@@ -175,14 +175,14 @@ describe('[#20745] a no-operator object beneath a relation, structured-JSON or p
   });
 
   it('refuses {} beneath a relation and a JSON column too, in the engine\'s words rather than each driver\'s', async () => {
-    for (const [where, words] of [
+    for (const [where, empty, words] of [
       // [#20802] Served at `where` otherwise — `{}` names no field of the related object.
-      [{ owner: {} }, 'names no field of the related object'],
-      [{ meta: {} }, 'whole-value match'],
+      [{ owner: {} }, '(no keys)', 'names no field of the related object'],
+      [{ meta: {} }, 'an empty object {}', 'whole-value match'],
     ] as const) {
       const err = await refusalOf(engine.find(OBJECT, { where: where as FilterCondition }));
       expect(envelopeOf(err), JSON.stringify(where)).toEqual(ENVELOPE);
-      expect(err!.message, JSON.stringify(where)).toContain('an empty object {}');
+      expect(err!.message, JSON.stringify(where)).toContain(empty);
       expect(err!.message, JSON.stringify(where)).toContain(words);
     }
     expect(reads).toHaveLength(0);
 
@@ -285,7 +285,7 @@ describe('[#20802] the nested-relation form is lowered at the engine\'s where se
     const cases: ReadonlyArray<readonly [FilterCondition, string, string]> = [
       [{ parent: { owner: { region: 'NA' } } }, 'where.parent', "'owner' is itself a lookup field of the related object 'nested_rel_ledger'"],
       [{ owner: { account: { title: 'a' } } }, 'where.owner', "'account' is itself a lookup field of the related object 'nested_rel_owner'"],
-      [{ owner: { 'account.title': 'a' } }, 'where.owner', "'account.title' is a dotted path — the condition reaches one level only"],
+      [{ owner: { 'account.title': 'a' } }, 'where.owner', "'account.title' is a dotted path: the condition reaches one level only"],
       [{ owner: { regio: 'NA' } }, 'where.owner', "'regio' is not a field of the related object 'nested_rel_owner'"],
       [{ owner: {} }, 'where.owner', 'names no field of the related object'],
       [{ stray: { region: 'NA' } }, 'where.stray', "no object 'nested_rel_missing' is registered here"],
@@ -295,7 +295,8 @@ describe('[#20802] the nested-relation form is lowered at the engine\'s where se
       rec.reads.length = 0;
       const err = await refusalOf(engine.find(OBJECT, { where }));
       expect(envelopeOf(err), JSON.stringify(where)).toEqual(INVALID_FILTER);
-      expect(err!.message, JSON.stringify(where)).toContain(`at ${path}, a nested-relation condition`);
+      expect(err!.message, JSON.stringify(where)).toContain('puts a nested-relation condition (');
+      expect(err!.message, JSON.stringify(where)).toContain(`at ${path}, beneath the declared`);
       expect(err!.message, JSON.stringify(where)).toContain(words);
       expect(err!.message, JSON.stringify(where)).toContain('The filter was NOT applied.');
       expect(rec.reads, JSON.stringify(where)).toHaveLength(0);
 
@@ -141,6 +141,11 @@ export type { AdmittedValueShapeViolationTally } from './engine.js';
 // type of `ObjectQL.listDatasourceDefs()`. Exported so a consumer sweeping for
 // `sys_secret` references can name the shape it reads instead of re-declaring it.
 export type { DatasourceDef } from './engine.js';
+// [#20802] The cap on the related ids one nested-relation condition may feed
+// (`{ owner: { region: 'NA' } }`, served at `where`): past it the engine
+// refuses the filter rather than truncate it, and its words name this number.
+// Exported so a caller running the two-step route itself can page by it.
+export { RELATION_FILTER_ID_CAP } from './relation-filter-lowering.js';
 // [#16159] `SUMMARY_RECOMPUTE_CODE` joins the class it names. The refusal's own
 // docblock tells a caller to identify it by `code` rather than `instanceof`
 // (the two-realm split #14936 measured: this package declares BOTH realms in
 
@@ -393,13 +393,15 @@ describe('#7534 — unknown field on the EXPLICIT filter axes (real ObjectQL eng
         // `{owner_id: {region: 'NA'}}` names `owner_id` on THIS object and
         // `region` on the related one. Judging `region` against this object's
         // field map would refuse a legitimate relation filter.
-        // [#20745] The engine refuses the nested-relation form itself (no
-        // driver serves it) with INVALID_FILTER in its own words. This gate
-        // still never descends: the answer is not its INVALID_FIELD about
-        // `region`.
+        // [#20745] The engine refused the nested-relation form itself for a
+        // while. [#20802] It serves it now, judging the condition's keys
+        // against the RELATED object's declarations — here `owner_id` points
+        // at `sys_user`, which this harness does not register, so the engine
+        // answers INVALID_FILTER in its own words. This gate still never
+        // descends: the answer is not its INVALID_FIELD about `region`.
         const err: any = await find({ where: { owner_id: { region: 'NA' } } }).then(() => null, (e: any) => e);
         expect({ code: err?.code, status: err?.status }).toEqual({ code: 'INVALID_FILTER', status: 400 });
-        expect(err.message).toContain('nested-relation form');
+        expect(err.message).toContain("a nested-relation condition beneath the declared lookup field 'owner_id'");
         expect(err.field).toBeUndefined();
     });
 
 
@@ -1226,17 +1226,37 @@ describe('#4226 — sort / select / expand on the list path (real ObjectQL engin
         // inner keys belong to ANOTHER object — the exact shape the collectors
         // refuse to descend into. If this control answers the dotted verdict's
         // INVALID_FIELD, that verdict has started judging comparand VALUES,
-        // which is a different (and wrong) gate. [#20745] The engine refuses
-        // the form itself — no driver serves it — so both doors answer the
-        // no-operator-object arm's INVALID_FILTER, in its own words.
-        for (const run of [
-            () => protocol.findData({ object: 'showcase_task', query: { where: { project_id: { name: 'Apollo' } } } }),
-            () => engine.find('showcase_task', { where: { project_id: { name: 'Apollo' } } }),
-        ]) {
-            const err: any = await run().then(() => null, (e: any) => e);
-            expect({ code: err?.code, status: err?.status }).toEqual({ code: 'INVALID_FILTER', status: 400 });
-            expect(err.message).toContain('nested-relation form');
-        }
+        // which is a different (and wrong) gate. [#20745] The engine refused
+        // the form itself for a while — no driver served it. [#20802] It is
+        // SERVED now: the engine reads the related object with the condition
+        // and hands the driver `$in` on its ids, so both doors answer the rows
+        // the undotted `{ project_id: 'p1' }` control answers.
+        const byFk: any = await protocol.findData({ object: 'showcase_task', query: { where: { project_id: 'p1' } } });
+        const wanted = byFk.records.map((r: any) => r.id).sort();
+        expect(wanted).toHaveLength(5);
+        const viaProtocol: any = await protocol.findData({
+            object: 'showcase_task', query: { where: { project_id: { name: 'Apollo' } } },
+        });
+        expect(viaProtocol.records.map((r: any) => r.id).sort()).toEqual(wanted);
+        const viaEngine = await engine.find('showcase_task', { where: { project_id: { name: 'Apollo' } } });
+        expect(viaEngine.map((r: any) => r.id).sort()).toEqual(wanted);
+        const none = await engine.find('showcase_task', { where: { project_id: { name: 'Gemini' } } });
+        expect(none).toEqual([]);
+    });
+
+    it('[#20802] both doors\' dotted relation refusals name the SAME served nested route', async () => {
+        const ingressErr: any = await protocol
+            .findData({ object: 'showcase_task', query: { where: { 'project_id.name': 'Apollo' } } })
+            .then(() => null, (e: unknown) => e);
+        const engineErr: any = await engine
+            .find('showcase_task', { where: { 'project_id.name': 'Apollo' } })
+            .then(() => null, (e: unknown) => e);
+        const route = 'nest the condition beneath the relation field: { "project_id": { "name": VALUE } }';
+        expect(String(ingressErr?.message)).toContain(route);
+        expect(String(engineErr?.message)).toContain(route);
+        // The claim this change made false is gone from both doors.
+        expect(String(ingressErr?.message)).not.toContain('a filter reaches only columns');
+        expect(String(engineErr?.message)).not.toContain('a filter reaches only columns');
     });
 
     it('⛔ CONTROL — the structured/JSON head stays UNJUDGED at both doors: the ruled carve-out', async () => {
 
@@ -218,12 +218,12 @@ export function lowerRelationSite(site: RelationFilterSite, ids: readonly unknow
   };
 }
 
-/** How the words name the object beneath the field: its keys, never its values. */
+/** How the words name the condition: its keys, never its values. */
 function describeKeys(keys: readonly string[]): string {
-  if (keys.length === 0) return 'an empty object {}';
+  if (keys.length === 0) return 'no keys';
   const shown = keys.slice(0, 3).map((key) => JSON.stringify(key)).join(', ');
   const more = keys.length > 3 ? `, and ${keys.length - 3} more` : '';
-  return `an object with no operator key (keys ${shown}${more})`;
+  return `keys ${shown}${more}`;
 }
 
 /** The ids route every driver serves: `$in` on a single-valued relation, `$contains` per id on a multi-valued one. */
@@ -236,54 +236,49 @@ function idsRoute(field: string, multiple: boolean): string {
 /**
  * The words of a structural refusal ({@link admitRelationCondition}): the
  * position, the verdict and the route first — the REST door bounds a 4xx
- * message at 500 characters by truncation — and the reasoning after.
+ * message at 500 characters by truncation — and nothing after the route that a
+ * caller needs.
  */
 export function relationConditionRefusalMessage(refusal: RelationConditionRefusal, context: string): string {
   const { field, type, target, multiple, path, key } = refusal;
   const related = target === undefined ? 'the related object' : `the related object '${target}'`;
-  const readTarget = target === undefined ? 'the related object' : `'${target}'`;
+  const named = target === undefined ? 'the related object' : `'${target}'`;
   const head =
-    `${context}: filter on '${field}' puts ${describeKeys(refusal.keys)} at ${path}, a nested-relation `
-    + `condition beneath the declared ${type} field '${field}'`;
-  const route = `match '${field}' against the ids it returns: ${idsRoute(field, multiple)}`;
+    `${context}: filter on '${field}' puts a nested-relation condition (${describeKeys(refusal.keys)}) at `
+    + `${path}, beneath the declared ${type} field '${field}'`;
+  const verdict = 'The filter was NOT applied.';
+  const twoStep = `then match '${field}' against its ids: ${idsRoute(field, multiple)}.`;
   switch (refusal.reason) {
     case 'unregistered-target':
       return (
         head
         + (target === undefined
-          ? ' — and the field declares no related object, so there is nothing to read. '
-          : ` — and no object '${target}' is registered here, so there is nothing to read. `)
-        + 'The filter was NOT applied. Match the field against ids you already hold: '
-        + `${idsRoute(field, multiple)}.`
+          ? ', and the field declares no related object to read. '
+          : `, and no object '${target}' is registered here to read. `)
+        + `${verdict} Match '${field}' against ids you hold: ${idsRoute(field, multiple)}.`
       );
     case 'empty':
       return (
-        head
-        + ` that names no field of ${related}. The filter was NOT applied. Name a field of ${related} `
-        + `({ "${field}": { "FIELD": VALUE } }), or test that '${field}' has a value with `
+        `${head}, and it names no field of ${related}. ${verdict} Name one `
+        + `({ "${field}": { "FIELD": VALUE } }), or test that '${field}' has a value: `
         + `{ "${field}": { "$null": false } }.`
       );
     case 'undeclared-key':
       return (
-        head
-        + `, and '${key}' is not a field of ${related}. The filter was NOT applied. Name a field `
-        + `${related} declares: { "${field}": { "FIELD": VALUE } }. No driver matches a key the `
-        + 'related object does not declare the same way, and an empty answer would read exactly like a real one.'
+        `${head}, and '${key}' is not a field of ${related}. ${verdict} Name a field it declares: `
+        + `{ "${field}": { "FIELD": VALUE } }. A key it does not declare would read as a real empty answer.`
       );
     case 'dotted-key':
       return (
-        head
-        + `, and '${key}' is a dotted path — the condition reaches one level only, the fields of `
-        + `${related} itself. The filter was NOT applied. Read ${readTarget} with that condition `
-        + `yourself (one level there), then ${route}.`
+        `${head}, and '${key}' is a dotted path: the condition reaches one level only. ${verdict} `
+        + `Read ${named} with that condition yourself, ${twoStep}`
       );
     case 'second-level':
     default:
       return (
-        head
-        + `, and '${key}' is itself a ${refusal.keyType ?? 'relation'} field of ${related} holding a `
-        + 'condition of its own — the condition reaches one level only. The filter was NOT applied. '
-        + `Read ${readTarget} with { "${key}": { … } } yourself (one level there), then ${route}.`
+        `${head}, and '${key}' is itself a ${refusal.keyType ?? 'relation'} field of ${related} holding a `
+        + `condition of its own: one level only. ${verdict} Read ${named} with { "${key}": { … } } yourself, `
+        + twoStep
       );
   }
 }
@@ -300,13 +295,10 @@ export function relationConditionError(refusal: RelationConditionRefusal, contex
  * matching rows. The words name the cap, the relation and the two-step route.
  */
 export function relationFilterCapError(site: RelationFilterSite, context: string, cap: number): Error {
-  const keys = Object.keys(site.condition).map((key) => JSON.stringify(key)).join(', ');
   return invalidFilterError(
     `${context}: the nested-relation condition at ${site.path} matched more than ${cap} records of `
-    + `the related object '${site.target}' — past the engine's cap on the ids one condition may feed `
-    + `the filter — so the filter was NOT applied: a cut-off id list would silently drop matching rows. `
-    + `Narrow the condition, or run the two steps yourself: read '${site.target}' with the same `
-    + `condition (keys ${keys}) page by page, then match '${site.field}' against the ids it returns: `
-    + `${idsRoute(site.field, site.multiple)}.`,
+    + `the related object '${site.target}' (the engine's cap), so the filter was NOT applied: a cut-off `
+    + `id list would silently drop matching rows. Narrow the condition, or read '${site.target}' yourself `
+    + `page by page and match '${site.field}' against its ids: ${idsRoute(site.field, site.multiple)}.`,
   );
 }