one store, every door

The first full sync of my notes vault pushed six hundred encrypted blobs to the site’s storage in one burst, straight through the free tier’s allowance. The response wasn’t throttling but suspension: the store flipped to inactive, reads started refusing, and the free tier has no pay-as-you-go escape, just a month-long wait. Every private surface read from that one store — files, financials, notes, and the passkey record that signs me in. One write burst, four features dark, and my ability to log into my own site survived only as a warm session cookie on my phone. Your auth record is data too, and it shares fate with wherever you put it.

Two earlier decisions made recovery cheap. Graceful degradation held: every surface showed “offline”, nothing crashed. And nothing in the store was a source of truth — the notes live in a local folder, the file inbox was always ephemeral, and the encryption never cared which bucket held the ciphertext. So recovery was a rebuild, not a restore: a fresh bucket on a tier the footprint can’t trip, one shared storage layer swapped underneath, a re-sync, a re-enrollment, all while the cookie was still warm.

What I keep from it: quota suspension is its own outage class — I’d designed for the store being down, not for it being alive and refusing me over a bill. The useful question isn’t “do I have backups” but “what would I rebuild from, and does it live outside the blast radius?”. And one store for everything was operationally simple and a single point of failure at once. Keep that coupling if it’s worth it, but name it, especially where it includes the thing that authenticates you.