Records one render, and compiles or re-proves against it.
The proofs run here, not at serve time, so a stored plan has already reproduced both renders. A
refusal is remembered (a moved generation gives another go) so a hopeless compile does not spend
CPU on every render.
A plan past PLAN_TTL_MS is re-proved against this render (one render, not three); one
that stops agreeing is dropped and sampling restarts.
owned marks a key that names one session (privatePlanKey); it drops only the
two-witness requirement, which has no work to do when nobody else is served from the key.
headers are the module-set headers the render carried. They are part of what a plan holds, so
two witnesses must agree on them like on the markup, and a live render whose headers differ from
the plan's drops it (a plan stored before headers existed re-proves into one that has them).
the plan when this render completed a compile, so the caller can mirror it to KV;
undefined for a re-proof (KV already holds it) and for a private plan (never mirrored)
Records one render, and compiles or re-proves against it.
The proofs run here, not at serve time, so a stored plan has already reproduced both renders. A refusal is remembered (a moved generation gives another go) so a hopeless compile does not spend CPU on every render.
A plan past PLAN_TTL_MS is re-proved against this render (one render, not three); one that stops agreeing is dropped and sampling restarts.
ownedmarks a key that names one session (privatePlanKey); it drops only the two-witness requirement, which has no work to do when nobody else is served from the key.headersare the module-set headers the render carried. They are part of what a plan holds, so two witnesses must agree on them like on the markup, and a live render whose headers differ from the plan's drops it (a plan stored before headers existed re-proves into one that has them).