fix(skills): correct routing and examples in flashduty skill cards

- SKILL.md: the positional-argument rule was wrong for generated/raw
  commands, which accept the matching --flag as a first-class
  alternative (flag wins if both given); only a few curated verbs are
  positional-only.
- automation.md: fix a stale cron in the exact-cron example so it
  matches its own local-time semantics and name; add automation-rule-run
  as the way to fire a rule immediately outside its schedule.
- safari.md: surface automation-rule-run and the automation-rule-*
  passthrough family in the intent table, pointing back to
  automation.md as the primary router.
- monit.md: the folder-id-0 help-text trap on rule-list-basic also
  applies to rule-status; extend the gotcha to cover both. Add
  preview-sync to the intent table.
- monit-query.md: both example commands were missing the required
  --input-query flag; add gotchas for the 6h window cap, the
  supported ds-type enum, and the tunable defaults/caps.
- monit-agent.md: document the flat results[i].summary/results[i].data
  response shape and its omitted-not-null field semantics.

Author: ysyneu

skills/flashduty/SKILL.md

@@ -37,7 +37,7 @@ Append `--output-format toon` to read commands: it drops the per-row repeated ke
 
 The hot path: **read the domain card** (index below) for the exact verb + flags. Command groups are hyphenated (`status-page`, `alert-event`), not concatenated (`statuspage`) — guessing the wrong form costs a failed call. For a command outside the cards, derive it from its API path: **group = first path segment, verb = the rest joined by `-`** (`POST /status-page/change/create` → `fduty status-page change-create`), then confirm with `fduty <group> <verb> --help`. Pass nested-object / array fields as JSON via `--data '{...}'`; typed scalar flags override matching `--data` keys.
 
-**Positional arguments.** A card heading like `### change-create <page-id>` means that id is **positional** — pass it as the first bare argument (`change-create 5759… --type incident`), not as `--page-id`. A heading with no `<…>` takes all inputs as flags. Cards mark each positional with a `(positional, required)` row; trust the heading over your instinct to use a flag.
+**Positional arguments.** A card heading like `### change-create <page-id>` means that id can always be passed **positionally**, as the first bare argument (`change-create 5759… --type incident`). On generated/raw-passthrough commands the matching `--<field>` flag (e.g. `--page-id`) is an equally valid alternative — if both are given, the flag wins. A few curated commands (`incident detail`, `automation get`) are positional-only, with no matching flag at all. A heading with no `<…>` takes all inputs as flags. `--help` settles any doubt.
 
 ## fduty answers directly — don't grep or browse
 

skills/flashduty/reference/automation.md

@@ -18,6 +18,7 @@ Prereq: `SKILL.md` read. Automations create AI SRE sessions on a schedule or thr
 | list run history | `runs <rule-id>` |
 | list preset templates | `templates` |
 | test/fire an HTTP POST trigger | `fire <trigger-id>` |
+| run a rule immediately, outside its schedule | `safari automation-rule-run <rule-id>` (the friendly group has no run verb; `fire` is not a substitute — it needs a configured HTTP POST trigger + token) |
 
 ## Scope and visibility
 
@@ -74,7 +75,7 @@ fduty automation update <rule-id> --rotate-http-post-token --output-format toon
 ```bash
 fduty automation create \
   --name "Weekday 08:05 review" \
-  --cron-expr "5 0 * * 1-5" \
+  --cron-expr "5 8 * * 1-5" \
   --prompt "Review open incidents and alert noise before the workday." \
   --output-format toon
 ```

skills/flashduty/reference/monit-agent.md

@@ -43,6 +43,7 @@ Run up to 8 monit-agent tools concurrently on a target
 
 - **`catalog` → `invoke` is the order.** `catalog` returns each tool's `name` (+ `input_schema` for its params); `invoke` runs them. Tool names are target-specific — take them verbatim from the catalog, do not invent.
 - **`invoke` carries the tool list in `--data`**: `{"tools":[{"tool":"<name>","params":{…}}, … up to 8]}`. `params` defaults to `{}`. `--target-locator` (required) and `--target-kind` override matching `--data` keys.
+- **Read results at `results[i].summary` and `results[i].data`** — both sit directly on the result; webapi unwraps the agent envelope, so there is no `data.data`. Empty fields are omitted rather than sent as `null`: no `error` key on success, no `data`/`summary` on failure, and `truncated` only when the result really was truncated. Branch on key presence, not on `null`.
 
 ## Gotchas
 

skills/flashduty/reference/monit-query.md

@@ -22,7 +22,7 @@ fduty monit datasource-list --output-format toon
 fduty monit-query rows --ds-name <name> --ds-type <type> --expr "rate(http_requests_total[5m])"
 # 2b. or get pre-clustered RCA over a window
 fduty monit-query diagnose --ds-name <name> --ds-type <type> \
-  --operation log_patterns --time-start -1h --time-end now
+  --operation log_patterns --input-query '{app="my-app"} |= "error"' --time-start -1h --time-end now
 ```
 
 <!-- GENERATED:monit-query START · 由 fduty __dump-commands 同步 · 勿手改 fence 内 -->
@@ -61,10 +61,13 @@ Raw datasource passthrough (returns values/rows as the datasource itself would)
 - **A 5xx or HTML-body error is TRANSIENT** — retry the same call ≤3×. Do NOT fall back to SSH, `monit-agent`, or incident search on a transient datasource error.
 - `rows` has **no time flags** — putting `--time-start` on `rows` is wrong; embed the range in `--expr`.
 - Empty results = the query genuinely matched nothing in that window — report it, don't widen blindly.
+- **`diagnose` rejects windows wider than 6 hours outright.** `--time-start`/`--time-end` span is capped at 6h server-side; the default window is the last 15 minutes (`--time-start 15m`, `--time-end now`). Widen within the cap, don't retry past it.
+- **`--ds-type` on `diagnose` only accepts `prometheus`, `victorialogs`, `loki`, `mysql`.** `monit datasource-list` can return other types (e.g. `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`) — those are not supported here.
+- **Tunables and their caps**: `--max-logs` (default 10000, cap 50000), `--max-patterns` (default 20, cap 50), `--timeout-seconds` (default 25, cap 30).
 
 ## Worked example — log-pattern evidence in the last hour
 
 ```bash
 fduty monit-query diagnose --ds-name prod-loki --ds-type loki \
-  --operation log_patterns --time-start -1h --time-end now --output-format toon
+  --operation log_patterns --input-query '{app="payment"} |= "error"' --time-start -1h --time-end now --output-format toon
 ```

skills/flashduty/reference/monit.md

@@ -19,6 +19,7 @@ Prereq: `SKILL.md` read. **SKILL.md + this card = full competence on monitors 
 | count rules per top-level folder (subtree totals) | `rule-counter-status` |
 | full rule config | `rule-info` |
 | create / update a rule | `rule-create` / `rule-update` |
+| preview a query before saving it into a rule | `preview-sync` |
 | delete one or many rules | `rule-delete` / `rule-delete-batch` |
 | move rules to another folder | `rule-move` |
 | toggle enabled/channels in bulk | `rule-update-fields` |
@@ -387,7 +388,7 @@ Invoke target tools
 - **`tools-catalog` / `tools-invoke` `--target-locator` is required and not guessable.** If the user has not provided a host or IP, ask — do not invent one. Tool names in `invoke` must come from the `tools-catalog` response — never hallucinate them.
 - **`rule-delete-batch` and `datasource-delete` are irreversible.** Confirm IDs with `rule-list-basic` / `datasource-info` first.
 - **`rule-audit-detail --id` takes the audit record ID**, not the rule ID. Get audit record IDs from `rule-audits --id <rule-id>` first; passing the rule ID returns HTTP 400.
-- **`rule-list-basic` needs a REAL `--folder-id` and returns only that folder's *direct* rules.** `--folder-id 0` / omitting it 400s "Folder not found" — the generated `--folder-id` help below ("0 to list all accessible rules") is a known SDK/OpenAPI bug; ignore it. Enumerate by walking the tree (`rule-counter-status` → `rule-status` → `rule-list-basic`); past the server cap the counters 400 "too many rules" and full enumeration isn't possible from the CLI — report that limit, never substitute fired alerts (see the enumerate hot flow).
+- **`rule-list-basic` and `rule-status` both need a REAL `--folder-id`; neither accepts `0`.** `--folder-id 0` / omitting it 400s "Folder not found" on either verb — the generated `--folder-id` help text below ("0 to list all accessible rules" on `rule-list-basic`, "0 for all" on `rule-status`) is a known SDK/OpenAPI bug on both; ignore it. `rule-list-basic` returns only that folder's *direct* rules; `rule-status` returns trigger counts for that folder and its descendants. Enumerate by walking the tree (`rule-counter-status` → `rule-status` → `rule-list-basic`); past the server cap the counters 400 "too many rules" and full enumeration isn't possible from the CLI — report that limit, never substitute fired alerts (see the enumerate hot flow).
 
 ## Worked example — inspect a firing rule then batch-disable it
 

skills/flashduty/reference/safari.md

@@ -23,6 +23,8 @@ Prereq: `SKILL.md` read. This is the **AI-SRE platform self-management** group:
 | list / create / update an A2A agent | `a2a-agent-list` / `a2a-agent-create` / `a2a-agent-update` |
 | enable / disable / delete an A2A agent | `a2a-agent-enable` / `a2a-agent-disable` / `a2a-agent-delete` |
 | list / get / export / delete a session | `session-list` / `session-get` / `session-export` / `session-delete` |
+| run an Automation rule immediately, outside its schedule | `automation-rule-run <rule-id>` |
+| manage Automation rules directly (create/update/delete/list/runs/…) | `automation-rule-*` / `automation-run-list` / `automation-template-list` — see **`reference/automation.md`** for the primary router |
 
 ## Hot flow — install an MCP server