
 // =======================================================================================
 // Extend PointerHelpers for interfaces
 

c++/src/capnp/rpc.capnp

@@ -441,6 +441,15 @@ struct Resolve {
   union {
     cap @1 :CapDescriptor;
     # The object to which the promise resolved.
+    #
+    # The sender promises that from this point forth, until `promiseId` is released, it shall
+    # simply forward all messages to the capability designated by `cap`.  This is true even if
+    # `cap` itself happens to desigate another promise, and that other promise later resolves --
+    # messages sent to `promiseId` shall still go to that other promise, not to its resolution.
+    # This is important in the case that the receiver of the `Resolve` ends up sending a
+    # `Disembargo` message towards `promiseId` in order to control message ordering -- that
+    # `Disembargo` really needs to reflect back to exactly the object designated by `cap` even
+    # if that object is itself a promise.
 
     exception @2 :Exception;
     # Indicates that the promise was broken.