Cloudflare R2 / S3-compatible blocks

R2 is the remote block plane in the current split-store design. It is deliberately not used as the metadata store by the Node factory or theR2BlockStore API.

Namespace {
  nodes[42] = NodeMetadata {
    stats: { ino: 42, size: 8192, mode: regular },
    data: File(FileLayout {
      chunker: { algorithm: "fixed-size", version: 1, chunk_size: 4096 },
      extents: [
        { file_offset: 0,    block: "b012...", block_offset: 0, length: 4096 },
        { file_offset: 4096, block: "bfed...", block_offset: 0, length: 4096 }
      ]
    })
  }
}

BlockId "b012..." -> [4 KiB raw bytes]
BlockId "bfed..."  -> [4 KiB raw bytes]

Layout and chunking

Files are split into fixed-size chunks by ChunkedFs. The metadata provider records the block IDs; R2 stores bytes only. A completed object upload is the block barrier before metadata publication, but automatic orphan collection is not implemented.

Durability and consistency

The adapter reports durability only when the caller declares it. A configured R2 endpoint normally uses the durable path. Endpoint, bucket, credential, and state-key shapes are validated before client construction, so malformed configuration fails closed. The live tests verify confirmed writes, ranges, reopen, conditional behavior, and owned-prefix cleanup. Those results do not turn every object-store deployment into a universal power-loss claim. When the selected driver advertises durable_writes, successful mutations now await its syncfs barrier and return an error if that barrier fails; volatile drivers remain unchanged. This is a local mutation acknowledgment boundary, not proof of provider or power-loss durability. The subsequent local S3 qualification packet at exact revision 71972b28 passed the release N-API build, 990 pinned-oracle tests with 79 explicit skips, 4 unit, 6 chunked, 29 gateway, and 5 public-API Rust tests, 64-way direct-session/CAS concurrency, process restart, structural-factory parity, and the 40-case S3/WebDAV HTTP differential. It remains local/oracle evidence; the follow-up local hook packet at d43f5ea also wires RustS3SessionHooks and the N-API now,requestId, onError, andonAssertion controls with callback keepalive/release; its callback-observability, package, Rust, and strict-Clippy checks passed. These remain local controls, not live-provider acceptance. The latest AWS admission 35693941024 on published sourcefcf1d547 stopped atAWS_S3_CI_CONFIG_BLOCKED missing_bucket. The latest R2 admission 35693941037 on the same source stopped atcount=329 limit=20 and skipped its live integration job, so neither produced a live service PASS. The current S3 transport packet also closes bounded HEAD Content-Length/no-body, chunked PUT411 MissingContentLength, Expect: 100-continue, pipelined-response ordering, short streamed-response, and rejected-body keep-alive reuse cases; the full local Rust packet passed 40 gateway cases alongside strict Clippy, formatting, and diff checks. The same packet also proves bounded graceful close for an in-flight response. These are local transport boundaries, not live-provider acceptance.

Across every split-store composition, new blocks are flushed before metadata references are published. A provider acknowledgement is not automatically a power-loss or distributed-locking guarantee.

List, head, range-read, and delete an owned prefix

export R2_ENDPOINT='https://<account>.r2.cloudflarestorage.com'
export R2_BUCKET='mount-rs-tests'
export R2_PREFIX='mount-rs-tests/trace-owned'

aws s3api list-objects-v2 --endpoint-url "$R2_ENDPOINT"   --bucket "$R2_BUCKET" --prefix "$R2_PREFIX/"
aws s3api head-object --endpoint-url "$R2_ENDPOINT"   --bucket "$R2_BUCKET" --key "$R2_PREFIX/<block-id>"
aws s3api get-object --endpoint-url "$R2_ENDPOINT"   --bucket "$R2_BUCKET" --key "$R2_PREFIX/<block-id>"   --range bytes=0-63 /tmp/block-prefix.bin

Credentials, cleanup, and safe operations

Keep endpoint, access key, and secret values outside source control. Give each run a unique prefix, list it before cleanup, and delete only objects under that prefix. Never use a shared state key or bucket-wide delete as a test cleanup shortcut.

Current limits

R2 is block-only here; it does not solve metadata fencing or garbage collection. Orphan blocks can remain after uncertain publication, and native/hosted benchmark and full release matrices remain separate from the authenticated live gate. The main-only workflow admits at most 20 runs per month under a worst-case $100 monthly envelope (up to $4 per run). Hosted run 35579174675 completed the full R2 packet after the earlier 35575940720 ESTALE failure; this still does not establish native mount, power-loss, or full release acceptance.

← Back to providers