@@ -9,5 +9,5 @@ Clause-②: yes (widening: new exported members of the published spec `data` ent
 
 - **`RLS_DENY_FILTER` moves into the spec.** FROM `@objectstack/plugin-security`'s own frozen literal TO `RLS_DENY_FILTER` exported by `@objectstack/spec/data`. The value is unchanged: `{ id: '__rls_deny__:00000000-0000-0000-0000-000000000000' }`, an `id` equality no record satisfies, so a consumer that never heard of it still reads zero rows. `@objectstack/plugin-security` keeps exporting `RLS_DENY_FILTER` under the same name and type; it is now the spec's object, not a second copy. Nothing to change in code that imports it from either package.
 - **One object, compared by identity.** `getReadFilter` (`ISecurityService`) now returns the sentinel itself, not a copy, for a principal-less caller, a sharing scope that cannot be resolved, an on-behalf-of caller, a caller with no permission set and a resolution failure. It also returns the sentinel itself when the only layer that constrains is the tenant wall's deny, the RLS compiler's deny (every applicable policy dropped), or the deny of a `controlled_by_parent` object whose master cannot be resolved. Before this release most of those returned a spread copy, which matched the same zero rows but was a different object. Not every zero-row answer is the sentinel: a deny ANDed with another layer is returned as the composed `$and`, with the sentinel inside it, and the record-sharing layer's own deny, `{ id: '__deny_all__' }`, is returned unchanged when sharing is the only layer that constrains. ADR-0139 D2 step 2 has the engine's `ReadableIds` composition recognise the deny by `scope === RLS_DENY_FILTER` and answer it `$in: []`; any other zero-row answer composes like any scope and still matches no row. The object is frozen: code that edited the filter `getReadFilter` returned now gets a `TypeError` instead of silently changing a deny.
-- **The composed leaf.** `ReadableIds.compose(leaf, scope)` builds the frozen value `{ object, scope }` the engine hands a driver in place of a `ReadableIds` leaf (D2 step 3). It is branded under `COMPOSED_READABLE_IDS_BRAND` (`Symbol.for('objectstack.filter.readableIds.composed')`), so a JSON round-trip, a structured clone or a spread drops the brand. `isComposedReadableIds(value)` recognises it. The type `ComposedReadableIds` is exported. `scope` is `undefined` for "no row restriction"; `compose` throws a `TypeError` for anything but a `ReadableIds.of` leaf, for a scope that is not a plain filter object, and for `RLS_DENY_FILTER` itself, which D2 step 2 answers `$in: []`.
+- **The composed leaf.** `ReadableIds.compose(leaf, scope)` builds the frozen value `{ object, scope }` the engine hands a driver in place of a `ReadableIds` leaf (D2 step 3). It is branded under `COMPOSED_READABLE_IDS_BRAND` (`Symbol.for('objectstack.filter.readableIds.composed')`), so a JSON round-trip, a structured clone or a spread drops the brand. `isComposedReadableIds(value)` recognises it. The type `ComposedReadableIds` is exported. `scope` is `undefined` for "no row restriction"; `compose` throws a `TypeError` for anything but a `ReadableIds.of` leaf, for a scope that is neither `undefined` nor a non-null, non-array object, and for `RLS_DENY_FILTER` itself, which D2 step 2 answers `$in: []`.
 - **`isReadableIds` answers as before.** It answers `false` for a composed leaf, so it still means "an uncomposed leaf", and a driver refuses on it. The comparand-shape door's `admitReadableIds` admits the uncomposed leaf only: a composed leaf handed to the engine from outside is refused `INVALID_FILTER` / 400 as a non-list comparand.
@@ -268,6 +268,21 @@ describe('isComposedReadableIds — disjoint from isReadableIds, and every copy
     expect(isComposedReadableIds(leaf)).toBe(false);
   });
 
+  it('a hand-built value carrying BOTH brands is not composed: it reads as an uncomposed leaf, whichever recogniser is asked first', () => {
+    // Both keys are global-registry symbols, so in-process code can build this.
+    const both = { object: 'x', scope: undefined };
+    Object.defineProperty(both, READABLE_IDS_BRAND, { value: true });
+    Object.defineProperty(both, COMPOSED_READABLE_IDS_BRAND, { value: true });
+    expect(isComposedReadableIds(both)).toBe(false);
+    expect(isReadableIds(both)).toBe(true);
+    // The comparand door, as measured: it admits the value as an UNCOMPOSED leaf
+    // for the composing caller (so the engine composes it from the caller's
+    // access) and refuses it for every other caller.
+    expect(() => assertListComparandShapes({ record_id: { $in: both } }, undefined, 'where', ADMIT)).not.toThrow();
+    const err = refusalOf(() => assertListComparandShapes({ record_id: { $in: both } }));
+    expect(envelopeOf(err)).toEqual(ENVELOPE);
+  });
+
   it('a JSON round-trip, a structured clone, a spread and Object.assign all drop the brand', () => {
     const copies = {
       json: JSON.parse(JSON.stringify(composed)),
 
@@ -200,25 +200,31 @@ export interface ComposedReadableIds {
 /**
  * Is `value` a branded {@link ComposedReadableIds} leaf?
  *
- * Own symbol key only, and only the declared value `true`; `object` a
- * non-empty string; `scope` an own key holding `undefined` or a plain,
- * non-array object. Every copy that lost the brand, every hand-built shape that
- * breaks one of those, an uncomposed {@link ReadableIds} leaf, `null` and every
- * primitive answer `false`.
+ * Own symbol key only, and only the declared value `true`; no own
+ * {@link READABLE_IDS_BRAND} beside it; `object` a non-empty string; `scope`
+ * an own key holding `undefined` or a non-null, non-array object. Every copy
+ * that lost the brand, every hand-built shape that breaks one of those, an
+ * uncomposed {@link ReadableIds} leaf, `null` and every primitive answer
+ * `false`.
  *
- * Disjoint from {@link isReadableIds}: no value answers `true` to both.
+ * Disjoint from {@link isReadableIds}: no value answers `true` to both. A
+ * value that carries both brands answers `false` here, so it is never a
+ * composed leaf: when its uncomposed brand is valid, {@link isReadableIds}
+ * answers `true` and the value is refused as an uncomposed leaf, whichever of
+ * the two recognisers is asked first.
  */
 export function isComposedReadableIds(value: unknown): value is ComposedReadableIds {
   if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
   if (!Object.prototype.hasOwnProperty.call(value, COMPOSED_READABLE_IDS_BRAND)) return false;
   if ((value as Record<symbol, unknown>)[COMPOSED_READABLE_IDS_BRAND] !== true) return false;
+  if (Object.prototype.hasOwnProperty.call(value, READABLE_IDS_BRAND)) return false;
   const object = (value as { object?: unknown }).object;
   if (typeof object !== 'string' || object.length === 0) return false;
   if (!Object.prototype.hasOwnProperty.call(value, 'scope')) return false;
   return isComposableScope((value as { scope?: unknown }).scope);
 }
 
-/** `undefined` (no restriction) or a plain, non-array object — the scope's two declared spellings. */
+/** `undefined` (no restriction) or a non-null, non-array object — the scope's two declared spellings. */
 function isComposableScope(scope: unknown): boolean {
   return scope === undefined || (scope !== null && typeof scope === 'object' && !Array.isArray(scope));
 }
@@ -261,7 +267,7 @@ export const ReadableIds: {
    * @param scope the parent's lowered read scope, or `undefined` for "no row
    *              restriction" (`getReadFilter`'s own spelling of it).
    * @throws TypeError when `leaf` is not a branded {@link ReadableIds} leaf;
-   *         when `scope` is neither `undefined` nor a plain, non-array object;
+   *         when `scope` is neither `undefined` nor a non-null, non-array object;
    *         or when `scope` IS {@link RLS_DENY_FILTER}, which D2 step 2
    *         answers `$in: []` and never composes.
    */