@@ -6140,11 +6140,11 @@ export class ObjectQL implements IObjectQLEngine {
    *
    * Per parent object `P`, once per call, in this order:
    *
-   *  1. **D5's three classes are refused, by name** (`INTERNAL_ERROR` / 500),
-   *     before the security service is asked anything: a delegated
-   *     (on-behalf-of) caller; a parent an object-scoped read middleware
-   *     narrows ({@link hasObjectMiddleware}); a parent bound to another
-   *     datasource than `object` ({@link resolveDatasourceBinding}).
+   *  1. **D5's two remaining classes are refused, by name** (`INTERNAL_ERROR`
+   *     / 500), before the security service is asked anything: a parent an
+   *     object-scoped read middleware narrows ({@link hasObjectMiddleware}); a
+   *     parent bound to another datasource than `object`
+   *     ({@link resolveDatasourceBinding}).
    *  2. **A parent the registry does not hold** ⇒ `$in: []`, unasked.
    *  3. **The security service** — absent or unusable ⇒ `$in: []`.
    *  4. **`canReadObject(P)`** (its `explain` fallback when the method is
@@ -6155,6 +6155,17 @@ export class ObjectQL implements IObjectQLEngine {
    *     `'policy'` and otherwise passed exactly as `P`'s own read passes its
    *     injected scope. The tenant wall is the driver's (D3).
    *
+   * [ADR-0139 D5.1, as amended] A **delegated (on-behalf-of) caller** is
+   * composed, not refused: both halves are asked with the caller's context
+   * exactly as it stands — `onBehalfOf` intact — and the security service
+   * answers each half for the delegated principal, which under ADR-0090 D10
+   * is the INTERSECTION of the principal's leg and the delegator's. The
+   * engine composes what it is answered and derives no second intersection
+   * of its own: it has one context, the delegated one, and the delegator's
+   * grants are the security service's to resolve. A service that cannot
+   * answer that context answers the deny sentinel, and step 5 turns it into
+   * `$in: []`, closed.
+   *
    * Nothing is memoised across calls. `aggregate`'s `having` and its
    * aggregations' own filters are judged here too, so a leaf a middleware
    * wrote there is refused rather than evaluated in memory.
@@ -6174,7 +6185,7 @@ export class ObjectQL implements IObjectQLEngine {
     }
     const sites = collectComposableReadableIds(object, operation, ast.where, 'where');
     if (sites.length === 0) return ast;
-    const parents = this.refuseUncomposableReadableIdsClasses(object, operation, sites, context);
+    const parents = this.refuseUncomposableReadableIdsClasses(object, operation, sites);
 
     const security = this.resolveReadableIdsSecurity();
     if (security.kind !== 'usable' && !this.readableIdsSecurityReported.has(security.kind)) {
@@ -6202,17 +6213,18 @@ export class ObjectQL implements IObjectQLEngine {
   }
 
   /**
-   * [ADR-0139 D5] Refuse D5's three classes, by name, and return the distinct
-   * parent objects of `sites` the security service is asked about, in walk
-   * order (every one but a parent the registry does not hold). Reads the
-   * context, the registry and the middleware registrations only — no security
-   * call.
+   * [ADR-0139 D5] Refuse D5's two remaining classes (D5.2 and D5.3), by name,
+   * and return the distinct parent objects of `sites` the security service is
+   * asked about, in walk order (every one but a parent the registry does not
+   * hold). Reads the registry and the middleware registrations only — no
+   * security call, and no reading of the caller's context: a delegated
+   * (on-behalf-of) caller is no longer a class of its own (D5.1, as amended),
+   * it is composed like any other through the security service's answers.
    */
   private refuseUncomposableReadableIdsClasses(
     object: string,
     operation: string,
     sites: readonly ComposableReadableIdsSite[],
-    context: ExecutionContext | undefined,
   ): string[] {
     const firstSite = new Map<string, ComposableReadableIdsSite>();
     for (const site of sites) if (!firstSite.has(site.leaf.object)) firstSite.set(site.leaf.object, site);
@@ -6222,11 +6234,6 @@ export class ObjectQL implements IObjectQLEngine {
       `such leaf ${why}. The query was NOT run and no driver was asked. Read this class through its bounded ` +
       'probe, chosen before the leaf is written.',
     );
-    const delegator = (context as { onBehalfOf?: { userId?: unknown } } | undefined)?.onBehalfOf?.userId;
-    if (delegator) {
-      throw refuse(sites[0], 'for a delegated (on-behalf-of) caller: the parent\'s read scope does not carry the ' +
-        'delegator intersection, so the composed leaf would not answer what a direct read answers');
-    }
     const outer = this.resolveDatasourceBinding(object)?.datasource;
     const composable: string[] = [];
     for (const [parent, site] of firstSite) {
 
@@ -5421,6 +5421,14 @@ export class SecurityPlugin implements Plugin {
     object: string,
     context: any,
     resolvedSets?: PermissionSet[],
+    /**
+     * [ADR-0090 D10] The depth to stamp instead of the one `getEffectiveScope`
+     * answers for `resolvedSets` — what step 2.6 stamps on a DELEGATED read,
+     * where the agent leg carries the intersected depth and the delegator leg
+     * its own ({@link computeDelegatedReadFilter}). Absent on every
+     * non-delegated call, which resolves the depth here as before.
+     */
+    depth?: string,
   ): Promise<Record<string, unknown> | null> {
     const sharing = this.resolveKernelService?.('sharing') as
       | { buildReadFilter?: (o: string, c: any) => Promise<unknown | null> }
@@ -5432,23 +5440,25 @@ export class SecurityPlugin implements Plugin {
     // [#5386] `resolvedSets` lets an in-middleware caller (the
     // controlled_by_parent derivation) pass the sets it already resolved for
     // THIS identity, instead of re-resolving them from the context.
-    let readScope: string | undefined;
-    try {
-      const permissionSets = resolvedSets ?? (await this.resolvePermissionSetsForContext(context));
-      if (permissionSets.length > 0) {
-        const meta = await this.getObjectSecurityMeta(object);
-        readScope = this.permissionEvaluator.getEffectiveScope(
-          'read',
-          object,
-          permissionSets,
-          { isPrivate: meta.isPrivate },
-        );
+    let readScope: string | undefined = depth;
+    if (readScope === undefined) {
+      try {
+        const permissionSets = resolvedSets ?? (await this.resolvePermissionSetsForContext(context));
+        if (permissionSets.length > 0) {
+          const meta = await this.getObjectSecurityMeta(object);
+          readScope = this.permissionEvaluator.getEffectiveScope(
+            'read',
+            object,
+            permissionSets,
+            { isPrivate: meta.isPrivate },
+          );
+        }
+      } catch {
+        // Depth is a WIDENING input: failing to resolve it leaves the owner-match
+        // at its narrowest ('own'), which is the safe direction. The sharing call
+        // below still runs — and its own failure still denies.
+        readScope = undefined;
       }
-    } catch {
-      // Depth is a WIDENING input: failing to resolve it leaves the owner-match
-      // at its narrowest ('own'), which is the safe direction. The sharing call
-      // below still runs — and its own failure still denies.
-      readScope = undefined;
     }
     const filter = await sharing.buildReadFilter(object, {
       ...context,
@@ -5861,6 +5871,14 @@ export class SecurityPlugin implements Plugin {
    *   3. {@link resolveSharingReadFilter} — plugin-sharing's OWD / record-share
    *      visibility filter, contributed by the sibling middleware.
    *
+   * [ADR-0090 D10] On a DELEGATED (on-behalf-of) context the chain composes
+   * each of the three twice — once for the delegated principal's leg, once for
+   * the delegator's — and so does this method ({@link computeDelegatedReadFilter}):
+   * the delegated read is scoped to the intersection, exactly as a delegated
+   * `find` is. ADR-0139 D5.1 named that intersection reaching this method as
+   * the condition under which the engine composes its `ReadableIds` leaf for a
+   * delegated caller; it does, so the engine does.
+   *
    * Each layer has been missing here at some point, and each absence had the
    * same shape: a caller who cannot read a row through `/data` could still
    * `COUNT(*)` / `GROUP BY` it through `/analytics`. Layer 3 was #4467; layer 2
@@ -5899,6 +5917,28 @@ export class SecurityPlugin implements Plugin {
     // refusal, mirrored: zero rows, read off the same predicate, before any
     // layer resolves. This used to answer the sharing predicate alone.
     if (isPrincipalLessContext(context)) return RLS_DENY_FILTER;
+    // [ADR-0090 D10 / ADR-0139 D5.1 as amended] A DELEGATED (on-behalf-of)
+    // context is scoped to the intersection of its own leg and its delegator's,
+    // composed as the engine middleware chain composes a delegated find
+    // ({@link computeDelegatedReadFilter}). This path used to answer the deny
+    // sentinel for every such context, because the intersection was threaded
+    // through the chain only; the engine's `ReadableIds` composition asks this
+    // method with the delegated context as it stands, so the intersection
+    // reaches here now. Fails CLOSED on every throw: a delegated read is never
+    // scoped wider than its delegator's own, and never served with a layer
+    // dropped.
+    if (context?.onBehalfOf?.userId) {
+      try {
+        return await this.computeDelegatedReadFilter(object, context);
+      } catch (e) {
+        this.logger.error?.(
+          `[security] getReadFilter failed for object '${object}' (principal ${context?.userId ?? 'unknown'} ` +
+            `on behalf of ${context.onBehalfOf.userId}) — denying (fail-closed)`,
+          e instanceof Error ? e : new Error(String(e)),
+        );
+        return RLS_DENY_FILTER;
+      }
+    }
     // [#4467] The OWD/sharing predicate is resolved for EVERY non-system caller,
     // ahead of the RLS branches below, because it is a SEPARATE middleware in
     // the chain this method mirrors: none of the RLS stand-downs below is a
@@ -5916,28 +5956,6 @@ export class SecurityPlugin implements Plugin {
       );
       return RLS_DENY_FILTER;
     }
-    // [#2852] D10 delegator intersection is NOT implemented on this path.
-    // The engine middleware (find/count/aggregate) intersects an on-behalf-of
-    // read with the DELEGATOR's own RLS (resolveDelegatorContext, ~L689), but
-    // getReadFilter — the read-scope provider bound by the analytics/raw-SQL
-    // path — resolves only the CALLER's ceiling. Computing a filter here for a
-    // delegated (agent) context would therefore SILENTLY WIDEN the read past
-    // the delegator's scope (the confused-deputy widening D10 prevents on the
-    // CRUD path). Until the intersection is threaded through computeRlsFilter
-    // (tracked with #2920 B1 / ADR-0095 D1), FAIL CLOSED: a delegated read on
-    // this path denies rather than under-scopes. System on-behalf-of already
-    // returned above; today no agent surface reaches analytics, so this is a
-    // latent-invariant guard, not a live-traffic change.
-    if (context?.onBehalfOf?.userId) {
-      this.logger.error?.(
-        `[security] getReadFilter received an on-behalf-of context for object ` +
-          `'${object}' (agent ${context?.userId ?? 'unknown'} on behalf of ` +
-          `${context.onBehalfOf.userId}) — the D10 delegator intersection is not ` +
-          `implemented on the read-scope path; denying (fail-closed: a delegated read is never scoped ` +
-          `wider than its delegator's own)`,
-      );
-      return RLS_DENY_FILTER;
-    }
     try {
       const permissionSets = await this.resolvePermissionSetsForContext(context);
       // [#21079] ADR-0056 D2 — the deny baseline at the row scope. A caller who
@@ -5978,6 +5996,87 @@ export class SecurityPlugin implements Plugin {
     }
   }
 
+  /**
+   * [ADR-0090 D10 / ADR-0139 D5.1 as amended] The read scope of a DELEGATED
+   * (on-behalf-of) principal: the INTERSECTION of the principal's own leg and
+   * the delegator's — never the union — composed here exactly as the engine
+   * middleware chain composes a delegated `find` of `object`, layer for layer:
+   *
+   *   1. {@link computeRlsFilter} over the principal's sets, with the delegated
+   *      context AS IT STANDS — {@link collectRLSPolicies} reads that context as
+   *      the delegated principal's own leg (`isDelegatedPrincipalLeg`), so the
+   *      ceiling's silence contributes no object default row scope;
+   *   2. {@link computeControlledByParentFilter} for the principal;
+   *   3. {@link computeRlsFilter} over the DELEGATOR's sets, with the context
+   *      {@link resolveDelegatorContext} rebuilds for them (the middleware's
+   *      D10 half, step 3);
+   *   4. {@link computeControlledByParentFilter} for the delegator;
+   *   5. plugin-sharing's visibility filter for the principal's identity, at
+   *      the agent-leg depth step 2.6 stamps as `__readScope`
+   *      (`intersectDelegatedScope` of the ceiling's DECLARED depth and the
+   *      delegator's effective one);
+   *   6. the same filter re-run under the DELEGATOR's identity at the
+   *      delegator's own depth — plugin-sharing's second call, with `userId`
+   *      swapped to the delegator and no delegation link.
+   *
+   * Fails CLOSED where the chain refuses, with the deny sentinel by identity:
+   * a principal that resolves no set (ADR-0056 D2); a delegator the link names
+   * who does not exist (the chain's `PERMISSION_DENIED`; `canReadObject`'s
+   * `false`); a delegator who resolves no set (object admission refuses them);
+   * a sharing scope that cannot be resolved. A throw anywhere propagates to the
+   * caller's catch, which denies.
+   *
+   * ⛔ Not a second intersection rule: every leg is the primitive the
+   * middleware calls, in the middleware's spelling, and the delegator's context
+   * comes from the one resolver the middleware and `canReadObject` share.
+   */
+  private async computeDelegatedReadFilter(
+    object: string,
+    context: any,
+  ): Promise<Record<string, unknown> | undefined> {
+    const permissionSets = await this.resolvePermissionSetsForContext(context);
+    if (permissionSets.length === 0) return RLS_DENY_FILTER;
+    const del = await resolveDelegatorContext(this.ql, context);
+    if (del.kind !== 'resolved') {
+      this.logger.error?.(
+        `[security] getReadFilter received an on-behalf-of context for object '${object}' whose delegator ` +
+          `'${String(context?.onBehalfOf?.userId)}' does not exist — denying (fail-closed: ADR-0090 D10, a ` +
+          `delegated read with no delegator to intersect against is never scoped)`,
+      );
+      return RLS_DENY_FILTER;
+    }
+    const delegatorContext = del.context;
+    const delegatorSets = await this.resolvePermissionSetsForContext(delegatorContext);
+    if (delegatorSets.length === 0) return RLS_DENY_FILTER;
+
+    // Step 2.6's two depth stamps, from the same two evaluator calls.
+    const meta = await this.getObjectSecurityMeta(object);
+    const delegatorScope = this.permissionEvaluator.getEffectiveScope('read', object, delegatorSets, { isPrivate: meta.isPrivate });
+    const declared = this.permissionEvaluator.getDeclaredScope('read', object, permissionSets, { isPrivate: meta.isPrivate });
+    const agentLegScope = intersectDelegatedScope(declared, delegatorScope).agentLegScope;
+
+    // Layers 5 and 6 — the sibling middleware's two calls. Resolved first, as
+    // the non-delegated path resolves its one sharing layer first: a sharing
+    // outage denies before any RLS layer is composed.
+    const sharingFilter = await this.resolveSharingReadFilter(object, context, permissionSets, agentLegScope);
+    const delegatorSharingFilter = await this.resolveSharingReadFilter(
+      object,
+      { ...context, userId: delegatorContext.userId, onBehalfOf: undefined },
+      delegatorSets,
+      delegatorScope,
+    );
+
+    // Layers 1 to 4 — the security middleware's own four, in its order.
+    const filter = await this.computeRlsFilter(permissionSets, object, 'find', context);
+    const cbpFilter = await this.computeControlledByParentFilter(permissionSets, object, context);
+    const delFilter = await this.computeRlsFilter(delegatorSets, object, 'find', delegatorContext);
+    const delCbpFilter = await this.computeControlledByParentFilter(delegatorSets, object, delegatorContext);
+
+    const securityLayers = andComposeLayers(andComposeLayers(filter, cbpFilter), andComposeLayers(delFilter, delCbpFilter));
+    const sharingLayers = andComposeLayers(sharingFilter, delegatorSharingFilter);
+    return andComposeLayers(securityLayers, sharingLayers) ?? undefined;
+  }
+
   /**
    * [#3547] Query surface: the field names the caller MAY READ on `object`
    * under `context`. This is the authoritative column projection for a