A hash join plus a filter that needs the token and the fact together.
Produced when a per-condition guard reads a variable bound upstream, e.g.
{:order, amt} when amt > t. :filter is arity 2,
(token_bindings, fact_bindings) -> boolean, and runs only on candidates
that already agree on :join_bind.