Client narrowing of the fan-out domain: a tenant-column list argument intersects the request set

R46’s fan-out domain (shipped, recorded in changelog.md) is a request-level fact: the factory-supplied tenant set intersected with the hosted map, applied uniformly to every fanned field in the operation. It cannot express narrowing driven by the query itself, such as a client selecting two of their ten authorized institutions for one field. Today that shape is approximated with an ordinary filter argument: the per-tenant WHERE clause makes unwanted tenants return empty, but every domain tenant is still queried, so the client pays connection, session, and query cost for databases it asked nothing from.

A list-valued argument whose column mapping lands on the tenant column, appearing on a @tenantFanOut field, intersects the fan-out domain instead of filtering rows: domain = factory set ∩ hosted map ∩ requested list. Safe by construction: intersection only ever shrinks the authorized set, so the client can exclude but never add a tenant; the factory set remains the authorization boundary and RLS remains defense in depth.

This is the fan-out cousin of R45’s ArgumentBound (where a scalar tenant-column argument routes the field to exactly one tenant). Note the interplay with R46’s rejection list: R46 v1 rejects a marked field that already holds a binding, which is exactly the coordinate this item lands on later; the rejection is the placeholder, and this item relaxes that one combination (list-valued tenant argument + marker) into narrowing semantics, keeping the scalar-argument + marker case rejected (a scalar contradicts fanning).