[finding] GraphQL residue outside #10583's site list: `api/index.mdx` still documents a `/graphql` route that the dispatcher removed

[claude]

Found while implementing the #10616 docs-audit sweep (member #10583). Filed
separately per that sweep's gate 4 — not folded into the sweep PR.

What #10583 covered

#10583 named five sites (getting-started/index.mdx:99, :133, and the
// Expose via REST/GraphQL gloss on three pages). All five are fixed in the sweep PR.

What it did not

content/docs/api/index.mdx is the sharpest remaining instance, and #10583 explicitly
parked it ("Out of this card's scope, flagged for whoever fixes it") without filing it
anywhere. It is not a stale gloss — it is a documented behaviour contract:

• content/docs/api/index.mdx:19 — table row: "GraphQL | Route is wired but
  bring-your-own service: /graphql returns 501 unless an implementation of the
  IGraphQLService contract is registered"
• content/docs/api/index.mdx:172 — the 501 table lists /graphql among routes that are
  "mounted; nothing implements it"

Both claims are false in the same two ways:

1. IGraphQLService does not exist anywhere in packages/**. It survives only in
   CHANGELOG history and packages/spec/llms.txt.

2. The route is not mounted at all, so it cannot return 501.
   packages/runtime/src/http-dispatcher.ts:2026 is the whole of it:

   // /graphql removed - GraphQL is not in the product plan (#2462 follow-on).
   

   There is no handleGraphQL in the runtime dispatcher; the only survivors are test
   doubles under packages/adapters/hono/src/__mocks__/runtime.ts and two Hono test
   files. packages/spec/src/system/core-services.zod.ts records that graphql was
   deleted as a CoreServiceName in discovery 的 workflow / graphql 槽位还声明着两条无人挂载的 route —— #4318 同款,但目前"上了膛没击发" #4451 (v17) precisely because it named "a /graphql
   surface the dispatcher had already removed".

A reader of the API module's landing page is told to register a contract that does not
exist, to reach a route that does not exist.

Two lower-severity residues, same family

• content/docs/getting-started/quick-reference.mdx:135 — "REST/GraphQL endpoints,
  real-time subscriptions, and discovery."
• content/docs/data-modeling/fields.mdx:319 — readonly description glosses the write
  path as "(REST/GraphQL/MCP/import, at the DataProtocol ingress)".

Generator territory, named but not filed here

content/docs/references/index.mdx:23 and :66 carry "REST/GraphQL contracts, endpoints,
routing, realtime, batch, discovery." Per #10563 and the #10616 exclusion list,
content/docs/references/** is generated — that string has to be fixed at the generator
(packages/spec/scripts/build-docs.ts and its inputs), not on the page.

Back-link: #10616, #10583

---

Generated by Claude Code

[os-zhuang]

Triage (finding concentration round): promoted to pm:queue · type Task. The api/index.mdx rows are a documented behaviour contract that is false twice over (a named contract that doesn't exist, a route that isn't mounted) on a module landing page — the sharpest kind of docs defect. Scope: the three non-generated sites named in the card. The content/docs/references/** residue is generator territory (packages/spec/scripts/build-docs.ts) — the dev should file that as a separate domain:spec follow-up card per the out-of-scope-findings protocol, not widen this PR. S, mode:subagent, sonnet; Clause-②: no.

---

Generated by Claude Code