@@ -0,0 +1,21 @@
+---
+'@objectstack/lint': minor
+---
+
+fix(lint)!: a report whose `runtimeFilter` names a field its dataset's object lacks is refused at publish (`report-filter-field-unknown`), as the dashboard twin already is (#29900)
+
+Clause-②: yes (narrowing) — the report publish door, `os validate` and `os build` refuse a report `runtimeFilter` key they accepted before; `@objectstack/lint` also exports `validateReportRuntimeFilters`, `REPORT_FILTER_FIELD_UNKNOWN` and the `ReportRuntimeFilterFinding` type.
+Metadata-protocol: narrowed
+Skills-docs: none — `skills/**` and `content/docs/**` teach `runtimeFilter` keys that are fields of the dataset's object, which this rule accepts; no page teaches a key the object lacks. The reasoning ships as the `os explain report-filter-field-unknown` entry.
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed or renamed: ReportSchema.runtimeFilter keeps its shape and meaning, and the build and the publish door now give its keys the verdict a dashboard widget filter key already gets. A refused key never served a report (every reader saw Dataset query failed), so there is no rewrite that keeps what the author meant; the author names a real field or dimension, and the refusal says which. -->
+
+**BREAKING** accept-set narrowing at the report publish door (`PUT /api/v1/meta/report/NAME`, `POST /api/v1/meta/report/NAME/publish`, package draft publish; Studio, REST and MCP authors) and in `os validate` / `os build`.
+
+- **Before.** A report with `runtimeFilter: { no_such_field: 'x' }` over a dataset whose object has no `no_such_field` published `200`, and every reader of the report saw a "Dataset query failed: 400 Bad Request — Filter member no_such_field …" panel instead of numbers. The same key on a dashboard widget's `filter` was already refused `422` (`widget-filter-field-unknown`).
+- **Now.** It is refused `422 INVALID_METADATA` with `report-filter-field-unknown` at `reports[0].runtimeFilter.no_such_field`, and the verdict names the object and the nearest field ("Did you mean …"). A `joined` report's block filter is judged against the block's dataset, and the report-level `runtimeFilter` (merged into every block's query) against each block's dataset.
+- **Accepted, as on a widget.** A field of the dataset's object, a registry-injected system column (`created_at`, `owner_id` where injected), a dotted relationship path, and every `$` operator and combinator. One more key is accepted on a report: a bare key naming a dimension of the bound dataset, which the dataset query binds through that dimension.
+- **Not judged.** A `dataset` that resolves to nothing (`chart-dataset-unknown` reports it once), an object the stack (or the publish snapshot) does not carry, an object with no readable field map, and a dotted key whose prefix the dataset's `include` does not declare.
+- **`os explain report-filter-field-unknown`** prints the reasoning; `RULE_EXPLANATIONS` gains the entry.
+
+**What an author does.** Nothing for a report whose filter keys name real fields or dimensions. A refused key never served the report (every reader saw the error panel), so there is no rewrite that keeps what the author meant: name a field of the dataset's object, a dimension of the dataset, or a `relationship.field` path whose prefix the dataset's `include` declares. The refusal names the key and the nearest field.
@@ -721,6 +721,14 @@ export {
 } from './validate-report-date-range.js';
 export type { ReportDateRangeFinding } from './validate-report-date-range.js';
 
+// [#29900] A report's `runtimeFilter` keys resolved on its dataset's object
+// graph, by the dashboard twin's own judgement (`widget-filter-field-unknown`).
+export {
+  validateReportRuntimeFilters,
+  REPORT_FILTER_FIELD_UNKNOWN,
+} from './validate-report-runtime-filter.js';
+export type { ReportRuntimeFilterFinding } from './validate-report-runtime-filter.js';
+
 // [#28473] ADR-0146 D3: a package namespace too long to have a paired
 // customization namespace, judged with `customizationNamespace` itself.
 export {
 
@@ -53,6 +53,9 @@ describe('reference-integrity suite — membership', () => {
       // same dataset's date dimensions — placed beside the chart member that
       // resolves the rest of that report's bindings.
       'validateReportDateRange',
+      // [#29900] The same report's `runtimeFilter` keys, resolved on the same
+      // dataset's object graph by the dashboard twin's judgement.
+      'validateReportRuntimeFilters',
       // [#14105] The dataset's OWN references, one level below the two binding
       // rules above it — the conscious edit this written-out list exists to
       // force, placed so the family reports top-down.
 
@@ -111,6 +111,7 @@ import { validatePageFieldBindings } from './validate-page-field-bindings.js';
 import { validatePageVisualizationBindings } from './validate-page-visualization-bindings.js';
 import { validateChartBindings } from './validate-chart-bindings.js';
 import { validateReportDateRange } from './validate-report-date-range.js';
+import { validateReportRuntimeFilters } from './validate-report-runtime-filter.js';
 import { validateDatasetReferences } from './validate-dataset-references.js';
 import { validateMappingTargetFields } from './validate-mapping-target-fields.js';
 import { validateNavAccess } from './validate-nav-access.js';
@@ -514,6 +515,23 @@ export const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[] = [
   // report declares `dateRange`, so 0 findings by construction, and the door
   // test's lit probes are refused (`runtime-gate.inert-type-writes.test.ts`).
   { name: 'validateReportDateRange', runtimeTypes: ['flow', 'report'], run: validateReportDateRange },
+  // [#29900] The same report, its `runtimeFilter` KEYS: each resolved on the
+  // bound dataset's object graph by `judgeDatasetFilterKeys`, the judgement the
+  // dashboard twin `widget-filter-field-unknown` runs on a widget's own
+  // `filter` (a dimension name of the dataset is accepted too: the dataset door
+  // binds a bare key through the cube's members first). Without it a report
+  // whose filter names a field the object lacks published 200 and every reader
+  // got "Dataset query failed", while the identical key on a widget was refused.
+  //
+  // `report` joins the `['flow']` default for its siblings' reason: the two
+  // collections it resolves into, `stack.datasets` and `stack.objects`, are both
+  // carried by the per-write report snapshot (`RuntimeStackContext`), and its
+  // skips (a dataset that resolves to nothing, an object this snapshot does not
+  // carry, one with no readable field map, a registry-injected column) keep a
+  // partial snapshot from manufacturing a refusal. A refusal NARROWING: MEASURED
+  // over the shipped report corpus before crossing (see the PR), with lit
+  // probes refused at the door (`runtime-gate.inert-type-writes.test.ts`).
+  { name: 'validateReportRuntimeFilters', runtimeTypes: ['flow', 'report'], run: validateReportRuntimeFilters },
   // [#14105] One level BELOW the two members above it. `validateChartBindings`
   // and `validateWidgetBindings` resolve a presentation's binding against the
   // dataset (#7529/#8902); this one resolves the DATASET's own references —
 
@@ -5490,6 +5490,30 @@ const REPORT_DATE_RANGE_DIMENSION_NONE_EXPLANATION: RuleExplanation = {
   paragraphs: REPORT_DATE_RANGE_SHARED_PARAGRAPHS,
 };
 
+// ── Report runtime filter (`validate-report-runtime-filter.ts`) ─────────────
+
+const REPORT_FILTER_FIELD_UNKNOWN_EXPLANATION: RuleExplanation = {
+  rule: 'report-filter-field-unknown',
+  covers: 'what an unresolved report filter key does',
+  paragraphs: [
+    'A report\'s `runtimeFilter` is ANDed into its dataset query, exactly as a dashboard widget\'s own ' +
+      '`filter` is. The dataset query refuses a key it cannot bind, so a report whose filter names a ' +
+      'field its dataset\'s object lacks shows every reader a "Dataset query failed" panel instead of ' +
+      'numbers. On a `joined` report the report-level `runtimeFilter` is merged into every block\'s ' +
+      'query, so it is judged against each block\'s dataset, and each block\'s own filter against its ' +
+      'own.',
+    'Each key is judged as `widget-filter-field-unknown` judges a widget filter key — a dotted ' +
+      '`relationship.field` path hop by hop, a bare name against the authored and registry-injected ' +
+      'columns — and one more name is accepted: a bare key naming a dimension of the bound dataset, ' +
+      'which the dataset query binds through that dimension. Not reported: a `dataset` that resolves to ' +
+      'nothing (`chart-dataset-unknown` reports that once), an object this stack does not define, or ' +
+      'one with no readable field map.',
+    'To fix it, filter on a field of the dataset\'s object, on a dimension of the dataset, or on a ' +
+      '`relationship[.relationship].field` path whose prefix the dataset\'s `include` declares. The ' +
+      'verdict\'s "Did you mean" names the nearest field of the object the miss landed on.',
+  ],
+};
+
 // The pairing rule lives in `@objectstack/spec/kernel`'s `customization-package.ts`
 // (`customizationNamespace`, `MAX_CUSTOMIZATION_BASE_NAMESPACE_LENGTH`,
 // `CUSTOMIZATION_NAMESPACE_SUFFIX`); `rule-explanations.test.ts` holds the
@@ -5762,6 +5786,7 @@ export const RULE_EXPLANATIONS: Readonly<Record<string, RuleExplanation>> = Obje
   [REPORT_DATE_RANGE_DIMENSION_NOT_DATE_EXPLANATION.rule]: REPORT_DATE_RANGE_DIMENSION_NOT_DATE_EXPLANATION,
   [REPORT_DATE_RANGE_DIMENSION_AMBIGUOUS_EXPLANATION.rule]: REPORT_DATE_RANGE_DIMENSION_AMBIGUOUS_EXPLANATION,
   [REPORT_DATE_RANGE_DIMENSION_NONE_EXPLANATION.rule]: REPORT_DATE_RANGE_DIMENSION_NONE_EXPLANATION,
+  [REPORT_FILTER_FIELD_UNKNOWN_EXPLANATION.rule]: REPORT_FILTER_FIELD_UNKNOWN_EXPLANATION,
   [NAMESPACE_NO_CUSTOMIZATION_PAIR_EXPLANATION.rule]: NAMESPACE_NO_CUSTOMIZATION_PAIR_EXPLANATION,
   [FLOW_REGION_SHAPE_INVALID_EXPLANATION.rule]: FLOW_REGION_SHAPE_INVALID_EXPLANATION,
 });
 
@@ -527,6 +527,73 @@ describe('#26548 — the `report` door judges a date range against the dataset i
   });
 });
 
+describe('#29900 — the `report` door resolves `runtimeFilter` keys as the dashboard twin does', () => {
+  // The card's shape at the door's own snapshot: a summary report over a
+  // dataset of `acme_invoice`, its dimension `state` named apart from the field
+  // `status` it reads so that "a dimension key is accepted" is not the same
+  // fact as "a field key is accepted".
+  const FILTERED = {
+    objects: OBJECTS,
+    datasets: [
+      ...DATASETS,
+      {
+        name: 'acme_invoice_states',
+        label: 'Invoice States',
+        object: 'acme_invoice',
+        dimensions: [{ name: 'state', label: 'State', field: 'status', type: 'string' }],
+        measures: [{ name: 'total_sum', label: 'Total', aggregate: 'sum', field: 'total' }],
+      },
+    ],
+  };
+  const report = (over: Record<string, unknown>) => ({
+    name: 'acme_filtered_report',
+    label: 'Open Invoices',
+    type: 'summary',
+    dataset: 'acme_invoice_states',
+    rows: ['state'],
+    values: ['total_sum'],
+    ...over,
+  });
+
+  it('⭐ LIT — the card\'s repro: a key the object lacks is REFUSED at its path', () => {
+    const result = runRuntimeAuthoringRules({
+      type: 'report',
+      item: report({ runtimeFilter: { no_such_field: 'x' } }),
+      context: FILTERED,
+    });
+    expect(result.rulesRun).toContain('validateReferenceIntegrity');
+    expect(ruleIds(result.errors), dump(result)).toEqual(['report-filter-field-unknown']);
+    expect(result.errors[0].path).toBe('reports[0].runtimeFilter.no_such_field');
+  });
+
+  it('⭐ LIT — a joined block\'s own key, and a container key a block\'s object lacks', () => {
+    const joined = {
+      name: 'acme_joined_report',
+      label: 'Joined',
+      type: 'joined',
+      runtimeFilter: { nope: 1 },
+      blocks: [{ name: 'b1', type: 'summary', dataset: 'acme_invoice_states', rows: ['state'], values: ['total_sum'], runtimeFilter: { also_nope: 1 } }],
+    };
+    const result = runRuntimeAuthoringRules({ type: 'report', item: joined, context: FILTERED });
+    expect(result.errors.map((f) => [f.rule, f.path]), dump(result)).toEqual([
+      ['report-filter-field-unknown', 'reports[0].runtimeFilter.nope'],
+      ['report-filter-field-unknown', 'reports[0].blocks[0].runtimeFilter.also_nope'],
+    ]);
+  });
+
+  it('⭐ CONTROL — a field key, a dimension key, a system column and `$` operators publish clean', () => {
+    const result = runRuntimeAuthoringRules({
+      type: 'report',
+      item: report({
+        runtimeFilter: { $and: [{ status: 'open' }, { state: { $ne: 'void' } }, { created_at: { $gte: '{today}' } }] },
+      }),
+      context: FILTERED,
+    });
+    expect(result.errors, dump(result)).toEqual([]);
+    expect(result.advisories, dump(result)).toEqual([]);
+  });
+});
+
 // ─── Group A · `skill` — outside the door BY DESIGN, and these pins hold it ──
 
 describe('#19527 — `skill` stays outside the door by design: tool references are a whole-stack verdict', () => {
@@ -928,15 +995,19 @@ describe('#19542 — DARK: what the five crossings did NOT widen', () => {
     }
   });
 
-  it('a `report` write reaches exactly TWO suite members, and a `skill` write none', () => {
+  it('a `report` write reaches exactly THREE suite members, and a `skill` write none', () => {
     // The entry-level `runtimeTypes` says which WRITES dispatch the suite; the
     // per-member `runtimeTypes` says which MEMBERS judge that snapshot. Asked
     // against the real table so a member widened without this file noticing
     // fails here.
     const membersFor = (type: string) =>
       REFERENCE_INTEGRITY_RULES.filter((m) => (m.runtimeTypes ?? ['flow']).includes(type)).map((m) => m.name);
 
-    expect(membersFor('report')).toEqual(['validateChartBindings', 'validateReportDateRange']);
+    expect(membersFor('report')).toEqual([
+      'validateChartBindings',
+      'validateReportDateRange',
+      'validateReportRuntimeFilters',
+    ]);
     // Outside the door by design (ruling `5791822697`) — the entry does not
     // dispatch a skill write and no member claims one, so the two halves
     // agree. See the `skill` block above.