Ten years of changing a runtime you are not allowed to break

A hosted runtime cannot ask its tenants to upgrade, so Cloudflare pins semantics to a date per deployment and releases the runtime every day. This guide reads the contract out of the one file where it is written down, counts what it costs (187 flags, 90 dated, 146 permanent opt-outs, 41 patches against V8), and catalogues the six failures the public record does contain. A reader finishes able to design the same contract, and to name the liability it creates.

What you get out of it

• A date per deployment, not a runtime version, is what lets the operator ship daily while tenants hold still; it also means nothing can ever be removed.
• Node.js removes 131 deprecated APIs because its users choose the version; Cloudflare has removed none, and 146 of its flags carry a permanent opt-out.
• The contract only covers behaviour the platform wrote: a V8 upgrade exposed Temporal with an unvirtualised clock and turned feature detection in tenant code into JWTs stamped 1970.
• Rust went where per-request memory safety is paid for, not everywhere: the CLI was rewritten out of Rust into TypeScript and the v1 repository archived on 2023-08-03.
• The real liability of a compatibility contract is the population of deployments that never move their date, and no published artefact says how large it is.

Scope

Why this, now. Node.js compatibility stopped being opt-in on 2026-08-04 after a first attempt was closed unmerged, which closes a ten-year arc from a runtime defined by what it refused to be.

What it does not cover. Cloudflare's network architecture, its configuration distribution plane and its published outage postmortems, all of which live on hosts this session's egress policy could not reach.