KF3 — INV-1 cache-slot separation [FO] (live, read-only).
Two principals whose ONLY difference is the resolved key filter issue IDENTICAL
RunViewParams against a small cacheable result set. INV-1 demands the key filter be
emitted by ComputeRunViewRLSWhereClause (inside the fingerprint) — appended later in the
WHERE assembly would produce two principals sharing one slot with different effective
filters. Proven both ways, RLS3/RLS4-style: divergent fingerprints for the same params,
AND each principal's live run is its own cold WRITE (never a hit off the other's slot),
AND the bound principal's rows all satisfy its key filter (end-to-end enforcement, not
just fingerprint hygiene).
KF3 — INV-1 cache-slot separation [FO] (live, read-only). Two principals whose ONLY difference is the resolved key filter issue IDENTICAL RunViewParams against a small cacheable result set. INV-1 demands the key filter be emitted by ComputeRunViewRLSWhereClause (inside the fingerprint) — appended later in the WHERE assembly would produce two principals sharing one slot with different effective filters. Proven both ways, RLS3/RLS4-style: divergent fingerprints for the same params, AND each principal's live run is its own cold WRITE (never a hit off the other's slot), AND the bound principal's rows all satisfy its key filter (end-to-end enforcement, not just fingerprint hygiene).