diff --git a/‎.changeset/21080-native-sql-engine-middleware-decline.md‎
Lines changed: 25 additions & 0 deletions b/‎.changeset/21080-native-sql-engine-middleware-decline.md‎
Lines changed: 25 additions & 0 deletions
diff --git a/‎packages/objectql/src/engine-has-object-middleware.test.ts‎
Lines changed: 103 additions & 0 deletions b/‎packages/objectql/src/engine-has-object-middleware.test.ts‎
Lines changed: 103 additions & 0 deletions
diff --git a/‎packages/objectql/src/engine.ts‎
Lines changed: 18 additions & 0 deletions b/‎packages/objectql/src/engine.ts‎
Lines changed: 18 additions & 0 deletions
@@ -0,0 +1,25 @@
+---
+'@objectstack/spec': minor
+'@objectstack/objectql': minor
+'@objectstack/service-analytics': minor
+---
+
+fix(service-analytics)!: the analytics native-SQL strategy declines an object an engine middleware is registered for, so the engine serves it and that object's read gates apply; the engine answers which objects carry one (`IObjectQLEngine.hasObjectMiddleware`) (#21080)
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) a correction of which analytics strategy serves a query that reads an object the data engine holds a per-object middleware for, decided at request time. No authorable key, spelling, value domain or stored metadata shape moves: every dataset, cube and dashboard parses as before, nothing stored is rewritten, and the only declaration change is ADDITIVE (one optional member on IObjectQLEngine, one public method on ObjectQL, one optional member on AnalyticsServiceConfig), so there is nothing for an author to convert and nothing for `objectstack migrate meta` to reach. The queries newly refused are refused at request time by the ObjectQL strategy's existing envelope, not by a schema. The other categories are closed on facts: the packages publish (not unpublished); no ADR-0087 id covers strategy routing and this diff adds none (not registered / already-registered); and the change is runtime behaviour plus additive declarations, not a removal from a published interface (not runtime-interface-only / type-surface-only). -->
+
+**BREAKING**: this narrows what the analytics doors serve for one class of query. It ships as `minor` under the launch-window convention for narrowings.
+
+**What changes.** On a SQL driver, `NativeSQLStrategy` compiled a query to SQL and ran it through the driver's raw-SQL seam, so no engine operation ran and no engine middleware did. It applied the security service's object admission and read filter and nothing else, so the read gates that live in the engine as per-object middlewares did not apply there: a caller admitted to such an object at object level read grouped results and counts over every row, rows about parent records that caller cannot read included. It now declines a query that reads (as its base object, a declared join, or through a relationship path) an object the data engine holds a middleware registered for. The ObjectQL strategy serves it through the engine with the caller's context, so the engine's middlewares run, and the analytics answer for that caller equals the data door's. On the stock composition the objects that move off the native path are `sys_comment`, `sys_activity` and `sys_attachment` (read gates), `sys_approval_request` (the snapshot redaction), and `sys_user_position` and `sys_permission_set` (write-side middlewares, which move as a side effect: a middleware does not declare its operation). No shipped dataset or dashboard reads any of them.
+
+**What is newly refused.** A query on such an object that the ObjectQL strategy cannot serve is refused with that strategy's existing `400`, where the native strategy used to serve it: for example a dimension reached through a relationship path combined with a measure that cannot be recombined across it (`avg`, `count_distinct`). Correctness wins over the fast path for a gated object.
+
+**It fails closed.** `AnalyticsServicePlugin` asks the data engine. An engine without `hasObjectMiddleware`, or no engine, cannot say, and the strategy declines then too: every query on such a host is served by the ObjectQL strategy, and the plugin says so once at `warn`. A host that constructs `AnalyticsService` with `executeRawSql` and without the new `hasObjectMiddleware` config member keeps the native path for every object and is told so once at construction.
+
+**New, additive.** `IObjectQLEngine.hasObjectMiddleware?(objectName): boolean` (`@objectstack/spec`), `ObjectQL.hasObjectMiddleware(objectName)` (`@objectstack/objectql`): whether a `registerMiddleware(fn, { object })` names the object; a global registration (no `object`, or `'*'`) is keyed to none and is not counted. `AnalyticsServiceConfig.hasObjectMiddleware` (`@objectstack/service-analytics`), which the plugin fills from the data engine.
+
+**Unchanged.** Objects no middleware names keep the native path. The middleware chain, `registerMiddleware` and every gate are unchanged.
+
+**What to do after upgrading.** Nothing on the stock composition. A host whose `"data"` service is not ObjectQL should implement `hasObjectMiddleware` to keep the native path for ungated objects. A host that builds `AnalyticsService` itself with `executeRawSql` should pass `hasObjectMiddleware` from its engine.
@@ -0,0 +1,103 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#21080] `ObjectQL.hasObjectMiddleware`, the engine's read-only answer to
+ * "is a middleware registered FOR this object?" (`IObjectQLEngine.hasObjectMiddleware`).
+ *
+ * The analytics native-SQL strategy runs no engine operation, so no engine
+ * middleware runs on it. It asks this accessor and declines an object that
+ * carries one, so the engine path serves that object and its middlewares run.
+ * What each case pins:
+ *
+ * - **Object-keyed.** A registration naming the object answers `true`; an
+ *   object no registration names answers `false`.
+ * - **Global is not object-keyed.** A registration with no `object`, or with
+ *   `'*'`, matches every object at dispatch, but it is keyed to none, so it
+ *   answers `false` for every object.
+ * - **Read-only.** Asking runs no middleware and changes nothing the dispatch
+ *   reads: on a later read the same middlewares run, once each.
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { ObjectQL } from './engine';
+import { SchemaRegistry } from './registry';
+
+vi.mock('./registry', async () => {
+  // [#10551] The one shared factory — see `registry-module-mock.ts`.
+  const { createRegistryModuleMock } = await import('./registry-module-mock.js');
+  return createRegistryModuleMock();
+});
+
+const GATED = 'gated_note';
+const PLAIN = 'plain_note';
+
+const passThrough = () => vi.fn(async (_ctx: unknown, next: () => Promise<void>) => next());
+
+async function makeEngine(): Promise<ObjectQL> {
+  vi.mocked((SchemaRegistry as any).getObject).mockImplementation((name: string) =>
+    name === GATED || name === PLAIN ? { name, fields: { title: { type: 'text' } } } : undefined,
+  );
+  const driver: any = {
+    name: 'memory',
+    supports: {},
+    connect: vi.fn().mockResolvedValue(undefined),
+    disconnect: vi.fn().mockResolvedValue(undefined),
+    find: vi.fn(async () => []),
+    findOne: vi.fn(async () => null),
+    count: vi.fn(async () => 0),
+    aggregate: vi.fn(async () => []),
+    create: vi.fn(),
+    update: vi.fn(),
+    delete: vi.fn(),
+  };
+  const ql = new ObjectQL();
+  ql.registerDriver(driver, true);
+  await ql.init();
+  return ql;
+}
+
+describe('ObjectQL.hasObjectMiddleware — the engine answers which objects carry an object-keyed middleware', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('answers true for an object a registration names, and false for one none names', async () => {
+    const ql = await makeEngine();
+    ql.registerMiddleware(passThrough(), { object: GATED });
+    expect(ql.hasObjectMiddleware(GATED)).toBe(true);
+    expect(ql.hasObjectMiddleware(PLAIN)).toBe(false);
+  });
+
+  it('answers false for every object when only global registrations exist', async () => {
+    const ql = await makeEngine();
+    ql.registerMiddleware(passThrough());
+    ql.registerMiddleware(passThrough(), { object: '*' });
+    expect(ql.hasObjectMiddleware(GATED)).toBe(false);
+    expect(ql.hasObjectMiddleware('*')).toBe(false);
+  });
+
+  it('answers false on an engine with no registration at all', async () => {
+    const ql = await makeEngine();
+    expect(ql.hasObjectMiddleware(GATED)).toBe(false);
+  });
+
+  it('runs no middleware and leaves the dispatch set unchanged', async () => {
+    const ql = await makeEngine();
+    const keyed = passThrough();
+    const global = passThrough();
+    ql.registerMiddleware(keyed, { object: GATED });
+    ql.registerMiddleware(global);
+    expect(ql.hasObjectMiddleware(GATED)).toBe(true);
+    expect(ql.hasObjectMiddleware(PLAIN)).toBe(false);
+    expect(keyed).not.toHaveBeenCalled();
+    expect(global).not.toHaveBeenCalled();
+    // Positive control: a read through the chain reaches both, once each, and
+    // a read of the other object reaches the global one alone.
+    await ql.count(GATED, {});
+    expect(keyed).toHaveBeenCalledTimes(1);
+    expect(global).toHaveBeenCalledTimes(1);
+    await ql.count(PLAIN, {});
+    expect(keyed).toHaveBeenCalledTimes(1);
+    expect(global).toHaveBeenCalledTimes(2);
+  });
+});
@@ -5112,6 +5112,24 @@ export class ObjectQL implements IObjectQLEngine {
     this.logger.debug('Registered middleware', { object: options?.object, total: this.middlewares.length });
   }
 
+  /**
+   * [#21080] Whether a middleware is registered FOR `objectName` — a
+   * {@link registerMiddleware} call whose `object` names it
+   * (`IObjectQLEngine.hasObjectMiddleware`).
+   *
+   * A read of what the registrations above recorded, and nothing else: it
+   * runs no middleware and registers none. A global registration (no
+   * `object`, or `'*'`) matches every object in {@link executeWithMiddleware}
+   * but is keyed to none, so it is not counted.
+   *
+   * Asked by a read path that runs no engine operation — the analytics
+   * native-SQL strategy, which executes raw SQL through the driver — so it can
+   * decline an object whose gates live here and let this engine serve it.
+   */
+  hasObjectMiddleware(objectName: string): boolean {
+    return this.middlewares.some((m) => !!m.object && m.object !== '*' && m.object === objectName);
+  }
+
   /**
    * Execute an operation through the middleware chain
    */