diff --git a/internal/cli/coverage_test.go b/internal/cli/coverage_test.go
index e225b56..192652e 100644
--- a/internal/cli/coverage_test.go
+++ b/internal/cli/coverage_test.go
@@ -24,6 +24,14 @@ var curatedOperationIDs = map[string]bool{
 	"automation-trigger-write-fire": true,
 }
 
+// retiredOperationIDs bridges the release window where the server-side route
+// is gone but the CLI still compiles against the previous released SDK spec.
+var retiredOperationIDs = map[string]bool{
+	"monit-preview-sync":      true,
+	"monit-read-query-rows":   true,
+	"monit-rule-write-status": true,
+}
+
 // loadSpecOps reads every public GET/POST operation from the openapi spec
 // shipped in the linked go-flashduty module — the same spec cligen generates
 // against — recording each op's id, path, and whether its 200 response is a
@@ -80,6 +88,9 @@ func loadSpecPaths(t *testing.T) map[string]string {
 	t.Helper()
 	ids := map[string]string{}
 	for _, op := range loadSpecOps(t) {
+		if retiredOperationIDs[op.id] {
+			continue
+		}
 		ids[op.id] = op.path
 	}
 	return ids
@@ -158,6 +169,9 @@ func TestGeneratorTargetsFullSpec(t *testing.T) {
 	curated := map[string]bool{}
 	wantGenerated := map[string]bool{}
 	for _, op := range ops {
+		if retiredOperationIDs[op.id] {
+			continue
+		}
 		if op.streaming {
 			streaming[op.id] = true
 			continue
diff --git a/internal/cli/monit_query.go b/internal/cli/monit_query.go
index db70eb2..bc2d78f 100644
--- a/internal/cli/monit_query.go
+++ b/internal/cli/monit_query.go
@@ -1,7 +1,6 @@
 package cli
 
 import (
-	"encoding/json"
 	"fmt"
 	"strconv"
 
@@ -15,7 +14,6 @@ func newMonitQueryCmd() *cobra.Command {
 	cmd := newGroupCmd("monit-query", "Probe monit-backed datasources (9 types via data; diagnose: loki|victorialogs log patterns, prometheus metric trends)")
 	cmd.AddCommand(newMonitQueryDiagnoseCmd())
 	cmd.AddCommand(newMonitQueryDataCmd())
-	cmd.AddCommand(newMonitQueryRowsCmd())
 	return cmd
 }
 
@@ -135,74 +133,8 @@ func newMonitQueryDataCmd() *cobra.Command {
 	return cmd
 }
 
-func newMonitQueryRowsCmd() *cobra.Command {
-	var (
-		dsType, dsName, expr string
-		argsKV               []string
-	)
-
-	cmd := &cobra.Command{
-		Use:        "rows",
-		Short:      "Raw datasource passthrough (returns values/rows as the datasource itself would). Deprecated — prefer 'monit-query data'",
-		Deprecated: "use 'monit-query data' instead",
-		Long:       curatedLong("Deprecated. Raw datasource passthrough returning values/rows as the datasource itself would. Migrate to 'monit-query data', which preserves frames/records/samples without forcing results into legacy rows.", "Diagnostics", "QueryRows"),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if dsType == "" || dsName == "" || expr == "" {
-				return fmt.Errorf("--ds-type, --ds-name, --expr are required")
-			}
-			argsMap, err := parseKVSlice(argsKV)
-			if err != nil {
-				return fmt.Errorf("invalid --args: %w", err)
-			}
-			if err := normalizeRawTimeArgs(dsType, argsMap); err != nil {
-				return err
-			}
-
-			return runCommand(cmd, args, func(ctx *RunContext) error {
-				input := &flashduty.QueryRowsRequest{
-					DsType: dsType,
-					DsName: dsName,
-					Expr:   expr,
-					Args:   argsMap,
-				}
-				result, _, err := ctx.Client.Diagnostics.QueryRows(cmdContext(ctx.Cmd), input)
-				if err != nil {
-					return err
-				}
-				// This command is a raw datasource passthrough. The legacy SDK
-				// captured the response body (a JSON array of {fields,values}
-				// objects) as a RawMessage and wrote it through verbatim,
-				// independent of the --json/--toon output format. go-flashduty
-				// decodes that same array into []QueryRow, so re-marshal it to
-				// the equivalent JSON array and write it through unchanged to
-				// preserve the legacy single-blob output shape.
-				if result == nil {
-					_, err = fmt.Fprintln(ctx.Writer, "{}")
-					return err
-				}
-				body, err := json.Marshal(*result)
-				if err != nil {
-					return fmt.Errorf("failed to marshal query rows: %w", err)
-				}
-				_, err = fmt.Fprintln(ctx.Writer, string(body))
-				return err
-			})
-		},
-	}
-
-	cmd.Flags().StringVar(&dsType, "ds-type", "", "Datasource type (required)")
-	cmd.Flags().StringVar(&dsName, "ds-name", "", "Datasource name (required)")
-	registerEnumFlag(cmd, "ds-type", "prometheus", "victorialogs", "loki", "mysql")
-	cmd.Flags().StringVar(&expr, "expr", "", "Query expression (required)")
-	cmd.Flags().StringSliceVar(&argsKV, "args", nil, "Arg entries KEY=VALUE (repeatable; values must be strings per monit-query contract). "+
-		"For loki/victorialogs raw mode, <ds-type>.start/<ds-type>.end accept a relative duration ('15m'), 'now', a date/RFC3339 timestamp, "+
-		"or a unix epoch in seconds or milliseconds — normalized to the form the datasource requires before sending")
-
-	return cmd
-}
-
 // normalizeRawTimeArgs rewrites the raw-mode time-window args of a
-// monit-query rows call (<ds-type>.start / <ds-type>.end) into the unix-
+// monit-query data call (<ds-type>.start / <ds-type>.end) into the unix-
 // seconds form the server requires, accepting any format timeutil.Parse
 // understands (RFC3339, date/datetime, relative duration, unix seconds or
 // milliseconds). Loki and VictoriaLogs are the only ds-types whose raw mode
diff --git a/internal/cli/monit_query_test.go b/internal/cli/monit_query_test.go
index e958d6e..7da20b8 100644
--- a/internal/cli/monit_query_test.go
+++ b/internal/cli/monit_query_test.go
@@ -22,15 +22,6 @@ func TestMonitQueryDiagnoseFlags(t *testing.T) {
 	}
 }
 
-func TestMonitQueryRowsFlags(t *testing.T) {
-	cmd := newMonitQueryRowsCmd()
-	for _, name := range []string{"ds-type", "ds-name", "expr", "args"} {
-		if cmd.Flags().Lookup(name) == nil {
-			t.Errorf("flag --%s missing", name)
-		}
-	}
-}
-
 func TestMonitQueryDataFlags(t *testing.T) {
 	cmd := newMonitQueryDataCmd()
 	for _, name := range []string{"ds-type", "ds-name", "expr", "args", "delay-seconds"} {
@@ -209,7 +200,7 @@ func TestMonitQueryDiagnoseInvalidTimeStart(t *testing.T) {
 	}
 }
 
-// --- monit-query rows -----------------------------------------------------
+// --- monit-query data -----------------------------------------------------
 
 func TestMonitQueryDataHappyPath(t *testing.T) {
 	saveAndResetGlobals(t)
@@ -309,96 +300,6 @@ func TestMonitQueryDataRequiredFlags(t *testing.T) {
 	}
 }
 
-func TestMonitQueryRowsHappyPath(t *testing.T) {
-	saveAndResetGlobals(t)
-	stub := newGFStub(t)
-	// rows is a raw datasource passthrough: the response envelope "data" is a
-	// JSON array of QueryRow ({fields,values}) objects, decoded into
-	// QueryRowsResponse ([]QueryRow) and re-marshalled verbatim to the writer.
-	stub.data = []any{
-		map[string]any{
-			"fields": map[string]any{"instance": "node-1"},
-			"values": map[string]any{"__value__": 1},
-		},
-	}
-
-	out, err := execCommand(
-		"monit-query", "rows",
-		"--ds-type", "prometheus",
-		"--ds-name", "prom-prod",
-		"--expr", "up",
-		"--args", "step=15s",
-		"--args", "tenant=acme",
-	)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if stub.lastPath != "/monit/query/rows" {
-		t.Fatalf("expected /monit/query/rows, got %q", stub.lastPath)
-	}
-	body := stub.lastBody
-	if body["ds_type"] != "prometheus" || body["ds_name"] != "prom-prod" || body["expr"] != "up" {
-		t.Errorf("unexpected rows input: %#v", body)
-	}
-	args, _ := body["args"].(map[string]any)
-	if args["step"] != "15s" || args["tenant"] != "acme" {
-		t.Errorf("expected args step=15s tenant=acme, got %#v", args)
-	}
-	// The rendered output is the re-marshalled row array (passthrough shape).
-	if !strings.Contains(out, "node-1") || !strings.Contains(out, "__value__") {
-		t.Errorf("expected rendered rows to carry the datasource payload, got:\n%s", out)
-	}
-}
-
-func TestMonitQueryRowsRequiredFlags(t *testing.T) {
-	cases := []struct {
-		name string
-		args []string
-	}{
-		{
-			name: "missing ds-type",
-			args: []string{
-				"monit-query", "rows",
-				"--ds-name", "prom-prod",
-				"--expr", "up",
-			},
-		},
-		{
-			name: "missing ds-name",
-			args: []string{
-				"monit-query", "rows",
-				"--ds-type", "prometheus",
-				"--expr", "up",
-			},
-		},
-		{
-			name: "missing expr",
-			args: []string{
-				"monit-query", "rows",
-				"--ds-type", "prometheus",
-				"--ds-name", "prom-prod",
-			},
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			saveAndResetGlobals(t)
-			stub := newGFStub(t)
-
-			_, err := execCommand(tc.args...)
-			if err == nil {
-				t.Fatal("expected required-flag error, got nil")
-			}
-			if !strings.Contains(err.Error(), "required") {
-				t.Errorf("expected error to mention 'required', got %q", err.Error())
-			}
-			if stub.requests != 0 {
-				t.Errorf("rows should not have been called: %d request(s)", stub.requests)
-			}
-		})
-	}
-}
-
 // --- normalizeRawTimeArgs --------------------------------------------------
 
 func TestNormalizeRawTimeArgsAcceptedFormats(t *testing.T) {
@@ -469,17 +370,17 @@ func TestNormalizeRawTimeArgsInvalidValue(t *testing.T) {
 	}
 }
 
-// TestMonitQueryRowsRawModeNormalizesRFC3339 is the regression test for the
+// TestMonitQueryDataRawModeNormalizesRFC3339 is the regression test for the
 // raw-vs-stats time format inconsistency: a raw-mode VictoriaLogs query given
 // RFC3339 --args timestamps must reach the server as the unix-seconds form
 // the raw query path requires.
-func TestMonitQueryRowsRawModeNormalizesRFC3339(t *testing.T) {
+func TestMonitQueryDataRawModeNormalizesRFC3339(t *testing.T) {
 	saveAndResetGlobals(t)
 	stub := newGFStub(t)
-	stub.data = []any{}
+	stub.data = map[string]any{"format": "query_result.v1", "result": map[string]any{"kind": "records", "records": []any{}}}
 
 	_, err := execCommand(
-		"monit-query", "rows",
+		"monit-query", "data",
 		"--ds-type", "victorialogs",
 		"--ds-name", "vl-prod",
 		"--expr", `{app="api"} |= "error"`,
@@ -534,25 +435,3 @@ func TestMonitQueryDataInvalidArgs(t *testing.T) {
 		t.Errorf("data should not have been called: %d request(s)", stub.requests)
 	}
 }
-
-func TestMonitQueryRowsInvalidArgs(t *testing.T) {
-	saveAndResetGlobals(t)
-	stub := newGFStub(t)
-
-	_, err := execCommand(
-		"monit-query", "rows",
-		"--ds-type", "prometheus",
-		"--ds-name", "prom-prod",
-		"--expr", "up",
-		"--args", "no-equals-sign",
-	)
-	if err == nil {
-		t.Fatal("expected error for malformed --args, got nil")
-	}
-	if !strings.Contains(err.Error(), "--args") {
-		t.Errorf("expected error to mention --args, got %q", err.Error())
-	}
-	if stub.requests != 0 {
-		t.Errorf("rows should not have been called: %d request(s)", stub.requests)
-	}
-}
diff --git a/internal/cli/zz_generated_alert_rules.go b/internal/cli/zz_generated_alert_rules.go
index 38ea836..9f7f723 100644
--- a/internal/cli/zz_generated_alert_rules.go
+++ b/internal/cli/zz_generated_alert_rules.go
@@ -1211,56 +1211,6 @@ Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '
 	return cmd
 }
 
-func genAlertRulesWriteStatusCmd() *cobra.Command {
-	var dataJSON string
-	var fFolderID int64
-	cmd := &cobra.Command{
-		Use:   "rule-status",
-		Short: "Get rule trigger status under folder",
-		Long: `Get rule trigger status under folder.
-
-Return the rule trigger summary for all rules under a folder node and its descendants.
-
-API: POST /monit/rule/status (monit-rule-write-status)
-
-Request fields:
-  --folder-id int — Folder ID to summarize. Obtainable via 'POST /monit/folder/list'. Trigger statistics are returned grouped by direct child folder.
-
-Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '.[]'', NOT '.items[]'):
-  - folder_id (integer) (required) — ID of the folder (grouping node).
-  - folder_name (string) — Folder name; omitted by some endpoints ('omitempty').
-  - rule_total (integer) (required) — Total rules in the folder family.
-  - triggered_rule_count (integer) (required) — Rules with active alerts.
-`,
-		Example: `  flashduty monit rule-status --data '{"folder_id":100}'`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return runCommand(cmd, args, func(ctx *RunContext) error {
-				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
-					if cmd.Flags().Changed("folder-id") {
-						body["folder_id"] = fFolderID
-					}
-					return nil
-				})
-				if err != nil {
-					return err
-				}
-				req := new(flashduty.RuleFolderIDRequest)
-				if err := genBindBody(body, req); err != nil {
-					return err
-				}
-				out, _, err := ctx.Client.AlertRules.WriteStatus(cmdContext(ctx.Cmd), req)
-				if err != nil {
-					return err
-				}
-				return printGenericResult(ctx, out)
-			})
-		},
-	}
-	cmd.Flags().Int64Var(&fFolderID, "folder-id", 0, "Folder ID to summarize. Obtainable via 'POST /monit/folder/list'. Trigger statistics are returned grouped by direct child folder.")
-	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
-	return cmd
-}
-
 func genAlertRulesWriteUpdateCmd() *cobra.Command {
 	var dataJSON string
 	var fAccountID int64
@@ -1582,6 +1532,5 @@ func registerGeneratedAlertRules(root *cobra.Command) {
 	genAddLeaf(gMonit, genAlertRulesWriteFieldsUpdateCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteImportCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteMoveCmd())
-	genAddLeaf(gMonit, genAlertRulesWriteStatusCmd())
 	genAddLeaf(gMonit, genAlertRulesWriteUpdateCmd())
 }
diff --git a/internal/cli/zz_generated_diagnostics.go b/internal/cli/zz_generated_diagnostics.go
index 339043c..c59626c 100644
--- a/internal/cli/zz_generated_diagnostics.go
+++ b/internal/cli/zz_generated_diagnostics.go
@@ -262,80 +262,6 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 	return cmd
 }
 
-func genDiagnosticsQueryRowsCmd() *cobra.Command {
-	var dataJSON string
-	var fAccountID int64
-	var fDelaySeconds int64
-	var fDsName string
-	var fDsType string
-	var fExpr string
-	cmd := &cobra.Command{
-		Use:        "query-rows",
-		Short:      "Query data source rows",
-		Deprecated: "use 'monit-query data' instead",
-		Long: `Query data source rows.
-
-Deprecated. Run a synchronous ad-hoc query and return the historical flattened rows shape. Existing consumers should migrate to '/monit/query/data', which preserves frames, records, and samples without forcing every result into legacy rows.
-
-API: POST /monit/query/rows (monit-read-query-rows)
-
-Request fields:
-  --account-id int — Optional consistency check. Must equal the authenticated account when supplied; mismatched values are rejected. Business execution always uses the authenticated account.
-  --delay-seconds int — Look-back offset in seconds applied to point-in-time queries (Prometheus, Loki stats, VictoriaLogs stats). Ignored for raw / detail queries.
-  --ds-name string (required) — Data source name; must match a configured data source under the tenant.
-  --ds-type string (required) — Data source type; must match a configured data source under the tenant. Examples: 'prometheus', 'loki', 'victorialogs', 'sls', 'elasticsearch', 'mysql', 'postgres', 'oracle', 'clickhouse'.
-  --expr string (required) — Query expression. Syntax depends on 'ds_type' and is interpreted by the corresponding monit-edge client (PromQL for Prometheus, LogQL for Loki, SQL for SQL sources, etc.).
-  args (object, via --data) — Polymorphic key/value extension parameters forwarded verbatim to monit-edge. All values must be strings, and keys are always namespaced by source (e.g. 'sls.project', 'loki.type'). Validation depends on 'ds_type': SLS requires 'sls.project' + 'sls.logstore'. Elasticsearch accepts 'es.type' of 'sql', or omitted — any other value is rejected. Loki and VictoriaLogs accept '<source>.type' of 'stats', 'raw', or omitted; 'raw' additionally requires a time range, either '<source>.start' + '<source>.end' or '<source>.timespan.value' + '<source>.timespan.unit' (unit one of 's', 'm', 'h', 'd'). Prometheus and the remaining SQL sources ignore 'args' entirely.
-
-Response fields ('data' is a TOP-LEVEL array of these row objects — pipe 'jq '.[]'', NOT '.items[]'):
-  - fields (object) — String-valued fields (labels, log fields, SQL columns).
-  - values (object) — Numeric fields. For metric queries the canonical key is '__value__'. May be 'null' for detail-oriented sources.
-`,
-		Example: `  flashduty monit query-rows --data '{"account_id":10001,"delay_seconds":30,"ds_name":"prod-prom","ds_type":"prometheus","expr":"up"}'`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return runCommand(cmd, args, func(ctx *RunContext) error {
-				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
-					if cmd.Flags().Changed("account-id") {
-						body["account_id"] = fAccountID
-					}
-					if cmd.Flags().Changed("delay-seconds") {
-						body["delay_seconds"] = fDelaySeconds
-					}
-					if cmd.Flags().Changed("ds-name") {
-						body["ds_name"] = fDsName
-					}
-					if cmd.Flags().Changed("ds-type") {
-						body["ds_type"] = fDsType
-					}
-					if cmd.Flags().Changed("expr") {
-						body["expr"] = fExpr
-					}
-					return nil
-				})
-				if err != nil {
-					return err
-				}
-				req := new(flashduty.QueryRowsRequest)
-				if err := genBindBody(body, req); err != nil {
-					return err
-				}
-				out, _, err := ctx.Client.Diagnostics.QueryRows(cmdContext(ctx.Cmd), req)
-				if err != nil {
-					return err
-				}
-				return printGenericResult(ctx, out)
-			})
-		},
-	}
-	cmd.Flags().Int64Var(&fAccountID, "account-id", 0, "Optional consistency check. Must equal the authenticated account when supplied; mismatched values are rejected. Business execution always uses the authenticated account.")
-	cmd.Flags().Int64Var(&fDelaySeconds, "delay-seconds", 0, "Look-back offset in seconds applied to point-in-time queries (Prometheus, Loki stats, VictoriaLogs stats). Ignored for raw / detail queries.")
-	cmd.Flags().StringVar(&fDsName, "ds-name", "", "Data source name; must match a configured data source under the tenant. (required)")
-	cmd.Flags().StringVar(&fDsType, "ds-type", "", "Data source type; must match a configured data source under the tenant. Examples: 'prometheus', 'loki', 'victorialogs', 'sls', 'elasticsearch', 'mysql', 'postgres', 'oracle', 'clickhouse'. (required)")
-	cmd.Flags().StringVar(&fExpr, "expr", "", "Query expression. Syntax depends on 'ds_type' and is interpreted by the corresponding monit-edge client (PromQL for Prometheus, LogQL for Loki, SQL for SQL sources, etc.). (required)")
-	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
-	return cmd
-}
-
 func genDiagnosticsTargetsListCmd() *cobra.Command {
 	var dataJSON string
 	var fAccountID int64
@@ -562,7 +488,6 @@ func registerGeneratedDiagnostics(root *cobra.Command) {
 	gMonit := genGroup(root, "monit", "Monitors API")
 	genAddLeaf(gMonit, genDiagnosticsQueryDataCmd())
 	genAddLeaf(gMonit, genDiagnosticsQueryDiagnoseCmd())
-	genAddLeaf(gMonit, genDiagnosticsQueryRowsCmd())
 	genAddLeaf(gMonit, genDiagnosticsTargetsListCmd())
 	genAddLeaf(gMonit, genDiagnosticsToolsCatalogCmd())
 	genAddLeaf(gMonit, genDiagnosticsToolsInvokeCmd())
diff --git a/internal/cli/zz_generated_manifest.go b/internal/cli/zz_generated_manifest.go
index 6c7f026..f3a0a08 100644
--- a/internal/cli/zz_generated_manifest.go
+++ b/internal/cli/zz_generated_manifest.go
@@ -181,10 +181,8 @@ var generatedOpIDs = []string{
 	"monit-datasource-write-create",
 	"monit-datasource-write-delete",
 	"monit-datasource-write-update",
-	"monit-preview-sync",
 	"monit-read-query-data",
 	"monit-read-query-diagnose",
-	"monit-read-query-rows",
 	"monit-read-targets-list",
 	"monit-read-tools-catalog",
 	"monit-read-tools-invoke",
@@ -204,7 +202,6 @@ var generatedOpIDs = []string{
 	"monit-rule-write-fields-update",
 	"monit-rule-write-import",
 	"monit-rule-write-move",
-	"monit-rule-write-status",
 	"monit-rule-write-update",
 	"monit-servicemap-read-fleet",
 	"monit-servicemap-read-fleet-summary",
diff --git a/internal/cli/zz_generated_monitor_utilities.go b/internal/cli/zz_generated_monitor_utilities.go
deleted file mode 100644
index 1208054..0000000
--- a/internal/cli/zz_generated_monitor_utilities.go
+++ /dev/null
@@ -1,81 +0,0 @@
-// Code generated by internal/cmd/cligen; DO NOT EDIT.
-
-package cli
-
-import (
-	"github.com/spf13/cobra"
-
-	flashduty "github.com/flashcatcloud/go-flashduty"
-)
-
-func genMonitorUtilitiesSyncCmd() *cobra.Command {
-	var dataJSON string
-	var fDelaySeconds int64
-	var fDsName string
-	var fDsType string
-	var fExpr string
-	cmd := &cobra.Command{
-		Use:   "preview-sync",
-		Short: "Preview datasource query",
-		Long: `Preview datasource query.
-
-Execute a synchronous datasource query and return the raw result. Used to preview alert rule expressions before saving.
-
-API: POST /monit/preview/sync (monit-preview-sync)
-
-Request fields:
-  --delay-seconds int — Shift the query window backward by this many seconds to compensate for data ingestion latency.
-  --ds-name string (required) — Datasource display name as configured in the account.
-  --ds-type string (required) — Datasource type, e.g. 'prometheus', 'loki', 'elasticsearch'.
-  --expr string (required) — Query expression. Format depends on 'ds_type' (PromQL for Prometheus, LogQL for Loki, etc.).
-  args (object, via --data) — Additional datasource-type-specific query arguments (string keys and values), e.g. 'sls.project' and 'sls.logstore' for SLS, 'es.type' for Elasticsearch, 'loki.type' and 'loki.limit' for Loki.
-`,
-		Example: `  flashduty monit preview-sync --data '{"delay_seconds":0,"ds_name":"Prometheus Prod","ds_type":"prometheus","expr":"rate(http_requests_total[5m])"}'`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return runCommand(cmd, args, func(ctx *RunContext) error {
-				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
-					if cmd.Flags().Changed("delay-seconds") {
-						body["delay_seconds"] = fDelaySeconds
-					}
-					if cmd.Flags().Changed("ds-name") {
-						body["ds_name"] = fDsName
-					}
-					if cmd.Flags().Changed("ds-type") {
-						body["ds_type"] = fDsType
-					}
-					if cmd.Flags().Changed("expr") {
-						body["expr"] = fExpr
-					}
-					return nil
-				})
-				if err != nil {
-					return err
-				}
-				req := new(flashduty.PreviewSyncRequest)
-				if err := genBindBody(body, req); err != nil {
-					return err
-				}
-				resp, err := ctx.Client.MonitorUtilities.Sync(cmdContext(ctx.Cmd), req)
-				if err != nil {
-					return err
-				}
-				if resp != nil && len(resp.Raw) > 0 {
-					return ctx.WriteRaw(resp.Raw)
-				}
-				ctx.WriteResult("OK: POST /monit/preview/sync")
-				return nil
-			})
-		},
-	}
-	cmd.Flags().Int64Var(&fDelaySeconds, "delay-seconds", 0, "Shift the query window backward by this many seconds to compensate for data ingestion latency.")
-	cmd.Flags().StringVar(&fDsName, "ds-name", "", "Datasource display name as configured in the account. (required)")
-	cmd.Flags().StringVar(&fDsType, "ds-type", "", "Datasource type, e.g. 'prometheus', 'loki', 'elasticsearch'. (required)")
-	cmd.Flags().StringVar(&fExpr, "expr", "", "Query expression. Format depends on 'ds_type' (PromQL for Prometheus, LogQL for Loki, etc.). (required)")
-	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
-	return cmd
-}
-
-func registerGeneratedMonitorUtilities(root *cobra.Command) {
-	gMonit := genGroup(root, "monit", "Monitors API")
-	genAddLeaf(gMonit, genMonitorUtilitiesSyncCmd())
-}
diff --git a/internal/cli/zz_generated_register.go b/internal/cli/zz_generated_register.go
index fc99dfb..f9e7ec3 100644
--- a/internal/cli/zz_generated_register.go
+++ b/internal/cli/zz_generated_register.go
@@ -16,7 +16,6 @@ func registerGenerated(root *cobra.Command) {
 	registerGeneratedAlertRules(root)
 	registerGeneratedDataSources(root)
 	registerGeneratedDiagnostics(root)
-	registerGeneratedMonitorUtilities(root)
 	registerGeneratedRuleSets(root)
 	registerGeneratedServiceMap(root)
 	registerGeneratedAlertEnrichment(root)
diff --git a/internal/cli/zz_generated_response_help.go b/internal/cli/zz_generated_response_help.go
index 67ed899..6e98cbd 100644
--- a/internal/cli/zz_generated_response_help.go
+++ b/internal/cli/zz_generated_response_help.go
@@ -35,7 +35,6 @@ var responseHelpBySDKMethod = map[string]string{
 	"AlertRules.WriteFieldsUpdate":              "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
 	"AlertRules.WriteImport":                    "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
 	"AlertRules.WriteMove":                      "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
-	"AlertRules.WriteStatus":                    "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - folder_id (integer) (required) — ID of the folder (grouping node).\n  - folder_name (string) — Folder name; omitted by some endpoints (`omitempty`).\n  - rule_total (integer) (required) — Total rules in the folder family.\n  - triggered_rule_count (integer) (required) — Rules with active alerts.\n",
 	"AlertRules.WriteUpdate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID. Filled by the server from the authenticated identity; do not provide.\n  - annotations (object) — Annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Channel IDs to send alerts to.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds. Generated by the server; do not provide.\n  - creator_id (integer) — Creator user ID. Filled by the server from the current user; do not provide.\n  - creator_name (string) — Creator name. Filled by the server; do not provide.\n  - cron_pattern (string) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval descriptor. Must not start with `CRON_TZ=` or `TZ=`; use the `timezone` field instead.\n  - debug_log_enabled (boolean) — Whether to enable debug logging; the edge emits detailed evaluation logs, useful for troubleshooting rules that do not trigger as expected.\n  - delay_seconds (integer) — Seconds to shift the evaluation query window backward, compensating for data ingestion latency.\n  - description (string) — Rule description, in Markdown.\n  - description_type (string) — Format for the description. Defaults to `text` when omitted or empty. `text` = plain text; `markdown` = Markdown, rendered as Markdown in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource IDs, merged with `ds_list` to decide which datasources the rule monitors; IDs survive datasource renames. At least one of `ds_list` and `ds_ids` must be provided.\n  - ds_list (array<string>) — Data source name patterns (supports wildcards).\n  - ds_type (string) — Datasource type identifier; allowed values are listed by `POST /monit/rule/dstypes` (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) — Whether the rule is enabled. Updating to `false` makes the server clean up the rule's active alerts.\n  - enabled_times (array<object>) — Time windows when the rule is active. Defaults to all days from 00:00 to 23:59 when omitted or empty.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) — ID of the folder the rule belongs to. Obtainable via `POST /monit/folder/list`.\n  - id (integer) — Rule ID. Required for update; omit for create (assigned by the server).\n  - labels (object) — Custom labels.\n  - name (string) — Rule name. Must be unique within the same folder.\n  - repeat_interval (integer) — Notification repeat interval in seconds.\n  - repeat_total (integer) — Max number of repeat notifications.\n  - rule_configs (object) — Check configuration: query list plus trigger/recovery conditions. Structure see `RuleConfigs`.\n    - check_anydata (object) — Any-data check configuration. Fires when the query returns any data rows.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether any-data checking is enabled: any returned data row triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery condition for any-data check. If omitted or `mode` is empty, treated as `nodata`.\n        - args (object) — Datasource-specific options for the recovery query, same convention as `queries[].args`; required for Elasticsearch datasources when `mode` is `ql`.\n        - condition (string) — Recovery expression. Required when `mode` is `ql`.\n        - mode (string) — `nodata` = recover when the query returns no data; `ql` = recover when the `condition` expression evaluates to true. When `mode` is `ql`, only a single query (`name=A`) is permitted. [nodata, ql]\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - severity (string) — Severity of any-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration.\n      - alert_on_empty_result (boolean) — Whether to trigger an alert when every query returns an empty result.\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only effective when `alert_on_empty_result` is enabled. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - enabled (boolean) — Whether no-data checking is enabled: a previously-seen series that stops returning data triggers an alert.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - resolve_timeout (integer) — Auto-resolve after N seconds.\n      - severity (string) — Severity of no-data alert events; case-sensitive. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration.\n      - alerting_check_times (integer) — Number of consecutive evaluations that must satisfy the condition before alerting; minimum 1.\n      - critical (string) — Critical threshold expression referencing query results via `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; at least one severity must be configured.\n      - enabled (boolean) — Whether threshold checking is enabled.\n      - info (string) — Info threshold expression, same syntax as `critical`.\n      - push_recovery_event (boolean) — Whether to push a recovery event notification when the alert resolves.\n      - recovery (object) — Recovery evaluation configuration for threshold checks.\n        - condition (string) — Recovery condition expression; required when `mode` is `threshold` or `ql`, and must be empty for `invert`.\n        - mode (string) — Recovery mode: `invert` = resolve when the alert expression no longer holds (`condition` stays empty); `threshold` = resolve when the `condition` threshold expression holds; `ql` = resolve when the `condition` query expression evaluates true. [invert, threshold, ql]\n      - recovery_check_times (integer) — Number of consecutive evaluations that must satisfy the recovery condition before resolving; minimum 1.\n      - warning (string) — Warning threshold expression, same syntax as `critical`.\n    - queries (array<object>) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicate `expr`.\n      - args (object) — Datasource-specific query options keyed by the `<datasource>.<option>` convention (e.g. `es.type`, `tencent_cls.limit`); most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields that become alert event labels — identical label sets collapse into one alert; must not overlap `value_fields`; applies to table-shaped results (SQL/ES-style datasources).\n      - name (string) — Query identifier (letter, e.g. `A`). The name `R` is reserved and must not be used.\n      - value_fields (array<string>) — Numeric result fields used in threshold evaluation (referenced as `$A.<field>` in threshold expressions); required for threshold checks unless the datasource is `prometheus`/`loki`/`victorialogs`; field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results are attached to alert events as context. Each entry must have a unique `name` (not duplicating any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific options for the auxiliary query, same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Relate-query identifier.\n  - timezone (string) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); shortcuts and offsets such as `Local`, `UTC+8`, or `CST` are rejected. Treated as `Asia/Shanghai` if empty.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds. Generated by the server; do not provide.\n  - updater_id (integer) — Last updater user ID. Filled by the server; do not provide.\n  - updater_name (string) — Last updater name. Filled by the server; do not provide.\n",
 	"Alerts.EventReadList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event. [Critical, Warning, Info, Ok]\n  - event_status (string) — Status of this event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Alerts.ReadEventList":                      "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event. [Critical, Warning, Info, Ok]\n  - event_status (string) — Status of this event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
@@ -93,7 +92,6 @@ var responseHelpBySDKMethod = map[string]string{
 	"DataSources.WriteUpdate":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether the datasource is active.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (object) — Type-specific datasource configuration. Include only the block matching `type_ident`.\n    - clickhouse (object) — ClickHouse datasource configuration. TLS fields are inherited from TLSClientConfig.\n      - database (string) — Default database for authentication.\n      - dial_timeout_mills (integer) — Dial timeout in milliseconds.\n      - idle_conns (integer) — Maximum number of idle connections in the pool; `0` or omitted uses the default of 4.\n      - lifetime_seconds (integer) — Maximum connection lifetime in seconds; `0` or omitted uses the default of 600 (10 minutes).\n      - max_execution_seconds (integer) — Max query execution time in seconds.\n      - open_conns (integer) — Maximum number of open connections in the pool; `0` or omitted uses the default of 32.\n      - password (string) — ClickHouse authentication password.\n      - timeout_mills (integer) — Per-query timeout in milliseconds; `0` or omitted uses the default of 10000 (10 seconds).\n      - tls_ca (string) — PEM-encoded CA certificate used to verify the server certificate.\n      - tls_cert (string) — PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`.\n      - tls_enabled (boolean) — Whether TLS is enabled; when `false`, all `tls_*` fields are cleared before saving.\n      - tls_key (string) — PEM-encoded client private key; must be configured together with `tls_cert`.\n      - tls_max_version (string) — Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint.\n      - tls_min_version (string) — Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`.\n      - tls_server_name (string) — Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty.\n      - tls_skip_verify (boolean) — Whether to skip server certificate verification (insecure, for self-signed setups only).\n      - username (string) — ClickHouse authentication username.\n    - elasticsearch (object) — Elasticsearch datasource configuration.\n      - api_key (string) — Elastic Cloud API key. Only for `cloud` deployment.\n      - certificate_fingerprint (string) — SHA-256 fingerprint of the Elasticsearch CA certificate, used to verify the server chain (the recommended check for ES 8 default security).\n      - cloud_id (string) — Elastic Cloud deployment ID. Only for `cloud` deployment.\n      - deployment (string) — Deployment type. `cloud` uses Elastic Cloud; `self-managed` uses a self-hosted cluster. [cloud, self-managed]\n      - headers (array<string>) — Custom HTTP headers added to every request, each entry formatted as `Key: Value`.\n      - password (string) — Authentication password for self-managed clusters; ignored when `service_token` is set.\n      - service_token (string) — Service token; overrides username/password if set.\n      - timeout_mills (integer) — Per-query timeout in milliseconds; `0` or omitted uses the default of 10000 (10 seconds).\n      - tls_ca (string) — PEM-encoded CA certificate used to verify the Elasticsearch server certificate.\n      - username (string) — Username for `self-managed` deployment.\n    - loki (object) — Loki datasource configuration. TLS fields are inherited from TLSClientConfig.\n      - basic_auth_enabled (boolean) — Whether HTTP Basic Auth is enabled; when `false`, `basic_auth_username`/`basic_auth_password` are ignored.\n      - basic_auth_password (string) — Basic Auth password, effective when `basic_auth_enabled` is `true`.\n      - basic_auth_username (string) — Basic Auth username, effective when `basic_auth_enabled` is `true`.\n      - headers (array<string>) — Custom HTTP headers added to every request, each entry formatted as `Key: Value`; usable for tenancy headers such as `X-Scope-OrgID`.\n      - params (array<string>) — Custom query parameters appended to every request URL, each entry formatted as `key=value`.\n      - tls_ca (string) — PEM-encoded CA certificate used to verify the server certificate.\n      - tls_cert (string) — PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`.\n      - tls_key (string) — PEM-encoded client private key; must be configured together with `tls_cert`.\n      - tls_max_version (string) — Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint.\n      - tls_min_version (string) — Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`.\n      - tls_server_name (string) — Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty.\n      - tls_skip_verify (boolean) — Whether to skip server certificate verification (insecure, for self-signed setups only).\n    - mysql (object) — MySQL datasource configuration. TLS fields are inherited from TLSClientConfig.\n      - idle_conns (integer) — Maximum idle connections.\n      - lifetime_seconds (integer) — Connection maximum lifetime in seconds.\n      - open_conns (integer) — Maximum open connections.\n      - password (string) — MySQL authentication password.\n      - timeout_mills (integer) — Query timeout in milliseconds.\n      - tls_ca (string) — PEM-encoded CA certificate used to verify the server certificate; only allowed when `tls_mode` is `verify-full` (or empty legacy mode).\n      - tls_cert (string) — PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`.\n      - tls_key (string) — PEM-encoded client private key; must be configured together with `tls_cert`.\n      - tls_max_version (string) — Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint.\n      - tls_min_version (string) — Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`.\n      - tls_mode (string) — TLS mode for the MySQL connection. Empty keeps the legacy per-field TLS behavior. `disable` = no TLS (all `tls_*` fields are cleared on save); `require` = TLS without server certificate verification; `verify-full` = TLS with full server verification (CA chain and hostname). MySQL has no `verify-ca` — verifying the CA implies verifying the hostname. [disable, require, verify-full]\n      - tls_server_name (string) — Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty.\n      - tls_skip_verify (boolean) — Whether to skip server certificate verification; derived from `tls_mode` when set (`require` → `true`, `verify-full` → `false`) — only manually effective under legacy empty `tls_mode`.\n      - username (string) — MySQL authentication username.\n    - oracle (object) — Oracle datasource configuration.\n      - idle_conns (integer) — Maximum number of idle connections in the pool; `0` or omitted uses the default of 4.\n      - lifetime_seconds (integer) — Maximum connection lifetime in seconds; `0` or omitted uses the default of 600 (10 minutes).\n      - open_conns (integer) — Maximum number of open connections in the pool; `0` or omitted uses the default of 32.\n      - options (object) — Extra connection options as key-value pairs.\n      - password (string) — Oracle authentication password.\n      - timeout_mills (integer) — Per-query timeout in milliseconds; `0` or omitted uses the default of 10000 (10 seconds).\n      - username (string) — Oracle authentication username.\n    - postgres (object) — PostgreSQL datasource configuration.\n      - idle_conns (integer) — Maximum number of idle connections in the pool; `0` or omitted uses the default of 4.\n      - lifetime_seconds (integer) — Maximum connection lifetime in seconds; `0` or omitted uses the default of 600 (10 minutes).\n      - open_conns (integer) — Maximum number of open connections in the pool; `0` or omitted uses the default of 32.\n      - password (string) — PostgreSQL authentication password.\n      - ssl_mode (string) — SSL mode for the PostgreSQL connection. Empty keeps the legacy behavior inferred from `tls_ca`. `disable` = no TLS (all `tls_*` fields are cleared on save); `require` = TLS without server certificate verification (`tls_ca` not allowed); `verify-ca` = verify the server certificate CA chain but not the hostname; `verify-full` = verify both CA chain and hostname. [disable, require, verify-ca, verify-full]\n      - timeout_mills (integer) — Per-query timeout in milliseconds; `0` or omitted uses the default of 10000 (10 seconds).\n      - tls_ca (string) — PEM-encoded CA certificate used to verify the server certificate; used with `ssl_mode` `verify-ca`/`verify-full` and rejected under `require`.\n      - tls_cert (string) — PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`.\n      - tls_key (string) — PEM-encoded client private key; must be configured together with `tls_cert`.\n      - username (string) — PostgreSQL authentication username.\n    - prometheus (object) — Prometheus datasource configuration. TLS fields are inherited from TLSClientConfig.\n      - basic_auth_enabled (boolean) — Enable HTTP Basic Auth.\n      - basic_auth_password (string) — Basic auth password.\n      - basic_auth_username (string) — Basic auth username.\n      - headers (array<string>) — Custom HTTP headers in `Key: Value` format.\n      - params (array<string>) — Custom query parameters in `key=value` format.\n      - tls_ca (string) — PEM-encoded CA certificate used to verify the server certificate.\n      - tls_cert (string) — PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`.\n      - tls_key (string) — PEM-encoded client private key; must be configured together with `tls_cert`.\n      - tls_max_version (string) — Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint.\n      - tls_min_version (string) — Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`.\n      - tls_server_name (string) — Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty.\n      - tls_skip_verify (boolean) — Whether to skip server certificate verification (insecure, for self-signed setups only).\n    - sls (object) — Alibaba Cloud SLS datasource configuration.\n      - access_key_id (string) — Alibaba Cloud Access Key ID.\n      - access_key_secret (string) — Alibaba Cloud Access Key Secret.\n      - headers (array<string>) — Custom HTTP headers.\n    - victorialogs (object) — VictoriaLogs datasource configuration. TLS fields are inherited from TLSClientConfig.\n      - basic_auth_enabled (boolean) — Whether HTTP Basic Auth is enabled; when `false`, `basic_auth_username`/`basic_auth_password` are ignored.\n      - basic_auth_password (string) — Basic Auth password, effective when `basic_auth_enabled` is `true`.\n      - basic_auth_username (string) — Basic Auth username, effective when `basic_auth_enabled` is `true`.\n      - headers (array<string>) — Custom HTTP headers added to every request, each entry formatted as `Key: Value`; usable for tenancy headers such as `AccountID`/`ProjectID`.\n      - params (array<string>) — Custom query parameters appended to every request URL, each entry formatted as `key=value`.\n      - tls_ca (string) — PEM-encoded CA certificate used to verify the server certificate.\n      - tls_cert (string) — PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`.\n      - tls_key (string) — PEM-encoded client private key; must be configured together with `tls_cert`.\n      - tls_max_version (string) — Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint.\n      - tls_min_version (string) — Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`.\n      - tls_server_name (string) — Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty.\n      - tls_skip_verify (boolean) — Whether to skip server certificate verification (insecure, for self-signed setups only).\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `victorialogs`.\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Diagnostics.QueryData":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - format (string) (required) — Public result-contract version. It is independent of the internal monit-edge query protocol version. Fixed at `query_result.v1`, which defines the structure of the `result` field. [query_result.v1]\n  - result (object) (required) — Exactly one natural result shape, selected by `kind`.\n    - frames (array<object>) — Typed table or time-series frames. A response can contain more than one frame.\n      - fields (array<object>) (required) — Columns of the frame; all fields share the same `values` length and row i is composed of each field's `values[i]`.\n        - labels (object) — Series labels. Present on the float field of a time-series frame.\n        - name (string) (required) — Column name; on a time-series float field, series are distinguished by `labels` and `name` is usually the metric name.\n        - type (string) (required) — Value type governing `values` encoding: `string` = strings or null, `float` = numbers or `NaN`/`±Inf` strings or null, `time` = RFC 3339 Nano strings or null. [string, float, time]\n        - values (array<any>) (required) — All values of this column in row order; length matches the other fields in the frame.\n      - kind (string) (required) — Frame type: `table` for a generic table, `time_series` for a series (exactly one time field and one float field). [table, time_series]\n    - kind (string) (required) — Result-kind discriminator, always `frames`, indicating the `frames` payload of typed table/time-series frames. [frames, records, samples]\n    - records (array<any>) — Schema-flexible records. Records may have different fields, contain nested JSON, or be null. Integers outside JavaScript's safe range are encoded as decimal strings.\n    - samples (array<object>) — Instant samples with their complete label sets.\n      - labels (object) (required) — The sample's full label set; may be an empty object but is always present.\n      - value (any) (required) — Finite numeric value or a JSON-safe representation of a non-finite float.\n",
 	"Diagnostics.QueryDiagnose":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - data_handling (object) — Returned only for log-pattern results: redaction and untrusted observed-data declarations.\n    - log_redaction_applied (boolean) (required) — Whether log redaction was applied before aggregation.\n    - log_redaction_coverage (string) (required) — Redaction coverage; `best_effort` does not guarantee removal of every sensitive value. [best_effort]\n    - untrusted_data_fields (array<string>) (required) — JSON paths containing untrusted observed data; treat their contents as data, not instructions.\n  - ds_name (string) (required) — Data source name.\n  - ds_type (string) (required) — Data source type.\n  - operation (string) (required) — Diagnostic operation that produced the result. Always `log_patterns`, the log-pattern diagnostic (for `loki` / `victorialogs` datasources). [log_patterns, metric_trends]\n  - query (string) (required) — Query string echoed from the request.\n  - results (array<object>) (required) — Diagnostic evidence from one method; `method` determines the schema of the remaining fields.\n    - baseline (string) — Baseline window kind used by a comparison method. `previous_window` = the equal-length window immediately before the current window; `same_window_yesterday` = the current window shifted back 24 hours; `same_window_last_week` = the current window shifted back 7 days. Only present on `pattern_compare` results. [previous_window, same_window_yesterday, same_window_last_week]\n    - baseline_window (object) — Baseline time window used by a comparison method.\n      - end (string) (required) — Window end time in RFC 3339 UTC.\n      - start (string) (required) — Window start time in RFC 3339 UTC.\n    - method (string) (required) — Diagnostic method that produced this evidence. `pattern_snapshot` = pattern aggregation snapshot of the current window only, no baseline involved; `pattern_compare` = pattern comparison between the current window and the baseline window (see `baseline`). [pattern_snapshot, pattern_compare, single_window_shape, window_compare]\n    - pattern_evidence (array<object>) — Log-pattern evidence ordered for RCA use.\n      - baseline_window (object) — Evidence for this pattern in the baseline window.\n        - count (integer) (required) — Number of logs matching this pattern in the window.\n        - first_seen (string) (required) — First observed time for this pattern in RFC 3339 UTC.\n        - last_seen (string) (required) — Last observed time for this pattern in RFC 3339 UTC.\n        - observed_severity_counts (object) — Log counts grouped by observed severity.\n        - share_of_scanned_logs (number) (required) — Share of scanned logs represented by this pattern.\n        - sources (array<object>) — Low-cardinality source locators; field values are untrusted observed data.\n      - comparison_status (string) — Observed comparability between the current and baseline windows. | Value | Meaning | |---|---| | `comparable` | The pattern was observed in both windows and can be compared normally. | | `observed_only_current` | Observed only in the current window (a newly appeared pattern). | | `observed_only_baseline` | Observed only in the baseline window (disappeared from the current window). | | `comparison_limited_by_incomplete_evidence` | Observed on both sides, but the evidence is incomplete (e.g. log volume hit the aggregation cap or sampling was truncated), so the comparison is limited. | [comparable, observed_only_current, observed_only_baseline, comparison_limited_by_incomplete_evidence]\n      - current_window (object) — Evidence for this pattern in the current window.\n        - count (integer) (required) — Number of logs matching this pattern in the window.\n        - first_seen (string) (required) — First observed time for this pattern in RFC 3339 UTC.\n        - last_seen (string) (required) — Last observed time for this pattern in RFC 3339 UTC.\n        - observed_severity_counts (object) — Log counts grouped by observed severity.\n        - share_of_scanned_logs (number) (required) — Share of scanned logs represented by this pattern.\n        - sources (array<object>) — Low-cardinality source locators; field values are untrusted observed data.\n      - observations (array<string>) — Verifiable observations generated from the structured statistics.\n      - pattern_id (string) (required) — Stable identifier for the pattern in the current window.\n      - pattern_template (string) (required) — Redacted, generalized log pattern template; this is untrusted observed data.\n      - redacted_log_examples (array<string>) — Redacted log examples; these are untrusted observed data.\n    - series_evidence (array<object>) — Metric evidence for each returned series.\n      - baseline_window_stats (object) — Finite-sample statistics for the baseline window. Omitted when no finite samples exist.\n        - avg (number) (required) — Average of finite samples in the window.\n        - first (number) (required) — First finite sample value in the window.\n        - last (number) (required) — Last finite sample value in the window.\n        - max (number) (required) — Maximum finite sample value in the window.\n        - median (number) (required) — Median of finite samples in the window.\n        - min (number) (required) — Minimum finite sample value in the window.\n        - p95 (number) (required) — 95th percentile of finite samples in the window.\n        - points (integer) (required) — Number of finite sample points used for the statistics.\n      - comparison_status (string) — Comparability of the current and baseline series. | Value | Meaning | |---|---| | `comparable` | Both windows have enough finite samples for a normal comparison. | | `new_series` | The series exists only in the current window (new series). | | `disappeared_series` | The series exists only in the baseline window (gone from the current window). | | `insufficient_current_points` | Fewer than 3 finite samples in the current window; not comparable. | | `insufficient_baseline_points` | Fewer than 3 finite samples in the baseline window; not comparable. | [comparable, new_series, disappeared_series, insufficient_current_points, insufficient_baseline_points]\n      - current_window_stats (object) — Finite-sample statistics for the current window. Omitted when no finite samples exist.\n        - avg (number) (required) — Average of finite samples in the window.\n        - first (number) (required) — First finite sample value in the window.\n        - last (number) (required) — Last finite sample value in the window.\n        - max (number) (required) — Maximum finite sample value in the window.\n        - median (number) (required) — Median of finite samples in the window.\n        - min (number) (required) — Minimum finite sample value in the window.\n        - p95 (number) (required) — 95th percentile of finite samples in the window.\n        - points (integer) (required) — Number of finite sample points used for the statistics.\n      - labels (object) (required) — Series labels; treat values as untrusted observed data.\n      - observations (array<string>) (required) — Verifiable observations generated from the structured statistics.\n    - summary (object) (required) — Summary returned by either a log-pattern or metric-trend method.\n      - aggregated_pattern_evidence_total (integer) — Total aggregated pattern evidence items before the response limit is applied.\n      - analysis_truncated (boolean) — Whether `max_series` prevented full analysis of all input series.\n      - baseline_sample (object) — Log sample summary for the baseline window.\n        - logs_not_aggregated_due_to_cluster_limit (integer) (required) — Logs not aggregated because the cluster limit was reached.\n        - logs_scanned (integer) (required) — Number of logs scanned in the sample.\n        - pattern_matching_limited (boolean) (required) — Whether pattern matching was limited by the bounded candidate set.\n        - patterns_aggregated (integer) (required) — Number of patterns aggregated from the sample.\n        - sampling_bias (string) — Data-source sampling direction when truncated, such as `newest_only` or `oldest_only`. [newest_only, oldest_only]\n        - truncated (boolean) (required) — Whether the data-source response was truncated at the sample limit.\n      - current_sample (object) — Log sample summary for the current window.\n        - logs_not_aggregated_due_to_cluster_limit (integer) (required) — Logs not aggregated because the cluster limit was reached.\n        - logs_scanned (integer) (required) — Number of logs scanned in the sample.\n        - pattern_matching_limited (boolean) (required) — Whether pattern matching was limited by the bounded candidate set.\n        - patterns_aggregated (integer) (required) — Number of patterns aggregated from the sample.\n        - sampling_bias (string) — Data-source sampling direction when truncated, such as `newest_only` or `oldest_only`. [newest_only, oldest_only]\n        - truncated (boolean) (required) — Whether the data-source response was truncated at the sample limit.\n      - evidence_summary (string) (required) — Factual summary generated from coverage, selection, and return counts.\n      - pattern_evidence_returned (integer) — Number of pattern evidence items returned in this response.\n      - pattern_evidence_truncated_by_max_patterns (boolean) — Whether returned pattern evidence was truncated by `max_patterns`.\n      - patterns_aggregated_only_in_baseline_sample (integer) — Number of aggregated patterns observed only in the baseline sample. Omitted when sampling is incomplete.\n      - selected_series_total (integer) — Series matching internal selection rules before `topk` is applied.\n      - series_analyzed (integer) — Number of series analyzed after applying `max_series`.\n      - series_returned (integer) — Number of `series_evidence` items returned in this response.\n      - series_total (integer) — Total input series; for comparisons, the union of current and baseline label sets.\n    - warnings (array<string>) (required) — Non-fatal warnings produced during analysis.\n    - window (object) (required) — Current analysis window using RFC 3339 UTC timestamps.\n      - end (string) (required) — Window end time in RFC 3339 UTC.\n      - start (string) (required) — Window start time in RFC 3339 UTC.\n  - schema_version (string) (required) — Schema version of the edge diagnostic result. Fixed at `2`, identifying the response-structure version; bumped on incompatible structural changes. [2]\n  - window (object) (required) — Current analysis window using RFC 3339 UTC timestamps.\n    - end (string) (required) — Window end time in RFC 3339 UTC.\n    - start (string) (required) — Window start time in RFC 3339 UTC.\n",
-	"Diagnostics.QueryRows":                     "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - fields (object) — String-valued fields (labels, log fields, SQL columns).\n  - values (object) — Numeric fields. For metric queries the canonical key is `__value__`. May be `null` for detail-oriented sources.\n",
 	"Diagnostics.TargetsList":                   "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - agent_version (string) — Most recently observed Agent version.\n  - cluster_name (string) — Edge cluster name.\n  - edge_ipport (string) — Edge instance address (`ip:port`), surfaced for diagnostics.\n  - target_kind (string) — Target kind, e.g. `host`, `mysql`. Filtering by kind is not supported in v1.\n  - target_locator (string) — Target identifier; the list is sorted by this field ascending.\n  - updated_at (string) — Last route-projection upsert time, Unix seconds. Treat as 'most recently observed', not a live-online indicator. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Diagnostics.ToolsCatalog":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - error (object) — Request-level business error. Omitted on success. Returned with HTTP 200 — do not rely on the status code alone.\n    - code (string) — Request-level error code: `target_unavailable` target unreachable, `timeout` resolution timed out, `forward_failed` cross-instance forwarding failed, `invalid_tool_result` agent returned an invalid result, `ambiguous_target_kind` target kind not uniquely inferable. [target_unavailable, timeout, forward_failed, invalid_tool_result, ambiguous_target_kind]\n    - message (string) — Human-readable error detail.\n    - target_kinds (array<string>) — Returned for `ambiguous_target_kind`; lists the candidate kinds.\n  - target (object) — Resolved target. Omitted when `target_kind` was not supplied and the locator could not be uniquely inferred.\n    - kind (string) — Resolved target kind, e.g. `host` or `mysql`; matches the `target_kind` inferred from or given in the request.\n    - locator (string) — Echo of the target locator from the request.\n  - tools (array<object>) — Tool metadata advertised by the target's agent. Always present; an empty array when `error` is set.\n    - description (string) — Tool capability description for UI / AI-SRE consumption.\n    - input_schema (object) — JSON Schema for `tools[].params`.\n    - name (string) — Tool name; pass into `/monit/tools/invoke` as `tools[].tool`.\n    - target_kind (string) — Target kind this tool applies to.\n",
 	"Diagnostics.ToolsInvoke":                   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - error (object) — Request-level business error. Omitted on success. Returned with HTTP 200 — do not rely on the status code alone.\n    - code (string) — Request-level error code: `target_unavailable` target unreachable, `forward_failed` cross-instance forwarding failed, `ambiguous_target_kind` target kind not uniquely inferable. [target_unavailable, forward_failed, ambiguous_target_kind]\n    - message (string) — Human-readable error detail.\n    - target_kinds (array<string>) — Returned only when `code` is `ambiguous_target_kind`, listing the candidate target kinds matched by the locator; omitted otherwise.\n  - results (array<object>) — Per-tool results, aligned with the request `tools[]` order. Empty when a request-level `error` is present.\n    - data (object) — Tool business payload. Present only on success. Webapi already unwraps the monit-agent result envelope, so there is no nested `data.data`.\n    - error (object) — Per-tool failure. Present only on failure, and mutually exclusive with `data` / `summary` / `truncated`.\n      - code (string) — Common WebAPI codes: `timeout`, `target_unavailable`, `invalid_tool_result`, `internal`, `invalid_args`, `unsupported_syntax`, `path_not_found`, and `catalog_changed`. Agent-specific tool errors may also be returned unchanged.\n      - message (string) — Human-readable detail for this tool's failure; agent-side messages may be forwarded verbatim.\n    - params (object) — Request params echoed back by webapi. Normalized to `{}` when the request omitted them or sent null.\n    - summary (string) — Human/LLM-readable one-line distillation of the result. Present only when non-empty.\n    - tool (string) — Tool name, aligned one-to-one with the request `tools[]` order.\n    - tool_version (string) — Agent-executed tool version. Omitted when the failure occurred before the agent picked a version.\n    - truncated (object) — Present only when the result was actually truncated — the field's presence is the signal, so there is no redundant `truncated: true`.\n      - reason (string) — Why the result was truncated.\n  - target (object) — Resolved target. Omitted when `target_kind` was not supplied and the locator could not be uniquely inferred.\n    - kind (string) — Resolved target kind, e.g. `host` or `mysql`; matches the `target_kind` inferred from or given in the request.\n    - locator (string) — Echo of the target locator from the request.\n",
diff --git a/internal/cmd/cligen/main.go b/internal/cmd/cligen/main.go
index 61653bd..42489c0 100644
--- a/internal/cmd/cligen/main.go
+++ b/internal/cmd/cligen/main.go
@@ -26,6 +26,14 @@ import (
 
 const genHeader = "// Code generated by internal/cmd/cligen; DO NOT EDIT.\n\n"
 
+// retiredOperationIDs contains server-side operations that must disappear from
+// the CLI before the next released SDK/OpenAPI snapshot is available.
+var retiredOperationIDs = map[string]bool{
+	"monit-preview-sync":      true,
+	"monit-read-query-rows":   true,
+	"monit-rule-write-status": true,
+}
+
 func main() {
 	only := ""
 	for i, a := range os.Args[1:] {
@@ -187,6 +195,9 @@ func collectServices(paths, schemas map[string]any, sdk map[string]map[string]me
 				continue
 			}
 			o := asMap(raw)
+			if retiredOperationIDs[str(o, "operationId")] {
+				continue
+			}
 			tags := asSlice(o["tags"])
 			if len(tags) == 0 {
 				continue
@@ -987,9 +998,7 @@ var opAliases = map[string][]string{
 // opDeprecationMessages maps a spec-deprecated operationId to its cobra
 // deprecation message. Ops without an entry get a generic message when the
 // spec marks them deprecated.
-var opDeprecationMessages = map[string]string{
-	"monit-read-query-rows": "use 'monit-query data' instead",
-}
+var opDeprecationMessages = map[string]string{}
 
 // positional describes the positional argument a generated command exposes.
 type positional struct {
diff --git a/skills/flashduty/reference/monit-rule.md b/skills/flashduty/reference/monit-rule.md
index a1a80e1..cb5216c 100644
--- a/skills/flashduty/reference/monit-rule.md
+++ b/skills/flashduty/reference/monit-rule.md
@@ -19,26 +19,24 @@ Prereq: `SKILL.md` + `reference/monit.md` read. This is the largest Flashmonit s
 | delete one or many rules | `rule-delete` / `rule-delete-batch` |
 | move rules to another folder | `rule-move` |
 | toggle enabled/channels in bulk | `rule-update-fields` |
-| rule trigger status by folder | `rule-status` / `rule-counter-status` |
+| rule trigger status for top-level folders | `rule-counter-status` |
 | rule change history | `rule-audits` → detail via `rule-audit-detail` |
 | export / import rules (backup/migrate) | `rule-export` / `rule-import` |
 | what datasource types support rules | `rule-dstypes` |
 | per-channel / per-node / total counters | `rule-counter-channel` / `rule-counter-node` / `rule-counter-total` |
 
-## Hot flow — enumerate configured rules (and its hard limit)
+## Hot flow — inspect configured rules
 
-`rule-list-basic --folder-id <id>` lists only the rules **directly in that folder**, NOT its sub-folders; `--folder-id 0` or omitting it **400s "Folder not found"**. There is no "all rules" call, so enumeration means walking the folder tree:
+`rule-list-basic --folder-id <id>` lists only the rules **directly in that folder**, NOT its sub-folders; `--folder-id 0` or omitting it **400s "Folder not found"**. Start from the top-level summary:
 
 ```bash
 # 1. top-level folders, each with its whole-subtree rule_total
 fduty monit rule-counter-status --output-format toon
-# 2. descend a folder to its DIRECT child folders (recurse until a folder has no children)
-fduty monit rule-status --folder-id <folder-id> --output-format toon
-# 3. list the rules sitting directly in each folder you reach
+# 2. list rules sitting directly in a known folder
 fduty monit rule-list-basic --folder-id <node-id> --output-format toon
 ```
 
-**Hard limit — large accounts cannot be fully enumerated.** `rule-counter-status` / `rule-status` abort with 400 "too many rules" past a server cap (default 100 rules; "too many folders" past 500), and no account-wide rule list exists. When you hit that cap you **cannot** enumerate every configured rule from the CLI — say so plainly ("cannot fully enumerate configured rules on this account") instead of fabricating a completeness percentage.
+There is no public CLI operation for listing direct child folders after `rule-status` was retired. Unless the user or another trusted context supplies child folder IDs, the CLI cannot recursively enumerate every configured rule. Say so plainly instead of treating the top-level direct-rule lists as complete.
 
 **CONFIGURED ≠ FIRED.** Never infer rule coverage from *fired* alerts (`insight top-alerts`, alert feeds): "not fired in 90d" does **not** mean "not configured", and reporting a rule as missing on that basis is confidently wrong. Fired-alert queries answer "what is noisy", not "what is monitored".
 
@@ -56,21 +54,22 @@ fduty monit rule-list-basic --folder-id <node-id> --output-format toon
 ## Gotchas
 
 - **`rule_configs` and nested arrays require `--data`.** The queries, thresholds, enabled_times, and labels objects cannot be expressed as flat flags — pass them as inline JSON via `--data '{"rule_configs":{...}}'`. Typed scalar flags (`--name`, `--enabled`, `--cron-pattern`, `--ds-type`) override matching `--data` keys.
-- **`folder-id 0` is not a universal "all rules" sentinel.** If the API says "Folder not found", believe it. For global inventory use `rule-counter-status` / `rule-counter-node` first, then run `rule-list-basic` against real folder IDs only.
+- **`folder-id 0` is not a universal "all rules" sentinel.** If the API says "Folder not found", believe it. Use `rule-counter-status` / `rule-counter-node` for top-level totals, then run `rule-list-basic` only against real folder IDs you actually know.
 - **"全量规则 / full rules" means exported monitor alert-rule definitions.** The concrete verb is `rule-export --ids ...`, usually after `rule-list-basic` selected the IDs. It does not mean dumping incidents or alerts.
 - **For rule counts, prefer the counter verbs over list pagination.** `rule-counter-status`, `rule-counter-node`, and `rule-counter-total` are the authoritative aggregation surfaces; do not infer counts by walking `rule-list-basic` pages.
 - **`rule-delete-batch` and `datasource-delete` are irreversible.** Confirm IDs with `rule-list-basic` / `datasource-info` first.
 - **`rule-audit-detail --id` takes the audit record ID**, not the rule ID. Get audit record IDs from `rule-audits --id <rule-id>` first; passing the rule ID returns HTTP 400.
-- **`rule-list-basic` and `rule-status` both need a REAL `--folder-id`; neither accepts `0`.** `--folder-id 0` / omitting it 400s "Folder not found" on either verb — the generated `--folder-id` help text below ("0 to list all accessible rules" on `rule-list-basic`, "0 for all" on `rule-status`) is a known SDK/OpenAPI bug on both; ignore it. `rule-list-basic` returns only that folder's *direct* rules; `rule-status` returns trigger counts for that folder and its descendants. Enumerate by walking the tree (`rule-counter-status` → `rule-status` → `rule-list-basic`); past the server cap the counters 400 "too many rules" and full enumeration isn't possible from the CLI — report that limit, never substitute fired alerts (see the enumerate hot flow).
+- **`rule-list-basic` needs a REAL `--folder-id`; it does not accept `0`.** Its generated help text saying "0 to list all accessible rules" is a known SDK/OpenAPI bug; ignore it. The command returns only that folder's *direct* rules. Without known child folder IDs the CLI cannot recursively enumerate the subtree; never substitute fired alerts as configured-rule inventory.
 
 ## Worked example — inspect a firing rule then batch-disable it
 
 ```bash
 # 1. find a folder with triggered rules (top-level folders + subtree counts)
 fduty monit rule-counter-status --output-format toon
-# 2. list the rules directly in a chosen folder (descend with rule-status if empty)
+# 2. list rules directly in a chosen top-level folder
 fduty monit rule-list-basic --folder-id <folder-id> --output-format toon
-# look at triggered=true rows; note their ids
+# if this is empty while rule_total is non-zero, rules live in unknown child folders;
+# the public CLI cannot descend without their IDs
 
 # 3. get full config of one rule
 fduty monit rule-info --id <rule-id> --output-format toon
@@ -170,11 +169,6 @@ Move alert rules to folder
 - `--ids` intSlice (required) — Rule IDs to move.
 - response: same shape as `rule-import` above
 
-### rule-status
-Get rule trigger status under folder
-- `--folder-id` int64 — Folder ID to summarize. Obtainable via 'POST /monit/folder/list'. Trigger statistics are returned grouped by direct child folder.
-- response: same shape as `rule-counter-status` above
-
 ### rule-update
 Update alert rule
 - `--account-id` int64 — Account ID. Filled by the server from the authenticated identity; do not provide.
diff --git a/skills/flashduty/reference/monit.md b/skills/flashduty/reference/monit.md
index 3053542..490426d 100644
--- a/skills/flashduty/reference/monit.md
+++ b/skills/flashduty/reference/monit.md
@@ -20,16 +20,7 @@ Key IDs are shared across all of them: **rule ID (int)** from `rule-list-basic`;
 
 Read verbs are free. Mutating verbs change state — confirm before running; each card flags its own, and marks the irreversible ones.
 
-`preview-sync` (preview a query before saving it into a rule) is the one verb belonging to no surface, so it renders here.
-
 <!-- GENERATED:monit START · 由 fduty __dump-commands 同步 · 勿手改 fence 内 -->
 
-### preview-sync
-Preview datasource query
-- `--delay-seconds` int64 — Shift the query window backward by this many seconds to compensate for data ingestion latency.
-- `--ds-name` string (required) — Datasource display name as configured in the account.
-- `--ds-type` string (required) — Datasource type, e.g. 'prometheus', 'loki', 'elasticsearch'.
-- `--expr` string (required) — Query expression. Format depends on 'ds_type' (PromQL for Prometheus, LogQL for Loki, etc.).
-- body-only (`--data`): args (object)
 
 <!-- GENERATED:monit END -->