[codex] adapt workerd 20260701

CLAUDE.md

@@ -73,7 +73,10 @@ shared crate `wdl-rust-common`.
   Runtime receives plaintext only in the internal load envelope after redis-proxy
   decrypts during `/runtime/load`. Env materializes in fixed precedence — vars, then
   namespace secrets, then worker secrets — so a worker secret shadows a namespace secret
-  shadows a var on the same key.
+  shadows a var on the same key. Control must keep the estimated full workerLoader env
+  — user vars/secrets plus runtime-injected binding/workflow env values such as
+  required caller secret copies — within WDL's headroomed workerd serialized env budget
+  before deploy/secret mutation, not let that fail later during cold-load.
 - **DB split is intentional.** DB 0 is control metadata, DB 1 is data-plane KV/queue/log
   streams, DB 2 is Workflows. See `docs/redis-key-layout.md`.
 - **D1/DO correctness comes from owner lease + generation fence.** Service DNS only
@@ -165,8 +168,10 @@ output capture, or fixture loading.
   host-only helpers in module functions or WeakMaps.
 - `workerd serve` emits raw console stdout in addition to structured tail events. The
   structured JSON log is the platform source of truth.
-- Mid-response disconnects do not reliably trip `request.signal`; use
-  `ReadableStream.cancel` plus pre-registered `ctx.waitUntil` for cleanup.
+- On current workerd, mid-response disconnects do not reliably trip `request.signal`
+  or async response-body `ReadableStream.cancel`; do not use either as the only
+  cleanup signal. Bound streaming responses with an independent timeout or an
+  explicit app-level heartbeat/close path.
 - Forwarding WebSocket `101` responses requires preserving `response.webSocket`; use the
   shared response helper instead of wrapping with `new Response(body, init)`.
 - workerd/capnp wiring traps apply to every tier's `*.capnp`, not just runtime: `workerd

Dockerfile.workerd

@@ -86,7 +86,7 @@ RUN ["/usr/local/bin/workerd", "--version"]
 
 # ECS task definitions pick the entry/command:
 #   gateway        : entryPoint ["workerd"]
-#                    command    ["serve", "-b", "/app/dist/workerd-configs/gateway.bin", "--experimental"]
+#                    command    ["serve", "-b", "/app/dist/workerd-configs/gateway.bin"]
 #   user-runtime   : entryPoint ["workerd"]
 #                    command    ["serve", "-b", "/app/dist/workerd-configs/user-runtime.bin", "--experimental"]
 #   system-runtime : entryPoint ["workerd"]
@@ -95,5 +95,6 @@ RUN ["/usr/local/bin/workerd", "--version"]
 #                    stopTimeout >= 20s
 #                    env D1_OWNER_TTL_SECONDS=120 D1_PROBE_TIMEOUT_MS=500 D1_QUERY_TIMEOUT_MS=30000 D1_SHUTDOWN_TIMEOUT_MS=15000
 #   do-runtime     : entryPoint ["do-supervisor"]
+#                    child workerd args include "--experimental" for workerLoader
 #                    stopTimeout >= 20s
 #                    env DO_OWNER_TTL_SECONDS=120 DO_DRAIN_IN_FLIGHT_TIMEOUT_MS=8000

control/bundle.js

@@ -12,6 +12,7 @@ import {
   isValidJsClassDeclarationName,
   validateModulePath,
 } from "shared-ns-pattern";
+import { firstWorkerdExperimentalCompatFlag } from "shared-workerd-compat-flags";
 import { normalizeBindings, validateBindings } from "control-bindings";
 import PACKAGE_JSON_SOURCE from "wdl-package-json-source";
 
@@ -131,11 +132,16 @@ export function normalizeModule(value) {
       return { type: "json", bytes: Buffer.from(JSON.stringify(record.json), "utf8") };
     if (typeof record.cjs === "string")
       return { type: "cjs", bytes: Buffer.from(record.cjs, "utf8") };
-    if (typeof record.py === "string")
-      return { type: "py", bytes: Buffer.from(record.py, "utf8") };
+    if (typeof record.py === "string") {
+      throw new BundleConfigError(
+        400,
+        "python_workers_unsupported",
+        "Python Workers modules are not supported by WDL"
+      );
+    }
   }
   throw new Error(
-    "Unrecognized module value (expected string or {data_b64|wasm_b64|text|json|cjs|py})"
+    "Unrecognized module value (expected string or {data_b64|wasm_b64|text|json|cjs})"
   );
 }
 
@@ -159,6 +165,14 @@ function validateCompatibilityFlags(flags) {
       );
     }
   }
+  const experimentalFlag = firstWorkerdExperimentalCompatFlag(flags);
+  if (experimentalFlag) {
+    throw new BundleConfigError(
+      400,
+      "experimental_compat_flag_unsupported",
+      `compatibilityFlags contains experimental workerd flag ${JSON.stringify(experimentalFlag)}, which WDL does not support for tenant workers`
+    );
+  }
 }
 
 /** @param {unknown} workflows */