fix(e2e): fail loudly on image-load errors; verify imports; move changelog entry

Review follow-ups:

- Drop '|| true' at every CI-active kind_load_image call site
  (upgrade-chain.sh, framework.sh x3) — under set -euo pipefail a failed load
  now aborts the run instead of resurrecting the silent-failure path this PR
  exists to kill.
- Convert the release-image load in test_upgrade_comprehensive.sh off raw
  'kind load docker-image'; no raw kind-load calls remain in e2e/.
- kind_load_image: capture and surface ctr's stderr on failure, and verify
  the image is actually present in containerd after import (a truncated
  stream can 'succeed' without importing what we think it did).
- Move the changelog entry from Improvements to Bug Fixes, matching #319.

Re-validated: full hardfork upgrade e2e 5/5 with the presence check live on
all three image loads.

Signed-off-by: puneetmahajan <59960662+puneet2019@users.noreply.github.com>

Author: puneet2019

CHANGELOG.md

@@ -64,6 +64,7 @@ Ref: https://keepachangelog.com/en/1.0.0/
 - (types,utils) [#320](https://github.com/mocachain/moca/pull/320) Delete dead ethermint-era files orphaned by the `rpc/`/`x/evm`/`x/erc20` removals: `types/{block,gasmeter,int,protocol,validation,constant}.go`, `types/openapiutil/`, and `utils/eth/eth.go` — every exported symbol verified unreferenced across the repo and all known external consumers (moca-storage-provider, moca-go-sdk, moca-challenger). Externally-used files (`chain_id.go` — `ParseChainID` is production code in the storage provider's signer — `grn.go`, `s3util`, `resource`, `common`) are untouched.
 - (client) [#321](https://github.com/mocachain/moca/pull/321) Delete the dead `client/testnet.go` (579 LOC): an unreferenced near-duplicate of `cmd/mocad/cmd/testnet.go`, which is what the `mocad testnet` command actually wires.
 - (e2e) [#324](https://github.com/mocachain/moca/pull/324) Fix the hardfork-upgrade e2e flake ("Chain did not reach height N within 240s"): the new-binary image load into kind could fail silently (`kind load ... || true`) and readiness accepted a single healthy pod as "chain resumed" while 2/3 quorum was still absent. Load images via `docker save | ctr import` with verification (`kind_load_image`), and gate post-restart on every validator's own RPC plus the EVM JSON-RPC (`wait_for_all_validator_rpcs`, `wait_for_evm_rpc_ready`); also delete stale kind clusters on fresh builds so containerd can't serve an old image SHA under the new tag.
+
 - (contracts) [#314](https://github.com/mocachain/moca/pull/314) Slim `contracts/` to what moca actually uses (mirroring cosmos/evm's top-level `contracts/` convention): delete the four ERC20 test doubles (`MinterBurnerDecimals`, `Burnable`, `DirectBalanceManipulation`, `MaliciousDelayed`) — dead since the `x/erc20` removal (#221), available upstream where still needed — plus their `.sol` sources, artifacts, and npm manifest. The moca-specific `ERC721NonTransferable` (bucket/object/group NFT facade the storage keeper mints/burns through) stays put, now pinned by a guard test covering its ABI surface, fixed token/hub addresses, and its intentionally bytecode-less (ABI-only) nature. Slither retargets to `solidity/`; the now-subjectless solhint workflow and broken `lint-contracts` Make targets are removed.
 
 ### State Machine Breaking

e2e/kind/framework/framework.sh

@@ -134,7 +134,7 @@ fw_start_chain() {
         fi
     else
         log_info "FW_SKIP_BUILD=true, loading pre-built images into Kind..."
-        kind_load_image "${DOCKER_IMAGE}:${DOCKER_TAG}" || true
+        kind_load_image "${DOCKER_IMAGE}:${DOCKER_TAG}"
     fi
 
     # Deploy chain
@@ -162,8 +162,8 @@ fw_start_chain_from_version() {
         OLD_VERSION="${old_version}" bash "${SCRIPTS_DIR}/build-images.sh"
     else
         log_info "FW_SKIP_BUILD=true, loading pre-built images into Kind..."
-        kind_load_image "${DOCKER_IMAGE}:${DOCKER_TAG}" || true
-        kind_load_image "${DOCKER_IMAGE}:${old_version}" || true
+        kind_load_image "${DOCKER_IMAGE}:${DOCKER_TAG}"
+        kind_load_image "${DOCKER_IMAGE}:${old_version}"
     fi
 
     # Deploy with old version

e2e/kind/scripts/lib.sh

@@ -123,11 +123,18 @@ kind_load_image() {
         log_error "Kind control-plane container '$node' not running"
         return 1
     fi
-    docker save "$image" | docker exec -i "$node" \
-        ctr --namespace=k8s.io images import - >/dev/null 2>&1 || {
-        log_error "Failed to load image $image into Kind"
+    local import_out
+    if ! import_out=$(docker save "$image" | docker exec -i "$node" \
+        ctr --namespace=k8s.io images import - 2>&1); then
+        log_error "Failed to load image $image into Kind: ${import_out}"
         return 1
-    }
+    fi
+    # Verify the image is actually present in containerd — a truncated stream
+    # can "succeed" without importing what we think it did.
+    if ! docker exec "$node" ctr --namespace=k8s.io images ls -q 2>/dev/null | grep -qF "${image}"; then
+        log_error "Image $image not present in Kind containerd after import (got: ${import_out})"
+        return 1
+    fi
     log_success "Image $image loaded into Kind cluster"
 }
 

e2e/kind/scripts/upgrade-chain.sh

@@ -38,15 +38,15 @@ _upgrade_governance() {
         mocad query auth module-account gov \
         --node tcp://localhost:26657 \
         --home /root/.mocad \
-        --output json 2>/dev/null | jq -r '.account.base_account.address // .account.value.address // empty' 2>/dev/null) || true
+        --output json 2>/dev/null | jq -r '.account.base_account.address // .account.value.address // empty' 2>/dev/null)
 
     if [ -z "$gov_authority" ]; then
         log_warn "Could not query gov module address, trying alternative..."
         gov_authority=$(kubectl exec -n "${K8S_NAMESPACE}" validator-0-0 -c mocad -- \
             mocad query auth module-accounts \
             --node tcp://localhost:26657 \
             --home /root/.mocad \
-            --output json 2>/dev/null | jq -r '.accounts[] | select(.name=="gov") | .base_account.address // .value.address // empty' 2>/dev/null) || true
+            --output json 2>/dev/null | jq -r '.accounts[] | select(.name=="gov") | .base_account.address // .value.address // empty' 2>/dev/null)
     fi
 
     if [ -z "$gov_authority" ]; then
@@ -80,7 +80,7 @@ PROPOSAL_EOF
 
     # Write proposal file into the pod
     echo "$proposal_json" | kubectl exec -i -n "${K8S_NAMESPACE}" validator-0-0 -c mocad -- \
-        bash -c "cat > /tmp/upgrade-proposal.json" || true
+        bash -c "cat > /tmp/upgrade-proposal.json"
 
     # Submit proposal via sync broadcast + wait for inclusion
     local submit_out="" submit_hash=""
@@ -110,9 +110,9 @@ PROPOSAL_EOF
         --node tcp://localhost:26657 \
         --chain-id "${CHAIN_ID}" \
         --home /root/.mocad \
-        --output json 2>&1) || true
+        --output json 2>&1)
 
-    proposal_id=$(echo "$query_out" | jq -r '.proposals[-1].id // .proposals[-1].proposal_id // empty' 2>/dev/null) || true
+    proposal_id=$(echo "$query_out" | jq -r '.proposals[-1].id // .proposals[-1].proposal_id // empty' 2>/dev/null)
 
     if [ -z "$proposal_id" ]; then
         log_error "Could not find upgrade proposal"
@@ -206,9 +206,9 @@ _wait_for_upgrade_halt() {
     # Chain halts but doesn't exit — scale down, replace binary, scale back up
     log_info "Scaling down validators..."
     for ((i = 0; i < NUM_VALIDATORS; i++)); do
-        kubectl scale statefulset "validator-${i}" --replicas=0 -n "${K8S_NAMESPACE}" 2>/dev/null || true
+        kubectl scale statefulset "validator-${i}" --replicas=0 -n "${K8S_NAMESPACE}" 2>/dev/null
     done
-    kubectl wait --for=delete pod -l app=validator -n "${K8S_NAMESPACE}" --timeout=60s 2>/dev/null || true
+    kubectl wait --for=delete pod -l app=validator -n "${K8S_NAMESPACE}" --timeout=60s 2>/dev/null
     log_info "All validators stopped"
 
     # Update all validator StatefulSets to use the new image, then scale back up
@@ -220,7 +220,7 @@ _update_validator_images() {
 
     # Load new image into Kind if not already loaded (docker save | ctr import
     # — see kind_load_image in lib.sh; avoids buildx desktop-linux quirks)
-    kind_load_image "${NEW_DOCKER_IMAGE}" || true
+    kind_load_image "${NEW_DOCKER_IMAGE}"
 
     # Patch each validator StatefulSet with the new image
     for ((i = 0; i < NUM_VALIDATORS; i++)); do
@@ -236,7 +236,7 @@ _update_validator_images() {
     # Scale validators back up with new image
     log_info "Starting validators with new image..."
     for ((i = 0; i < NUM_VALIDATORS; i++)); do
-        kubectl scale statefulset "validator-${i}" --replicas=1 -n "${K8S_NAMESPACE}" 2>/dev/null || true
+        kubectl scale statefulset "validator-${i}" --replicas=1 -n "${K8S_NAMESPACE}" 2>/dev/null
     done
 
     # Wait for all validators to come back up
@@ -246,7 +246,7 @@ _update_validator_images() {
         kubectl wait --for=condition=ready "pod/validator-${i}-0" \
             -n "${K8S_NAMESPACE}" --timeout=180s 2>/dev/null || {
             log_error "Validator-${i} failed to restart"
-            kubectl logs -n "${K8S_NAMESPACE}" "validator-${i}-0" --tail=50 2>/dev/null || true
+            kubectl logs -n "${K8S_NAMESPACE}" "validator-${i}-0" --tail=50 2>/dev/null
             return 1
         }
     done

e2e/kind/tests/test_upgrade_comprehensive.sh

@@ -191,7 +191,7 @@ if [ -n "$RELEASE_TAG" ] && [ -z "$RELEASE_IMAGE" ]; then
     log_info "Pulling release image: ${_GHCR_IMAGE}..."
     docker pull "$_GHCR_IMAGE" 2>&1
     echo "FROM ${_GHCR_IMAGE}" | docker build -t "$RELEASE_IMAGE" - 2>&1
-    kind load docker-image "$RELEASE_IMAGE" --name "${KIND_CLUSTER_NAME}" 2>&1
+    kind_load_image "$RELEASE_IMAGE"
 fi
 
 # Get validator operator addresses indexed by validator-N pod number.