pub fn unless_forgotten(plan: &mut Plan<'_>, principal: Uuid)
The commit conflicts if the principal was forgotten since it was read; the retry sees it.