fix(ocap-kernel): regenerate incarnationId on resetStorage=true

The peer-restart detection added in #948 only works if the sender
signals a new incarnation after a state wipe. The previous except-list
in Kernel.#resetKernelState kept `incarnationId` alive across
`resetStorage=true`, so a kernel-worker rebooted with the same
incarnation as before — the receiver's persisted comparison decided
"no restart," `highestReceivedSeq` stayed put, and fresh `seq=1`
messages were dropped as duplicates.

The browser kernel-worker hits this path on every offscreen-page
reload (the URL carries `?reset-storage=true`), so every extension
reload that re-registered a service silently dropped its first
message. Dropping `incarnationId` from the except-list lets
`provideIncarnationId` regenerate it, which is what the doc comment
on that function already advertised.

Adds an e2e regression covering the resetStorage path specifically
(the existing #944 test goes through fresh-DB, which exercises a
different code branch and didn't catch the bug).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: FUDCo

packages/kernel-node-runtime/test/e2e/remote-comms.test.ts

@@ -1118,6 +1118,79 @@ describe.sequential('Remote Communications E2E', () => {
       },
       NETWORK_TIMEOUT * 3,
     );
+
+    it(
+      'detects restart when sender keeps DB but uses resetStorage=true',
+      async () => {
+        // Companion to the test above. The fresh-DB path naturally regenerates
+        // incarnationId (nothing in KV to read). The `resetStorage=true` path
+        // wipes the KV but used to be coded with an except-list that preserved
+        // incarnationId — so the sender came back signaling the same
+        // incarnation, the matcher's handshake said "no restart", and the
+        // sender's fresh seq=1 was dropped against persisted dedup state.
+        // The browser/extension hits this path on every kernel-worker boot
+        // (the offscreen page launches the worker with ?reset-storage=true),
+        // so without this regression a plugin reload silently loses messages.
+        const k2Mnemonic =
+          'legal winner thank year wave sausage worth useful legal winner thank yellow';
+        const opts = {
+          relays: testRelays,
+          reconnectionBaseDelayMs: 100,
+          reconnectionMaxDelayMs: 500,
+          handshakeTimeoutMs: 5_000,
+          writeTimeoutMs: 5_000,
+          ackTimeoutMs: 2_000,
+          maxRetryAttempts: 4,
+        };
+
+        await kernel1.initRemoteComms({ ...opts });
+        await kernel2.initRemoteComms({ ...opts, mnemonic: k2Mnemonic });
+        const aliceURL = await launchVatAndGetURL(
+          kernel1,
+          makeRemoteVatConfig('Alice'),
+        );
+        await launchVatAndGetURL(kernel2, makeRemoteVatConfig('Bob'));
+        const bobRef = getVatRootRef(kernel2, kernelStore2, 'Bob');
+
+        const phase1 = await sendRemoteMessage(
+          kernel2,
+          bobRef,
+          aliceURL,
+          'hello',
+          ['Bob-before-reset'],
+        );
+        expect(phase1).toContain('vat Alice got "hello" from Bob-before-reset');
+
+        // Same delay rationale as in the fresh-DB test above.
+        await delay(150);
+
+        // Restart only the sender, KEEPING its DB but passing
+        // resetStorage=true. This is the path the browser kernel-worker
+        // takes on every offscreen-page reload. Identity keys (keySeed,
+        // peerId, ocapURLKey) must survive so the peer id stays stable;
+        // incarnationId must NOT survive so the matcher's handshake can
+        // detect the wipe.
+        await stopWithTimeout(async () => kernel2.stop(), 3000, 'kernel2.stop');
+        // eslint-disable-next-line require-atomic-updates
+        kernel2 = await restartKernel(dbFilename2, true, testRelays, opts);
+        await launchVatAndGetURL(kernel2, makeRemoteVatConfig('Bob'));
+        // eslint-disable-next-line require-atomic-updates
+        kernelStore2 = makeKernelStore(
+          await makeSQLKernelDatabase({ dbFilename: dbFilename2 }),
+        );
+        const newBobRef = getVatRootRef(kernel2, kernelStore2, 'Bob');
+
+        const phase2 = await sendRemoteMessage(
+          kernel2,
+          newBobRef,
+          aliceURL,
+          'hello',
+          ['Bob-after-reset'],
+        );
+        expect(phase2).toContain('vat Alice got "hello" from Bob-after-reset');
+      },
+      NETWORK_TIMEOUT * 3,
+    );
   });
 
   describe('Promise Rejection on Remote Give-Up', () => {

packages/ocap-kernel/CHANGELOG.md

@@ -37,6 +37,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Persist the peer's last-observed incarnation and compare it on every successful handshake; on a detected restart, clear the peer's c-list contributions and reject the promises it was deciding before the new incarnation reuses any erefs
 - Accept liveslots-allocated durable, virtual, and faceted vrefs (e.g. `o+d10/1`, `o+v3/4:0`) in `isVRef` / `insistERef` / `EndpointMessageStruct` validation ([#949](https://github.com/MetaMask/ocap-kernel/pull/949))
   - Previously the regex only matched plain `[op][+-]N`, so any vat using `defineDurableKind` failed outgoing-send validation and persisted-slot reads
+- Regenerate `incarnationId` when `resetStorage=true` clears the rest of kernel state, completing the #948 peer-restart detection on browser/extension kernel reloads
+  - The previous except-list preserved `incarnationId` across `resetStorage` wipes, so a restarted sender signalled the same incarnation it had before the wipe and the matching receiver's handshake decided "no restart" — leaving stale `highestReceivedSeq` in place and silently dropping the sender's fresh `seq=1` messages
 
 ## [0.7.0]
 

packages/ocap-kernel/src/Kernel.ts

@@ -704,8 +704,18 @@ export class Kernel {
   /**
    * Reset the kernel state.
    *
+   * Identity keys (`keySeed`, `peerId`, `ocapURLKey`) are preserved so the
+   * kernel keeps the same network identity across the reset. The
+   * `incarnationId` is deliberately *not* preserved: its whole purpose is
+   * to signal to remote peers that local state has been wiped so they
+   * clear any seq-dedup / c-list bookkeeping for this peer. Preserving it
+   * across a state wipe defeats the peer-restart detection introduced in
+   * #948.
+   *
    * @param options - Options for the reset.
-   * @param options.resetIdentity - If true, also clears identity keys (keySeed, peerId, ocapURLKey, incarnationId).
+   * @param options.resetIdentity - If true, also clears identity keys
+   *   (keySeed, peerId, ocapURLKey). Used when recovering from a
+   *   mnemonic, which is regenerating identity from scratch.
    */
   #resetKernelState({
     resetIdentity = false,
@@ -714,9 +724,11 @@ export class Kernel {
       // Full reset including identity - used when recovering from mnemonic
       this.#kernelStore.reset();
     } else {
-      // Preserve identity keys so network address survives restart
+      // Preserve identity keys so network address survives restart.
+      // `incarnationId` is deliberately omitted: it must be regenerated
+      // so remote peers can detect the state loss via the handshake.
       this.#kernelStore.reset({
-        except: ['keySeed', 'peerId', 'ocapURLKey', 'incarnationId'],
+        except: ['keySeed', 'peerId', 'ocapURLKey'],
       });
     }
   }