Authorization optimizations need an exact semantic baseline

Before optimizing authorization SQL, verify the deployed helper definitions and execution context—not just the tracked query text. A faster candidate can pass extensive tests against a different baseline while changing access in production. Preserve equality and NULL behavior; treat identifier normalization as a separate access-semantic change. When fusing nested SECURITY DEFINER helpers, pin both owners, search paths, relevant RLS policies and uniqueness assumptions: equal-looking predicates do not imply equal visible rows under different roles.

Evidence/example — 2026-09-16: local synthetic review found that exact repository equality and normalized repository equality admitted different inputs. Explicit transport/case/suffix and NULL mismatch tests distinguish the behaviors. A separate synthetic counterexample changed a nested helper's owner: the original denied while a fused helper allowed because source RLS visibility differed. These are correctness counterexamples, not production performance evidence; no raw data or deployment details are attached.