docs: sync doc-review findings (2026-08-06)

docs.json

@@ -558,7 +558,8 @@
                   "zh/monitors/targets/overview",
                   "zh/monitors/targets/install-agent",
                   "zh/monitors/targets/configure-targets",
-                  "zh/monitors/targets/reload-and-verify"
+                  "zh/monitors/targets/reload-and-verify",
+                  "zh/monitors/targets/servicemap"
                 ]
               },
               {
@@ -1823,7 +1824,8 @@
                   "en/monitors/targets/overview",
                   "en/monitors/targets/install-agent",
                   "en/monitors/targets/configure-targets",
-                  "en/monitors/targets/reload-and-verify"
+                  "en/monitors/targets/reload-and-verify",
+                  "en/monitors/targets/servicemap"
                 ]
               },
               {

en/ai-sre/artifacts.mdx

@@ -1,7 +1,7 @@
 ---
 title: Artifacts
-description: The artifact gallery collects web pages and reports that AI SRE sessions produce with the present_files tool and publish with the publish_artifact tool (for example, /insight reports). Search, filter or change scope, rename, share, download, and delete them here.
-keywords: ["AI SRE", "Artifacts", "present_files", "publish_artifact", "insight report", "artifact gallery"]
+description: The artifact gallery collects files that AI SRE sessions produce with the present_files tool and publish with the publish_artifact tool — web pages, reports, images, PDFs, source code, data files, and more (for example, /insight reports). Search, filter or change scope, rename, share (account-only or a public link), download, and delete them here.
+keywords: ["AI SRE", "Artifacts", "present_files", "publish_artifact", "insight report", "artifact gallery", "public link", "share"]
 sidebarTitle: Artifacts
 ---
 
@@ -13,7 +13,18 @@ sidebarTitle: Artifacts
 
 ---
 
-An artifact is a file AI SRE produces in a session with the `present_files` tool and then publishes to the artifact gallery with the `publish_artifact` tool — typically a self-contained HTML report or page. For example, the operational insight report generated by typing `/insight` in a session is an artifact.
+An artifact is a file AI SRE produces in a session with the `present_files` tool and then publishes to the artifact gallery with the `publish_artifact` tool. The most typical case is a self-contained HTML report or page — for example, the operational insight report generated by typing `/insight` in a session — but publishable types go well beyond that:
+
+| Category | Common extensions |
+|---|---|
+| Web pages & documents | `.html` `.htm` `.md` `.markdown` `.txt` `.log` |
+| Data & config | `.csv` `.tsv` `.json` `.yaml` `.yml` `.xml` `.toml` `.ini` |
+| Images | `.png` `.jpg` `.jpeg` `.gif` `.svg` `.webp` |
+| PDF | `.pdf` |
+| Source code | `.py` `.go` `.js` `.mjs` `.ts` `.jsx` `.tsx` `.java` `.c` `.h` `.cpp` `.cs` `.rb` `.rs` `.php` `.sh` `.sql` `.kt` `.swift` `.scala` `.css` `.vue` `.svelte` `.proto` `.tf` `.hcl`, and more |
+| Archives | `.zip` `.tar` `.gz` `.tgz` |
+
+Files outside the publishable range don't show a "Publish to artifact gallery" button in the session.
 
 A published artifact initially inherits its source session's scope: artifacts from a personal session belong to their creator ("Personal"); artifacts from a session bound to a team belong to that team and can be shared with other account members. Users with edit permission can change the scope later.
 
@@ -36,8 +47,8 @@ The artifact gallery has no entry point for manually uploading or creating files
 
 Each card shows:
 
-- A kind icon in the preview area: a code icon when the content type or file name is HTML, otherwise a document icon;
-- The title (up to two lines, truncated beyond that);
+- A kind icon in the preview area: determined by file extension and content type — images, PDF, HTML, Markdown, tables (CSV / TSV), JSON, archives, and source code each get a dedicated icon, falling back to a generic file icon when the type can't be recognized;
+- The title (single line, truncated beyond that; hover to see the full title);
 - An "Edited …" relative timestamp — just now / N minutes ago / N hours ago / N days ago, or a specific date beyond 30 days;
 - A scope badge in the bottom right: team artifacts show the team name (highlighted green); personal artifacts show the creator's name (gray).
 
@@ -77,7 +88,7 @@ The detail page route is `/ai-sre/artifacts/:artifactId`. The top toolbar offers
 
 - **Title**: if you have edit permission, click the title to edit it inline (no separate form) — press Enter to save, Esc to cancel;
 - **Creator**: shown below the title as "Artifact by [creator]";
-- **Share**: copies the link to the artifact's detail page;
+- **Share**: opens the share panel, where you can choose between "Account only" and "Public link" visibility — see [Share an artifact](#share-an-artifact) below;
 - **Delete**: shown only when you have edit permission; requires confirmation;
 - **More actions**: this menu appears only when at least one of the following is available —
   - **Open session**: shown when you still have access to the artifact's source session; opens that session's full conversation (messages, tool calls, artifact history);
@@ -86,6 +97,37 @@ The detail page route is `/ai-sre/artifacts/:artifactId`. The top toolbar offers
 
 The body renders the artifact according to its actual content type (for example, an HTML report renders inline as a page).
 
+## Share an artifact
+
+---
+
+The **Share** button in the detail page toolbar opens the share panel. **Manage permission** at the top lists who can manage sharing for this artifact (the creator is labeled "Owner"; team artifacts also list team members). **Visibility** below offers two modes:
+
+| Mode | Who can open it | Content |
+|---|---|---|
+| Account only | Members signed in to the same account | Viewable once signed in; content is **always the latest version** |
+| Public link | Anyone with the link, **no sign-in required** | Shows a **content snapshot** taken the moment the link was generated; it doesn't automatically sync after the artifact is updated |
+
+### Public link
+
+After you choose **Public link**, the panel first shows a content preview and a risk notice; the link only takes effect once you click **Generate public link**:
+
+<Warning>
+Once you generate a public link, anyone who gets the link can view this artifact, and the link can be forwarded further. Don't share secrets, personal information, or unauthorized third-party content.
+</Warning>
+
+On success, the link is copied to your clipboard automatically (a "Public link generated and copied to clipboard" toast appears). The public link takes the form `https://<console-domain>/share/artifact/<artifact-id>` — it's identified by the artifact's own ID and carries no token; anonymous access is served entirely by the CDN, without going through any endpoint that requires sign-in.
+
+| Action | Description |
+|---|---|
+| Generate public link | Copies the artifact's current content as a public snapshot and enables the link |
+| Update snapshot | Appears only when the artifact's content has changed since the snapshot was taken (an "Artifact content has changed — update the snapshot to sync the latest content" notice). Clicking it overwrites the snapshot with the latest content; **the link itself stays the same** |
+| Revoke public link | Turns off public access; the link stops working immediately |
+
+<Note>
+Artifacts larger than **16 MiB** can't generate a public link — you'll see a notice that the artifact exceeds the size limit. You can still share it using "Account only" mode.
+</Note>
+
 ## Permissions
 
 ---

en/ai-sre/environments.mdx

@@ -254,8 +254,20 @@ After the Runner starts, it continuously sends heartbeats. List statuses mean:
 |---|---|
 | Pending | The Environment exists, but the Runner has never connected. |
 | Online | The Runner is currently connected, heartbeat is healthy, and it can accept work. |
+| Degraded | The Runner is still connected and its heartbeat is healthy, but its executor can't keep up — tasks are queuing up or taking too long to return. **You can keep using it, but responses will be slower**. |
 | Offline | The Runner connected before, but its heartbeat is currently lost. |
 
+`degraded` is computed **in real time** and isn't persisted: it's re-evaluated from current signals on every read, so it never needs to be manually cleared. It's driven by two kinds of signal —
+
+- newer Runner versions report their own executor health probe and backlog count in the heartbeat, and degraded is judged directly from those;
+- older Runner versions that don't report these metrics use a fallback rule instead: **3 consecutive** task timeouts against the same Environment mark it degraded (only timeouts longer than 20 seconds count, so a caller's own short timeout isn't misjudged).
+
+Recovery is automatic too: for newer Runner versions, the status returns to `Online` as soon as the heartbeat is healthy again (probe passes and no backlog); for older Runner versions, any single successful task resets the counter, or it recovers automatically after 30 minutes of sustained quiet.
+
+<Tip>
+When you see `Degraded`, first check CPU, memory, and disk load on the Runner's host, and whether a long-running task is monopolizing the executor. It doesn't block the session, but staying in this state for a while means that host can't keep up with its current task volume.
+</Tip>
+
 The backend compares Runner versions during heartbeats. When a newer version is available, the Runner receives an upgrade notification and downloads, verifies, and replaces itself. Re-running the install command also upgrades manually.
 
 Uninstall commands are also in the setup guide, and differ by installation method:
@@ -380,7 +392,7 @@ The environment selector at the bottom of the chat input decides where a new ses
 |---|---|
 | **Auto** | The default for new sessions. Uses an online Runner the current member can use; otherwise falls back to the cloud Sandbox. |
 | **Cloud Sandbox · Default** | Forces the system-managed cloud Sandbox and ignores self-hosted Runners. |
-| **Self-hosted Environment** | Lists Runners the current member can use. Offline, never-connected, or team-mismatched Runners cannot be selected. |
+| **Self-hosted Environment** | Lists Runners the current member can use. Offline, never-connected, or team-mismatched Runners cannot be selected; Runners in **Degraded** status **remain selectable**, and selecting one shows a "Degraded — you can continue, but responses may be slower" notice. |
 
 <Warning>
 Environment selection is locked once per session: the Environment determined when the session sends its first message is recorded and reused for all later turns. Changing the selector afterward does not change that session. To switch environments, start a new session.

en/ai-sre/insight.mdx

@@ -58,7 +58,7 @@ Understanding how the report is put together helps you see where the numbers com
 
 <AccordionGroup>
   <Accordion title="Export and filter sessions" icon="download">
-    AI SRE first lists the sessions within scope for the last 30 days (up to 200 by default), covering **all four entry kinds** — web, IM, API, and scheduled; IM is a primary AI SRE entry point, so IM-originated sessions are analyzed alongside web. After exporting their full records, it keeps the sessions with **real signal**: **≥ 2 user-message turns OR ≥ 3 tool calls** (either one qualifies — `INSIGHT_MIN_MSGS` / `INSIGHT_MIN_CALLS`). The tool-call arm matters: it lets autonomous runs kicked off by an alert or a schedule — which may have zero human turns yet a dozen tool calls of real investigation — into the report, instead of being silently dropped by a user-turns-only filter. The quantitative overview also renders an **entry mix** line (`entry_mix`) showing where these sessions came from.
+    AI SRE first lists the sessions within scope for the last 30 days (up to 200 by default), covering **all four entry kinds** — web, IM, API, and automation; IM is a primary AI SRE entry point, so IM-originated sessions are analyzed alongside web. After exporting their full records, it keeps the sessions with **real signal**: **≥ 2 user-message turns OR ≥ 3 tool calls** (either one qualifies — `INSIGHT_MIN_MSGS` / `INSIGHT_MIN_CALLS`). The tool-call arm matters: it lets autonomous runs kicked off by an alert or a schedule — which may have zero human turns yet a dozen tool calls of real investigation — into the report, instead of being silently dropped by a user-turns-only filter. The quantitative overview also renders an **entry mix** line (`entry_mix`) showing where these sessions came from.
   </Accordion>
   <Accordion title="Compute quantitative metrics" icon="gauge-high">
     The report's quantitative overview — session count, your turn count, tool call count, average turns, daily activity, tool and skill distribution, entry mix, model distribution, and outcome distribution — is computed deterministically across all sessions by program logic, not estimated by the model, so it is reliable and always present even when no friction is found.
@@ -91,7 +91,7 @@ Computed deterministically by program logic, not estimated by the model; the mod
 | Activity | Per-day session activity bar chart, with start and end dates labeled |
 | Tool distribution | Ranking of tools the agent relied on most (top ~6) |
 | Skill distribution | Ranking of skills invoked during sessions; shows "No skills invoked" if none were called |
-| Entry mix | Where the sessions came from, formatted as `web (60) · IM (25) · scheduled (5)` (`entry_mix`) |
+| Entry mix | Where the sessions came from, formatted as `web (60) · IM (25) · automation (5)` (`entry_mix`) |
 | Model distribution | How many sessions used each model, formatted as `model name (N sessions)` |
 | Outcome distribution | Count of completed / incomplete / errored sessions (zero values omitted) |
 

en/ai-sre/knowledge.mdx

@@ -60,7 +60,7 @@ After reading `DUTY.md`, the agent decides which `@references` to expand based o
 
 | Constraint | Value | Notes |
 | --- | --- | --- |
-| Allowed extensions | `.md` `.yaml` `.yml` `.json` `.txt` `.sh` | Other extensions are rejected |
+| File content | Plain text (UTF-8) | Validated by **content**, not extension: a file saves as long as it contains no NUL bytes and decodes as valid UTF-8. So `.py`, `.sql`, and even an extension-less `Dockerfile` can be uploaded alongside `.md` `.yaml` `.json` `.txt` `.sh`; conversely, a file with a `.txt` extension but binary content is rejected |
 | Per-file size limit | 1 MiB | Files exceeding this cannot be saved |
 | Per-pack size limit | 5 MiB | The usage bar in the console reflects this quota |
 | File count limit | 100 | No new files can be added once the limit is reached |
@@ -88,7 +88,7 @@ Go to the **Knowledges** management page to create, edit, enable/disable, or del
   </Step>
 </Steps>
 
-**Document distillation**: Knowledge files only support the plain-text formats listed in the table above. If you upload a document in a format that can't be stored directly — PDF, Word, Excel, PowerPoint, or HTML — the console notes that the format can't be used by the agent directly and offers a **Go to chat for analysis** entry. Clicking it starts a new AI SRE session with the document carried in as an attachment; the agent reads the document and distills it into a Markdown knowledge file, which is saved into the current Knowledge Pack after your confirmation.
+**Document distillation**: Knowledge files only accept plain-text content (see the table above). If you upload a document that can't be stored directly — `.pdf`, `.docx`, `.xlsx`, `.pptx`, `.html`, `.htm` — the console notes that the format can't be used by the agent directly and offers a **Go to chat for analysis** entry. Clicking it starts a new AI SRE session with the document carried in as an attachment; the agent reads the document and distills it into a Markdown knowledge file, which is saved into the current Knowledge Pack after your confirmation. Legacy Office binary formats (`.doc`, `.xls`, `.ppt`) are outside the conversion range and get rejected outright as binary files — save them as `.docx` / `.xlsx` / `.pptx` first, then upload.
 
 **Reference consistency checks**: when you save a file, any `@reference` pointing to a file that does not exist in the pack returns a non-blocking unresolved-reference warning (the save still completes). When you delete a file that is still referenced by other files, a still-referenced conflict prompt appears first — you can choose to **force delete**.