docs: correct two stale GraphQL residue sites in package source comments

[os-steve]

Fixes #11140

Comment-only fix for two package-source comments that still asserted a /graphql surface the runtime does not mount — same defect class as #10846 / #10710 / #10832 / #10583 / #10835, one surface further in (package source comments rather than the published skill catalog).

Sites fixed

Site	Before	After
packages/spec/src/data/object.zod.ts:252	/** Enable REST/GraphQL API access */	/** Enable REST/MCP API access */
packages/adapters/hono/src/index.ts:105-106	Only routes that need framework-specific handling (auth service, GraphQL raw result, discovery wrapper) are registered explicitly.	Only routes that need framework-specific handling (auth service, discovery wrapper) are registered explicitly.

Neither site's .describe() (line below the apiEnabled JSDoc) was touched — it already read correctly ("Expose object via automatic APIs").

Why

• apiEnabled gates the automatic REST and MCP surfaces, not GraphQL — packages/mcp/src/stdio-data-bridge.ts:260 reads enable.apiEnabled === false. There is no automatic GraphQL API.
• createHonoApp registers auth (app.all(prefix + '/auth/*')) and discovery (app.get(prefix), /discovery, /.well-known/objectstack) explicitly, then one catch-all — no GraphQL route is registered. packages/runtime/src/http-dispatcher.ts:2087 carries the authoritative statement: // /graphql removed — GraphQL is not in the product plan (#2462 follow-on).

Scope

Comment-only. No behavior change, no .describe() change, no schema shape change. Exactly the two files/sites named above — nothing else touched.

Tests

Run on commit 07a05a7053 (current HEAD):

• Control probe (before edit): git grep -n "GraphQL" -- packages/spec/src/data/object.zod.ts packages/adapters/hono/src/index.ts → exactly the 2 expected hits.
• Control probe (after edit): same command → 0 hits (grep exit 1).
• pnpm --filter '@objectstack/spec^...' build → no workspace deps for spec; command-exit 0.
• pnpm --filter @objectstack/spec build → command-exit 0. Confirmed the rebuilt JS bundle (packages/spec/dist/data/index.js) carries the new JSDoc text (Enable REST/MCP API access) and no residual GraphQL text tied to apiEnabled; the .d.ts output does not inline this bare JSDoc at all (only .describe() strings do), so check:api-surface/check:docs are unaffected by this change — confirmed by check:generated below.
• pnpm --filter @objectstack/spec check:generated → ✓ All 14 generated artifacts are up to date (command-exit 0).
• pnpm --filter @objectstack/spec typecheck → command-exit 0 (tsc --noEmit + check:scripts-typecheck + check:test-typecheck, pre-existing test-layer debt count unchanged at 263/55 files).
• pnpm --filter '@objectstack/hono^...' build (deps closure: @objectstack/rest, plugin-auth, @objectstack/runtime, etc.) → command-exit 0.
• pnpm --filter @objectstack/hono build → command-exit 0.
• pnpm --filter @objectstack/hono test -- --maxWorkers=2 → Test Files 2 passed (2) / Tests 74 passed (74), command-exit 0.
• node scripts/check-route-envelope.mjs (matched by node scripts/pm/dispatch-gates.mjs specifically via packages/adapters/hono/src/index.ts) → pre-existing ratchet state unchanged, command-exit 0.
• git grep -n "createGraphQLDomain" packages/*/src → 0 hits (unchanged from filing-time verification).

Local scope followed the "定向门禁,全农场归 CI" discipline — the full lint farm is CI's to run.

Deviations from the dispatch prompt

None. Both sites were still present on origin/main at task start (line numbers matched the prompt's re-verification: object.zod.ts:252 intact, hono sentence spanning :105-:106). premise_still_valid: true.

skip-changeset: comment-only diff, no changeset. Adding the skip-changeset label next via the additive endpoint per AGENTS.md, then reading it back to confirm it survived.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/hono, @objectstack/spec, touching 1 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/getting-started/quick-reference.mdx (via ObjectCapabilities (symbol))
• content/docs/protocol/objectql/security.mdx (via ObjectCapabilities (symbol))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via ObjectCapabilities (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/adapters/hono/src/index.ts) — pages documenting those are invisible to this run

Coarse fallback — 126 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json bb006446adb558e5a86c009df9c0b08e98833011 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ab546a30fc50ef4e3a8a346ae132cea49c40271e — the merge of head 07a05a7053d88e99c2ef4586983f4e5987ade710 into base bb006446adb558e5a86c009df9c0b08e98833011, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ab546a30fc50ef4e3a8a346ae132cea49c40271e && git checkout ab546a30fc50ef4e3a8a346ae132cea49c40271e
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin bb006446adb558e5a86c009df9c0b08e98833011 07a05a7053d88e99c2ef4586983f4e5987ade710 && git checkout -B drift-repro bb006446adb558e5a86c009df9c0b08e98833011 && git merge --no-ff 07a05a7053d88e99c2ef4586983f4e5987ade710

node scripts/docs-audit/affected-docs.mjs --json bb006446adb558e5a86c009df9c0b08e98833011

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs bb006446adb558e5a86c009df9c0b08e98833011 → pass the list as
args.docs, on the commit named under Which tree this was computed on.