FLS23 — the audit projection holds on the SHARED cache slot, the same mechanism-level proof
FLS11 gives for ordinary reads.
The server's RunView slots are full-width and shared across users; per-request narrowing runs at
read time on every hit and every miss. So the writer's cold query warms a slot carrying the
denied value, the reader's identical query is served from that same slot WITHOUT a new cache
write, and the payload must still come back narrowed. This is the exact path the original
cross-user leak ran through.
FLS23 — the audit projection holds on the SHARED cache slot, the same mechanism-level proof FLS11 gives for ordinary reads.
The server's RunView slots are full-width and shared across users; per-request narrowing runs at read time on every hit and every miss. So the writer's cold query warms a slot carrying the denied value, the reader's identical query is served from that same slot WITHOUT a new cache write, and the payload must still come back narrowed. This is the exact path the original cross-user leak ran through.