@@ -115,6 +115,7 @@ function boot(opts: BootOpts = {}) {
     (rest as any).resolveExecCtx = async () => ('context' in opts ? opts.context : CTX);
     (rest as any).resolveSecurityService = async () => opts.security;
     (rest as any).approvalsServiceProvider = opts.approvals === undefined ? undefined : async () => opts.approvals;
+    const apiGate = vi.spyOn(rest as any, 'enforceApiAccess');
     rest.registerRoutes();
     const route = (rest as any).getRoutes().find(
         (r: any) => r.method === 'POST' && r.path === '/api/v1/data/:object/:id/page',
@@ -125,7 +126,7 @@ function boot(opts: BootOpts = {}) {
         await route.handler({ method: 'POST', params, query, headers: {}, body } as any, res);
         return { status: res.statusCode, body: res.json.mock.calls.at(-1)?.[0] };
     };
-    return { getData, findData, call };
+    return { getData, findData, call, apiGate };
 }
 
 const recordNotFound = () => Object.assign(new Error('Record a1 not found in account'), {
@@ -136,6 +137,14 @@ const permissionDenied = () => Object.assign(new Error('[Security] Access denied
 });
 
 describe('[#27627] POST /data/:object/:id/page', () => {
+    it('asks the object-exposure gate as GET /data/:object/:id does, with the caller\'s context (#27692)', async () => {
+        const { call, apiGate } = boot();
+        expect((await call({})).status).toBe(200);
+        expect(apiGate).toHaveBeenCalledTimes(1);
+        const [, , , environmentId, operation, context] = apiGate.mock.calls[0];
+        expect([environmentId, operation, context]).toEqual([undefined, 'get', CTX]);
+    });
+
     it("answers every part with the call the read it replaces makes, as the caller, in the schema's shape", async () => {
         const getRecordFieldAccess = vi.fn().mockResolvedValue(ACCESS);
         const explain = vi.fn(async (req: any) => DECISION(req.operation));
@@ -168,11 +177,11 @@ describe('[#27627] POST /data/:object/:id/page', () => {
         // Each related list: the parent condition (to the field's arity), AND
         // the declared scope, with `count` — as `GET /data/note` reads it.
         expect(findData.mock.calls.map(([req]) => req)).toEqual([
-            { object: 'note', query: { filter: { account: 'a1' }, top: 3, count: true }, context: CTX },
-            { object: 'note', query: { filter: { $and: [{ account: 'a1' }, { title: 'x' }] }, top: 0, count: true }, context: CTX },
-            { object: 'note', query: { filter: { watchers: { $contains: 'a1' } }, top: 1, count: true, orderBy: [{ field: 'title', order: 'desc' }] }, context: CTX },
+            { object: 'note', query: { object: 'note', where: { account: 'a1' }, limit: 3, count: true }, context: CTX },
+            { object: 'note', query: { object: 'note', where: { $and: [{ account: 'a1' }, { title: 'x' }] }, limit: 0, count: true }, context: CTX },
+            { object: 'note', query: { object: 'note', where: { watchers: { $contains: 'a1' } }, limit: 1, count: true, orderBy: [{ field: 'title', order: 'desc' }] }, context: CTX },
         ]);
-        expect(data.related.map((r) => [r.field, r.total, r.records])).toEqual([
+        expect(data.related.map((r) => ('total' in r ? [r.field, r.total, r.records] : [r.field, r.error]))).toEqual([
             ['account', 7, [{ id: 'note-1' }]],
             ['account', 7, [{ id: 'note-1' }]],
             ['watchers', 7, [{ id: 'note-1' }]],
@@ -241,7 +250,7 @@ describe('[#27627] POST /data/:object/:id/page', () => {
         const [list] = RecordPageResponseSchema.parse(answer.body.data).related;
         expect(list).not.toHaveProperty('total');
         expect(list).not.toHaveProperty('records');
-        expect(list.error).toMatchObject({ code: 'OBJECT_API_DISABLED', status: 404 });
+        expect('error' in list ? list.error : undefined).toMatchObject({ code: 'OBJECT_API_DISABLED', status: 404 });
         expect(findData).not.toHaveBeenCalled();
     });
 
 
@@ -116,7 +116,7 @@ export function registerRecordPageEndpoints(this: RecordPageRouteHost, basePath:
                 const p = await this.resolveProtocol(environmentId, req);
                 const context = await this.resolveExecCtx(environmentId, req);
                 if (this.enforceAuth(req, res, context)) return;
-                if (await this.enforceApiAccess(req, res, p, environmentId, 'get')) return;
+                if (await this.enforceApiAccess(req, res, p, environmentId, 'get', context)) return;
                 if (refuseUnknownQueryParams(req, res, RECORD_PAGE_PARAMS)) return;
 
                 const rawBody = req.body ?? {};
@@ -199,12 +199,15 @@ export function registerRecordPageEndpoints(this: RecordPageRouteHost, basePath:
                         const where = declared === undefined ? parentScope : { $and: [parentScope, declared] };
                         const found: any = await p.findData({
                             object: entry.object,
+                            // Canonical QueryAST (#16337), with the list's
+                            // `$count` as the request declares it.
                             query: {
-                                filter: where,
-                                top: entry.top,
+                                object: entry.object,
+                                where,
+                                limit: entry.top,
                                 count: true,
                                 ...(entry.sort && entry.sort.length > 0 ? { orderBy: entry.sort } : {}),
-                            } as any,
+                            },
                             ...scope,
                         } satisfies ServerScopedDataRequest<FindDataRequest>);
                         const records = Array.isArray(found?.records) ? found.records : [];
 
@@ -198,6 +198,10 @@ interface CensusEntry {
  * unchanged: neither the object state-machine read (`meta-object-state-routes.ts`)
  * nor the published read (now in `meta-item-history-routes.ts`) builds a `query:`
  * slot, so the new module's floor is 0 and the history module's stays 0.
+ *
+ * [#27627] 5 = 0 + 3 + 0 + 0 + 0 + 0 + 0 + 0 + 0 + 0 + 0 + 0 + 1 + 0 + 0 + 0 + 0 + 0 + 1:
+ * the record page (`record-page-routes.ts`) builds one `query:` slot, the
+ * related list read, so the new module's floor is 1.
  */
 const REGISTRAR_QUERY_SLOT_FLOORS: Readonly<Record<RestServerRegistrarFile, number>> = {
     'rest-server.ts': 0,
@@ -218,6 +222,7 @@ const REGISTRAR_QUERY_SLOT_FLOORS: Readonly<Record<RestServerRegistrarFile, numb
     'meta-item-write-routes.ts': 0,
     'meta-item-history-routes.ts': 0,
     'meta-object-state-routes.ts': 0,
+    'record-page-routes.ts': 1,
 };
 
 const CENSUS: CensusEntry[] = [
@@ -426,10 +431,11 @@ describe('[#16638] §1 CONTROLS on the census instrument itself', () => {
         // [#23050 slice 13e] Length 17 → 18, the sum unchanged (neither the object
         // state-machine read nor the published read carries a slot).
         // [#26433] The list's length is no longer pinned: the list is the authority.
+        // [#27627] The sum 4 → 5: the record page's related list read.
         expect(Object.keys(REGISTRAR_QUERY_SLOT_FLOORS).sort()).toEqual([...REST_SERVER_REGISTRAR_FILES].sort());
         expect(CENSUS.filter(({ file }) => REGISTRAR_SOURCES.has(file)).map(({ file }) => file))
             .toEqual([...REST_SERVER_REGISTRAR_FILES]);
-        expect([...REGISTRAR_SOURCES.values()].reduce((n, source) => n + querySlots(source).length, 0)).toBe(4);
+        expect([...REGISTRAR_SOURCES.values()].reduce((n, source) => n + querySlots(source).length, 0)).toBe(5);
     });
 
     it('dropping comment lines leaves the code that is being censused', () => {