Variable KV_OVERRIDABLEConst
KV_OVERRIDABLE: readonly [
"RENDER_BUDGET_MS",
"FILL_BATCH_SIZE",
"HTTP_DRAIN_LIMIT",
"MIRROR_LIMIT",
"LAZY_FS_BUDGET_BYTES",
"PREFILL",
"GEN_BUCKET_MS",
"MAIL_TRANSPORT",
"MAIL_DRAIN_LIMIT",
"SHELL_ASSEMBLY",
"OPCACHE_MODE",
"ARGON2",
"SITE_LOCATION_HINT",
"REPLICA_COUNT",
"REPLICA_LAG_MS",
"SITE_WARM",
"WARM_INTERVAL_MS",
"WARM_CEILING_MS",
"KEEP_WARM_MS",
"IDLE_CEILING_MS",
"SLEEP_BUDGET_MS",
"EDGE_PLAN",
"ASSET_AGGREGATES",
"MEMORY_CACHE_BINS",
"MEMORY_CACHE_MAX_ITEMS",
"RESPONSE_HEADERS",
"REDIRECTS",
"CSP_MODE",
"SPOOL",
"SPOOL_IMAGES",
"SPOOL_VIDEO",
"SPOOL_EMBEDS",
] = ...
The only env names KV may override, a privilege boundary: merging an arbitrary object would let a KV writer set
PW_DIAGNOSTICS=1, which reaches/sqland/restore. Every name is a lever whose worst case is a slow site.PLANhas its own key; the mail credentials (SMTP_*,CF_EMAIL_*,MAIL_FROM) must never join, sinceSMTP_HOSTwould receive every reset link.