The caveat up front is valuable: only the entrypoint Worker runs everywhere, while each tenant Durable Object is a single instance, so the buffer is distributed across tenants rather than replicated per tenant. The retry comparison is a strong reason for the design too. Stripe retrying for up to three days, Shopify 8 times over 4 hours, and GitHub not redelivering at all means one short outage can produce both a retry burst and permanently lost events.