RLS6 — the COMPLEMENT of RLS3, and always-runnable (no two-user discovery needed).
RLS3/RLS4 SKIP whenever the DB has no two users with distinct RLS clauses (the common
case on dev/admin databases), so the RLS invariant goes completely unexercised there.
RLS6 fills that gap using only the run's own context user + a real entity's live
metadata, asserting the two halves of the fingerprint contract:
an EMPTY effective clause must NOT alter the fingerprint (RLS-exempt users keep
SHARING cache slots — the correctness half that prevents needless cache fragmentation);
a NON-EMPTY clause MUST alter it (the isolation half RLS3 proves for two users).
Exactly one branch runs per deployment, but the check always executes and always asserts.
RLS6 — the COMPLEMENT of RLS3, and always-runnable (no two-user discovery needed). RLS3/RLS4 SKIP whenever the DB has no two users with distinct RLS clauses (the common case on dev/admin databases), so the RLS invariant goes completely unexercised there. RLS6 fills that gap using only the run's own context user + a real entity's live metadata, asserting the two halves of the fingerprint contract: