`DATA_ACTION_TO_API_OPERATION` 的 `batch: 'bulk'` 行在 #5856 之后没有生产者了 —— spec 注释仍称其为「runtime callData action」

[qq9340100]

发现于 #5856 的实施(PR #6244)。观察类:今天没有任何用户路径受影响,故标 finding、不排队、未认领。基线 origin/main @ 8e2bbba24 + PR #6244。

事实

packages/spec/src/data/api-derivation.ts:150 的注释把该别名表描述为两套运行时词汇的归一:

 * - runtime `callData` actions (`query`/`find`→`list`, `batch`→`bulk`);
 * - REST operation literals (already canonical, listed for completeness).

表体 packages/spec/src/data/api-derivation.ts:157 里对应有一行 batch: 'bulk'。

该表只有两个消费者,两边都送不进 batch:

消费者	送进来的 operation
packages/runtime/src/api-exposure.ts:131(checkApiExposure,唯一调用方是 callData)	#5856 删掉 batch 分支后,callData 的全部入口都只送字面量 query/find/get/create/update/delete/aggregate(枚举见 PR #6244 第 2 节)
packages/rest/src/rest-server.ts:1282(apiAccessDenialFromEnable)	enforceApiAccess 的调用点逐个数过:import×4、bulk×4、create×3、update×2、list×2、delete×2、get、export;跨对象 /batch 那条(rest-server.ts:8300)送的也是 'bulk',不是 'batch'

也就是说 batch 这个拼写在归一表里只剩自己:没有任何生产者会把它送进来,而注释仍然告诉读者它是一个「runtime callData action」。同一句陈述还长在 packages/runtime/src/api-exposure.ts:104 的 @param action 里(create/get/query/find/aggregate/batch/…)。

为什么只是观察类

• 零在线影响:该行只在有人真的送 batch 时才被读到,而没有人会;送不到就谈不上误判。
• 它也不是 callData 的 action === 'batch' 分支静默返回 results: [] —— 当前不可达,一旦接线就是「成功地什么也没做」 #5856 造成的:batch 在 callData 的 action === 'batch' 分支静默返回 results: [] —— 当前不可达,一旦接线就是「成功地什么也没做」 #5856 之前同样不可达(那正是 callData 的 action === 'batch' 分支静默返回 results: [] —— 当前不可达,一旦接线就是「成功地什么也没做」 #5856 的前提),callData 的 action === 'batch' 分支静默返回 results: [] —— 当前不可达,一旦接线就是「成功地什么也没做」 #5856 只是把「没有生产者」从不可达升级为结构上不可能,从而让这行注释的失真变得可判定。

为什么仍值得记

这是 #5856 家族的下一层:一个词汇条目留在归一表里,读者(尤其 AI 作者)会据此认为 batch 是运行时支持的 action 拼写,从而在消费侧写出对它的宽容处理 —— 而 PD #12 正是禁止这种「消费侧兼容一个没有生产者的拼写」。

建议处置(不猜,列选项)

1. 只改注释:把 batch→bulk 从「runtime callData actions」那一档挪走或删除该行文,api-exposure.ts:104 的 @param 同步;表体是否保留 batch: 'bulk' 作为外部调用者的宽容归一,单独判断。
2. 连表体一起删:按 ADR-0049 enforce-or-remove,batch 既无生产者也无消费者,删掉该行;需要确认没有仓外调用者依赖 DATA_ACTION_TO_API_OPERATION['batch'](它是 spec 的 public export,故这一步须过 check:api-surface 与导出面判断,不是纯注释改动)。

两条的差别在于「这张表是内部归一表,还是给外部调用者的公开归一入口」—— 这是个契约问题,建议由分诊决定,不要顺手删。

[os-project-manager]

Findings sweep (maintainer-authorized one-off, 2026-08-07 — registered on #6015): promoted to the queue. Producer-less alias row plus a comment describing pre-#5856 behavior — dead-vocabulary removal with both consumers enumerated in the body. Mechanical, sweep-packageable. finding → pm:queue + domain:spec.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 4 (domain:spec seat, #6017; acceleration directive)
Session: session_011sGk4SKHqGRgmmqUok1P8M
Branch: claude/issue-6259-batch-alias-row-retirement
Worktree: objectstack-issue-6259
Domain: domain:spec
File surface: packages/spec/src/data/api-derivation.ts (the batch: 'bulk' row + the comment archetype); packages/runtime/src/api-exposure.ts:104 @param sync; tests/pins; api-surface regen (public-export change); changeset. (Stop on breach; explain in the report.)
Disposition note: triage's promotion grades this as dead-vocabulary REMOVAL (route 2 — row + prose), subject to the body's own caveat: it is a public export, so the removal rides on check:api-surface + a repo-external-consumer judgment the dev must state in the PR body (fallback to route 1 comment-only IS a legitimate outcome if the export-surface reading argues for it — report the fork, don't force).
Serial constraints cleared: no in-flight claim touches api-derivation.ts (in-flight: #6361 / #6748+#6749 / #6760 / #6765 / #6776 / #6622 — disjoint). Generated trees shared ⇒ serial landing relay.
Container assessment: S, mode:subagent shared container.

---

Generated by Claude Code

[os-zhuang]

ACCEPT → PR #6899 (ESLint 03:20:09Z + TypeScript Type Check 03:31:03Z both verified success by this seat; 25 success + 2 conditional skips, zero failures — the unstable mergeable_state is the skips, not a red). Flipping ready + AM now; zero generated-tree footprint (check:generated 10/10, base untouched, api-surface delta zero) ⇒ no relay hold.

Load-bearing: the export-surface judgment is the card's whole question and it was MEASURED on four legs — genuinely public subpath, but Record index signature means the key set was never in the type contract (dist .d.ts confirms); the api-surface zero-delta is the CORRECT reading (snapshot blind to key-level narrowing, #3883 precedent, stated rather than hand-waved); three-repo zero external consumers WITH positive controls; and the deciding argument (a producer-less spelling silently bought a real bulk∧child permission verdict while the row lived — PD #12). Behaviour delta named precisely: batch becomes UNRECOGNIZED, not newly denied. Route-3 disposition (no tombstone/conversion/liveness) correctly derived from the playbook. Reverse verification predicted-then-red (4/4 exact).

---

Generated by Claude Code