A redirect expressed as the body the plan compiler already knows how to diff.
/user is a 302 to /user/<uid> that rendered on every request (x-worker-ms 68.1 / 76.5 /
226.9 at c=1 / 4 / 16 against a localhost VPS's 5 / 6 / 83). Synthesising the redirect into a
body reuses every existing guard: disagreeing renders refuse, the generation fences the key, the
session must agree, and forgetWitness() spends that on a write. A per-user Location differs
across sessions, so a shared plan refuses it and only the private key serves it.
It is NUL-prefixed so no HTML render can be mistaken for it.
A redirect expressed as the body the plan compiler already knows how to diff.
/useris a 302 to/user/<uid>that rendered on every request (x-worker-ms68.1 / 76.5 / 226.9 at c=1 / 4 / 16 against a localhost VPS's 5 / 6 / 83). Synthesising the redirect into a body reuses every existing guard: disagreeing renders refuse, the generation fences the key, the session must agree, andforgetWitness()spends that on a write. A per-userLocationdiffers across sessions, so a shared plan refuses it and only the private key serves it.It is NUL-prefixed so no HTML render can be mistaken for it.