docs(spec): re-measure the sys_api_key batch-conformance claims at the current objectui pin and promote the citation to the asserting spelling

[qq9340100]

Fixes#10435

What

packages/spec/src/data/api-methods-batch-conformance.test.ts justified the SINGLE_RECORD_WRITE_ONLY entry for sys_api_key with a present-tense claim ("both read off the console build this release pins") while citing .objectui-sha6314e87f2 — but .objectui-sha is 9a3daf8d37ad973a621e5edd276fe32467f90684, so the sentence asserted a current-pin identity against a tree the release does not build.

Per the triage scope: re-measured all three claims at the current pin 9a3daf8d3 (objectui packages/plugin-grid, read via git -C ../objectui show at the full pinned sha, path by path — never the checkout's HEAD) plus the framework-side facts about sys_api_key at this branch's tree. All three hold. The citation is updated to the current pin and promoted to the ASSERTING spelling (`.objectui-sha` = `9a3daf8d3`), so check:objectui-pin-citations (lands with PR #10439) re-checks this site on every future pin bump. The old sha is kept in the parenthetical as a dated provenance note.

Measurement table (claim → verdict at pin 9a3daf8d3)

#	Claim (as written at 6314e87f2)	Measured at 9a3daf8d3	Verdict
1	No checkbox column; none of the object's four list views declares bulkActions / bulkActionDefs / selection; ObjectGrid auto-enables multi-select only when a bulk action exists	sys_api_key declares exactly four list views — mine, active, revoked, all_keys (packages/platform-objects/src/identity/sys-api-key.object.ts:114-159, this branch) — none carries bulkActions/bulkActionDefs/selection. ObjectGrid.tsx:2388-2397 (at pin): selectionMode defaults false; set from schema.selection?.type, legacy schema.selectable, else if (hasBulkActions) selectionMode = 'multiple' — the only auto-enable path	HOLDS
2	The single implicit bulk action is bulk-delete, gated on the resolved delete affordance — false three times over for sys_api_key	ObjectGrid.tsx:2384-2386 (at pin): implicit ['delete'] only when canDelete && onBulkDelete && bulkActionDefs.length === 0. rowCrudAffordances.ts:158-170 (at pin) resolves canDelete from the ADR-0103 managedBy bucket ∧ userActions ∧ the server's effective operation set ∧ the principal's allowDelete. sys_api_key (this branch): managedBy: 'better-auth' (L22, bucket denies delete by default), userActions: { edit: true } (L38, edit alone), apiMethods: ['get', 'list', 'update'] (L364, no delete) — false three times over, as written	HOLDS
3	A multi-select revoke would not reach /batch: both actions are locations: ['list_item']; naming one in bulkActions promotes it to operation: 'custom' + actionDef, which useBulkExecutor fans out per record through the action runner; the data-plane bulk primitive is reached only by an update/delete bulk def	revoke_api_key/restore_api_key are both locations: ['list_item'] (object file L88/L103, this branch). resolveBulkActions.ts:139-152 (at pin): a promoted def carries operation: 'custom' + actionDef and "is NOT a data-plane mass update". useBulkExecutor.ts (at pin): custom defs dispatch per record through the action runner (L88-99); the bulk primitives are reached only via def.operation === 'update' → bulkUpdate (L284) or 'delete' → bulkDelete (L287)	HOLDS

Since no selection surface exists at the current pin, the SINGLE_RECORD_WRITE_ONLY entry stands unchanged and the FORK branch of the card (conformance-rule question) was not reached.

Gate-spelling note

The promoted citation matches the ASSERTING regex of check:objectui-pin-citations as it exists on the #10274 branch (PR #10439): ran that script ad hoc against this tree — this site classifies asserting 9a3daf8d3 current (green); the script's remaining failures are the four sites PR #10439 itself fixes on its own branch, plus component.test.ts:1949/expression-bindable-text-keys.zod.ts:49 spellings that branch also carries fixes for. The script copy was removed before commit — this PR deliberately does not carry the gate; it lands with #10439. If #10439 lands first, this line is exactly the spelling its gate then checks; the textual conflict on L64 (its branch spells the OLD sha in the historical form) resolves in favor of this PR's re-measured asserting form.

Scope

One file, comment-only (citation + provenance sentence). No runtime, schema, or assertion changes — the test's four assertions are untouched. Tests/prose-only → skip-changeset (same rationale as #10439).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.