The Durable Object initialization check. Every flowsafe DO base class calls
this before serving its first request:
Under workerd (state present), the env MUST carry both DEPLOYMENT_TENANT
and DB, and the sentinel must match — a DO namespace bound to the wrong
deployment (or a Worker bound to the wrong database) refuses instead of
serving another organization's data. Missing bindings fail closed too:
an unguarded production DO is exactly the silent gap this check exists
to close.
Off workerd (node/vitest, state undefined), the check is skipped — the
same posture as every other workerd-only affordance on these classes
(hibernatable WebSockets and Durable Object alarm/recovery metadata).
The Durable Object initialization check. Every flowsafe DO base class calls this before serving its first request: