test(ocap-kernel): restore branch coverage to baseline after netlayer extraction

Extracting the well-covered netlayer machinery into @metamask/netlayer lowered
ocap-kernel's aggregate branch coverage (an arithmetic artifact). Add
behavior-asserting tests for specified guard/error paths to bring it back above
the pre-extraction baseline (85.91%):

- reconnectPeer handler: defaults omitted hints to []
- RemoteHandle: rejects invalid inbound message seq (non-number/non-integer/<1);
  rejects outbound sends once the pending queue is at capacity; gives up and
  fires onGiveUp after MAX_RETRIES unacknowledged retransmits; rejects pending +
  gives up on a terminal outbound send error; cleans up the pending redemption
  when the redeem send is rejected
- GC store: collectGarbage deletes an unreferenced promise

ocap-kernel branch coverage: 85.9% -> 86.3% (>= baseline on two consecutive
runs); statements/functions/lines also above baseline.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: rekmarks

packages/ocap-kernel/src/remotes/kernel/RemoteHandle.test.ts

@@ -584,6 +584,79 @@ describe('RemoteHandle', () => {
     );
   });
 
+  it.each([
+    { label: 'a non-number seq', seq: 'x' },
+    { label: 'a non-integer seq', seq: 1.5 },
+    { label: 'a zero seq', seq: 0 },
+    { label: 'a negative seq', seq: -3 },
+  ])('handleRemoteMessage rejects $label', async ({ seq }) => {
+    const remote = makeRemote();
+    const delivery = JSON.stringify({
+      seq,
+      method: 'deliver',
+      params: ['dropExports', ['ro+1']],
+    });
+    await expect(remote.handleRemoteMessage(delivery)).rejects.toThrow(
+      `invalid message seq: ${seq}`,
+    );
+    remote.cleanup();
+  });
+
+  it('rejects a new outbound message once the pending queue is at capacity', async () => {
+    const remote = makeRemote();
+    // Fill the pending queue to MAX_PENDING_MESSAGES (200). The mock transport
+    // resolves each send but never ACKs, so the queue never drains.
+    for (let index = 0; index < 200; index += 1) {
+      await remote.deliverDropExports(['ro+1']);
+    }
+    await expect(remote.deliverDropExports(['ro+1'])).rejects.toThrow(
+      'pending queue at capacity (200)',
+    );
+    remote.cleanup();
+  });
+
+  it('rejects pending and fires give-up when an outbound delivery hits a terminal send error', async () => {
+    const onGiveUp = vi.fn();
+    const remote = RemoteHandle.make({
+      remoteId: mockRemoteId,
+      peerId: mockRemotePeerId,
+      kernelStore: mockKernelStore,
+      kernelQueue: mockKernelQueue,
+      remoteComms: mockRemoteComms,
+      onGiveUp,
+    });
+    // isTerminalSendError matches by `error.name`; the real class is
+    // transport-internal.
+    const terminal = Object.assign(new Error('Remote peer restarted'), {
+      name: 'PeerRestartedError',
+    });
+    vi.mocked(mockRemoteComms.sendRemoteMessage).mockRejectedValueOnce(
+      terminal,
+    );
+
+    await remote.deliverNotify([['rp+1', false, { body: '"a"', slots: [] }]]);
+    // The send is fire-and-forget; drain microtasks so its catch handler runs.
+    for (let i = 0; i < 5; i += 1) {
+      await Promise.resolve();
+    }
+
+    expect(onGiveUp).toHaveBeenCalledWith(mockRemotePeerId);
+    remote.cleanup();
+  });
+
+  it('cleans up the pending redemption when the redeem send is rejected', async () => {
+    const remote = makeRemote();
+    // Fill the outbound queue so the redeemURL send itself is rejected at
+    // capacity, exercising redeemOcapURL's catch-path cleanup.
+    for (let index = 0; index < 200; index += 1) {
+      await remote.deliverDropExports(['ro+1']);
+    }
+    await expect(remote.redeemOcapURL('ocap:test@peer')).rejects.toThrow(
+      'pending queue at capacity (200)',
+    );
+    remote.cleanup();
+  });
+
   it('handleRemoteMessage handles redeemURL request', async () => {
     const remote = makeRemote();
     const mockOcapURL = 'as if it was a URL';
@@ -1673,6 +1746,40 @@ describe('RemoteHandle', () => {
       expect(mockRemoteComms.sendRemoteMessage).toHaveBeenCalledTimes(2);
       expect(onGiveUp).not.toHaveBeenCalled();
     });
+
+    it('gives up and fires onGiveUp after MAX_RETRIES unacknowledged retransmits', async () => {
+      const onGiveUp = vi.fn();
+      const remote = RemoteHandle.make({
+        remoteId: mockRemoteId,
+        peerId: mockRemotePeerId,
+        kernelStore: mockKernelStore,
+        kernelQueue: mockKernelQueue,
+        remoteComms: mockRemoteComms,
+        ackTimeoutMs: 100,
+        onGiveUp,
+      });
+
+      // One pending message that is never ACKed; sends resolve so each timeout
+      // retransmits rather than aborting.
+      vi.mocked(mockRemoteComms.sendRemoteMessage).mockResolvedValue(undefined);
+      await remote.deliverNotify([['rp+1', false, { body: '"a"', slots: [] }]]);
+
+      // MAX_RETRIES is 3: the first three timeouts retransmit; the fourth
+      // exhausts retries and gives up.
+      for (let attempt = 0; attempt < 4; attempt += 1) {
+        fireLastAckTimer();
+        for (let i = 0; i < 5; i += 1) {
+          await Promise.resolve();
+        }
+      }
+
+      expect(onGiveUp).toHaveBeenCalledWith(mockRemotePeerId);
+      expect(onGiveUp).toHaveBeenCalledTimes(1);
+      // Initial send + one per retry (MAX_RETRIES = 3) = 4; the give-up
+      // timeout does not retransmit again.
+      expect(mockRemoteComms.sendRemoteMessage).toHaveBeenCalledTimes(4);
+      remote.cleanup();
+    });
   });
 
   describe('first-send terminal errors', () => {

packages/ocap-kernel/src/rpc/platform-services/reconnectPeer.test.ts

@@ -177,6 +177,26 @@ describe('reconnectPeer', () => {
       expect(result).toBeNull();
     });
 
+    it('defaults hints to an empty array when the params omit them', async () => {
+      const mockReconnectPeer: ReconnectPeer = vi.fn(async () => null);
+
+      const hooks = {
+        reconnectPeer: mockReconnectPeer,
+      };
+
+      // The struct requires `hints`, but the handler defensively defaults a
+      // missing value to `[]`; exercise that guard directly.
+      const params = { peerId: 'peer-789' } as unknown as {
+        peerId: string;
+        hints: string[];
+      };
+
+      const result = await reconnectPeerHandler.implementation(hooks, params);
+
+      expect(mockReconnectPeer).toHaveBeenCalledWith('peer-789', []);
+      expect(result).toBeNull();
+    });
+
     it('calls the reconnectPeer hook with empty hints array', async () => {
       const mockReconnectPeer: ReconnectPeer = vi.fn(async () => null);
 

packages/ocap-kernel/src/store/methods/gc.test.ts

@@ -267,5 +267,18 @@ describe('GC methods', () => {
       // Object should still exist
       expect(kernelStore.getObjectRefCount(ko1)).toBeDefined();
     });
+
+    it('deletes an unreferenced promise', () => {
+      const [kpid] = kernelStore.initKernelPromise();
+      // initKernelPromise sets refCount to 1; dropping it to zero enqueues the
+      // promise for collection.
+      kernelStore.decrementRefCount(kpid, 'gc-test');
+
+      kernelStore.collectGarbage();
+
+      expect(() => kernelStore.getKernelPromise(kpid)).toThrow(
+        `unknown kernel promise ${kpid}`,
+      );
+    });
   });
 });