fix(cli): name the stderr error listener so the pin can see it

The first ablation of this change caught a phantom check in its own pin: a
probe polling `process.stderr.listenerCount('error') > 0` reported
`LISTENER ATTACHED after 20 ms` against a tree with the whole listener
block deleted. Node parks an anonymous `once('error', noop)` on this stream
for the duration of every `console.error` (`ignoreErrors`), so a count
cannot tell this listener apart from that one, and the poll doubled as the
probe's only synchronisation point — a slow box would have written before
the attach and red a working tree.

The listener is named, the probe waits for that name, and a parity case
holds the probe's mirror equal to the entry's spelling.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFY46JydE1gMxQG1TqBcMZ

Author: claude

packages/cli/bin/run.js

@@ -137,7 +137,14 @@ try {
  * it is a real behaviour change for a supervisor that destroyed the read end
  * and relied on the crash to end the child.
  */
-process.stderr.on('error', () => {
+// ⚠️ NAMED, and not for tidiness. Node parks an anonymous `once('error')` on
+// this stream for the duration of a `console.error` (`ignoreErrors`), so
+// "something is listening" is briefly true in any process and cannot tell this
+// listener apart from that one — a pin that polled the COUNT passed against a
+// tree with this whole block deleted, measured. The name is what
+// `published-entry-stderr-error-listener.e2e.test.ts` waits for and asserts on;
+// it also puts a legible frame in any listener dump.
+process.stderr.on('error', function objectstackStderrErrorIsNotFatal() {
   // Nothing to report, and nowhere left to report it.
 });
 

packages/cli/test/fixtures/published-entry-stderr-error-probe.mjs

@@ -40,6 +40,16 @@
  * Markers go to a file: stderr is the thing under test and, on the arm that is
  * supposed to fail, the thing that is already broken.
  *
+ * ## Why it waits for a NAMED listener and not for a count
+ *
+ * Node parks an anonymous `once('error', noop)` on this stream for the duration
+ * of every `console.error` (`ignoreErrors`), so `listenerCount('error') > 0` is
+ * briefly true in any process. An earlier version of this probe polled the
+ * count, and under the ablation that deletes the entry's listener entirely it
+ * still reported `LISTENER ATTACHED after 20 ms` — a green reading against a
+ * tree with nothing guarding it. The name is the only thing that identifies
+ * THIS listener, so it is what the poll waits for.
+ *
  * env: `OS_PUBLISHED_ENTRY_ERROR_PROBE_MARKS` — the marker file.
  * env: `OS_PUBLISHED_ENTRY_ERROR_PROBE_ARM`   — `guarded` (default) | `unguarded`.
  */
@@ -67,6 +77,18 @@ const ATTACH_WAIT_MS = 15_000;
 /** Comfortably finer than anything being timed. */
 const POLL_MS = 10;
 
+/**
+ * The listener `bin/run.js` attaches, by name. Mirrored rather than imported —
+ * that file runs the CLI at module top, so there is nothing to import from it —
+ * and held equal to the entry's spelling by a case in the driving suite, the
+ * same discipline `run-dev-unbuilt-workspace.e2e.test.ts` uses for the shim's
+ * drain bound.
+ */
+const LISTENER_NAME = 'objectstackStderrErrorIsNotFatal';
+
+/** Is the entry's OWN listener on the stream right now? */
+const guardAttached = () => process.stderr.listeners('error').some((fn) => fn?.name === LISTENER_NAME);
+
 /**
  * ⛔ This probe installs NO `error` listener of its own on `process.stderr`.
  * `uncaughtExceptionMonitor` observes the default action without preventing it,
@@ -103,13 +125,15 @@ function writeAndOutliveIt() {
 
 let waited = 0;
 const poll = setInterval(() => {
-  const attached = process.stderr.listenerCount('error') > 0;
+  const attached = guardAttached();
   if (!attached && waited < ATTACH_WAIT_MS) {
     waited += POLL_MS;
     return;
   }
   clearInterval(poll);
   mark(attached ? `LISTENER ATTACHED after ${waited} ms` : `LISTENER ABSENT after ${waited} ms`);
+  // The raw count too, as EVIDENCE in a failure message — never as the oracle.
+  mark(`LISTENERS count=${process.stderr.listenerCount('error')}`);
   if (UNGUARDED) {
     // The live positive control — in this process only, never on disk.
     process.stderr.removeAllListeners('error');

packages/cli/test/published-entry-stderr-error-listener.e2e.test.ts

@@ -60,8 +60,8 @@
  * between the two entries is what #15564 refused to accept as evidence, and a
  * case asserting it would smuggle that reading back in.
  *
- * The reachability half is not left unheld either — case 3 keeps the premise
- * the measurement rests on: `serve` still writes to stderr RAW.
+ * The reachability half is not left unheld either — the last case below keeps
+ * the premise the measurement rests on: `serve` still writes to stderr RAW.
  */
 
 import { spawn } from 'node:child_process';
@@ -166,21 +166,46 @@ afterAll(() => {
 });
 
 describe('the published entry point survives a failed stderr write', () => {
-  it('attaches the listener before anything of its own can write', () => {
+  it('attaches its OWN listener before anything of its own can write', () => {
     // The probe reports what it SAW rather than being assumed to have found it:
     // `LISTENER ABSENT` is the reading when `bin/run.js` stops attaching one,
     // and it is a different sentence from "the probe never ran".
+    //
+    // ⚠️ It looks for the listener BY NAME, and that is a correction rather
+    // than a flourish: node parks an anonymous `once('error', noop)` across
+    // every `console.error`, so a count-based version of this case reported
+    // `LISTENER ATTACHED after 20 ms` against a tree with the whole block
+    // deleted — measured, under the ablation below. The count is carried in
+    // the markers as evidence and decides nothing.
     expect(
       guarded.marks,
       `the probe never reached the listener check, so it measured NOTHING — a zero reading, not a pass. Markers:\n${guarded.marks}`,
     ).toMatch(/LISTENER (ATTACHED|ABSENT)/);
     expect(
       guarded.marks,
-      `bin/run.js no longer attaches an \`error\` listener to process.stderr — a failed stderr write is an ` +
+      `bin/run.js no longer attaches its \`error\` listener to process.stderr — a failed stderr write is an ` +
         `uncaught exception again on the entry point a customer's install runs (#14858, #15564). Markers:\n${guarded.marks}`,
     ).toContain('LISTENER ATTACHED');
   });
 
+  it("keeps the probe's mirror of the listener name equal to the entry's own", () => {
+    // The probe cannot import the name — `bin/run.js` runs the CLI at module
+    // top — so it mirrors it, and a mirror with nothing holding it is how a
+    // synchronisation point ends up waiting for a spelling that moved. Same
+    // discipline as `run-dev-unbuilt-workspace.e2e.test.ts` keeps over the
+    // shim's drain bound. ⛔ A renamed listener would not red the cases above:
+    // the probe would simply time out and write early, which on a fast box
+    // still survives.
+    const mirrored = /const LISTENER_NAME = '([A-Za-z0-9_$]+)';/.exec(readFileSync(PROBE, 'utf8'))?.[1];
+    expect(mirrored, `no LISTENER_NAME declaration found in ${PROBE}`).toBeDefined();
+    const entry = maskComments(readFileSync(RUN_JS, 'utf8'));
+    expect(
+      entry,
+      `${RUN_JS} does not attach a listener named ${mirrored}, which is the name the probe waits for — ` +
+        `either the entry renamed it or it stopped attaching one at all.`,
+    ).toContain(`function ${mirrored}(`);
+  });
+
   it('outlives a failed write and ends with its own status, not a crash', () => {
     const evidence = `ceiling ${HARD_CAP_MS} ms (constant, load-independent by design); this child ran ${guarded.elapsedMs} ms. Markers:\n${guarded.marks}`;
     expect(guarded.marks, `the probe never made its write. ${evidence}`).toContain('WROTE');