Struct RetainedCommitment 

struct RetainedCommitment<S: PixSpec> {
    ssa_index: SsaIndex,
    ssa_commitment: PixGroup<S>,
    proof: SsaCommitmentProof<S>,
    constant_terms: Vec<PixGroupRepr<S>>,
    attempts_served: u8,
}

Everything needed to re-send part of one cycle’s commitment, minus the polynomials themselves.

A cycle’s commitment ships as hundreds of packets and the peer can only use it once every one has landed, so it must be able to ask for the pieces a lost packet took with it. Answering that needs the same bytes again, and neither half can be recovered from what SsaShareGenerator otherwise keeps: the proof opens the sum of the sub-secrets, which is not retained, and a polynomial exhausted by emission is dropped from the queue along with its constant term — so an Entry that recomputed would fail exactly when the peer has been waiting longest.

The cost is the compressed commitments, polynomials_per_ssa × 33 B — 270 kB at the deployed dimensions, against the ~33 MB of polynomial state a cycle holds while it is still being served. MAX_RETAINED_COMMITMENT_CYCLES bounds how many are held at once.

Fields

ssa_index: SsaIndex

ssa_commitment: PixGroup<S>

Client commitment to the whole SSA, i.e. the sum of every constant term.

proof: SsaCommitmentProof<S>

The proof of knowledge that opens Self::ssa_commitment.

Kept rather than re-proven, and re-sent verbatim: it is a non-interactive proof of a public statement about a public commitment, so a second copy of the same proof discloses nothing a fresh one would not, and re-proving would need the sum of the sub-secrets.

constant_terms: Vec<PixGroupRepr<S>>

Wire-ready constant-term commitments, indexed by polynomial index.

attempts_served: u8

Retransmission requests already answered for this cycle.

Bounded by MAX_COMMITMENT_RETRANSMISSIONS: one request may name every polynomial, so an answer is the whole burst again.