@@ -0,0 +1,25 @@
+---
+'@objectstack/objectql': minor
+'@objectstack/core': patch
+---
+
+feat(objectql): the engine composes a `ReadableIds` leaf at its executor boundary, on the final query immediately before the driver call, and refuses it by name wherever it cannot (ADR-0139 D2, D5)
+
+Clause-②: no
+
+- **Composed.** On `find`, `findOne`, `count` and `aggregate`, after the middleware chain and the `beforeFind` hooks, every `{ FIELD: { $in: ReadableIds.of(P) } }` in `where` is replaced by `ReadableIds.compose(leaf, scope)`, where `scope` is the registered security service's `getReadFilter(P, caller)`, marked `'policy'` (`undefined` composes with no row restriction). The comparand becomes `$in: []`, which matches no row, when:
+  - `canReadObject(P, caller)` is false or throws (a service without `canReadObject` is asked `explain`, and only `allowed: true` admits);
+  - `getReadFilter` answers `RLS_DENY_FILTER` (by identity) or throws;
+  - no security service is registered, or the registered one cannot answer both halves (the engine reads the kernel's `security` service through `ObjectQLPlugin` when a leaf is composed, so an engine used without that plugin has none);
+  - the registry holds no object `P`.
+
+  Each parent object is asked once per read, and nothing is kept across reads. A leaf that a middleware or a `beforeFind` hook writes is composed the same way.
+- **Refused, `INTERNAL_ERROR` / 500, before any driver is asked:**
+  - on `update` and `delete`: the caller's leaf at the comparand door, a middleware's at the executor's entry, before the prior-row reads;
+  - in `having` and in an aggregation's own `filter`;
+  - anywhere but a `$in` comparand, including a leaf the array form of `where` lowers into another position;
+  - a composed leaf the engine did not compose, written by a middleware or a hook (the caller's own, as a `$in` comparand, stays the comparand door's `INVALID_FILTER` / 400);
+  - ADR-0139 D5's three classes: a delegated (on-behalf-of) caller, a parent with an object-scoped read middleware, and a parent bound to another datasource than the object read.
+- **Before:** the comparand door refused every `ReadableIds` leaf `INTERNAL_ERROR` / 500 ("this engine does not compose that leaf yet"), and a leaf that a middleware or a hook wrote reached the driver unrefused.
+- **`@objectstack/core`:** `resolveFilterTokens` returns a `ReadableIds` leaf by reference. When the filter also held a placeholder, it used to rebuild the leaf as a plain `{ object }` and drop its brand.
+- **Not yet:** no driver evaluates the composed leaf (ADR-0139 E3 and E4), and no code in the platform writes a `ReadableIds` leaf today.
@@ -95,6 +95,13 @@ const CALLERS: Record<string, Classification> = {
     kind: 'not-a-door',
     reason: 'the provider: it implements the admission and binds it into the security service it registers; it serves no rows',
   },
+  'packages/objectql/src/engine.ts': {
+    kind: 'not-a-door',
+    reason:
+      'the ReadableIds composition (ADR-0139 D2): it asks the admission of a PARENT object to compose the scope of a `$in` leaf '
+      + 'that only narrows the read the caller addressed, whose own door already admitted it; no row and no field of the '
+      + 'parent is served, and a refused parent answers `$in: []`',
+  },
 };
 
 const SCAN_TIMEOUT_MS = 60_000;
 
@@ -1,6 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { describe, it, expect } from 'vitest';
+import { ReadableIds, isReadableIds } from '@objectstack/spec/data';
 import {
   resolveFilterToken,
   resolveFilterTokens,
@@ -296,6 +297,21 @@ describe('resolveFilterTokens — tree walk', () => {
   it('accepts the `${token}` spelling', () => {
     expect(resolveFilterTokens({ d: '${30_days_ago}' }, ctx)).toEqual({ d: '2026-06-15' });
   });
+
+  // [ADR-0139 D1] The tree around a placeholder is rebuilt; a `ReadableIds`
+  // leaf in it is not. Its brand is a non-enumerable symbol key, so a copy of
+  // it is an unbranded `{ object }` that the engine's executor boundary cannot
+  // compose.
+  it('returns a ReadableIds leaf beside a resolved placeholder by reference, brand intact', () => {
+    const leaf = ReadableIds.of('cpz_doc');
+    const out = resolveFilterTokens(
+      { owner: '{current_user_id}', $or: [{ record_id: { $in: leaf } }, { note: 'x' }] },
+      ctx,
+    ) as { owner: string; $or: Array<{ record_id?: { $in: unknown } }> };
+    expect(out.owner).toBe('usr_1');
+    expect(out.$or[0].record_id!.$in).toBe(leaf);
+    expect(isReadableIds(out.$or[0].record_id!.$in)).toBe(true);
+  });
 });
 
 /**
 
@@ -106,6 +106,7 @@
 
 import {
   classifyFilterToken,
+  isReadableIds,
   isRecordContextToken,
   parseDateMacroParam,
   type DateMacroUnit,
@@ -505,6 +506,9 @@ export function resolveFilterToken(
 function hasFilterToken(node: unknown): boolean {
   if (typeof node === 'string') return classifyFilterToken(node) !== null;
   if (Array.isArray(node)) return node.some(hasFilterToken);
+  // A `ReadableIds` leaf is a comparand value: its `object` names a table and
+  // is never a placeholder (see `resolveFilterTokens`).
+  if (isReadableIds(node)) return false;
   if (node && typeof node === 'object' && !(node instanceof Date)) {
     return Object.values(node as Record<string, unknown>).some(hasFilterToken);
   }
@@ -518,6 +522,13 @@ function hasFilterToken(node: unknown): boolean {
  * bake one request's user id, and one day's dates, into every later render).
  *
  * Returns the input unchanged, by reference, when it holds no placeholders.
+ *
+ * [ADR-0139 D1] A branded `ReadableIds` leaf is returned BY REFERENCE, never
+ * rebuilt. Its brand is a non-enumerable symbol key, so the plain-object copy
+ * below would hand back an unbranded `{ object }`: a leaf beside a resolved
+ * placeholder would then reach the engine's executor boundary as a plain
+ * object in a `$in` comparand, which the engine cannot compose. The leaf holds
+ * no placeholder and is frozen, so returning it unchanged is exact.
  */
 export function resolveFilterTokens<T>(
   filter: T,
@@ -542,6 +553,8 @@ export function resolveFilterTokens<T>(
       return resolved;
     }
     if (Array.isArray(node)) return node.map(walk);
+    // [ADR-0139 D1] The leaf by reference, brand intact (see above).
+    if (isReadableIds(node)) return node;
     if (node && typeof node === 'object') {
       // Dates and other class instances are comparands, not filter structure.
       if (node instanceof Date) return node;