Function scope_namespace 

pub fn scope_namespace(tenant: &str, raw_salt: &str) -> String

PC-ISO namespace scoping: with a keyring configured, a request’s cache namespace is t:<tenant>\x1f<salt> — a tenant’s keys share cache; different tenants never do; a client-controlled salt cannot cross the \x1f boundary (tenant ids exclude it). Without a keyring the raw salt passes through, byte-identical to PC-ISO behavior.