Cloudflare Records

Problem

D1 tells an application what it believes now and R2 holds bytes, but neither gives those bytes durable historical identity. The guarantees that keep that identity correct — exact-byte identity, safe deduplication, idempotent retry, no half-published records, verified large uploads, reference-aware deletion — are the part every team rebuilds, badly.

Solution

Specified a normative v0 contract and made it executable as an adapter-neutral test suite, so a local adapter and real Durable Object SQLite plus R2 are held to the same behavior. Carried an explicit kill criterion: if the store does not measurably remove infrastructure code from its consumers it should collapse into a shared library rather than pretend to be a platform primitive.

Role

Creator, architect, and lead engineer

Technologies

Impact

• Wrote the store's specification as an adapter-neutral contract suite of 31 tests, run against both a local adapter and real Durable Object SQLite with R2, so the spec is executable rather than aspirational
• Measured a 25.9% storage reduction from content deduplication on the first consumer — 7,262 occurrences across 5,944 distinct contents — with every digest independently matching a manifest produced months earlier by a different implementation
• Held the store to an explicit kill criterion — collapse into a library unless it measurably removes infrastructure code from consumers — with every consumer keeping a before-and-after architecture diff as the evidence
• Made partial publication unrepresentable: content and metadata publish atomically and the store owns orphan cleanup, so a failed create leaves nothing behind rather than an unreferenced object no query can reach