@@ -0,0 +1,23 @@
+---
+'@objectstack/lint': minor
+---
+
+fix(lint)!: a roll-up summary whose `summaryOperations.filter` names a key its child object lacks is refused at build and publish (`object-field-ref-unknown`), because every child write then fails its recompute
+
+Clause-②: no (narrowing) — `os validate`, `os build`, `os lint` and the object save and publish doors refuse a summary field they accepted before. No export is added: the position joins the existing `object-field-ref-unknown` rule.
+Metadata-protocol: narrowed
+Skills-docs: none — `skills/**` and `content/docs/**` teach `summaryOperations.filter` keys that are fields of the child object, which this rule accepts. The reasoning ships in the `os explain object-field-ref-unknown` entry.
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed or renamed: summaryOperations.filter keeps its shape and meaning, and lint now judges its keys against the child object the way lookupFilters[].field is judged against the referenced one. A refused key never filtered what the author meant (every child write answered a recompute failure and the summary stayed stale), so there is no rewrite that keeps the author's intent: the author names a real child field, and the verdict names the nearest one. -->
+
+**BREAKING** accept-set narrowing in `os validate` / `os build` / `os lint` and at the object save and publish doors (`PUT /api/v1/meta/object/NAME` live save, the per-item and package publish; Studio, REST and MCP authors), through the `object-field-ref-unknown` rule.
+
+- **Before.** A summary field with `summaryOperations: { object: 'invoice_line', function: 'sum', field: 'amount', filter: { stauts: 'paid' } }` parsed, built and published. The engine runs the filter as the `where` of an aggregate on the child, ANDed with the parent-FK match. Measured on a real `SqlDriver` (better-sqlite3): every insert of a child row then answered `SummaryRecomputeError` ("the triggering records WERE written"), and the summary kept a stale value.
+- **Now.** Each key the child lacks is refused `error` at `objects[i].fields.FIELD.summaryOperations.filter.KEY`, naming the key, the child object and the nearest field ("Did you mean"). Keys inside `$and` / `$or` / `$not` groups are judged too. Three more shapes the recompute query refuses are refused the same way, each measured on the same driver as a `SummaryRecomputeError` on every child insert:
+  - a dotted key such as `account.status`: the cure is the nested one-level form the query serves, `{ account: { status: VALUE } }`;
+  - a child field computed on read, such as a `formula`: denormalise it onto the child as a stored field;
+  - beneath a relation, a key the related object lacks, a dotted key, a second relation holding a condition of its own, or an empty condition. The nested form reaches one level.
+- **Accepted.** Child fields with any operator, and the nested one-level relation form `{ relation: { field: VALUE } }` over fields of the related object.
+- **Not judged.** A child object the stack does not define, a child with no readable field map, and a registry-injected system column (resolved per object), the same skips every position of this rule takes.
+
+**What an author does.** Nothing for a filter whose keys are fields of the child object. For a refused key: name the child field you meant (the verdict suggests the nearest one), or drop the key.
@@ -4249,6 +4249,15 @@ const OBJECT_FIELD_REF_UNKNOWN_EXPLANATION: RuleExplanation = {
       '(the picker scopes its candidates by that key). The referenced object is judged only on ' +
       '`lookup`, `master_detail` and `user` fields, the types that render the picker, and a bare ' +
       '`dependsOn` name that misses on the owning object is reported once, there.',
+    'A summary field\'s `summaryOperations.filter` is judged against the CHILD object ' +
+      '`summaryOperations.object` names: the engine ANDs it with the parent-FK match and runs it as the ' +
+      'query on that child, so every key (inside `$and` / `$or` / `$not` groups) is a field of the child. ' +
+      'That query refuses what it cannot serve, and each refusal makes every child write answer a roll-up ' +
+      'recompute failure (the row is still written) while the summary keeps a stale value. So the rule ' +
+      'refuses a key the child lacks; a dotted key such as `account.status` (write the nested one-level ' +
+      'form `{ account: { status: VALUE } }` instead); a field computed on read, such as a `formula` ' +
+      '(denormalise it onto the child as a stored field); and, beneath a relation, a key the related ' +
+      'object lacks, a dotted key or a second relation holding a condition of its own.',
     '`lookupColumns`, `dependsOn` and `indexes[].fields` are read verbatim (a picker column key, a ' +
       'record key, a physical column), so a dotted name there is one name no field carries; the ' +
       'other positions resolve a relationship path. Not judged: an object this stack does not ' +
 
@@ -532,6 +532,130 @@ describe('validateObjectFieldRefs — lookupFilters[].field (addresses the REFER
   });
 });
 
+describe('validateObjectFieldRefs — summaryOperations.filter (addresses the CHILD object, #31224)', () => {
+  // `crm_account` is the parent; `crm_invoice` (with an FK to it) the child.
+  const rollup = (filter: unknown, over: Record<string, unknown> = {}) => ({
+    objects: [
+      account({
+        fields: {
+          ...account().fields,
+          billed: { type: 'summary', summaryOperations: { object: 'crm_invoice', field: 'total', function: 'sum', filter, ...over } },
+        },
+      }),
+      invoice({ account: lookup() }),
+    ],
+  });
+
+  it('REFUSES a misspelt key against the child object, at its path, as an error', () => {
+    const findings = validateObjectFieldRefs(rollup({ regoin: 'emea' }));
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toMatchObject({
+      severity: 'error',
+      rule: OBJECT_FIELD_REF_UNKNOWN,
+      path: 'objects[0].fields.billed.summaryOperations.filter.regoin',
+    });
+    expect(findings[0]!.message).toContain('"regoin" is not a field on object "crm_invoice"');
+    expect(findings[0]!.message).toContain('Did you mean "region"');
+    expect(findings[0]!.hint).toContain('runs on the child object `summaryOperations.object` names');
+  });
+
+  it('REFUSES a key only the PARENT (the object owning the summary) has', () => {
+    const findings = validateObjectFieldRefs(rollup({ industry: 'saas' }));
+    expect(findings.map((f) => f.path)).toEqual(['objects[0].fields.billed.summaryOperations.filter.industry']);
+  });
+
+  it('walks $and / $or / $not groups and reads past operator objects', () => {
+    const findings = validateObjectFieldRefs(rollup({
+      $and: [{ total: { $gte: 100 } }, { $or: [{ region: 'emea' }, { stauts: 'paid' }] }],
+      $not: { isssued_on: { $lt: '2026-01-01' } },
+    }));
+    expect(findings.map((f) => f.path)).toEqual([
+      'objects[0].fields.billed.summaryOperations.filter.$and[1].$or[1].stauts',
+      'objects[0].fields.billed.summaryOperations.filter.$not.isssued_on',
+    ]);
+  });
+
+  it('passes child fields with operators, and the nested one-level relation form the engine serves', () => {
+    expect(validateObjectFieldRefs(rollup({
+      total: { $gt: 0 },
+      issued_on: { $gte: '2026-01-01' },
+      region: { $in: ['emea', 'apac'] },
+      account: { status: 'active', industry: { $in: ['saas'] } },
+    }))).toEqual([]);
+  });
+
+  it('REFUSES the dotted spelling of a relation path, with the nested spelling as the cure', () => {
+    const findings = validateObjectFieldRefs(rollup({ 'account.status': 'active' }));
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toMatchObject({
+      severity: 'error',
+      rule: OBJECT_FIELD_REF_UNKNOWN,
+      path: 'objects[0].fields.billed.summaryOperations.filter.account.status',
+    });
+    expect(findings[0]!.message).toContain('dotted path through the relation "account"');
+    expect(findings[0]!.message).toContain('every recompute fails');
+    expect(findings[0]!.hint).toBe('Nest the condition beneath the relation field: { account: { status: VALUE } }.');
+  });
+
+  it('REFUSES a dotted path into a scalar field, and judges a dotted key whose head is unknown as unknown', () => {
+    const findings = validateObjectFieldRefs(rollup({ 'region.code': 'x', 'regoin.code': 'y' }));
+    expect(findings.map((f) => f.path)).toEqual([
+      'objects[0].fields.billed.summaryOperations.filter.region.code',
+      'objects[0].fields.billed.summaryOperations.filter.regoin.code',
+    ]);
+    expect(findings[0]!.message).toContain('a dotted path into "region", a text field');
+    expect(findings[0]!.hint).toContain('Denormalise the value onto the child object');
+    expect(findings[1]!.message).toContain('"regoin" is not a field on object "crm_invoice"');
+  });
+
+  it('REFUSES a child field computed on read (formula), at the top level and one level down', () => {
+    const stack = rollup({ is_big: true, account: { score_band: 'a' } }) as any;
+    stack.objects[1].fields.is_big = { type: 'formula', expression: 'total > 100' };
+    stack.objects[0].fields.score_band = { type: 'formula', expression: "'a'" };
+    const findings = validateObjectFieldRefs(stack);
+    expect(findings.map((f) => f.path)).toEqual([
+      'objects[0].fields.billed.summaryOperations.filter.is_big',
+      'objects[0].fields.billed.summaryOperations.filter.account.score_band',
+    ]);
+    expect(findings[0]!.message).toContain('a formula field of "crm_invoice", computed on read');
+    for (const f of findings) expect(f.hint).toContain('Denormalise the value onto the child object');
+  });
+
+  it('REFUSES what the nested form cannot serve: an unknown related key, a dotted one, a second relation level, an empty condition', () => {
+    const stack = rollup({
+      $and: [
+        { account: { statsu: 'active' } },
+        { account: { 'parent.name': 'x' } },
+        { account: { parent: { name: 'x' } } },
+        { account: {} },
+      ],
+    }) as any;
+    stack.objects[0].fields.parent = { type: 'lookup', reference: 'crm_account' };
+    const findings = validateObjectFieldRefs(stack);
+    expect(findings.map((f) => f.path)).toEqual([
+      'objects[0].fields.billed.summaryOperations.filter.$and[0].account.statsu',
+      'objects[0].fields.billed.summaryOperations.filter.$and[1].account.parent.name',
+      'objects[0].fields.billed.summaryOperations.filter.$and[2].account.parent',
+      'objects[0].fields.billed.summaryOperations.filter.$and[3].account',
+    ]);
+    expect(findings[0]!.message).toContain('"statsu" is not a field on object "crm_account"');
+    expect(findings[1]!.message).toContain('reaches one level only');
+    expect(findings[2]!.message).toContain('is itself a relation of "crm_account"');
+    expect(findings[3]!.message).toContain('names no field of "crm_account"');
+  });
+
+  it('judges only a `summary` field', () => {
+    const stack = rollup({ regoin: 'emea' }) as any;
+    stack.objects[0].fields.billed.type = 'number';
+    expect(validateObjectFieldRefs(stack)).toEqual([]);
+  });
+
+  it('does not judge a filter whose child the stack does not define, or a roll-up with no filter', () => {
+    expect(validateObjectFieldRefs(rollup({ anything: 1 }, { object: 'elsewhere_line' }))).toEqual([]);
+    expect(validateObjectFieldRefs(rollup(undefined))).toEqual([]);
+  });
+});
+
 describe('validateObjectFieldRefs — dependsOn (the gate on the OWNER, the filter on the REFERENCE)', () => {
   it('REFUSES a misspelt name in the string arm against the owning object — once, not twice', () => {
     const findings = validateObjectFieldRefs(twoObjects({
@@ -755,6 +879,7 @@ describe('[#22161] one-line verdicts — object-field-ref-unknown', () => {
       '.lookupColumns[',
       '.lookupFilters[',
       '.dependsOn[',
+      '.summaryOperations.filter.',
     ]) {
       expect(converted.some((f) => f.path.includes(position)), position).toBe(true);
     }
@@ -773,7 +898,7 @@ describe('[#22161] one-line fix — object-field-ref-unknown', () => {
     const converted = fired.filter((f) => f.rule === OBJECT_FIELD_REF_UNKNOWN);
     // Coverage control: every position fired (the verdict block above names
     // them), so the bound reads each prescription.
-    for (const position of ['.highlightFields[', '.publicSharing.redactFields[', '.indexes[', '.relatedListColumns[', '.lookupColumns[', '.lookupFilters[', '.dependsOn[']) {
+    for (const position of ['.highlightFields[', '.publicSharing.redactFields[', '.indexes[', '.relatedListColumns[', '.lookupColumns[', '.lookupFilters[', '.dependsOn[', '.summaryOperations.filter.']) {
       expect(converted.some((f) => f.path.includes(position)), position).toBe(true);
     }
     for (const f of converted) {