docs: align two published passages with the schemas they describe (capabilities vocabulary, analytics fields[]) - #16234

Fixes #15982
Fixes #16141

Two published passages asserted a wire/schema shape that the spec schema on the same tree
contradicts. Both are aligned to the schema and the dead names are retired. Nothing in
packages/** changes: packages/spec/src/api/discovery.zod.ts and
packages/spec/src/api/analytics.zod.ts are the truth this PR aligns to, not files it
edits. No product-semantics claim is added.

One commit per card; the two passages are the whole diff.

1 — content/docs/kernel/services-checklist.mdx (commit 1)

The "When a plugin registers a service" bullet named the retired top-level features map
and the retired workflow slot, and closed with "there is no features.auth".

Measured on this tree:

• The vocabulary is closed. WellKnownCapabilitiesSchema
  (packages/spec/src/api/discovery.zod.ts:659-738) declares exactly, in schema order:
  comments · automation · cron · search · export · chunkedUpload ·
  transactionalBatch · websockets · files · analytics · ai · notifications ·
  i18n. No workflow, no auth. None of the 13 is internal — every one is a
  frontend-adaptation flag that both discovery producers must answer (ruling A, SDK 的 client.capabilities 声明为 WellKnownCapabilities,但两个 discovery 生产者填的是互不相交的键集 #5672), so
  none of them is a key the page should withhold.

• The wire spelling. DiscoverySchema.capabilities is a closed map of
  CapabilityDescriptor ({ enabled, features?, description? }), so a flag reads
  capabilities.KEY.enabled. A per-capability features sub-record survives on purpose
  (CapabilityDescriptorSchema, 两个 discovery 生产者都在线上返回 schema 未声明的顶层字段(scoping / features / endpoints),且 REST 形状永远无法通过 DiscoverySchema #4828); the top-level features map does not — that is
  the one the bullet named.

• Which entries actually follow slot presence, read off the producer the page is about
  (packages/runtime/src/http-dispatcher.ts:1467-1483 and :1760-1848):

  capability	how the dispatcher answers it
  files, analytics, ai, notifications, i18n, automation	isServiceServeable(THAT_SLOT)
  cron	presence of the job slot
  export	automation or queue slot
  chunkedUpload	hasFiles — same storage surface as files
  websockets	isSubscribableChannel(services.realtime) — not slot presence (realtime: the bell cannot prefer a live channel because discovery advertises realtime as enabled:true with no HTTP/WS surface mounted and no route to connect to #14646)
  search	stated false; this dispatcher mounts no /search route (finding: the runtime dispatcher's capabilities.search is still presence-gated, so it over-promises the moment the slot is filled #7602)
  comments	measured from the object registry (sys_comment), not a slot
  transactionalBatch	stated false; this face mounts no /batch

So the old list was wrong in three directions at once: it named two retired keys, it
omitted four slot-derived ones (automation, cron, export, chunkedUpload), and it
listed search as slot-following when #7602 made it a stated false. The rewritten bullet
states each of those and keeps #14646's websockets clause verbatim — that clause is
measured and true, and was deliberately left intact.

Beyond the two names the card asked for. Correcting only features and workflow
would have left a rewritten bullet still asserting that search follows slot presence and
still under-listing the slot-derived set. Those are the same defect class in the same
sentence, mechanically decidable from the same two files, so they are corrected here rather
than left as fresh false prose. Flagged for the reviewer as the one place this PR goes past
the card's literal wording.

Not done, on purpose. Triage on #15982 ruled that adding a gate to check this bullet
against WellKnownCapabilitiesSchema is new work excluded from the card (「另立卡」). No
gate is added and no issue is filed for it; it is reported to the PM instead.

2 — content/docs/api/data-api.mdx (commit 2)

The Callout type="info" under POST /analytics/query said each fields[] entry carries
"exactly name and type … and nothing else", and that reading data.fields[i].label or
.format off a query result "yields undefined".

Both sentences are false on this tree:

• AnalyticsResultResponseSchema.data.fields[]
  (packages/spec/src/api/analytics.zod.ts) declares name, type, and the optional
  label (:105), format (:107), currency (:109), percentScale (:114),
  builtinAggregate (:121).
• The schema's own docblock (:66-89) records why: "Two packages/spec route response schemas declare a data NARROWER than the contract their route relays — AnalyticsResultResponseSchema and TriggerFlowResponseSchema #13078 restored the parity: this
  schema used to declare only rows / fields{name,type} / sql?, a strict subset of what
  the route relays, while the wire really carries fields[].label … format / currency /
  percentScale … and totals." The callout was true when docs: /analytics/query 的响应示例给 data.fields[] 标了 label / format —— 运行时只发 { name, type } #6369 wrote it and was
  inverted by that later correction without the page being touched.
• packages/spec/src/contracts/analytics-service.ts mirrors the members on
  AnalyticsResult, and packages/spec/src/api/analytics.test.ts binds
  AnalyticsResultResponse['data'] to it at compile time.

The rewrite states the conditional form — "when the producer declares them" — because
that is exactly what the schema supports. Triage's hard boundary is honoured: no strategy
census was run, so the page does not claim every strategy always emits these keys.

One fact added on top of the ruling, measured while writing it: the callout's remedy
("read them from the cube metadata instead") is unreachable for format.
GET /analytics/meta publishes the CubeMeta discovery projection — name, type,
title only — and its docblock (analytics.zod.ts:155-174) records that sql,
description, granularities and format "are dropped by the projection and are NOT
reachable through this endpoint" (#6442). The new callout says so, and keeps cube metadata
named as the declaration surface.

The JSON example above the callout is untouched: a result whose columns declare none of the
optional members is a valid response, so it contradicts nothing the new text says.

Scope and neighbours

• #14646 is not addressed here — its websockets clause is preserved as written.
• #14546 is not addressed here; it stays open on its own terms.
• #16144 touched this same page at :447+ (the /analytics/meta prose). Verified
  non-overlapping: its only hunk on this file is @@ -447 +447,4 @@, below the callout.
• content/docs/** only ⇒ skip-changeset: this PR releases nothing from any package.
• turbo ls --affected against the merge base reports 0 packages, so no package test or
  typecheck is owed; the docs gate family is what applies.

Generated by Claude Code