chore(spec): regenerate reference docs, strictness ledger and import-surface baseline

Tooling output of the schema widening, not hand-written:

- `gen:docs` re-renders the analytics/automation-api reference pages with the
  newly declared members and the now-importable `AnalyticsResultResponse`.
- `gen:strictness-ledger` moves the `api/` unknown-key site count 444 -> 448.
- `--update-import-baseline` discharges the shrink-only ratchet entry
  `api/AnalyticsResultResponse — no type export`: the gap the card names is
  closed, and a stale line would stay available to excuse the next one.

Author: claude

content/docs/references/api/analytics.mdx

@@ -18,7 +18,7 @@ Provides endpoints for executing analytical queries and discovering metadata.
 
 ```typescript
 import { AnalyticsEndpoint, AnalyticsMetadataResponseSchema, AnalyticsQueryRequestSchema, AnalyticsResultResponseSchema, AnalyticsSqlResponseSchema, GetAnalyticsMetaRequestSchema } from '@objectstack/spec/api';
-import type { AnalyticsEndpoint, AnalyticsMetadataResponse, AnalyticsQueryRequest, AnalyticsSqlResponse, GetAnalyticsMetaRequest } from '@objectstack/spec/api';
+import type { AnalyticsEndpoint, AnalyticsMetadataResponse, AnalyticsQueryRequest, AnalyticsResultResponse, AnalyticsSqlResponse, GetAnalyticsMetaRequest } from '@objectstack/spec/api';
 
 // Validate data
 const result = AnalyticsEndpoint.parse(data);
@@ -103,7 +103,7 @@ const result = AnalyticsEndpoint.parse(data);
 | **success** | `boolean` | ✅ | Operation success status |
 | **error** | `{ code: Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| …>; declaredCode?: string; message: string; userMessage?: string; … }` | optional | Error details if success is false |
 | **meta** | `{ timestamp: string; duration?: number; requestId?: string; traceId?: string }` | optional | Response metadata |
-| **data** | `{ rows: Record<string, any>[]; fields: object[]; sql?: string }` | ✅ |  |
+| **data** | `{ rows: Record<string, any>[]; fields: object[]; sql?: string; totals?: object[] }` | ✅ |  |
 
 ### Nested Shape: `AnalyticsResultResponse.error`
 
@@ -123,8 +123,9 @@ const result = AnalyticsEndpoint.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **rows** | `Record<string, any>[]` | ✅ | Result rows |
-| **fields** | `{ name: string; type: string }[]` | ✅ | Column metadata |
+| **fields** | `{ name: string; type: string; label?: string; format?: string; … }[]` | ✅ | Column metadata |
 | **sql** | `string` | optional | Executed SQL (if debug enabled) |
+| **totals** | `{ dimensions: string[]; rows: Record<string, any>[] }[]` | optional | Marginal aggregates - one entry per requested totals grouping, in request order, each computed with the measure's true aggregate over the underlying data (never re-derived from bucketed values). The grand-total grouping yields a single dimensionless row. |
 
 
 ---

content/docs/references/api/automation-api.mdx

@@ -583,7 +583,7 @@ const result = AutomationApiErrorCode.parse(data);
 | **success** | `boolean` | ✅ | Operation success status |
 | **error** | `{ code: Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| …>; declaredCode?: string; message: string; userMessage?: string; … }` | optional | Error details if success is false |
 | **meta** | `{ timestamp: string; duration?: number; requestId?: string; traceId?: string }` | optional | Response metadata |
-| **data** | `{ success: boolean; output?: any; error?: string; durationMs?: number }` | ✅ |  |
+| **data** | `{ success: boolean; output?: any; error?: string; durationMs?: number; … }` | ✅ |  |
 
 ### Nested Shape: `TriggerFlowResponse.error`
 
@@ -606,6 +606,13 @@ const result = AutomationApiErrorCode.parse(data);
 | **output** | `any` | optional | Output data from the automation |
 | **error** | `string` | optional | Error message if execution failed |
 | **durationMs** | `number` | optional | Execution duration in milliseconds |
+| **code** | `Enum<'PERMISSION_DENIED' \| 'INVALID_SIGNAL' \| 'RUN_NOT_FOUND' \| 'STORE_UNAVAILABLE' \| …>` | optional | Machine-readable failure classification, set alongside `error` when the caller must distinguish WHY it failed. A closed union - the members and their transport mappings are documented on the contract (`AutomationResult.code`, contracts/automation-service.ts). |
+| **status** | `Enum<'completed' \| 'paused' \| 'failed'>` | optional | Lifecycle status. `paused` means the run suspended at a node and can be continued with the resume route. Absent or `completed`/`failed` means the run reached a terminal state. |
+| **runId** | `string` | optional | Run id - set when `status` is `paused`, so callers can resume it |
+| **screen** | `{ nodeId: string; title?: string; description?: string; fields: object[]; … }` | optional | The screen to render - set when the run paused at a `screen` node awaiting user input. The client collects values for `screen.fields` and resumes the run with them. |
+| **successMessage** | `string` | optional | Friendly terminal message copied from the flow definition on terminal success, so a screen-flow runner can show a meaningful toast |
+| **errorMessage** | `string` | optional | Friendly terminal message copied from the flow definition on failure |
+| **summary** | `{ selected: integer; acted: integer; skipped: integer; unmeasured?: integer; … }` | optional | What the run did - records selected / acted on, gate skips, per-node status. Set on a TERMINAL result (a paused run has not finished doing it yet). |
 
 
 ---

docs/audits/2026-07-unknown-key-strictness-ledger.counts.md

@@ -257,7 +257,7 @@ directory rather than per file.
 | Dir | Sites |
 |---|---|
 | `ai/` | 77 |
-| `api/` | 444 |
+| `api/` | 448 |
 | `cloud/` | 83 |
 | `identity/` | 32 |
 | `integration/` | 10 |

packages/spec/docs-import-surface.baseline.json

@@ -4,7 +4,6 @@
     "ai/AIModelConfig — no type export",
     "ai/CodeContent — no type export",
     "ai/ImageContent — no type export",
-    "api/AnalyticsResultResponse — no type export",
     "api/Discovery — no type export",
     "api/HttpFindQueryParams — no type export",
     "api/MetadataExportRequest — no type export",