docs(skill): split channel/incident cards; add shared filters reference

channel.md (367 lines) carried four rule families beside channel CRUD, and
incident.md (508) carried the whole post-mortem surface — every task paid
for the whole domain, and the guidance competing for attention is exactly
how a hot-flow example gets misread. Split along task lines using subset
fences:

- channel.md → channel CRUD only; escalation.md (escalate-rule-*);
  noise.md (silence-rule-*, inhibit-rule-*, unsubscribe-rule-*)
- incident.md → triage/investigation; postmortem.md (post-mortem-*)
- filters.md: new shared reference for filters/source_filters/
  target_filters — OR-of-AND shape, IN/NOTIN semantics incl. the
  missing-key trap, /regex/ values, construction-from-labels rules, and
  the per-family key vocabulary. Consumer cards and alert.md's pipeline
  section point here instead of restating it.
- Canonical keys only: guidance now teaches severity/status/
  data_source_id; the per-surface aliases (event_severity,
  alert_severity, incident_severity, alert_status, incident_status,
  integration_id) always carry the same stored value and are called out
  as never-use.
- SKILL.md router: channel row narrowed; new escalation/noise/postmortem
  rows; shared-reference note for filters.md.

Author: ysyneu

skills/flashduty/SKILL.md

@@ -57,14 +57,17 @@ Some asks span several commands. For those the skill ships a script that fetches
 
 | intent / 意图 (terms route in either language) | card |
 |---|---|
-| incident / fault / 故障 / 事件 / triage 分诊 / acknowledge 认领 / merge 合并 / escalate 升级 / postmortem 复盘 / **summarize or analyze an incident 故障汇总分析** | **`reference/incident.md`** |
+| incident / fault / 故障 / 事件 / triage 分诊 / acknowledge 认领 / merge 合并 / escalate 升级 / **summarize or analyze an incident 故障汇总分析** | **`reference/incident.md`** |
+| post-mortem / postmortem 复盘 / 复盘报告 / 复盘模板 / post-incident review / RCA report | **`reference/postmortem.md`** |
 | alert / 告警 / dedup 去重 / alert fields 告警字段 / alert pipeline 告警管道 | **`reference/alert.md`** |
 | change / 变更 / deployment 部署 / release 发布 / correlated change 变更关联 / what changed | **`reference/change.md`** |
 | monitor / 监控 / alert rule 告警规则 / datasource 数据源 / inspection 巡检 / rule config 规则配置 | **`reference/monit.md`** |
 | automation / 自动化 / 定时 AI SRE / scheduled AI task / daily brief / weekly report / webhook trigger / POST trigger / chat-created automation | **`reference/automation.md`** |
 | metric/log query / 指标查询 / 日志查询 / PromQL / LogsQL / SQL / trend 趋势 / log clustering 日志聚类 / datasource RCA 数据源排查 | **`reference/monit-query.md`** |
 | host diagnostics / 主机诊断 / on-box / process 进程 / load 负载 / lock 锁 / slow query 慢查询 / mysql / reachability 可达性 | **`reference/monit-agent.md`** |
-| channel / 协作空间 / collaboration space / 频道 / integration 集成 / dispatch rule 分派规则 / escalation 升级规则 / noise reduction 降噪 / silence 静默 / inhibit 抑制 | **`reference/channel.md`** |
+| channel / 协作空间 / collaboration space / 频道 / integration 集成 / alert grouping 告警分组 | **`reference/channel.md`** |
+| dispatch rule 分派策略 / 分派规则 / escalation rule 升级规则 / notify layers 通知层级 / who gets paged | **`reference/escalation.md`** |
+| silence 静默 / 屏蔽 / inhibit 抑制 / drop rule 丢弃 / noise reduction 降噪 / maintenance silence 维护窗口静默 | **`reference/noise.md`** |
 | enrichment / 数据加工 / 富化 / label mapping 字段映射 / extraction 提取 / mapping schema 集成 schema | **`reference/enrichment.md`** |
 | insight / 洞察 / stats 统计 / trend 趋势 / MTTA / MTTR / top alerts Top 告警 / incident export 故障导出 | **`reference/insight.md`** |
 | schedule / on-call / 值班 / 排班 / rotation 轮值 / who is on call 谁在值班 / shift 班次 / next responder 下一班 | **`reference/schedule.md`** |
@@ -79,3 +82,5 @@ Some asks span several commands. For those the skill ships a script that fetches
 | sourcemap / source map / source mapping / symbolication / deobfuscate / stack enrich / dSYM / miniprogram source map | **`reference/sourcemap.md`** |
 | status page / 状态页 / public incident 公开事件 / public timeline 公开时间线 / maintenance window 维护窗口 / subscriber 订阅者 | **`reference/status-page.md`** |
 | AI-SRE platform / customize / 安装配置 MCP server (connector) 连接器 / install mcp / skill upload 上传技能 / A2A agent / session export 会话导出 | **`reference/safari.md`** |
+
+Shared reference: `reference/filters.md` — read it before composing any `filters` / `source_filters` / `target_filters` value (silence / inhibit / drop / escalation rules); it carries the condition shape, operators, and the valid key set per rule family.

skills/flashduty/reference/alert.md

@@ -143,7 +143,7 @@ View alert timeline
 
 ## Pipeline rule kinds
 
-`pipeline-upsert` replaces the whole pipeline; `rules[].kind` values: `title_reset` · `description_reset` · `severity_reset` · `alert_drop` · `alert_inhibit`. The `rules` array has no typed flag — pass it via `--data '{"rules":[...]}'`. The call is idempotent (upsert), so re-running with the same body is safe.
+`pipeline-upsert` replaces the whole pipeline; `rules[].kind` values: `title_reset` · `description_reset` · `severity_reset` · `alert_drop` · `alert_inhibit`. The `rules` array has no typed flag — pass it via `--data '{"rules":[...]}'`. The call is idempotent (upsert), so re-running with the same body is safe. `rules[].if` and `alert_inhibit`'s `source_filters` are OR-of-AND condition trees — read `reference/filters.md` before composing them.
 
 ## Gotchas