When `parentPort.on('message', fn)` is called, `injectFakeEmitter` wraps `fn` into a `callback` and stores it in `trackedByListener` under `callback` as the key — not `fn`. If the user then calls `parentPort.removeEventListener('message', fn)`, `parentPortRemoveEventListener` does `trackedByListener.get(fn)`, finds nothing, and exits early without calling `releaseListener()`. This leaves `messageListenerCount` stuck above zero, keeping the capture-phase `messageForwarder` installed on `self` ind