diff --git a/packages/extension/test/e2e/control-panel.test.ts b/packages/extension/test/e2e/control-panel.test.ts
index eaa19ed27e..c2f5ca66c4 100644
--- a/packages/extension/test/e2e/control-panel.test.ts
+++ b/packages/extension/test/e2e/control-panel.test.ts
@@ -165,7 +165,6 @@ test.describe('Control Panel', () => {
       '{"key":"v3.c.o+0","value":"ko6"}',
       '{"key":"v3.c.kp4","value":"R p-1"}',
       '{"key":"v3.c.p-1","value":"kp4"}',
-      '{"key":"ko6.refCount","value":"1,1"}',
       '{"key":"kp4.refCount","value":"2"}',
     ];
     const v1koValues = [
diff --git a/packages/kernel-test/src/garbage-collection.test.ts b/packages/kernel-test/src/garbage-collection.test.ts
index 268ed7920e..84b120947b 100644
--- a/packages/kernel-test/src/garbage-collection.test.ts
+++ b/packages/kernel-test/src/garbage-collection.test.ts
@@ -21,9 +21,11 @@ import {
 /**
  * Make a test subcluster with vats for GC testing
  *
+ * @param extraImporters - Names of additional importer vats to include, for
+ * topologies where more than one vat shares the same exported object.
  * @returns The test subcluster
  */
-function makeTestSubcluster(): ClusterConfig {
+function makeTestSubcluster(extraImporters: string[] = []): ClusterConfig {
   return {
     bootstrap: 'exporter',
     forceReset: true,
@@ -40,6 +42,15 @@ function makeTestSubcluster(): ClusterConfig {
           name: 'Importer',
         },
       },
+      ...Object.fromEntries(
+        extraImporters.map((name) => [
+          name,
+          {
+            bundleSpec: getBundleSpec('importer-vat'),
+            parameters: { name },
+          },
+        ]),
+      ),
     },
   };
 }
@@ -81,10 +92,11 @@ describe('Garbage Collection', () => {
       [objectId],
     );
     const createObjectRef = createObjectData.slots[0] as KRef;
-    // Verify initial reference counts from database
-    const initialRefCounts = kernelStore.getObjectRefCount(createObjectRef);
-    expect(initialRefCounts.reachable).toBe(2);
-    expect(initialRefCounts.recognizable).toBe(2);
+    // Held only by the resolved promise's value, which still carries the slot
+    expect(kernelStore.getObjectRefCount(createObjectRef)).toStrictEqual({
+      reachable: 1,
+      recognizable: 1,
+    });
     // Send the object to the importer vat
     const objectRef = kunser(createObjectData);
     await kernel.queueMessage(importerKRef, 'storeImport', [objectRef]);
@@ -116,10 +128,10 @@ describe('Garbage Collection', () => {
     await waitUntilQuiescent();
     const createObjectRef = createObjectData.slots[0] as KRef;
 
-    // Store initial reference count information
-    const initialRefCounts = kernelStore.getObjectRefCount(createObjectRef);
-    expect(initialRefCounts.reachable).toBe(2);
-    expect(initialRefCounts.recognizable).toBe(2);
+    expect(kernelStore.getObjectRefCount(createObjectRef)).toStrictEqual({
+      reachable: 1,
+      recognizable: 1,
+    });
 
     // Store the reference in the importer vat
     const objectRef = kunser(createObjectData);
@@ -201,4 +213,129 @@ describe('Garbage Collection', () => {
     );
     expect(parseReplyBody(exporterFinalCheck.body)).toBe(false);
   }, 40000);
+
+  describe('an object shared by two importers', () => {
+    let secondImporterKRef: KRef;
+    let secondImporterVatId: VatId;
+
+    beforeEach(async () => {
+      kernelDatabase = await makeSQLKernelDatabase({ dbFilename: ':memory:' });
+      kernelStore = makeKernelStore(kernelDatabase);
+      kernel = await makeKernel(kernelDatabase, true, makeMockLogger());
+      await runTestVats(kernel, makeTestSubcluster(['Importer2']));
+
+      const vats = kernel.getVats();
+      const idOf = (name: string): VatId =>
+        vats.find((row) => row.config.parameters?.name === name)?.id as VatId;
+      exporterVatId = idOf('Exporter');
+      importerVatId = idOf('Importer');
+      secondImporterVatId = idOf('Importer2');
+      exporterKRef = kernelStore.getRootObject(exporterVatId) as KRef;
+      importerKRef = kernelStore.getRootObject(importerVatId) as KRef;
+      secondImporterKRef = kernelStore.getRootObject(
+        secondImporterVatId,
+      ) as KRef;
+    });
+
+    /**
+     * Give an importer a chance to notice a dropped object and tell the kernel,
+     * then keep cranking until the resulting GC actions have all been consumed.
+     *
+     * @param vatId - The vat to reap.
+     * @param rootKRef - That vat's root, to poke with cranks afterwards.
+     */
+    async function reapAndSettle(vatId: VatId, rootKRef: KRef): Promise<void> {
+      kernel.reapVats((id) => id === vatId);
+      // BOYD has to reach the vat, the vat has to answer, and the kernel has to
+      // act on the answer — but a round can queue more work, so loop until the
+      // queue is actually empty rather than guessing at a crank count.
+      const maxRounds = 10;
+      for (let round = 0; round < maxRounds; round++) {
+        await kernel.queueMessage(rootKRef, 'noop', []);
+        await waitUntilQuiescent(500);
+        if ([...kernelStore.getGCActions()].length === 0) {
+          return;
+        }
+      }
+      throw Error(
+        `GC actions still pending after ${maxRounds} rounds: ${[
+          ...kernelStore.getGCActions(),
+        ].join(', ')}`,
+      );
+    }
+
+    it('survives until both importers let go', async () => {
+      const objectId = 'shared-object';
+      const createObjectData = await kernel.queueMessage(
+        exporterKRef,
+        'createObject',
+        [objectId],
+      );
+      const sharedKRef = createObjectData.slots[0] as KRef;
+      const objectRef = kunser(createObjectData);
+
+      for (const importer of [importerKRef, secondImporterKRef]) {
+        await kernel.queueMessage(importer, 'storeImport', [
+          objectRef,
+          objectId,
+        ]);
+      }
+      await waitUntilQuiescent();
+
+      expect(kernelStore.getImporters(sharedKRef)).toStrictEqual(
+        [importerVatId, secondImporterVatId].sort(),
+      );
+      // Two importers, plus the resolved createObject promise whose value
+      // still carries the slot
+      expect(kernelStore.getObjectRefCount(sharedKRef)).toStrictEqual({
+        reachable: 3,
+        recognizable: 3,
+      });
+
+      await kernel.queueMessage(importerKRef, 'makeWeak', [objectId]);
+      await kernel.queueMessage(importerKRef, 'forgetImport', []);
+      await waitUntilQuiescent();
+      await reapAndSettle(importerVatId, importerKRef);
+
+      // The exporter must not have been told to drop it: the second importer
+      // legitimately still holds it
+      expect(kernelStore.getReachableFlag(exporterVatId, sharedKRef)).toBe(
+        true,
+      );
+      expect(kernelStore.getImporters(sharedKRef)).toStrictEqual([
+        secondImporterVatId,
+      ]);
+      expect(
+        parseReplyBody(
+          (
+            await kernel.queueMessage(exporterKRef, 'isObjectPresent', [
+              objectId,
+            ])
+          ).body,
+        ),
+      ).toBe(true);
+
+      expect(
+        parseReplyBody(
+          (
+            await kernel.queueMessage(secondImporterKRef, 'useImport', [
+              objectId,
+            ])
+          ).body,
+        ),
+      ).toBe(objectId);
+
+      await kernel.queueMessage(secondImporterKRef, 'makeWeak', [objectId]);
+      await kernel.queueMessage(secondImporterKRef, 'forgetImport', []);
+      await waitUntilQuiescent();
+      await reapAndSettle(secondImporterVatId, secondImporterKRef);
+
+      expect(kernelStore.getImporters(sharedKRef)).toStrictEqual([]);
+      // Only the createObject result's stored value still names it
+      expect(kernelStore.getObjectRefCount(sharedKRef)).toStrictEqual({
+        reachable: 1,
+        recognizable: 1,
+      });
+    }, 60000);
+  });
 });
diff --git a/packages/kernel-test/src/persistence.test.ts b/packages/kernel-test/src/persistence.test.ts
index c4dd6ec814..0a97a58fff 100644
--- a/packages/kernel-test/src/persistence.test.ts
+++ b/packages/kernel-test/src/persistence.test.ts
@@ -170,7 +170,8 @@ describe('persistent storage', { timeout: 20_000 }, () => {
     // Enqueue a send message into the database
     kv1.set('queue.run.head', '4');
     kv1.set('nextPromiseId', '4');
-    kv1.set(`${v1Root}.refCount`, '3,3');
+    // The root's pin, plus the send being injected below.
+    kv1.set(`${v1Root}.refCount`, '2,2');
     kv1.set('queue.kp3.head', '1');
     kv1.set('queue.kp3.tail', '1');
     kv1.set('kp3.state', 'unresolved');
diff --git a/packages/kernel-test/src/refcount-audit.test.ts b/packages/kernel-test/src/refcount-audit.test.ts
new file mode 100644
index 0000000000..509bb6b9b3
--- /dev/null
+++ b/packages/kernel-test/src/refcount-audit.test.ts
@@ -0,0 +1,55 @@
+import { makeSQLKernelDatabase } from '@metamask/kernel-store/sqlite/nodejs';
+import { makeKernelStore } from '@metamask/ocap-kernel';
+import type { KRef, VatId } from '@metamask/ocap-kernel';
+import { expect, describe, it } from 'vitest';
+
+import {
+  getBundleSpec,
+  makeKernel,
+  makeMockLogger,
+  runTestVats,
+} from './utils.ts';
+
+/**
+ * The per-crank audit throws from inside the run loop, which nothing restarts.
+ * Unless that failure is reported to whoever is waiting on the kernel, the only
+ * symptom is a test that hangs until its timeout, with no mention of reference
+ * counts anywhere — which would make the audit worthless as a build gate.
+ */
+describe('reference count audit', () => {
+  it('reports a violation to kernel callers rather than hanging', async () => {
+    const kernelDatabase = await makeSQLKernelDatabase({
+      dbFilename: ':memory:',
+    });
+    const kernelStore = makeKernelStore(kernelDatabase);
+    const kernel = await makeKernel(kernelDatabase, true, makeMockLogger());
+    await runTestVats(kernel, {
+      bootstrap: 'exporter',
+      forceReset: true,
+      vats: {
+        exporter: {
+          bundleSpec: getBundleSpec('exporter-vat'),
+          parameters: { name: 'Exporter' },
+        },
+      },
+    });
+
+    const exporterVatId = kernel.getVats()[0]?.id as VatId;
+    const exporterKRef = kernelStore.getRootObject(exporterVatId) as KRef;
+
+    kernelStore.setObjectRefCount(exporterKRef, {
+      reachable: 7,
+      recognizable: 9,
+    });
+
+    // The crank carrying this message settles its result before the
+    // end-of-crank audit runs, so this one may still succeed.
+    await kernel
+      .queueMessage(exporterKRef, 'createObject', ['x'])
+      .catch(() => undefined);
+
+    await expect(
+      kernel.queueMessage(exporterKRef, 'createObject', ['y']),
+    ).rejects.toThrow(/reference count invariant violated/u);
+  }, 30000);
+});
diff --git a/packages/kernel-test/src/utils.ts b/packages/kernel-test/src/utils.ts
index c255347b89..7d867f2c28 100644
--- a/packages/kernel-test/src/utils.ts
+++ b/packages/kernel-test/src/utils.ts
@@ -93,6 +93,9 @@ export async function makeKernel(
     resetStorage,
     logger,
     keySeed,
+    // Refcount drift is invisible to ordinary assertions until something gets
+    // collected out from under a live holder, so check it every crank.
+    auditRefCounts: true,
   });
   return kernel;
 }
diff --git a/packages/ocap-kernel/CHANGELOG.md b/packages/ocap-kernel/CHANGELOG.md
index ed8da249c2..6c48e4ee0d 100644
--- a/packages/ocap-kernel/CHANGELOG.md
+++ b/packages/ocap-kernel/CHANGELOG.md
@@ -23,10 +23,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Log a warning when a vat requests an unknown global
 - Export `OcapURLIssuerService` and `OcapURLRedemptionService` types so vats can type the corresponding kernel-service endowments ([#952](https://github.com/MetaMask/ocap-kernel/pull/952))
 - Reference-marker sigil (`@@NAME`) at the `queueMessage` RPC boundary lets JSON-RPC callers name a live kernel object as a call argument ([#984](https://github.com/MetaMask/ocap-kernel/pull/984))
+
   - Anywhere in the args tree, a string of the form `@@NAME` (NAME is one or more alphanumeric characters, currently a well-formed kref) is expanded to a `kslot` standin so `kser` encodes it as a real CapData slot in the dispatched message
   - Purely an RPC-boundary concern: internal callers of `Kernel.queueMessage` are unaffected
   - Caveat: a legitimate string argument that begins with `@@` followed by alphanumerics will be misinterpreted as a marker; wrap such literals inside an object
 
+- Reference-count auditing: `auditRefCounts`, `recomputeRefCounts`, `formatRefCountViolations`, `assertRefCountsIfAuditing`, and `setRefCountAuditing` on the kernel store, plus a `Kernel.make` option `auditRefCounts` that verifies every kref's counts against the references the kernel actually holds at the end of each crank ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+  - Reports drift in both directions: counts too low (a live capability can be collected) and counts too high with no holder (a leak)
+  - Exports the `RefCountViolation` type, a union over `kind: 'mismatch' | 'dangling'`
+- Add `setReachableFlag` to the kernel store, the counterpart to `clearReachableFlag` ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+- Add `orphanKernelObject` to the kernel store, which drops an object's owner mapping and hands it to the collector ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+
 ### Changed
 
 - Attribute a failed subcluster vat launch to the specific vat by kernel id and `ClusterConfig` name (e.g. `Failed to launch vat v3 (bob)`), preserving the original error as the `cause` ([#975](https://github.com/MetaMask/ocap-kernel/pull/975))
@@ -38,6 +45,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **BREAKING:** Make c-list reference accounting symmetric: creating an import c-list entry now takes a reference, as tearing one down has always released one ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+  - `initKernelObject` now births objects at `(0, 0)` instead of `(1, 1)`. The old constant made the arithmetic come out right for exactly one importer, masking the missing increment; with two importers a live capability could be dropped and retired out from under a holder
+  - Removes the owner-side baseline decrements in `cleanupTerminatedVat` and `forgetEndpointImports`, which double-claimed the same unit an importer's drop also spent — the source of `"koNN" underflow -1,0` escaping mid-cleanup and leaving a vat half-cleaned
+  - `translateRefKtoE` now re-establishes reachability, so a vat handed an object it previously dropped is counted as holding it live again
+  - Renames `krefsToExistingErefs` to `krefsToErefs`, which now throws on an unmapped kref instead of silently dropping it
+- Pin vat root objects for the lifetime of their vat, and release the pin on termination ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+  - A root is addressable while its vat lives whether or not anyone imports it; the old `(1, 1)` birth baseline was standing in for this
+- Garbage-collection action delivery now moves the kernel's own c-list: `dropExports` clears the owner's reachable flag and `retireExports`/`retireImports` tear the entry down ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+  - Previously the owner's flag never cleared, so the same action could be re-derived, and retired entries outlived the objects they named
+- Orphan a kernel object when its owner stops naming it (a delivered `retireExport`, or a `retireExports`/`abandonExports` syscall), so its `owner` and `refCount` records no longer outlive the c-list entry they were reachable through — they leaked, and the next collection to visit such a kref killed the run loop ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+- `queueMessage` now rejects with the error that stopped the run loop, and messages the kernel itself is awaiting are rejected rather than left pending forever ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+- Reject a `retireExports`/`abandonExports` syscall for an object the calling endpoint does not own, instead of letting it erase another endpoint's claim to an object it is still exporting ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+- Garbage-collection action delivery releases the kernel's side even when the endpoint has vanished, and rolls back rather than committing a release the endpoint was never told about ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+- Tear down and mark for cleanup a vat whose worker launched but whose kernel-side registration then failed ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+- Charge a delivered message's target reference against the run-queue item's own target rather than the routed target, so a message routed through a resolved promise no longer decrements an object nobody charged while leaking the promise ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+- Release a queued notification's reference before the paths that decide there is nothing to deliver, and stop decrementing references on promises retired alongside it that nobody had taken ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+- Transfer, rather than duplicate, the references a message carries when it is queued on an unresolved promise and later re-enqueued on resolution ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+- Fix the stale `cle.`/`clk.` key prefixes in `getPromisesByDecider` and `deleteEndpoint`, which no longer matched the `${endpointId}.c.` c-list layout ([#1010](https://github.com/MetaMask/ocap-kernel/pull/1010))
+
+  - `getPromisesByDecider` matched nothing, so promises a terminating vat or restarting peer was deciding were never rejected
+
 - Deserialize CapData rejections in `Kernel.queueMessage` so vat errors surface as plain `Error` objects to all callers ([#928](https://github.com/MetaMask/ocap-kernel/pull/928))
 - Detect peer restart across receiver state loss so the receiving kernel no longer silently drops a restarted peer's `seq=1` messages ([#948](https://github.com/MetaMask/ocap-kernel/pull/948))
   - Persist the peer's last-observed incarnation and compare it on every successful handshake; on a detected restart, clear the peer's c-list contributions and reject the promises it was deciding before the new incarnation reuses any erefs
diff --git a/packages/ocap-kernel/src/Kernel.ts b/packages/ocap-kernel/src/Kernel.ts
index 6cff649624..762f2dfbac 100644
--- a/packages/ocap-kernel/src/Kernel.ts
+++ b/packages/ocap-kernel/src/Kernel.ts
@@ -84,6 +84,13 @@ export class Kernel {
   /** The kernel's run queue */
   readonly #kernelQueue: KernelQueue;
 
+  /**
+   * Why the run loop stopped, if it has. Nothing restarts it, so this is
+   * terminal: it turns what would otherwise be an indefinite wait for a
+   * message that can never be delivered into an error naming the cause.
+   */
+  #runLoopFailure: Error | undefined;
+
   /** The kernel's router */
   readonly #kernelRouter: KernelRouter;
 
@@ -105,6 +112,10 @@ export class Kernel {
    * @param options.mnemonic - Optional BIP39 mnemonic for deriving the kernel identity.
    * @param options.ioChannelFactory - Optional factory for creating IO channels.
    * @param options.allowedGlobalNames - Optional list of allowed global names for vat endowments.
+   * @param options.auditRefCounts - If true, verify every kref's reference
+   * counts against the references the kernel actually holds at the end of each
+   * crank, and throw on any mismatch. Intended for tests and debugging; the
+   * audit walks the whole store.
    */
   // eslint-disable-next-line no-restricted-syntax
   private constructor(
@@ -117,12 +128,16 @@ export class Kernel {
       mnemonic?: string | undefined;
       ioChannelFactory?: IOChannelFactory;
       allowedGlobalNames?: AllowedGlobalName[];
+      auditRefCounts?: boolean;
     } = {},
   ) {
     this.#platformServices = platformServices;
     this.#kernelDatabase = kernelDatabase;
     this.#logger = options.logger ?? new Logger('ocap-kernel');
     this.#kernelStore = makeKernelStore(kernelDatabase, this.#logger);
+    if (options.auditRefCounts) {
+      this.#kernelStore.setRefCountAuditing(true);
+    }
     if (!this.#kernelStore.isInitialized()) {
       this.#kernelStore.markInitialized();
     }
@@ -234,6 +249,8 @@ export class Kernel {
    * @param options.ioChannelFactory - Optional factory for creating IO channels.
    * @param options.systemSubclusters - Optional array of system subcluster configurations.
    * @param options.allowedGlobalNames - Optional list of allowed global names for vat endowments. When set, only these names from the `VatSupervisor`'s configured endowments (see `createDefaultEndowments`) are available to vats.
+   * @param options.auditRefCounts - If true, verify reference counts against
+   * ground truth at the end of each crank and throw on any mismatch.
    * @returns A promise for the new kernel instance.
    */
   static async make(
@@ -247,6 +264,7 @@ export class Kernel {
       ioChannelFactory?: IOChannelFactory;
       systemSubclusters?: SystemSubclusterConfig[];
       allowedGlobalNames?: AllowedGlobalName[];
+      auditRefCounts?: boolean;
     } = {},
   ): Promise<Kernel> {
     const kernel = new Kernel(platformServices, kernelDatabase, options);
@@ -301,6 +319,11 @@ export class Kernel {
           'Run loop error (kernel may be non-functional):',
           error,
         );
+        this.#runLoopFailure =
+          error instanceof Error ? error : Error(String(error));
+        // Every message still awaiting a result was depending on the loop that
+        // just died. Reject them rather than leave their callers hanging.
+        this.#kernelQueue.failPendingMessages(this.#runLoopFailure);
         // Don't re-throw to avoid unhandled rejection in this long-running task
       });
 
@@ -399,6 +422,12 @@ export class Kernel {
     method: string,
     args: unknown[],
   ): Promise<CapData<KRef>> {
+    if (this.#runLoopFailure) {
+      throw Error(
+        `Kernel run loop is no longer running: ${this.#runLoopFailure.message}`,
+        { cause: this.#runLoopFailure },
+      );
+    }
     try {
       return await this.#kernelQueue.enqueueMessage(target, method, args);
     } catch (rejection) {
diff --git a/packages/ocap-kernel/src/KernelQueue.test.ts b/packages/ocap-kernel/src/KernelQueue.test.ts
index 1c7101d496..2f92c74094 100644
--- a/packages/ocap-kernel/src/KernelQueue.test.ts
+++ b/packages/ocap-kernel/src/KernelQueue.test.ts
@@ -44,6 +44,7 @@ describe('KernelQueue', () => {
     kernelStore = {
       nextTerminatedVatCleanup: vi.fn(),
       collectGarbage: vi.fn(),
+      assertRefCountsIfAuditing: vi.fn(),
       runQueueLength: vi.fn(),
       dequeueRun: vi.fn(),
       enqueueRun: vi.fn(),
@@ -294,10 +295,6 @@ describe('KernelQueue', () => {
         reject: rejectHandler,
       });
       kernelQueue.resolvePromises(endpointId, [resolution], false);
-      expect(kernelStore.incrementRefCount).toHaveBeenCalledWith(
-        kpid,
-        'resolve|kpid',
-      );
       expect(kernelStore.incrementRefCount).toHaveBeenCalledWith(
         'ko1',
         'resolve|slot',
@@ -351,10 +348,6 @@ describe('KernelQueue', () => {
       const insistEndpointIdSpy = vi.spyOn(types, 'insistEndpointId');
       kernelQueue.resolvePromises(undefined, [resolution], false);
       expect(insistEndpointIdSpy).not.toHaveBeenCalled();
-      expect(kernelStore.incrementRefCount).toHaveBeenCalledWith(
-        kpid,
-        'resolve|kpid',
-      );
       expect(kernelStore.incrementRefCount).toHaveBeenCalledWith(
         'ko1',
         'resolve|slot',
diff --git a/packages/ocap-kernel/src/KernelQueue.ts b/packages/ocap-kernel/src/KernelQueue.ts
index f0cba6d132..f217fcc553 100644
--- a/packages/ocap-kernel/src/KernelQueue.ts
+++ b/packages/ocap-kernel/src/KernelQueue.ts
@@ -174,6 +174,7 @@ export class KernelQueue {
       await this.#terminateVat(vatId, info);
     }
     this.#kernelStore.collectGarbage();
+    this.#kernelStore.assertRefCountsIfAuditing();
   }
 
   /**
@@ -231,6 +232,21 @@ export class KernelQueue {
     }
   }
 
+  /**
+   * Reject every message still awaiting a result.
+   *
+   * Only the run loop settles these, so if it stops they can never settle on
+   * their own; a caller awaiting one would wait forever.
+   *
+   * @param error - The failure to report to each waiting caller.
+   */
+  failPendingMessages(error: Error): void {
+    for (const [kpid, { reject }] of this.subscriptions) {
+      this.subscriptions.delete(kpid);
+      reject(error);
+    }
+  }
+
   /**
    * Queue a message to be delivered from the kernel to an object in an endpoint.
    *
@@ -328,7 +344,6 @@ export class KernelQueue {
     for (const resolution of resolutions) {
       const [kpid, rejected, data] = resolution;
 
-      this.#kernelStore.incrementRefCount(kpid, 'resolve|kpid');
       for (const slot of data.slots || []) {
         this.#kernelStore.incrementRefCount(slot, 'resolve|slot');
       }
diff --git a/packages/ocap-kernel/src/KernelRouter.test.ts b/packages/ocap-kernel/src/KernelRouter.test.ts
index ea833293a6..eed87fe4d7 100644
--- a/packages/ocap-kernel/src/KernelRouter.test.ts
+++ b/packages/ocap-kernel/src/KernelRouter.test.ts
@@ -59,9 +59,14 @@ describe('KernelRouter', () => {
       krefToEref: vi.fn() as unknown as MockInstance,
       getKpidsToRetire: vi.fn().mockReturnValue([]),
       translateCapDataKtoE: vi.fn(),
-      krefsToExistingErefs: vi.fn((_endpointId: string, krefs: string[]) =>
+      krefsToErefs: vi.fn((_endpointId: string, krefs: string[]) =>
         krefs.map((kref: string) => `translated-${kref}`),
       ) as unknown as MockInstance,
+      clearReachableFlag: vi.fn(),
+      deleteCListEntry: vi.fn(),
+      forgetKref: vi.fn(),
+      orphanKernelObject: vi.fn(),
+      hasCListEntry: vi.fn().mockReturnValue(true),
       createCrankSavepoint: vi.fn(),
     } as unknown as KernelStore;
 
@@ -283,8 +288,67 @@ describe('KernelRouter', () => {
         expect(endpointHandle.deliverMessage).not.toHaveBeenCalled();
         expect(result).toBeUndefined();
 
-        // Verify that no refcount decrementation happened since we're requeuing
-        expect(kernelStore.decrementRefCount).not.toHaveBeenCalled();
+        expect(kernelStore.decrementRefCount).toHaveBeenCalledWith(
+          target,
+          'requeue|target',
+        );
+      });
+
+      it('hands over every reference a requeued message carries', async () => {
+        const target = 'kp123';
+        (
+          kernelStore.getKernelPromise as unknown as MockInstance
+        ).mockReturnValueOnce({ state: 'unresolved' });
+        const message: KernelMessage = {
+          methargs: { body: 'method args', slots: ['ko1', 'ko2'] },
+          result: 'kp9',
+        };
+        await kernelRouter.deliver({ type: 'send', target, message });
+
+        expect(kernelStore.enqueuePromiseMessage).toHaveBeenCalledWith(
+          target,
+          message,
+        );
+        expect(
+          (kernelStore.decrementRefCount as unknown as MockInstance).mock.calls,
+        ).toStrictEqual([
+          [target, 'requeue|target'],
+          ['kp9', 'requeue|result'],
+          ['ko1', 'requeue|slot'],
+          ['ko2', 'requeue|slot'],
+        ]);
+      });
+
+      it('charges the promise, not the object it resolved to', async () => {
+        const promiseId = 'kp123';
+        const resolvedObject = 'ko456';
+        (
+          kernelStore.getKernelPromise as unknown as MockInstance
+        ).mockReturnValueOnce({
+          state: 'fulfilled',
+          value: { body: '#"$0"', slots: [resolvedObject] },
+        });
+        (kernelStore.getOwner as unknown as MockInstance).mockReturnValue('v1');
+
+        await kernelRouter.deliver({
+          type: 'send',
+          target: promiseId,
+          message: {
+            methargs: { body: 'method args', slots: [] },
+            result: null,
+          },
+        });
+
+        // The run queue item was charged against the promise it named, so that
+        // is what has to be released — not whatever routing resolved it to.
+        expect(kernelStore.decrementRefCount).toHaveBeenCalledWith(
+          promiseId,
+          'deliver|send|target',
+        );
+        expect(kernelStore.decrementRefCount).not.toHaveBeenCalledWith(
+          resolvedObject,
+          'deliver|send|target',
+        );
       });
 
       it('splats message when promise resolves to a non-object', async () => {
@@ -550,6 +614,12 @@ describe('KernelRouter', () => {
         // Verify no notification was delivered to the vat
         expect(endpointHandle.deliverNotify).not.toHaveBeenCalled();
         expect(result).toStrictEqual({ didDelivery: endpointId });
+        // Nothing was delivered, but the queued notification is gone either
+        // way, so its reference has to be released on this path too.
+        expect(kernelStore.decrementRefCount).toHaveBeenCalledWith(
+          kpid,
+          'deliver|notify',
+        );
       });
 
       it('returns didDelivery when no kpids to retire', async () => {
@@ -588,6 +658,10 @@ describe('KernelRouter', () => {
         // Verify no notification was delivered to the vat
         expect(endpointHandle.deliverNotify).not.toHaveBeenCalled();
         expect(result).toStrictEqual({ didDelivery: endpointId });
+        expect(kernelStore.decrementRefCount).toHaveBeenCalledWith(
+          kpid,
+          'deliver|notify',
+        );
       });
 
       it('throws if notification is for an unresolved promise', async () => {
@@ -649,6 +723,159 @@ describe('KernelRouter', () => {
           expect(result).toStrictEqual(mockCrankResult);
         },
       );
+
+      it('clears the reachable flag when delivering dropExports', async () => {
+        await kernelRouter.deliver({
+          type: 'dropExports',
+          endpointId: 'v1',
+          krefs: ['ko1', 'ko2'],
+        });
+
+        expect(
+          (kernelStore.clearReachableFlag as unknown as MockInstance).mock
+            .calls,
+        ).toStrictEqual([
+          ['v1', 'ko1'],
+          ['v1', 'ko2'],
+        ]);
+        expect(kernelStore.deleteCListEntry).not.toHaveBeenCalled();
+      });
+
+      it.each(['retireExports', 'retireImports'] as const)(
+        'tears down the c-list entry when delivering %s',
+        async (actionType) => {
+          await kernelRouter.deliver({
+            type: actionType,
+            endpointId: 'v1',
+            krefs: ['ko1', 'ko2'],
+          });
+
+          expect(
+            (kernelStore.deleteCListEntry as unknown as MockInstance).mock
+              .calls,
+          ).toStrictEqual([
+            ['v1', 'ko1', 'translated-ko1'],
+            ['v1', 'ko2', 'translated-ko2'],
+          ]);
+        },
+      );
+
+      it('orphans the object when delivering retireExports', async () => {
+        await kernelRouter.deliver({
+          type: 'retireExports',
+          endpointId: 'v1',
+          krefs: ['ko1', 'ko2'],
+        });
+
+        // The owner has given up the last name for the object, so the kernel's
+        // record of who owns it must go too or it outlives every reference.
+        expect(
+          (kernelStore.orphanKernelObject as unknown as MockInstance).mock
+            .calls,
+        ).toStrictEqual([
+          ['ko1', 'v1'],
+          ['ko2', 'v1'],
+        ]);
+      });
+
+      it('leaves ownership alone when delivering retireImports', async () => {
+        await kernelRouter.deliver({
+          type: 'retireImports',
+          endpointId: 'v1',
+          krefs: ['ko1'],
+        });
+
+        expect(kernelStore.orphanKernelObject).not.toHaveBeenCalled();
+      });
+
+      it('still releases the kernel side when the endpoint has vanished', async () => {
+        getEndpoint.mockImplementationOnce(() => {
+          throw Error('vat v1 not found');
+        });
+
+        const result = await kernelRouter.deliver({
+          type: 'retireImports',
+          endpointId: 'v1',
+          krefs: ['ko1'],
+        });
+
+        expect(result).toStrictEqual({ didDelivery: 'v1' });
+        // The action has already been consumed, so skipping the teardown would
+        // lose it and leave the entry behind for good
+        expect(kernelStore.deleteCListEntry).toHaveBeenCalledWith(
+          'v1',
+          'ko1',
+          'translated-ko1',
+        );
+      });
+
+      it('skips krefs already cleaned up before delivery', async () => {
+        (
+          kernelStore.hasCListEntry as unknown as MockInstance
+        ).mockImplementation(
+          (_endpointId: string, kref: string) => kref === 'ko1',
+        );
+
+        await kernelRouter.deliver({
+          type: 'retireImports',
+          endpointId: 'v1',
+          krefs: ['ko1', 'ko2'],
+        });
+
+        expect(
+          (kernelStore.deleteCListEntry as unknown as MockInstance).mock.calls,
+        ).toStrictEqual([['v1', 'ko1', 'translated-ko1']]);
+      });
+
+      it('does nothing when every kref is already gone', async () => {
+        (kernelStore.hasCListEntry as unknown as MockInstance).mockReturnValue(
+          false,
+        );
+
+        const result = await kernelRouter.deliver({
+          type: 'retireImports',
+          endpointId: 'v1',
+          krefs: ['ko1'],
+        });
+
+        expect(result).toStrictEqual({ didDelivery: 'v1' });
+        expect(kernelStore.deleteCListEntry).not.toHaveBeenCalled();
+        expect(endpointHandle.deliverRetireImports).not.toHaveBeenCalled();
+      });
+
+      it('rolls back and terminates the vat when delivery fails', async () => {
+        (
+          endpointHandle.deliverRetireImports as unknown as MockInstance
+        ).mockRejectedValueOnce(Error('endpoint went away mid-delivery'));
+
+        const result = await kernelRouter.deliver({
+          type: 'retireImports',
+          endpointId: 'v1',
+          krefs: ['ko1'],
+        });
+
+        // Committing the release while v1 still holds the eref would leave the
+        // two disagreeing, and v1 would mint a fresh kref for the same object
+        expect(result?.abort).toBe(true);
+        expect(result?.terminate?.vatId).toBe('v1');
+      });
+
+      it('does not retry a remote that refuses the delivery', async () => {
+        (
+          endpointHandle.deliverRetireImports as unknown as MockInstance
+        ).mockRejectedValueOnce(Error('remote queue full'));
+
+        const result = await kernelRouter.deliver({
+          type: 'retireImports',
+          endpointId: 'r1',
+          krefs: ['ko1'],
+        });
+
+        // Aborting would restore the action, and GC actions are selected ahead
+        // of all other work, so a remote that keeps refusing would be handed
+        // this same item every crank and nothing else would ever run
+        expect(result).toStrictEqual({ didDelivery: 'r1' });
+      });
     });
 
     describe('bringOutYourDead', () => {
diff --git a/packages/ocap-kernel/src/KernelRouter.ts b/packages/ocap-kernel/src/KernelRouter.ts
index 5cfb8335d4..cbd36b36a5 100644
--- a/packages/ocap-kernel/src/KernelRouter.ts
+++ b/packages/ocap-kernel/src/KernelRouter.ts
@@ -3,7 +3,10 @@ import type { CapData } from '@endo/marshal';
 import { Logger } from '@metamask/logger';
 
 import { KernelQueue } from './KernelQueue.ts';
-import { makeKernelError } from './liveslots/kernel-marshal.ts';
+import {
+  makeFatalKernelError,
+  makeKernelError,
+} from './liveslots/kernel-marshal.ts';
 import type { KernelStore } from './store/index.ts';
 import { extractSingleRef } from './store/utils/extract-ref.ts';
 import { parseRef } from './store/utils/parse-ref.ts';
@@ -11,6 +14,7 @@ import { isPromiseRef } from './store/utils/promise-ref.ts';
 import type {
   EndpointId,
   EndpointHandle,
+  ERef,
   KRef,
   KernelMessage,
   RunQueueItem,
@@ -20,6 +24,7 @@ import type {
   RunQueueItemGCAction,
   CrankResult,
 } from './types.ts';
+import { isVatId } from './types.ts';
 import { assert, Fail } from './utils/assert.ts';
 
 type MessageRoute = {
@@ -255,7 +260,10 @@ export class KernelRouter {
               'deliver|splat|result',
             );
           }
-          this.#kernelStore.decrementRefCount(target, 'deliver|splat|target');
+          this.#kernelStore.decrementRefCount(
+            item.target,
+            'deliver|splat|target',
+          );
           for (const slot of message.methargs.slots) {
             this.#kernelStore.decrementRefCount(slot, 'deliver|splat|slot');
           }
@@ -314,12 +322,24 @@ export class KernelRouter {
       } else {
         Fail`no owner for kernel object ${target}`;
       }
-      this.#kernelStore.decrementRefCount(target, 'deliver|send|target');
+      // `item.target`, not the routed `target`: a message aimed at a promise
+      // is charged against the promise, and routing may have resolved it to a
+      // different object.
+      this.#kernelStore.decrementRefCount(item.target, 'deliver|send|target');
       for (const slot of message.methargs.slots) {
         this.#kernelStore.decrementRefCount(slot, 'deliver|send|slot');
       }
     } else {
+      // The references move from this run queue item to the promise's queue
+      // entry. New holder first, so nothing transiently looks unreferenced.
       this.#kernelStore.enqueuePromiseMessage(target, message);
+      this.#kernelStore.decrementRefCount(item.target, 'requeue|target');
+      if (message.result) {
+        this.#kernelStore.decrementRefCount(message.result, 'requeue|result');
+      }
+      for (const slot of message.methargs.slots) {
+        this.#kernelStore.decrementRefCount(slot, 'requeue|slot');
+      }
     }
 
     return crankResult;
@@ -362,6 +382,9 @@ export class KernelRouter {
     if (state === 'unresolved') {
       Fail`notification on unresolved promise ${kpid}`;
     }
+    // Release the queued notification's reference up front, so the paths that
+    // decide there is nothing to deliver don't leak it.
+    this.#kernelStore.decrementRefCount(kpid, 'deliver|notify');
     if (!this.#kernelStore.krefToEref(endpointId, kpid)) {
       // no c-list entry, already done
       return { didDelivery: endpointId };
@@ -385,16 +408,15 @@ export class KernelRouter {
         tPromise.state === 'rejected',
         this.#kernelStore.translateCapDataKtoE(endpointId, tPromise.value),
       ]);
-      // decrement refcount for the promise being notified
-      if (toResolve !== kpid) {
-        this.#kernelStore.decrementRefCount(toResolve, 'deliver|notify|slot');
-      }
     }
+    // TODO: SwingSet also tears down the c-list entry for each promise in the
+    // batch here, since the endpoint can never refer to a settled promise by
+    // that eref again. Left alone for now because the debug UI discovers
+    // exported ocap URLs by scanning these entries. The cost of keeping them is
+    // that a settled promise reached this way holds a count forever, so it is
+    // never collected and its resolution slots are never released.
     const endpoint = this.#getEndpoint(endpointId);
-    const crankResult = await endpoint.deliverNotify(resolutions);
-    // Decrement reference count for processed 'notify' item
-    this.#kernelStore.decrementRefCount(kpid, 'deliver|notify');
-    return crankResult;
+    return await endpoint.deliverNotify(resolutions);
   }
 
   /**
@@ -408,15 +430,97 @@ export class KernelRouter {
     this.#logger?.log(
       `@@@@ deliver ${endpointId} ${type} ${JSON.stringify(krefs)}`,
     );
-    const endpoint = this.#getEndpoint(endpointId);
-    const erefs = this.#kernelStore.krefsToExistingErefs(endpointId, krefs);
+    // This action was selected while the endpoint's c-list held every one of
+    // these krefs, but `nextTerminatedVatCleanup` runs between selection and
+    // here and can take the entries — and the endpoint — with it. Whatever
+    // survives still has to be released on the kernel's side: the action has
+    // already been consumed from the durable set, so skipping the teardown
+    // would lose it and leave the entry behind for good.
+    const live = krefs.filter((kref) =>
+      this.#kernelStore.hasCListEntry(endpointId, kref),
+    );
+    if (live.length < krefs.length) {
+      this.#logger?.error(
+        `${type} for ${endpointId}: ${krefs.length - live.length} of ${krefs.length} kref(s) were cleaned up before delivery`,
+      );
+    }
+    if (live.length === 0) {
+      return { didDelivery: endpointId };
+    }
+    const erefs = this.#kernelStore.krefsToErefs(endpointId, live);
+    // Telling an endpoint to let go is also the kernel letting go. Otherwise a
+    // dropped export stays flagged reachable, so the same action gets derived
+    // again, and retired entries outlive the objects they name.
+    live.forEach((kref, index) => {
+      if (type === 'dropExports') {
+        this.#kernelStore.clearReachableFlag(endpointId, kref);
+        return;
+      }
+      // `erefs` is parallel to `live`: krefsToErefs throws rather than
+      // returning a short array, so every index is populated.
+      this.#kernelStore.deleteCListEntry(
+        endpointId,
+        kref,
+        erefs[index] as ERef,
+      );
+      if (type === 'retireExports') {
+        // Retiring an export is the owner giving up the last name for the
+        // object, so the kernel's record of who owns it goes too.
+        this.#kernelStore.orphanKernelObject(kref, endpointId);
+      }
+    });
+    let endpoint: EndpointHandle;
+    try {
+      endpoint = this.#getEndpoint(endpointId);
+    } catch (error) {
+      this.#logger?.error(
+        `Endpoint ${endpointId} vanished before ${type} of ${JSON.stringify(live)}; released the kernel's side anyway:`,
+        error,
+      );
+      return { didDelivery: endpointId };
+    }
     const method =
       `deliver${(type[0] as string).toUpperCase()}${type.slice(1)}` as
         | 'deliverDropExports'
         | 'deliverRetireExports'
         | 'deliverRetireImports';
-    const crankResult = await endpoint[method](erefs);
-    return crankResult;
+    try {
+      return await endpoint[method](erefs);
+    } catch (error) {
+      if (!isVatId(endpointId)) {
+        // A remote is a separate kernel across a link that can drop messages,
+        // so its protocol already has to tolerate one going missing — it
+        // reconciles on the next incarnation change. Retrying instead would
+        // starve the kernel: GC actions are selected ahead of all other work,
+        // so a remote that keeps refusing (a full send queue, say) would be
+        // handed the same item every crank and nothing else would ever run.
+        this.#logger?.error(
+          `Delivery of ${type} to remote ${endpointId} failed; the kernel has released ${JSON.stringify(live)} regardless:`,
+          error,
+        );
+        return { didDelivery: endpointId };
+      }
+      // A vat is local and reliable, so a refusal means it is broken. Undo the
+      // teardown rather than commit it: leaving the two disagreeing would have
+      // the vat mint fresh krefs for objects the kernel thinks it let go of.
+      // Aborting restores the entries and the action; terminating the vat is
+      // what stops that restored action from being retried forever.
+      this.#logger?.error(
+        `Delivery of ${type} to ${endpointId} failed; rolling back the kernel's release of ${JSON.stringify(live)} and terminating it:`,
+        error,
+      );
+      return {
+        abort: true,
+        terminate: {
+          vatId: endpointId,
+          reject: true,
+          info: makeFatalKernelError(
+            'INTERNAL_ERROR',
+            `failed to accept ${type}: ${error instanceof Error ? error.message : String(error)}`,
+          ),
+        },
+      };
+    }
   }
 
   /**
diff --git a/packages/ocap-kernel/src/garbage-collection/gc-handlers.ts b/packages/ocap-kernel/src/garbage-collection/gc-handlers.ts
index c96b6e26c8..15e254eb3b 100644
--- a/packages/ocap-kernel/src/garbage-collection/gc-handlers.ts
+++ b/packages/ocap-kernel/src/garbage-collection/gc-handlers.ts
@@ -78,11 +78,26 @@ export function performExportCleanup(
         `endpoint ${endpointId} issued invalid ${action}Exports for ${kref}`,
       );
     }
+    // Only an owner may give up an object. Nothing upstream of here checks that
+    // the vref is even an export — `translateSyscallVtoK` maps import and
+    // export directions alike — so without this a vat could disown an object
+    // belonging to a different, live vat. An already-orphaned object is fine:
+    // there is no claim left to erase.
+    const owner = kernelStore.getOwner(kref);
+    if (owner !== undefined && owner !== endpointId) {
+      throw Error(
+        `endpoint ${endpointId} issued ${action}Exports for ${kref}, which is owned by ${owner}`,
+      );
+    }
     if (checkReachable) {
       if (kernelStore.getReachableFlag(endpointId, kref)) {
         throw Error(`${action}Exports but ${kref} is still reachable`);
       }
     }
     kernelStore.forgetKref(endpointId, kref);
+    // The owner no longer names the object, so nothing can reach it through
+    // this endpoint again. Drop the owner mapping too, or the kernel's record
+    // of the object outlives the only c-list entry it was reachable through.
+    kernelStore.orphanKernelObject(kref, endpointId);
   }
 }
diff --git a/packages/ocap-kernel/src/remotes/kernel/RemoteHandle.test.ts b/packages/ocap-kernel/src/remotes/kernel/RemoteHandle.test.ts
index e114834029..663e4f4e58 100644
--- a/packages/ocap-kernel/src/remotes/kernel/RemoteHandle.test.ts
+++ b/packages/ocap-kernel/src/remotes/kernel/RemoteHandle.test.ts
@@ -464,7 +464,8 @@ describe('RemoteHandle', () => {
     for (const kref of krefs) {
       const { isPromise } = parseRef(kref);
       if (isPromise) {
-        expect(mockKernelStore.getRefCount(kref)).toBe(1);
+        // 1 for the unsettled promise, 1 for the remote's c-list entry
+        expect(mockKernelStore.getRefCount(kref)).toBe(2);
       } else {
         expect(mockKernelStore.getObjectRefCount(kref)).toStrictEqual({
           reachable: 1,
@@ -485,7 +486,7 @@ describe('RemoteHandle', () => {
     for (const kref of krefs) {
       const { isPromise } = parseRef(kref);
       if (isPromise) {
-        expect(mockKernelStore.getRefCount(kref)).toBe(1);
+        expect(mockKernelStore.getRefCount(kref)).toBe(2);
       } else {
         expect(mockKernelStore.getObjectRefCount(kref)).toStrictEqual({
           reachable: 0,
@@ -551,7 +552,6 @@ describe('RemoteHandle', () => {
 
     // As if we're no longer using it (which, in fact, we weren't), which is a
     // prequisite for a valid 'retireImports' delivery
-    mockKernelStore.decrementRefCount(koref, 'test');
     mockKernelStore.clearReachableFlag(remote.remoteId, koref);
 
     // Now have the "other end" retire the import (include seq for incoming message)
diff --git a/packages/ocap-kernel/src/remotes/kernel/RemoteManager.test.ts b/packages/ocap-kernel/src/remotes/kernel/RemoteManager.test.ts
index 34e9e91502..29ca0b2da7 100644
--- a/packages/ocap-kernel/src/remotes/kernel/RemoteManager.test.ts
+++ b/packages/ocap-kernel/src/remotes/kernel/RemoteManager.test.ts
@@ -23,16 +23,13 @@ describe('RemoteManager', () => {
   let remoteManager: RemoteManager;
   let mockPlatformServices: PlatformServices;
   let kernelStore: ReturnType<typeof makeKernelStore>;
-  let kernelKVStore: ReturnType<typeof makeMapKernelDatabase>['kernelKVStore'];
   let mockKernelQueue: KernelQueue;
   let logger: Logger;
   let mockRemoteComms: RemoteComms;
   let mockFactory: ReturnType<typeof createMockRemotesFactory>;
 
   beforeEach(() => {
-    const kernelDatabase = makeMapKernelDatabase();
-    kernelKVStore = kernelDatabase.kernelKVStore;
-    kernelStore = makeKernelStore(kernelDatabase);
+    kernelStore = makeKernelStore(makeMapKernelDatabase());
     logger = new Logger('test');
 
     mockFactory = createMockRemotesFactory({
@@ -776,7 +773,7 @@ describe('RemoteManager', () => {
       // Set up a promise where the remote is the decider
       const [kpid] = kernelStore.initKernelPromise();
       kernelStore.setPromiseDecider(kpid, remoteId);
-      kernelKVStore.set(`cle.${remoteId}.p+1`, kpid);
+      kernelStore.addCListEntry(remoteId, kpid, 'rp+1');
 
       const resolvePromisesSpy = vi.spyOn(mockKernelQueue, 'resolvePromises');
 
@@ -882,7 +879,7 @@ describe('RemoteManager', () => {
 
       const [kpid] = kernelStore.initKernelPromise();
       kernelStore.setPromiseDecider(kpid, remoteId);
-      kernelKVStore.set(`cle.${remoteId}.p+1`, kpid);
+      kernelStore.addCListEntry(remoteId, kpid, 'rp+1');
       kernelStore.setPeerIncarnation(peerId, 'incarnation-A');
 
       const resolvePromisesSpy = vi.spyOn(mockKernelQueue, 'resolvePromises');
diff --git a/packages/ocap-kernel/src/store/index.test.ts b/packages/ocap-kernel/src/store/index.test.ts
index 3db43c3e31..9b49861b48 100644
--- a/packages/ocap-kernel/src/store/index.test.ts
+++ b/packages/ocap-kernel/src/store/index.test.ts
@@ -46,6 +46,8 @@ describe('kernel store', () => {
         'addSubcluster',
         'addSubclusterVat',
         'allocateErefForKref',
+        'assertRefCountsIfAuditing',
+        'auditRefCounts',
         'bufferCrankOutput',
         'cleanupOrphanMessages',
         'cleanupTerminatedVat',
@@ -83,6 +85,7 @@ describe('kernel store', () => {
         'forgetEref',
         'forgetKref',
         'forgetTerminatedVat',
+        'formatRefCountViolations',
         'getAllRemoteRecords',
         'getAllSystemSubclusterMappings',
         'getAllVatRecords',
@@ -138,14 +141,16 @@ describe('kernel store', () => {
         'isVatTerminated',
         'kernelRefExists',
         'krefToEref',
-        'krefsToExistingErefs',
+        'krefsToErefs',
         'makeVatStore',
         'markInitialized',
         'markVatAsTerminated',
         'nextReapAction',
         'nextTerminatedVatCleanup',
+        'orphanKernelObject',
         'pinObject',
         'provideIncarnationId',
+        'recomputeRefCounts',
         'recordLastActiveTime',
         'releaseAllSavepoints',
         'releaseSavepoint',
@@ -164,6 +169,8 @@ describe('kernel store', () => {
         'setPeerIncarnation',
         'setPendingMessage',
         'setPromiseDecider',
+        'setReachableFlag',
+        'setRefCountAuditing',
         'setRelayEntries',
         'setRemoteHighestReceivedSeq',
         'setRemoteIdentityValue',
@@ -203,31 +210,31 @@ describe('kernel store', () => {
       const ko2Owner = 'r23';
       expect(ks.initKernelObject(ko1Owner)).toBe('ko1');
 
-      // Check that the object is initialized with reachable=1, recognizable=1
-      const refCounts = ks.getObjectRefCount('ko1');
-      expect(refCounts.reachable).toBe(1);
-      expect(refCounts.recognizable).toBe(1);
+      expect(ks.getObjectRefCount('ko1')).toStrictEqual({
+        reachable: 0,
+        recognizable: 0,
+      });
 
       // Increment the reference count
       ks.incrementRefCount('ko1', 'test');
-      expect(ks.getObjectRefCount('ko1').reachable).toBe(2);
-      expect(ks.getObjectRefCount('ko1').recognizable).toBe(2);
+      expect(ks.getObjectRefCount('ko1')).toStrictEqual({
+        reachable: 1,
+        recognizable: 1,
+      });
 
       // Increment again
       ks.incrementRefCount('ko1', 'test');
-      expect(ks.getObjectRefCount('ko1').reachable).toBe(3);
-      expect(ks.getObjectRefCount('ko1').recognizable).toBe(3);
-
-      // Decrement
-      ks.decrementRefCount('ko1', 'tess');
-      expect(ks.getObjectRefCount('ko1').reachable).toBe(2);
-      expect(ks.getObjectRefCount('ko1').recognizable).toBe(2);
+      expect(ks.getObjectRefCount('ko1')).toStrictEqual({
+        reachable: 2,
+        recognizable: 2,
+      });
 
-      // Decrement twice more to reach 0
       ks.decrementRefCount('ko1', 'test');
       ks.decrementRefCount('ko1', 'test');
-      expect(ks.getObjectRefCount('ko1').reachable).toBe(0);
-      expect(ks.getObjectRefCount('ko1').recognizable).toBe(0);
+      expect(ks.getObjectRefCount('ko1')).toStrictEqual({
+        reachable: 0,
+        recognizable: 0,
+      });
 
       // Create another object
       expect(ks.initKernelObject(ko2Owner)).toBe('ko2');
diff --git a/packages/ocap-kernel/src/store/index.ts b/packages/ocap-kernel/src/store/index.ts
index 144b3a6c48..068c214b0c 100644
--- a/packages/ocap-kernel/src/store/index.ts
+++ b/packages/ocap-kernel/src/store/index.ts
@@ -38,9 +38,10 @@
  *   ${kpid}.decider = ${endid}               // who decides on settlement
  *   ${kpid}.value = JSON(CAPDATA)            // value settled to, if settled
  *
- * C-lists
- *   cle.${endid}.${eref} = ${kref}           // ERef->KRef mapping
- *   clk.${endid}.${kref} = ${eref}           // KRef->ERef mapping
+ * C-lists (both directions share one prefix; see `getCListPrefix`)
+ *   ${endid}.c.${eref} = ${kref}             // ERef->KRef mapping
+ *   ${endid}.c.${kref} = R|_ ${eref}         // KRef->ERef mapping, plus the
+ *                                            // endpoint's reachable flag
  *
  * Vat bookkeeping
  *   e.nextObjectId.${endid} = NN             // allocation counter for imported object ERefs
@@ -79,6 +80,7 @@ import { getPinMethods } from './methods/pinned.ts';
 import { getPromiseMethods } from './methods/promise.ts';
 import { getQueueMethods } from './methods/queue.ts';
 import { getReachableMethods } from './methods/reachable.ts';
+import { getRefCountAuditMethods } from './methods/refcount-audit.ts';
 import { getRefCountMethods } from './methods/refcount.ts';
 import { getRelayMethods } from './methods/relay.ts';
 import { getRemoteMethods } from './methods/remote.ts';
@@ -152,12 +154,14 @@ export function makeKernelStore(kdb: KernelDatabase, logger?: Logger) {
     subclusters: provideCachedStoredValue('subclusters', '[]'),
     nextSubclusterId: provideCachedStoredValue('nextSubclusterId', '1'),
     vatToSubclusterMap: provideCachedStoredValue('vatToSubclusterMap', '{}'),
+    refCountAuditingEnabled: false,
     // Logging
     logger: logger?.subLogger({ tags: ['kernel-store'] }),
   };
 
   const id = getIdMethods(context);
   const refCount = getRefCountMethods(context);
+  const refCountAudit = getRefCountAuditMethods(context);
   const object = getObjectMethods(context);
   const promise = getPromiseMethods(context);
   const revocation = getRevocationMethods(context);
@@ -291,6 +295,7 @@ export function makeKernelStore(kdb: KernelDatabase, logger?: Logger) {
     ...id,
     ...queue,
     ...refCount,
+    ...refCountAudit,
     ...object,
     ...promise,
     ...revocation,
@@ -339,3 +344,4 @@ export function makeKernelStore(kdb: KernelDatabase, logger?: Logger) {
 
 export type KernelStore = ReturnType<typeof makeKernelStore>;
 export type { RelayEntry } from './types.ts';
+export type { RefCountViolation } from './methods/refcount-audit.ts';
diff --git a/packages/ocap-kernel/src/store/methods/base.ts b/packages/ocap-kernel/src/store/methods/base.ts
index bd09b457a5..2ccd17f1f3 100644
--- a/packages/ocap-kernel/src/store/methods/base.ts
+++ b/packages/ocap-kernel/src/store/methods/base.ts
@@ -19,7 +19,18 @@ export function getBaseMethods(kv: KVStore) {
    * @returns The key for the reachable flag and vatSlot.
    */
   function getSlotKey(endpointId: EndpointId, ref: Ref): string {
-    return `${endpointId}.c.${ref}`;
+    return `${getCListPrefix(endpointId)}${ref}`;
+  }
+
+  /**
+   * Get the prefix shared by both directions of every entry in an endpoint's
+   * c-list, for iterating over the whole thing.
+   *
+   * @param endpointId - The endpoint whose c-list is of interest.
+   * @returns The prefix that all of that endpoint's c-list keys begin with.
+   */
+  function getCListPrefix(endpointId: EndpointId): string {
+    return `${endpointId}.c.`;
   }
 
   /**
@@ -206,6 +217,7 @@ export function getBaseMethods(kv: KVStore) {
 
   return {
     getSlotKey,
+    getCListPrefix,
     refCountKey,
     getOwnerKey,
     getRevokedKey,
diff --git a/packages/ocap-kernel/src/store/methods/clist-accounting.test.ts b/packages/ocap-kernel/src/store/methods/clist-accounting.test.ts
new file mode 100644
index 0000000000..5f154399b4
--- /dev/null
+++ b/packages/ocap-kernel/src/store/methods/clist-accounting.test.ts
@@ -0,0 +1,354 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+
+import { makeMapKernelDatabase } from '../../../test/storage.ts';
+import type { VatConfig, VatId } from '../../types.ts';
+import { makeKernelStore } from '../index.ts';
+
+/**
+ * Regressions for an asymmetry in c-list accounting: creating an import c-list
+ * entry changed no refcount while tearing one down decremented both, and
+ * `initKernelObject` compensated by minting every object at (1, 1). That
+ * constant came out right for exactly one importer, which is why nothing
+ * noticed.
+ */
+describe('c-list reference accounting', () => {
+  let kernelStore: ReturnType<typeof makeKernelStore>;
+
+  /**
+   * Register and initialize an endpoint so it can hold c-list entries.
+   *
+   * @param vatIds - The vats to bring into existence.
+   */
+  function givenVats(...vatIds: VatId[]): void {
+    for (const vatId of vatIds) {
+      kernelStore.setVatConfig(vatId, { sourceSpec: 'x' } as VatConfig);
+      kernelStore.initEndpoint(vatId);
+    }
+  }
+
+  beforeEach(() => {
+    kernelStore = makeKernelStore(makeMapKernelDatabase());
+    kernelStore.markInitialized();
+    kernelStore.setRefCountAuditing(true);
+    givenVats('v1', 'v2', 'v3');
+  });
+
+  it('counts each importer separately', () => {
+    const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+
+    expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+      reachable: 0,
+      recognizable: 0,
+    });
+
+    kernelStore.translateRefKtoE('v2', kref, true);
+    expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+      reachable: 1,
+      recognizable: 1,
+    });
+
+    kernelStore.translateRefKtoE('v3', kref, true);
+    expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+      reachable: 2,
+      recognizable: 2,
+    });
+  });
+
+  it('keeps an object alive for a second importer after the first lets go', () => {
+    const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+    kernelStore.translateRefKtoE('v2', kref, true);
+    kernelStore.translateRefKtoE('v3', kref, true);
+
+    kernelStore.clearReachableFlag('v2', kref);
+    kernelStore.forgetKref('v2', kref);
+    kernelStore.collectGarbage();
+
+    // v3 still holds it, so the owner must not be told to drop or retire
+    expect([...kernelStore.getGCActions()]).toStrictEqual([]);
+    expect(kernelStore.getReachableFlag('v3', kref)).toBe(true);
+    expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+      reachable: 1,
+      recognizable: 1,
+    });
+    expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+  });
+
+  it('drops an object once the last of several importers lets go', () => {
+    const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+    for (const vatId of ['v2', 'v3'] as VatId[]) {
+      kernelStore.translateRefKtoE(vatId, kref, true);
+      kernelStore.clearReachableFlag(vatId, kref);
+      kernelStore.forgetKref(vatId, kref);
+    }
+    kernelStore.collectGarbage();
+
+    expect([...kernelStore.getGCActions()]).toStrictEqual([
+      `v1 dropExport ${kref}`,
+      `v1 retireExport ${kref}`,
+    ]);
+  });
+
+  it('cleans up a terminated owner whose importer had already dropped', () => {
+    const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+    kernelStore.translateRefKtoE('v2', kref, true);
+    kernelStore.clearReachableFlag('v2', kref);
+    kernelStore.markVatAsTerminated('v1');
+
+    // Previously the owner's baseline decrement drove this below zero and threw
+    // out of the middle of the export loop, leaving the vat half-cleaned
+    expect(kernelStore.cleanupTerminatedVat('v1')).toStrictEqual({
+      exports: 1,
+      imports: 0,
+      promises: 0,
+      kv: 0,
+    });
+    expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+      reachable: 0,
+      recognizable: 1,
+    });
+    expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+  });
+
+  it('restores reachability when a dropped import is handed over again', () => {
+    const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+    const eref = kernelStore.translateRefKtoE('v2', kref, true);
+    kernelStore.clearReachableFlag('v2', kref);
+
+    expect(kernelStore.getReachableFlag('v2', kref)).toBe(false);
+    expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+      reachable: 0,
+      recognizable: 1,
+    });
+
+    expect(kernelStore.translateRefKtoE('v2', kref, true)).toBe(eref);
+    expect(kernelStore.getReachableFlag('v2', kref)).toBe(true);
+    expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+      reachable: 1,
+      recognizable: 1,
+    });
+  });
+
+  it('does not inflate the count when the same import is translated twice', () => {
+    const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+    kernelStore.translateRefKtoE('v2', kref, true);
+    kernelStore.translateRefKtoE('v2', kref, true);
+    kernelStore.translateRefKtoE('v2', kref, true);
+
+    expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+      reachable: 1,
+      recognizable: 1,
+    });
+  });
+
+  it('collects an object whose only reference went splat', () => {
+    const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+    kernelStore.incrementRefCount(kref, 'queue|slot');
+    kernelStore.decrementRefCount(kref, 'deliver|splat|slot');
+
+    // Previously this settled at (1,1) with no holder, forever
+    expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+      reachable: 0,
+      recognizable: 0,
+    });
+    kernelStore.collectGarbage();
+    expect([...kernelStore.getGCActions()]).toStrictEqual([
+      `v1 dropExport ${kref}`,
+      `v1 retireExport ${kref}`,
+    ]);
+    expect(kernelStore.getImporters(kref)).toStrictEqual([]);
+  });
+
+  describe('an owner that gives up its own export', () => {
+    it('frees the object once the last importer lets go', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v2', kref, true);
+      kernelStore.clearReachableFlag('v2', kref);
+      kernelStore.collectGarbage();
+
+      // The owner is told to drop, which clears its flag, and it then retires
+      // the export itself — leaving nothing naming the object from its side.
+      kernelStore.clearReachableFlag('v1', kref);
+      kernelStore.forgetKref('v1', kref);
+      kernelStore.orphanKernelObject(kref, 'v1');
+
+      kernelStore.forgetKref('v2', kref);
+      kernelStore.collectGarbage();
+
+      expect(kernelStore.kernelRefExists(kref)).toBe(false);
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it('collects an orphan that no importer ever recognized', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+
+      kernelStore.forgetKref('v1', kref);
+      kernelStore.orphanKernelObject(kref, 'v1');
+      kernelStore.collectGarbage();
+
+      expect(kernelStore.getOwner(kref)).toBeUndefined();
+      expect(kernelStore.kernelRefExists(kref)).toBe(false);
+    });
+
+    it('retires stragglers that still recognize an orphaned object', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v2', kref, true);
+      kernelStore.clearReachableFlag('v2', kref);
+
+      kernelStore.clearReachableFlag('v1', kref);
+      kernelStore.forgetKref('v1', kref);
+      kernelStore.orphanKernelObject(kref, 'v1');
+      kernelStore.collectGarbage();
+
+      // v2 can still recognize it, so it has to be told the name is dead
+      expect([...kernelStore.getGCActions()]).toStrictEqual([
+        `v2 retireImport ${kref}`,
+      ]);
+      // v2's entry outlives the object it names until that action is delivered.
+      // The audit has to tolerate that window, or the end-of-crank check throws
+      // on a state the collector itself just created.
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it('rejects an endpoint disowning an object it does not own', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v2', kref, true);
+
+      expect(() => kernelStore.orphanKernelObject(kref, 'v2')).toThrow(
+        'owned by "v1"',
+      );
+      expect(kernelStore.getOwner(kref)).toBe('v1');
+    });
+
+    it('survives an owner mapping left behind without a c-list entry', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v2', kref, true);
+      kernelStore.clearReachableFlag('v2', kref);
+      kernelStore.clearReachableFlag('v1', kref);
+      // Tear the owner's side down but leave the ownership record, the shape
+      // that used to make the next collection read a key that wasn't there.
+      kernelStore.forgetKref('v1', kref);
+      kernelStore.forgetKref('v2', kref);
+
+      expect(() => kernelStore.collectGarbage()).not.toThrow();
+      expect(kernelStore.getOwner(kref)).toBeUndefined();
+      expect(kernelStore.kernelRefExists(kref)).toBe(false);
+    });
+  });
+
+  describe('cleanupTerminatedVat', () => {
+    it('does nothing for a vat that is not terminated', () => {
+      expect(kernelStore.cleanupTerminatedVat('v1')).toStrictEqual({
+        exports: 0,
+        imports: 0,
+        promises: 0,
+        kv: 0,
+      });
+    });
+
+    it('orphans exports, releases imports, and forgets the vat', () => {
+      const mine = kernelStore.exportFromEndpoint('v1', 'o+1');
+      const theirs = kernelStore.exportFromEndpoint('v2', 'o+1');
+      kernelStore.translateRefKtoE('v1', theirs, true);
+      kernelStore.translateRefKtoE('v3', mine, true);
+      kernelStore.markVatAsTerminated('v1');
+
+      const work = kernelStore.cleanupTerminatedVat('v1');
+
+      expect(work).toMatchObject({ exports: 1, imports: 1, promises: 0 });
+      // v1's export is orphaned but still recognized by v3
+      expect(kernelStore.getOwner(mine)).toBeUndefined();
+      expect(kernelStore.getObjectRefCount(mine)).toStrictEqual({
+        reachable: 1,
+        recognizable: 1,
+      });
+      // v1's import of v2's object is released
+      expect(kernelStore.getObjectRefCount(theirs)).toStrictEqual({
+        reachable: 0,
+        recognizable: 0,
+      });
+      expect(kernelStore.hasCListEntry('v1', mine)).toBe(false);
+      expect(kernelStore.hasCListEntry('v1', theirs)).toBe(false);
+      expect(kernelStore.isVatTerminated('v1')).toBe(false);
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it('releases the c-list entry of a promise the vat was deciding', () => {
+      const kpid = kernelStore.exportFromEndpoint('v1', 'p+1');
+      kernelStore.setPromiseDecider(kpid, 'v1');
+      kernelStore.translateRefKtoE('v2', kpid, true);
+      // The caller rejects the orphans first, which is what releases the
+      // unsettled-promise reference and clears the decider
+      expect([...kernelStore.getPromisesByDecider('v1')]).toStrictEqual([kpid]);
+      kernelStore.resolveKernelPromise(kpid, true, {
+        body: '#"gone"',
+        slots: [],
+      });
+      kernelStore.markVatAsTerminated('v1');
+
+      const work = kernelStore.cleanupTerminatedVat('v1');
+
+      expect(work).toMatchObject({ exports: 0, imports: 0, promises: 1 });
+      expect(kernelStore.getRefCount(kpid)).toBe(1);
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it('leaves a live vat that shares the object untouched', () => {
+      const kref = kernelStore.exportFromEndpoint('v2', 'o+1');
+      kernelStore.translateRefKtoE('v1', kref, true);
+      kernelStore.translateRefKtoE('v3', kref, true);
+      kernelStore.markVatAsTerminated('v1');
+
+      kernelStore.cleanupTerminatedVat('v1');
+      kernelStore.collectGarbage();
+
+      expect(kernelStore.getReachableFlag('v3', kref)).toBe(true);
+      expect([...kernelStore.getGCActions()]).toStrictEqual([]);
+      expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+        reachable: 1,
+        recognizable: 1,
+      });
+    });
+  });
+
+  describe('three endpoints sharing one object', () => {
+    it('accounts for every hand-off and release in turn', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      const importers = ['v2', 'v3'] as VatId[];
+
+      for (const vatId of importers) {
+        kernelStore.translateRefKtoE(vatId, kref, true);
+      }
+      expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+        reachable: 2,
+        recognizable: 2,
+      });
+      expect(kernelStore.getImporters(kref)).toStrictEqual(importers);
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+
+      // v2 drops but still recognizes
+      kernelStore.clearReachableFlag('v2', kref);
+      expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+        reachable: 1,
+        recognizable: 2,
+      });
+      kernelStore.collectGarbage();
+      expect([...kernelStore.getGCActions()]).toStrictEqual([]);
+
+      // v2 retires; v3 keeps it alive
+      kernelStore.forgetKref('v2', kref);
+      kernelStore.collectGarbage();
+      expect([...kernelStore.getGCActions()]).toStrictEqual([]);
+      expect(kernelStore.getImporters(kref)).toStrictEqual(['v3']);
+
+      // v3 lets go too, and only now is the owner told
+      kernelStore.clearReachableFlag('v3', kref);
+      kernelStore.forgetKref('v3', kref);
+      kernelStore.collectGarbage();
+      expect([...kernelStore.getGCActions()]).toStrictEqual([
+        `v1 dropExport ${kref}`,
+        `v1 retireExport ${kref}`,
+      ]);
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+  });
+});
diff --git a/packages/ocap-kernel/src/store/methods/clist.test.ts b/packages/ocap-kernel/src/store/methods/clist.test.ts
index e43d6e428a..4df8841bf9 100644
--- a/packages/ocap-kernel/src/store/methods/clist.test.ts
+++ b/packages/ocap-kernel/src/store/methods/clist.test.ts
@@ -27,39 +27,58 @@ describe('clist-methods', () => {
   });
 
   describe('addCListEntry', () => {
-    it('adds a bidirectional mapping between KRef and ERef', () => {
-      const endpointId: EndpointId = 'v1';
-      const kref: KRef = 'ko1';
-      const eref: ERef = 'o-1';
+    it.each([
+      { what: 'an object import', kref: 'ko1', eref: 'o-1', flag: '_' },
+      { what: 'an object export', kref: 'ko1', eref: 'o+1', flag: 'R' },
+      { what: 'a promise import', kref: 'kp1', eref: 'p-2', flag: '_' },
+      { what: 'a promise export', kref: 'kp1', eref: 'p+2', flag: 'R' },
+    ] as { what: string; kref: KRef; eref: ERef; flag: string }[])(
+      'adds a bidirectional mapping for $what',
+      ({ kref, eref, flag }) => {
+        const endpointId: EndpointId = 'v1';
+
+        clistMethods.addCListEntry(endpointId, kref, eref);
+
+        // Only an export is born reachable; an import earns reachability when
+        // the reference is actually handed over
+        expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`${flag} ${eref}`);
+        expect(kv.get(`${endpointId}.c.${eref}`)).toBe(kref);
+      },
+    );
+
+    it('works with remote endpoints', () => {
+      const endpointId: EndpointId = 'r1';
+      const kref: KRef = 'ko2';
+      const eref: ERef = 'ro+3';
 
       clistMethods.addCListEntry(endpointId, kref, eref);
 
-      // Check that both mappings are stored
       expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`R ${eref}`);
       expect(kv.get(`${endpointId}.c.${eref}`)).toBe(kref);
     });
 
-    it('works with promise refs', () => {
-      const endpointId: EndpointId = 'v1';
-      const kref: KRef = 'kp1';
-      const eref: ERef = 'p+2';
+    it('takes a recognizable reference for an object import', () => {
+      clistMethods.addCListEntry('v1', 'ko1', 'o-1');
 
-      clistMethods.addCListEntry(endpointId, kref, eref);
+      expect(kv.get('ko1.refCount')).toBe('0,1');
+    });
 
-      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`R ${eref}`);
-      expect(kv.get(`${endpointId}.c.${eref}`)).toBe(kref);
+    it('takes no reference for an object export', () => {
+      clistMethods.addCListEntry('v1', 'ko1', 'o+1');
+
+      expect(kv.get('ko1.refCount')).toBeUndefined();
     });
 
-    it('works with remote endpoints', () => {
-      const endpointId: EndpointId = 'r1';
-      const kref: KRef = 'ko2';
-      const eref: ERef = 'ro+3';
+    it.each(['p-1', 'p+1'] as ERef[])(
+      'takes a reference for a promise entry (%s)',
+      (eref) => {
+        kv.set('kp1.refCount', '1');
 
-      clistMethods.addCListEntry(endpointId, kref, eref);
+        clistMethods.addCListEntry('v1', 'kp1', eref);
 
-      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`R ${eref}`);
-      expect(kv.get(`${endpointId}.c.${eref}`)).toBe(kref);
-    });
+        expect(kv.get('kp1.refCount')).toBe('2');
+      },
+    );
   });
 
   describe('hasCListEntry', () => {
@@ -96,7 +115,7 @@ describe('clist-methods', () => {
       expect(kv.get(`e.nextObjectId.${endpointId}`)).toBe('2');
 
       // Check that the mapping was added
-      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`R ${eref}`);
+      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`_ ${eref}`);
       expect(kv.get(`${endpointId}.c.${eref}`)).toBe(kref);
     });
 
@@ -113,7 +132,7 @@ describe('clist-methods', () => {
       expect(kv.get(`e.nextPromiseId.${endpointId}`)).toBe('2');
 
       // Check that the mapping was added
-      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`R ${eref}`);
+      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`_ ${eref}`);
       expect(kv.get(`${endpointId}.c.${eref}`)).toBe(kref);
     });
 
@@ -151,7 +170,7 @@ describe('clist-methods', () => {
     });
   });
 
-  describe('krefsToExistingErefs', () => {
+  describe('krefsToErefs', () => {
     it('returns the ERefs for existing KRefs', () => {
       const endpointId: EndpointId = 'v1';
       const kref1: KRef = 'ko1';
@@ -163,25 +182,18 @@ describe('clist-methods', () => {
       clistMethods.addCListEntry(endpointId, kref2, eref2);
 
       expect(
-        clistMethods.krefsToExistingErefs(endpointId, [kref1, kref2]),
+        clistMethods.krefsToErefs(endpointId, [kref1, kref2]),
       ).toStrictEqual([eref1, eref2]);
     });
 
-    it('returns an empty array for non-existent KRefs', () => {
-      const endpointId: EndpointId = 'v1';
-      const kref: KRef = 'ko1';
-
-      expect(
-        clistMethods.krefsToExistingErefs(endpointId, [kref]),
-      ).toStrictEqual([]);
+    it('throws for an unmapped KRef', () => {
+      expect(() => clistMethods.krefsToErefs('v1', ['ko1'])).toThrow(
+        'unmapped kref "ko1" in "v1" c-list',
+      );
     });
 
     it('returns an empty array for empty KRef array', () => {
-      const endpointId: EndpointId = 'v1';
-
-      expect(clistMethods.krefsToExistingErefs(endpointId, [])).toStrictEqual(
-        [],
-      );
+      expect(clistMethods.krefsToErefs('v1', [])).toStrictEqual([]);
     });
   });
 
@@ -191,7 +203,7 @@ describe('clist-methods', () => {
       const kref: KRef = 'ko1';
       const eref: ERef = 'o-1';
       clistMethods.addCListEntry(endpointId, kref, eref);
-      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`R ${eref}`);
+      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`_ ${eref}`);
       expect(kv.get(`${endpointId}.c.${eref}`)).toBe(kref);
       clistMethods.forgetEref(endpointId, eref);
       expect(kv.get(`${endpointId}.c.${kref}`)).toBeUndefined();
@@ -214,7 +226,7 @@ describe('clist-methods', () => {
       const kref: KRef = 'ko1';
       const eref: ERef = 'o-1';
       clistMethods.addCListEntry(endpointId, kref, eref);
-      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`R ${eref}`);
+      expect(kv.get(`${endpointId}.c.${kref}`)).toBe(`_ ${eref}`);
       expect(kv.get(`${endpointId}.c.${eref}`)).toBe(kref);
       clistMethods.forgetKref(endpointId, kref);
       expect(kv.get(`${endpointId}.c.${kref}`)).toBeUndefined();
diff --git a/packages/ocap-kernel/src/store/methods/clist.ts b/packages/ocap-kernel/src/store/methods/clist.ts
index 425f4a1295..d7e3a52af0 100644
--- a/packages/ocap-kernel/src/store/methods/clist.ts
+++ b/packages/ocap-kernel/src/store/methods/clist.ts
@@ -1,3 +1,5 @@
+import { Fail } from '@endo/errors';
+
 import { getBaseMethods } from './base.ts';
 import { getReachableMethods } from './reachable.ts';
 import { getRefCountMethods } from './refcount.ts';
@@ -20,23 +22,32 @@ import {
 export function getCListMethods(ctx: StoreContext) {
   const { getSlotKey } = getBaseMethods(ctx.kv);
   const { clearReachableFlag } = getReachableMethods(ctx);
-  const { decrementRefCount } = getRefCountMethods(ctx);
+  const { incrementRefCount, decrementRefCount } = getRefCountMethods(ctx);
 
   /**
    * Add an entry to an endpoint's c-list, creating a new bidirectional mapping
    * between an ERef belonging to the endpoint and a KRef belonging to the
    * kernel.
    *
+   * The entry is itself a reference, so creating one takes a count, mirroring
+   * {@link deleteCListEntry}. An import is born recognizing but not reaching:
+   * reachability is `setReachableFlag`'s job, when the reference is handed
+   * over. An export takes no count for an object — the owner is not one of its
+   * own referrers — and is born flagged. For a promise both directions count;
+   * only objects exempt the owner.
+   *
    * @param endpointId - The endpoint whose c-list is to be added to.
    * @param kref - The KRef.
    * @param eref - The ERef.
    */
   function addCListEntry(endpointId: EndpointId, kref: KRef, eref: ERef): void {
+    const isExport = parseRef(eref).direction === 'export';
     ctx.kv.set(
       getSlotKey(endpointId, kref),
-      buildReachableAndVatSlot(true, eref),
+      buildReachableAndVatSlot(isExport, eref),
     );
     ctx.kv.set(getSlotKey(endpointId, eref), kref);
+    incrementRefCount(kref, 'add|kref', { isExport, onlyRecognizable: true });
   }
 
   /**
@@ -133,16 +144,23 @@ export function getCListMethods(ctx: StoreContext) {
   }
 
   /**
-   * Look up the ERefs that an endpoint's c-list maps aa list of KRefs to.
+   * Look up the ERefs that an endpoint's c-list maps a list of KRefs to,
+   * without allocating entries or disturbing reachability.
+   *
+   * Every kref must already be mapped: a missing entry means the caller's list
+   * of krefs and the c-list disagree, which is worth hearing about rather than
+   * silently dropping the one that got away.
    *
    * @param endpointId - The endpoint in question.
    * @param krefs - The KRefs to look up.
-   * @returns The given endpoint's ERefs corresponding to `krefs`
+   * @returns The given endpoint's ERefs corresponding to `krefs`.
    */
-  function krefsToExistingErefs(endpointId: EndpointId, krefs: KRef[]): ERef[] {
-    return krefs
-      .map((kref) => krefToEref(endpointId, kref))
-      .filter((eref): eref is ERef => Boolean(eref));
+  function krefsToErefs(endpointId: EndpointId, krefs: KRef[]): ERef[] {
+    return krefs.map(
+      (kref) =>
+        krefToEref(endpointId, kref) ??
+        Fail`unmapped kref ${kref} in ${endpointId} c-list`,
+    );
   }
 
   /**
@@ -182,6 +200,6 @@ export function getCListMethods(ctx: StoreContext) {
     krefToEref,
     forgetEref,
     forgetKref,
-    krefsToExistingErefs,
+    krefsToErefs,
   };
 }
diff --git a/packages/ocap-kernel/src/store/methods/gc.test.ts b/packages/ocap-kernel/src/store/methods/gc.test.ts
index a294920e9a..e91fb29bb9 100644
--- a/packages/ocap-kernel/src/store/methods/gc.test.ts
+++ b/packages/ocap-kernel/src/store/methods/gc.test.ts
@@ -76,21 +76,6 @@ describe('GC methods', () => {
     });
   });
 
-  describe('reachability tracking', () => {
-    it('manages reachable flags', () => {
-      const v1Object = kernelStore.initKernelObject('v1');
-      kernelStore.addCListEntry('v1', v1Object, 'o-1');
-
-      expect(kernelStore.getReachableFlag('v1', v1Object)).toBe(true);
-
-      kernelStore.clearReachableFlag('v1', v1Object);
-      expect(kernelStore.getReachableFlag('v1', v1Object)).toBe(false);
-
-      const refCounts = kernelStore.getObjectRefCount(v1Object);
-      expect(refCounts.reachable).toBe(0);
-    });
-  });
-
   describe('reaping', () => {
     it('processes reap queue in order', () => {
       const vatIds = ['v1', 'v2', 'v3'];
diff --git a/packages/ocap-kernel/src/store/methods/gc.ts b/packages/ocap-kernel/src/store/methods/gc.ts
index 04f3c0cc0c..92a093c968 100644
--- a/packages/ocap-kernel/src/store/methods/gc.ts
+++ b/packages/ocap-kernel/src/store/methods/gc.ts
@@ -1,6 +1,7 @@
 import { Fail } from '@endo/errors';
 
 import { getBaseMethods } from './base.ts';
+import { getCListMethods } from './clist.ts';
 import { getObjectMethods } from './object.ts';
 import { getPromiseMethods } from './promise.ts';
 import { getReachableMethods } from './reachable.ts';
@@ -33,6 +34,37 @@ export function getGCMethods(ctx: StoreContext) {
   const { getImporters, isVatTerminated } = getVatMethods(ctx);
   const { getReachableFlag, getReachableAndVatSlot } = getReachableMethods(ctx);
   const { clearEmptySubclusters } = getSubclusterMethods(ctx);
+  const { hasCListEntry } = getCListMethods(ctx);
+
+  /**
+   * Give up the kernel's record of who owns an object. The object survives only
+   * as long as something still names it; the collector disposes of it from
+   * there, retiring any stragglers that still recognize it.
+   *
+   * Called when an owner stops naming its own export — it retired or abandoned
+   * it, or a GC `retireExport` was delivered. Without this the owner mapping
+   * outlives the c-list entry it was reachable through, which both leaks the
+   * object record and leaves `collectGarbage` reading a c-list entry that is no
+   * longer there.
+   *
+   * Disowning an object is only ever the owner's own doing, so `expectedOwner`
+   * is required: taking it on trust would let one endpoint erase another's claim
+   * to an object it is still exporting. An object that is already orphaned is
+   * left alone — the caller and the kernel agree it has no owner.
+   *
+   * @param kref - The object whose owner mapping is to be dropped.
+   * @param expectedOwner - The endpoint the caller believes owns `kref`.
+   */
+  function orphanKernelObject(kref: KRef, expectedOwner: EndpointId): void {
+    const owner = getOwner(kref);
+    if (owner === undefined) {
+      return;
+    }
+    owner === expectedOwner ||
+      Fail`cannot orphan ${kref} for ${expectedOwner}: owned by ${owner}`;
+    ctx.kv.delete(getOwnerKey(kref));
+    ctx.maybeFreeKrefs.add(kref);
+  }
 
   /**
    * Get the set of GC actions to perform.
@@ -158,15 +190,28 @@ export function getGCMethods(ctx: StoreContext) {
           // might still alive, or might be terminated and in the
           // process of being deleted. These two clauses are
           // mutually exclusive.
-          if (ownerVatID && !terminated) {
+          if (ownerVatID && !terminated && !hasCListEntry(ownerVatID, kref)) {
+            // Should be unreachable: every path that tears down an owner's
+            // export entry orphans the object with it. Repair it so the
+            // collector can keep going, but say so — absorbing this in silence
+            // would hide whatever upstream broke the pairing.
+            ctx.logger?.error(
+              `${kref} is owned by live endpoint ${ownerVatID} which has no ` +
+                `c-list entry for it; treating it as orphaned`,
+            );
+            orphanKernelObject(kref, ownerVatID);
+            ownerVatID = undefined;
+          } else if (ownerVatID && !terminated) {
             const vatConsidersReachable = getReachableFlag(ownerVatID, kref);
             if (vatConsidersReachable) {
               // the reachable count is zero, but the vat doesn't realize it
               actions.add(makeGCAction(ownerVatID, 'dropExport', kref));
             }
             if (recognizable === 0) {
-              // TODO: rethink this assert
-              // assert.equal(vatConsidersReachable, false, `${kref} is reachable but not recognizable`);
+              // No assertion that the owner has stopped considering this
+              // reachable: when the last holder both drops and retires before
+              // we run, we queue dropExport and retireExport together and the
+              // owner's flag is still set until the first of them is delivered.
               actions.add(makeGCAction(ownerVatID, 'retireExport', kref));
             }
           } else if (ownerVatID && terminated) {
@@ -219,6 +264,7 @@ export function getGCMethods(ctx: StoreContext) {
     scheduleReap,
     nextReapAction,
     retireKernelObjects,
+    orphanKernelObject,
     collectGarbage,
   };
 }
diff --git a/packages/ocap-kernel/src/store/methods/object.test.ts b/packages/ocap-kernel/src/store/methods/object.test.ts
index def40adaef..26d4fb9b16 100644
--- a/packages/ocap-kernel/src/store/methods/object.test.ts
+++ b/packages/ocap-kernel/src/store/methods/object.test.ts
@@ -29,7 +29,7 @@ describe('object-methods', () => {
   });
 
   describe('initKernelObject', () => {
-    it('creates a new kernel object with initial reference counts', () => {
+    it('creates a new kernel object, unreferenced', () => {
       const owner: EndpointId = 'v1';
       const koId = objectStore.initKernelObject(owner);
 
@@ -39,13 +39,13 @@ describe('object-methods', () => {
       // Check the owner is set correctly
       expect(kv.get(`${koId}.owner`)).toBe(owner);
 
-      // Check reference counts are initialized to 1,1
-      expect(kv.get(`${koId}.refCount`)).toBe('1,1');
-
-      // Check via the API
-      const refCounts = objectStore.getObjectRefCount(koId);
-      expect(refCounts.reachable).toBe(1);
-      expect(refCounts.recognizable).toBe(1);
+      // A new object has no referrers yet; the owner's own export entry is
+      // not one of them
+      expect(kv.get(`${koId}.refCount`)).toBe('0,0');
+      expect(objectStore.getObjectRefCount(koId)).toStrictEqual({
+        reachable: 0,
+        recognizable: 0,
+      });
     });
 
     it('initializes the revoked flag to false', () => {
@@ -171,8 +171,10 @@ describe('object-methods', () => {
     it('returns reference counts for existing objects', () => {
       const koId = objectStore.initKernelObject('v1');
 
+      objectStore.setObjectRefCount(koId, { reachable: 1, recognizable: 2 });
+
       const refCounts = objectStore.getObjectRefCount(koId);
-      expect(refCounts).toStrictEqual({ reachable: 1, recognizable: 1 });
+      expect(refCounts).toStrictEqual({ reachable: 1, recognizable: 2 });
     });
 
     it('returns zero counts for non-existent objects', () => {
@@ -276,8 +278,8 @@ describe('object-methods', () => {
       // Check initial state
       expect(objectStore.getOwner(koId)).toBe('v1');
       expect(objectStore.getObjectRefCount(koId)).toStrictEqual({
-        reachable: 1,
-        recognizable: 1,
+        reachable: 0,
+        recognizable: 0,
       });
 
       // Update reference counts
diff --git a/packages/ocap-kernel/src/store/methods/object.ts b/packages/ocap-kernel/src/store/methods/object.ts
index 9e596f5e8f..57b7aaf88e 100644
--- a/packages/ocap-kernel/src/store/methods/object.ts
+++ b/packages/ocap-kernel/src/store/methods/object.ts
@@ -19,10 +19,11 @@ export function getObjectMethods(ctx: StoreContext) {
     getBaseMethods(ctx.kv);
 
   /**
-   * Create a new kernel object.  The new object will be born with reference and
-   * recognizability counts of 1, on the assumption that the new object
-   * corresponds to an object that has just been imported from somewhere. The
-   * object is initially unrevoked.
+   * Create a new kernel object, born unreferenced at `(0, 0)`. Every unit of
+   * an object's counts is owed to a reference someone else holds — an
+   * importer's c-list entry, a queued message, a promise's resolution value, a
+   * pin — and the owner's own export entry is not one of them. The object is
+   * initially unrevoked.
    *
    * @param owner - The endpoint or 'kernel' that is the owner of the new object.
    * @returns The new object's KRef.
@@ -30,7 +31,7 @@ export function getObjectMethods(ctx: StoreContext) {
   function initKernelObject(owner: EndpointId | 'kernel'): KRef {
     const koId = getNextObjectId();
     ctx.kv.set(getOwnerKey(koId), owner);
-    setObjectRefCount(koId, { reachable: 1, recognizable: 1 });
+    setObjectRefCount(koId, { reachable: 0, recognizable: 0 });
     return koId;
   }
 
diff --git a/packages/ocap-kernel/src/store/methods/promise.test.ts b/packages/ocap-kernel/src/store/methods/promise.test.ts
index baeba6c2e5..d85e291ef5 100644
--- a/packages/ocap-kernel/src/store/methods/promise.test.ts
+++ b/packages/ocap-kernel/src/store/methods/promise.test.ts
@@ -58,6 +58,7 @@ describe('promise store methods', () => {
   };
   let context: StoreContext;
   let promiseMethods: ReturnType<typeof getPromiseMethods>;
+  const mockIncrementRefCount = vi.fn();
   const mockDecrementRefCount = vi.fn();
 
   beforeEach(() => {
@@ -78,6 +79,7 @@ describe('promise store methods', () => {
       incCounter: mockIncCounter,
       provideStoredQueue: mockProvideStoredQueue,
       getPrefixedKeys: mockGetPrefixedKeys,
+      getCListPrefix: (endpointId: string) => `${endpointId}.c.`,
     });
 
     (getQueueMethods as ReturnType<typeof vi.fn>).mockReturnValue({
@@ -85,6 +87,7 @@ describe('promise store methods', () => {
     });
 
     (getRefCountMethods as ReturnType<typeof vi.fn>).mockReturnValue({
+      incrementRefCount: mockIncrementRefCount,
       decrementRefCount: mockDecrementRefCount,
     });
 
@@ -304,11 +307,12 @@ describe('promise store methods', () => {
         slots: ['o+1', 'o+2'],
       };
       const message1: KernelMessage = {
-        method: 'method1',
-      } as unknown as KernelMessage;
+        methargs: { body: 'method1', slots: ['ko7'] },
+        result: 'kp8',
+      };
       const message2: KernelMessage = {
-        method: 'method2',
-      } as unknown as KernelMessage;
+        methargs: { body: 'method2', slots: [] },
+      };
 
       mockKV.set(`${kpid}.state`, 'unresolved');
       mockKV.set(`${kpid}.decider`, 'v1');
@@ -338,7 +342,15 @@ describe('promise store methods', () => {
       expect(mockKV.has(`${kpid}.decider`)).toBe(false);
       expect(mockKV.has(`${kpid}.subscribers`)).toBe(false);
       expect(mockQueue.delete).toHaveBeenCalled();
-      expect(mockDecrementRefCount).toHaveBeenCalledTimes(1);
+      // Each dequeued message releases what its queue entry held, then the
+      // promise releases the decision it was owed
+      expect(mockDecrementRefCount.mock.calls).toStrictEqual([
+        [kpid, 'resolve|dequeue|target'],
+        ['kp8', 'resolve|dequeue|result'],
+        ['ko7', 'resolve|dequeue|slot'],
+        [kpid, 'resolve|dequeue|target'],
+        [kpid, 'resolve|decider'],
+      ]);
     });
 
     it('rejects a promise and enqueues pending messages', () => {
@@ -372,6 +384,23 @@ describe('promise store methods', () => {
       expect(mockProvideStoredQueue).toHaveBeenCalledWith(kpid, false);
       expect(mockQueue.enqueue).toHaveBeenCalledWith(message);
     });
+
+    it('takes a reference on everything the queued message carries', () => {
+      const kpid = 'kp123';
+      const message: KernelMessage = {
+        methargs: { body: 'test', slots: ['ko1', 'kp2'] },
+        result: 'kp3',
+      };
+
+      promiseMethods.enqueuePromiseMessage(kpid, message);
+
+      expect(mockIncrementRefCount.mock.calls).toStrictEqual([
+        [kpid, 'promiseQueue|target'],
+        ['kp3', 'promiseQueue|result'],
+        ['ko1', 'promiseQueue|slot'],
+        ['kp2', 'promiseQueue|slot'],
+      ]);
+    });
   });
 
   describe('getKernelPromiseMessageQueue', () => {
@@ -410,69 +439,71 @@ describe('promise store methods', () => {
   });
 
   describe('getPromisesByDecider', () => {
-    it('yields promises decided by a specific vat', () => {
-      const vatId = 'v1' as VatId;
-      const kpid1 = 'kp101';
-      const kpid2 = 'kp102';
-      const kpid3 = 'kp103';
-
-      // Set up mock data
-      mockGetPrefixedKeys.mockReturnValue([
-        `cle.${vatId}.p1`,
-        `cle.${vatId}.p2`,
-        `cle.${vatId}.p3`,
-      ]);
-
-      mockKV.set(`cle.${vatId}.p1`, kpid1);
-      mockKV.set(`cle.${vatId}.p2`, kpid2);
-      mockKV.set(`cle.${vatId}.p3`, kpid3);
-
-      // kpid1 is decided by vatId
-      mockKV.set(`${kpid1}.state`, 'unresolved');
-      mockKV.set(`${kpid1}.decider`, vatId);
-      mockKV.set(`${kpid1}.subscribers`, '[]');
-
-      // kpid2 is also decided by vatId
-      mockKV.set(`${kpid2}.state`, 'unresolved');
-      mockKV.set(`${kpid2}.decider`, vatId);
-      mockKV.set(`${kpid2}.subscribers`, '[]');
+    /**
+     * Populate a c-list and an unresolved promise record, using the real key
+     * layout so the scan is exercised rather than mocked around.
+     *
+     * @param endpointId - The endpoint whose c-list to add to.
+     * @param eref - The endpoint's ref for the promise.
+     * @param kpid - The kernel promise.
+     * @param decider - The promise's decider, if it has one.
+     * @param state - The promise's state.
+     */
+    function givenCListPromise(
+      endpointId: string,
+      eref: string,
+      kpid: string,
+      decider: string | undefined,
+      state = 'unresolved',
+    ): void {
+      mockKV.set(`${endpointId}.c.${eref}`, kpid);
+      mockKV.set(`${endpointId}.c.${kpid}`, `R ${eref}`);
+      mockKV.set(`${kpid}.state`, state);
+      mockKV.set(`${kpid}.subscribers`, '[]');
+      if (state === 'unresolved') {
+        if (decider) {
+          mockKV.set(`${kpid}.decider`, decider);
+        }
+      } else {
+        mockKV.set(`${kpid}.value`, '{"body":"value","slots":[]}');
+      }
+      mockGetPrefixedKeys.mockImplementation((prefix: string) =>
+        [...mockKV.keys()].filter((key) => key.startsWith(prefix)).sort(),
+      );
+    }
 
-      // kpid3 is unresolved but decided by a different vat
-      mockKV.set(`${kpid3}.state`, 'unresolved');
-      mockKV.set(`${kpid3}.decider`, 'v2');
-      mockKV.set(`${kpid3}.subscribers`, '[]');
+    it.each([
+      { context: 'a vat', endpointId: 'v1', erefs: ['p+1', 'p-2'] },
+      { context: 'a remote', endpointId: 'r1', erefs: ['rp+1', 'rp-2'] },
+    ])('yields promises decided by $context', ({ endpointId, erefs }) => {
+      givenCListPromise(endpointId, erefs[0] as string, 'kp101', endpointId);
+      givenCListPromise(endpointId, erefs[1] as string, 'kp102', endpointId);
+      givenCListPromise(endpointId, 'p+3', 'kp103', 'v2');
 
-      const result = Array.from(promiseMethods.getPromisesByDecider(vatId));
+      const result = Array.from(
+        promiseMethods.getPromisesByDecider(endpointId as VatId),
+      );
 
-      expect(result).toStrictEqual([kpid1, kpid2]);
-      expect(mockGetPrefixedKeys).toHaveBeenCalledWith(`cle.${vatId}.p`);
+      expect(result).toStrictEqual(['kp101', 'kp102']);
     });
 
     it('does not yield resolved promises', () => {
-      const vatId = 'v1' as VatId;
-      const kpid1 = 'kp101';
-      const kpid2 = 'kp102';
+      givenCListPromise('v1', 'p+1', 'kp101', undefined, 'fulfilled');
+      givenCListPromise('v1', 'p+2', 'kp102', 'v1');
 
-      mockGetPrefixedKeys.mockReturnValue([
-        `cle.${vatId}.p1`,
-        `cle.${vatId}.p2`,
-      ]);
+      const result = Array.from(promiseMethods.getPromisesByDecider('v1'));
 
-      mockKV.set(`cle.${vatId}.p1`, kpid1);
-      mockKV.set(`cle.${vatId}.p2`, kpid2);
-
-      // kpid1 is fulfilled
-      mockKV.set(`${kpid1}.state`, 'fulfilled');
-      mockKV.set(`${kpid1}.value`, '{"body":"value","slots":[]}');
+      expect(result).toStrictEqual(['kp102']);
+    });
 
-      // kpid2 is unresolved and decided by vatId
-      mockKV.set(`${kpid2}.state`, 'unresolved');
-      mockKV.set(`${kpid2}.decider`, vatId);
-      mockKV.set(`${kpid2}.subscribers`, '[]');
+    it('ignores object entries in the same c-list', () => {
+      givenCListPromise('v1', 'p+1', 'kp101', 'v1');
+      mockKV.set('v1.c.o+1', 'ko1');
+      mockKV.set('v1.c.ko1', 'R o+1');
 
-      const result = Array.from(promiseMethods.getPromisesByDecider(vatId));
+      const result = Array.from(promiseMethods.getPromisesByDecider('v1'));
 
-      expect(result).toStrictEqual([kpid2]);
+      expect(result).toStrictEqual(['kp101']);
     });
 
     it('yields nothing if no promises are decided by the vat', () => {
diff --git a/packages/ocap-kernel/src/store/methods/promise.ts b/packages/ocap-kernel/src/store/methods/promise.ts
index c3aedbf6c3..40fa73b049 100644
--- a/packages/ocap-kernel/src/store/methods/promise.ts
+++ b/packages/ocap-kernel/src/store/methods/promise.ts
@@ -16,6 +16,9 @@ import { makeKernelSlot } from '../utils/kernel-slots.ts';
 import { parseRef } from '../utils/parse-ref.ts';
 import { isPromiseRef } from '../utils/promise-ref.ts';
 
+/** Matches the promise erefs in a c-list: `p+NN`/`p-NN`, or `rp+NN`/`rp-NN` for a remote. */
+const PROMISE_EREF = /^r?p[-+]\d+$/u;
+
 /**
  * Create a promise store object that provides functionality for managing kernel promises.
  *
@@ -25,14 +28,20 @@ import { isPromiseRef } from '../utils/promise-ref.ts';
  */
 // eslint-disable-next-line @typescript-eslint/explicit-function-return-type
 export function getPromiseMethods(ctx: StoreContext) {
-  const { incCounter, provideStoredQueue, getPrefixedKeys, refCountKey } =
-    getBaseMethods(ctx.kv);
-  const { decrementRefCount } = getRefCountMethods(ctx);
+  const {
+    incCounter,
+    provideStoredQueue,
+    getPrefixedKeys,
+    getCListPrefix,
+    refCountKey,
+  } = getBaseMethods(ctx.kv);
+  const { incrementRefCount, decrementRefCount } = getRefCountMethods(ctx);
 
   /**
-   * Create a new, unresolved kernel promise. The new promise will be born with
-   * a reference count of 1 on the assumption that the promise has just been
-   * imported from somewhere.
+   * Create a new, unresolved kernel promise, born with a reference count of 1:
+   * an unsettled promise is owed a decision, and that obligation is itself a
+   * reference. Released, exactly once, when the promise settles in
+   * {@link resolveKernelPromise}.
    *
    * @returns A tuple of the new promise's KRef and an object describing the
    * new promise itself.
@@ -159,16 +168,18 @@ export function getPromiseMethods(ctx: StoreContext) {
     value: CapData<KRef>,
   ): [KRef, KernelMessage][] {
     const queue = provideStoredQueue(kpid, false);
-    // Collect messages that were queued on this promise
+    // Releasing each queue entry's references as we go: the caller re-enqueues
+    // these on the run queue, which takes its own.
     const queuedMessages: [KRef, KernelMessage][] = [];
     for (const message of getKernelPromiseMessageQueue(kpid)) {
       queuedMessages.push([kpid, message]);
+      releaseQueuedMessageRefs(kpid, message, 'resolve|dequeue');
     }
     ctx.kv.set(`${kpid}.state`, rejected ? 'rejected' : 'fulfilled');
     ctx.kv.set(`${kpid}.value`, JSON.stringify(value));
     ctx.kv.delete(`${kpid}.decider`);
     ctx.kv.delete(`${kpid}.subscribers`);
-    // Drop the baseline "decider" refcount now that the promise is settled.
+    // The promise has been decided, so it is no longer owed a decision.
     decrementRefCount(kpid, 'resolve|decider');
     queue.delete();
     return queuedMessages;
@@ -177,13 +188,46 @@ export function getPromiseMethods(ctx: StoreContext) {
   /**
    * Append a message to a promise's message queue.
    *
+   * The queue entry becomes the message's holder, so it takes references on
+   * everything the message carries, just as the run queue does.
+   *
    * @param kpid - The KRef of the promise to enqueue on.
    * @param message - The message to enqueue.
    */
   function enqueuePromiseMessage(kpid: KRef, message: KernelMessage): void {
+    incrementRefCount(kpid, 'promiseQueue|target');
+    if (message.result) {
+      incrementRefCount(message.result, 'promiseQueue|result');
+    }
+    for (const slot of message.methargs.slots) {
+      incrementRefCount(slot, 'promiseQueue|slot');
+    }
     provideStoredQueue(kpid, false).enqueue(message);
   }
 
+  /**
+   * Release the references a promise-queue entry held on the message it
+   * carried.
+   *
+   * @param kpid - The promise whose queue the message was on, and hence the
+   * message's target.
+   * @param message - The message being taken off the queue.
+   * @param tag - Tag for refcount logging.
+   */
+  function releaseQueuedMessageRefs(
+    kpid: KRef,
+    message: KernelMessage,
+    tag: string,
+  ): void {
+    decrementRefCount(kpid, `${tag}|target`);
+    if (message.result) {
+      decrementRefCount(message.result, `${tag}|result`);
+    }
+    for (const slot of message.methargs.slots) {
+      decrementRefCount(slot, `${tag}|slot`);
+    }
+  }
+
   /**
    * Fetch the messages in a kernel promise's message queue.
    *
@@ -211,8 +255,13 @@ export function getPromiseMethods(ctx: StoreContext) {
    * @yields the kpids of all the unresolved promises decided by `decider`.
    */
   function* getPromisesByDecider(decider: EndpointId): Generator<KRef> {
-    const basePrefix = `cle.${decider}.`;
-    for (const key of getPrefixedKeys(`${basePrefix}p`)) {
+    const prefix = getCListPrefix(decider);
+    for (const key of getPrefixedKeys(prefix)) {
+      // A c-list holds both directions of each pair. Iterate by eref, and only
+      // the promise ones: `p+NN`/`p-NN` for a vat, `rp+NN`/`rp-NN` for a remote.
+      if (!PROMISE_EREF.test(key.slice(prefix.length))) {
+        continue;
+      }
       const kpid = ctx.kv.getRequired<KRef>(key);
       const kp = getKernelPromise(kpid);
       if (kp.state === 'unresolved' && kp.decider === decider) {
diff --git a/packages/ocap-kernel/src/store/methods/reachable.test.ts b/packages/ocap-kernel/src/store/methods/reachable.test.ts
index fdaab477e5..2464339b68 100644
--- a/packages/ocap-kernel/src/store/methods/reachable.test.ts
+++ b/packages/ocap-kernel/src/store/methods/reachable.test.ts
@@ -1,6 +1,7 @@
 import { describe, it, expect, beforeEach } from 'vitest';
 
 import { makeMapKernelDatabase } from '../../../test/storage.ts';
+import type { KRef } from '../../types.ts';
 import { makeKernelStore } from '../index.ts';
 
 describe('GC methods', () => {
@@ -15,13 +16,82 @@ describe('GC methods', () => {
       const ko1 = kernelStore.initKernelObject('v1');
       kernelStore.addCListEntry('v1', ko1, 'o-1');
 
+      // An import entry is born recognizing but not yet reaching
+      expect(kernelStore.getReachableFlag('v1', ko1)).toBe(false);
+      expect(kernelStore.getObjectRefCount(ko1)).toStrictEqual({
+        reachable: 0,
+        recognizable: 1,
+      });
+
+      kernelStore.setReachableFlag('v1', ko1);
       expect(kernelStore.getReachableFlag('v1', ko1)).toBe(true);
+      expect(kernelStore.getObjectRefCount(ko1)).toStrictEqual({
+        reachable: 1,
+        recognizable: 1,
+      });
 
       kernelStore.clearReachableFlag('v1', ko1);
       expect(kernelStore.getReachableFlag('v1', ko1)).toBe(false);
+      expect(kernelStore.getObjectRefCount(ko1)).toStrictEqual({
+        reachable: 0,
+        recognizable: 1,
+      });
+    });
+
+    /**
+     * Give v1 an import entry it reaches, the state both idempotence tests
+     * start from.
+     *
+     * @returns The kref of the reached import.
+     */
+    function givenReachedImport(): KRef {
+      const ko1 = kernelStore.initKernelObject('v1');
+      kernelStore.addCListEntry('v1', ko1, 'o-1');
+      kernelStore.setReachableFlag('v1', ko1);
+      return ko1;
+    }
+
+    it('setReachableFlag is idempotent', () => {
+      const ko1 = givenReachedImport();
+
+      kernelStore.setReachableFlag('v1', ko1);
+      kernelStore.setReachableFlag('v1', ko1);
+
+      expect(kernelStore.getObjectRefCount(ko1)).toStrictEqual({
+        reachable: 1,
+        recognizable: 1,
+      });
+    });
+
+    it('clearReachableFlag is idempotent', () => {
+      const ko1 = givenReachedImport();
 
-      const refCounts = kernelStore.getObjectRefCount(ko1);
-      expect(refCounts.reachable).toBe(0);
+      kernelStore.clearReachableFlag('v1', ko1);
+      kernelStore.clearReachableFlag('v1', ko1);
+
+      expect(kernelStore.getObjectRefCount(ko1)).toStrictEqual({
+        reachable: 0,
+        recognizable: 1,
+      });
+    });
+
+    it('leaves an export entry alone: it carries no reachable count', () => {
+      const ko1 = kernelStore.initKernelObject('v1');
+      kernelStore.addCListEntry('v1', ko1, 'o+1');
+
+      expect(kernelStore.getReachableFlag('v1', ko1)).toBe(true);
+      kernelStore.setReachableFlag('v1', ko1);
+      expect(kernelStore.getObjectRefCount(ko1)).toStrictEqual({
+        reachable: 0,
+        recognizable: 0,
+      });
+
+      kernelStore.clearReachableFlag('v1', ko1);
+      expect(kernelStore.getReachableFlag('v1', ko1)).toBe(false);
+      expect(kernelStore.getObjectRefCount(ko1)).toStrictEqual({
+        reachable: 0,
+        recognizable: 0,
+      });
     });
   });
 });
diff --git a/packages/ocap-kernel/src/store/methods/reachable.ts b/packages/ocap-kernel/src/store/methods/reachable.ts
index 4caa2d0960..05e4c5f986 100644
--- a/packages/ocap-kernel/src/store/methods/reachable.ts
+++ b/packages/ocap-kernel/src/store/methods/reachable.ts
@@ -54,6 +54,32 @@ export function getReachableMethods(ctx: StoreContext) {
     return parseReachableAndVatSlot(data);
   }
 
+  /**
+   * Set the reachable flag for a given endpoint and kref.
+   *
+   * The counterpart to {@link clearReachableFlag}: this is how an object
+   * regains reachability when a vat that dropped it is handed it again.
+   * Idempotent, so repeated translations don't inflate the count.
+   *
+   * @param endpointId - The endpoint for which the reachable flag is being set.
+   * @param kref - The kref.
+   */
+  function setReachableFlag(endpointId: EndpointId, kref: KRef): void {
+    const key = getSlotKey(endpointId, kref);
+    const { isReachable, vatSlot } = getReachableAndVatSlot(endpointId, kref);
+    if (isReachable) {
+      return;
+    }
+    ctx.kv.set(key, buildReachableAndVatSlot(true, vatSlot));
+    const { direction, isPromise } = parseRef(vatSlot);
+    // increment 'reachable' part of refcount, but only for object imports
+    if (!isPromise && direction === 'import' && kernelRefExists(kref)) {
+      const counts = getObjectRefCount(kref);
+      counts.reachable += 1;
+      setObjectRefCount(kref, counts);
+    }
+  }
+
   /**
    * Clear the reachable flag for a given endpoint and kref.
    *
@@ -84,6 +110,7 @@ export function getReachableMethods(ctx: StoreContext) {
   return {
     getReachableFlag,
     getReachableAndVatSlot,
+    setReachableFlag,
     clearReachableFlag,
   };
 }
diff --git a/packages/ocap-kernel/src/store/methods/refcount-audit.test.ts b/packages/ocap-kernel/src/store/methods/refcount-audit.test.ts
new file mode 100644
index 0000000000..bccab4073e
--- /dev/null
+++ b/packages/ocap-kernel/src/store/methods/refcount-audit.test.ts
@@ -0,0 +1,307 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+
+import { makeMapKernelDatabase } from '../../../test/storage.ts';
+import type { KRef, VatConfig, VatId } from '../../types.ts';
+import { makeKernelStore } from '../index.ts';
+
+describe('reference count audit', () => {
+  let kernelStore: ReturnType<typeof makeKernelStore>;
+
+  /**
+   * Register and initialize an endpoint so it can hold c-list entries.
+   *
+   * @param vatIds - The vats to bring into existence.
+   */
+  function givenVats(...vatIds: VatId[]): void {
+    for (const vatId of vatIds) {
+      kernelStore.setVatConfig(vatId, { sourceSpec: 'x' } as VatConfig);
+      kernelStore.initEndpoint(vatId);
+    }
+  }
+
+  beforeEach(() => {
+    kernelStore = makeKernelStore(makeMapKernelDatabase());
+    kernelStore.markInitialized();
+    givenVats('v1', 'v2', 'v3');
+  });
+
+  describe('auditRefCounts', () => {
+    it('finds nothing wrong in an empty store', () => {
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it.each([
+      {
+        what: 'an export',
+        act: (kref: KRef) => kref,
+      },
+      {
+        what: 'an export plus one importer',
+        act: (kref: KRef) => {
+          kernelStore.translateRefKtoE('v2', kref, true);
+          return kref;
+        },
+      },
+      {
+        what: 'an export plus two importers',
+        act: (kref: KRef) => {
+          kernelStore.translateRefKtoE('v2', kref, true);
+          kernelStore.translateRefKtoE('v3', kref, true);
+          return kref;
+        },
+      },
+      {
+        what: 'a dropped import',
+        act: (kref: KRef) => {
+          kernelStore.translateRefKtoE('v2', kref, true);
+          kernelStore.clearReachableFlag('v2', kref);
+          return kref;
+        },
+      },
+      {
+        what: 'a retired import',
+        act: (kref: KRef) => {
+          kernelStore.translateRefKtoE('v2', kref, true);
+          kernelStore.clearReachableFlag('v2', kref);
+          kernelStore.forgetKref('v2', kref);
+          return kref;
+        },
+      },
+      {
+        what: 'a pin',
+        act: (kref: KRef) => {
+          kernelStore.pinObject(kref);
+          return kref;
+        },
+      },
+      {
+        what: 'a queued message',
+        act: (kref: KRef) => {
+          kernelStore.enqueueRun({
+            type: 'send',
+            target: kref,
+            message: { methargs: { body: '#[]', slots: [kref] }, result: null },
+          });
+          kernelStore.incrementRefCount(kref, 'queue|target');
+          kernelStore.incrementRefCount(kref, 'queue|slot');
+          return kref;
+        },
+      },
+    ])('holds for $what', ({ act }) => {
+      act(kernelStore.exportFromEndpoint('v1', 'o+1'));
+
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it('holds for a queued notification', () => {
+      const kpid = kernelStore.exportFromEndpoint('v1', 'p+1');
+      kernelStore.enqueueRun({ type: 'notify', endpointId: 'v2', kpid });
+      kernelStore.incrementRefCount(kpid, 'notify');
+
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it('holds for an unsettled promise with importers', () => {
+      const kpid = kernelStore.exportFromEndpoint('v1', 'p+1');
+      kernelStore.translateRefKtoE('v2', kpid, true);
+
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+      expect(kernelStore.getRefCount(kpid)).toBe(3);
+    });
+
+    it('holds for a settled promise whose value carries a slot', () => {
+      const koid = kernelStore.exportFromEndpoint('v1', 'o+1');
+      const kpid = kernelStore.exportFromEndpoint('v1', 'p+1');
+      kernelStore.incrementRefCount(koid, 'resolve|slot');
+      kernelStore.resolveKernelPromise(kpid, false, {
+        body: '#"$0"',
+        slots: [koid],
+      });
+
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it('reports counts that are too low', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v2', kref, true);
+      kernelStore.setObjectRefCount(kref, { reachable: 0, recognizable: 0 });
+
+      expect(kernelStore.auditRefCounts()).toStrictEqual([
+        {
+          kind: 'mismatch',
+          kref,
+          stored: '0,0',
+          expected: '1,1',
+          holders: ['v2 c-list import o-1'],
+        },
+      ]);
+    });
+
+    it('reports counts that are too high even though nothing underflowed', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.setObjectRefCount(kref, { reachable: 1, recognizable: 1 });
+
+      expect(kernelStore.auditRefCounts()).toStrictEqual([
+        { kind: 'mismatch', kref, stored: '1,1', expected: '0,0', holders: [] },
+      ]);
+    });
+
+    it('reports a reference to a kref that has been deleted', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v2', kref, true);
+      kernelStore.deleteKernelObject(kref);
+
+      expect(kernelStore.auditRefCounts()).toStrictEqual([
+        {
+          kind: 'dangling',
+          kref,
+          expected: '1,1',
+          holders: ['v2 c-list import o-1'],
+        },
+      ]);
+    });
+
+    it('does not mistake an owner for a referrer', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+
+      expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+        reachable: 0,
+        recognizable: 0,
+      });
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+  });
+
+  describe('assertRefCountsIfAuditing', () => {
+    it('does nothing while auditing is off', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.setObjectRefCount(kref, { reachable: 9, recognizable: 9 });
+
+      expect(() => kernelStore.assertRefCountsIfAuditing()).not.toThrow();
+    });
+
+    it('throws with the offending krefs once auditing is on', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.setObjectRefCount(kref, { reachable: 9, recognizable: 9 });
+      kernelStore.setRefCountAuditing(true);
+
+      expect(() => kernelStore.assertRefCountsIfAuditing()).toThrow(
+        `${kref}: stored 9,9, expected 0,0`,
+      );
+    });
+
+    it('stays quiet when the counts agree', () => {
+      kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.setRefCountAuditing(true);
+
+      expect(() => kernelStore.assertRefCountsIfAuditing()).not.toThrow();
+    });
+  });
+
+  describe('recomputeRefCounts', () => {
+    it('rebuilds counts written under the old accounting', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v2', kref, true);
+      kernelStore.translateRefKtoE('v3', kref, true);
+      // As the pre-fix kernel would have left it: born (1,1), with neither
+      // importer's c-list entry taking a reference. Two importers is the
+      // smallest topology where that disagrees with the truth — with one, the
+      // phantom baseline happens to come out to the right number.
+      kernelStore.setObjectRefCount(kref, { reachable: 1, recognizable: 1 });
+
+      const { corrected, unfixable } = kernelStore.recomputeRefCounts();
+
+      expect(corrected).toStrictEqual([
+        {
+          kind: 'mismatch',
+          kref,
+          stored: '1,1',
+          expected: '2,2',
+          holders: ['v2 c-list import o-1', 'v3 c-list import o-1'],
+        },
+      ]);
+      expect(unfixable).toStrictEqual([]);
+      expect(kernelStore.getObjectRefCount(kref)).toStrictEqual({
+        reachable: 2,
+        recognizable: 2,
+      });
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it('reports references it cannot repair', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v2', kref, true);
+      kernelStore.deleteKernelObject(kref);
+
+      const { corrected, unfixable } = kernelStore.recomputeRefCounts();
+
+      expect(corrected).toStrictEqual([]);
+      expect(unfixable).toHaveLength(1);
+      expect(unfixable[0]?.kref).toBe(kref);
+    });
+
+    it('rebuilds a promise count', () => {
+      const kpid = kernelStore.exportFromEndpoint('v1', 'p+1');
+      kernelStore.translateRefKtoE('v2', kpid, true);
+      // A promise has one undifferentiated count, so its repair goes down a
+      // different path from an object's pair.
+      kernelStore.incrementRefCount(kpid, 'phantom');
+      kernelStore.incrementRefCount(kpid, 'phantom');
+
+      const { corrected, unfixable } = kernelStore.recomputeRefCounts();
+
+      expect(corrected).toStrictEqual([
+        {
+          kind: 'mismatch',
+          kref: kpid,
+          stored: '5',
+          expected: '3',
+          holders: [
+            'unsettled promise',
+            'v1 c-list export p+1',
+            'v2 c-list import p-1',
+          ],
+        },
+      ]);
+      expect(unfixable).toStrictEqual([]);
+      expect(kernelStore.getRefCount(kpid)).toBe(3);
+      expect(kernelStore.auditRefCounts()).toStrictEqual([]);
+    });
+
+    it('queues krefs it zeroes for collection', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.setObjectRefCount(kref, { reachable: 1, recognizable: 1 });
+
+      kernelStore.recomputeRefCounts();
+      kernelStore.collectGarbage();
+
+      expect([...kernelStore.getGCActions()]).toStrictEqual([
+        `v1 dropExport ${kref}`,
+        `v1 retireExport ${kref}`,
+      ]);
+    });
+  });
+
+  describe('formatRefCountViolations', () => {
+    it('names the holders behind a mismatch', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.translateRefKtoE('v2', kref, true);
+      kernelStore.setObjectRefCount(kref, { reachable: 0, recognizable: 0 });
+
+      expect(
+        kernelStore.formatRefCountViolations(kernelStore.auditRefCounts()),
+      ).toBe(
+        `${kref}: stored 0,0, expected 1,1 (held by: v2 c-list import o-1)`,
+      );
+    });
+
+    it('says so when a mismatch has no holders at all', () => {
+      const kref = kernelStore.exportFromEndpoint('v1', 'o+1');
+      kernelStore.setObjectRefCount(kref, { reachable: 1, recognizable: 1 });
+
+      expect(
+        kernelStore.formatRefCountViolations(kernelStore.auditRefCounts()),
+      ).toBe(`${kref}: stored 1,1, expected 0,0 (held by: nothing)`);
+    });
+  });
+});
diff --git a/packages/ocap-kernel/src/store/methods/refcount-audit.ts b/packages/ocap-kernel/src/store/methods/refcount-audit.ts
new file mode 100644
index 0000000000..773fede93b
--- /dev/null
+++ b/packages/ocap-kernel/src/store/methods/refcount-audit.ts
@@ -0,0 +1,385 @@
+import type { CapData } from '@endo/marshal';
+
+import { getBaseMethods } from './base.ts';
+import { getObjectMethods } from './object.ts';
+import { getPinMethods } from './pinned.ts';
+import type { KRef, KernelMessage, RunQueueItem } from '../../types.ts';
+import type { StoreContext } from '../types.ts';
+import { parseRef } from '../utils/parse-ref.ts';
+import { isPromiseRef } from '../utils/promise-ref.ts';
+import { parseReachableAndVatSlot } from '../utils/reachable.ts';
+
+/**
+ * A kref whose stored reference counts disagree with the counts implied by the
+ * references the kernel can actually be seen to hold.
+ */
+export type RefCountViolation =
+  | {
+      /** The kref is still counted, just by the wrong amount. */
+      kind: 'mismatch';
+      kref: KRef;
+      /**
+       * The counts as stored, in the store's own encoding:
+       * `"reachable,recognizable"` for objects, a single number for promises.
+       */
+      stored: string;
+      /** The counts implied by `holders`, in the same encoding as `stored`. */
+      expected: string;
+      /** One entry per reference found, so a mismatch can be traced to its source. */
+      holders: string[];
+    }
+  | {
+      /**
+       * The kref has no refcount entry, so each entry in `holders` names
+       * something the kernel has already deleted. Rewriting a count cannot
+       * repair this.
+       */
+      kind: 'dangling';
+      kref: KRef;
+      /** The counts `holders` imply, which there is nothing left to credit. */
+      expected: string;
+      /** One entry per dangling reference found. */
+      holders: string[];
+    };
+
+/**
+ * The running total of references found for one kref. For a promise, which has
+ * only a single count, that count accumulates in `reachable`.
+ */
+type Tally = {
+  reachable: number;
+  recognizable: number;
+  holders: string[];
+};
+
+/** Matches the kref-keyed half of a c-list entry, e.g. `v1.c.ko3`. */
+const CLIST_KREF_KEY = /^([vr]\d+)\.c\.(k[op]\d+)$/u;
+
+/** Matches a queue entry (but not the queue's `head`/`tail` bookkeeping). */
+const QUEUE_ENTRY_KEY = /^queue\.([^.]+)\.(\d+)$/u;
+
+/** Matches the state record that exists for every live kernel promise. */
+const PROMISE_STATE_KEY = /^(kp\d+)\.state$/u;
+
+/** Matches the refcount record that exists for every live kernel object or promise. */
+const REFCOUNT_KEY = /^(k[op]\d+)\.refCount$/u;
+
+/**
+ * Get the methods that audit reference counts against ground truth.
+ *
+ * The kernel's reference counts are a cache: every unit of every count is owed
+ * to some reference the kernel is holding somewhere else in the store — a
+ * c-list entry, a queued message, a promise's resolution value, a pin. This
+ * module recomputes those counts from the references themselves and reports
+ * where the cache has drifted, in either direction. Counts that are too low
+ * let a live capability be collected; counts that are too high leak it.
+ *
+ * @param ctx - The store context.
+ * @returns The reference count audit methods.
+ */
+// eslint-disable-next-line @typescript-eslint/explicit-function-return-type
+export function getRefCountAuditMethods(ctx: StoreContext) {
+  const { getPrefixedKeys, refCountKey } = getBaseMethods(ctx.kv);
+  const { getObjectRefCount } = getObjectMethods(ctx);
+  const { getPinnedObjects } = getPinMethods(ctx);
+
+  /**
+   * Render a tally the way the store encodes it, so expected and stored values
+   * can be compared and reported as like for like.
+   *
+   * @param kref - The kref the counts belong to.
+   * @param counts - The counts to render.
+   * @param counts.reachable - The reachable count (the only count, for a promise).
+   * @param counts.recognizable - The recognizable count (ignored for a promise).
+   * @returns The encoded counts.
+   */
+  function renderCounts(
+    kref: KRef,
+    counts: { reachable: number; recognizable: number },
+  ): string {
+    return isPromiseRef(kref)
+      ? `${counts.reachable}`
+      : `${counts.reachable},${counts.recognizable}`;
+  }
+
+  /**
+   * Walk the whole store and total up, for every kref, the references the
+   * kernel is holding to it.
+   *
+   * The credits below mirror `incrementRefCount` case for case; when that
+   * function's rules change, these have to change with it.
+   *
+   * @returns A tally per kref that anything refers to.
+   */
+  function computeExpectedRefCounts(): Map<KRef, Tally> {
+    const tallies = new Map<KRef, Tally>();
+    // `retireKernelObjects` deletes an object and queues a `retireImport` for
+    // each importer in the same breath, so between then and the delivery an
+    // importer's c-list entry legitimately names a kref the kernel has already
+    // dropped. Those entries are scheduled for teardown and are not holders.
+    const retiring = new Set(
+      (JSON.parse(ctx.gcActions.get() ?? '[]') as string[]).filter((action) =>
+        action.includes(' retireImport '),
+      ),
+    );
+
+    const credit = (
+      kref: KRef,
+      holder: string,
+      { onlyRecognizable = false }: { onlyRecognizable?: boolean } = {},
+    ): void => {
+      let tally = tallies.get(kref);
+      if (!tally) {
+        tally = { reachable: 0, recognizable: 0, holders: [] };
+        tallies.set(kref, tally);
+      }
+      tally.holders.push(holder);
+      if (isPromiseRef(kref)) {
+        // Promises have a single count and no reachable/recognizable split.
+        tally.reachable += 1;
+        return;
+      }
+      if (!onlyRecognizable) {
+        tally.reachable += 1;
+      }
+      tally.recognizable += 1;
+    };
+
+    /**
+     * A queued message holds its result promise and every slot it carries.
+     *
+     * @param message - The queued message.
+     * @param holder - Description of the queue entry holding it.
+     */
+    const creditMessage = (message: KernelMessage, holder: string): void => {
+      if (message.result) {
+        credit(message.result, `${holder} result`);
+      }
+      for (const slot of message.methargs.slots) {
+        credit(slot, `${holder} slot`);
+      }
+    };
+
+    for (const key of getPrefixedKeys('')) {
+      const clistMatch = CLIST_KREF_KEY.exec(key);
+      if (clistMatch) {
+        const [, endpointId, kref] = clistMatch as unknown as [
+          string,
+          string,
+          KRef,
+        ];
+        const { isReachable, vatSlot } = parseReachableAndVatSlot(
+          ctx.kv.getRequired(key),
+        );
+        const { direction } = parseRef(vatSlot);
+        const holder = `${endpointId} c-list ${direction} ${vatSlot}`;
+        if (isPromiseRef(kref)) {
+          // Both directions count for a promise.
+          credit(kref, holder);
+        } else if (
+          direction === 'import' &&
+          !retiring.has(`${endpointId} retireImport ${kref}`)
+        ) {
+          // An object export is the owner's own entry and carries no count;
+          // an object import always recognizes and, while flagged, reaches.
+          credit(kref, holder, { onlyRecognizable: !isReachable });
+        }
+        continue;
+      }
+
+      const queueMatch = QUEUE_ENTRY_KEY.exec(key);
+      if (queueMatch) {
+        const [, queueName, seq] = queueMatch as unknown as [
+          string,
+          string,
+          string,
+        ];
+        const entry = ctx.kv.getRequired(key);
+        if (queueName === 'run') {
+          const item = JSON.parse(entry) as RunQueueItem;
+          if (item.type === 'send') {
+            credit(item.target, `run queue #${seq} send target`);
+            creditMessage(item.message, `run queue #${seq} send`);
+          } else if (item.type === 'notify') {
+            credit(item.kpid, `run queue #${seq} notify`);
+          }
+        } else {
+          const kpid = queueName as KRef;
+          const message = JSON.parse(entry) as KernelMessage;
+          credit(kpid, `${kpid} queue #${seq} target`);
+          creditMessage(message, `${kpid} queue #${seq}`);
+        }
+        continue;
+      }
+
+      const promiseMatch = PROMISE_STATE_KEY.exec(key);
+      if (promiseMatch) {
+        const kpid = promiseMatch[1] as KRef;
+        if (ctx.kv.getRequired(key) === 'unresolved') {
+          // The unit `initKernelPromise` mints, released when the promise settles.
+          credit(kpid, 'unsettled promise');
+        } else {
+          const value = JSON.parse(
+            ctx.kv.getRequired(`${kpid}.value`),
+          ) as CapData<KRef>;
+          for (const slot of value.slots) {
+            credit(slot, `${kpid} resolution slot`);
+          }
+        }
+      }
+    }
+
+    for (const kref of getPinnedObjects()) {
+      credit(kref, 'pin');
+    }
+
+    return tallies;
+  }
+
+  /**
+   * Collect every kref the store has a refcount entry for.
+   *
+   * @returns The krefs with refcount entries.
+   */
+  function getCountedKrefs(): KRef[] {
+    const krefs: KRef[] = [];
+    for (const key of getPrefixedKeys('')) {
+      const match = REFCOUNT_KEY.exec(key);
+      if (match) {
+        krefs.push(match[1] as KRef);
+      }
+    }
+    return krefs;
+  }
+
+  /**
+   * Compare every kref's stored reference counts against the references the
+   * kernel can be seen to hold.
+   *
+   * @returns The krefs whose counts disagree with ground truth, in kref order.
+   */
+  function auditRefCounts(): RefCountViolation[] {
+    const expected = computeExpectedRefCounts();
+    const violations: RefCountViolation[] = [];
+    const krefs = new Set<KRef>([...expected.keys(), ...getCountedKrefs()]);
+
+    for (const kref of [...krefs].sort()) {
+      const tally = expected.get(kref) ?? {
+        reachable: 0,
+        recognizable: 0,
+        holders: [],
+      };
+      const expectedText = renderCounts(kref, tally);
+      const raw = ctx.kv.get(refCountKey(kref));
+      if (raw === undefined) {
+        // The kref has been deleted from the kernel, so anything still
+        // pointing at it is a dangling reference.
+        if (tally.holders.length > 0) {
+          violations.push({
+            kind: 'dangling',
+            kref,
+            expected: expectedText,
+            holders: tally.holders,
+          });
+        }
+        continue;
+      }
+      const storedText = isPromiseRef(kref)
+        ? raw
+        : renderCounts(kref, getObjectRefCount(kref));
+      if (storedText !== expectedText) {
+        violations.push({
+          kind: 'mismatch',
+          kref,
+          stored: storedText,
+          expected: expectedText,
+          holders: tally.holders,
+        });
+      }
+    }
+    return violations;
+  }
+
+  /**
+   * Overwrite stored reference counts with the counts implied by ground truth.
+   *
+   * This is how a store written under the pre-fix accounting is brought onto
+   * the current scheme: the references themselves are authoritative, so the
+   * counts can simply be rebuilt from them. Krefs that are referenced but have
+   * already been deleted cannot be repaired this way and are reported instead.
+   *
+   * @returns The violations that were corrected and those that could not be.
+   */
+  function recomputeRefCounts(): {
+    corrected: RefCountViolation[];
+    unfixable: RefCountViolation[];
+  } {
+    const corrected: RefCountViolation[] = [];
+    const unfixable: RefCountViolation[] = [];
+    for (const violation of auditRefCounts()) {
+      if (violation.kind === 'dangling') {
+        unfixable.push(violation);
+        continue;
+      }
+      ctx.kv.set(refCountKey(violation.kref), violation.expected);
+      if (violation.expected.startsWith('0')) {
+        ctx.maybeFreeKrefs.add(violation.kref);
+      }
+      corrected.push(violation);
+    }
+    return { corrected, unfixable };
+  }
+
+  /**
+   * Render violations as a human-readable report.
+   *
+   * @param violations - The violations to describe.
+   * @returns A newline-separated report, one line per violation.
+   */
+  function formatRefCountViolations(violations: RefCountViolation[]): string {
+    return violations
+      .map((violation) => {
+        const { kref, expected, holders } = violation;
+        const stored =
+          violation.kind === 'dangling' ? '(deleted)' : violation.stored;
+        const held = holders.length > 0 ? holders.join(', ') : 'nothing';
+        return `${kref}: stored ${stored}, expected ${expected} (held by: ${held})`;
+      })
+      .join('\n');
+  }
+
+  /**
+   * Audit reference counts and throw if any have drifted. Enabled per kernel
+   * via the `auditRefCounts` option, and run at the end of every crank.
+   */
+  function assertRefCountsIfAuditing(): void {
+    if (!ctx.refCountAuditingEnabled) {
+      return;
+    }
+    const violations = auditRefCounts();
+    if (violations.length > 0) {
+      const report = formatRefCountViolations(violations);
+      // Logged as well as thrown: if this is the last crank before the kernel
+      // goes idle, nobody sends another message and the log is the only record.
+      ctx.logger?.error(`reference count invariant violated:\n${report}`);
+      throw Error(`reference count invariant violated:\n${report}`);
+    }
+  }
+
+  /**
+   * Turn the per-crank reference count audit on or off.
+   *
+   * @param enabled - Whether to audit after every crank.
+   */
+  function setRefCountAuditing(enabled: boolean): void {
+    ctx.refCountAuditingEnabled = enabled;
+  }
+
+  return {
+    auditRefCounts,
+    recomputeRefCounts,
+    formatRefCountViolations,
+    assertRefCountsIfAuditing,
+    setRefCountAuditing,
+  };
+}
diff --git a/packages/ocap-kernel/src/store/methods/translators.test.ts b/packages/ocap-kernel/src/store/methods/translators.test.ts
index 0ac95eafb0..fd1b5e1df6 100644
--- a/packages/ocap-kernel/src/store/methods/translators.test.ts
+++ b/packages/ocap-kernel/src/store/methods/translators.test.ts
@@ -14,6 +14,7 @@ import type {
 } from '../../types.ts';
 import type { StoreContext } from '../types.ts';
 import * as clistModule from './clist.ts';
+import * as reachableModule from './reachable.ts';
 import { getTranslators } from './translators.ts';
 import * as vatModule from './vat.ts';
 
@@ -22,6 +23,7 @@ describe('getTranslators', () => {
   const mockErefToKref = vi.fn();
   const mockAllocateErefForKref = vi.fn();
   const mockExportFromEndpoint = vi.fn();
+  const mockSetReachableFlag = vi.fn();
   const mockCtx = {} as StoreContext;
 
   beforeEach(() => {
@@ -33,6 +35,10 @@ describe('getTranslators', () => {
       allocateErefForKref: mockAllocateErefForKref,
     } as unknown as ReturnType<typeof clistModule.getCListMethods>);
 
+    vi.spyOn(reachableModule, 'getReachableMethods').mockReturnValue({
+      setReachableFlag: mockSetReachableFlag,
+    } as unknown as ReturnType<typeof reachableModule.getReachableMethods>);
+
     vi.spyOn(vatModule, 'getVatMethods').mockReturnValue({
       exportFromEndpoint: mockExportFromEndpoint,
     } as unknown as ReturnType<typeof vatModule.getVatMethods>);
diff --git a/packages/ocap-kernel/src/store/methods/translators.ts b/packages/ocap-kernel/src/store/methods/translators.ts
index c5948fedff..b7d418a1c3 100644
--- a/packages/ocap-kernel/src/store/methods/translators.ts
+++ b/packages/ocap-kernel/src/store/methods/translators.ts
@@ -21,6 +21,7 @@ import type {
 } from '../../types.ts';
 import type { StoreContext } from '../types.ts';
 import { getCListMethods } from './clist.ts';
+import { getReachableMethods } from './reachable.ts';
 import { getVatMethods } from './vat.ts';
 import { Fail, assert } from '../../utils/assert.ts';
 
@@ -35,6 +36,7 @@ import { Fail, assert } from '../../utils/assert.ts';
 // eslint-disable-next-line @typescript-eslint/explicit-function-return-type
 export function getTranslators(ctx: StoreContext) {
   const { krefToEref, erefToKref, allocateErefForKref } = getCListMethods(ctx);
+  const { setReachableFlag } = getReachableMethods(ctx);
   const { exportFromEndpoint } = getVatMethods(ctx);
 
   /**
@@ -54,6 +56,11 @@ export function getTranslators(ctx: StoreContext) {
   /**
    * Translate a reference from kernel space into endpoint space.
    *
+   * Translating is how the kernel hands an endpoint a reference, so it also
+   * re-establishes reachability: a vat given an object it previously dropped
+   * holds it live again. Garbage collection deliveries must not do this, and
+   * don't — they map through `krefsToErefs`, which never touches the flag.
+   *
    * @param endpointId - The endpoint for whom translation is desired.
    * @param kref - The KRef of the entity of interest.
    * @param importIfNeeded - If true, allocate a new clist entry if necessary;
@@ -74,6 +81,7 @@ export function getTranslators(ctx: StoreContext) {
         throw Fail`unmapped kref ${kref} endpoint=${endpointId}`;
       }
     }
+    setReachableFlag(endpointId, kref);
     if (isRemoteId(endpointId)) {
       // The import/export relationship between a vat and the kernel is
       // asymmetric -- the vat always exports to the kernel and imports from the
diff --git a/packages/ocap-kernel/src/store/methods/vat.test.ts b/packages/ocap-kernel/src/store/methods/vat.test.ts
index d04c609896..029cf31786 100644
--- a/packages/ocap-kernel/src/store/methods/vat.test.ts
+++ b/packages/ocap-kernel/src/store/methods/vat.test.ts
@@ -118,6 +118,7 @@ describe('vat store methods', () => {
     (getBaseMethods as ReturnType<typeof vi.fn>).mockReturnValue({
       getPrefixedKeys: mockGetPrefixedKeys,
       getSlotKey: mockGetSlotKey,
+      getCListPrefix: (endpointId: string) => `${endpointId}.c.`,
       getOwnerKey: mockGetOwnerKey,
     });
 
@@ -273,33 +274,26 @@ describe('vat store methods', () => {
     it('deletes all keys related to the endpoint', () => {
       const endpointId = 'e1';
 
-      // Setup mock data
-      mockKV.set(`cle.${endpointId}.obj1`, 'data1');
-      mockKV.set(`cle.${endpointId}.obj2`, 'data2');
-      mockKV.set(`clk.${endpointId}.prom1`, 'data3');
+      // The c-list holds both directions of each pair under one prefix
+      mockKV.set(`${endpointId}.c.o-1`, 'ko1');
+      mockKV.set(`${endpointId}.c.ko1`, 'R o-1');
+      mockKV.set(`${endpointId}.c.p+1`, 'kp1');
       mockKV.set(`e.nextObjectId.${endpointId}`, '10');
       mockKV.set(`e.nextPromiseId.${endpointId}`, '5');
 
-      mockGetPrefixedKeys.mockImplementation((prefix: string) => {
-        if (prefix === `cle.${endpointId}.`) {
-          return [`cle.${endpointId}.obj1`, `cle.${endpointId}.obj2`];
-        }
-        if (prefix === `clk.${endpointId}.`) {
-          return [`clk.${endpointId}.prom1`];
-        }
-        return [];
-      });
+      mockGetPrefixedKeys.mockImplementation((prefix: string) =>
+        [...mockKV.keys()].filter((key) => key.startsWith(prefix)),
+      );
 
       vatMethods.deleteEndpoint(endpointId);
 
-      expect(mockKV.has(`cle.${endpointId}.obj1`)).toBe(false);
-      expect(mockKV.has(`cle.${endpointId}.obj2`)).toBe(false);
-      expect(mockKV.has(`clk.${endpointId}.prom1`)).toBe(false);
+      expect(mockKV.has(`${endpointId}.c.o-1`)).toBe(false);
+      expect(mockKV.has(`${endpointId}.c.ko1`)).toBe(false);
+      expect(mockKV.has(`${endpointId}.c.p+1`)).toBe(false);
       expect(mockKV.has(`e.nextObjectId.${endpointId}`)).toBe(false);
       expect(mockKV.has(`e.nextPromiseId.${endpointId}`)).toBe(false);
 
-      expect(mockGetPrefixedKeys).toHaveBeenCalledWith(`cle.${endpointId}.`);
-      expect(mockGetPrefixedKeys).toHaveBeenCalledWith(`clk.${endpointId}.`);
+      expect(mockGetPrefixedKeys).toHaveBeenCalledWith(`${endpointId}.c.`);
     });
 
     it('does nothing if endpoint has no associated keys', () => {
@@ -309,8 +303,7 @@ describe('vat store methods', () => {
 
       expect(() => vatMethods.deleteEndpoint(endpointId)).not.toThrow();
 
-      expect(mockGetPrefixedKeys).toHaveBeenCalledWith(`cle.${endpointId}.`);
-      expect(mockGetPrefixedKeys).toHaveBeenCalledWith(`clk.${endpointId}.`);
+      expect(mockGetPrefixedKeys).toHaveBeenCalledWith(`${endpointId}.c.`);
     });
   });
 
@@ -470,11 +463,10 @@ describe('vat store methods', () => {
       expect(result).toBe('kp123');
       expect(mockInitKernelPromise).toHaveBeenCalled();
       expect(mockSetPromiseDecider).toHaveBeenCalledWith('kp123', vatId);
+      // addCListEntry takes the entry's reference; exportFromEndpoint no
+      // longer takes one of its own
       expect(mockAddCListEntry).toHaveBeenCalledWith(vatId, 'kp123', vref);
-      expect(mockIncrementRefCount).toHaveBeenCalledWith('kp123', 'export', {
-        isExport: true,
-        onlyRecognizable: true,
-      });
+      expect(mockIncrementRefCount).not.toHaveBeenCalled();
     });
 
     it('creates a kernel object for an exported object', () => {
@@ -486,10 +478,7 @@ describe('vat store methods', () => {
       expect(result).toBe('ko456');
       expect(mockInitKernelObject).toHaveBeenCalledWith(vatId);
       expect(mockAddCListEntry).toHaveBeenCalledWith(vatId, 'ko456', vref);
-      expect(mockIncrementRefCount).toHaveBeenCalledWith('ko456', 'export', {
-        isExport: true,
-        onlyRecognizable: true,
-      });
+      expect(mockIncrementRefCount).not.toHaveBeenCalled();
     });
 
     it('throws an error for non-export reference', () => {
@@ -566,38 +555,22 @@ describe('vat store methods', () => {
       });
     }
 
-    it("decrements the decider refcount for the peer's promise exports", () => {
+    it("releases the peer's promise exports through the c-list", () => {
       seedClist([['rp+1', 'kp123']]);
-      mockGetKernelPromise.mockReturnValue({ decider: endpointId });
 
       vatMethods.forgetEndpointImports(endpointId);
 
+      // The caller rejected the promises the peer was deciding first, which
+      // released the unsettled-promise reference; the entry's own reference is
+      // all that is left, and deleteCListEntry releases it.
       expect(mockDeleteCListEntry).toHaveBeenCalledWith(
         endpointId,
         'kp123',
         'rp+1',
       );
-      expect(mockDecrementRefCount).toHaveBeenCalledWith(
-        'kp123',
-        'cleanup|peerRestart|promise|decider',
-      );
     });
 
-    it('skips the decider decrement when the peer is no longer the decider', () => {
-      seedClist([['rp+1', 'kp123']]);
-      mockGetKernelPromise.mockReturnValue({ decider: 'someoneElse' });
-
-      vatMethods.forgetEndpointImports(endpointId);
-
-      expect(mockDeleteCListEntry).toHaveBeenCalledWith(
-        endpointId,
-        'kp123',
-        'rp+1',
-      );
-      expect(mockDecrementRefCount).not.toHaveBeenCalled();
-    });
-
-    it("releases the peer's object exports: owner, c-list, baseline refcount, GC", () => {
+    it("releases the peer's object exports: owner, c-list, GC", () => {
       seedClist([['ro+7', 'ko42']]);
       mockKV.set(`owner.ko42`, endpointId);
       mockGetReachableAndVatSlot.mockReturnValue({ vatSlot: 'ro+7' });
@@ -607,33 +580,29 @@ describe('vat store methods', () => {
       expect(mockKV.has(`owner.ko42`)).toBe(false);
       expect(mockKV.has(`slot.${endpointId}.ko42`)).toBe(false);
       expect(mockKV.has(`slot.${endpointId}.ro+7`)).toBe(false);
-      expect(mockDecrementRefCount).toHaveBeenCalledWith(
-        'ko42',
-        'cleanup|peerRestart|export|baseline',
-      );
       expect(mockMaybeFreeKrefs.add).toHaveBeenCalledWith('ko42');
-      // Object-export tear-down handles the c-list pair directly; we don't
-      // also call deleteCListEntry (which uses the recognizable-only path
-      // and would corrupt the count).
+      // An export entry carries no reference, so tearing it down changes no
+      // count; the object is simply orphaned for GC to retire.
+      expect(mockDecrementRefCount).not.toHaveBeenCalled();
       expect(mockDeleteCListEntry).not.toHaveBeenCalled();
     });
 
-    it('preserves baseline refcount when ownership has migrated', () => {
+    it('leaves the owner mapping alone when ownership has migrated', () => {
       seedClist([['ro+7', 'ko42']]);
       mockKV.set(`owner.ko42`, 'someoneElse');
       mockGetReachableAndVatSlot.mockReturnValue({ vatSlot: 'ro+7' });
 
       vatMethods.forgetEndpointImports(endpointId);
 
-      // Foreign owner survives — the baseline reference is theirs now.
       expect(mockKV.get(`owner.ko42`)).toBe('someoneElse');
-      // Our c-list pair is still torn down (the peer can't reach the kref
-      // through us anymore), but the refcount stays untouched so we don't
-      // corrupt the new owner's accounting.
+      // Our c-list pair is still torn down: the peer can't reach the kref
+      // through us anymore.
       expect(mockKV.has(`slot.${endpointId}.ko42`)).toBe(false);
       expect(mockKV.has(`slot.${endpointId}.ro+7`)).toBe(false);
       expect(mockDecrementRefCount).not.toHaveBeenCalled();
-      expect(mockMaybeFreeKrefs.add).not.toHaveBeenCalled();
+      // We dropped a reference to it, so it still goes to the collector — the
+      // new owner's mapping is what decides its fate from there.
+      expect(mockMaybeFreeKrefs.add).toHaveBeenCalledWith('ko42');
     });
 
     it('preserves our exports to the peer (import-direction entries)', () => {
diff --git a/packages/ocap-kernel/src/store/methods/vat.ts b/packages/ocap-kernel/src/store/methods/vat.ts
index 84e065ee55..c1875d8581 100644
--- a/packages/ocap-kernel/src/store/methods/vat.ts
+++ b/packages/ocap-kernel/src/store/methods/vat.ts
@@ -5,7 +5,6 @@ import { getCListMethods } from './clist.ts';
 import { getObjectMethods } from './object.ts';
 import { getPromiseMethods } from './promise.ts';
 import { getReachableMethods } from './reachable.ts';
-import { getRefCountMethods } from './refcount.ts';
 import type {
   EndpointId,
   KRef,
@@ -35,18 +34,14 @@ const VAT_CONFIG_BASE_LEN = VAT_CONFIG_BASE.length;
 // eslint-disable-next-line @typescript-eslint/explicit-function-return-type
 export function getVatMethods(ctx: StoreContext) {
   const { kv } = ctx;
-  const { getPrefixedKeys, getSlotKey, getOwnerKey } = getBaseMethods(ctx.kv);
+  const { getPrefixedKeys, getSlotKey, getCListPrefix, getOwnerKey } =
+    getBaseMethods(ctx.kv);
   const { deleteCListEntry } = getCListMethods(ctx);
   const { getReachableAndVatSlot } = getReachableMethods(ctx);
-  const {
-    initKernelPromise,
-    setPromiseDecider,
-    getKernelPromise,
-    addPromiseSubscriber,
-  } = getPromiseMethods(ctx);
+  const { initKernelPromise, setPromiseDecider, addPromiseSubscriber } =
+    getPromiseMethods(ctx);
   const { initKernelObject } = getObjectMethods(ctx);
   const { addCListEntry } = getCListMethods(ctx);
-  const { incrementRefCount, decrementRefCount } = getRefCountMethods(ctx);
 
   /**
    * Delete all persistent state associated with an endpoint.
@@ -54,10 +49,7 @@ export function getVatMethods(ctx: StoreContext) {
    * @param endpointId - The endpoint whose state is to be deleted.
    */
   function deleteEndpoint(endpointId: EndpointId): void {
-    for (const key of getPrefixedKeys(`cle.${endpointId}.`)) {
-      kv.delete(key);
-    }
-    for (const key of getPrefixedKeys(`clk.${endpointId}.`)) {
+    for (const key of getPrefixedKeys(getCListPrefix(endpointId))) {
       kv.delete(key);
     }
     kv.delete(`e.nextObjectId.${endpointId}`);
@@ -261,8 +253,8 @@ export function getVatMethods(ctx: StoreContext) {
       const { vatSlot } = getReachableAndVatSlot(vatID, kref);
       ctx.kv.delete(getSlotKey(vatID, kref));
       ctx.kv.delete(getSlotKey(vatID, vatSlot));
-      // Decrease refcounts that belonged to the terminating vat
-      decrementRefCount(kref, 'cleanup|export|baseline');
+      // An export entry holds no count, so there is nothing to release; the
+      // object is now orphaned, and GC retires it once importers let go.
       ctx.maybeFreeKrefs.add(kref);
       work.exports += 1;
     }
@@ -279,20 +271,16 @@ export function getVatMethods(ctx: StoreContext) {
       work.imports += 1;
     }
 
-    // The caller used enumeratePromisesByDecider() before calling us,
-    // so they have already rejected the orphan promises, but those
-    // kpids are still present in the dead vat's c-list. Clean those up now.
+    // The caller looked the orphan promises up with getPromisesByDecider() and
+    // rejected them before calling us; that rejection is what released each
+    // promise's unsettled reference. Their kpids are still in the dead vat's
+    // c-list, so clean those up now.
     for (const key of getPrefixedKeys(promisePrefix)) {
       const krefStr = ctx.kv.get<KRef>(key) ?? Fail`getNextKey ensures get`;
       assert(key.startsWith(clistPrefix), key);
       const vref = key.slice(clistPrefix.length) as ERef;
       // the following will also delete both db keys
       deleteCListEntry(vatID, krefStr, vref);
-      // If the dead vat was still the decider, drop the decider’s refcount, too.
-      const kp = getKernelPromise(krefStr);
-      if (kp.decider === vatID) {
-        decrementRefCount(krefStr, 'cleanup|promise|decider');
-      }
       work.promises += 1;
     }
 
@@ -374,49 +362,28 @@ export function getVatMethods(ctx: StoreContext) {
       }
       const { isPromise } = parseRef(eref);
       if (isPromise) {
-        // deleteCListEntry decrements the promise refcount via the
-        // recognizable path. Additionally, if the endpoint was still
-        // recorded as decider, drop the decider's reference too.
+        // The caller already rejected the promises this endpoint was deciding,
+        // so only the c-list entry's own reference is left.
         deleteCListEntry(endpointId, kref, eref);
-        const kp = getKernelPromise(kref);
-        if (kp.decider === endpointId) {
-          decrementRefCount(kref, 'cleanup|peerRestart|promise|decider');
-        }
       } else {
         // Object exports: drop the owner mapping if it still names the
-        // restarting endpoint, decrement the baseline refcount the kernel
-        // implicitly held while the endpoint owned the object, and queue
-        // it for GC. Then tear down the c-list pair.
-        //
-        // We deliberately do NOT call deleteCListEntry here: that path uses
-        // `onlyRecognizable: true`, which is the right semantics for an
-        // endpoint dropping its imports but the wrong semantics for
-        // releasing an export the endpoint owned. The baseline decrement
-        // below corresponds to the implicit reference exportFromEndpoint
-        // installed when the kernel object was first created.
+        // restarting endpoint, tear down the c-list pair, and queue the object
+        // for GC. An export entry holds no count, so this changes none. If
+        // ownership has migrated (e.g. a kernel-internal handoff), leave the
+        // new owner's mapping alone: the kref is theirs from here.
         const ownerKey = getOwnerKey(kref);
         const currentOwner = ctx.kv.get(ownerKey);
-        const stillOwned = currentOwner === endpointId;
-        if (stillOwned) {
+        if (currentOwner === endpointId) {
           ctx.kv.delete(ownerKey);
         } else if (currentOwner !== undefined) {
-          // Ownership has migrated (e.g. via a kernel-internal handoff).
-          // The baseline reference is now owed to the new owner; do not
-          // decrement against their accounting. Tear down our c-list pair
-          // and stop — the new owner is responsible for the kref's lifetime.
           ctx.logger?.warn(
             `forgetEndpointImports: kref ${kref} was exported by ${endpointId} ` +
-              `but is now owned by ${currentOwner}; preserving baseline refcount`,
+              `but is now owned by ${currentOwner}`,
           );
-          const { vatSlot } = getReachableAndVatSlot(endpointId, kref);
-          ctx.kv.delete(getSlotKey(endpointId, kref));
-          ctx.kv.delete(getSlotKey(endpointId, vatSlot));
-          continue;
         }
         const { vatSlot } = getReachableAndVatSlot(endpointId, kref);
         ctx.kv.delete(getSlotKey(endpointId, kref));
         ctx.kv.delete(getSlotKey(endpointId, vatSlot));
-        decrementRefCount(kref, 'cleanup|peerRestart|export|baseline');
         ctx.maybeFreeKrefs.add(kref);
       }
     }
@@ -441,11 +408,9 @@ export function getVatMethods(ctx: StoreContext) {
     } else {
       kref = initKernelObject(endpointId);
     }
+    // addCListEntry takes the entry's reference: none for an object, since the
+    // owner is not one of its referrers, and one for a promise.
     addCListEntry(endpointId, kref, eref);
-    incrementRefCount(kref, 'export', {
-      isExport: true,
-      onlyRecognizable: true,
-    });
     ctx.logger?.debug('exportFromEndpoint', endpointId, eref, kref);
     if (context === 'remote' && isPromise) {
       addPromiseSubscriber(endpointId, kref);
diff --git a/packages/ocap-kernel/src/store/types.ts b/packages/ocap-kernel/src/store/types.ts
index 1ea54d19cc..69b48f5794 100644
--- a/packages/ocap-kernel/src/store/types.ts
+++ b/packages/ocap-kernel/src/store/types.ts
@@ -27,6 +27,7 @@ export type StoreContext = {
   subclusters: StoredValue; // Holds Subcluster[]
   nextSubclusterId: StoredValue; // Holds string
   vatToSubclusterMap: StoredValue; // Holds Record<VatId, SubclusterId>
+  refCountAuditingEnabled: boolean; // If true, verify refcounts against ground truth every crank
   logger?: Logger | undefined;
 };
 
diff --git a/packages/ocap-kernel/src/vats/VatManager.ts b/packages/ocap-kernel/src/vats/VatManager.ts
index b90f6f30c8..b0f2bc8f86 100644
--- a/packages/ocap-kernel/src/vats/VatManager.ts
+++ b/packages/ocap-kernel/src/vats/VatManager.ts
@@ -123,13 +123,42 @@ export class VatManager {
         cause: error,
       });
     }
-    this.#kernelStore.initEndpoint(vatId);
-    const rootRef = this.#kernelStore.exportFromEndpoint(
-      vatId,
-      ROOT_OBJECT_VREF,
-    );
-    this.#kernelStore.setVatConfig(vatId, vatConfig);
-    return rootRef;
+    try {
+      this.#kernelStore.initEndpoint(vatId);
+      const rootRef = this.#kernelStore.exportFromEndpoint(
+        vatId,
+        ROOT_OBJECT_VREF,
+      );
+      // A root is addressable for as long as its vat lives, whether or not
+      // anyone currently imports it: the kernel's own API hands out root krefs
+      // and `getRootObject` resolves them through this c-list entry. Without a
+      // pin, GC would retire the entry the moment the last importer let go.
+      this.#kernelStore.pinObject(rootRef);
+      this.#kernelStore.setVatConfig(vatId, vatConfig);
+      return rootRef;
+    } catch (error) {
+      // The worker is already running, so leaving it would strand a vat the
+      // kernel has no record of. Tear it down before reporting the failure.
+      let stopFailure: unknown;
+      try {
+        await this.stopVat(vatId, true);
+      } catch (caught) {
+        stopFailure = caught;
+        this.#logger.error(
+          `Failed to stop vat ${vatId} after incomplete launch; its worker may still be running:`,
+          caught,
+        );
+      }
+      // `stopVat` only tears down the worker. Whatever store records the
+      // partial launch did write — the endpoint counters, the root's c-list
+      // pair, its owner entry — are reclaimed by the terminated-vat cleanup,
+      // which never runs unless the vat is marked.
+      this.#kernelStore.markVatAsTerminated(vatId);
+      throw new Error(
+        `Failed to launch vat ${vatId} (${vatName})${stopFailure ? ' (cleanup also failed)' : ''}`,
+        { cause: error },
+      );
+    }
   }
 
   /**
@@ -186,6 +215,14 @@ export class VatManager {
     } else if (terminating) {
       terminationError = new VatDeletedError(vatId);
     }
+    if (terminating) {
+      // Release the pin `launchVat` took, so the root can be collected once
+      // its importers let go. A restart keeps it: the same root comes back.
+      const rootRef = this.#kernelStore.getRootObject(vatId);
+      if (rootRef) {
+        this.#kernelStore.unpinObject(rootRef);
+      }
+    }
     await this.#platformServices
       .terminate(vatId, terminationError)
       .catch(this.#logger.error);
diff --git a/packages/ocap-kernel/src/vats/VatSyscall.test.ts b/packages/ocap-kernel/src/vats/VatSyscall.test.ts
index 04a0e8bf42..bf425bc23b 100644
--- a/packages/ocap-kernel/src/vats/VatSyscall.test.ts
+++ b/packages/ocap-kernel/src/vats/VatSyscall.test.ts
@@ -30,6 +30,9 @@ describe('VatSyscall', () => {
       clearReachableFlag: vi.fn(),
       getReachableFlag: vi.fn(),
       forgetKref: vi.fn(),
+      // Only an owner may disown an object, so the cleanup syscalls check first
+      getOwner: vi.fn().mockReturnValue('v1'),
+      orphanKernelObject: vi.fn(),
       getVatConfig: vi.fn(() => ({})),
       isVatActive: vi.fn(() => true),
       isInCrank: vi.fn(() => true),