Runs work with permission to change PROTECTED_SESSION_CONFIG_KEYS. The permission follows
the async call chain started inside work (every await, timer and promise it spawns) and ends
when work settles.
Server code only. Never call this from anything that forwards client-supplied JSON into the
session Config — wrap exactly the statement that writes server-decided values, nothing wider.
Runs
workwith permission to change PROTECTED_SESSION_CONFIG_KEYS. The permission follows the async call chain started insidework(everyawait, timer and promise it spawns) and ends whenworksettles.Server code only. Never call this from anything that forwards client-supplied JSON into the session
Config— wrap exactly the statement that writes server-decided values, nothing wider.