ORM: index-union findMany drops its take() bound entirely under RLS or a residual filter #442

Summary

The index-union (multiProbe) findMany lane drops its take() bound entirely whenever either:

• RLS is enabled on the table, or
• any post-filter is not Convex-enforceable (e.g. contains)

Each probe then falls back to .collect() and scans its whole probed range.

Measured on origin/main with the scanned counter, findMany({ where: { ownerId: { in: [a, b] } }, limit: 3 }):

The RLS leg is the severe one: turning on a security feature silently removes a read bound, and nothing at the call site indicates it.

Root cause

packages/kitcn/src/orm/query.ts:6871-6872:

this.rls?.mode !== 'skip' && isRlsEnabled(this.tableConfig.table as any)

sets probeHasPostFetchMembership, which nulls probeBound at :6884, which forces .collect() at :6917.

probeHasResidualFilter at :6854-6855 does the same for the whole fan-out whenever any post-filter is not enforceable.

Not fixed by the recent work

#425 rewired the stream sites (cursor pagination, _buildPlanStream). The non-paginated multiProbe branch returns early at query.ts:6835 and never reaches a stream, so it was untouched.

#426 relaxed only the ordering leg of this guard — probeOrderDirection now comes from orderPushdownDirection and the !hasSecondaryOrders clause is gone, so multi-field orderBy no longer costs the bound. That is orthogonal. The residual-filter and RLS legs are byte-identical to the audited code.

Suggested fix

Route the non-paginated multiProbe branch (query.ts:6835) through _buildResidualFilterStream. Post-#425 that already builds a merged probe-union stream via _buildPlanStream and sizes take() by matches rather than scanned rows — which is exactly what the single-index lane at query.ts:7344 already does.

The bound is recoverable because the stream counts survivors; the current code drops it only because a plain db.query fan-out cannot.

Tests to add

Two read-bound cases, asserting on reads.scanned:

• RLS + in() + limit
• residual filter (contains) + in() + limit

Both should hold the same absolute bound at two table sizes.

Existing tests

None pin the broken behavior. convex/orm/index-union-pagination.test.ts:240 covers non-paginated multiProbe only where probeBound is already defined (no RLS, no residual filter).

Environment

• kitcn 0.32.1
• convex 1.44.0
• verified and measured against origin/main at 14bab503