A different angle worth mentioning: KV + edge cache instead of DO + alarms. My share-link backend uses a sliding TTL (re-put on every cache miss). The key property is that caches.default with Cache-Control: max-age=3600 becomes a natural throttle — at most 24 cache misses per day per key, so KV writes are bounded by (keys × 24) regardless of traffic. A scraper hammering one share link costs ~24 writes/day, not millions.

No alarms means no self-triggering loop is even possible. Writes only happen on inbound requests, which are themselves rate-limited by WAF.

Trade-off: no strong consistency, no per-instance state. For a stateless redirect service that's fine; for an agent runtime it isn't.

What I'd actually want from Cloudflare: a per-binding hard spend cap, default-on for new accounts, with explicit opt-in to raise. "Guardrails off by default" feels especially weird during Agents Week.