docs(api): daily audit 2026-09-09 — add Explore query + Prometheus label values, fix catalog counts

[flashduty]

What this is

Daily api-review run (--mode generate --scope all --auto) for 2026-09-09, against fc-pgy@02df4651 and flashduty-docs@5270c08.

Registry vs spec delta

• public registry rows (auth == "all", path not /event/push/*, module not hidden): 347
• committed spec operations before this PR: 339
• only one module diverged: Monitors

Module	Added	Updated	Removed
Monitors	2	0	0
On-call	0	0	0
Platform	0	0	0
RUM	0	0	0
AI SRE	0	0	0

Added operations

Both rows became app_key-callable in fc-pgy commit 7105f01c (merged as PR #951 on 2026-09-08), which flipped exactly these two entries from jwt to all so the query assistant can call them server-side with the caller's app_key:

1. POST /monit/query/explore — monit-read-query-explore, tag Monitors/Diagnostics.
   Handler monit-webapi/router/router_explore.go:215 (exploreQuery) → exploreprotocol.DecodeHTTPQuery + ExploreLogic.Query; the {request_id, data} envelope is written by writeExploreSuccess. Request/response shapes come from monit-webapi/pkg/exploreprotocol/dto.go and validate.go; examples follow pkg/exploreprotocol/testdata/explore_result_contract_golden.json.
2. GET /monit/prometheus/api/v1/label/{label_name}/values — monit-prometheus-read-label-values, tag Monitors/Data sources.
   Handler monit-webapi/router/router.go:272 → router_prom.go:44 (promProxy).

Review attention: op 2 is not envelope-shaped

promProxy proxies the request to the selected data source and returns the data source's native Prometheus JSON (c.Data(output.StatusCode, output.ContentType, output.Body)), not the standard {request_id, data} envelope; it also requires an X-DSID header. It is documented truthfully (native response schema, X-DSID header parameter, text/plain failure note), but it is the first non-envelope operation in the Monitors specs. If the product decision is that this route should not be in the public reference, drop the second path plus its nav/catalog row — op 1 stands on its own.

Deliberately not re-added

Nine auth=all registry rows are absent from the specs. Seven of them were removed from the docs on 2026-09-08 by f1790df and are retired on the backend — monit-webapi/router/router_explore_test.go:361 (TestRetiredRoutesReturnNotFound) asserts they return 404:

• POST /monit/query/diagnose
• POST /monit/rule/counter/status
• POST /monit/store/ruleset/create|delete|info|list|update

They stay out; the stale registry rows are an upstream cleanup item for fc-pgy.

Unresolved

• POST /monit/rule/dstypes — present in the specs, removed from the registry by fc-pgy 6be0e3a (2026-09-06); still live in the DB. Carried from HEAD unchanged, not deleted (same handling as the 2026-09-07 run).
• mapping.yaml gaps — /status-page/* (registry provider status-page, mapping says statuspage), /calendar/* (registry pgy, mapping event), /route/*, /rum/data|field|resource/*, /monit/query/* have no scope entry. None produced drift today (every such path is already in the specs), but the audit had to assign modules by path segment to see that.

Examples

No dev-API capture was possible in this environment (no credential access), so all new request/response examples are constructed from the Go types and the explore protocol golden fixtures — realistic data source IDs, expressions, labels, and epoch timestamps, no "string" placeholders.

Validation

• python3 scripts/lint_openapi.py → OK: 12 spec files, no violations
• all four touched spec files parse; paths: monitors 27 (was 25), consolidated 341 (was 339)
• EN/ZH structural parity verified for the 2 new operations and all 10 new schemas (only tags and human text differ)
• spec diff is a pure addition: 588 lines per file, 0 deletions, no key reordering
• coverage check: every spec path present in docs.json and both api-catalog.mdx; every accordion count matches its row count (193 / 27 / 41 / 53 / 27 = 341)
• mint broken-links could not be run — no Node/Mintlify CLI in this environment

Adjacent drift not touched (outside api-review scope)

• {en,zh}/openapi/api-catalog.mdx keeps an empty ### Monitor utilities section (the Monitors/Monitor utilities tag has 0 operations).
• {en,zh}/developer/cli.mdx still say "340 API operations / 337 generated commands" and {en,zh}/developer/overview.mdx "340 API operations across 38 services" — these track generator output, which this run cannot compute.

Process note

The team knowledge pack still lacks runbooks/api-review-daily.md and runbooks/api-review-apply-patches.py, which this automation references. The skill's generate_openapi.py carries no baseline-fidelity/key-order patch, so this run did not perform a full regeneration: it rebuilt strictly from git show HEAD: and appended only the delta, keeping the baseline byte-identical outside the additions.