fix(lint): the seven system-field exemption lists derive from the spec's declarations (#4330)

[os-zhuang]

Closes #4330.

What

Five rules in packages/lint each carried their own hand-copy of "registry-injected columns present on almost every object but absent from authored fields" — and by the time this lands there were seven: validate-translation-references had grown _id/name/space beyond the list the issue recorded, and #4305 added validate-hook-body-writes with its own union variant. Exactly the shape #3786 removed from the audit-provenance family.

One module now owns the answer:

• packages/lint/src/system-fields.ts — exports SYSTEM_FIELDS, derived from the spec's two declarations: FIELD_GROUP_SYSTEM_FIELDS (@objectstack/spec/data) and SystemFieldName (@objectstack/spec/system). All seven field-resolving rules consume it; validate-searchable-fields' local derivation (feat(lint): catch a stale searchableFields entry at authoring time (#4254 follow-up) #4328) moved here.
• system-fields.test.ts — pins the boundary in both directions: the set contains exactly the two declarations' union, and none of the rule-local exemptions (name, owner, record_type, _id, space).

The two judgement calls the issue asked for

1. The derived union is a superset of the hand-copies — accepted. widget-bindings, page-field-bindings and react-page-props now also exempt is_deleted; flow-template-paths now also exempts user_id. Both are the permissive direction the rules' own comments argue for: over-inclusion costs at worst a missed warning on a systemFields: false object, under-inclusion a false finding (ADR-0072 D1).
2. name / owner / record_type (and legacy _id / space) stay rule-local. None is a system column in the spec's sense — name in particular is an ordinary authored field on most objects, and exempting it package-wide would stop every field-existence rule from catching a reference to a genuinely missing field. The three rules that exempt any of them keep a local extension (IMPLICIT_FIELDS / IMPLICIT_HEADS) spreading the shared set, with the reason next to the names. The shared module's doc states this admission rule, and the pin test fails if one of them ever slips into the shared set.

No exemption any rule previously had was removed — every conversion is behavior-preserving or strictly more permissive.

Also corrected in passing: flow-template-paths' comment claimed to mirror "validateFormLayout's system-field set" — validateFormLayout has no such set.

Verification

• pnpm test in packages/lint: 40 files, 586 passed / 2 skipped
• pnpm typecheck in packages/lint: clean
• Changeset: patch for @objectstack/lint (matches the fix(spec,plugin-approvals): the two approval vocabularies are derived, not hand-matched (#3786) #4295 / fix(hono,plugin-hono-server,runtime): one CORS source and one registry key — the last derivable copies from the #3786 sweep #4282 precedent for derive-not-copy fixes)

🤖 Generated with Claude Code

https://claude.ai/code/session_01D8QhQz2V6VH1SX5SQ1nAgk

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 31, 2026 6:51am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/lint.

2 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/automation/hook-bodies.mdx (via @objectstack/lint)
• content/docs/permissions/authorization.mdx (via @objectstack/lint)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.