Repository navigation
[finding] objects.mdx's apiMethods sample omits bulk too — same trap as #10590, different page, outside that card's site list #10711
Description
Found while implementing the #10616 docs-audit sweep (member #10590). Filed
separately per that sweep's gate 4 — not folded into the sweep PR.
What is wrong
content/docs/data-modeling/objects.mdx:83 (line 84 on the sweep branch, after that
page's sharingModel edit) ships this sample:
enable: {
trackHistory: true, // Field history tracking for audit
searchable: true, // Include in global search index
apiEnabled: true, // Expose object via automatic APIs (REST)
apiMethods: ['get', 'list', 'create', 'update', 'delete'],
...bulk is missing. packages/spec/src/data/object.zod.ts:18-22:
export const ApiMethod = z.enum([
'get', 'list', // Read
'create', 'update', 'delete', // Write
'bulk', // Batch operations
]);An apiMethods whitelist is exact — undefined = unrestricted, a subset = that subset's
derived closure — so a reader who copies this sample silently denies batch operations
on the object.
Why it is not part of #10590
#10590 names exactly one landing spot, data-modeling/schema-design.mdx:71-77, and rests
its case on the comment there asserting "six primitives only" next to a list of five. This
site has no such comment, so it is the quieter half of the same defect: no contradiction on
the page to notice, just a sample that under-enumerates.
The same page contradicts itself two rows down. objects.mdx:96 — the property table
directly below the sample — reads:
apiMethods| all | Whitelist over the six primitives
(get/list/create/update/delete/bulk) ...
So the page's table is right and the page's sample is wrong, on the same screen.
The sweep's gate 3 ("zero changes outside the listed member sites") is why this was not
folded into the sweep PR.
Generated by Claude Code
Activity
os-zhuang commentedon Aug 21, 2026
Triage (finding concentration round): promoted to
pm:queue· type Task. One-line sample fix; the page's own property table two rows down already states the correct six-primitive list, and the copy-paste consequence (silently denying batch operations) is the dangerous direction. S,mode:subagent, sonnet; Clause-②: no.Generated by Claude Code
claude commentedon Aug 21, 2026
{ "issue": 10711, "status": "done", "branch": "claude/issue-10711-apimethods-bulk", "pr": "https://github.com/objectstack-ai/objectstack/pull/10823", "premise_still_valid": true, "summary": "Re-derived both halves at base f4e5d916d6 and confirmed the card: packages/spec/src/data/object.zod.ts:18-22 declares six ApiMethod primitives, content/docs/data-modeling/objects.mdx:97 (the property table) already names all six, and objects.mdx:84 (the sample) listed five, omitting 'bulk'. Line numbers had moved by one from the card (sample 83->84, table 96->97). Fixed with a one-line addition of 'bulk' to the sample array; nothing else changed. Swept every apiMethods occurrence repo-wide for a third under-enumerating site and found none — objects.mdx:84 was the last one. #10590 has ALREADY LANDED at this base: schema-design.mdx:71-77 now enumerates all six with an explicit \"omitting `bulk` DENIES batch operations\" comment; that site was not touched. Concluded skip-changeset (label applied and read back): apps/docs is private:true and no workspace package.json names content/ in files[], so this file publishes nothing to npm — unlike the sibling card's published-package README.", "tests": "Gate set derived with `node scripts/pm/dispatch-gates.mjs` (no path args; it took its own change set from merge base f4e5d916d) -> 14 families. Re-derived AND re-run after the final commit at HEAD 03c2bb5261 with a clean working tree; every exit code captured before any pipe (`cmd > log 2>&1; ec=$?`), run through `scripts/pm/os-verify-lock.sh -c` (VERDICT command-exit 0, held 27s, waited 6s). All 15 exit 0 (14 derived + check:nul-bytes): cross-package-test-inputs, doc-anchors, doc-authoring, doc-formula-expressions, docs-audit-scope, docs-redirects, spec-empty-state, spec-liveness, published-readme-links, role-word, spec-strictness-ledger, spec-variant-docs, check-cross-package-test-inputs.mjs, check-doc-frontmatter.mjs, nul-bytes. Gates' own verdict lines, not a bare $?: `✓ doc authoring guard: 389 files clean — no bare metadata literals.` · `✅ check-doc-anchors: 272 internal #fragment link(s) across 408 source file(s) all resolve to a real heading` · `✓ check-doc-frontmatter: 403 page(s) under content/docs parse with yaml@2.9.0` · `✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 416 files / 1443 TS blocks judged clean by @objectstack/formula.` · `✓ docs-accuracy-audit scope is in sync with content/docs/: 189 hand-written doc(s).` FIRST run of check:doc-formula-expressions exited 1 with ERR_MODULE_NOT_FOUND for @objectstack/formula/dist/index.mjs — unbuilt dependency closure in a fresh worktree, NOT this change; green after `pnpm --workspace-concurrency=2 --filter '@objectstack/lint^...' build` and green in the post-commit union. Edit proven on disk before commit: old shape grep -c 1->0, new shape 0->1, plus the one-line git diff. Control-byte self-scan of the edited file and of the PR body: clean. NO ABLATION APPLIES — a docs correction has no guard under test, so there is no mutation that would prove a gate red; the slot is deliberately empty rather than filled with a ceremony that measures nothing.", "open_questions": [], "out_of_scope_findings": [] }Generated by Claude Code