fix: two augmentation-compat regressions vs Node 25.8.1

[colinhacks]

Two verified fixes from the v0.5.0 Deno-corpus regression audit. Nine-cause breakdown: wiki/research/nub-v0.5-augmentation-regressions.md.

• fix(runtime): probe lazy MessageEvent/File with in, not typeof, so undici isn't loaded at startup (moduleLoadList 227→114; Node 110).
• test(node-compat): reap the child's process group on timeout/exit (orphaned grandchildren killed the CI runner; job pulled 2026-06-03).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nub	Ready	Preview, Comment	Jul 24, 2026 11:14pm

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[pullfrog]

Important

The three fixes are sound and well-verified, but widening the source-maps gate to all of Node 26.x left two references describing the old 26.2.x-only behavior — including a user-facing docs page that now states the wrong versions.

Reviewed changes — three independent augmentation-compat fixes from the v0.5.0 Deno-corpus regression audit, plus a test-only process-group reap.

• Widen the source-maps gate to all of Node 26.x — source_maps_safe now returns node_version.major() != 26; the doc comment and unit test are updated in-diff to reflect the 2026-07-23 sweep (26.0–26.5 all rethrow no-message assert.ok(false) as TypeError; 24.17/25.9 clean).
• Stop materializing undici at preload time in polyfills.cjs — the File/Blob backfill and the MessageEvent.ports-freeze wrap now probe existence with in instead of typeof, and the MessageEvent wrap is additionally version-gated to skip on Node >= 22.3.0 (where the native undici-backed MessageEvent already freezes .ports).
• Reap the child's process group on exit and timeout in the node_compat test — the child is spawned as its own process-group leader (process_group(0)) and a new reap_group SIGKILLs the negative pgid, so forked servers/workers/grandchildren aren't orphaned to PID 1 (the failure that pulled the compat corpus from CI).

⚠️ Docs still describe the old 26.2.x-only source-maps gate

The TypeScript runtime docs page still says source maps are withheld only on the "26.2.x patch band" and that "Every other version (18.19 through 26.1, and 26.3+) gets source maps." After this PR that's false — source maps are now withheld across all of 26.x, so 26.0 / 26.1 / 26.3 / 26.4 / 26.5 do NOT get remapped stack traces. A user on the recommended newest Node major will read behavior the binary no longer exhibits.

Technical details

# Docs describe the old 26.2.x-only source-maps gate

## Affected sites
- `site/content/docs/runtime/typescript.mdx:97` — "except the **26.2.x** patch band" and "Every other version (18.19 through 26.1, and 26.3+) gets source maps" now contradict `source_maps_safe` (`major() != 26`).

## Required outcome
- The page states that source maps are withheld across the entire Node 26.x line (not just 26.2.x), and does not claim 26.1/26.3+ get source maps.

## Open questions for the human (optional)
- Whether to keep the version specifics inline or generalize to "the Node 26 line" so the copy doesn't need re-editing when a fixed 26.x lands.

ℹ️ Stale code comment in compute_inject_flags

The inline comment at the ALWAYS_INJECT loop still reads "withheld on Node 26.2.x (see source_maps_safe): there it turns a no-message AssertionError into a TypeError." It restates the pre-PR gate; the authoritative doc comment on source_maps_safe itself was updated, but this second copy wasn't.

Technical details

# Stale 26.2.x comment at the injection site

## Affected sites
- `crates/nub-core/src/node/flags.rs:161-162` — "withheld on Node 26.2.x" / "there it turns a no-message AssertionError into a TypeError"; not in the diff, so it wasn't updated alongside the gate.

## Required outcome
- The comment reflects the widened gate (all of 26.x), or defers to `source_maps_safe`'s now-authoritative doc comment rather than duplicating the band.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — the PR narrowed from three fixes to two since the prior pullfrog review; the source-maps gate widening in flags.rs (and its typescript.mdx doc reference, which the prior review flagged) was dropped, so those findings no longer apply. The two remaining fixes are correct and self-contained.

• Stop materializing undici at preload time in polyfills.cjs — the File/Blob backfill and the MessageEvent.ports-freeze wrap now probe existence with in instead of a value read, and the MessageEvent wrap is additionally version-gated to skip on Node >= 22.3.0 (where the native undici-backed MessageEvent already freezes .ports), so undici is no longer forced at startup on the fast tier.
• Reap the child's process group on exit and timeout in the node_compat test — the child is spawned as its own process-group leader (process_group(0), #[cfg(unix)]) and a new reap_group SIGKILLs the negative pgid, so forked servers/workers/grandchildren aren't orphaned to PID 1 (the failure that pulled the compat corpus from CI).

Verification notes for this pass:

• The File/Blob in-probe still runs the backfill on the floor (where the globals are genuinely absent) and skips it on modern tiers without firing the lazy getter; the inner per-name typeof … === "undefined" guard is correct on the floor.
• The MessageEvent version gate (major > 22 || (major === 22 && minor >= 3)) skips the wrap across the entire fast tier (floor 22.15), matching the confirmed 22.3.0 native-freeze point (nodejs/node#52370).
• The process-group reap ordering is correct on both paths (clean-exit reaps the leader via try_wait then signals surviving members; timeout does reap_group → child.kill() → child.wait()), and libc is a cfg(unix) dependency available to the integration test.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}