diff --git a/en/ai-sre/agents.mdx b/en/ai-sre/agents.mdx
index 4c21e4084..8141034c1 100644
--- a/en/ai-sre/agents.mdx
+++ b/en/ai-sre/agents.mdx
@@ -22,7 +22,7 @@ sidebarTitle: Agent
 
 Delegation doesn't make you wait. After AI SRE delegates a task to a remote agent, the conversation continues immediately. You can keep working or delegate several tasks at once. When the remote agent finishes, its result appears in the conversation as a new message.
 
-Each A2A delegation appears in the conversation stream as a **task card** carrying an `A2A` badge. The card shows the remote agent name, task intent, run status, and usage metrics such as tool call count, tokens, and elapsed time. The run status is one of: initializing, in progress, awaiting input, awaiting authorization, completed, failed (including orphaned), interrupted, or killed. Click the card to view the full delegation trace in the right-hand panel.
+Each A2A delegation appears in the conversation stream as one line: a bot glyph, the label "Dispatched [remote agent name]", and the task intent, with the run status and usage metrics such as tool call count, tokens, and elapsed time on the right. The run status is one of: initializing, in progress, awaiting input, awaiting authorization, completed, failed (including orphaned), interrupted, or killed. Click the line to view the full delegation trace in the right-hand panel; the `A2A` badge sits on that panel's header, not on the line.
 
 <Tip>
 **The instructions decide whether AI SRE picks this agent.** Before delegating, AI SRE sees only one `name: summary` line per agent and uses it to decide. The summary comes from the `summary:` line at the top of the instructions. The body is delivered in full only on the first delegation, so it can be long and detailed. See [Writing Instructions](#writing-instructions).
@@ -293,7 +293,7 @@ The platform ships several **bootstrap Subagents** that work out of the box:
 | `general` | General-purpose worker with full tool access. Use it to offload work whose intermediate steps would otherwise pollute the parent's context (long reports, multi-file edits, end-to-end builds, repeated probing). Dispatch several in parallel for independent units of work |
 | `explore` | Read-only investigator restricted to `grep` / `glob` / `read`; it cannot write or execute. Returns a compact summary rather than raw search output — ideal for locating evidence inside a codebase or knowledge dump |
 
-**In the conversation**: each dispatch also appears as a **task card** with the same statuses as an A2A delegation. Its badge reads `Agent` instead of `A2A`. The card also shows the **execution environment** of the dispatch (the cloud environment or the BYOC Runner's name) — see "Dispatch target environment" below.
+**In the conversation**: each dispatch also appears as one line, with the same statuses as an A2A delegation — a bot glyph, the label "Dispatched [subagent name]" (written `subagent` when the name is a type synonym such as `agent` / `general`), and the task intent, with right-aligned mono meta naming the dispatch's **execution environment** (the cloud environment or the BYOC Runner's name) plus that run's usage and status. Click the line to view the full trace in the right-hand panel; the `Agent` badge (`A2A` for an A2A delegation) sits on that panel's header. See "Dispatch target environment" below.
 
 **Runtime limits**:
 
@@ -304,7 +304,7 @@ The platform ships several **bootstrap Subagents** that work out of the box:
 
 - **Omitted (the default)**: the subagent runs in the **same** environment as the current session and **shares its filesystem** — it can read your workspace's files directly. Naming the environment the session is *already* in (say, passing `cloud` from a cloud session) has the same result: an inheritance, not a second sandbox.
 - **`cloud`**: runs in a **fresh cloud environment** — an ephemeral container with its own filesystem and the account's default egress policy.
-- **A BYOC Runner's environment_id**: runs on **that Runner**. The selectable targets are **account-scope Runners** plus the Runners of the **team the session is bound to**, and online ones only. Naming an unusable Runner (offline, nonexistent, or belonging to another team) makes the dispatch fail with the reason. It is never re-routed elsewhere.
+- **A BYOC Runner's environment_id**: runs on **that Runner**. The candidates are **account-scope Runners** plus the Runners of the **team the session is bound to**. This list does not distinguish whether a Runner is online right now: every Runner that has **connected at least once** is listed (including one that is offline right now), and only a Runner that has **never connected** (`pending`) is left out — whether it is actually reachable is checked at dispatch time. Naming an unusable Runner (offline, nonexistent, or belonging to another team) makes the dispatch fail with the reason. It is never re-routed elsewhere.
 - **Subagents only**: passing `environment` for an A2A Agent is rejected — a remote agent executes in its own environment and has no placement to choose. To move work to another environment, dispatch a Subagent.
 
 **A cross-environment dispatch cannot read the parent's files**: a child session shares the parent's sandbox / workspace only when its execution environment is **exactly the same**. Dispatched to another environment, it gets **its own** sandbox or Runner scratch directory and **cannot see your (the parent's) files**. So put everything the subagent needs **in the prompt**: file contents, paths, parameters, and constraints. Don't write "read file x in the workspace." Results come back as **text** or through an external system such as git or a ticket. See [Environments (BYOC)](/en/ai-sre/environments) for how the environments themselves differ and how to pick one.
@@ -313,7 +313,7 @@ The platform ships several **bootstrap Subagents** that work out of the box:
 
 <CardGroup cols={2}>
   <Card title="Console Chat" icon="comments" href="/en/ai-sre/sessions">
-    Observe A2A delegation task cards and their sub-session panels within a session.
+    Observe A2A delegations and their sub-session panels within a session.
   </Card>
   <Card title="MCP (External Tools)" icon="plug" href="/en/ai-sre/mcp">
     Connect external tools to agents to expand their capability boundary during tasks.
diff --git a/en/ai-sre/automations.mdx b/en/ai-sre/automations.mdx
index 022c01c55..908015f8e 100644
--- a/en/ai-sre/automations.mdx
+++ b/en/ai-sre/automations.mdx
@@ -40,6 +40,8 @@ The page header offers two ways to create a rule. **Create via chat** opens a se
 
 Either entry point leads to the same configuration form.
 
+A preset template can also be **opened from another page by link**: a link of the form `/ai-sre/automations/new?template=<key>` opens the create form with that template applied; if the link also carries `oncall_incident_channel_ids=<id>,<id>`, the **On-call incident trigger**'s channels are preselected and the form says the channels already follow the application's alert settings — review it and click **Create**. Such links are shareable and survive a reload; when the template key does not exist or the template fails to load, the form reports an error and opens blank.
+
 ## Configuration fields
 
 The configuration form has the following fields:
diff --git a/en/ai-sre/environments.mdx b/en/ai-sre/environments.mdx
index 361ceceb5..817a38cc3 100644
--- a/en/ai-sre/environments.mdx
+++ b/en/ai-sre/environments.mdx
@@ -73,6 +73,7 @@ Environment variables are visible in plaintext to everyone who uses this cloud e
 |---|---|
 | `FLASHDUTY_APP_KEY` / `FLASHDUTY_BASE_URL` | The Flashduty API credential and endpoint, used by the built-in `flashduty` skill and by the runtime. |
 | `FLASHDUTY_DOCS_URL` | The static address of the official docs bundle; the built-in `flashduty-docs` skill downloads its copy of the docs from here. |
+| `FLASHDUTY_CONSOLE_URL` | The console address. The agent expands it into the clickable absolute links it cites Flashduty resources with (incidents, alerts, channels, schedules, and so on). When no console address is configured the variable is not injected, and the agent cites resources by id in prose instead. It is non-sensitive — unlike `FLASHDUTY_APP_KEY`, the agent can read it. |
 | `GH_TOKEN`, the `GH_TOKEN_` prefix, `GH_PROMPT_DISABLED`, the `GIT_CONFIG_` prefix | The GitHub-side token and git configuration the platform injects (an account can have more than one GitHub App installation, so names such as `GH_TOKEN_1` and `GH_TOKEN_2` are reserved too). |
 | `PATH` / `HOME` | The runtime environment's base variables. |
 | `GITLAB_TOKEN`, `GITLAB_ACCESS_TOKEN`, `OAUTH_TOKEN`, `GITLAB_HOST`, `GL_HOST`, `GITLAB_URI`, `GITLAB_API_HOST`, `GITLAB_SSH_HOST`, `GITLAB_SUBFOLDER`, `CA_CERT`, `SKIP_TLS_VERIFY`, the `GLAB_` prefix | GitLab / `glab` authentication, host and TLS configuration, so sessions cannot bypass the bot identity the platform injects. |
diff --git a/en/ai-sre/im.mdx b/en/ai-sre/im.mdx
index 692e7666d..390c3a5d5 100644
--- a/en/ai-sre/im.mdx
+++ b/en/ai-sre/im.mdx
@@ -60,7 +60,7 @@ In a connected IM group with **Allow AI SRE conversations in IM** on, **@mention
     The platform distinguishes between **group @mentions** and **direct messages**. Once mentioned, AI SRE deduplicates the event, puts a "processing" receipt on that message (see [Processing Receipt](#processing-receipt)), and determines whether the message contains an imperative instruction.
   </Step>
   <Step title="Bind to a session">
-    AI SRE locates a session using "account + platform + chat" as the key: multiple @mentions within the same IM chat are routed to the **same agent session**, preserving context. For a new chat, the platform supplies the opening message of that IM thread and any associated incident as initial context.
+    AI SRE locates a session using "account + platform + chat" as the key: multiple @mentions within the same IM chat are routed to the **same agent session**, preserving context. For a new chat, the platform supplies the opening message of that IM thread and any associated incident as initial context. In a Feishu/Lark group with thread replies enabled, a new Thread session opened by a **top-level @mention** is also seeded with the group's messages from the **last 10 minutes** (up to that @mention) — that is how the error text or screenshot you posted just before the @mention gets into context. A Thread reply reads only its own Thread and never falls back to the group timeline.
   </Step>
   <Step title="Read context and reply">
     AI SRE reads the thread / chat history to build context, investigates autonomously, and posts its findings **in-thread**. Other people @mentioned in the original message are carried over into the reply, making it easy for multiple parties to collaborate in the group.
@@ -71,6 +71,23 @@ In a connected IM group with **Allow AI SRE conversations in IM** on, **@mention
 The **reply mode** is configurable (off / first / all), controlling whether AI SRE @mentions the person who asked, and whether it replies **in-thread** or in the main channel. In a busy large group, in-thread replies keep the investigation discussion focused without flooding the channel.
 </Tip>
 
+### Attachments and images
+
+AI SRE downloads the images, documents, and audio it sees in the chat and hands them to the agent as files — not only the attachments on **the message that @mentions the bot**, but also those on **earlier messages in the same thread / session**. This is built for the incident scene: when you post a screenshot of the error in the group and then add "@bot what is this about," the model receives that screenshot instead of unexplained text.
+
+Each summon has a per-kind attachment budget. **The current message's attachments take it first, and history fills the remainder starting from the newest message**:
+
+| Kind | Per-summon limit |
+| --- | --- |
+| Images | 5 |
+| Documents | 3 |
+| Audio | 3 |
+
+- **A history message is attached whole or not at all**: if a history message's attachments do not fit the remaining budget, none of them are attached rather than some of them, so the files the model sees always match the message text.
+- **Over-limit attachments are rejected**: a single attachment over 20 MiB, or a direct URL that is not HTTPS, is rejected and never handed to the agent.
+- **History attachments have a time budget**: one that has not finished downloading in about 5 seconds is shown to the model as "not attached" instead of being promised as a file — an old screenshot never stalls the investigation.
+- **Only your current message can stop the investigation**: if every attachment on it fails, AI SRE does not invoke the agent and instead replies "I could not process any of the attachments. Please try again, or send a smaller file." A failed history attachment never stops an investigation.
+
 ### Processing receipt
 
 Once the bot has your message, it first puts an emoji reaction on **the message you sent**, as an immediate "received, working on it" signal. The emoji is picked **at random** from that platform's own pool rather than being fixed. The pool keeps only glyphs that read as "received, working on it." The pool leaves out congratulatory, thumbs-up, heart, and smiley reactions. On a message that just arrived, they read as a verdict or as sarcasm:
@@ -79,7 +96,7 @@ Once the bot has your message, it first puts an emoji reaction on **the message
 | --- | --- |
 | Slack | eyes, thinking_face, hourglass_flowing_sand, mag, zap |
 | Lark / Feishu | Typing, THINKING, Get, OnIt |
-| DingTalk | Platform built-in emotions: 思考, 收到, Get |
+| DingTalk | Platform built-in emotions: 思考, 收到 |
 
 On Slack this sits alongside a native "is working on it" status, which the bot also shows.
 
diff --git a/en/ai-sre/mcp.mdx b/en/ai-sre/mcp.mdx
index 69f7e535d..6ed08b764 100644
--- a/en/ai-sre/mcp.mdx
+++ b/en/ai-sre/mcp.mdx
@@ -76,10 +76,13 @@ Row names share a namespace with template names: if a system already has a templ
 
 ## Adding an MCP server
 
-Go to **Customize → Plugins → MCP**. The list page has two entries in the top-right corner:
+Go to **Customize → Plugins → MCP**. The list page has three entries in the top-right corner:
 
-- **Add MCP**: opens a form for defining an MCP server by hand (its fields are listed under "Basic Fields" below).
+- **Add from catalog**: jumps to **Customize → Plugins → Overview** (the plugin catalog — see "Installing MCP servers from the marketplace" above), where you pick and install a built-in MCP template; it then shows up in this list. Like the other two buttons, it requires MCP create permission.
 - **Add in chat**: opens a session with a prefilled prompt. The agent asks whether you want to connect your own service or install an existing one, checks the plugin catalog first, and searches the web for candidates if nothing matches. The button appears only when the target scope is unambiguous (you have account-level permission, or exactly one of your teams is selected).
+- **Add MCP**: opens a form for defining an MCP server by hand (its fields are listed under "Basic Fields" below).
+
+When the list is empty (no servers configured and no active search), the page shows how many built-in MCP templates the plugin catalog holds — "The plugin catalog has N built-in MCP servers. Install one to use it in sessions." — and offers a **Browse built-in MCP servers** button that jumps there (that button appears only with create permission). The plain "No MCP servers configured. Click the button above to add one." message appears only when the catalog itself is empty or a search is active.
 
 ### Basic fields
 
@@ -207,7 +210,7 @@ An MCP server may be bound to execution environments **other than the current se
 
 - The agent sees the connector's name, purpose and available environments, and asking for it by name gets an explanation rather than "not found".
 - The agent dispatches a subagent into the target environment to call it (see [Agents](/en/ai-sre/agents)) and brings the result back to the conversation.
-- Only **online** account-level Runners, Runners of the team bound to the session, and the bound cloud environment are valid targets. For others the agent explains it cannot use them right now.
+- The targets are **account-level Runners**, the Runners of the team bound to the session, and the bound cloud environment. This list does not distinguish whether a Runner is online right now: a Runner that has **connected at least once** (including one that is offline right now) is marked available, and only a Runner that has **never connected** (`pending`) is marked unavailable, with the agent explaining that it cannot be used yet. An offline Runner therefore stays a candidate and only fails at dispatch time with the environment-unavailable reason.
 - Only the main session can dispatch this way; subagents cannot dispatch further.
 
 Conversely, to make a connector directly usable **here**, add the current environment to that server's Execution Environment list (provided the server is reachable from this session). See [Environments (BYOC)](/en/ai-sre/environments) for how the environments themselves differ.
diff --git a/en/ai-sre/sessions.mdx b/en/ai-sre/sessions.mdx
index 595281687..1e3c1b53b 100644
--- a/en/ai-sre/sessions.mdx
+++ b/en/ai-sre/sessions.mdx
@@ -171,7 +171,7 @@ Only the console shows the connection card. In IM and API sessions the agent pos
 
 ### Subagents
 
-When the agent delegates work, a subagent line appears in the conversation. It shows the type (Agent / A2A), name, execution environment, status, and duration. After the run, it also shows tool calls, token usage, and any failure reason. Click it to open the subagent session side by side; it can be expanded to full screen.
+When the agent delegates work, a subagent line appears in the conversation. It shows the name, execution environment, status, and duration; the line itself carries no type badge — the type (Agent / A2A) is labelled on the subagent panel's header. After the run, it also shows tool calls, token usage, and any failure reason. Click it to open the subagent session side by side; it can be expanded to full screen.
 
 A subagent may also need you:
 
@@ -180,6 +180,8 @@ A subagent may also need you:
 
 Stop subagents from the task panel. A subagent whose executor was lost shows as **Failed**; one terminated by the platform shows as **Killed**.
 
+A subagent can also **report progress to the parent agent** while it runs (a cross-agent `agent_message`). Such a report appears in the main conversation as a **Subagent report** line: collapsed it shows only a bot glyph and that label, and clicking it expands the full text — the expanded block leads with the reporting subagent's name (type names such as `agent` and `general` are dropped) and renders the body as an Output block. While the subagent is still running, the same report first appears as a **Subagent report** line under the subagent reference line for that dispatch; once the durable row lands, that live echo disappears, so the same report never shows twice. After a page reload only the durable rows remain — live echoes are not replayed.
+
 ### Task panel and background tasks
 
 Besides subagents, the agent can run long commands in the background (builds, bulk data pulls) or start monitors that watch a condition until it is met or a deadline passes.
diff --git a/en/ai-sre/skills.mdx b/en/ai-sre/skills.mdx
index f1dde0f4b..732199372 100644
--- a/en/ai-sre/skills.mdx
+++ b/en/ai-sre/skills.mdx
@@ -134,7 +134,10 @@ Updating a modified skill **overwrites your local changes with the latest Market
 
 ## Custom Skills
 
-In addition to installing from the Marketplace, you can upload your own skill packages. On the skill list page, click **Upload Skill** and fill in the form:
+In addition to installing from the Marketplace, you can upload your own skill packages. The skill list page's toolbar offers two entries:
+
+- **Add from catalog**: jumps to the **Skill** category of **Customize → Plugins → Overview** — the plugin catalog described under "Install from marketplace" above (it shares its page with the MCP templates; see [MCP](/en/ai-sre/mcp)) — where you pick and install a built-in skill template, and it then shows up in this list. Like **Upload Skill**, it requires upload permission.
+- **Upload Skill**: opens the upload form, where you fill in:
 
 | Field | Type | Required | Description |
 | --- | --- | --- | --- |
@@ -143,6 +146,8 @@ In addition to installing from the Marketplace, you can upload your own skill pa
 
 At upload time, the system validates the package. The archive must be a valid zip with `SKILL.md` in the root directory and parseable frontmatter. `name` must follow the naming rule: start with a letter, use only letters/digits/`-`/`_`, and be 1–64 characters. All declared tools must be valid, meaning the built-in tools and MCP servers exist. **Skill names must be unique within a team** — a duplicate name within the same team is rejected with a prompt to choose a different name. Different teams may each own a skill with the same name.
 
+When the list is empty (no skills yet and no active search), the page shows how many built-in skill templates the plugin catalog holds — "The plugin catalog has N built-in skills. Install one to use it in sessions." — and offers a **Browse built-in skills** button that jumps there (that button appears only with upload permission). The plain "No skills yet. Click Upload skill to add one." message appears only when the catalog itself is empty or a search is active.
+
 <Note>
 The system reads all metadata other than the skill name from the `SKILL.md` frontmatter, including description, version, tags, author, and tools. You don't enter it in the form.
 </Note>
diff --git a/en/changelog/changelog.mdx b/en/changelog/changelog.mdx
index 0000b1ec0..b7a88161a 100644
--- a/en/changelog/changelog.mdx
+++ b/en/changelog/changelog.mdx
@@ -4,6 +4,28 @@ description: "This page documents important updates and feature releases for Fla
 keywords: ["Changelog", "Product Release", "Feature Updates", "Flashduty", "Version History"]
 ---
 
+<Update label="2026-10-12" description="🤖 One-click auto-analysis from a RUM Issue, AI SRE reads IM attachments, CLI gains a global field-projection flag">
+
+### RUM issues: one-click auto-analysis
+
+The Issue detail page gains an **Auto-analyze** button in its top-right corner, shown when AI SRE is enabled for the account and you can create automation rules: it opens the AI SRE automation create form prefilled with the preset template "RUM Issue Incident Analysis" (`rum_issue_incident_analysis`), with the channels already picked from that application's alert settings — confirm and click **Create**, and the automation analyzes the incidents the application's issue alerts raise from then on.
+
+The automation is triggered by incidents, so the application has to be able to raise them first. When you click the button, RUM reads the application's alert settings: it jumps straight to the create form only when alerting is on, delivery is set to a **Flashduty channel**, and at least one channel is selected; otherwise it tells you to finish the alert setups first and goes to the application's **Alert Settings** tab. See [Issue overview and details](/en/rum/error-tracking/error-viewing#header-actions).
+
+### AI SRE reads IM attachments
+
+AI SRE downloads the images, documents, and audio in the chat and hands them to the agent as files — not only those on **the message that @mentions the bot**, but also those on **earlier messages in the same thread / war room**: post a screenshot of the error and then add "@bot what is this about," and the model receives that screenshot instead of unexplained text.
+
+Each turn's budget is counted per kind, with the current message's attachments taking it first and history filling the remainder from the newest message back: **5 images, 3 documents, 3 audio**. A single attachment over 20 MiB, or a direct URL that is not HTTPS, is rejected; history attachments also have a download budget of about 5 seconds, and one that has not finished is treated as not attached, so an old screenshot never stalls the investigation. See [IM Integration · Attachments and images](/en/ai-sre/im#attachments-and-images).
+
+### CLI: global `--fields` projection
+
+The CLI gains a global `--fields` flag: in `json` / `toon` output it keeps only the named top-level fields (comma-separated), applied to each row of a list or to a single record, and **every command accepts it, the OpenAPI-generated ones included**; where a command declares its own `--fields` (`incident list`, `alert-event list` and the other commands with a default compact projection), that one wins.
+
+Table output ignores the flag and a stderr note says so; a name that matches no key anywhere in the response is reported on stderr together with the keys the output does carry; output that is neither an object nor a list of objects fails the command. See [CLI](/en/developer/cli).
+
+</Update>
+
 <Update label="2026-10-09" description="📊 Dashboard built-in time variables and display time zone, RUM Explorer analytics, OAuth for MCP Server and the Go SDK">
 
 ### Dashboards: built-in time variables and display time zone
diff --git a/en/developer/cli.mdx b/en/developer/cli.mdx
index 5e08a17a5..7d0d36fb1 100644
--- a/en/developer/cli.mdx
+++ b/en/developer/cli.mdx
@@ -94,14 +94,16 @@ flashduty config set base_url URL  # Override the API endpoint
 
 ## Global flags
 
-All subcommands accept these flags:
+These flags are registered on the root command; every subcommand accepts them except `--version`:
 
 | Flag | Description |
 |------|-------------|
 | `--output-format` | Output format: `table` (default), `json`, or `toon` (compact, token-efficient) |
 | `--json` | Alias for `--output-format json`; emit JSON for parsing with `jq` or similar tools |
 | `--no-trunc` | Disable column truncation in table output |
+| `--fields` | In `json`/`toon` output, keep only the named top-level fields (comma-separated): each row of a list, or the keys of a single record. Table output ignores it and a stderr note says so; a name that matches no key is reported on stderr together with the keys the output does carry, and output that is neither an object nor a list of objects fails the command. See "Field projections for structured output" below |
 | `--base-url` | Override the API endpoint (for private deployments) |
+| `--version` | Print the version — the same single line as `flashduty version`. That meaning exists only on the root command; a command that defines its own `--version` (for example the optimistic-locking version on mutating verbs) follows its own description |
 
 ## Command catalog
 
@@ -116,7 +118,7 @@ flashduty incident ack <id> [<id2>...]   # Acknowledge incidents
 flashduty incident close <id> [<id2>...] # Close (resolve) incidents
 flashduty incident merge <target-id> --source <ids> # Merge incidents into a target incident
 flashduty incident timeline <id>         # View an incident timeline
-flashduty incident alerts <id>           # List alerts associated with an incident
+flashduty incident alerts <id>           # List alerts associated with an incident (--limit default 10, --page)
 flashduty incident similar <id>          # Find similar historical incidents
 flashduty incident feed <id> [flags]    # View an incident's paginated feed (timeline entries)
 ```
@@ -141,7 +143,7 @@ Common filter flags for `incident list`:
 | `--is-rare` | Only outlier incidents | `false` |
 | `--is-snoozed` | Only snoozed incidents | `false` |
 | `--ever-muted` | Only incidents that were ever silenced | `false` |
-| `--since` | Start time (duration, date, datetime, or unix timestamp); the `--since` to `--until` window must be under 31 days | `24h` |
+| `--since` | Start time (duration, date, datetime, or unix timestamp); the `--since` to `--until` window must be under 31 days | `24h` (`30d` when `--progress` lists only `Triggered,Processing`) |
 | `--until` | End time | `now` |
 | `--asc` | Sort ascending (oldest first) | `false` (newest first) |
 | `--limit` | Max results (max 100) | `20` |
@@ -151,6 +153,8 @@ Time format examples: `5m`, `1h`, `24h`, `168h`, `2026-04-01`, `2026-04-01 10:00
 
 `incident feed <id>` reads an incident's feed (timeline entries) page by page. `--asc` lists the oldest entries first (the default is newest first). `--types` filters by comma-separated entry types, for example `i_comm,i_assign`; each entry's `type` field gives its actual type. `--limit` (max 100) and `--page` paginate the result.
 
+`incident alerts <id>` lists the alerts attached to that incident; `--limit` defaults to `10` and `--page` starts at `1`.
+
 #### Create, update, and merge
 
 `incident create` requires `--title` (3–200 characters) and `--severity`, and prompts for missing values in a terminal. There are three ways to assign people, which can be combined: `--assign` (member IDs), `--assign-emails` (member emails, comma-separated; emails that match no member are ignored), and `--escalate-rule-id` with `--escalate-layer` (assign the people at that zero-based layer of the escalation rule; `--escalate-layer` requires `--escalate-rule-id`).
@@ -685,8 +689,9 @@ This command only reads the value set of one label; to fetch time series from an
 ### alert — Alert and alert-event queries
 
 ```bash
-flashduty alert list [flags]        # List alerts (default: last 24h)
+flashduty alert list [flags]        # List alerts (default: last 24h; 30d with --active)
 flashduty alert get <alert_id>      # Get full detail of one alert; detail is an alias
+flashduty alert events <alert_id>   # List the raw events that make up one alert (--limit, --page)
 flashduty alert-event list [flags]  # List alert events (default: last 1h)
 ```
 
@@ -699,6 +704,10 @@ Common filter flags for both `list` commands: `--severity` (`Critical,Warning,In
 - `--asc`: sort oldest first by start time (the default is newest first).
 - `--by-updated-at`: apply `--since`/`--until` to the last-updated time instead of the start time. `alert-event list` also supports `--asc` (oldest first; newest first by default), but has no `--by-updated-at` counterpart.
 
+`alert list` also filters by state through `--active` (active alerts only) and `--recovered` (recovered alerts only). They are mutually exclusive — passing both is an error — and passing neither applies no state filter. Active alerts can be older than a day, so with `--active` and no `--since` the window widens to 30 days by default (the window actually sent is reported by the stderr note).
+
+`alert events <alert_id>` lists the raw events that make up one alert: leave `--limit` unset to take the server default of 20 (max 100), and `--page` starts at 1. It reads events for a single alert; for a time-window query across alerts use `alert-event list`.
+
 ### automation — AI SRE automation rules
 
 The `automation` command group manages AI SRE automation rules — create, query, update, delete, run history, and triggering. See [Automations](/en/ai-sre/automations) for the console workflow.
@@ -908,6 +917,14 @@ Table view with no column truncation — useful for copy-paste or wide terminals
 </Tab>
 </Tabs>
 
+### Time-window note
+
+Commands that query a time range print the window they actually sent to stderr in the local timezone, for example `note: window 2026-10-08T14:00:00+08:00..2026-10-09T14:00:00+08:00 (1d, ended now)`. The parenthesised part carries the span and where the end sits relative to now (`ended 3m ago` / `ends in 2h`); when the window comes from a default rather than from `--since`/`--until` you typed, the note names that default (an `--progress` filter of open states only, or `--active`).
+
+This covers `incident list`, `alert list`, `alert-event list`, `change list`, `audit search`, `insight`, `oncall`, `monit-query` (when its tool params carry an execution window), and every generated command whose `--start-time`/`--end-time` resolve. A command that leaves one side to `--data` or to the server default prints no note, because the window was never fully resolved by the CLI. A query with a single evaluation timestamp reads `note: instant <time> (…)` instead.
+
+Use it to catch a window you did not intend: a default wider than you expected (`--active` widens it to 30 days), or an epoch read in the wrong timezone, which lands the window in the future and reads `ends in 7h`. The note goes only to stderr, so stdout stays byte-identical for `jq` and toon consumers.
+
 ### Generated-command output bound
 
 Generated commands (the ones covering the OpenAPI through the code generator, such as `safari session-list`, `monit datasource-list`, `safari a2a-agent-list`) apply a 16 KiB bound to **list-shaped** responses in `json`/`toon` mode. The reduction has three tiers, plus a machine-readable marker:
@@ -919,15 +936,17 @@ Generated commands (the ones covering the OpenAPI through the code generator, su
 **A reduced list envelope is rebuilt with the reduction written into the payload.** A list envelope is a response whose row array is named `items`, `docs`, or `list`, and whose other fields are all scalars (`total`, `has_next_page`, `search_after_ctx`, …). Examples are `monit datasource-list` and `safari session-list`. Once a reduction happens, the CLI rebuilds that envelope and adds fields to the payload, so a script sees the reduction without parsing stderr:
 
 - **Rows withheld**: the payload carries `truncated: true` together with `emitted_rows: N` (N is the number of rows actually emitted). The envelope's `total`, `has_next_page`, and `search_after_ctx` still describe the page as the server returned it. They **can't** tell you whether you got everything: a page cut to 7 of 100 rows keeps the original pagination fields. To collect all rows, re-request with a `--limit` no larger than the rows you actually received, then follow the returned cursor.
-- **Only long values clipped** (no rows withheld): the payload carries `truncated: true` alone, and stderr names the clipped fields. Re-requesting cannot restore them: narrow the filter, lower the rows per page, or switch to a curated command that supports field projections.
+- **Only long values clipped** (no rows withheld): the payload carries `truncated: true` alone, and stderr names the clipped fields. Re-requesting cannot restore them: narrow the filter, lower the rows per page, or keep only the fields you need with the global `--fields`.
 
 **Bare top-level arrays** (such as the curated `incident list` and `insight incidents`) have nowhere to carry the marker, so a reduction is announced on stderr only.
 
-**Detail-shaped single objects** (for example, `safari session-get`) are never bounded or shortened — a shortened id or status would pass for a real value, so these responses print untouched. Most generated commands have no flag that narrows their output. An occasional `--fields` selects request-body fields, not output fields. For complete JSON, lower `--limit` and page through with `--page` (for example, `flashduty safari session-list --limit 20 --page 2`), or narrow the filter.
+**Detail-shaped single objects** (for example, `safari session-get`) are never bounded or shortened — a shortened id or status would pass for a real value, so these responses print untouched. Generated commands can narrow their output fields with the global `--fields` (see "Global flags" and "Field projections for structured output" below; where an occasional command spells `--fields` as a request-body field selector, such as `monit rule-update-fields`, it does not apply to the output). For complete JSON, lower `--limit` and page through with `--page` (for example, `flashduty safari session-list --limit 20 --page 2`), or narrow the filter.
 
 ### Field projections for structured output
 
-The following commands support `--fields` with `json` or `toon` output. Supply comma-separated top-level response fields; an unknown field fails immediately, and table output ignores this flag.
+`--fields` is a global flag (see "Global flags"): every command accepts it in `json` or `toon` output, and it takes a comma-separated list of top-level fields to keep, applied to each row of a list or to the keys of a single record. The projection runs on the response: for a list envelope (row array named `items`, `docs`, or `list`, with only scalar paging fields beside it) it narrows that row array and leaves the paging fields intact; a field no row of the response carries is left out and stderr reports it as matching no key, listing the keys the output does carry; output that is neither an object nor a list of objects fails the command and tells you to drop `--fields`. Table output ignores `--fields`, and stderr says so.
+
+The curated commands in the table below fall back to a default compact projection when `--fields` is omitted, and are size-bounded; each of them defines its own `--fields` (same meaning as the global one), so a misspelled field name fails immediately and lists the names that are valid. Every other command — all the generated ones included — has no default projection: on those, `--fields` applies to the raw fields of the API response, and a name that matches no key only produces the stderr note above.
 
 | Command | Structured output when `--fields` is omitted | Limit |
 | --- | --- | --- |
diff --git a/en/monitors/dashboards/dashboards.mdx b/en/monitors/dashboards/dashboards.mdx
index 512d64693..29be4b1aa 100644
--- a/en/monitors/dashboards/dashboards.mdx
+++ b/en/monitors/dashboards/dashboards.mdx
@@ -195,8 +195,9 @@ Dashboards **cannot** be shared publicly or anonymously. Anyone opening a link m
 
 ## Fullscreen and query details
 
-Hover over a panel title to **Edit** (requires management permission), go **Fullscreen**, or **Retry**.
+Hover over a panel title to **Edit** (requires management permission), go **Fullscreen**, or **Refresh**.
 
+- **Refresh**: appears in the hover actions once the panel has finished loading. Click it to re-run that panel's queries immediately — any in-flight query for the panel is cancelled and the panel moves to the front of the query queue.
 - In fullscreen you can change that panel's time range without affecting the others.
 - In fullscreen you can **Copy panel link** or **Download data CSV**.
 - **Query details** lists each query's expression and status; **Open in query workbench** takes the current variables and time to the [Query workbench](/en/monitors/explore/explore) for debugging.
diff --git a/en/on-call/channel/integrate-data.mdx b/en/on-call/channel/integrate-data.mdx
index ed6d3e687..7f0303c4c 100644
--- a/en/on-call/channel/integrate-data.mdx
+++ b/en/on-call/channel/integrate-data.mdx
@@ -79,26 +79,28 @@ A shared integration needs at least one routing rule, or Flashduty drops its ale
 
 ## Browsing and finding integrations
 
-The Integration Center groups alert sources and change events by category. Narrow the list with a category chip, or search for the system you need.
+The Integration Center groups alert sources and change events by category. Browse the categories, or search for the system you need.
 
-The add-integration panel has one set of chips per tab, and each tab opens on its own default category:
+The add-integration panel has one set of categories per tab, and each tab opens with its own default category expanded:
 
-| Tab | Category chips (in display order) | Default category |
+| Tab | Categories (in display order) | Default expanded category |
 | :--- | :--- | :--- |
 | Alert Events | Generic, Popular, Cloud providers, Metrics & infrastructure, APM & observability, Event correlation & AIOps, Logs & error tracking, Security, Uptime & status pages, Jobs, delivery & app platforms, Network & hardware | **Popular** |
 | Change Events | Generic, CI/CD & deploy, Source control, Config & feature flags, Infrastructure & platforms | **CI/CD & deploy** |
 
 - Integrations without a category appear under **Uncategorized**. Empty categories don't appear.
-- By default the panel keeps only **All**, **Generic**, the tab's default category, and the currently selected category; the rest collapse into **More N**, which expands on click.
-- Search matches integration names and types across all categories, ignoring the selected chip, and lists hits under **Search results**. Clear the search to return to your selected category.
+- The panel renders one collapsible section per category. Only the tab's default category starts expanded, and the rest collapse until you click their titles. The search box placeholder shows how many integrations the panel covers.
+- Search matches integration names and types across every category: each category with hits stays on screen with its matching entries, the section header shows hits out of that category's total (for example, `3 / 12`), and the matching part of a name is highlighted. Search skips **Popular**, whose entries already live in their real categories.
+- When no category matches, the panel shows the **No results for "…"** empty state: the Alert Events tab also offers **Standard alert event** (which connects any system through a Webhook), and every tab can use **Request an integration**. The search term is carried into the request form as the system name.
 
 ### All integrations catalog
 
-Clicking the **All** chip opens a full-screen catalog:
+Clicking the **View all** button next to the search box opens a full-screen catalog:
 
-- The number next to the title is how many integrations the catalog covers, and the search box at the top searches all of them.
+- The search box at the top searches all of them, and its placeholder shows how many integrations the catalog covers.
 - The category rail on the left lists every category with its entry count; clicking one scrolls the right side to that category (and clears the search).
-- The right side lists systems by category; click **Add** to open the new-integration page for that system.
+- The right side lists systems by category, with each section header showing that category's entry count; hovering a card reveals a **+** icon in its top-right corner, and clicking the card opens the new-integration page for that system.
+- Searching inside the catalog groups the hits by category as well, with each section header showing hits out of that category's total; when no category matches, the catalog shows the **No results for "…"** empty state without repeating the buttons, since the fallback area below already offers them.
 
 At the bottom the catalog keeps a "Can't find your system?" fallback area with two ways out: connect it with a generic integration, or request an integration.
 
diff --git a/en/on-call/incident/search-view-incident.mdx b/en/on-call/incident/search-view-incident.mdx
index ae81fbb15..de4683d19 100644
--- a/en/on-call/incident/search-view-incident.mdx
+++ b/en/on-call/incident/search-view-incident.mdx
@@ -249,14 +249,16 @@ The timeline records every operation on [action items and follow-ups](/en/on-cal
 <Accordion title="Event type reference">
 | Event Type | Timeline Record |
 | :--- | :--- |
-| `i_wi_created` | Created action / Created follow-up |
+| `i_wi_created` | Created action / Created follow-up, followed by ", assigned to …" when the record carries assignees |
 | `i_wi_updated` | Updated action / Updated follow-up |
-| `i_wi_assignees` | Updated action assignees / Updated follow-up assignees |
+| `i_wi_assignees` | Updated action assignees / Updated follow-up assignees, likewise followed by ", assigned to …" when the record carries assignees |
 | `i_wi_completed` | Completed action / Completed follow-up |
 | `i_wi_converted` | Converted action to follow-up |
 | `i_wi_bound` | Linked follow-up to the post-mortem |
 | `i_wi_auto_converted` | Converted N unfinished actions to follow-ups: title, title… (a batch conversion on incident close; one record summarizes all items) |
 | `i_wi_deleted` | Deleted action / Deleted follow-up |
+
+After "assigned to" comes the record's assignees: when they are all members, each is listed as an avatar plus a name; when AI SRE is among them, the record switches to a joint signature — member names separated by commas, closing with "and AI SRE" (for example, "John, Jane and AI SRE"). When the record carries no assignees at all, these two events show only the first half of the sentence.
 </Accordion>
 
 ### AI SRE action records
diff --git a/en/on-call/incident/work-items.mdx b/en/on-call/incident/work-items.mdx
index 1818c58b6..c475560fb 100644
--- a/en/on-call/incident/work-items.mdx
+++ b/en/on-call/incident/work-items.mdx
@@ -35,10 +35,22 @@ In the **Actions** card on the incident overview page, click **Add an action** (
 | :--- | :---: | :--- |
 | **Title** | Yes | A brief description of the work to be done, up to **512** characters |
 | **Description** | No | Additional details about what needs to be done, up to **65535** characters |
-| **Assignees** | No | Search and multi-select from account members; no limit on the number |
+| **Assignees** | No | Search and multi-select from account members; no limit on the number. You can also pick the **AI SRE** option pinned at the top of the list (sub-label **Assign to AI**) to hand the item to the account's AI SRE |
 
 Once created, the action item appears in the card and the incident timeline records an "action created" event. Members assigned as assignees receive a personal notification prompting them to follow through (sent through **email and in-app push** by default; you can adjust notification channels in [Personal Settings](/en/on-call/configuration/personal-settings)).
 
+### Assigning to AI SRE
+
+The assignee picker pins **AI SRE** above the member list, separated from it by a divider, with **Assign to AI** as its sub-label. Search never filters it out, so it stays in the results whatever you type. Selecting it hands the item to the account's AI SRE, and you can keep member assignees alongside it; in the input box the selection shows as an **AI SRE** chip without the sub-label. Action items and follow-ups share the same create/edit dialog, so the field behaves the same for both.
+
+- The card shows the assignment as an **AI SRE** avatar next to the member avatars (up to 2 avatars, with the rest collapsed into `+N`)
+- Hovering the AI SRE avatar opens a hover card: it names the member whose identity and permissions the AI SRE is acting with, and offers **Continue conversation**, which opens the session behind this run in the AI SRE panel
+- When the run came from an IM session, the hover card only says **IM sessions can't be viewed on the web yet** and offers no entry point
+- Opening the session requires AI SRE to be enabled for the account and AI SRE chat permission for you; personal sessions (visible only to their creator) and expired sessions can't be continued
+- On the incident timeline, this work item's record lists the assignees with a joint signature (for example, "John and AI SRE")
+
+To filter work items by assignee kind — for example to list everything handed to AI SRE — use `flashduty incident work-item-list --assignee-type ai_sre` in the [CLI](/en/developer/cli).
+
 ### Edit and delete
 
 - Members with incident update permission can click the item title, or use **Edit** in the **More** menu, to change the title, description, or assignees
@@ -81,6 +93,8 @@ Access to action items and follow-ups follows these rules:
 
 Access to action items also follows the incident's **collaboration space**. Only account owners, account admins, and members with access to that space can work on them. Manual incidents without a collaboration space are visible to all account members. This matches the access rules of the incident itself.
 
+**Assignees** in the table above means account members. A work item assigned to **AI SRE** is executed by the AI rather than being someone's own item: AI SRE is not an account member, so the member-facing completion permission and personal notification above don't apply to it (when the same item also has member assignees, those members are notified as usual). To list the work items assigned to AI SRE on their own, use `flashduty incident work-item-list --assignee-type ai_sre` in the [CLI](/en/developer/cli).
+
 ## Closed incidents
 
 Once an incident is closed, the Actions card becomes read-only while the Follow-ups card unlocks for editing:
diff --git a/en/rum/error-tracking/error-viewing.mdx b/en/rum/error-tracking/error-viewing.mdx
index d63c7d9f1..809080d28 100644
--- a/en/rum/error-tracking/error-viewing.mdx
+++ b/en/rum/error-tracking/error-viewing.mdx
@@ -279,6 +279,17 @@ Click any Issue to open the details panel and view more information.
   </Accordion>
 </AccordionGroup>
 
+### Header actions
+
+The Issue detail panel has two AI SRE buttons in its top-right corner, shown only when AI SRE is enabled for the account:
+
+| Button | Shown when | What it does |
+|--------|------------|--------------|
+| **Auto-analyze** | The member can create AI SRE automation rules | Opens the AI SRE automation create form, prefilled with the preset template "RUM Issue Incident Analysis" (`rum_issue_incident_analysis`) and the application's alert channels; once saved, that automation analyzes the incidents this application's issue alerts raise |
+| **AI fix** | The member can access AI SRE sessions | Opens an AI SRE session with the Issue attached as a reference tag, see [Sessions · Attachments and Context References](/en/ai-sre/sessions#attachments-and-context-references) |
+
+**Auto-analyze** is triggered by incidents, so the application has to be able to raise them first. When you click it, RUM reads the application's alert settings: it jumps straight to the create form only when alerting is on, delivery is set to a **Flashduty channel**, and at least one channel is selected — the channels are already picked from the application's alert settings, so confirm and click **Create**. Otherwise it shows "This application has no On-call alerting yet. Issues must raise incidents to trigger auto-analysis, so set up alerting first." and goes to the application's **Alert Settings** tab. For the template's contents and the form fields, see [Automations](/en/ai-sre/automations).
+
 ## Issue alerts
 
 Discover problems immediately when they occur, giving you the opportunity to proactively identify and fix them before they become severe.
diff --git a/en/rum/error-tracking/issue-alerts.mdx b/en/rum/error-tracking/issue-alerts.mdx
index 1cb0d45a1..afd8cbb8d 100644
--- a/en/rum/error-tracking/issue-alerts.mdx
+++ b/en/rum/error-tracking/issue-alerts.mdx
@@ -195,6 +195,8 @@ RUM alerts work in deep collaboration with Flashduty, forming a complete alert p
 
 With Flashduty channel delivery, you can process RUM alerts further in the [Alert Pipeline](/en/on-call/integration/alert-integration/alert-pipelines). For example, adjust severity by affected user count, suppress repeated alerts in a time window, or customize alert titles. When you choose Webhook delivery, RUM alerts do not enter this On-call processing chain; handle payload transformation, routing, and notification in your receiver.
 
+The [Auto-analyze](/en/rum/error-tracking/error-viewing#header-actions) automation on the Issue detail page is triggered by incidents, and only Flashduty channel delivery raises incidents from issue alerts, so it applies only to applications that deliver to a channel: webhook delivery raises no incidents and cannot trigger the automation.
+
 ## Further reading
 
 <CardGroup cols={2}>
diff --git a/zh/ai-sre/agents.mdx b/zh/ai-sre/agents.mdx
index fac3a234f..228a8fe7b 100644
--- a/zh/ai-sre/agents.mdx
+++ b/zh/ai-sre/agents.mdx
@@ -22,7 +22,7 @@ sidebarTitle: Agent
 
 委派后无需等待：AI SRE 把任务交给远端 Agent 后会立即继续当前对话，您可以继续工作或同时委派多个任务；远端完成后，其结果作为一条新消息出现在对话中。
 
-每次 A2A 委派在对话流里以一张带 `A2A` 徽标的**任务卡片**呈现，显示远端 Agent 名、本次任务意图、运行状态（初始化 / 进行中 / 等待输入 / 等待授权 / 完成 / 失败（含孤儿任务）/ 中断 / 已终止）以及工具调用数、Token、耗时等用量；点击卡片可在右侧面板里查看该次委派的完整过程。
+每次 A2A 委派在对话流里以一行呈现：机器人图标 + “已派发〈远端 Agent 名〉”文案 + 本次任务意图，右侧显示运行状态（初始化 / 进行中 / 等待输入 / 等待授权 / 完成 / 失败（含孤儿任务）/ 中断 / 已终止）以及工具调用数、Token、耗时等用量；点击这一行可在右侧面板里查看该次委派的完整过程，`A2A` 徽标标在该面板标题上，不在对话流这一行上。
 
 <Tip>
 **调用说明决定 AI SRE 会不会选中这个 Agent。** 委派前，AI SRE 只看到清单里的一行 `名称：简介`（简介取自调用说明开头的 `summary:`），据此判断要不要派给它；正文只在首次委派时完整送达，可以写长写细。写法见[调用说明的写法](#调用说明的写法)。
@@ -293,7 +293,7 @@ A2A 与故障的**自动联动**仍在开发中：故障自动绑定尚未完整
 | `general` | 通用执行器，拥有完整工具权限，适合把中间步骤会污染主对话上下文的工作（长报告、多文件改动、端到端构建、反复探查）整体外包出去；可并行派发多个处理相互独立的工作单元 |
 | `explore` | 只读调查器，仅限 `grep` / `glob` / `read`，不能写入或执行；返回浓缩摘要而非原始搜索输出，适合在代码库或知识转储中定位证据 |
 
-**会话中的呈现**：每次派发在对话流里同样以一张**任务卡片**呈现，状态与 A2A 委派相同，但徽标是 `Agent`（A2A 委派为 `A2A`）。卡片右侧还标出这次派发所在的**执行环境**（云端环境或 BYOC Runner 名称），见下文“派发目标环境”。
+**会话中的呈现**：每次派发在对话流里同样以一行呈现，状态与 A2A 委派相同——机器人图标 + “已派发〈子代理名〉”文案（子代理名是 `agent` / `general` 这类类型同义词时写作 `subagent`）+ 本次任务意图，右侧以等宽小字标出这次派发所在的**执行环境**（云端环境或 BYOC Runner 名称）与该次运行的用量、状态；点击这一行可在右侧面板里查看完整过程，`Agent` 徽标（A2A 委派为 `A2A`）标在该面板标题上。见下文“派发目标环境”。
 
 **运行约束**：
 
@@ -304,7 +304,7 @@ A2A 与故障的**自动联动**仍在开发中：故障自动绑定尚未完整
 
 - **省略（默认）**：子代理与当前会话在**同一个**环境里运行，**共用同一套文件系统**——它能直接看到您 workspace 里的文件。点名会话**已经在**的那个环境（例如在一个云端会话里传 `cloud`）结果相同，也是继承，不会另起一个沙箱。
 - **`cloud`**：在一个**全新的云端环境**里运行——临时容器、独立的文件系统，出网按账户的默认策略。
-- **某个 BYOC Runner 的 environment_id**：在**那台 Runner** 上运行。可选目标是**账户级 Runner**，加上**当前会话所绑定团队**的 Runner，且只列出**在线**的；指定不可用的 Runner（离线、不存在或属于其他团队）时，派发会失败并说明原因，不会改派到其他环境。
+- **某个 BYOC Runner 的 environment_id**：在**那台 Runner** 上运行。候选目标是**账户级 Runner**，加上**当前会话所绑定团队**的 Runner；这份清单不区分 Runner 当前是否在线——只要**曾连接过**就会列出（含当前离线的），只有**从未连接**（`pending`）的 Runner 不列出，是否真的可达在派发时才校验。指定不可用的 Runner（离线、不存在或属于其他团队）时，派发会失败并说明原因，不会改派到其他环境。
 - **只对 Subagent 有效**：给 A2A Agent 传 `environment` 会被拒绝——远端 Agent 在它自己的环境里执行，没有可选位置；要换环境就派一个 Subagent 去做。
 
 **跨环境派发时无法读取父会话的文件**：只有执行环境与父会话**完全相同**时，子会话才共用父会话的沙箱 / workspace。派发到其他环境的子会话会得到**自己的**沙箱或 Runner scratch 目录，**无法读取您（父会话）的文件**。因此，请把子会话需要的全部信息**写进 prompt**（文件内容、路径、参数、约束），不要只写“读 workspace 里的某个文件”；结果会以**文本**回来，或者经外部系统（git、工单）流转。运行环境本身的区别与选择方式见 [运行环境（BYOC）](/zh/ai-sre/environments)。
@@ -313,7 +313,7 @@ A2A 与故障的**自动联动**仍在开发中：故障自动绑定尚未完整
 
 <CardGroup cols={2}>
   <Card title="控制台对话" icon="comments" href="/zh/ai-sre/sessions">
-    在会话中观察 A2A 委派的任务卡片及其子会话面板。
+    在会话中观察 A2A 委派及其子会话面板。
   </Card>
   <Card title="MCP（外部工具）" icon="plug" href="/zh/ai-sre/mcp">
     为 Agent 接入外部工具，扩展其在任务中的能力边界。
diff --git a/zh/ai-sre/automations.mdx b/zh/ai-sre/automations.mdx
index 1d0b27594..1c5377660 100644
--- a/zh/ai-sre/automations.mdx
+++ b/zh/ai-sre/automations.mdx
@@ -40,6 +40,8 @@ sidebarTitle: 自动化
 
 无论从哪条入口进入，接下来都是同一张配置表单。
 
+预设模板还可以**从其他页面用链接打开**：形如 `/ai-sre/automations/new?template=<key>` 的链接会直接打开创建表单并套用该模板；链接若还带上 `oncall_incident_channel_ids=<id>,<id>`，**On-call 故障触发** 的协作空间会一并选好，表单会说明“协作空间已按应用的告警配置选好”，确认后点 **创建** 即可。这类链接可以分享，刷新后仍然生效；模板 key 不存在或加载失败时，表单会提示错误并打开一张空白表单。
+
 ## 配置字段
 
 配置表单的字段如下：
diff --git a/zh/ai-sre/environments.mdx b/zh/ai-sre/environments.mdx
index 8ae424e7b..821a86804 100644
--- a/zh/ai-sre/environments.mdx
+++ b/zh/ai-sre/environments.mdx
@@ -73,6 +73,7 @@ AI SRE 提供两类运行环境：
 |---|---|
 | `FLASHDUTY_APP_KEY` / `FLASHDUTY_BASE_URL` | Flashduty API 的凭据与地址，供内置的 `flashduty` Skill 与运行时调用。 |
 | `FLASHDUTY_DOCS_URL` | 官方文档包的静态地址；内置的 `flashduty-docs` Skill 从这里下载文档副本。 |
+| `FLASHDUTY_CONSOLE_URL` | 控制台的地址。Agent 用它把结论里引用的 Flashduty 资源（故障、告警、协作空间、值班表等）拼成可点击的绝对链接；未配置控制台地址时该变量不注入，Agent 改为在正文里用资源 ID 指代。它属于非敏感变量，与 `FLASHDUTY_APP_KEY` 不同，Agent 可以读取。 |
 | `GH_TOKEN`、`GH_TOKEN_` 前缀、`GH_PROMPT_DISABLED`、`GIT_CONFIG_` 前缀 | GitHub 侧由平台注入的令牌与 git 配置（一个账户可能有多个 GitHub App 安装，因此 `GH_TOKEN_1`、`GH_TOKEN_2` 这类也保留）。 |
 | `PATH` / `HOME` | 运行环境的基础环境变量。 |
 | `GITLAB_TOKEN`、`GITLAB_ACCESS_TOKEN`、`OAUTH_TOKEN`、`GITLAB_HOST`、`GL_HOST`、`GITLAB_URI`、`GITLAB_API_HOST`、`GITLAB_SSH_HOST`、`GITLAB_SUBFOLDER`、`CA_CERT`、`SKIP_TLS_VERIFY`、`GLAB_` 前缀 | GitLab / `glab` 的认证、主机与 TLS 配置，防止会话绕过平台注入的机器人身份。 |
diff --git a/zh/ai-sre/im.mdx b/zh/ai-sre/im.mdx
index 2c34d2879..b8a1909b2 100644
--- a/zh/ai-sre/im.mdx
+++ b/zh/ai-sre/im.mdx
@@ -60,7 +60,7 @@ IM 交互依赖您已在 Flashduty 中接入对应平台的机器人（用于告
     平台区分**群聊 @ 提及**与**私聊消息**两种入口。被提及后，AI SRE 会做去重、给这条消息添加一个“处理中”回执（见[处理中回执](#处理中回执)），并识别消息里是否带有命令式指令。
   </Step>
   <Step title="绑定会话">
-    AI SRE 以“账户 + 平台 + 会话（chat）”为键定位一个会话：同一个 IM 会话里的多次 @ 提及，会续接到**同一个 Agent 会话**，从而保留上下文。若是新会话，平台会带入该 IM 线程的起始消息、以及（若有）关联的故障作为初始上下文。
+    AI SRE 以“账户 + 平台 + 会话（chat）”为键定位一个会话：同一个 IM 会话里的多次 @ 提及，会续接到**同一个 Agent 会话**，从而保留上下文。若是新会话，平台会带入该 IM 线程的起始消息、以及（若有）关联的故障作为初始上下文。在开启了话题回复的飞书 / Lark 群里，由**顶层 @** 新开的话题会话还会额外带入该群**最近 10 分钟**（截止到这条 @ 为止）的群消息——您在 @ 之前随手贴的报错文本或截图，就是这样进入上下文的；话题内的回复只读它自己那个话题，不会回退到群消息。
   </Step>
   <Step title="读取上下文作答">
     AI SRE 读取线程 / 会话的历史消息构建上下文，自主排查，并把结论**在线程内**回复。消息里一并 @ 到的其他人也会被保留为提及对象，在回复中带上，方便多方在群里协作。
@@ -71,6 +71,23 @@ IM 交互依赖您已在 Flashduty 中接入对应平台的机器人（用于告
 **回复模式**可配置（off / first / all），决定 AI SRE 是否在回复时 @ 提问者、以及是在**线程内**还是主频道作答。在嘈杂的大群里，线程内回复能让排查讨论保持聚拢、不刷屏。
 </Tip>
 
+### 附件与图片
+
+聊天里的图片、文档与语音，AI SRE 会自己下载下来、作为文件交给 Agent——不只是 **@ 它那条消息**上的附件，**同一线程 / 会话里更早的消息**上的附件也会一并带上。这是为故障现场准备的：您先往群里贴一张报错截图、再补一句“@bot 这个怎么回事”，模型拿到的是那张截图，而不是一句无从判断的文字。
+
+每轮召唤的附件额度按类型计算，**当前这条消息的附件先占额度，历史消息再从剩下的额度里补，从最新的一条往前挑**：
+
+| 类型 | 每轮上限 |
+| --- | --- |
+| 图片 | 5 个 |
+| 文档 | 3 个 |
+| 语音 | 3 个 |
+
+- **历史消息整条附带**：一条历史消息的附件放不进剩余额度，就整条不带，而不是只带其中一部分——模型看到的附件始终与其文字对得上。
+- **超限即拒**：单个附件超过 20 MiB，或直链不是 HTTPS，都会被拒绝，不会交给 Agent。
+- **历史附件有时间预算**：约 5 秒内没下载完的历史附件，在模型眼里就是“未附带”，不会先被承诺成一个文件——排查不会为一张旧截图卡住。
+- **只有您当前这条消息能中止排查**：它的附件全部失败时，AI SRE 不调用 Agent，直接回一句“无法处理本次附带的附件。请重试，或发送较小的文件。”；历史附件失败不中止排查，缺了就是缺了。
+
 ### 处理中回执
 
 收到您的消息后，机器人会先给**您发出的那条消息**添加一个表情回执，作为“已收到、正在处理”的即时信号。表情从该平台自己的表情池里**随机**挑选，不再固定某一个。表情池中只保留表示“已收到、正在处理”的字形，道贺、鼓掌、点赞、比心、笑脸这类会被读成结论或反话的表情不在其中：
@@ -79,7 +96,7 @@ IM 交互依赖您已在 Flashduty 中接入对应平台的机器人（用于告
 | --- | --- |
 | Slack | eyes、thinking_face、hourglass_flowing_sand、mag、zap |
 | 飞书 / Lark | Typing、THINKING、Get、OnIt |
-| 钉钉 / DingTalk | 平台内置表情：思考、收到、Get |
+| 钉钉 / DingTalk | 平台内置表情：思考、收到 |
 
 Slack 除此之外还会显示一条原生的“正在处理”状态，与表情回执并存。
 
diff --git a/zh/ai-sre/mcp.mdx b/zh/ai-sre/mcp.mdx
index 74a160ed6..424fbaf18 100644
--- a/zh/ai-sre/mcp.mdx
+++ b/zh/ai-sre/mcp.mdx
@@ -76,10 +76,13 @@ sidebarTitle: "MCP 外部工具"
 
 ## 添加 MCP 服务器
 
-进入 **自定义 → 插件 → MCP** 页面，列表页右上角有两个入口：
+进入 **自定义 → 插件 → MCP** 页面，列表页右上角有三个入口：
 
-- **添加 MCP**：点击后弹出表单，手工定义一台 MCP 服务器（字段见下文“基础字段”）。
+- **从插件目录添加**：跳到 **自定义 → 插件 → 概览**（插件目录，见上文“从市场安装 MCP 服务器”），在那里挑选并安装预置的 MCP 模板，安装后即出现在本列表中。与另外两个按钮一样，需要 MCP 的创建权限。
 - **在对话中添加**：新建一条预填提示的会话，由 Agent 询问您要接入自己的服务还是安装现成的，先查插件目录，没有再联网搜索候选供您选择。只有在能确定写入范围时（您有账户级权限，或当前只选中了一个您所属的团队）才显示此按钮。
+- **添加 MCP**：点击后弹出表单，手工定义一台 MCP 服务器（字段见下文“基础字段”）。
+
+列表为空时（尚无已配置的服务器，且没有在搜索），页面会显示插件目录里的预置 MCP 数量——“插件目录里有 N 个预置 MCP，安装后即可在会话中使用。”——并给出 **浏览预置 MCP** 按钮直接跳过去（有创建权限时才显示该按钮）；只有插件目录为空、或正在搜索时，才回到原来的提示“尚未配置 MCP 服务器。点击上方按钮添加。”
 
 ### 基础字段
 
@@ -207,7 +210,7 @@ MCP 服务器可能绑定在**当前会话之外的执行环境**中。由于不
 
 - Agent 能看到这类连接器的名称、用途和可用环境，按名字询问时也会得到说明，而不是“找不到”。
 - Agent 会派一个子代理到目标环境中调用它（见 [Agent](/zh/ai-sre/agents)），再把结果带回当前对话。
-- 只能派往**在线**的账户级 Runner、当前会话所绑定团队的 Runner，以及绑定的云端环境；其他环境 Agent 会说明暂时无法使用。
+- 可派往**账户级 Runner**、当前会话所绑定团队的 Runner，以及绑定的云端环境。这份清单不区分 Runner 当前是否在线：**曾连接过**的 Runner（含当前离线的）都标为可用，只有**从未连接**（`pending`）的 Runner 才标为不可用、Agent 会说明它暂时用不了；离线 Runner 因此也会出现在候选里，直到派发失败时才给出该环境不可用的原因。
 - 只有主会话能这样派发，子代理不能再派发。
 
 在**当前**环境里直接可用，把它加进该服务器的“执行环境”列表即可（前提是它对这个会话可达）。运行环境本身的区别见 [运行环境（BYOC）](/zh/ai-sre/environments)。
diff --git a/zh/ai-sre/sessions.mdx b/zh/ai-sre/sessions.mdx
index 609ecc160..ccab71146 100644
--- a/zh/ai-sre/sessions.mdx
+++ b/zh/ai-sre/sessions.mdx
@@ -171,7 +171,7 @@ Agent 需要您澄清信息时，会在对话中插入提问卡片，可能是
 
 ### 子任务（Subagent）
 
-Agent 委派子任务时，对话中会出现一行子任务引用，显示类型（Agent / A2A）、名称、执行环境、状态与耗时，结束后显示工具调用数、Token 用量和失败原因。点击它会在右侧并排打开子会话，可以展开为全屏。
+Agent 委派子任务时，对话中会出现一行子任务引用，显示名称、执行环境、状态与耗时，结束后显示工具调用数、Token 用量和失败原因；这一行不带类型徽标，类型（Agent / A2A）标在右侧子会话面板的标题上。点击它会在右侧并排打开子会话，可以展开为全屏。
 
 子任务还可能处于两种需要您处理的状态：
 
@@ -180,6 +180,8 @@ Agent 委派子任务时，对话中会出现一行子任务引用，显示类
 
 停止子任务请在任务面板中操作。执行者丢失的子任务显示为 **失败**，被平台终止的显示为 **已终止**。
 
+子任务在运行中还可以**向主 Agent 汇报进展**（跨 Agent 的 `agent_message`）。这类汇报会出现在主对话里，作为一行 **子代理汇报**：收起时只有一个机器人图标和这行标题，点击展开查看汇报全文——展开后先显示汇报的子代理名（`agent`、`general` 这类通用执行器的名字不显示），正文以 Output 输出块呈现。子任务仍在运行时，同一份汇报先以一行 **子代理汇报** 出现在它那次派发所在的子任务引用下方；持久记录落定后，这行即时回显自动消失，同一份汇报不会显示两次。刷新页面后只保留持久记录，运行期间的即时回显不会重放。
+
 ### 任务面板与后台任务
 
 除了子任务，Agent 还可以在后台运行长时间命令（如构建、批量拉取数据），或启动监视器持续观察某个条件，直到满足条件或到达截止时间。
diff --git a/zh/ai-sre/skills.mdx b/zh/ai-sre/skills.mdx
index ddefe7656..ead5c5ae8 100644
--- a/zh/ai-sre/skills.mdx
+++ b/zh/ai-sre/skills.mdx
@@ -134,7 +134,10 @@ Skill 市场位于 **自定义 → 插件 → 概览** 的插件目录中，归
 
 ## 自定义 Skill
 
-除了从市场安装，您也可以上传自己的 Skill 包。在 Skill 列表页点击 **上传 Skill**，在表单中填写：
+除了从市场安装，您也可以上传自己的 Skill 包。Skill 列表页的工具栏提供两个入口：
+
+- **从插件目录添加**：跳到 **自定义 → 插件 → 概览** 的 **Skill** 类别，也就是上文“从市场安装”里的插件目录（该目录与 MCP 模板共用同一个页面，见 [MCP](/zh/ai-sre/mcp)），在那里挑选并安装预置的 Skill 模板，安装后即出现在本列表中。与 **上传 Skill** 一样，需要上传 Skill 的权限。
+- **上传 Skill**：打开上传表单，在表单中填写：
 
 | 字段 | 类型 | 是否必填 | 说明 |
 | --- | --- | --- | --- |
@@ -143,6 +146,8 @@ Skill 市场位于 **自定义 → 插件 → 概览** 的插件目录中，归
 
 上传时系统会自动校验：归档是合法 zip、根目录存在 `SKILL.md`、frontmatter 可解析、`name` 符合命名规则（字母开头，仅含字母、数字、`-`、`_`，长度 1–64）、声明的工具有效（内置工具存在、MCP 服务存在）。同一**团队**内**Skill 名不能重复**，重名会被拒绝并提示换名；不同团队可以各自拥有同名 Skill。
 
+列表为空时（目前还没有任何 Skill，且没有在搜索），页面会显示插件目录里的预置 Skill 数量——“插件目录里有 N 个预置 Skill，安装后即可在会话中使用。”——并给出 **浏览预置 Skill** 按钮直接跳过去（有上传权限时才显示该按钮）；只有插件目录为空、或正在搜索时，才回到原来的提示“暂无 Skill。点击「上传 Skill」添加一个。”
+
 <Note>
 Skill 名以外的元数据（描述、版本、标签、作者、工具等）都从 `SKILL.md` 的 frontmatter 解析得到，无需在表单中重复填写。
 </Note>
diff --git a/zh/changelog/changelog.mdx b/zh/changelog/changelog.mdx
index ecb8a2300..ef900baf4 100644
--- a/zh/changelog/changelog.mdx
+++ b/zh/changelog/changelog.mdx
@@ -4,6 +4,28 @@ description: "本页面记录 Flashduty 产品的重要更新和功能发布"
 keywords: ["更新日志", "产品发布", "功能更新", "Flashduty", "版本记录"]
 ---
 
+<Update label="2026-10-12" description="🤖 RUM Issue 一键开启自动分析、AI SRE 读取 IM 附件、CLI 新增全局字段投影参数">
+
+### RUM Issue：一键开启自动分析
+
+Issue 详情页右上角新增 **开启自动分析** 按钮，账户已开启 AI SRE、且当前成员有创建自动化规则的权限时显示：点击后打开 AI SRE 自动化的创建表单，预填预设模板「RUM Issue 故障分析」（`rum_issue_incident_analysis`），协作空间也已按该应用的告警配置选好——确认后点 **创建**，这条自动化就负责分析该应用后续由 Issue 告警生成的故障。
+
+自动化以故障为触发条件，所以该应用要先能产生故障。点击按钮时 RUM 会读取应用的告警设置：告警已开启、投递方式为 **Flashduty 协作空间**、且至少选了一个协作空间时，才直接跳到创建表单；不满足时提示先完成告警设置，并跳到该应用的 **告警设置** 页签。详见 [Issue 概览与详情](/zh/rum/error-tracking/error-viewing#头部操作)。
+
+### AI SRE 读取 IM 附件
+
+AI SRE 会把聊天里的图片、文档与语音自己下载下来、作为文件交给 Agent——不只是 **@ 它那条消息**上的附件，**同一线程 / 作战室里更早的消息**上的附件也会一并带上：您先贴一张报错截图、再补一句「@bot 这个怎么回事」，模型拿到的是那张截图，而不是一句无从判断的文字。
+
+每轮额度按类型计算，当前消息的附件先占额度、历史消息从最新的一条往前补：**图片 5 个、文档 3 个、语音 3 个**。单个附件超过 20 MiB、或直链不是 HTTPS，都会被拒绝；历史附件还有约 5 秒的下载时间预算，没下载完的按「未附带」处理，排查不会被一张旧截图卡住。详见 [IM 集成 · 附件与图片](/zh/ai-sre/im#附件与图片)。
+
+### CLI：全局 `--fields` 字段投影
+
+CLI 新增全局参数 `--fields`：`json` / `toon` 输出时只保留逗号分隔的顶层字段，作用于列表的每一行或单条记录，**所有命令都可用，OpenAPI 生成的命令也在内**；命令自己声明了 `--fields`（`incident list`、`alert-event list` 等带默认紧凑投影的命令）时，以命令自己那个为准。
+
+表格输出忽略该参数，并在 stderr 提示它未生效；字段名在整个响应里都没命中时，stderr 会列出实际存在的键；输出既不是对象也不是对象列表时，命令直接报错。详见 [命令行工具](/zh/developer/cli)。
+
+</Update>
+
 <Update label="2026-10-09" description="📊 仪表盘内置时间变量与显示时区、RUM 查看器聚合分析、MCP Server 与 Go SDK 支持 OAuth 授权">
 
 ### 仪表盘：内置时间变量与显示时区
diff --git a/zh/developer/cli.mdx b/zh/developer/cli.mdx
index 22e4b2e33..0112d8dec 100644
--- a/zh/developer/cli.mdx
+++ b/zh/developer/cli.mdx
@@ -94,14 +94,16 @@ flashduty config set base_url URL  # 覆盖 API 地址
 
 ## 全局参数
 
-所有子命令均支持以下参数：
+以下参数注册在根命令上；除 `--version` 外，其余所有子命令均可使用：
 
 | 参数 | 说明 |
 |------|------|
 | `--output-format` | 输出格式：`table`（默认）、`json` 或 `toon`（紧凑、更省 token） |
 | `--json` | 以 JSON 格式输出，是 `--output-format json` 的别名，便于通过 `jq` 等工具解析 |
 | `--no-trunc` | 表格输出时不截断长字段 |
+| `--fields` | `json`/`toon` 输出时只保留指定的顶层字段（逗号分隔），作用于列表的每一行或单个记录；表格输出忽略该参数，并在 stderr 提示它未生效。字段名未命中时 stderr 会列出实际可用的键；输出不是对象或对象列表时命令直接报错。详见下文「结构化输出的字段投影」 |
 | `--base-url` | 覆盖 API 地址（私有部署场景） |
+| `--version` | 打印版本信息，与 `flashduty version` 输出相同的一行。这个含义只在根命令上有；个别命令自己定义了 `--version`（例如变更类命令的乐观锁版本号），那些命令按自己的说明生效 |
 
 ## 命令清单
 
@@ -116,7 +118,7 @@ flashduty incident ack <id> [<id2>...]  # 认领故障
 flashduty incident close <id> [<id2>...] # 关闭（解决）故障
 flashduty incident merge <target-id> --source <ids> # 将多个故障合并到目标故障
 flashduty incident timeline <id>        # 查看故障时间线
-flashduty incident alerts <id>          # 查看故障关联的告警
+flashduty incident alerts <id>          # 查看故障关联的告警（--limit 默认 10、--page）
 flashduty incident similar <id>         # 查找相似的历史故障
 flashduty incident feed <id> [flags]   # 查看故障的分页动态流（时间线条目）
 ```
@@ -141,7 +143,7 @@ flashduty incident feed <id> [flags]   # 查看故障的分页动态流（时间
 | `--is-rare` | 仅看新奇故障 | `false` |
 | `--is-snoozed` | 仅看已暂缓的故障 | `false` |
 | `--ever-muted` | 仅看曾被静默的故障 | `false` |
-| `--since` | 起始时间（时长、日期、日期时间或 Unix 时间戳），与 `--until` 的窗口须小于 31 天 | `24h` |
+| `--since` | 起始时间（时长、日期、日期时间或 Unix 时间戳），与 `--until` 的窗口须小于 31 天 | `24h`；`--progress` 只含 `Triggered,Processing` 时为 `30d` |
 | `--until` | 截止时间 | `now` |
 | `--asc` | 按时间升序（最早的在前） | `false`（最新在前） |
 | `--limit` | 最大结果数（上限 100） | `20` |
@@ -151,6 +153,8 @@ flashduty incident feed <id> [flags]   # 查看故障的分页动态流（时间
 
 `incident feed <id>` 按页读取故障的动态流（时间线条目）：`--asc` 让最旧的条目在前（默认最新在前），`--types` 按逗号分隔的条目类型过滤（如 `i_comm,i_assign`，条目的 `type` 字段给出实际类型），另有 `--limit`（最大 100）与 `--page`。
 
+`incident alerts <id>` 列出该故障关联的告警，支持 `--limit`（默认 `10`）与 `--page`（默认 `1`）。
+
 #### 创建、更新与合并
 
 `incident create` 的 `--title`（3–200 字符）与 `--severity` 必填，在终端中缺少时会交互提示。指派方式有三种，可组合使用：`--assign`（成员 ID 列表）、`--assign-emails`（成员邮箱，逗号分隔；不匹配任何成员的邮箱会被忽略）、`--escalate-rule-id` 加 `--escalate-layer`（从该分派策略的指定环节（从 0 开始）起，指派该环节的人员；`--escalate-layer` 必须与 `--escalate-rule-id` 一起使用）。
@@ -680,8 +684,9 @@ flashduty monit prometheus-api-v1-label-{label_name}-values job --data-source-id
 ### alert — 告警与告警事件查询
 
 ```bash
-flashduty alert list [flags]        # 列出告警（默认最近 24 小时）
+flashduty alert list [flags]        # 列出告警（默认最近 24 小时；--active 时为 30 天）
 flashduty alert get <alert_id>      # 查看单条告警详情；detail 是同一命令的别名
+flashduty alert events <alert_id>   # 列出组成该告警的原始事件（--limit、--page）
 flashduty alert-event list [flags]  # 列出告警事件（默认最近 1 小时）
 ```
 
@@ -689,6 +694,10 @@ flashduty alert-event list [flags]  # 列出告警事件（默认最近 1 小时
 
 `alert list` 另有 `--alert-ids`（逗号分隔的告警 ID）、`--alert-keys`（逗号分隔的告警去重键）、`--asc`（按开始时间升序，默认最新在前）、`--by-updated-at`（把 `--since`/`--until` 应用到最近更新时间，而不是开始时间）；`alert-event list` 也支持 `--asc`（升序，默认最新在前），但没有 `--by-updated-at`。
 
+`alert list` 还用 `--active`（只看活跃告警）与 `--recovered`（只看已恢复告警）筛选状态：二者互斥，同时传入会报错；只传其中一个时，`--active` 对应活跃、`--recovered` 对应已恢复，都不传则不加状态过滤。活跃告警可能早于一天，因此 `--active` 且未指定 `--since` 时默认窗口放宽到 30 天（实际生效的窗口见 stderr 的窗口提示）。
+
+`alert events <alert_id>` 列出组成该告警的原始事件：`--limit` 默认取服务端默认的 20 条（上限 100），`--page` 从 1 开始。它按单个告警取事件，跨告警的时间窗查询用 `alert-event list`。
+
 ### automation — AI SRE 自动化规则
 
 `automation` 命令组管理 AI SRE 的自动化规则——创建、查询、更新、删除、运行历史与触发，页面操作见[自动化](/zh/ai-sre/automations)。
@@ -892,6 +901,14 @@ TOON 不能直接用 `jq` 解析；需要管道给 `jq` 时请改用 `--json`。
 </Tab>
 </Tabs>
 
+### 时间窗口提示
+
+查询时间范围的命令会把本次实际发送的窗口按本地时区写到 stderr，例如 `note: window 2026-10-08T14:00:00+08:00..2026-10-09T14:00:00+08:00 (1d, ended now)`。括号里是窗口跨度与结束时间相对当前的位置（`ended 3m ago` / `ends in 2h`）；若窗口来自某个默认值而非你显式传入的 `--since`/`--until`，还会说明是哪个默认值（如 `--progress` 只含开放状态、`--active`）。
+
+覆盖范围包括 `incident list`、`alert list`、`alert-event list`、`change list`、`audit search`、`insight`、`oncall`、`monit-query`（工具参数带执行窗口时），以及所有解析出 `--start-time`/`--end-time` 的生成命令（只给出一侧、另一侧交给 `--data` 或服务端默认的命令不输出该提示，因为窗口没有被完整确定）。只有一个时间点的查询写成 `note: instant <时刻> (…)`。
+
+它用来核对窗口是否就是你要的那个：默认值可能比你预期的宽（例如 `--active` 会把默认窗口放宽到 30 天），把时间戳按错误时区解读会让窗口落到未来，此时提示形如 `ends in 7h`。提示只写 stderr，stdout 保持原样，`jq` 与 toon 消费方不受影响。
+
 ### 生成命令的输出上限
 
 由 OpenAPI 代码生成提供覆盖的生成命令（如 `safari session-list`、`monit datasource-list`、`safari a2a-agent-list` 等），其 `json` / `toon` 输出对**列表形态**的响应按 16 KiB 上限处理。缩减分三级，另外会有一个机读标记：
@@ -903,15 +920,17 @@ TOON 不能直接用 `jq` 解析；需要管道给 `jq` 时请改用 `--json`。
 **列表信封会被重建并写入缩减标记**。列表信封指行数组名为 `items` / `docs` / `list`、同级只有 `total`、`has_next_page`、`search_after_ctx` 等标量字段的响应（如 `monit datasource-list`、`safari session-list`）；一旦发生缩减，CLI 会重建该信封并在 payload 中补写字段，脚本无需解析 stderr 也能发现缩减：
 
 - **整行被丢弃**：写入 `truncated: true` 与 `emitted_rows: N`（N 为实际输出的行数）。此时信封中的 `total`、`has_next_page`、`search_after_ctx` 仍是服务端原始分页的原样回显，**不能**用来判断是否已取全——被截成「100 行中前 7 行」的一页照样带着原来的分页字段。要取全请按实际收到的行数收窄 `--limit` 重新请求，再沿返回的游标继续翻页。
-- **只有长值被截短**（没有丢行）：只写 `truncated: true`，stderr 会点名被截字段。重新请求无法找回这些值，请收窄筛选条件、减少每页行数，或改用支持字段投影的精选命令。
+- **只有长值被截短**（没有丢行）：只写 `truncated: true`，stderr 会点名被截字段。重新请求无法找回这些值，请收窄筛选条件、减少每页行数，或用全局 `--fields` 只保留需要的字段。
 
 **顶层数组形态**的响应（如精选命令 `incident list`、`insight incidents`）没有信封可承载标记，缩减仍只写 stderr。
 
-**明细形态的单个对象**（如 `safari session-get` 的详情）不做截断、原样输出——截短后的值无法与真实短值区分，因此这类响应不受上限约束。生成命令大多没有可收窄输出的标志（个别命令的 `--fields` 是请求体的字段选择器，不作用于输出）；需要完整 JSON 时请通过 `--limit` 调小每页数量、配合 `--page` 分页逐页拉取（如 `flashduty safari session-list --limit 20 --page 2`），或按需收窄筛选条件。
+**明细形态的单个对象**（如 `safari session-get` 的详情）不做截断、原样输出——截短后的值无法与真实短值区分，因此这类响应不受上限约束。生成命令可以用全局 `--fields` 收窄输出的字段（见「全局参数」与下文「结构化输出的字段投影」；个别命令的 `--fields` 是请求体的字段选择器，如 `monit rule-update-fields`，不作用于输出）；需要完整 JSON 时请通过 `--limit` 调小每页数量、配合 `--page` 分页逐页拉取（如 `flashduty safari session-list --limit 20 --page 2`），或按需收窄筛选条件。
 
 ### 结构化输出的字段投影
 
-以下命令在 `json` 或 `toon` 输出时支持 `--fields`。用逗号分隔顶层响应字段；未知字段会直接报错，表格输出会忽略此参数。
+`--fields` 是全局参数（见「全局参数」）：任意命令在 `json` 或 `toon` 输出时都能用它，逗号分隔要保留的顶层字段，作用于列表的每一行或单个记录。投影在返回结果上执行：列表信封（行数组为 `items`、`docs` 或 `list`，同级只有标量分页字段）只收窄其中的行数组，分页字段原样保留；某个字段在整个响应里都不存在时不会被写入输出，stderr 会提示该字段未匹配到任何键、并列出实际存在的键；输出既不是对象也不是对象列表时，命令报错并要求去掉 `--fields`。表格输出忽略 `--fields`，此时 stderr 会提示它未生效。
+
+下表列出的精选命令在省略 `--fields` 时按默认紧凑投影输出，并受大小上限约束；它们各自定义了自己的 `--fields`（含义与全局一致），字段名写错会直接报错并列出具名可用的字段。其它命令——包括全部生成命令——不带默认投影，`--fields` 直接作用在接口返回的原始字段上，字段名未命中只会得到上面那条 stderr 提示。
 
 | 命令 | 未指定 `--fields` 时的结构化输出 | 上限 |
 | --- | --- | --- |
diff --git a/zh/monitors/dashboards/dashboards.mdx b/zh/monitors/dashboards/dashboards.mdx
index 7c789130d..32c05680a 100644
--- a/zh/monitors/dashboards/dashboards.mdx
+++ b/zh/monitors/dashboards/dashboards.mdx
@@ -195,8 +195,9 @@ keywords: ["仪表盘", "Dashboard", "面板", "模板变量", "同环比", "版
 
 ## 全屏与查询详情
 
-鼠标悬停在面板标题上时，可以 **编辑**（需管理权限）、**全屏** 或 **重试**。
+鼠标悬停在面板标题上时，可以 **编辑**（需管理权限）、**全屏** 或 **刷新**。
 
+- **刷新**：面板查询完成后，悬停操作里会出现该图标。点击立即重新查询该面板：该面板正在进行的查询会被取消，并排到查询队列最前优先执行。
 - 全屏时可以单独修改该面板的时间范围，不影响其他面板。
 - 全屏时可以 **复制面板链接** 或 **下载数据 CSV**。
 - **查询详情**列出每条查询的表达式和状态，点击 **在查询工作台打开** 可以带着当前变量和时间去[查询工作台](/zh/monitors/explore/explore)调试。
diff --git a/zh/on-call/channel/integrate-data.mdx b/zh/on-call/channel/integrate-data.mdx
index a70b8ce9d..dbfd914ce 100644
--- a/zh/on-call/channel/integrate-data.mdx
+++ b/zh/on-call/channel/integrate-data.mdx
@@ -80,26 +80,28 @@ Flashduty On-call 提供两种告警接入方式：
 
 ## 浏览与查找集成
 
-集成中心把收录的告警源与变更事件按分类组织，您可以用分类胶囊缩小范围，也可以直接搜索目标系统。
+集成中心把收录的告警源与变更事件按分类组织，您可以在分类之间浏览，也可以直接搜索目标系统。
 
-添加集成面板的胶囊按页签分成两套，打开时默认落在各页签的默认分类：
+添加集成面板的分类按页签分成两套，打开时展开各页签的默认分类：
 
-| 页签 | 分类胶囊（按显示顺序） | 默认分类 |
+| 页签 | 分类（按显示顺序） | 默认展开的分类 |
 | :--- | :--- | :--- |
 | 告警事件 | 通用接入、热门、云厂商、指标与基础设施监控、APM 与可观测平台、事件关联与 AIOps、日志与错误追踪、安全、拨测与状态页、任务、交付与应用平台、网络与硬件 | **热门** |
 | 变更事件 | 通用接入、CI/CD 与部署、代码仓库、配置与功能开关、基础设施与平台 | **CI/CD 与部署** |
 
-- 未登记分类的集成归入 **未分类**；页面只显示有条目的分类。
-- 默认情况下，面板只保留 **全部**、**通用接入**、当前页签的默认分类与当前选中的分类，其余收进 **更多 N**，点击后展开。
-- 搜索框跨全部分类匹配（忽略当前选中的胶囊），按集成名称或集成类型查找，结果以 **搜索结果** 呈现；清空搜索后回到原来选中的分类。
+- 未登记分类的集成归入 **未分类**；面板只显示有条目的分类。
+- 面板为每个分类渲染一个可折叠区块，只有当前页签的默认分类默认展开，其余收起、点标题即展开；搜索框内的提示文字给出面板收录的集成总数。
+- 搜索框跨全部分类匹配，按集成名称或集成类型查找：命中的分类连同命中条目一起展示，分类标题右侧显示「命中数 / 该分类总数」（例如 `3 / 12`），命中的名称里与搜索词相同的部分会高亮。搜索不涉及 **热门**，因为其中的集成本来就归类在各自的真实分类里。
+- 一个分类都没有命中时，面板显示 **没有找到「搜索词」** 空状态：告警页签额外给出 **标准告警事件** 入口（用它可以通过 Webhook 接入任意系统），所有页签都可以点 **提交集成需求** 告诉我们需要支持什么，搜索词会带入需求表单的系统名称。
 
 ### 全部集成目录
 
-点击 **全部** 胶囊会打开一个全屏集成目录：
+点击搜索框旁的 **查看全部** 按钮会打开一个全屏集成目录：
 
-- 标题右侧是该目录收录的集成总数，顶部搜索框跨全部集成查找。
+- 顶部搜索框跨全部集成查找，提示文字给出该目录收录的集成数量。
 - 左侧分类导航列出每个分类及其条目数，点击即在右侧滚动定位到该分类（同时清空搜索）。
-- 右侧按分类列出可接入的系统，点击 **添加** 进入新建集成页。
+- 右侧按分类列出可接入的系统，每个分类标题右侧是该分类的条目数；鼠标悬停在卡片上时卡片右上角出现一个 **+** 图标，点击卡片进入该集成的新建集成页。
+- 在目录里搜索时命中结果同样按分类分组，每个分类标题右侧显示「命中数 / 该分类总数」；一个分类都没有命中时显示 **没有找到「搜索词」** 空状态，空状态不再重复放按钮，用下方的兜底区即可。
 
 目录底部还有一块「没有找到你要接的系统？」的兜底区，给出两条出路：用通用集成接入，或提交集成需求。
 
diff --git a/zh/on-call/incident/search-view-incident.mdx b/zh/on-call/incident/search-view-incident.mdx
index a295a1374..44df6f9ce 100644
--- a/zh/on-call/incident/search-view-incident.mdx
+++ b/zh/on-call/incident/search-view-incident.mdx
@@ -250,14 +250,16 @@ AI 总结仅适用于由告警自动触发的故障，手动创建的故障不
 <Accordion title="事件类型对照">
 | 事件类型 | 时间线记录 |
 | :--- | :--- |
-| `i_wi_created` | 创建了行动项 / 创建了跟进项 |
+| `i_wi_created` | 创建了行动项 / 创建了跟进项，记录里带指派对象时后接「，指派给 …」 |
 | `i_wi_updated` | 更新了行动项 / 更新了跟进项 |
-| `i_wi_assignees` | 更新了行动项负责人 / 更新了跟进项负责人 |
+| `i_wi_assignees` | 更新了行动项负责人 / 更新了跟进项负责人，记录里带指派对象时同样后接「，指派给 …」 |
 | `i_wi_completed` | 完成了行动项 / 完成了跟进项 |
 | `i_wi_converted` | 将行动项转换为跟进项 |
 | `i_wi_bound` | 将跟进项关联到故障复盘 |
 | `i_wi_auto_converted` | 将 N 个未完成行动项转为跟进项：标题、标题…（故障关闭时批量转换，一条记录汇总全部条目） |
 | `i_wi_deleted` | 删除了行动项 / 删除了跟进项 |
+
+「指派给」后面是该记录上的负责人：只有成员时按「头像 + 名字」逐个列出；负责人中含 AI SRE 时改用联合署名，成员名以「、」相连，最后以「和 AI SRE」收尾（例如「张三、李四 和 AI SRE」）。记录里没有任何指派对象时，上述两条事件只显示句子的前半部分。
 </Accordion>
 
 ### AI SRE 代操作记录
diff --git a/zh/on-call/incident/work-items.mdx b/zh/on-call/incident/work-items.mdx
index e935073f7..0438d0b74 100644
--- a/zh/on-call/incident/work-items.mdx
+++ b/zh/on-call/incident/work-items.mdx
@@ -35,10 +35,22 @@ keywords: ["行动项", "跟进项", "工作项", "故障处理", "故障复盘"
 | :--- | :---: | :--- |
 | **行动项标题** | 是 | 简要描述要完成的工作，最长 **512** 字符 |
 | **描述** | 否 | 补充需要执行的具体内容，最长 **65535** 字符 |
-| **负责人** | 否 | 支持搜索并从账户成员中多选，不限制人数 |
+| **负责人** | 否 | 支持搜索并从账户成员中多选，不限制人数；也可以选择固定在列表顶部的 **AI SRE**（副文案 **分配给 AI 执行**），把这条工作项交给账号的 AI SRE 执行 |
 
 创建成功后，行动项会展示在卡片中，并在故障时间线上记录一条"创建了行动项"事件。被指定为负责人的成员会收到一条个人通知，提醒其跟进处理（默认通过**邮件和应用内推送**发送，可在[个人设置](/zh/on-call/configuration/personal-settings)中调整通知渠道）。
 
+### 指派给 AI SRE
+
+负责人选择器把 **AI SRE** 固定在成员列表上方，与成员之间用一条分隔线隔开，副文案为 **分配给 AI 执行**；它不参与搜索过滤，输入任何关键词都会留在结果里。选中后，这条工作项交给账号的 AI SRE 执行，同时仍可以保留成员负责人；选中项在输入框中只显示 **AI SRE** 芯片，不显示副文案。行动项与跟进项共用同一个创建/编辑弹窗，两者的负责人字段行为一致。
+
+- 卡片上以 **AI SRE** 头像展示该指派，与成员头像并列（最多显示 2 个头像，其余折叠为 `+N`）
+- 鼠标悬停 AI SRE 头像会弹出悬浮卡：卡片写明 AI SRE 是以哪位成员的身份和权限在执行，并提供 **接续对话** 入口，点击会在 AI SRE 面板中打开这次执行关联的会话
+- 执行来自 IM 会话时，悬浮卡只给出 **IM 会话暂不支持在 Web 查看** 的说明，不提供进入入口
+- 打开会话要求账号已启用 AI SRE，且您拥有使用 AI SRE 对话的权限；个人会话（仅创建者可见）或已失效的会话无法接续
+- 故障时间线上，这条工作项记录会以联合署名列出指派对象（例如「张三 和 AI SRE」）
+
+需要按指派对象筛选这类工作项时（例如列出所有交给 AI SRE 的事项），使用 [CLI](/zh/developer/cli) 的 `flashduty incident work-item-list --assignee-type ai_sre`。
+
 ### 编辑与删除
 
 - 拥有故障更新权限的成员，点击行动项标题，或通过 **更多** 菜单中的 **编辑** 打开弹窗，修改标题、描述或负责人
@@ -81,6 +93,8 @@ keywords: ["行动项", "跟进项", "工作项", "故障处理", "故障复盘"
 
 此外，行动项的读写还受故障所属**协作空间**约束：只有账号所有者、账号管理员，以及能访问这个故障所属协作空间的成员才能操作；如果故障是手动创建、未挂载协作空间，则保持账户内可见，账户成员均可访问。这与故障本身的访问规则一致。
 
+上表中的「负责人」指账户成员。指派给 **AI SRE** 的工作项由 AI SRE 执行，而不是由某位成员负责：AI SRE 不是账户成员，上表针对成员的完成权限与个人通知都不适用于它（同一条工作项上还选了成员负责人时，成员负责人照常收到通知）。要单独列出指派给 AI SRE 的工作项，使用 [CLI](/zh/developer/cli) 的 `flashduty incident work-item-list --assignee-type ai_sre`。
+
 ## 已关闭故障
 
 故障关闭后，行动项卡片进入只读状态，跟进项卡片同时解锁为可编辑：
diff --git a/zh/rum/error-tracking/error-viewing.mdx b/zh/rum/error-tracking/error-viewing.mdx
index 2354bdbb4..a73c42cd2 100644
--- a/zh/rum/error-tracking/error-viewing.mdx
+++ b/zh/rum/error-tracking/error-viewing.mdx
@@ -280,6 +280,17 @@ Issue 列表支持两种查看模式：侧栏模式和全屏模式。默认以
   </Accordion>
 </AccordionGroup>
 
+### 头部操作
+
+Issue 详情面板右上角提供两个 AI SRE 相关的按钮，只在账户已开启 AI SRE 时显示：
+
+| 按钮 | 显示条件 | 作用 |
+|------|----------|------|
+| **开启自动分析** | 当前成员有创建 AI SRE 自动化规则的权限 | 打开 AI SRE 自动化的创建表单，预填预设模板「RUM Issue 故障分析」（`rum_issue_incident_analysis`）与该应用的告警协作空间；保存后，这条自动化负责分析该应用后续由 Issue 告警生成的故障 |
+| **AI 修复** | 当前成员有 AI SRE 会话的访问权限 | 打开 AI SRE 会话，并把当前 Issue 作为引用标签带进输入框，见[会话 · 附件与上下文引用](/zh/ai-sre/sessions#附件与上下文引用) |
+
+**开启自动分析** 以故障为触发条件，所以该应用要先能产生故障。点击按钮时 RUM 会读取该应用的告警设置：告警已开启、投递方式为 **Flashduty 协作空间**、且至少选了一个协作空间时，才直接跳到创建表单——协作空间已按应用的告警配置选好，确认后点 **创建** 即可。不满足时提示「该应用还没开启 On-call 告警。异常要先生成故障才能触发自动分析，请先完成告警设置。」，并跳到该应用的 **告警设置** 页签。模板内容与表单字段见[自动化](/zh/ai-sre/automations)。
+
 ## 异常告警
 
 在问题发生时立即发现它，让您有机会在问题变得严重之前主动识别和修复它。
diff --git a/zh/rum/error-tracking/issue-alerts.mdx b/zh/rum/error-tracking/issue-alerts.mdx
index 64940909f..be7909427 100644
--- a/zh/rum/error-tracking/issue-alerts.mdx
+++ b/zh/rum/error-tracking/issue-alerts.mdx
@@ -209,6 +209,8 @@ RUM 告警与 Flashduty 深度协同，形成完整的告警处理链路：
 
 选择 Flashduty 协作空间投递时，您可以在 Flashduty 的[告警处理 Pipeline](/zh/on-call/integration/alert-integration/alert-pipelines) 中进一步处理 RUM 告警，例如根据影响用户数调整告警级别、按时间窗口抑制重复告警、自定义告警标题格式等。选择 Webhook 投递时，RUM 告警不会进入这条 On-call 处理链路，请在您的接收端完成格式转换、路由和通知。
 
+Issue 详情页的[开启自动分析](/zh/rum/error-tracking/error-viewing#头部操作)这条自动化以故障为触发条件，而只有 Flashduty 协作空间投递才会由 Issue 告警生成故障，所以它只对协作空间投递的应用生效：Webhook 投递不产生故障，无法触发这条自动化。
+
 ## 延伸阅读
 
 <CardGroup cols={2}>