docs(adr): ADR-0139 — one engine-internal semi-join leaf, "the ids of object X this caller may read" (ruling A on #22590 item 3)

docs/adr/0055-master-detail-controlled-by-parent.md

@@ -1,6 +1,7 @@
 # ADR-0055: Master-detail "controlled by parent" permissions — derived access via pre-resolved master-id membership
 
 **Status**: Accepted (2026-06-19) — implemented in this PR (P0–P2) · **Amended** (2026-09-07, #11082 / PR #11183 — the "Single-level only in v1" limit under Consequences and the "Transitive nested master-detail chains" **Non-goal** are both **reversed**: since `@objectstack/plugin-security` 17.3.0 (merged 2026-08-23) the read derivation and the write gate compose `controlled_by_parent` across a chain, bounded by a cycle guard and a cost ceiling that both fail **closed**. Nothing else in this record changes — §1–§4, the mechanism choice, the set-size limit and the share-table non-goal all stand. See **"Amendment (2026-09-07, #11082): transitive chains compose — the single-level non-goal is reversed"** at the end.)
+· **Revisited in part** (2026-10-10, [ADR-0139](./0139-engine-internal-semi-join-leaf-readable-parent-ids.md), Proposed) — §2's alternatives row (a) is reversed for ONE engine-internal, non-authorable leaf the engine composes from the compiler's output; the RLS compiler still has no subquery form, and §2's chosen mechanism (b), its `rlsMembership` IN-form and the set-size limit all stand.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove), [ADR-0054](./0054-runtime-proof-for-authorable-surface.md) (prove-it-runs)
 **Surfaced by**: an audit of master-detail permission semantics — `OWDModel.controlled_by_parent` is **declared but unenforced** (zero runtime consumers; not reachable through the object's `sharingModel` enum; the RLS compiler is relationship-blind). This is *false compliance* (ADR-0049) and *unproven liveness* (ADR-0054).

docs/adr/0056-permission-model-landing-verification.md

@@ -166,7 +166,7 @@ The one-time table above rots. Make it a **living ledger**: extend the ADR-0054
 
 - **Not** a permission-model rewrite — the Salesforce-shaped model stays; this is landing verification.
 - **Not** designing the compliance/encryption/masking subsystems (D8 only triages their *status*).
-- **Not** adding RLS-compiler subquery support (ADR-0055 constraint stands; widening uses pre-resolved `rlsMembership`).
+- **Not** adding RLS-compiler subquery support (ADR-0055 constraint stands; widening uses pre-resolved `rlsMembership`). · **Revisited in part** (2026-10-10, [ADR-0139](./0139-engine-internal-semi-join-leaf-readable-parent-ids.md), Proposed): the compiler gains no subquery form; ONE engine-internal, non-authorable leaf is composed by the engine from the compiler's output.
 - **Not** ServiceNow-style per-row ACL scripts, nor client-side enforcement (server is the boundary).
 
 ## Alternatives considered