@@ -0,0 +1,19 @@
+---
+'@objectstack/service-analytics': patch
+---
+
+fix(service-analytics)!: members read through a relationship path answer one refusal on the native, ObjectQL and draft-preview faces
+
+Clause-②: no (narrowing) — the draft preview (`queryDataset` with `previewDrafts: true`) now refuses `INVALID_FIELD` / 400 any member it would read through a relationship path (a dimension, time dimension, measure or filter member), which it served as one `null` group, `[]` or a total of `0`, because it joins nothing; a `timeDimensions` entry and a `runtimeFilter` member spelled through a relationship path the dataset's `include` does not declare are refused `INVALID_FIELD` / 400 on every face, where the native strategy answered `DATASET_INVALID` / 400 and the preview served; and a declared path to a column the related object lacks is refused `INVALID_FIELD` / 400 before SQL, where the native strategy answered `DATABASE_ERROR` / 500. Nothing is widened: no export, answer member, error code or status is added; every code was already on the wire.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export or type changes: a selection that reads through a relationship path is refused by the preview that cannot join it, a selection naming an undeclared path or a missing related column is refused on the faces that served it or failed on it, and the native face's refusal takes the member-level code the other member gates answer. There is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** accept-set narrowing on the `queryDataset` draft preview (`@objectstack/service-analytics`), and a code change on two native refusals.
+
+- **Before.** Measured on real SQLite over a dataset `include: ['account']`: the preview answered a backed `account.name` (or a declared dimension over it, or a declared measure over a related field) with one `null` group holding the whole total, a backed `runtimeFilter` member with `[]`, and a windowed backed time dimension with a total of `0`, while the live strategies served the real answer. `OBJECT.region` and `CUBE.region`, which both live strategies resolve to the declared `region`, also came back as one `null` group. A time dimension through an undeclared path was dropped by the preview and refused `DATASET_INVALID` by the native strategy when only windowed; a `runtimeFilter` member through an undeclared path got `DATASET_INVALID` (native), the cross-object filter refusal (ObjectQL) and `[]` or, under an `$or`, the other arm's rows (preview). `account.bogus` reached SQL on the native strategy as a 500.
+- **Now.** The service's join gate (the one `dimensions` already asked since the previous fix) also judges `timeDimensions` entries and `where` leaves, so an undeclared path is refused on every face with one message naming the member and the path. A second gate refuses a declared path to a column the related object does not have, naming the member, the column (`field`) and the object (`object`), on every face with one message. The preview then refuses any remaining relationship-path member with a message saying it joins no related object, and answers `OBJECT.region` / `CUBE.region` with the declared dimension's groups.
+- **Unchanged.** The live strategies serve a backed path as before (the ObjectQL strategy keeps its own cross-object refusals for a filter, a bucketed time dimension or a measure it cannot join). A path through an object the caller may not read keeps its 403. A hand-authored cube's configured allowlist still answers `DATASET_INVALID`, and so does every other reason that code is raised.
+- **Who sees it.** An author previewing a draft dataset that groups, filters or measures through a related object: the preview now says it cannot join instead of showing a number that changes after publish. A caller naming a related field the dataset does not include, or a related column that does not exist: one `INVALID_FIELD` / 400 on every face.
+
+**The remedy.** Publish the draft to query a related field through the live strategies, or preview without it; add the relationship to the dataset's `include`; check the related column's spelling.
@@ -153,7 +153,7 @@ describe('[#5367] a dataset refusal answers 400 DATASET_INVALID from its own env
     body: unknown;
     analytics: () => AnalyticsService;
     message: RegExp;
-    /** Defaults to `DATASET_INVALID`; see the one row that legitimately differs. */
+    /** Defaults to `DATASET_INVALID`; see the two rows that legitimately differ. */
     code?: string;
   }> = [
     {
@@ -225,17 +225,22 @@ describe('[#5367] a dataset refusal answers 400 DATASET_INVALID from its own env
     },
     {
       // The caller-shaped trigger: the DATASET declares no `include`, and the
-      // SELECTION filters on a dotted member, which the strategy compiles into
-      // a join at alias `account`. [#28258] A dotted `dimensions` entry was the
-      // trigger here until the service learned to refuse it ahead of either
-      // strategy (`INVALID_FIELD` / 400, one answer on all three dataset
-      // faces); a `runtimeFilter` member still reaches the strategy's own
-      // allowlist, and this row's audit trail is about that producer.
-      name: 'native-sql-strategy: a selection naming a join outside the allowlist',
+      // SELECTION filters on a dotted member, which the strategy would compile
+      // into a join at alias `account`. [#28258] A dotted `dimensions` entry
+      // was the trigger here until the service learned to refuse it ahead of
+      // either strategy; [#28557] a `runtimeFilter` member (and [#28556] a
+      // `timeDimensions` entry) is now refused by the same service gate,
+      // `INVALID_FIELD` / 400 naming the member, one answer on all three
+      // dataset faces. No request member reaches the strategy's allowlist on
+      // this route any more (it stays for a hand-authored cube's configured
+      // hook). The row keeps its audit trail: the input this list entry used to
+      // classify answers 400 from a declared envelope, never from a message.
+      name: 'native-sql-strategy allowlist input (now refused by the service join gate, not the strategy): a selection naming a join outside the allowlist',
       listEntry: 'not backed by a declared relationship',
       analytics: nativeAnalytics,
       body: { dataset, selection: { dimensions: ['stage'], measures: ['revenue'], runtimeFilter: { 'account.region': 'emea' } } },
-      message: /join "account" is not backed by a declared relationship on cube "pipeline"/,
+      message: /Filter member 'account\.region' on cube 'pipeline' traverses relationship path 'account', which the dataset does not declare/,
+      code: 'INVALID_FIELD',
     },
   ];
 
@@ -256,6 +261,11 @@ describe('[#5367] a dataset refusal answers 400 DATASET_INVALID from its own env
     });
   }
 
+  // The five LIST ENTRIES, not five live producers: since #28557 the
+  // `not backed by a declared relationship` row is answered by the service's
+  // join gate ahead of the native strategy, so its producer (the strategy's
+  // allowlist) is no longer driven through this route. This pin is the
+  // string-level audit that every deleted entry still has a row.
   it('covers exactly the five entries #5367 deleted from the message list', () => {
     expect(CASES.map((c) => c.listEntry).sort()).toEqual([
       'is not a subset of the selected dimensions',
 
@@ -16,11 +16,13 @@
  *   `null` group.
  * - A multi-hop spelling is judged hop by hop: with only `account` included,
  *   `account.owner.name` is refused naming `account.owner`.
- * - CONTROL: a backed dotted dimension still serves on every face (the live
- *   strategies the same groups); a dotted spelling that resolves to a declared
- *   dimension (`<object>.region`) still serves; an undeclared plain dimension
- *   (`bogus`, #28201) keeps its own refusal; a `runtimeFilter` member through an
- *   unbacked path keeps the native strategy's `DATASET_INVALID`.
+ * - CONTROL: a backed dotted dimension still serves on both live strategies
+ *   (the same groups), and the draft preview refuses it with its own refusal
+ *   (#28555, `dotted-path-preview-parity.test.ts`); a dotted spelling that
+ *   resolves to a declared dimension (`<object>.region`) still serves; an
+ *   undeclared plain dimension (`bogus`, #28201) keeps its own refusal. A
+ *   `runtimeFilter` member through an unbacked path is refused by the same
+ *   gate since #28557 (pinned in that file too).
  */
 
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
@@ -182,15 +184,18 @@ describe('[#28258] a dotted dimension through a relationship path the dataset do
     expect(refusals[2].message).toBe(refusals[0].message);
   });
 
-  it("CONTROL: a backed 'account.name' serves on every face, the same groups on both live strategies", async () => {
+  it("CONTROL: a backed 'account.name' serves on both live strategies, the same groups", async () => {
     const expected = [{ key: 'Acme', total: 130 }, { key: 'Globex', total: 50 }];
     for (const face of ['native', 'objectql'] as const) {
       const result = await ask(face, BACKED, { dimensions: ['account.name'], measures: ['total'] });
       expect(groupsOf(result.rows, 'account.name'), face).toEqual(expected);
     }
-    // The preview serves it (it is not refused); its seed rows carry no join.
-    const preview = await ask('preview', BACKED, { dimensions: ['account.name'], measures: ['total'] });
-    expect(Array.isArray(preview.rows)).toBe(true);
+    // [#28555] The preview joins nothing, so it refuses the backed path with
+    // its own refusal rather than this gate's (which judges only unbacked ones).
+    const err = await refusalOf(ask('preview', BACKED, { dimensions: ['account.name'], measures: ['total'] }));
+    expect(err.code, err.message).toBe('INVALID_FIELD');
+    expect(err.status).toBe(400);
+    expect(err.message).not.toContain('which the dataset does not declare');
   });
 
   it("CONTROL: '<object>.region', which resolves to the declared 'region', still serves on every face", async () => {
@@ -226,11 +231,13 @@ describe('[#28258] a dotted dimension through a relationship path the dataset do
     expect(refusals[2].message).toBe(refusals[0].message);
   });
 
-  it("CONTROL: a runtimeFilter member through an unbacked path keeps the native strategy's DATASET_INVALID", async () => {
+  it("[#28557] a runtimeFilter member through an unbacked path is refused by the same gate, param 'where'", async () => {
     const err = await refusalOf(
       ask('native', UNBACKED, { dimensions: ['region'], measures: ['total'], runtimeFilter: { 'account.name': 'Acme' } }),
     );
-    expect(err.code, err.message).toBe('DATASET_INVALID');
+    expect(err.code, err.message).toBe('INVALID_FIELD');
     expect(err.status).toBe(400);
+    expect(err.param).toBe('where');
+    expect(err.member).toBe('account.name');
   });
 });