ADR-0139 D5.1 follow-up: once the ReadableIds leaf composes for a delegated caller, retire each consumer's 'delegated-caller' whole-read probe routing (plugin-audit gates, service-storage attachments) #25034

Filing gate ④, a coordination node: the per-consumer follow-up that the amended ADR-0139 D5.1 names. It is filed by the domain:engine seat 2 (seat post #20966, os-support-ai, session session_01QK6pdbxKZiHdFApL8RYVh9), from the CONTRACT_REVIEW_TIER review of PR #25032 (6306657655, ③ out-of-scope (a), escalated) and that PR's dev report (6306430776). ⛔ Not a claim. Lane and grade belong to triage. The consumers live in domain:services packages.

Blocked-by: #25009

Reader (who acts): triage routes it once #25009 (PR #25032, Tier H, awaiting the maintainer's approval) lands. Until then the residue is correct behaviour: a delegated caller takes the whole-read probe, as it must while the leaf refuses delegated callers.

What the governed text says (PR #25032's head, docs/adr/0139-engine-internal-semi-join-leaf-readable-parent-ids.md:232)

'delegated-caller' probe routing (D4) is now a residue of the refusal, retired per consumer on its own card.

The consumers, enumerated on origin/main (73432299c)

• packages/plugins/plugin-audit/src/parent-record-read-gate.ts:451: if (isDelegatedCaller(context)) return { probeWholeRead: 'delegated-caller' }; (the activity and ledger gate, ADR-0139 E5, ADR-0139 E5: plugin-audit's parent-record read gate emits one ReadableIds leaf per parent object and does no pre-scan; D5's three classes keep the probe (D4, D5) #23673).
• packages/services/service-storage/src/attachment-access-hooks.ts:1020: the same line (the attachment read gate, E7, ADR-0139 E7: the comment-thread, comment-reaction and attachment read gates emit one ReadableIds leaf per parent object and do no pre-scan; D5's three classes keep the probe (D4, D5) #23732).
• packages/plugins/plugin-audit/src/comment-access-hooks.ts (doc near :1131) and the reaction gate (E7, ADR-0139 E7: the comment-thread, comment-reaction and attachment read gates emit one ReadableIds leaf per parent object and do no pre-scan; D5's three classes keep the probe (D4, D5) #23732): the comment-thread and comment-reaction gates' D5 class routing.
• The WholeReadProbe / probeWholeRead unions that carry the 'delegated-caller' member (parent-record-read-gate.ts:225, :243; attachment-access-hooks.ts:857).

Each consumer that switches emits the leaf for a delegated caller too, keeps D5.2 and D5.3 (middleware-narrowed and other-datasource parents) on the probe, and pins delegated parity with its probe.

Dedupe (MCP search_issues, objectstack, open and closed)

"delegated-caller probe routing ReadableIds leaf consumers retire plugin-audit service-storage delegated caller probeWholeRead": 14 hits. The relevant ones are #25009 (open, the prerequisite), #25010 (open, the nested sibling), and #23732 and #23673 (closed, the E7 and E5 switches that built the routing). None retires the routing. New.

Dedupe words: delegated-caller probeWholeRead residue · ADR-0139 D5.1 consumer retire probe routing.

Generated by Claude Code