Compiled render plans answered by the front worker, with no Durable Object hop.
An authenticated page cannot use caches.default or the KV page tier (both are keyed without a
user). Every tier outside the isolate costs 5-12 ms (the object hop 12); isolate memory costs 0.
Why serving a plan is safe:
A plan is compiled from two different sessions of one role set and served only to a session
whose own live render has agreed with it. Anything constant for one user and different for
another varies between the samples, so the compiler names an unknown slot and
unservableSlots refuses the plan. The per-session agreement in lookupEdgePlan
is unconditional: the two-session proof cannot see a third user whose shared region differs.
The plan must reproduce both renders byte for byte (planExplainsBoth), hold no slot it
cannot generate and survive generatorAgrees.
The generation is in the key, so a content invalidation drops every plan at once.
The structural refusals mirror putPage(): GET, 200, HTML, a real render, and no changed
session cookie.
Private fallback: a site with one editor never gets two sessions, so two renders of the same
session compile a plan under privatePlanKey, served to that session only. Every other
refusal still runs. It is never mirrored to KV and is compiled only while the shared key has no
serving plan.
Not covered: staleness up to GENERATION_TRUST_MS for a bump made elsewhere, and a message
Drupal queued for the visitor's next page (a plan compiled from renders without it would omit it;
forgetWitness drops that session's agreement on any non-GET).
Session lifetime: Drupal can end a session under a cookie the client keeps sending.
rememberRoles records what the object reported per cookie, and PLAN_TTL_MS stops
the plan serving until a live render agrees again (once a minute, not once per request).
Compiled render plans answered by the front worker, with no Durable Object hop.
An authenticated page cannot use
caches.defaultor the KV page tier (both are keyed without a user). Every tier outside the isolate costs 5-12 ms (the object hop 12); isolate memory costs 0.Why serving a plan is safe:
putPage(): GET, 200, HTML, a real render, and no changed session cookie.Private fallback: a site with one editor never gets two sessions, so two renders of the same session compile a plan under privatePlanKey, served to that session only. Every other refusal still runs. It is never mirrored to KV and is compiled only while the shared key has no serving plan.
Not covered: staleness up to GENERATION_TRUST_MS for a bump made elsewhere, and a message Drupal queued for the visitor's next page (a plan compiled from renders without it would omit it; forgetWitness drops that session's agreement on any non-GET).
Session lifetime: Drupal can end a session under a cookie the client keeps sending. rememberRoles records what the object reported per cookie, and PLAN_TTL_MS stops the plan serving until a live render agrees again (once a minute, not once per request).