D14 — RLS isolation tests do not use RefreshDatabase
Architecture decision record, relocated verbatim from the retired single-file
docs/tenancy/decision log. Status, thematic clusters, and how to record a new ADR: the decision log index.
PostgresRLSBootstrapper opens a SEPARATE connection for the NOBYPASSRLS role, so a wrapping
transaction on the central connection neither covers tenant-context writes nor exposes
uncommitted central rows to the tenant connection. RLS tests therefore migrate:fresh +
tenants:rls, commit real data, assert isolation, and clean up in tearDown. They also set
tenancy.cache.stores = [] (CacheTenancyBootstrapper rejects the array test cache driver;
cache prefixing is orthogonal to RLS).