@@ -1443,7 +1443,10 @@ export class AnalyticsService implements IAnalyticsService {
     // read"). `callCtx` is the ONE thing `query()` and `generateSql()` share,
     // so gating it covers the direct `/analytics/query` door, the `/analytics/sql`
     // echo door and — through `DatasetExecutor` — every dataset door.
-    await this.assertReadAdmitted(this.queryObjects(query, scope), context);
+    // [#20933] The set is derived ONCE here and handed to both questions, so
+    // the objects admitted and the objects scoped are one value, not two calls.
+    const objects = this.queryObjects(query, scope);
+    await this.assertReadAdmitted(objects, context);
     // [#20917] …and the FIELD-level gate, right behind it and for the same
     // reason: every member the query names is judged here, once, so every
     // strategy — and the SQL echo — inherits the verdict by construction. The
@@ -1461,17 +1464,21 @@ export class AnalyticsService implements IAnalyticsService {
     // a deployment with no `getReadScope` provider is exactly the one that most
     // needs the engine to scope for it.
     if (!this.readScopeProvider) return { ...this.baseCtx, ...reads, context, getDatasetScope };
-    // Pre-resolve the read scope for every object the strategy will scan (base
-    // + all declared joins) BEFORE the synchronous SQL builder runs, since the
+    // Pre-resolve the read scope for every object the strategy will scan (base,
+    // declared joins, relationship paths — `queryObjects`, the set the admission
+    // above read) BEFORE the synchronous SQL builder runs, since the
     // provider may be async (the production `security.getReadFilter` bridge).
     // The strategy then reads each object's filter synchronously from the map.
-    const scopes = await this.resolveReadScopes(query, context, scope);
+    const scopes = await this.resolveReadScopes(objects, context);
     return {
       ...this.baseCtx,
       ...reads,
       context,
       getDatasetScope,
       getReadScope: (objectName: string) => scopes.get(objectName) ?? null,
+      // [#20933] …and the set itself, for the strategy that looks at the scopes
+      // before it compiles (`NativeSQLStrategy`'s cross-field decline).
+      readScopedObjects: [...objects],
     };
   }
 
@@ -1530,15 +1537,30 @@ export class AnalyticsService implements IAnalyticsService {
   }
 
   /**
-   * Every object this query will READ — the cube's base object plus every
-   * joined object.
+   * Every object this query will READ — the cube's base object, every join the
+   * cube declares, and every object a member the query names reaches through a
+   * relationship path.
    *
    * ONE derivation, two consumers: {@link resolveReadScopes} scopes exactly
    * this set and {@link assertReadAdmitted} admits exactly this set, so the set
    * that is row-scoped and the set that is admitted are provably the same set
    * rather than two lists that agree today. It is a SUPERSET of what a strategy
-   * actually scans (a strategy only joins along declared relationships), which
-   * is the safe direction: no scanned object is ever left ungated.
+   * actually scans (a declared join the query never uses is in it), which is
+   * the safe direction: no scanned object is ever left ungated.
+   *
+   * [#20933] A relationship path is read whether or not the cube declares it.
+   * A dotted member of an inferred cube, an authored member whose `sql` walks a
+   * relationship the cube's `joins` never lists, a dotted member the query
+   * names itself: `NativeSQLStrategy` joins the object at each hop
+   * (`qualifyAndRegisterJoin`) and `ObjectQLStrategy` reads it to resolve the
+   * related value. Those objects are in this set, so each is admitted and its
+   * read scope reaches the strategy exactly as a declared join's does — the
+   * strategies apply the scope of every object they read from this set, and
+   * carry no rule of their own. Each hop's object is the one the field gate
+   * attributes the hop's fields to ({@link namedQueryFields}: the cube's join
+   * keyed by the path with its dots as `__`, falling back to the alias itself),
+   * reused rather than re-derived, so the field gate and this set can never
+   * name different objects for the same hop.
    *
    * An unregistered cube yields the empty set — the query fails its own
    * cube-existence gate downstream, and inventing an object name here would
@@ -1553,14 +1575,21 @@ export class AnalyticsService implements IAnalyticsService {
   private queryObjects(query: AnalyticsQuery, scope: CubeScope): Set<string> {
     if (!query.cube) return new Set<string>();
     const cube = scope.getCube(query.cube);
-    return cube ? this.cubeObjects(cube) : new Set<string>();
+    if (!cube) return new Set<string>();
+    const objects = this.cubeObjects(cube);
+    for (const { object } of namedQueryFields(query, cube, this.cubeReads(scope).getDatasetScope(query.cube))) {
+      objects.add(object);
+    }
+    return objects;
   }
 
   /**
-   * {@link queryObjects} for a cube already in hand — the draft-preview branch
-   * holds the COMPILED dataset rather than a query naming it, and reaching for
-   * the registry there would make the gate depend on a registration side
-   * effect. One derivation, two entry points.
+   * The cube's own part of {@link queryObjects}: its base object and every
+   * join it declares. The draft-preview branch asks this part alone — it holds
+   * the COMPILED dataset rather than a query naming it (reaching for the
+   * registry there would make the gate depend on a registration side effect),
+   * and it evaluates the executor's queries over the base object's drafted seed
+   * rows in memory, so it reads no object through a relationship path.
    */
   private cubeObjects(cube: Cube): Set<string> {
     const objects = new Set<string>();
@@ -1631,13 +1660,14 @@ export class AnalyticsService implements IAnalyticsService {
 
   /**
    * Resolve the read scope (tenant + RLS `FilterCondition`) for the base object
-   * AND every joined object of the query's cube, keyed by object name. This is
-   * the async pre-pass that lets the synchronous strategy enforce scoping even
-   * when the provider (security `getReadFilter`) resolves asynchronously.
+   * AND every object the query reads through a join or a relationship path,
+   * keyed by object name. This is the async pre-pass that lets the synchronous
+   * strategy enforce scoping even when the provider (security `getReadFilter`)
+   * resolves asynchronously.
    *
-   * The object set is `cube.sql` (base) plus every `cube.joins[*].name` — a
-   * SUPERSET of what the strategy actually scans (the strategy only joins along
-   * declared relationships), so no scanned object is ever left unscoped.
+   * The object set is {@link queryObjects} — the one the admission reads, a
+   * SUPERSET of what the strategy actually scans, so no scanned object is ever
+   * left unscoped.
    *
    * Fail-closed: if the provider throws for an object, the whole query is
    * rejected rather than emitting SQL with that object unscoped.
@@ -1651,15 +1681,14 @@ export class AnalyticsService implements IAnalyticsService {
    * enveloped, it is re-thrown before the wording is ever read.
    */
   private async resolveReadScopes(
-    query: AnalyticsQuery,
+    objects: Iterable<string>,
     context: ExecutionContext | undefined,
-    scope: CubeScope,
   ): Promise<Map<string, FilterCondition>> {
     const map = new Map<string, FilterCondition>();
     const provider = this.readScopeProvider;
-    if (!provider || !query.cube) return map;
+    if (!provider) return map;
 
-    for (const object of this.queryObjects(query, scope)) {
+    for (const object of objects) {
       let filter: FilterCondition | null | undefined;
       try {
         filter = await provider(object, context);
 
@@ -332,9 +332,17 @@ export class NativeSQLStrategy implements AnalyticsStrategy {
     if (typeof ctx.getReadScope !== 'function') return null;
     const cube = query.cube ? ctx.getCube(query.cube) : undefined;
     if (!cube) return null;
-    const objects = [this.extractObjectName(cube)];
-    for (const alias of Object.keys(cube.joins ?? {})) {
-      objects.push(cube.joins?.[alias]?.name ?? alias);
+    // [#20933] The scopes the door resolved, over the set it resolved them for:
+    // an object read through a relationship path carries its scope too, and a
+    // reference in it declines the query exactly as one in a declared join's
+    // does. The cube's own objects stand in only for a context built without
+    // that set.
+    const scoped = (ctx as DatasetScopedStrategyContext).readScopedObjects;
+    const objects = scoped ? [...scoped] : [this.extractObjectName(cube)];
+    if (!scoped) {
+      for (const alias of Object.keys(cube.joins ?? {})) {
+        objects.push(cube.joins?.[alias]?.name ?? alias);
+      }
     }
     for (const objectName of objects) {
       const scope = ctx.getReadScope(objectName);
 
@@ -70,6 +70,19 @@ export interface DatasetScope {
 /** A {@link StrategyContext} that can answer for a compiled dataset (#10298). */
 export interface DatasetScopedStrategyContext extends StrategyContext {
   getDatasetScope?(cubeName: string): DatasetScope | undefined;
+  /**
+   * [#20933] Every object whose read scope `getReadScope` answers for this
+   * query — `AnalyticsService.queryObjects`, the one set the object-level
+   * admission read: the base object, every join the cube declares, and every
+   * object a member reaches through a relationship path.
+   *
+   * For a strategy that must look at the scopes BEFORE it compiles, so it reads
+   * them over the set the door scoped instead of re-deriving which objects the
+   * query reads. `undefined` when the context carries no read scope at all.
+   * Declared HERE rather than on the spec's {@link StrategyContext} for the
+   * reason `getDatasetScope` is: nothing about it is an authorable surface.
+   */
+  readScopedObjects?: readonly string[];
   /**
    * [#14079] The DECLARED type of `field` on `objectName` — `'number'`,
    * `'boolean'`, `'text'`, … — or `undefined` when the host cannot answer (no