The edge¶

Nerthus.Core (until cutover). This page describes the frozen system that runs today and is deleted at cutover. Replaced by: not yet written.

Everything this estate runs on Cloudflare, in one place: three Workers, one KV namespace, a tunnel per host, and the DNS in front of them. This page is the map. It says which object exists, who deploys it, and what moves when somebody redeploys.

Publish the API is the procedure that bootstraps the edge from nothing. The two watchers owns which health sweeper is live. Check the quota owns the budget.

Read at nerthus.core.infra.common 7cb02cb and nerthus.core 126bd73 (2026-08-28).

Three Workers, and they are not deployed by the same thing¶

Worker	Lives in	Serves	Deployed by
`fleet-health`	`Infra.Common` `worker/fleet-health.js`	no public route - a cron trigger	`wrangler deploy` from that repository
`nerthus-cors`	`Infra.Common` `worker/cors-worker.js`	`evocation.nerthus.pl/*`	`worker/Publish-NerthusCorsWorker.ps1`
`nerthus-report`	`Nerthus.Core` `vm/report-worker.js`	`conjure.nerthus.pl`, a custom domain	`vm/Publish-NerthusReportWorker.ps1`

The Discord Worker is the one in the other repository, and that is the fact most likely to catch a reader out: conjure.nerthus.pl is published from Nerthus.Core, so a fleet-contract release does not move it and a fleet redeploy does not update it.

fleet-health declares workers_dev = false and preview_urls = false in its own configuration rather than only in the dashboard. A dashboard-only disable is undone by the next deploy.

One KV namespace, two consumers¶

Namespace FLEET_KV, id dcfc8105531140b5979bdc44a71d8d03, bound by both fleet-health and nerthus-cors.

fleet-health reads two keys per sweep and writes one, conditionally: on a state change, and otherwise once per heartbeat interval.
nerthus-cors reads on every non-preflight request, so the read column tracks API traffic rather than the sweep.

Only the sweep writes. The write cap is the one to watch, and Check the quota holds the arithmetic and the day-by-day reading.

When the write cap is exceeded, the damage is account-wide until midnight UTC: every KV write fails, including the fleet provisioner's, so the roster the Worker reads silently stops tracking fleet/hosts.yaml.

The cron¶

fleet-health carries one trigger, in worker/wrangler.toml: */15 * * * *.

That is the value the documentation is held to by ci/assert-tracked-literals.py in the documentation repository, because it used to be one minute and five pages went on saying so for weeks after it changed.

A tunnel per host, and the token is not recoverable¶

Each fleet host reaches the internet through its own Cloudflare tunnel. Merging a roster line in Nerthus.Core.Infra.Dev is what creates that host's tunnel, its DNS record and its Worker route, and encrypts the tunnel token to the age: key on the line.

A tunnel that is deleted cannot be restored from the vault. Recreating one with the same name and the same secret produces a new id, and the id is inside the token, so every committed secrets/<town>.tunnel.age is dead the moment its tunnel is deleted. Recovery is a provision run. The ingress rules in the repository are the durable half - see What is backed up, and what is not.

Which of these a redeploy moves¶

If you redeploy	What moves	What does not
`fleet-health`	the sweep code and its cron	no public route - it has none
`nerthus-cors`	the `evocation.nerthus.pl/*` route's handler and its allowed origins	the KV data, the tunnels
`nerthus-report`	the `conjure.nerthus.pl` handler and the Discord command surface	anything in `Infra.Common`
a fleet provision	a host's tunnel, DNS record and Worker route	the three Workers' code

A stale Worker deployment keeps running. More than one live fleet-health* deployment burns a full sweep budget per day each, and that is the most plausible reading of an unexplained account alert. wrangler deployments list names them.

What it costs¶

The free tier: 100 000 KV reads and 1 000 KV writes a day, and the Worker request allowance. The sweep is engineered around the write cap rather than the read cap, and Check the quota is where that is measured rather than computed.