The disk

Each session has a 10 GB SQLite-backed disk owned by its Durable Object. It survives WebSocket drops, browser restarts, hibernation, and DO eviction. Facets can be evicted and sockets can drop; the disk persists.

$ echo "still here tomorrow" > /home/user/note.txt
# close the tab, come back next week
$ cat note.txt
still here tomorrow

The disk preserves arbitrary bytes, symlinks, stat metadata, and exec bits. fs.writeFileSync with arbitrary bytes is probed. chmod +x survives, and ./prog honors it. Ownership is real too: every inode stores uid, gid, and mode durably, and a process without permission gets EACCES, not silent success (security). The VFS event bus sends coalesced file changes to the editor and dev servers, which is what keeps Vite HMR working. Each path has a revision watermark, so runtime caches know when to refresh.

The shell, all four runtimes, the editor, box.files in the SDK, and the agent’s tools see the same bytes. A compiled C program can read with fopen("./data.txt", "r") what cat sees.

Process writes stream to the supervisor with credit backpressure. With no credit, a process can’t send more. That lets a parallel npm install or an 84,000-file checkout fit inside a 128 MiB isolate. fsync and process exit are durability boundaries. Hibernation doesn’t lose committed writes.

Short-lived runtime paths read from bounded, revision-invalidated snapshots for speed. Long-running processes increasingly use the live bridge. The target is one rule: reads see either the latest committed state or their own unflushed write. Inside the disk explains the machinery.