fix(run-store): reject findRuns take without orderBy across both run tables

An unordered take capped each run table independently and concatenated the
two results, so a both-table read could silently drop one table rows once
the other filled the cap. Reject it like the existing skip and cursor guards;
callers that need a bounded cross-table read pass an orderBy for the keyset
merge.

Author: d-cs

internal-packages/run-store/src/PostgresRunStore.test.ts

@@ -2400,6 +2400,34 @@ describe("PostgresRunStore — table routing by id format", () => {
     }
   );
 
+  postgresTest(
+    "findRuns rejects `take` without `orderBy` across both tables (non-deterministic cap)",
+    async ({ prisma }) => {
+      const { environment } = await seedEnvironment(prisma);
+      const store = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
+
+      // A both-table predicate (no id-list) with `take` but no `orderBy` would
+      // cap each table independently and silently drop one table's overflow.
+      await expect(
+        store.findRuns({
+          where: { runtimeEnvironmentId: environment.id },
+          select: { id: true },
+          take: 5,
+        })
+      ).rejects.toThrow(/take.*orderBy/i);
+
+      // The same read WITH an `orderBy` is a valid bounded cross-table merge.
+      await expect(
+        store.findRuns({
+          where: { runtimeEnvironmentId: environment.id },
+          select: { id: true, createdAt: true },
+          orderBy: { createdAt: "desc" },
+          take: 5,
+        })
+      ).resolves.toBeDefined();
+    }
+  );
+
   postgresTest(
     "findRuns with an id-list partitions by id format and skips the table with no candidate ids",
     async ({ prisma }) => {

internal-packages/run-store/src/PostgresRunStore.ts

@@ -936,6 +936,20 @@ export class PostgresRunStore implements RunStore {
         "RunStore.findRuns: a negative `take` (Prisma 'last N') is not supported across both run tables."
       );
     }
+    // `take` without `orderBy` across BOTH tables is non-deterministic: each
+    // table is capped at `take` independently, then the two capped sets are
+    // concatenated, so once one table fills `take` the other table's rows are
+    // silently dropped. Reject it (like `skip`/`cursor` above) rather than
+    // return a result that may omit one table. Add an `orderBy` for a bounded
+    // cross-table merge, or scope the predicate to a single table.
+    if (args.take !== undefined && ordered.length === 0) {
+      throw new Error(
+        "RunStore.findRuns: `take` without `orderBy` is not supported across both run tables " +
+          "(each table is capped independently, so the cap is non-deterministic and may omit one " +
+          "table's rows). Add an `orderBy` for a bounded cross-table merge, or scope the predicate " +
+          "to a single table."
+      );
+    }
 
     // ORDERED + LIMITED → bounded 2-way merge.
     if (ordered.length > 0 && args.take !== undefined) {
@@ -960,9 +974,10 @@ export class PostgresRunStore implements RunStore {
       return this.#stripAddedKeys(merged, addedKeys);
     }
 
-    // UNORDERED / NO-LIMIT (or `take` without `orderBy`) → run the SAME args
-    // against both tables and concatenate. A run is in exactly one table, so
-    // concatenation is complete and has no duplicates.
+    // UNORDERED / NO-LIMIT → run the SAME args against both tables and
+    // concatenate. A run is in exactly one table, so concatenation is complete
+    // and has no duplicates. (`take` without `orderBy` was rejected above;
+    // `orderBy` + `take` took the bounded-merge branch above.)
     //
     // `orderBy` without `take` still needs the order keys projected so the
     // whole-set re-sort below can read them.
@@ -985,13 +1000,6 @@ export class PostgresRunStore implements RunStore {
       combined = combined.sort(comparator);
     }
 
-    // `take` without `orderBy`: an unordered cap. Each table was capped at
-    // `take`, so the concatenation is at most `2*take`; trim to `take`. Order
-    // among unordered rows is unspecified either way.
-    if (args.take !== undefined) {
-      combined = combined.slice(0, args.take);
-    }
-
     return this.#stripAddedKeys(combined, addedKeys);
   }