UpdateModuleSysmbols comes on attach
I forgot about UpdateModuleSysmbols when I described the fake debug events sent on attach. This event is sent after LoadModule and is what delivers the symbols for dynamically generated code. This lets you debug code generated with ref.emit when you attach to a process. Note that if the debuggee only emits symbols when a debugger is attached, then this will appear not to work. (Another reason why the presence of a debugger shouldn't change behavior). I updated the original post.
This is an example of how simple things become so complicated. At first it sounds simple to say "Attaching will deliver faked events to bring the debugger up to the current state of the debuggee". But when you start drilling in, there's so many corner cases and caveats. I wish simple things could stay simple.