25.8.15 Backport of #87303 - Fix condition not being moved to PREWHERE in case there is a row policy (version 2)

[zvonand]

Changelog category (leave one):

• Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Fixed move-to-prewhere optimization, which did not work in the presence of row policy (ClickHouse#87303 by @KochetovNicolai)

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All with Aarch64
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [d0e8ec2]

[zvonand]

S3 fails: Altinity/clickhouse-regression#93

Aggregate fails: uniqTheta was updated in upstream, not related, test will be updated separately by QA team

[CarlosFelipeOR]

QA Verification

Analysis Summary

This PR is a backport of upstream ClickHouse#87303 (with follow-ups ClickHouse#88017 and ClickHouse#88036) to the releases/25.8.15 branch.

Bug Fixed:

The move-to-PREWHERE optimization did not work when row policies were present, causing performance degradation. This fix restructures how row-level filtering interacts with PREWHERE optimization.

New Tests:

• 03591_optimize_prewhere_row_policy.sql - Verifies PREWHERE optimization works with row policies
• 03641_analyzer_issue_85834.sql - Regression test for issue Not found column when combining row policies, prewhere and additional_table_filters ClickHouse/ClickHouse#85834

Verification Criteria:

Criteria	Status
Upstream PR approved and merged	✅
Follow-up PRs included	✅
Backport applies cleanly	✅
CI passing*	✅
Tests cover the fix	✅
Local backport fix reviewed	✅

* Remaining Failures

• S3/*/zero copy replication
  Regression in zero-copy replication introduced in 25.8.15.
  Issue Regression: S3 zero-copy replication leaves replica out of sync in 25.8.15 #1338 was opened and the fix was made upstream.
  Once it is backported, these regression tests will pass.

• /aggregate functions/part 1/uniqTheta
  Failure caused by an upstream bug fix that changed the expected result.
  Snapshots were already updated in Altinity/clickhouse-regression to reflect the correct behavior.
  Failure: RegressionTestsRelease /aggregate functions/part 1/uniqTheta - snapshot outdated clickhouse-regression#96
  After updating the commit hash, this test will pass.

Notes:

• Large structural change (54 files) but well-tested upstream
• Includes backport-specific fix commit.
• Comprehensive EXPLAIN-based tests verify correct query plan generation

No manual testing required - upstream validation, follow-up fixes, and CI coverage are sufficient for this backport.
Adding verified label.