ysyneu · Oct 22, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 21, 2026
diff --git a/api-reference/monitors.openapi.en.json b/api-reference/monitors.openapi.en.json
@@ -5839,7 +5839,7 @@
         }
       },
       "TooManyRequests": {
-        "description": "Rate limit hit (per-account limit or the operation's platform-wide limit). Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
+        "description": "Rate limit hit. Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
         "content": {
           "application/json": {
             "schema": {

diff --git a/api-reference/monitors.openapi.zh.json b/api-reference/monitors.openapi.zh.json
@@ -5839,7 +5839,7 @@
         }
       },
       "TooManyRequests": {
-        "description": "触发频率限制（账户级限制或该接口的平台级上限）。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
+        "description": "触发频率限制。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
         "content": {
           "application/json": {
             "schema": {

diff --git a/api-reference/on-call.openapi.en.json b/api-reference/on-call.openapi.en.json
@@ -19112,7 +19112,7 @@
         }
       },
       "TooManyRequests": {
-        "description": "Rate limit hit (per-account limit or the operation's platform-wide limit). Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
+        "description": "Rate limit hit. Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
         "content": {
           "application/json": {
             "schema": {

diff --git a/api-reference/on-call.openapi.zh.json b/api-reference/on-call.openapi.zh.json
@@ -19112,7 +19112,7 @@
         }
       },
       "TooManyRequests": {
-        "description": "触发频率限制（账户级限制或该接口的平台级上限）。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
+        "description": "触发频率限制。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
         "content": {
           "application/json": {
             "schema": {

diff --git a/api-reference/openapi.en.json b/api-reference/openapi.en.json
@@ -107,7 +107,7 @@
         "description": "The service is temporarily unavailable. Include the request_id when reporting."
       },
       "TooManyRequests": {
-        "description": "Rate limit hit (per-account limit or the operation's platform-wide limit). Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
+        "description": "Rate limit hit. Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
         "content": {
           "application/json": {
             "schema": {

diff --git a/api-reference/openapi.zh.json b/api-reference/openapi.zh.json
@@ -107,7 +107,7 @@
         "description": "服务暂时不可用。反馈问题时请附带 request_id。"
       },
       "TooManyRequests": {
-        "description": "触发频率限制（账户级限制或该接口的平台级上限）。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
+        "description": "触发频率限制。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
         "content": {
           "application/json": {
             "schema": {

diff --git a/api-reference/platform.openapi.en.json b/api-reference/platform.openapi.en.json
@@ -2601,7 +2601,7 @@
         }
       },
       "TooManyRequests": {
-        "description": "Rate limit hit (per-account limit or the operation's platform-wide limit). Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
+        "description": "Rate limit hit. Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
         "content": {
           "application/json": {
             "schema": {

diff --git a/api-reference/platform.openapi.zh.json b/api-reference/platform.openapi.zh.json
@@ -2601,7 +2601,7 @@
         }
       },
       "TooManyRequests": {
-        "description": "触发频率限制（账户级限制或该接口的平台级上限）。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
+        "description": "触发频率限制。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
         "content": {
           "application/json": {
             "schema": {

diff --git a/api-reference/rum.openapi.en.json b/api-reference/rum.openapi.en.json
@@ -104,7 +104,7 @@
             }
           }
         },
-        "description": "Rate limit hit (per-account limit or the operation's platform-wide limit). Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
+        "description": "Rate limit hit. Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
         "headers": {
           "Flashcat-Request-Rate-Limit-Delay": {
             "description": "Seconds until the current rate-limit window resets. Absent when the request was rejected by the gateway's global protection limit.",

diff --git a/api-reference/rum.openapi.zh.json b/api-reference/rum.openapi.zh.json
@@ -104,7 +104,7 @@
             }
           }
         },
-        "description": "触发频率限制（账户级限制或该接口的平台级上限）。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
+        "description": "触发频率限制。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
         "headers": {
           "Flashcat-Request-Rate-Limit-Delay": {
             "description": "距当前限流窗口重置的秒数。请求被网关全局保护限流拒绝时不返回该响应头。",

diff --git a/api-reference/safari.openapi.en.json b/api-reference/safari.openapi.en.json
@@ -5207,7 +5207,7 @@
         }
       },
       "TooManyRequests": {
-        "description": "Rate limit hit (per-account limit or the operation's platform-wide limit). Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
+        "description": "Rate limit hit. Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry.",
         "content": {
           "application/json": {
             "schema": {

diff --git a/api-reference/safari.openapi.zh.json b/api-reference/safari.openapi.zh.json
@@ -5207,7 +5207,7 @@
         }
       },
       "TooManyRequests": {
-        "description": "触发频率限制（账户级限制或该接口的平台级上限）。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
+        "description": "触发频率限制。请等待响应头 `Flashcat-Request-Rate-Limit-Delay` 给出的秒数后重试。",
         "content": {
           "application/json": {
             "schema": {

diff --git a/docs.json b/docs.json
@@ -3010,6 +3010,14 @@
     {
       "source": "/webhook/history/list",
       "destination": "/zh/api-reference/on-call/integrations/webhook-history-list"
+    },
+    {
+      "source": "/zh/rum/error-tracking/erro-reporting/web",
+      "destination": "/zh/rum/error-tracking/error-reporting/web"
+    },
+    {
+      "source": "/en/rum/error-tracking/erro-reporting/web",
+      "destination": "/en/rum/error-tracking/error-reporting/web"
     }
   ],
   "navigation": {

diff --git a/en/ai-sre/agents.mdx b/en/ai-sre/agents.mdx
@@ -154,9 +154,19 @@ OAuth 2.1 appears only on the **member authorization** axis. The service authori
 </Note>
 
 <Note>
-Saved sensitive fields (such as tokens, API keys and client secrets) are shown **masked**. Leaving one blank when editing keeps the current value rather than clearing it.
+Saved sensitive fields (such as tokens, API keys, and client secrets) are shown as a fixed `****` mask that reveals neither the first nor the last characters. Saving the mask unchanged keeps the current value; saving the field empty clears it.
 </Note>
 
+#### Changing the Card URL discards stored credentials
+
+Pointing an agent at a different Card URL means a new destination, and the credentials stored for the old one don't come along:
+
+- **Re-enter every sensitive field of the agent's authentication settings as plaintext in the same edit.** Saving fails and lists the field names to re-enter when a value is left empty, sent back as the mask, or the field is omitted entirely (an omitted field counts as reusing the old value). The error reads: `The connection destination changed, so stored secrets are not sent to it. Re-enter these values in the same edit: <keys>`.
+- **Every member's credential under member authorization (Secret (Header) / OAuth 2.1) is revoked.** After the change, each member enters their key again or authorizes again. Revocation happens before the save, so members re-authorize even when the save fails.
+- **Replacing only the OAuth metadata without touching the Card URL** also revokes members' credentials, but does not require re-entering the values shared account-wide. Emptying it only triggers rediscovery from the unchanged Card URL.
+
+Members who can view but not edit an agent get the Card URL with its `user:password` part removed and every query value replaced by `****`; a URL that doesn't parse is hidden entirely.
+
 <Warning>
 Use HTTPS for member authorization (OAuth 2.1) discovery whenever possible. Enable "Allow fetching OAuth configuration over HTTP (testing only)" for a non-local HTTP Card URL only in controlled test environments. If an HTTPS endpoint uses a self-signed certificate, enable "Skip TLS certificate verification" only temporarily and only inside a trusted network.
 </Warning>

diff --git a/en/ai-sre/apps.mdx b/en/ai-sre/apps.mdx
@@ -103,6 +103,9 @@ Authorization happens on GitHub's official install page, opened in a popup.
   <Step title="Pick the organization and repositories on GitHub">
     Choose the **organization** (or personal account) to install into, and grant a repository scope — **All repositories** or **Only select repositories**. The set of granted repositories determines which repositories AI SRE can access afterward.
   </Step>
+  <Step title="Authorize Flashduty on GitHub">
+    After you pick the organization and repositories, GitHub takes the browser to the Flashduty App's OAuth **Authorize** page; confirm it and the browser returns to Flashduty on its own. This step is what proves the installation belongs to you: Flashduty binds the installation to your account only once the authorizing GitHub user is shown to have access to it, so an installation nobody can access is never bound. A private deployment must set the GitHub App's **Callback URL** to the install callback address and fill in the OAuth client id and secret; without them, installations do not take effect.
+  </Step>
   <Step title="Auto-refresh after you confirm">
     After you confirm on GitHub, the popup closes and the new organization appears in the installation list.
   </Step>

diff --git a/en/ai-sre/automations.mdx b/en/ai-sre/automations.mdx
@@ -113,6 +113,8 @@ Runs automatically on a time cadence. The cadence supports two cron forms:
 | Month | `*` or `1`–`12` |
 | Day of week | `*` or `0`–`7` (both `0` and `7` mean Sunday) |
 
+You can't set both day of month and day of week: one of the two must be `*`, or the save is rejected with this message under the cron field: "Do not set both a day of month and a day of week. Change one of them to *." A 4-field expression works the same way, so its day of month and day of week also can't both be set.
+
 To avoid hand-writing the expression, the UI offers four modes:
 
 | Mode | Meaning |

diff --git a/en/ai-sre/context.mdx b/en/ai-sre/context.mdx
@@ -40,6 +40,8 @@ Everything under Customize (skills, knowledge, MCP, agents, environments) uses t
 | Loaded in a session | A session bound to a team loads shared resources and that team's resources only, including for account owners and admins. A personal session loads shared resources and the resources of the teams the session creator belongs to. |
 | List | Management pages show shared resources and resources of your teams. |
 
+A resource the list doesn't show is the same when opened by ID: the MCP, A2A Agent, and Skill detail pages, and Skill downloads, report that the resource does not exist rather than revealing that the ID exists.
+
 For troubleshooting that spans teams, ask the other team to set the relevant resources to shared.
 
 ## Read next

diff --git a/en/ai-sre/mcp.mdx b/en/ai-sre/mcp.mdx
@@ -172,6 +172,20 @@ Service authorization shows a dash ("—"). Click the authorization entry to ope
 - **Member authorization (key)**: click **Enter Key** or **Update Key**.
 - **Revoke**: deletes your saved credential.
 
+### Changing the destination leaves stored secrets behind
+
+A save that changes the **transport**, the **command**, the **args**, or the **endpoint** (URL) counts as switching to a different connection destination. Args are compared as a list, so an unchanged list is not a change. Stored shared credentials do not go to the new destination: the protected values in the environment variables and Headers (key rules in [Authentication](#authentication) above) must be re-entered as plaintext in the same edit. If you leave one out, send it empty, or send the mask back as-is, the save is refused and the form shows this error listing the affected key names:
+
+```text
+The connection destination changed, so stored secrets are not sent to it. Re-enter these values in the same edit: GITHUB_TOKEN, X-API-Key
+```
+
+The same edit also revokes every member's credential for this server: member authorization (key) needs the key again, and member authorization (OAuth) needs a fresh authorization. The revocation happens before the save, so a save that ultimately fails can still cost members one more authorization. Replacing only the OAuth metadata (the value that names the token endpoint), through the API, does not require re-entering shared credentials, but it still revokes members' credentials; emptying that value only triggers rediscovery from the unchanged endpoint and revokes nothing.
+
+### How protected values are shown
+
+Protected values (environment variable and Header names that match those rules) always come back as the fixed mask `****`, with no first or last characters revealed; sending `****` back means "keep the stored value". Members who can view but not edit the server see less of the connection config: **args** are not returned at all, and the **endpoint** (plus a proxy address set through the API) comes back with any `user:password` removed and every query-string value replaced by `****`; an endpoint that cannot be parsed is left empty. Editors see the endpoint and args as entered.
+
 ## Management & inspection
 
 The MCP list shows each server you added with its name and description, scope (Shared or team), transport and enabled state. You can filter by All / Shared / Team and search by name, description, transport or URL. The built-in Flashduty MCP server is not listed.

diff --git a/en/changelog/changelog.mdx b/en/changelog/changelog.mdx
@@ -4,6 +4,18 @@ description: "This page documents important updates and feature releases for Fla
 keywords: ["Changelog", "Product Release", "Feature Updates", "Flashduty", "Version History"]
 ---
 
+<Update label="2026-10-20" description="📋 Table and card views for routing rules, and connector credentials no longer follow a changed destination">
+
+### Routing rules in a table or card view
+
+The routing-rule list now offers two presentations, chosen at the top right: **table** and **card**. Cards are laid out in routing order; the number at a card's top right turns into a drag handle on hover, and dropping it on another card reorders the rules exactly like dragging the order column in the table. Each card keeps the **more actions** (⋯) menu. In the card view the **View** menu gains an **Last modified** switch that hides that line at the bottom of each card. The choice is remembered per member: reloading the page, opening another tab, or switching to another collaboration space shows the last view you picked. See [Routing rules](/en/on-call/channel/escalation-rule).
+
+### Connector credentials no longer follow a changed destination
+
+The people who can edit an MCP server or an A2A agent are not necessarily the people who enter its credentials, so a credential only holds for the destination it was entered for. Changing an MCP server's **transport / command / args / URL**, or an A2A agent's **Card URL**, moves the destination: every shared secret already stored in the config must be typed again in the same edit, otherwise the save fails and lists the keys to re-enter; every member's per-user credential is revoked at the same time, so each member re-enters their key or authorises again against the new destination. Replacing only the OAuth metadata revokes members' per-user credentials alone. Protected values in lists and detail pages are now shown as a plain `****` with no leading or trailing characters, and a member who can view but not edit also loses the MCP args and sees the credentials and every query value in a URL masked. See [MCP](/en/ai-sre/mcp) and [Agent](/en/ai-sre/agents).
+
+</Update>
+
 <Update label="2026-10-19" description="📊 RUM custom dashboards, a redesigned template detail page with send test, native Feishu tables, hosted access domains for WeCom apps, Feishu apps created by QR code">
 
 ### RUM custom dashboards: build your own under Insights

diff --git a/en/monitors/alert-rules/investigation-entries.mdx b/en/monitors/alert-rules/investigation-entries.mdx
@@ -27,7 +27,7 @@ A rule can hold many investigation entries. Each entry has three parts: the entr
 | Entry type | Button | Jumps to | Notes |
 |---------|------|--------|------|
 | **Dashboard entry** | Add dashboard entry | The dashboard viewer | Can target the whole dashboard, a tab, a section or a panel, and sets the values of that dashboard's template variables |
-| **Query entry** | Add query entry | The Query Workbench | Stores one editable initial query (query type + query + query parameters) and optionally the data source it runs on |
+| **Query entry** | Add query entry | The Query Workbench | Stores one editable initial query (query type + query + minimum step + query parameters) and optionally the data source it runs on |
 
 Neither type supports runbooks, tickets or arbitrary URLs.
 
@@ -83,7 +83,8 @@ Time range semantics:
 | **Data source** | Defaults to `Alert event datasource` (the query is written against the rule's data source type); you can also pick a specific data source. When the rule's data source type is not queryable in the workbench, the `Alert event datasource` option is disabled and labelled `Alert event datasource (not supported for this rule type)`, so the entry must name a data source explicitly. **Changing the data source resets the query**, because the query language changed |
 | **Query type** | Only shown for data sources with more than one query type (Prometheus: Graph only / Raw only; Loki: Range / Instant; VictoriaLogs: Raw logs / Instant stats / Range stats). Prometheus "Graph + Raw" is not offered here because it is two executions and cannot be stored as one query. SQL-type data sources, SLS and Tencent CLS each have a single query mode and therefore no such row |
 | **Initial query** | The query editor, with the same syntax and completion as the Query Workbench. The whole expression is rendered as a Go template and inserted **verbatim — no automatic quoting or escaping** |
-| **Query parameters** | The data source's named parameters, per data source type (Limit, Direction, Min step (s), the SLS project / logstore, the Tencent CLS region / topic / syntax). Parameter values are **not templated**; a `{{` is rejected (`query args do not support templates`) |
+| **Minimum step** | Only for Prometheus / Loki when **Query type** is a range query; in seconds, minimum 1. It is the lower bound on the query step: the backend still derives the step from `max_data_points` but never goes below this value. Leave it empty for no lower bound |
+| **Query parameters** | The data source's named parameters, per data source type (Limit, Direction, the SLS project / logstore, the Tencent CLS region / topic / syntax). Parameter values are **not templated**; a `{{` is rejected (`query args do not support templates`) |
 
 With the event data source selected, a rule type that the workbench does not support shows `Choose a datasource type under "Datasource and query" first, or pick a datasource for this entry`; an explicitly selected data source that was deleted or that you cannot use shows `The selected datasource is unavailable`. The data source's real type, permissions and provider-specific restrictions are re-checked by the workbench as the current user when the entry is opened or run.