Safe Search + Cache + Per Client Overrides

[kaplanben]

First, I'm sorry if this has already been discussed or answered elsewhere. I tried searching quite a bit, but couldn't find a definitive answer.

TLDR;

Does AdGuard support per-client safe search settings with cache_enabled: true without "client cache pollution/bleed" (Yes/No)?

The Longer Version

Those are the knowns (for me):

1. Adguard use global cache, and client info (ID) is not part of the cache key
2. Adguard supports per-client settings override (in UI as well), so you can set (for example) Safe Search globally enabled and on a per-client basis disable safe search (or change its settings).
3. Adguard supports per-client cache settings, for example, client cache size.

However, in real life, this does not work reliably (I couldn't manage to make this usable):

In Real Life:

1. Due to the global cache, the first client to query (let's say -) YouTube, will fill the cache with the resulting redirects.
2. The second client to ask for YouTube will get the answer from the cache. This is regardless of whether the answer matches the per-client settings or not.
3. Making this setup invalid since it will send clients that should be restricted to the unrestricted sites and vice versa.

Notes:

1. Disabling caching completely will probably solve the issue, but it is not possible in my use case (or suggested to be done at all).
2. Optimistic caching for client cache can reduce the pollution, but will not solve it.
3. Similarly, low TTLs can reduce issues, not prevent them.
4. Per-client cache settings (upstreams_cache_enabled|size, etc) do not seem to affect/help this issue. As long as the cache is used (not disabled), there will be cache pollution.

Summary

If I try to conclude all of the above into a single statement, it will be:

Important

Adguard does not support per-client safe searching if cache is enabled.

Or

Warning

Per-client safe searching when the global cache is used will have unpredictable and unreliable results due to client cache bleed.

Official Information Lacking

However, I can't find any official wording to match those statements.
On the contrary, I see many that suggest this should "just work", and obviously, considerable development time was done to allow per-client safe searching settings overrides.

The Open Question

I don't understand why to put development effort into a per-client safe searching code/feature, when caching kills this feature, and not document this clearly (e.g., "choose either caching or per-client safe search, but can't have both").

I'm not trying to step on anyone's toes, I'm really trying to understand the expected behavior vs the observed behavior, and I spent a lot of time with little official findings.

Does AdGuard support per-client safe search settings with cache enabled (Yes/No)?

cache_enabled: true
cache_optimistic: false|true
safebrowsing_cache_size: 1048576
safesearch_cache_size: 1048576
parental_cache_size: 1048576
cache_time: 30
      ...
      upstreams_cache_size: 1024
      upstreams_cache_enabled: true
      ...