feat(canary): watch the fixes we wait on, digest what a pin adopts, probe JXL and dictionaries live

[oddharsh]

Production runs on prerelease pins since #810. This is what those early builds are now used for, three ways, each one gate or step on a leg that already runs nightly.

1. Upstream watches: the fixes we wait on, read every night

tools/lib/upstream-watches.ts is a gate turned inside out. Each entry is a probe that reads false on the pinned toolchain today, one per upstream thread this repository opened or commented on, with the reading recorded beside it. Every leg answers each watch under the pin and under the candidate; a row that differs is a changed night whose signature names the watch and the direction, so the issue says which fix arrived in which build. Landed in both is the cue to retire it. A probe that could not run reads did not run and moves nothing.

watch	waits on
bun-image-rejects-out-of-range-quality	oven-sh/bun#40490 (fix #40520)
bun-image-rejects-wrong-option-types	oven-sh/bun#40490 (fix #40491)
bun-image-linear-light-resize	oven-sh/bun#40510 (fix #40512)
bun-image-keeps-16-bit-samples	oven-sh/bun#30462
fetch-honours-dispatcher	oven-sh/bun#39247 (fix #39250), the harness hang, and the issue that decides whether node can leave engines
css-minifier-knows-the-seven-pseudo-elements	oven-sh/bun#41120
css-minifier-lowercases-target-current	oven-sh/bun#42480 (fix #42484)
workerd-honours-zstd-dictionary	cloudflare/workerd#7106, our own PR, via tools/workerd-zstd-probe.ts on wrangler's createTestHarness
wrangler-types-accepts-x-new-config	gotcha 41, no upstream issue

Measured on the pinned bun 1.4.2-canary.20260913.1 and on today's rolling canary (1.4.3-canary.1+782c4020b): every gate green, all seven bun watches not yet -> not yet, which matches the state of bun's review queue (every one of those fix PRs is still REVIEW_REQUIRED). The two wrangler watches read not yet on both the pin (982b806) and main:

resolved:  wrangler 4.132.0, miniflare@f2b3a6d, workerd 1.20260915.1

  ok   deploy --dry-run bundles — index.js 759667 B
  ok   bundle is byte-identical to the pinned wrangler's — 759667 B, sha256 9067893ebc47
  ok   route oracle passes on the candidate harness — exit 0
  ok   cal suite passes on the candidate harness — 84 pass, 0 fail

watches (pinned -> candidate):
  workerd-honours-zstd-dictionary                not yet  -> not yet
  wrangler-types-accepts-x-new-config            not yet  -> not yet

One thing the wrangler leg's first run found and this PR settles: wrangler main had moved to workerd@1.20260915.1 (published 01:18Z), and bunfig's 24h minimumReleaseAge refused it, so neither the canary leg nor the pin job could install main. The pin takes workers-sdk main at zero hours old, and each such commit names the exact workerd it was built against, so age-gating the runtime while taking its publisher unaged protects nothing and reds both jobs on the mornings they have news. workerd and its five platform packages are exempted by name, with the reason in bunfig.toml and the instruction to remove the six lines if the wrangler pin ever returns to a release. Verified both ways: with the exemption bun add workerd@1.20260915.1 resolves, without it failed to resolve. This is the one policy change in the PR.

2. The nightly pin PRs say what they adopt

bun run pin:digest -- --repo <owner/name> --from <sha> --to <sha> renders a GitHub compare range as Markdown, and both bun-pin.yml and wrangler-pin.yml put it in the PR body under the gate evidence. For workers-sdk that is the .changeset/*.md files added in the range, which is the unreleased changelog, wrangler and miniflare first; for bun it is the commit subjects with the robobun count beside them. Run on the real ranges today: #808's b149147 -> 982b806 was 5 commits carrying 4 changesets (execa replaced by tinyexec, KV bulk routes in the Local Explorer, ...), and the bun pin's 09bb546 -> 7e56b40 was 70 commits, 63 by bots. Advisory by construction: if GitHub refuses, the body carries one line and a compare link and the PR still opens.

3. Two live browser probes, for the features parked on a browser

Horizon marks jpeg-xl honest-false because no synchronous probe exists, and nothing on the page can see a request header, so the two site features waiting on a browser could never flip on the browsers leg. Two live probes ride beside the page's own now: live:jxl-decode (a 190-byte 2x2 JXL from cjxl, decoded from a data URI, with a PNG decoded the same way as the control) and live:dictionary-transport (a real visit to production, then a second navigation, read for the Available-Dictionary the engine sends and the dcz it gets back; --offline skips it, and stable chromium reading false is the instrument).

First run, Chrome 153 against Canary 155: JXL decodes by default in Canary. The roadmap note from a week ago has it flag-only in Chrome; that now describes stable alone, and a JXL /i/ tier is gated on a Chrome release rather than a flag.

                           chrome: sent Available-Dictionary, got dcz
chrome                     153.0.8010.37      64/87 probes true
                           chrome-canary: sent Available-Dictionary, got dcz
chrome-canary              155.0.8057.0       66/87 probes true

2 probe(s) answer differently in the prerelease:
  live:jxl-decode              chrome:chrome-canary                 false -> true
  margin-trim                  chrome:chrome-canary                 false -> true

The dictionary probe's first draft read false in Canary on three of six trials with the .dict response visibly at ~450ms: the fetch lands before goto resolves, so a listener attached after navigation only sees the trials where it came late. It attaches before navigating now, and the reason is written at the call.

What was checked

• bun run test 724 pass; the canary contract file also passes under node (12/12), and it now RUNS every bun watch under the pinned bun and asserts a boolean back, so a watch that reads null fails the suite.
• bun run lint, bun run typecheck, bun run derive:check (three new writers declared).
• wrangler types --x-new-config re-measured on main 982b806: still refused with Unknown arguments. My first read of exit 0 was tail's. Gotcha 40, again, and the reason that watch exists.

Nothing here writes a pin, opens a PR from the canary, or holds a Cloudflare credential; the contract test that says so still passes.

[github-actions]

Wire-size diff vs merge base

7d77bd08 → 8b6ae70d

Brotli q11, the quality the edge serves. Every number here is deterministic:
an unchanged file produces no row. Advisory — this check fails on nothing.

Client assets

No change. 25 files, 86.93 KiB Brotli total.

Pages

No change. 56 files, 584.45 KiB Brotli total.

Worker bundle

No change. 249.30 KiB gzip.

Dictionary transport

Family dictionary acquisition: no change, 14.41 KiB q11.

pd/: no change. 112 deltas, 460.86 KiB total.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	aadhar-sh	ce6ca7e	Sep 15 2026, 07:32 PM