KF4 — INV-2 / INV-3 fingerprint↔WHERE agreement [FO] (deterministic, no DB read).
The cache fingerprint's clause (ComputeRunViewRLSWhereClause) and the WHERE assembly's
clause (GetEffectiveRowFilterWhereClause) MUST be byte-identical (INV-2 — any
nondeterminism silently splits or merges cache slots), stable across consecutive calls
and across binding order, and computed for the PASSED principal (INV-3 — once the clause
is per-key, fingerprinting for one principal while filling the slot with another's rows
is a leak). Uses real metadata filters (no SQL executes) so the composed clause is
multi-layered when the DB carries 2+ filters.
KF4 — INV-2 / INV-3 fingerprint↔WHERE agreement [FO] (deterministic, no DB read). The cache fingerprint's clause (ComputeRunViewRLSWhereClause) and the WHERE assembly's clause (GetEffectiveRowFilterWhereClause) MUST be byte-identical (INV-2 — any nondeterminism silently splits or merges cache slots), stable across consecutive calls and across binding order, and computed for the PASSED principal (INV-3 — once the clause is per-key, fingerprinting for one principal while filling the slot with another's rows is a leak). Uses real metadata filters (no SQL executes) so the composed clause is multi-layered when the DB carries 2+ filters.