fix(ocap-kernel): don't audit an importer entry the collector is retiring

`retireKernelObjects` deletes an object and queues a `retireImport` for each
importer in the same breath, so until that action is delivered an importer's
c-list entry names a kref the kernel has already dropped. The audit counted
those entries as holders and reported a violation against the collector's own
output — and since `assertRefCountsIfAuditing` throws from inside the crank,
that killed the run loop for good.

Reachable from an ordinary `terminateVat` while a surviving vat holds the
dying vat's export in liveslots' dropped-but-recognizable state. No current
test produced it; found by Cursor Bugbot on #1020 and reproduced against the
real store.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: sirtimid

packages/ocap-kernel/src/store/methods/clist-accounting.test.ts

@@ -216,6 +216,26 @@ describe('c-list reference accounting', () => {
       expect(kernelStore.auditRefCounts()).toStrictEqual([]);
     });
 
+    it('tolerates an importer entry that outlives the object it names', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v3', kref, true);
+      // v3 has let go of the object but can still recognize the name
+      kernelStore.clearReachableFlag('v3', kref);
+      kernelStore.markVatAsTerminated('v1');
+      kernelStore.cleanupTerminatedVat('v1');
+
+      kernelStore.collectGarbage();
+
+      // The collector deletes the object and queues the retirement together, so
+      // v3's entry names a kref the kernel has already dropped until that action
+      // is delivered. Counting it as a holder fails the end-of-crank audit on a
+      // state the collector itself just created, which kills the run loop.
+      expect([...kernelStore.getGCActions()]).toStrictEqual([
+        `v3 retireImport ${kref}`,
+      ]);
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
     it('leaves a live vat that shares the object untouched', () => {
       const kref = kernelStore.exportFromEndpoint('v2', 'o+1');
       kernelStore.translateRefKtoE('v1', kref, true);

packages/ocap-kernel/src/store/methods/refcount-audit.ts

@@ -98,6 +98,15 @@ export function getRefCountAuditMethods(ctx: StoreContext) {
    */
   function computeExpectedRefCounts(): Map<KRef, Tally> {
     const tallies = new Map<KRef, Tally>();
+    // `retireKernelObjects` deletes an object and queues a `retireImport` for
+    // each importer in the same breath, so between then and the delivery an
+    // importer's c-list entry legitimately names a kref the kernel has already
+    // dropped. Those entries are scheduled for teardown and are not holders.
+    const retiring = new Set(
+      (JSON.parse(ctx.gcActions.get() ?? '[]') as string[]).filter((action) =>
+        action.includes(' retireImport '),
+      ),
+    );
 
     const credit = (
       kref: KRef,
@@ -152,7 +161,10 @@ export function getRefCountAuditMethods(ctx: StoreContext) {
         if (isPromiseRef(kref)) {
           // Both directions count for a promise.
           credit(kref, holder);
-        } else if (direction === 'import') {
+        } else if (
+          direction === 'import' &&
+          !retiring.has(`${endpointId} retireImport ${kref}`)
+        ) {
           // An object export is the owner's own entry and carries no count;
           // an object import always recognizes and, while flagged, reaches.
           credit(kref, holder, { onlyRecognizable: !isReachable });