From 5e25639130370778ae4e886ecf22ce8ee67d639d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 5 Sep 2026 13:10:21 +0000
Subject: [PATCH 1/3] test(cli): hoist the serve-probe child-lifecycle
 attribution and pin it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three more e2e files here fetched a spawned `os serve` with no read of the
child's fate on the failing path: `child.on('exit')` fed the READINESS promise
only, so a death after readiness reached vitest as a bare `TypeError: fetch
failed` with no exit code, no stdout and no stderr.

The idiom that repaired the fourth file is hoisted into
`test/helpers/serve-process.ts` as `probeThroughChild()` and all four files now
consume it, so the family has one definition rather than four copies — and one
pin, `serve-probe-child-attribution.test.ts`, which drives a real child that
accepts the whole request and then FINs.

No skip, no todo, no quarantine, no timeout bump.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
---
 packages/cli/test/helpers/serve-process.ts    | 237 +++++++++++
 ...serve-mcp-capability-collision.e2e.test.ts | 129 ++++--
 .../test/serve-mcp-stdio-answers.e2e.test.ts  |  61 ++-
 ...ve-node-env-production-default.e2e.test.ts | 214 ++--------
 .../serve-probe-child-attribution.test.ts     | 371 ++++++++++++++++++
 .../test/serve-process-child-env.e2e.test.ts  |  48 ++-
 6 files changed, 823 insertions(+), 237 deletions(-)
 create mode 100644 packages/cli/test/serve-probe-child-attribution.test.ts

diff --git a/packages/cli/test/helpers/serve-process.ts b/packages/cli/test/helpers/serve-process.ts
index 49b5d9ec05..37deedfd2d 100644
--- a/packages/cli/test/helpers/serve-process.ts
+++ b/packages/cli/test/helpers/serve-process.ts
@@ -927,3 +927,240 @@ export function runServe(
     child.on('exit', () => finish());
   });
 }
+
+// ─────────────────────────────────────────────────────────────────────────
+// CHILD-LIFECYCLE ATTRIBUTION FOR AN HTTP PROBE AGAINST A SPAWNED `os serve`
+//
+// ## The defect this section removes
+//
+// A file here boots `os serve`, waits for its banner, and then `fetch`es it.
+// Every one of them fed `child.on('exit')` into the READINESS promise ONLY, so
+// once readiness had settled a later death was invisible: the rejection reached
+// vitest as a bare `TypeError: fetch failed` with no exit code, no stdout and no
+// stderr. One such occurrence was recorded in a merge-group run and could not be
+// attributed at all — the probe had discarded the only two artefacts that decide
+// between "the child died" and "a live child dropped a connection".
+//
+// ## What the recorded signature actually said
+//
+// Three shapes measured side by side on this container, with the same request
+// the origin probes send:
+//
+//     nothing listening on the port    ECONNREFUSED, and NO socket object
+//                                      (bytesWritten/bytesRead both undefined)
+//     listener accepts, then FINs      UND_ERR_SOCKET "other side closed",
+//                                      bytesWritten 321, bytesRead 0
+//     server torn down mid-request     UND_ERR_SOCKET "other side closed",
+//                                      bytesWritten 345, bytesRead 0
+//
+// `bytesWritten: 349, bytesRead: 0` — what the merge-group run recorded — says
+// the connection was ESTABLISHED, the whole request was delivered, and the peer
+// closed it without answering. Only the second and third match; the FIRST is
+// what a genuine readiness race looks like. So the child was serving when the
+// request arrived, and something ended the connection after it. ⛔ The repair is
+// therefore not a longer wait and ⛔ not a bigger timeout.
+//
+// It matters that a silent death is reachable at all: there is no
+// `process.on('uncaughtException')` and no `'unhandledRejection'` handler
+// anywhere in this repo's product source, so a late async throw inside the child
+// — or an OOM kill on a six-shard CI box — takes the process down with no HTTP
+// answer and exactly this client-side signature.
+//
+// ## The bound, and what it can and cannot hide
+//
+// ⛔ The retry is not the first move and cannot be reached before the child has
+// been asked whether it is alive. On a transport failure the probe waits up to
+// `settleMs` for the child's `exit` event — the FIN reaches the client on the
+// network's schedule and `exit` arrives on the event loop's, so reading
+// `exitCode` at the instant `fetch` rejects reports a dead child as ALIVE — and
+// then:
+//
+//   • child EXITED ⇒ ⛔ never retried. Fails at once, naming the exit code and
+//     signal and quoting the child's whole stdout and stderr.
+//   • failure is NOT `UND_ERR_SOCKET` ⇒ ⛔ never retried. Rethrown with the
+//     child's output attached. ECONNREFUSED (nothing listening), a timeout, a
+//     DNS or a TLS fault each still fail on their first occurrence.
+//   • child ALIVE and `UND_ERR_SOCKET` ⇒ absorbed, up to `attempts` in total.
+//
+// ⛔ CANNOT hide a wrong ANSWER. The loop absorbs transport failures only; a
+// `200` where the pin wants `403` is returned to the caller untouched, on the
+// first attempt, every time. Nor can it hide a boot that never reaches the
+// banner: that is the caller's readiness rejection, which this does not touch.
+//
+// ⚠️ CAN hide a LIVE `os serve` that occasionally destroys a connection without
+// answering it. That is a real product-defect class and this bound does not
+// remove it. What it does is make every occurrence print
+// `[<label>] absorbed a transport failure` with the full socket signature, so a
+// recurring one is a `grep` away in a CI log instead of a merge-queue eviction.
+// ⛔ If that line starts appearing, the finding is in `os serve` and belongs in a
+// card against it — do not raise `attempts` to make it stop.
+//
+// ⛔ And the line these files may never cross, restated because they are slow and
+// their subject is unglamorous: no `.skip`, no `.todo`, no quarantine list, no
+// retry that swallows a failure into silence. A flake in a required shard is a
+// harness bug to diagnose, never a licence to stop measuring.
+// ─────────────────────────────────────────────────────────────────────────
+
+/** How many times one probe may be re-sent, in total, across all attempts. */
+export const PROBE_ATTEMPTS = 3;
+
+/**
+ * How long a probe gives the child's `exit` event before it will call the child
+ * alive — see the section above for why that answer cannot be read
+ * synchronously off `exitCode`.
+ *
+ * Two seconds because this is a LOCAL child whose exit has already happened by
+ * the time its FIN reached us; the wait covers event-loop delivery, not process
+ * teardown. It is paid ONLY on a failing attempt, so a green run never waits.
+ */
+export const CHILD_EXIT_SETTLE_MS = 2_000;
+
+/** The child's lifecycle state, as far as this process can observe it. */
+export interface ChildFate {
+  exited: boolean;
+  code: number | null;
+  signal: NodeJS.Signals | null;
+}
+
+/**
+ * The child surface these lifecycle reads need, spelled structurally.
+ *
+ * Deliberately NOT `ChildProcess`: the files here spawn with different `stdio`
+ * tuples and so hold differently-typed handles (`ChildProcessByStdio<null,
+ * Readable, Readable>`, `ChildProcessWithoutNullStreams`). Naming only the four
+ * members actually read keeps every one of them assignable without a cast.
+ */
+export interface LifecycleChild {
+  exitCode: number | null;
+  signalCode: NodeJS.Signals | null;
+  once(event: 'exit', listener: () => void): unknown;
+  off(event: 'exit', listener: () => void): unknown;
+}
+
+export function fateOf(child: LifecycleChild): ChildFate {
+  return {
+    exited: child.exitCode !== null || child.signalCode !== null,
+    code: child.exitCode,
+    signal: child.signalCode,
+  };
+}
+
+/** Ask the child whether it is still running, allowing `ms` for the answer. */
+export function settleChildFate(child: LifecycleChild, ms: number): Promise<ChildFate> {
+  const already = fateOf(child);
+  if (already.exited) return Promise.resolve(already);
+  return new Promise<ChildFate>((settle) => {
+    const onExit = () => {
+      clearTimeout(timer);
+      settle(fateOf(child));
+    };
+    const timer = setTimeout(() => {
+      child.off('exit', onExit);
+      settle(fateOf(child));
+    }, ms);
+    child.once('exit', onExit);
+  });
+}
+
+/** `cause.code` of a `fetch` rejection, when it carries one. */
+export function transportCode(err: unknown): string | undefined {
+  const cause = (err as { cause?: { code?: unknown } } | undefined)?.cause;
+  return typeof cause?.code === 'string' ? cause.code : undefined;
+}
+
+/**
+ * One line naming what the transport did — the exact fields the recorded
+ * failure had to be diagnosed from, kept together so the NEXT occurrence needs
+ * no second run to be readable.
+ */
+export function transportSignature(err: unknown): string {
+  const cause = (err as {
+    cause?: { code?: unknown; message?: unknown; socket?: Record<string, unknown> };
+  } | undefined)?.cause;
+  const socket = cause?.socket;
+  const wire = socket
+    ? ` socket: bytesWritten=${String(socket.bytesWritten)} bytesRead=${String(socket.bytesRead)}`
+      + ` local=${String(socket.localAddress)}:${String(socket.localPort)}`
+      + ` remote=${String(socket.remoteAddress)}:${String(socket.remotePort)}`
+    : ' socket: none — the connection was never established';
+  return `${(err as Error)?.message ?? String(err)}`
+    + ` [cause ${String(cause?.code ?? 'none')}: ${String(cause?.message ?? 'none')}]${wire}`;
+}
+
+export interface ChildProbeOptions {
+  /** The spawned `os serve` the request is addressed to. */
+  child: LifecycleChild;
+  /**
+   * Everything the child has printed so far. Read at THROW time, not at call
+   * time, so a failure carries the crash the child printed on its way down
+   * rather than the buffer as it stood when the probe started.
+   */
+  transcript: () => string;
+  /** The file's own tag, for the greppable absorbed-failure line. */
+  label: string;
+  /** What is being asked of the child, e.g. `the origin probe on port 41234`. */
+  what: string;
+  attempts?: number;
+  settleMs?: number;
+}
+
+/**
+ * Run one HTTP exchange against a spawned `os serve` and, if the transport
+ * fails, say WHY — naming the child's exit status and quoting everything it
+ * printed. See the section above for the bound and its fences.
+ *
+ * `request` must perform the whole exchange it wants attributed, body read
+ * included: a connection torn down mid-body rejects out of `res.json()` /
+ * `res.text()`, not out of `fetch()`, and a thunk that returns the bare
+ * `Response` leaves that half unattributed.
+ */
+export async function probeThroughChild<T>(
+  options: ChildProbeOptions,
+  request: () => Promise<T>,
+): Promise<T> {
+  const attempts = options.attempts ?? PROBE_ATTEMPTS;
+  const settleMs = options.settleMs ?? CHILD_EXIT_SETTLE_MS;
+  const absorbed: string[] = [];
+
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      return await request();
+    } catch (probeErr) {
+      const signature = transportSignature(probeErr);
+      // ⛔ Ask the child FIRST, and wait for the answer: a dead child must never
+      // reach the absorb branch below.
+      const fate = await settleChildFate(options.child, settleMs);
+      if (fate.exited) {
+        throw new Error(
+          `os serve DIED while answering ${options.what} — exit code ${String(fate.code)}, `
+          + `signal ${String(fate.signal)}. This is the CHILD's failure, not a dropped socket, so `
+          + 'it is NOT retried; the transcript below is what it printed on its way down.\n'
+          + `attempt ${attempt}/${attempts}: ${signature}${options.transcript()}`,
+        );
+      }
+      if (transportCode(probeErr) !== 'UND_ERR_SOCKET') {
+        throw new Error(
+          `${options.what} failed with a transport error this harness does not absorb — only `
+          + 'UND_ERR_SOCKET against a still-running child is absorbed, and only '
+          + `${attempts} times (see PROBE_ATTEMPTS).\n`
+          + `attempt ${attempt}/${attempts}: ${signature}${options.transcript()}`,
+        );
+      }
+      absorbed.push(`attempt ${attempt}/${attempts}: ${signature}`);
+      // Loud on purpose. An absorbed failure that printed nothing would be the
+      // "retry into silence" this harness forbids; this line is what makes a
+      // recurring one greppable in a CI log.
+      console.error(
+        `[${options.label}] absorbed a transport failure from a STILL-RUNNING os serve during `
+        + `${options.what} (attempt ${attempt}/${attempts}) — ${signature}`,
+      );
+    }
+  }
+
+  throw new Error(
+    `${options.what} never completed a request against os serve after ${attempts} attempts. The `
+    + `child was still running ${settleMs} ms after EVERY one of them, so this is a live server `
+    + 'dropping connections, not a dead child — the finding is in os serve, not in this '
+    + `harness.\n${absorbed.join('\n')}${options.transcript()}`,
+  );
+}
diff --git a/packages/cli/test/serve-mcp-capability-collision.e2e.test.ts b/packages/cli/test/serve-mcp-capability-collision.e2e.test.ts
index ef3af2aab4..7a007fd1e9 100644
--- a/packages/cli/test/serve-mcp-capability-collision.e2e.test.ts
+++ b/packages/cli/test/serve-mcp-capability-collision.e2e.test.ts
@@ -52,6 +52,7 @@ import {
   E2E_SECRET_KEY,
   RUN_JS_RESOLVES_FROM_DIST,
   childEnv,
+  probeThroughChild,
   randomPort,
   requireBuiltCli,
 } from './helpers/serve-process.js';
@@ -141,6 +142,15 @@ let apiKey: string;
  * assertions below look for arrives on stderr.
  */
 let bootOutput = '';
+/**
+ * The boot's stdout. Kept alongside {@link bootOutput} for #15653's transcript:
+ * `serve` keeps stdout clear for the MCP stdio transport, so it is normally
+ * empty — and that is exactly why a crash that DOES land on it must not be the
+ * one thing a failure message cannot show.
+ */
+let bootStdout = '';
+/** The serving child every probe below is addressed to, for #15653's fate read. */
+let serveChild: ChildProcessWithoutNullStreams | undefined;
 const children: ChildProcessWithoutNullStreams[] = [];
 
 function boot(env: Record<string, string | undefined>, waitFor: RegExp): Promise<ChildProcessWithoutNullStreams> {
@@ -214,6 +224,7 @@ function boot(env: Record<string, string | undefined>, waitFor: RegExp): Promise
 
     const onOutput = () => {
       bootOutput = err;
+      bootStdout = out;
       if (settled) return;
       // ⭐ #12526: the child is the authority on which port it bound, so read it
       // back before handing this boot to assertions that will use `port`.
@@ -333,17 +344,61 @@ async function stop(child: ChildProcessWithoutNullStreams): Promise<void> {
   });
 }
 
-/** POST a JSON-RPC frame to the HTTP MCP transport with the minted key. */
-async function rpc(method: string, params: unknown, id: number): Promise<Response> {
-  return fetch(`${base}/mcp`, {
-    method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-      // The transport negotiates both; SSE is what an MCP client sends.
-      accept: 'application/json, text/event-stream',
-      authorization: `Bearer ${apiKey}`,
+/**
+ * ⭐ #15653. `boot()`'s `child.on('exit')` handler feeds the READINESS promise
+ * ONLY — it returns early once `settled` — so a death AFTER readiness is
+ * invisible to it, and every request in this file used to reach vitest as a bare
+ * `TypeError: fetch failed` with no exit code, no stdout and no stderr.
+ * `probeThroughChild()` is where the child's fate is read instead; its own
+ * section in `helpers/serve-process.ts` carries the measurement, the bound and
+ * the fences (⛔ no skip, no quarantine, no timeout bump).
+ *
+ * The transcript is read at THROW time, so a failure carries what the child
+ * printed on its way down rather than the buffer as it stood at ready.
+ *
+ * ⛔ An ASSERTION must never go inside `request`: the guard reads any throw as a
+ * transport failure, so a wrong answer would be reported as a dropped socket.
+ */
+function probe<T>(what: string, request: () => Promise<T>): Promise<T> {
+  if (!serveChild) throw new Error('probe() called before the serving child was booted');
+  return probeThroughChild(
+    {
+      child: serveChild,
+      transcript: () =>
+        `\n--- child stdout ---\n${bootStdout}\n--- child stderr ---\n${bootOutput}`,
+      label: 'serve-mcp-capability-collision',
+      what: `${what} on port ${port}`,
     },
-    body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
+    request,
+  );
+}
+
+/**
+ * POST a JSON-RPC frame to the HTTP MCP transport with the minted key, and read
+ * its answer back.
+ *
+ * ⛔ The frame read is INSIDE the guard on purpose: an SSE stream torn down
+ * mid-body rejects out of `res.text()` rather than out of `fetch()`, and a
+ * helper that returned the bare `Response` would leave that half unattributed.
+ * `readFrame()` itself cannot throw — it swallows parse errors by design.
+ */
+async function rpc(
+  method: string,
+  params: unknown,
+  id: number,
+): Promise<{ status: number; frame: Record<string, unknown> | undefined }> {
+  return probe(`the JSON-RPC \`${method}\` probe`, async () => {
+    const res = await fetch(`${base}/mcp`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        // The transport negotiates both; SSE is what an MCP client sends.
+        accept: 'application/json, text/event-stream',
+        authorization: `Bearer ${apiKey}`,
+      },
+      body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
+    });
+    return { status: res.status, frame: await readFrame(res, id) };
   });
 }
 
@@ -381,24 +436,34 @@ describe('#7652: an app loading the MCP client connector still gets the MCP serv
     port = randomPort();
     base = `http://localhost:${port}/api/v1`;
 
-    await boot({ OS_DATABASE_URL: join(dir, 'probe.db') }, /Server is ready/);
+    serveChild = await boot({ OS_DATABASE_URL: join(dir, 'probe.db') }, /Server is ready/);
 
-    const signIn = await fetch(`${base}/auth/sign-in/email`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ email: 'admin@objectos.ai', password: 'admin123' }),
+    const signIn = await probe('the sign-in probe', async () => {
+      const res = await fetch(`${base}/auth/sign-in/email`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ email: 'admin@objectos.ai', password: 'admin123' }),
+      });
+      let body: unknown = null;
+      try { body = await res.json(); } catch { /* non-JSON error body */ }
+      return { status: res.status, body };
     });
     expect(signIn.status).toBe(200);
-    const token = ((await signIn.json()) as { token?: string }).token;
+    const token = (signIn.body as { token?: string } | null)?.token;
     expect(token).toBeTruthy();
 
-    const minted = await fetch(`${base}/keys`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
-      body: JSON.stringify({ name: 'mcp-collision-e2e' }),
+    const minted = await probe('the key-mint probe', async () => {
+      const res = await fetch(`${base}/keys`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+        body: JSON.stringify({ name: 'mcp-collision-e2e' }),
+      });
+      let body: unknown = null;
+      try { body = await res.json(); } catch { /* non-JSON error body */ }
+      return { status: res.status, body };
     });
     expect(minted.status).toBe(201);
-    apiKey = String(((await minted.json()) as { data: { key: string } }).data.key);
+    apiKey = String((minted.body as { data: { key: string } }).data.key);
     expect(apiKey.startsWith('osk_')).toBe(true);
   }, 240_000);
 
@@ -418,17 +483,19 @@ describe('#7652: an app loading the MCP client connector still gets the MCP serv
   });
 
   it('GET /api/v1/mcp/skill answers 200 — the card\'s repro', async () => {
-    const res = await fetch(`${base}/mcp/skill`);
+    const skill = await probe('the GET /mcp/skill probe', async () => {
+      const res = await fetch(`${base}/mcp/skill`);
+      return { status: res.status, body: await res.text() };
+    });
     expect(
-      res.status,
+      skill.status,
       'the boot banner advertises this endpoint; a 501 here is #7652 (the connector suppressed MCPServerPlugin)',
     ).toBe(200);
-    const body = await res.text();
-    expect(body.length).toBeGreaterThan(0);
+    expect(skill.body.length).toBeGreaterThan(0);
   }, 60_000);
 
   it('POST /api/v1/mcp answers `initialize` and `tools/list`', async () => {
-    const initRes = await rpc(
+    const init = await rpc(
       'initialize',
       {
         protocolVersion: '2024-11-05',
@@ -437,17 +504,17 @@ describe('#7652: an app loading the MCP client connector still gets the MCP serv
       },
       1,
     );
-    expect(initRes.status, 'a 501 here means the MCP service was never registered').toBe(200);
-    const initFrame = await readFrame(initRes, 1);
+    expect(init.status, 'a 501 here means the MCP service was never registered').toBe(200);
+    const initFrame = init.frame;
     expect(initFrame, 'no JSON-RPC frame for the initialize request').toBeTruthy();
     expect(initFrame!.error).toBeUndefined();
     const initResult = initFrame!.result as { protocolVersion?: string; serverInfo?: { name?: string } } | undefined;
     expect(initResult?.protocolVersion).toBeTruthy();
     expect(initResult?.serverInfo?.name).toBeTruthy();
 
-    const toolsRes = await rpc('tools/list', {}, 2);
-    expect(toolsRes.status).toBe(200);
-    const toolsFrame = await readFrame(toolsRes, 2);
+    const toolsRpc = await rpc('tools/list', {}, 2);
+    expect(toolsRpc.status).toBe(200);
+    const toolsFrame = toolsRpc.frame;
     expect(toolsFrame, 'no JSON-RPC frame for tools/list').toBeTruthy();
     expect(toolsFrame!.error).toBeUndefined();
     const tools = (toolsFrame!.result as { tools?: unknown[] } | undefined)?.tools;
diff --git a/packages/cli/test/serve-mcp-stdio-answers.e2e.test.ts b/packages/cli/test/serve-mcp-stdio-answers.e2e.test.ts
index 2ed1fc8e32..df61d29125 100644
--- a/packages/cli/test/serve-mcp-stdio-answers.e2e.test.ts
+++ b/packages/cli/test/serve-mcp-stdio-answers.e2e.test.ts
@@ -51,6 +51,7 @@ import {
   E2E_SECRET_KEY,
   RUN_JS_RESOLVES_FROM_DIST,
   childEnv,
+  probeThroughChild,
   randomPort,
   requireBuiltCli,
 } from './helpers/serve-process.js';
@@ -349,23 +350,61 @@ describe('#7645: the stdio MCP transport answers over a spawned CLI process', ()
     // boot 2 sees the same row (`:memory:` would not survive the restart).
     const first = await boot({ OS_DATABASE_URL: join(dir, 'probe.db') }, /Server is ready/);
     const base = `http://localhost:${port}/api/v1`;
-    const signIn = await fetch(`${base}/auth/sign-in/email`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      // `serve --dev` seeds this admin on an empty DB.
-      body: JSON.stringify({ email: 'admin@objectos.ai', password: 'admin123' }),
+
+    // ⭐ #15653. `boot()`'s `child.on('exit')` handler feeds the READINESS promise
+    // ONLY — it returns early once `settled` — so a death AFTER readiness is
+    // invisible to it, and the two requests below used to reach vitest as a bare
+    // `TypeError: fetch failed` with no exit code, no stdout and no stderr.
+    // `probeThroughChild()` is where the child's fate is read instead; its own
+    // section in `helpers/serve-process.ts` carries the measurement, the bound
+    // and the fences (⛔ no skip, no quarantine, no timeout bump).
+    //
+    // Read at THROW time, so a failure carries what the child printed on its way
+    // down rather than the buffer as it stood at ready.
+    const transcript = () =>
+      `\n--- child stdout ---\n${first.stdout()}\n--- child stderr ---\n${first.stderr()}`;
+    const probe = <T>(what: string, request: () => Promise<T>): Promise<T> =>
+      probeThroughChild(
+        {
+          child: first.child,
+          transcript,
+          label: 'serve-mcp-stdio-answers',
+          what: `${what} on port ${port}`,
+        },
+        request,
+      );
+
+    // ⛔ The body read is INSIDE the thunk and cannot throw: a connection torn
+    // down mid-body rejects out of `res.json()` rather than out of `fetch()`, and
+    // the guard reads any throw as a transport failure — so an ASSERTION must
+    // never live in here or a wrong answer would be reported as a dropped socket.
+    const signIn = await probe('the sign-in probe', async () => {
+      const res = await fetch(`${base}/auth/sign-in/email`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        // `serve --dev` seeds this admin on an empty DB.
+        body: JSON.stringify({ email: 'admin@objectos.ai', password: 'admin123' }),
+      });
+      let body: unknown = null;
+      try { body = await res.json(); } catch { /* non-JSON error body */ }
+      return { status: res.status, body };
     });
     expect(signIn.status).toBe(200);
-    const token = ((await signIn.json()) as { token?: string }).token;
+    const token = (signIn.body as { token?: string } | null)?.token;
     expect(token).toBeTruthy();
 
-    const minted = await fetch(`${base}/keys`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
-      body: JSON.stringify({ name: 'mcp-stdio-e2e' }),
+    const minted = await probe('the key-mint probe', async () => {
+      const res = await fetch(`${base}/keys`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+        body: JSON.stringify({ name: 'mcp-stdio-e2e' }),
+      });
+      let body: unknown = null;
+      try { body = await res.json(); } catch { /* non-JSON error body */ }
+      return { status: res.status, body };
     });
     expect(minted.status).toBe(201);
-    apiKey = String(((await minted.json()) as { data: { key: string } }).data.key);
+    apiKey = String((minted.body as { data: { key: string } }).data.key);
     expect(apiKey.startsWith('osk_')).toBe(true);
 
     await stop(first.child);
diff --git a/packages/cli/test/serve-node-env-production-default.e2e.test.ts b/packages/cli/test/serve-node-env-production-default.e2e.test.ts
index 6d04683bec..9350089f47 100644
--- a/packages/cli/test/serve-node-env-production-default.e2e.test.ts
+++ b/packages/cli/test/serve-node-env-production-default.e2e.test.ts
@@ -171,6 +171,7 @@ import {
   childEnv,
   E2E_SECRET_KEY,
   portContentionError,
+  probeThroughChild,
   requireBuiltCli,
   reservePort,
 } from './helpers/serve-process.js';
@@ -316,8 +317,7 @@ interface OriginCheckResult {
 const READY_BANNER_TAIL = /Press Ctrl\+C to stop/;
 
 /**
- * WHY THE PROBE BELOW IS LIFECYCLE-AWARE, and the reading that decided its
- * shape. The bound is this constant; the reason is this whole section.
+ * WHY THE PROBE BELOW IS LIFECYCLE-AWARE — this file's half of the reading.
  *
  * A merge-group run evicted a queue entry when the third call site below failed
  * with:
@@ -326,149 +326,25 @@ const READY_BANNER_TAIL = /Press Ctrl\+C to stop/;
  *     Caused by: SocketError: other side closed
  *     { code: 'UND_ERR_SOCKET', socket: { bytesWritten: 349, bytesRead: +0 } }
  *
- * ## What that signature IS — measured, and it is ⛔ NOT "the server was not up"
- *
- * `bytesWritten: 349, bytesRead: 0` says the TCP connection was ESTABLISHED,
- * the whole request was delivered, and the peer then closed it without
- * answering. Three shapes measured side by side on this container, with the
- * same request this file sends:
- *
- *     nothing listening on the port    ECONNREFUSED, and NO socket object
- *                                      (bytesWritten/bytesRead both undefined)
- *     listener accepts, then FINs      UND_ERR_SOCKET "other side closed",
- *                                      bytesWritten 321, bytesRead 0
- *     server torn down mid-request     UND_ERR_SOCKET "other side closed",
- *                                      bytesWritten 345, bytesRead 0
- *
- * Only the second and third match what was recorded, and the FIRST is what a
- * genuine readiness race looks like. So the child was serving when the request
- * arrived, and something ended the connection after it. The wait above was
- * already correct: ⛔ the repair is not a longer or better wait, and ⛔ not a
- * bigger timeout.
- *
- * ## What this harness could not say, and now says
- *
- * On the failing path this function used to discard the two artefacts that
- * decide between "the child died" and "a live child dropped a connection": the
- * child's exit status, and everything the child printed. The `child.on('exit')`
- * handler above feeds the READINESS promise only, so once that promise has
- * settled a later death is invisible here and the rejection reaches vitest as a
- * bare `TypeError: fetch failed` — no exit code, no stdout, no stderr. That is
- * why the one recorded occurrence could not be attributed at all, and it is the
- * defect this repair removes.
- *
- * It matters that a silent death is reachable. There is no
- * `process.on('uncaughtException')` and no `'unhandledRejection'` handler
- * anywhere in this repo's product source, so a late async throw inside the
- * child — or an OOM kill on a six-shard CI box — takes the process down with no
- * HTTP answer and exactly this client-side signature.
- *
- * ## The bound, and what it can and cannot hide
- *
- * ⛔ The retry is not the first move and cannot be reached before the child has
- * been asked whether it is alive. On a transport failure the probe waits up to
- * {@link CHILD_EXIT_SETTLE_MS} for the child's `exit` event — the FIN reaches
- * the client on the network's schedule and `exit` arrives on the event loop's,
- * so reading `exitCode` at the instant `fetch` rejects reports a dead child as
- * alive — and then:
- *
- *   • child EXITED ⇒ ⛔ never retried. Fails at once, naming the exit code and
- *     signal and quoting the child's whole stdout and stderr.
- *   • failure is NOT `UND_ERR_SOCKET` ⇒ ⛔ never retried. Rethrown with the
- *     child's output attached. ECONNREFUSED (nothing listening), a timeout, a
- *     DNS or a TLS fault each still fail on their first occurrence.
- *   • child ALIVE and `UND_ERR_SOCKET` ⇒ absorbed, up to this many attempts in
- *     total.
- *
- * ⛔ CANNOT hide a wrong ANSWER. The loop absorbs transport failures only; a
- * `200` where the pin wants `403` is returned to the caller untouched, on the
- * first attempt, every time. Nor can it hide a boot that never reaches the
- * banner: that is the readiness rejection above, which this does not touch.
- *
- * ⚠️ CAN hide a LIVE `os serve` that occasionally destroys a connection without
- * answering it. That is a real product-defect class and this bound does not
- * remove it. What it does is make every occurrence print
- * `[serve-node-env-production-default] absorbed a transport failure` with the
- * full socket signature, so a recurring one is a `grep` away in a CI log
- * instead of a merge-queue eviction. ⛔ If that line starts appearing, the
- * finding is in `os serve` and belongs in a card against it — do not raise this
- * number to make it stop.
- *
- * ⛔ And the line this file may never cross, restated because the test is slow
- * (its shard ran 783 s) and its subject is unglamorous: no `.skip`, no `.todo`,
- * no quarantine list, no retry that swallows a failure into silence. A flake in
- * a required shard is a harness bug to diagnose, never a licence to stop
+ * ⛔ That is NOT "the server was not up": `bytesRead: 0` with `bytesWritten` set
+ * says the connection was ESTABLISHED and the whole request delivered before the
+ * peer closed it, whereas nothing listening answers `ECONNREFUSED` with no
+ * socket object at all. So the wait above was already correct — ⛔ the repair is
+ * not a longer wait and ⛔ not a bigger timeout.
+ *
+ * The mechanism, the three socket shapes measured side by side, the bound and
+ * every fence now live ONCE, with `probeThroughChild()` in
+ * `helpers/serve-process.ts` — read that section rather than a copy of it. Three
+ * sibling files here had the same unguarded shape (#15653) and the idiom was
+ * hoisted so the family has one definition and one pin
+ * (`serve-probe-child-attribution.test.ts`) rather than four copies of it.
+ *
+ * ⛔ The line this file may never cross, restated because the test is slow (its
+ * shard ran 783 s) and its subject is unglamorous: no `.skip`, no `.todo`, no
+ * quarantine list, no retry that swallows a failure into silence. A flake in a
+ * required shard is a harness bug to diagnose, never a licence to stop
  * measuring.
  */
-const PROBE_ATTEMPTS = 3;
-
-/**
- * How long the probe gives the child's `exit` event before it will call the
- * child alive — see the section above for why that answer cannot be read
- * synchronously off `exitCode`.
- *
- * Two seconds because this is a LOCAL child whose exit has already happened by
- * the time its FIN reached us; the wait covers event-loop delivery, not process
- * teardown. It is paid ONLY on a failing attempt, so a green run never waits.
- */
-const CHILD_EXIT_SETTLE_MS = 2_000;
-
-/** The child's lifecycle state, as far as this process can observe it. */
-interface ChildFate {
-  exited: boolean;
-  code: number | null;
-  signal: NodeJS.Signals | null;
-}
-
-function fateOf(child: ProbeChild): ChildFate {
-  return {
-    exited: child.exitCode !== null || child.signalCode !== null,
-    code: child.exitCode,
-    signal: child.signalCode,
-  };
-}
-
-/** Ask the child whether it is still running, allowing `ms` for the answer. */
-function settleChildFate(child: ProbeChild, ms: number): Promise<ChildFate> {
-  const already = fateOf(child);
-  if (already.exited) return Promise.resolve(already);
-  return new Promise<ChildFate>((settle) => {
-    const onExit = () => {
-      clearTimeout(timer);
-      settle(fateOf(child));
-    };
-    const timer = setTimeout(() => {
-      child.off('exit', onExit);
-      settle(fateOf(child));
-    }, ms);
-    child.once('exit', onExit);
-  });
-}
-
-/** `cause.code` of a `fetch` rejection, when it carries one. */
-function transportCode(err: unknown): string | undefined {
-  const cause = (err as { cause?: { code?: unknown } } | undefined)?.cause;
-  return typeof cause?.code === 'string' ? cause.code : undefined;
-}
-
-/**
- * One line naming what the transport did — the exact fields the recorded
- * failure had to be diagnosed from, kept together so the NEXT occurrence needs
- * no second run to be readable.
- */
-function transportSignature(err: unknown): string {
-  const cause = (err as {
-    cause?: { code?: unknown; message?: unknown; socket?: Record<string, unknown> };
-  } | undefined)?.cause;
-  const socket = cause?.socket;
-  const wire = socket
-    ? ` socket: bytesWritten=${String(socket.bytesWritten)} bytesRead=${String(socket.bytesRead)}`
-      + ` local=${String(socket.localAddress)}:${String(socket.localPort)}`
-      + ` remote=${String(socket.remoteAddress)}:${String(socket.remotePort)}`
-    : ' socket: none — the connection was never established';
-  return `${(err as Error)?.message ?? String(err)}`
-    + ` [cause ${String(cause?.code ?? 'none')}: ${String(cause?.message ?? 'none')}]${wire}`;
-}
 
 /**
  * Boot `os serve` for real against the shipped entrypoint, wait for the ready
@@ -609,9 +485,14 @@ async function probeOriginCheck(env: Record<string, string | undefined>): Promis
   const transcript = () => `\n--- child stdout ---\n${out}\n--- child stderr ---\n${err}`;
 
   try {
-    const absorbed: string[] = [];
-    for (let attempt = 1; attempt <= PROBE_ATTEMPTS; attempt++) {
-      try {
+    return await probeThroughChild(
+      {
+        child,
+        transcript,
+        label: 'serve-node-env-production-default',
+        what: `the origin probe on port ${port}`,
+      },
+      async () => {
         const res = await fetch(`http://localhost:${port}/api/v1/auth/sign-in/email`, {
           method: 'POST',
           headers: {
@@ -622,45 +503,14 @@ async function probeOriginCheck(env: Record<string, string | undefined>): Promis
           },
           body: JSON.stringify({ email: 'nobody@example.com', password: 'definitely-wrong-password' }),
         });
+        // ⛔ The body read stays INSIDE the guard, and cannot throw: a connection
+        // torn down mid-body rejects out of `res.json()` rather than out of
+        // `fetch()`, and an ASSERTION in here would be reported as a dropped
+        // socket rather than as the wrong answer it is.
         let body: any = null;
         try { body = await res.json(); } catch { /* non-JSON error body, fall through with null */ }
         return { status: res.status, body };
-      } catch (probeErr) {
-        const signature = transportSignature(probeErr);
-        // ⛔ Ask the child FIRST, and wait for the answer. See PROBE_ATTEMPTS:
-        // a dead child must never reach the absorb branch below.
-        const fate = await settleChildFate(child, CHILD_EXIT_SETTLE_MS);
-        if (fate.exited) {
-          throw new Error(
-            `os serve DIED while answering the origin probe on port ${port} — exit code `
-            + `${String(fate.code)}, signal ${String(fate.signal)}. This is the CHILD's failure, not a `
-            + 'dropped socket, so it is NOT retried; the transcript below is what it printed on its '
-            + `way down.\nattempt ${attempt}/${PROBE_ATTEMPTS}: ${signature}${transcript()}`,
-          );
-        }
-        if (transportCode(probeErr) !== 'UND_ERR_SOCKET') {
-          throw new Error(
-            `the origin probe on port ${port} failed with a transport error this harness does not `
-            + 'absorb — only UND_ERR_SOCKET against a still-running child is absorbed, and only '
-            + `${PROBE_ATTEMPTS} times (see PROBE_ATTEMPTS).\nattempt ${attempt}/${PROBE_ATTEMPTS}: `
-            + `${signature}${transcript()}`,
-          );
-        }
-        absorbed.push(`attempt ${attempt}/${PROBE_ATTEMPTS}: ${signature}`);
-        // Loud on purpose. An absorbed failure that printed nothing would be the
-        // "retry into silence" this card forbids; this line is what makes a
-        // recurring one greppable in a CI log.
-        console.error(
-          '[serve-node-env-production-default] absorbed a transport failure from a STILL-RUNNING '
-          + `os serve on port ${port} (attempt ${attempt}/${PROBE_ATTEMPTS}) — ${signature}`,
-        );
-      }
-    }
-    throw new Error(
-      `the origin probe never completed a request against os serve on port ${port} after `
-      + `${PROBE_ATTEMPTS} attempts. The child was still running ${CHILD_EXIT_SETTLE_MS} ms after `
-      + 'EVERY one of them, so this is a live server dropping connections, not a dead child — the '
-      + `finding is in os serve, not in this harness.\n${absorbed.join('\n')}${transcript()}`,
+      },
     );
   } finally {
     await stop(child);
diff --git a/packages/cli/test/serve-probe-child-attribution.test.ts b/packages/cli/test/serve-probe-child-attribution.test.ts
new file mode 100644
index 0000000000..384d6c4a6a
--- /dev/null
+++ b/packages/cli/test/serve-probe-child-attribution.test.ts
@@ -0,0 +1,371 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #15653 — the pin the attribution idiom never had.
+ *
+ * Four e2e files here boot a real `os serve` and `fetch` it. When that request
+ * fails the useful question is always the same: did the CHILD die, or did a
+ * live child drop the connection? Every one of those files used to answer
+ * neither, because `child.on('exit')` fed the READINESS promise only — so a
+ * death after readiness was invisible and the rejection reached vitest as a
+ * bare `TypeError: fetch failed`, with no exit code, no stdout and no stderr.
+ * One such occurrence was recorded in a merge-group run and could not be
+ * attributed at all.
+ *
+ * `probeThroughChild()` in `helpers/serve-process.ts` is the repair. This file
+ * is what makes it a MEASUREMENT rather than a claim, and it exists because the
+ * repair landed once already (on the NODE_ENV file) proven only by an ad-hoc
+ * harness that was never committed — so nothing in the tree could fail if the
+ * attribution stopped working.
+ *
+ * ## Why the failure here is DRIVEN, not mocked
+ *
+ * ⭐ An assertion that "the error message contains the exit code" is vacuous if
+ * the child never dies. So every case below spawns a REAL child process and
+ * makes a REAL `fetch` against it fail on the wire. The child is not `os serve`
+ * — it is a ~30-line TCP peer that reproduces the one client-side signature
+ * that matters, `UND_ERR_SOCKET` / "other side closed" / `bytesRead: 0`, by
+ * accepting the whole request and then FINning without answering. That is the
+ * cheaper deterministic driver: `os serve` cannot be asked to die mid-request on
+ * command, needs a built `dist/`, and costs ~20 s a boot, while this peer
+ * produces a byte-identical client-side rejection in milliseconds and can be
+ * told to exit with a chosen code, or to stay up, on demand.
+ *
+ * ⛔ What that swap does NOT cover is the product: this file is a pin on the
+ * HARNESS's attribution, not on `os serve`'s behaviour. The four e2e files
+ * remain the ones that boot the real command.
+ *
+ * ## The controls, and the axis each one discriminates on
+ *
+ * `HEALTHY CONTROL` — a child that ANSWERS. It discriminates on **"did this
+ * harness talk to a live peer at all"**: if the spawn were broken, the port
+ * wrong, or the child never listening, every failing case above would still go
+ * red for a reason that has nothing to do with attribution, and would read
+ * exactly like a passing repair. It must come back `200`, and the guard must be
+ * transparent — a control that only ever fails is not a control.
+ *
+ * `PROBES_EXERCISED` — a counter incremented INSIDE each request thunk, printed
+ * and asserted non-zero at the end. It discriminates on **"did the guarded path
+ * actually run"**: a `probeThroughChild()` that returned early, or a `rejects`
+ * matcher against a promise that was never created, would leave it at zero.
+ */
+
+import { describe, it, expect, afterAll } from 'vitest';
+import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  CHILD_EXIT_SETTLE_MS,
+  PROBE_ATTEMPTS,
+  fateOf,
+  probeThroughChild,
+  reservePort,
+  settleChildFate,
+  transportCode,
+  transportSignature,
+  type LifecycleChild,
+} from './helpers/serve-process.js';
+
+/**
+ * The driver. Three modes, one shape:
+ *
+ *   `answer` — replies `200 {"ok":true}`. The healthy control.
+ *   `die`    — accepts the whole request, FINs without answering, exits 7.
+ *   `live`   — accepts and FINs every connection, forever. Never exits.
+ *
+ * ⛔ No `${...}` anywhere in here: this string is embedded in a template
+ * literal, so a dollar-brace would be interpolated by THIS file rather than
+ * reaching the child.
+ */
+const DRIVER = `
+import { createServer } from 'node:net';
+
+const mode = process.argv[2];
+process.stdout.write('probe-child stdout: mode ' + mode + '\\n');
+process.stderr.write('probe-child stderr: mode ' + mode + '\\n');
+
+const server = createServer((socket) => {
+  const chunks = [];
+  socket.on('error', () => {});
+  socket.on('data', (chunk) => {
+    chunks.push(chunk);
+    // Wait for the whole request head, so the client has finished writing and
+    // the socket reports bytesWritten > 0 with bytesRead still 0.
+    if (!Buffer.concat(chunks).toString('utf8').includes('\\r\\n\\r\\n')) return;
+    if (mode === 'answer') {
+      const body = '{"ok":true}';
+      socket.end(
+        'HTTP/1.1 200 OK\\r\\ncontent-type: application/json\\r\\n'
+        + 'content-length: ' + body.length + '\\r\\nconnection: close\\r\\n\\r\\n' + body,
+      );
+      return;
+    }
+    process.stderr.write('probe-child stderr: FIN without answering\\n');
+    socket.end();
+    if (mode === 'die') {
+      socket.on('close', () => {
+        process.stderr.write('probe-child stderr: exiting 7\\n');
+        process.exit(7);
+      });
+    }
+  });
+});
+
+server.listen(0, '127.0.0.1', () => {
+  process.stdout.write('LISTENING ' + server.address().port + '\\n');
+});
+`;
+
+const dir = mkdtempSync(join(tmpdir(), 'probe-child-attribution-'));
+const DRIVER_PATH = join(dir, 'driver.mjs');
+writeFileSync(DRIVER_PATH, DRIVER, 'utf8');
+
+const children: ChildProcessWithoutNullStreams[] = [];
+
+/** Markers the child prints on both streams, so a transcript can be PROVEN carried. */
+const STDOUT_MARKER = 'probe-child stdout:';
+const STDERR_MARKER = 'probe-child stderr:';
+
+interface Driven {
+  child: ChildProcessWithoutNullStreams;
+  port: number;
+  transcript: () => string;
+}
+
+/** Boot the driver and wait until it has said which port it bound. */
+function drive(mode: 'answer' | 'die' | 'live'): Promise<Driven> {
+  return new Promise((ready, fail) => {
+    const child = spawn(process.execPath, [DRIVER_PATH, mode], {
+      cwd: dir,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    }) as ChildProcessWithoutNullStreams;
+    children.push(child);
+
+    let out = '';
+    let err = '';
+    const transcript = () => `\n--- child stdout ---\n${out}\n--- child stderr ---\n${err}`;
+    const timer = setTimeout(
+      () => fail(new Error(`driver never announced a port${transcript()}`)),
+      30_000,
+    );
+
+    child.stdout.on('data', (d) => {
+      out += String(d);
+      const match = /LISTENING (\d+)/.exec(out);
+      if (!match) return;
+      clearTimeout(timer);
+      ready({ child, port: Number(match[1]), transcript });
+    });
+    child.stderr.on('data', (d) => { err += String(d); });
+    child.on('exit', (code) => {
+      clearTimeout(timer);
+      fail(new Error(`driver exited ${String(code)} before announcing a port${transcript()}`));
+    });
+  });
+}
+
+async function stop(child: ChildProcessWithoutNullStreams): Promise<void> {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  await new Promise<void>((done) => {
+    const give = setTimeout(() => {
+      try { child.kill('SIGKILL'); } catch { /* already gone */ }
+      done();
+    }, 5_000);
+    child.once('exit', () => { clearTimeout(give); done(); });
+    try { child.kill('SIGTERM'); } catch { clearTimeout(give); done(); }
+  });
+}
+
+/** ⭐ Incremented INSIDE the thunk — see the header's control section. */
+let probesExercised = 0;
+
+/** The request every case sends — the same shape the origin probes send. */
+function signInRequest(port: number): Promise<{ status: number; body: unknown }> {
+  probesExercised += 1;
+  return fetch(`http://127.0.0.1:${port}/api/v1/auth/sign-in/email`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ email: 'nobody@example.com', password: 'definitely-wrong-password' }),
+  }).then(async (res) => ({ status: res.status, body: await res.json() }));
+}
+
+afterAll(async () => {
+  for (const child of children) await stop(child);
+  rmSync(dir, { recursive: true, force: true });
+}, 30_000);
+
+describe('#15653: an HTTP probe against a spawned child names the child\'s fate', () => {
+  it(
+    'BEFORE — an UNGUARDED fetch against a child that dies mid-request says only `fetch failed`',
+    async () => {
+      const { child, port, transcript } = await drive('die');
+      // ⛔ Deliberately NOT through `probeThroughChild()`. This is the shape the
+      // four e2e files had, reproduced, so the repair below has a measured
+      // before-state to be an improvement over rather than an assertion about one.
+      const bare = await signInRequest(port).then(
+        () => null,
+        (err: unknown) => err as Error,
+      );
+
+      expect(bare, 'the driven failure did not happen — nothing was measured').toBeTruthy();
+      expect(bare!.message).toBe('fetch failed');
+      // The recorded merge-group signature, reproduced: the request was fully
+      // delivered and the peer closed without answering.
+      expect(transportCode(bare)).toBe('UND_ERR_SOCKET');
+      expect(transportSignature(bare)).toContain('bytesRead=0');
+
+      // ⭐ THE DEFECT, stated as an assertion: everything needed to attribute
+      // this failure is absent from what vitest would have been shown.
+      const shown = `${bare!.message}\n${bare!.stack ?? ''}`;
+      expect(shown, 'the bare rejection must not name an exit code').not.toContain('exit code');
+      expect(shown).not.toContain(STDOUT_MARKER);
+      expect(shown).not.toContain(STDERR_MARKER);
+
+      // ...and the child really is dead, so the information existed to be read.
+      const fate = await settleChildFate(child, CHILD_EXIT_SETTLE_MS);
+      expect(fate.exited).toBe(true);
+      expect(fate.code).toBe(7);
+      expect(transcript()).toContain('exiting 7');
+    },
+    60_000,
+  );
+
+  it(
+    'AFTER — the SAME driven failure names the exit status and carries what the child printed',
+    async () => {
+      const { port, child, transcript } = await drive('die');
+      const failure = await probeThroughChild(
+        { child, transcript, label: 'probe-child-attribution', what: `the sign-in probe on port ${port}` },
+        () => signInRequest(port),
+      ).then(() => null, (err: unknown) => err as Error);
+
+      expect(failure, 'the driven failure did not happen — nothing was measured').toBeTruthy();
+      const message = failure!.message;
+
+      // The two artefacts the bare rejection above discarded.
+      expect(message, 'the exit code must be named').toContain('exit code 7');
+      expect(message, 'the signal must be named').toContain('signal null');
+      expect(message, "the child's stdout must be quoted").toContain(STDOUT_MARKER);
+      expect(message, "the child's stderr must be quoted").toContain(STDERR_MARKER);
+      expect(message, 'the crash the child printed on its way down must be quoted')
+        .toContain('exiting 7');
+
+      // The verdict itself, and the fence: a dead child is never retried.
+      expect(message).toContain('os serve DIED');
+      expect(message).toContain('NOT retried');
+      expect(message).toContain('attempt 1/3');
+      // The transport evidence survives the repair rather than being replaced by it.
+      expect(message).toContain('UND_ERR_SOCKET');
+      expect(message).toContain('bytesRead=0');
+    },
+    60_000,
+  );
+
+  it(
+    'HEALTHY CONTROL — against a child that ANSWERS, the guard is transparent',
+    async () => {
+      // ⭐ The axis: "did this harness talk to a live peer at all". Every failing
+      // case above would look identical if the spawn, the port or the request
+      // were broken. This one can only pass if they work.
+      const { child, port, transcript } = await drive('answer');
+      const answer = await probeThroughChild(
+        { child, transcript, label: 'probe-child-attribution', what: `the sign-in probe on port ${port}` },
+        () => signInRequest(port),
+      );
+      expect(answer.status).toBe(200);
+      expect(answer.body).toEqual({ ok: true });
+      // And the child is still alive: the guard neither killed nor waited on it.
+      expect(fateOf(child).exited).toBe(false);
+    },
+    60_000,
+  );
+
+  it(
+    'a transport failure that is NOT `UND_ERR_SOCKET` is rethrown at once, with the transcript',
+    async () => {
+      // A LIVE child, but the request is addressed to a port nothing listens on
+      // — the bind-probed draw is free by construction, so this is ECONNREFUSED:
+      // the shape a genuine readiness race has, and the one that must never be
+      // absorbed as a dropped connection.
+      const { child, transcript } = await drive('live');
+      const closedPort = reservePort();
+      const failure = await probeThroughChild(
+        { child, transcript, label: 'probe-child-attribution', what: `the sign-in probe on port ${closedPort}` },
+        () => signInRequest(closedPort),
+      ).then(() => null, (err: unknown) => err as Error);
+
+      expect(failure, 'the driven failure did not happen — nothing was measured').toBeTruthy();
+      expect(failure!.message).toContain('does not absorb');
+      expect(failure!.message).toContain('attempt 1/3');
+      expect(failure!.message).toContain(STDERR_MARKER);
+      // ⭐ The discriminating half: it failed on its FIRST attempt. An absorbed
+      // one would have printed attempt 2 and 3 before giving up.
+      expect(failure!.message).not.toContain('attempt 2/3');
+      expect(fateOf(child).exited, 'the child must still be alive for this case to mean anything')
+        .toBe(false);
+    },
+    60_000,
+  );
+
+  it(
+    'a LIVE child that FINs every attempt is absorbed exactly PROBE_ATTEMPTS times, then blamed',
+    async () => {
+      const { child, port, transcript } = await drive('live');
+      const before = probesExercised;
+      const failure = await probeThroughChild(
+        { child, transcript, label: 'probe-child-attribution', what: `the sign-in probe on port ${port}` },
+        () => signInRequest(port),
+      ).then(() => null, (err: unknown) => err as Error);
+
+      expect(failure, 'the driven failure did not happen — nothing was measured').toBeTruthy();
+      // ⭐ The bound is REAL: the request was actually re-sent, three times.
+      expect(probesExercised - before).toBe(PROBE_ATTEMPTS);
+      expect(failure!.message).toContain('never completed a request');
+      expect(failure!.message).toContain('live server dropping connections, not a dead child');
+      expect(failure!.message).toContain('attempt 3/3');
+      // ⛔ Never silent: every absorbed attempt is in the message.
+      expect(failure!.message).toContain('attempt 1/3');
+      expect(failure!.message).toContain('attempt 2/3');
+      expect(fateOf(child).exited).toBe(false);
+    },
+    60_000,
+  );
+
+  it('settleChildFate WAITS for `exit` instead of reading `exitCode` at rejection time', async () => {
+    // The mechanism the driven cases rest on, pinned deterministically: the FIN
+    // reaches the client on the network's schedule and `exit` arrives on the
+    // event loop's, so a synchronous read reports a dead child as ALIVE. A fake
+    // child is right HERE — the point is the timing of the two reads, and a real
+    // process cannot be made to deliver `exit` at a chosen instant.
+    let listener: (() => void) | undefined;
+    const late: LifecycleChild = {
+      exitCode: null,
+      signalCode: null,
+      once: (_event, fn) => { listener = fn; return late; },
+      off: () => late,
+    };
+
+    // The synchronous read, taken at the instant a `fetch` would have rejected.
+    expect(fateOf(late).exited, 'the sync read reports a not-yet-reaped child as alive').toBe(false);
+
+    const settling = settleChildFate(late, CHILD_EXIT_SETTLE_MS);
+    setTimeout(() => {
+        late.exitCode = 7;
+      listener?.();
+    }, 50);
+
+    expect(await settling).toEqual({ exited: true, code: 7, signal: null });
+  });
+
+  it('the guarded path really ran — a non-zero count of probes exercised', () => {
+    // ⛔ Not decoration. Every assertion above lives behind a promise; if the
+    // thunks had never been invoked, the `rejects`-style checks would still pass
+    // against errors thrown for other reasons and this file would be green
+    // having measured nothing.
+    console.error(`[probe-child-attribution] probes exercised: ${probesExercised}`);
+    expect(probesExercised).toBeGreaterThan(0);
+    // 1 (bare) + 1 (attributed) + 1 (healthy) + 1 (not absorbed) + 3 (absorbed).
+    expect(probesExercised).toBe(7);
+  });
+});
diff --git a/packages/cli/test/serve-process-child-env.e2e.test.ts b/packages/cli/test/serve-process-child-env.e2e.test.ts
index c0fe962b68..4578f8d23b 100644
--- a/packages/cli/test/serve-process-child-env.e2e.test.ts
+++ b/packages/cli/test/serve-process-child-env.e2e.test.ts
@@ -119,6 +119,7 @@ import {
   childEnv,
   holdPort,
   portDriftError,
+  probeThroughChild,
   randomPort,
   VITEST_WORKER_ENV_KEYS,
 } from './helpers/serve-process.js';
@@ -299,24 +300,45 @@ async function probeOrigin(
       });
     });
 
+    // Everything the child said, for a failure message that can be attributed
+    // without a second run. Read at THROW time, so it carries the crash the child
+    // printed on its way down rather than the buffer as it stood at ready.
+    const transcript = () => `\n--- child stdout ---\n${out}\n--- child stderr ---\n${err}`;
+
+    // ⭐ The `exit` handler above feeds the READINESS promise ONLY, so a death
+    // AFTER readiness is invisible to it and used to reach vitest as a bare
+    // `TypeError: fetch failed` — no exit code, no stdout, no stderr (#15653).
+    // `probeThroughChild()` is where that is now read; its own section in
+    // `helpers/serve-process.ts` carries the measurement and the fences.
+    //
     // ⭐ `bound`, not `requestedPort`. They are provably the same number on this
     // line — a mismatch was REFUSED above rather than reaching it — and
     // addressing the child's own announced port is what keeps that true if the
     // gate is ever loosened.
-    const res = await fetch(`http://localhost:${bound}/api/v1/auth/sign-in/email`, {
-      method: 'POST',
-      headers: {
-        'content-type': 'application/json',
-        // Not localhost, so untrusted under every branch of serve.ts's
-        // trusted-origin assembly. No cookie and no Sec-Fetch-* header: that is
-        // the shape validateFormCsrf forces an origin check for.
-        origin: 'https://evil.example.com',
+    return await probeThroughChild(
+      {
+        child,
+        transcript,
+        label: 'serve-process-child-env',
+        what: `the origin probe on port ${bound}`,
       },
-      body: JSON.stringify({ email: 'nobody@example.com', password: 'definitely-wrong-password' }),
-    });
-    let body: any = null;
-    try { body = await res.json(); } catch { /* non-JSON body, fall through */ }
-    return { status: res.status, code: body?.code };
+      async () => {
+        const res = await fetch(`http://localhost:${bound}/api/v1/auth/sign-in/email`, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            // Not localhost, so untrusted under every branch of serve.ts's
+            // trusted-origin assembly. No cookie and no Sec-Fetch-* header: that is
+            // the shape validateFormCsrf forces an origin check for.
+            origin: 'https://evil.example.com',
+          },
+          body: JSON.stringify({ email: 'nobody@example.com', password: 'definitely-wrong-password' }),
+        });
+        let body: any = null;
+        try { body = await res.json(); } catch { /* non-JSON body, fall through */ }
+        return { status: res.status, code: body?.code };
+      },
+    );
   } finally {
     await stop(child);
   }

From 586830c2141037823c7ff0616e1391915035ef09 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 5 Sep 2026 13:23:34 +0000
Subject: [PATCH 2/3] test(cli): spell the probe child as ChildProcessByStdio,
 not WithoutNullStreams

The pin spawns with `stdio: ['ignore', 'pipe', 'pipe']`, so the handle has no
`stdin` and the cast was a type error.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
---
 .../cli/test/serve-probe-child-attribution.test.ts | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/packages/cli/test/serve-probe-child-attribution.test.ts b/packages/cli/test/serve-probe-child-attribution.test.ts
index 384d6c4a6a..c7b3b74bea 100644
--- a/packages/cli/test/serve-probe-child-attribution.test.ts
+++ b/packages/cli/test/serve-probe-child-attribution.test.ts
@@ -51,10 +51,11 @@
  */
 
 import { describe, it, expect, afterAll } from 'vitest';
-import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process';
+import { spawn, type ChildProcessByStdio } from 'node:child_process';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import type { Readable } from 'node:stream';
 import {
   CHILD_EXIT_SETTLE_MS,
   PROBE_ATTEMPTS,
@@ -121,14 +122,17 @@ const dir = mkdtempSync(join(tmpdir(), 'probe-child-attribution-'));
 const DRIVER_PATH = join(dir, 'driver.mjs');
 writeFileSync(DRIVER_PATH, DRIVER, 'utf8');
 
-const children: ChildProcessWithoutNullStreams[] = [];
+/** What `spawn(…, { stdio: ['ignore', 'pipe', 'pipe'] })` returns — no `stdin`. */
+type ProbeChild = ChildProcessByStdio<null, Readable, Readable>;
+
+const children: ProbeChild[] = [];
 
 /** Markers the child prints on both streams, so a transcript can be PROVEN carried. */
 const STDOUT_MARKER = 'probe-child stdout:';
 const STDERR_MARKER = 'probe-child stderr:';
 
 interface Driven {
-  child: ChildProcessWithoutNullStreams;
+  child: ProbeChild;
   port: number;
   transcript: () => string;
 }
@@ -139,7 +143,7 @@ function drive(mode: 'answer' | 'die' | 'live'): Promise<Driven> {
     const child = spawn(process.execPath, [DRIVER_PATH, mode], {
       cwd: dir,
       stdio: ['ignore', 'pipe', 'pipe'],
-    }) as ChildProcessWithoutNullStreams;
+    }) as ProbeChild;
     children.push(child);
 
     let out = '';
@@ -165,7 +169,7 @@ function drive(mode: 'answer' | 'die' | 'live'): Promise<Driven> {
   });
 }
 
-async function stop(child: ChildProcessWithoutNullStreams): Promise<void> {
+async function stop(child: ProbeChild): Promise<void> {
   if (child.exitCode !== null || child.signalCode !== null) return;
   await new Promise<void>((done) => {
     const give = setTimeout(() => {

From 5c5bcfd71d99038a79ba592ccc23b01f02259162 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 5 Sep 2026 13:30:19 +0000
Subject: [PATCH 3/3] test(cli): the attribution pin's driver declares its
 child env
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`check:cli-test-child-env` requires every child spawned from packages/cli/test
to declare its environment. The driver reads no variable of its own, so
`childEnv()` — the environment minus the vitest worker family — is the honest
declaration rather than an omitted `env` key.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
---
 packages/cli/test/serve-probe-child-attribution.test.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/packages/cli/test/serve-probe-child-attribution.test.ts b/packages/cli/test/serve-probe-child-attribution.test.ts
index c7b3b74bea..f8812a1c62 100644
--- a/packages/cli/test/serve-probe-child-attribution.test.ts
+++ b/packages/cli/test/serve-probe-child-attribution.test.ts
@@ -59,6 +59,7 @@ import type { Readable } from 'node:stream';
 import {
   CHILD_EXIT_SETTLE_MS,
   PROBE_ATTEMPTS,
+  childEnv,
   fateOf,
   probeThroughChild,
   reservePort,
@@ -143,6 +144,12 @@ function drive(mode: 'answer' | 'die' | 'live'): Promise<Driven> {
     const child = spawn(process.execPath, [DRIVER_PATH, mode], {
       cwd: dir,
       stdio: ['ignore', 'pipe', 'pipe'],
+      // `childEnv()`, not an omitted `env` and not a bare `...process.env`. This
+      // driver reads no variable of its own, so the declaration is not about what
+      // it needs — it is the one `check:cli-test-child-env` requires of every
+      // child spawned from this directory, and the honest answer here is "the
+      // environment minus the vitest worker family".
+      env: childEnv(),
     }) as ProbeChild;
     children.push(child);