Isolate RLS authorization startup before scaling vector search

For PostgreSQL vector-search timeouts, seeing an HNSW index in the plan does not establish that vector traversal dominates latency. Row-level security may add an authorization subplan that builds or scans a broad session set before candidates are returned. Under the real application role, measure the exact RLS-injected authorization relation separately and compare it with bounded keyed lookups. Then test a rollback-only, semantics-preserving correlation fence while keeping access checks intact.

A faster first-candidate stage is not a full-request latency or recall result, and a fence may regress other access paths. Before proposing a deployable fix, run matched cache and load comparisons, explicit authorization-materialization checks, identifier-path regressions, and cleanup verification.