@@ -0,0 +1,19 @@
+---
+'@objectstack/objectql': minor
+'@objectstack/plugin-security': minor
+---
+
+feat(objectql, plugin-security): the engine composes its `ReadableIds` leaf for a delegated (on-behalf-of) caller, scoped to the delegator intersection, instead of refusing it (ADR-0139 D5.1 as amended; O5 answered)
+
+Clause-②: no
+
+**Before.** A read carrying an on-behalf-of link whose final `where` held a `ReadableIds` leaf was refused `INTERNAL_ERROR` / 500 before any driver was asked (ADR-0139 D5.1 as accepted), and `getReadFilter` answered the deny sentinel for every delegated context, so the leaf's consumers routed such a caller to their bounded, fail-closed probe.
+
+**Now.**
+
+- `@objectstack/objectql`: the executor boundary composes the leaf for a delegated caller exactly as for any other. It asks `canReadObject` and `getReadFilter` with the delegated context as it stands (`onBehalfOf` intact) and composes what the security service answers; it derives no intersection of its own. The two remaining D5 classes, a parent an object-scoped read middleware narrows and a parent bound to another datasource, are still refused by name with the same envelope.
+- `@objectstack/plugin-security`: `getReadFilter` answers a delegated context the ADR-0090 D10 intersection, the six layers the engine middleware ANDs into a delegated `find` of the same object: the principal's row-level security and `controlled_by_parent` derivation, the delegator's two over the delegator's own rebuilt context, and the sharing visibility filter under each identity at its own depth. A delegated read through the leaf serves exactly the rows a delegated direct read of the parent serves. It fails closed as the chain does: a delegator who does not exist, a delegator the object does not admit, a principal or a delegator that resolves no permission set, and any resolution failure answer the deny sentinel, and the leaf is `$in: []`.
+
+**What a reader sees.** No shipped consumer writes a leaf for a delegated caller yet (each still routes it to its probe; that routing retires per consumer on its own card), so a delegated read of `sys_activity`, `sys_audit_log`, `sys_comment`, `sys_comment_reaction` or `sys_attachment` is served as before. A door that binds `getReadFilter` directly, such as the analytics raw-SQL path, scopes a delegated context to the intersection now; as accepted it denied that context outright.
+
+**Unchanged.** `controlled_by_parent`'s own read scope (ADR-0055 §2 mechanism (b), the pre-resolved id set) and the nested master chain, which keep their own cards; the delegated `find`, `findOne`, `count` and `aggregate` through the engine middleware, which already applied the intersection.
@@ -323,7 +323,7 @@ and none changes `packages/spec` before it.
 | Card | Decisions | What lands | Pins (red before, green after) | Order |
 |:--|:--|:--|:--|:--|
 | **E1** — the leaf | D1 | `ReadableIds` in `packages/spec/src/data/`; the comparand door admits the branded value and refuses the unbranded one | a JSON round-trip of a `where` holding the leaf is refused; the plain-object spelling is refused 400 | first |
-| **E2** — composition | D2, D5 | the engine seam composes the leaf, refuses it on write verbs and for D5's three classes, marks the scope `'policy'`; the conformance case-set | `canReadObject` false ⇒ no row; deny sentinel ⇒ no row; a delegated, middleware-gated or federated parent ⇒ the loud refusal | after E1 |
+| **E2** — composition | D2, D5 | the engine seam composes the leaf, refuses it on write verbs and for D5's three classes as accepted (D5.1 amended 2026-10-21: the delegated caller composes), marks the scope `'policy'`; the conformance case-set | `canReadObject` false ⇒ no row; deny sentinel ⇒ no row; a delegated, middleware-gated or federated parent ⇒ the loud refusal | after E1 |
 | **E3** — SQL family | D3 | `driver-sql` compiles the leaf inside `packages/drivers/driver-sql/src/sql-driver.ts#applyTenantScope`; wasm and local Turso inherit; the remote transport compiles it | a reader with more than 2,000 readable candidates gets every visible row; an unreadable row stays hidden; a deleted parent is excluded; `count` equals the rows served | after E2 |
 | **E4** — memory and mongodb | D3 | memory implements; mongodb refuses with the envelope | the conformance table records both | with E3 |
 | **E5** — the activity and ledger switch | D4, D5 | `packages/plugins/plugin-audit/src/parent-record-read-gate.ts#computeParentRecordFilter` emits leaves, no pre-scan; D5's classes keep the probe; letter C's refusal retired from these two | the measured scenario answers 1,808 of 1,808; the exemption capability unchanged; the outside class as a predicate | after E3 |
 
@@ -22,8 +22,10 @@
  * Case 1 drives a REAL report site on a bare instance, so the pin is about what
  * an operator sees rather than about a field's contents. `getReadFilter` with an
  * on-behalf-of context is the one refusal reachable with no `ql`, no `metadata`
- * and no `start()`: it fails closed on the unimplemented D10 delegator
- * intersection (#2852) and reports through `this.logger.error?.()`.
+ * and no `start()`: the ADR-0090 D10 intersection it composes (ADR-0139 D5.1 as
+ * amended) needs the delegator's `sys_user` row, which a bare instance cannot
+ * read, so the link names a delegator who does not exist and the read fails
+ * closed on that dangling link, reporting through `this.logger.error?.()`.
  *
  * Case 2 pins the channel the LEDGER row is about. `error` stays optional by
  * #9754's own ruling (hosts inject reduced sinks); `warn` is the channel a
 
@@ -6040,8 +6040,9 @@ export class SecurityPlugin implements Plugin {
     if (del.kind !== 'resolved') {
       this.logger.error?.(
         `[security] getReadFilter received an on-behalf-of context for object '${object}' whose delegator ` +
-          `'${String(context?.onBehalfOf?.userId)}' does not exist — denying (fail-closed: ADR-0090 D10, a ` +
-          `delegated read with no delegator to intersect against is never scoped)`,
+          `'${String(context?.onBehalfOf?.userId)}' does not exist — denying (fail-closed: a delegated read is ` +
+          `never scoped wider than its delegator's own, and with no delegator to intersect against it is not ` +
+          `scoped at all; ADR-0090 D10)`,
       );
       return RLS_DENY_FILTER;
     }
 
@@ -77,11 +77,13 @@ const sinkOf = (plugin: SecurityPlugin) => (plugin as any).logger;
  * Drive a REAL report through `this.logger` and return whether it landed.
  *
  * `getReadFilter` is a public instance method whose on-behalf-of refusal
- * (`this.logger.error?.(…)`, the ADR-0095/#2852 fail-closed branch) depends on
- * NONE of the handles captured below the bail-outs — no `this.ql`, no
- * `this.metadata`. That makes it the one report site that is genuinely
- * reachable on a bailed-out instance, which is what makes it the right probe
- * for "the sink RECEIVES something".
+ * (`this.logger.error?.(…)`, the ADR-0090 D10 fail-closed branch for a
+ * delegator who does not exist — on a bailed-out instance the delegator's
+ * `sys_user` row cannot be read, so the link dangles) depends on NONE of the
+ * handles captured below the bail-outs — no `this.ql`, no `this.metadata`.
+ * That makes it the one report site that is genuinely reachable on a
+ * bailed-out instance, which is what makes it the right probe for "the sink
+ * RECEIVES something".
  *
  * Pre-fix this call is silent: `{}.error` is `undefined` and `?.()` no-ops.
  */