[viethqb]

Documentation for Wave 2b of the Known-issues fix programme. Every statement was checked against the platform PRs #726 (B4, alerts and reports delivery), #727 (B7, authentication, sessions and roles) and #728 (B6, engines and monitor): their descriptions, their diffs and the code on platform main (40176006) and, for #728, its branch head.

Pages changed (31, plus known-issues and the REST reference)

• Alerts and reports (#726): run-history.md (Success only when every destination took the message, Error otherwise; each failed destination named, webhook <host> only; Run now updates Last run and the badge, not Next run), notifications.md (when delivery fails: the grace table for all, some and no destinations reached; Slack without an app is an Error; subject without report report), schedules.md (items due together run four at a time; grace starts from the last run that reached someone), reports.md (render limit 30 s per object plus 30 s and the timeout message, CSV/Text numbers like the table's defaults, subject rule), index.md, create-an-alert.md; dashboards/export-and-reports.md
• Authentication and roles (#727): troubleshooting/cannot-sign-in.md (failures only, 5 per 5 minutes, the 429 body with Retry-After, Try again in N minutes, success clears the count; No workspaces yet, synced groups hold no role by themselves, verified email for pre-registration), authentication.md (openid once, email_verified redemption, limiter), workspace-settings/members.md (add someone who has not signed in yet: Waiting for first sign-in, Withdraw, verified email only, workspace roles only; pickers list workspace roles, no data_api_invoker), roles-and-permissions.md (9 permissions (7 inherited), Inherited from, why data_api_invoker is missing), access-requests.md, control-plane/audit-log.md (opens on Changes and denials, hideAllowed, actorEmail, member:invite/member:uninvite), access-control/users.md (Disable confirmation; roles listed are direct grants only), access-control/index.md (Recent changes by email), faq.md, first-login-tour.md, quick-start.md, run-the-demo-stack.md, security-hardening.md, troubleshooting/index.md, configuration-keys.md
• Ranger surface (KI-148, closed as no longer applying since #713/#714): engines-and-ranger.md (/ranger routes, per-engine Basic credential, auth_mode, operator token, plugin 2.8.0 floor, the XML with the credential lines), ranger-plugin.md (Authentication text, warnings, what you supply), security-hardening.md, kubernetes.md (the ingress routes /ranger), configuration-keys.md (ranger.auth_mode)
• Engines and monitor (#728): query-engines/engine-detail.md (endpoint, containers on Docker, no Logs/Exec there, Review changes confirms the save, ingress Host required, Restart recreates an engine whose containers are gone, Monitor sign-in table and node fallback, catalog test runs as you on a JWT engine), provision.md (Worker 0, ingress host), query-engines/index.md (Endpoint column, demo-down/up), run-the-demo-stack.md (Restart after demo-down/demo-up), data-governance/lineage.md (new section How egret computes lineage: who egret-lineage is served to and what it is granted), overview.md, classifications/view-exposure.md
• REST reference regenerated with scripts/gen-api-reference.mjs (separate commits): from platform main's openapi.json for #726/#727 (auth.md: 429 RateLimited with Retry-After; control-plane-audit.md: hideAllowed; workspace-members.md: invited, GET/DELETE /invites; index.md), then from #728's branch head 2021bff8 (main plus #728) for control-plane-engines.md (endpoint, runtime, nullable nodes). #728 was still open when this was written; if its openapi.json changes before it merges, regenerate from main.

Known issues

Closed with a Status note: KI-032, KI-033, KI-034, KI-157, KI-167, KI-169, KI-173 (#726); KI-002, KI-017, KI-018, KI-019, KI-127, KI-142, KI-144, KI-145, KI-185, KI-209 (#727); KI-194, KI-195, KI-196, KI-197, KI-198, KI-199, KI-200, KI-201, KI-213 (#728). KI-021 closed as by design (the group is synced; a platform role comes only from an admin's grant to the group; the dev stack's seed makes it, the demo stack does not). KI-148 closed as no longer applying (since #713/#714 ranger.auth_token is only the operator bearer; plugins use per-engine Basic credentials). No S1 row is open; none was in this wave.

Added at the end of the last table, each checked against platform code:

• KI-260 the Users list and user page show only directly granted platform roles, not roles held through a group
• KI-261 POST /ws/{ws}/members still accepts data_api_invoker (direct call or pre-registration) although the pickers hide it
• KI-262 bulk Disable on the Users list acts at once (Undo toast only), while single Disable asks
• KI-263 a Docker engine save cancelled by a browser disconnect leaves the engine with no container (failed until the next save)
• KI-264 the Ingress section is offered on Docker engines, which refuse any ingress
• KI-265 verify: on a Ranger-bound impersonation engine the monitor's egret-monitor probably sees no other user's queries (not reproduced)
• KI-266 CSV/Text reports use the table's default number format, not a column's own format settings (Limitation, B4 decision)

The catalog test (SHOW SCHEMAS) running as the viewer on a JWT engine is described on the Engine detail page instead of a row: it is the intended sign-in, and the page says the test fails when the engine's policy does not let you read the catalog. The intro paragraph names the source of KI-260 to KI-266.

Screenshots

Re-shot on the shared demo stack (egret.localtest.me:18080, running #728's images; B7's UI is not in them), light, 1440×900, every PNG viewed:

• admin/cp-engine-overview, admin/cp-engine-monitor, admin/cp-engine-settings, admin/cp-engine-delete (a temporary engine docs-w2b-trino, deleted afterwards; the shot scripts take DOCS_ENGINE for its name)
• alerts/run-log (run log of b4-premise multi-destination: Error naming two failed destinations, then On grace; RUN_LOG_ALERT picks the alert)
• Wave 2 stale: sql-datasets/sqllab-error (line 1:35), ops/get-started/sql-lab-run (rows in order)

Still out of date:

• B7 UI (not on the stack): admin/cp-audit-log (no Changes and denials), admin/cp-user-detail and admin/cp-users-bulk (no Disable confirmation), admin/ws-members and admin/ws-add-member (no Waiting for first sign-in, no SSO hint), admin/ws-roles-expanded (own permissions only), ops/get-started/sign-in / login error text.
• B4: alerts/detail (Recent runs of an alert that no longer exists on the stack) and alerts/alerts-list kept: the stack's Default workspace now holds only the b4- test items, so a re-shot list would not show what the page describes.
• B6: admin/gov-table-lineage, the Governance overview and View exposure shots (the stack has no analytics.sessions or view), admin/cp-engine-catalogs / cp-engine-workspaces (no docs seed), admin/cp-engine-logs (no longer referenced; Docker shows no Logs button).
• Wave 2 list from docs: Wave 2 fixes (KI-004 to KI-211, KI-247 to KI-259) #29, except the two above: the demo stack no longer has the docs seed (Docs sandbox, the chart and Data API objects), so they could not be re-shot.

Not verified

• Kubernetes engines (#728): the monitor's viewer token, the node fallback and Restart recreating a removed engine are covered only by fakes in #728's tests; written from code.
• The Ranger surface section is written from platform main's code and docs/en/guides/ranger-surface.md, not observed on the stack.
• finance_reporter's count (9 permissions (7 inherited)) is inferred from the b7_reporter live check of the same shape.
• KI-263 and KI-265 are from #728's notes; KI-263 checked in the Docker provisioner's code (remove, then start, in the request), KI-265 not reproduced.

The build passes for en and vi with DOCUSAURUS_NO_PERSISTENT_CACHE=1 npm run build.

🤖 Generated with Claude Code