docs(adr): ADR-0139 marks O5 answered and the E2 pins follow the amended D5.1; the ancestors docblock counts six call sites

- Open items: O5 is marked answered, pointing at D6 where the ruling is recorded.
- E2 row, Pins cell: a delegated caller composes (both halves asked with the link
  intact, the closed doors still `$in: []`); a middleware-gated or federated parent
  keeps the loud refusal, a delegated context included.
- security-plugin.ts: computeControlledByParentFilter's `ancestors` docblock counts
  the six call sites (five with empty ancestors, the recursive hop the sixth). Comment only.

Claude-Session: https://claude.ai/code/session_01QK6pdbxKZiHdFApL8RYVh9
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

docs/adr/0139-engine-internal-semi-join-leaf-readable-parent-ids.md

@@ -308,7 +308,8 @@ here.
 - **O3** — `driver-mongodb`: the cost of a pipeline form is unprototyped; it refuses until measured.
 - **O4** — `packages/plugins/plugin-sharing/src/sharing-service.ts` reads a caller's record-share grants at
   `limit: 5000` with no warning; that scope rides into the subquery unchanged. A separate finding, not this record's.
-- **O5** — whether `controlled_by_parent`'s id set becomes a seventh consumer (D6).
+- **O5** — whether `controlled_by_parent`'s id set becomes a seventh consumer (D6). **Answered** (2026-10-21): the
+  ruling is recorded verbatim in D6, as amended.
 
 ## Acceptance criteria
 
@@ -323,7 +324,7 @@ and none changes `packages/spec` before it.
 | Card | Decisions | What lands | Pins (red before, green after) | Order |
 |:--|:--|:--|:--|:--|
 | **E1** — the leaf | D1 | `ReadableIds` in `packages/spec/src/data/`; the comparand door admits the branded value and refuses the unbranded one | a JSON round-trip of a `where` holding the leaf is refused; the plain-object spelling is refused 400 | first |
-| **E2** — composition | D2, D5 | the engine seam composes the leaf, refuses it on write verbs and for D5's three classes as accepted (D5.1 amended 2026-10-21: the delegated caller composes), marks the scope `'policy'`; the conformance case-set | `canReadObject` false ⇒ no row; deny sentinel ⇒ no row; a delegated, middleware-gated or federated parent ⇒ the loud refusal | after E1 |
+| **E2** — composition | D2, D5 | the engine seam composes the leaf, refuses it on write verbs and for D5's three classes as accepted (D5.1 amended 2026-10-21: the delegated caller composes), marks the scope `'policy'`; the conformance case-set | `canReadObject` false ⇒ no row; deny sentinel ⇒ no row; a delegated caller composes (both halves asked with the delegation link intact, the closed doors still `$in: []`); a middleware-gated or federated parent ⇒ the loud refusal, a delegated context included | after E1 |
 | **E3** — SQL family | D3 | `driver-sql` compiles the leaf inside `packages/drivers/driver-sql/src/sql-driver.ts#applyTenantScope`; wasm and local Turso inherit; the remote transport compiles it | a reader with more than 2,000 readable candidates gets every visible row; an unreadable row stays hidden; a deleted parent is excluded; `count` equals the rows served | after E2 |
 | **E4** — memory and mongodb | D3 | memory implements; mongodb refuses with the envelope | the conformance table records both | with E3 |
 | **E5** — the activity and ledger switch | D4, D5 | `packages/plugins/plugin-audit/src/parent-record-read-gate.ts#computeParentRecordFilter` emits leaves, no pre-scan; D5's classes keep the probe; letter C's refusal retired from these two | the measured scenario answers 1,808 of 1,808; the exemption capability unchanged; the outside class as a predicate | after E3 |

packages/plugins/plugin-security/src/security-plugin.ts

@@ -8743,9 +8743,10 @@ export class SecurityPlugin implements Plugin {
     context: any,
     /**
      * [ADR-0055 amendment] The `controlled_by_parent` objects already being resolved on
-     * this branch of the walk, outermost first. Empty at every real call site
-     * — the four are the CRUD middleware (caller and D10 delegator) and
-     * `getReadFilter` — and grown by one on each recursive hop.
+     * this branch of the walk, outermost first. Empty at five of the six call
+     * sites — the CRUD middleware (caller and D10 delegator), `getReadFilter`
+     * and `computeDelegatedReadFilter` (principal and delegator) — and grown by
+     * one at the sixth, the recursive hop.
      */
     ancestors: readonly string[] = [],
   ): Promise<Record<string, unknown> | null> {