celldBeta

celld is one Rust binary that embeds V8 and runs Cloudflare Workers code. Each Durable Object becomes a cell: a named, single-threaded object with its own private SQLite database, one per user, document, chat room or AI agent. You run one celld process (a node) per machine, and all nodes that share one bucket form a fleet; any node can serve any cell, so you add capacity by starting another node. The bucket can be Amazon S3, Cloudflare R2, Tigris, Google Cloud Storage or Azure Blob Storage. There is no consensus service or membership list: a node claims a cell with a conditional write of an ownership record to the bucket, and every claim advances a fencing epoch. Each cell’s SQLite changes are written in Litestream’s LTX format under a prefix named for that epoch, so a node that has lost a cell can only write into a superseded prefix, and nodes hold leases in the bucket that expire after 10 seconds by default, after which a cut-off node fences itself and exits. KV namespaces, queues, D1 databases and Workflows are cells too, with the same ownership and failover, and R2 bindings read and write objects in the fleet bucket.

celld promises RPO 0: it holds every response, error or outbound side effect until the writes it could reveal are durable. In the default fleet mode the owner sends each write to one or two other nodes and answers once they have fsynced it or the bucket upload finishes, whichever is first; a lab fleet measured about 25 ms for that, against about 600 ms for a proof through the bucket alone, which is what a one-node fleet always waits for. The claim is tested by killing nodes with SIGKILL mid-write and deleting their local databases, freezing owners, cutting nodes off from the bucket and throttling the bucket, then fetching every cell through other nodes and comparing it with a ledger; the testing page reports zero lost messages across runs. The coordination protocol is also model-checked in TLA+, which found four bugs and a split-brain in v0.1.0, and runs through millions of seeded simulation schedules.

Cells hibernate. An idle cell can leave memory after a set time, a hibernated one keeps its WebSocket clients connected on its node, and a cell no node holds is just objects in the bucket, costing almost nothing until its next request restores it. The docs put one 8 GB node at 1,000 resident cells, about $0.05 per resident cell a month (the site’s chart uses 2,500 cells per node and about $0.02), and the site contrasts that with Durable Objects billed at about $4.15 per resident object-month. A request to a warm cell touches no bucket at all: about 1.1 ms at p50 and 7 ms at p99 on a fixed host.