[flashduty]

Window

2026-11-05T08:02:00Z → 2026-11-09T09:06Z. The 11-05 run ended with zero drift; the 11-06 run produced no PR (its runner dropped), so this window starts at the 11-05 end point and covers everything after it.

Method: per repo git log --since=<window start> origin/main, non-merge commits diffed one by one (git diff <c>^1 <c>, merge commits excluded so large fc-event merges do not inject phantom hunks), scanning ^[+-][^+-].*(json:"|binding:), then filtered to the public surface (Auth == "all", not /event/push/, module not hidden). Because several long-lived branches (feat/license-2027, feat/session-data-masking, codex/blueking-itsm) were merged into main inside this window while their commits were authored earlier, each repo was additionally checked with a whole-window net tree diff (<base>..origin/main -- '*.go'); the drifts below come from that second pass.

Changes

rum (2 files + consolidated, en/zh)

• updated: RumApplicationItem gains active_devices_enabled (boolean, required).
  Evidence: fc-rum/types/application.go — ActiveDevicesEnabled bool \json:"active_devices_enabled"`, fed by logic/transfer.gofromconfig.ActiveDevicesEnabled(row.AccountID) (deploy.active_devices_accounts). Commit d1c91659, 2026-11-08, in window. Boolean without omitempty, so it is always on the wire → listed in required. Examples for POST /rum/application/{info,infos,list}` updated to match.

on-call (2 files + consolidated, en/zh)

• updated: POST /oncall/license/list — LicenseListResponse gains license_cnt, used_cnt, window_start, window_end, rule_effective, rule_effective_at, auto_grab_disabled, transferred_at; LicensePersonItem gains status (fixed/active/revoked), via (auto/admin/fixed/""), acquired_at.
  Evidence: fc-event/cmd/server/controller/license/info.go (licenseListOutput, and the item literal that fills Status/Via/AcquiredAt) and fc-event/structs/license.go (LicensePersonItem.Status/Via/AcquiredAt, LicenseStatusT). The provider commits were authored 2026-10-28 but reached main on 2026-11-09 (Merge pull request #3526 from flashcatcloud/feat/license-2027, b8368364c), i.e. inside the window; git merge-base --is-ancestor confirms the code was not on main at the window start, and git show <base>:cmd/server/controller/license/info.go shows the old payload (total/items only).
  Window semantics read from fc-event/logic/resource/usage.go (LicenseWindow, licenseWindowStart, 30-day PeriodToDays) and structs/license.go (LicenseRuleLaunchAt = 2026-11-09 00:00 +08:00, LicenseRuleOldAccountAt = 2027-01-01 00:00 +08:00).
• added/removed operations: none.

Constructed examples

The dev API was not reachable from the run environment, so the /oncall/license/list 200 example was constructed from the handler's output struct and the Redis-backed window model (30-day window, license_cnt 6, used_cnt 3, one fixed seat, one auto-grabbed seat, one revoked seat). The RUM application examples already existed; only active_devices_enabled: true was added to them. Nothing in this PR was captured from a live call.

Not changed, and why

• structs.IncidentAction.Byline (fc-event e8b42fd1, in window): internal engine payload (TriggerAction → notify/blueking/jira handlers). It is not in any public response and not in the registry. The public byline is structs.FeedItem.Byline (authored 2026-11-03, pre-window) and is already handled by docs(api-reference): daily api-review 2026-11-04 — timeline byline, escalate layers minItems, RUM session summary flag, session credits fields #1164.
• preference.updateInput.EmailFromByline / structs.PreferenceItem.EmailFromByline (fc-event 68c9fb41, in window): /preference/info and /preference/update are registry rows with Auth: "jwt" → not app-key-callable. No public surface.
• GET /deploy/products + enabled_products (fc-pgy a9f56091, in window): registry row deploy:read:products is Auth: "none" — anonymous, not app_key-callable, so outside the public surface per the scope filter.
• fc-pgy /person/app-key/* MaxKeys field and removal of the Password fields on the account/member structs: all /person/app-key/* rows are Auth: "jwt"; the removed password fields never appeared in any public response (the only password in the specs is the MemberResetInfoUpdates request field).
• fc-event /oncall/license/{transfer,setting/update} and the whole /-/license/*, /incident/blueking/ticket/*, /datasource/blueking/*, /monit/*/export, /safari/skill/download row sets: Auth: "jwt"/"service" — internal.
• fc-datasource BlueKing ITSM plugin settings, plug_im ambient_reply_enabled: integration settings is modelled as a free-form object (additionalProperties: true) in the specs, so per-key additions need no schema change.
• Registry rows that flipped IsAudit: false → true on six public export/download operations (/insight/*/export, /enrichment/mapping/data/download, /safari/session/export, /status-page/subscriber/export): the API reference does not document the audit flag anywhere today, so this stays out rather than introducing a one-off convention.
• DataSourceItem.last_source_time (fc-datasource, net window): already present in the on-call split and consolidated files.
• fc-statuspage, fc-oncall, monit-webapi, monit-edge, go-pkg: no public field/constraint change in the window (net diff of json:/binding: lines is empty for the public handlers; the monit-webapi and fc-datasource matches are test fixtures and migration commands).

Unresolved / open (not written into the specs)

1. POST /change/info — registry row Auth: "all", but fc-event main registers only change/list (cmd/server/routes.go:336-338) and cmd/server/controller/change/info.go defines only List. Still unresolved.
2. POST /channel/incident/daily-counts — no handler on fc-event main (grep daily-counts empty). Still unresolved.
3. POST /safari/session/masking/{settings/get,settings/update,preview,summary,add_terms,resolve_display} and SessionItem.masking_enabled — handlers exist on fc-safari main (cmd/api/sessions/masking.go) and the rows are Auth: "all", but the feature is config-gated: fc-safari/etc/masking.yml ships enabled: false with "deliberately disabled unless an operator enables it", so the surface is not reachable until an operator turns it on. Registered 2026-11-03 (pre-window) and left out by the 11-04/11-05 rounds too — flagged here rather than silently skipped. A human should decide whether to document it ahead of GA.
4. GET /monit/prometheus/api/v1/label/:label_name/values — the only registry/spec path difference left is gin :param vs spec {param} notation; the operation is documented.

Registry vs spec cross-check

• 1262 registry rows parsed (400 with Auth == "all", /event/push/* excluded); with the mapping from claude-plugins-flashduty#101 applied: 0 orphans, 0 provider rejects. Note: docs(ai-sre): drop deprecated session/cancel from the public API #101 is still open, so the catalog copy of mapping.yaml is stale in both directions — it lacks the monitors/diagnostics, monitors/dashboard, rum/data, rum/dashboard, rum/resource, /rum/field entries that are already on that repo's main, and lacks docs(ai-sre): drop deprecated session/cancel from the public API #101's /integration, /route, status-page, on-call/license fixes. Registry→spec diff after that mapping: 9 rows absent from the specs, all accounted for in "Unresolved" above.
• No new public path appeared in the window (every added registry row is jwt/service/none/integration), so docs.json and both api-catalog.mdx are untouched. Verified: all 392 operations are present in the docs.json nav and in both catalogs.

Split vs consolidated

Deep compare (key order ignored) across the five splits and both consolidated files, before and after these edits: the only differences are the two known hand-edits — DutyError.reason (consolidated-only, x-flashduty-preserve-absence) in on-call/platform/rum/safari × en/zh, and the safari components.responses example-label customs (BadRequest, Forbidden, plus consolidated-only NotFound). Left alone. ServiceUnavailable is consolidated-only in four modules but is defined in the monitors split where it is referenced — no dangling $ref.

Overlap with open PRs

• docs(api-reference): daily api-review 2026-11-04 — timeline byline, escalate layers minItems, RUM session summary flag, session credits fields #1164 (api-review/2026-11-04T081045Z, still open) edits FeedItem.byline, escalate-rule layers.minItems, RumApplicationItem.session_summary_enabled, and the safari session credit fields. Only RumApplicationItem is shared with this PR: docs(api-reference): daily api-review 2026-11-04 — timeline byline, escalate layers minItems, RUM session summary flag, session credits fields #1164 appends session_summary_enabled at the end of the property map / required list and at the end of each application example, while this PR inserts active_devices_enabled right after account_id in all three places. Different lines, so the merge should be clean; if docs(api-reference): daily api-review 2026-11-04 — timeline byline, escalate layers minItems, RUM session summary flag, session credits fields #1164 lands first, rebase this branch and re-run the linter (its example additions are what keeps required satisfied).
• docs(doc-review): daily review 2026-11-04 — RUM session AI summary, AI SRE session credits, per-rule new-alert limit, engine install addresses #1165 (doc-review), docs(rum): HarmonyOS crash thread dumps and memory at the fault #1153 (HarmonyOS), docs: 补充资源响应上下文场景并精简 Web SDK 高级配置 #1168 (RUM/SDK mdx): touch only .mdx, no api-reference/*.json conflict.

Verification (actual output)

$ python3 -c "json.load(...)"            # 13 spec files
json.load ok for 13 files
$ python3 scripts/lint_openapi.py
OK: 12 spec files, no violations          # exit 0
$ python3 scripts/api_path_redirects.py --check
                                          # exit 0
$ docs.json / api-catalog reachability
on-call|platform|monitors|rum|safari: paths not in docs.json nav: none; en/zh catalog missing: none
$ git diff --stat
 api-reference/on-call.openapi.en.json | 112 ++++++++++++++++++++++++++++++--
 api-reference/on-call.openapi.zh.json | 112 ++++++++++++++++++++++++++++++--
 api-reference/openapi.en.json         | 122 ++++++++++++++++++++++++++++++++--
 api-reference/openapi.zh.json         | 122 ++++++++++++++++++++++++++++++++--
 api-reference/rum.openapi.en.json     |  10 +++
 api-reference/rum.openapi.zh.json     |  10 +++
 6 files changed, 460 insertions(+), 28 deletions(-)