docs: document new computed outbox controls and grouped space collaborators

en/basic/admin-panel/ai-setting.mdx

@@ -90,6 +90,8 @@ In **App Auth**, you can configure sign-in providers for generated apps:
 
 **Teable** sign-in is available by default. **Email OTP** appears in App Builder only after the SMTP settings are complete, and **Google** appears only after both OAuth credentials are configured.
 
+**Auto-inject AI API Key into apps** is on by default, so apps can call the platform's AI models. Turn it off and apps can no longer reach them.
+
 ### Optional. Configure Voice input
 
 To use voice input in AI Chat, enable the feature and enter an **OpenAI API Key**. Configure the **Transcription Endpoint** only when using a custom transcription service. You can also limit the recording length and requests per minute.

en/basic/admin-panel/computed-outbox.mdx

@@ -39,21 +39,26 @@ A failed row is the history of one delivery attempt, not a stuck task. The durab
 
 **Clear failed history** removes the retained failed-job records from the queue only. It repairs nothing, and dead letters remain in **Anomaly maintenance**.
 
+A state tile can also count entries whose job data no longer exists in Redis, usually left behind after eviction or data loss. The list cannot show them, so the page explains the gap under the table. Teable sweeps such leftovers out of the failed state on its own; **Clear failed history** removes them right away.
+
 ## Handle Anomalous Tasks
 
 <Info>The **Failed** count and **Anomaly maintenance** show different types of problems, so their numbers may differ.</Info>
 
 **Anomaly maintenance** collects anomalies into problem groups, one per Base, source table, and error, so a single root cause is easy to spot. Review the failure reason and fix the underlying problem before you recover anything. Expand a group to read its error details and the tasks it covers; those rows are for inspection, and recovery always runs on the group as a whole.
 
-Each group offers one action, depending on its type:
+The actions a group offers depend on its type:
 
 | Anomaly type | Action | What happens |
 | --- | --- | --- |
 | **Dead letter** | **Recover entire group** | Restores every dead letter currently in that group to the durable queue and redelivers them. Every other group stays untouched. |
+| **Dead letter** | **Discard group** | Permanently deletes the dead letters in that group. They cannot be recovered or replayed afterwards, so use it only when a replay is pointless. |
 | **Timed out** | **Re-arm latest timeout** | Wakes the queue for the newest task in the group so a worker can take it over. |
 
 After a group recovery, Teable reports how many tasks it restored, how many were newly queued or already queued, and how many were delivered or deferred. Workers then consume the group under the current concurrency and task-splitting limits.
 
+A group marked **Base deleted** belongs to a Base that no longer exists. Recovering it would fail again immediately, so **Discard group** is the only action offered.
+
 ## Pause Computed Tasks for a Space
 
 When one space's computed tasks are making an incident worse, pause that space in **Computed task pauses** rather than stopping the whole instance.
@@ -70,8 +75,15 @@ A pause only stops workers from claiming new computed tasks for that space. Task
 
 A pause always expires on its own, and two hours is the longest you can set. If the incident outlasts it, pause the space again from this page. The list shows every active pause with who created it, why, and when it auto-resumes, along with how many pending tasks the active pauses are holding, so you can judge the backlog a resume will release. To lift one early, click **Resume** on its row and confirm.
 
-## Adjust Worker Concurrency
+## Adjust Concurrency
+
+The queue section has two concurrency controls. Each one writes a cluster-wide override that every process picks up within about 15 seconds, with no restart, and each can be reset so processes return to their own environment setting. An **Overridden** badge marks a control that is no longer on its default.
+
+| Control | What it limits |
+| --- | --- |
+| **Per-process concurrency** | How many computed tasks each worker process handles at once. |
+| **Per-base claim caps** | How many computed tasks run at the same time for one Base (**Per base**) and for one source table within it (**Per seed table**). Both default to 2 and accept values from 1 to 16. |
 
-**Per-process concurrency** in the queue section shows how many computed tasks each worker process handles at once. Click it to set a cluster-wide override; every worker picks it up within about 15 seconds, with no restart. **Reset to default** removes the override and returns each process to its own environment setting.
+Raise the claim caps when one busy Base is the bottleneck, and per-process concurrency when many Bases are queued at the same time.
 
-<Warning>Higher concurrency puts more load on your database. Each Base is separately limited to 2 concurrent tasks across the cluster, so raising this value mainly helps when many Bases are waiting at the same time.</Warning>
+<Warning>Higher concurrency puts more load on your database. Spaces that store their data in a [database tenant](/en/basic/admin-panel/database-tenant) keep the environment defaults for the claim caps, because their connection pools are sized for those values.</Warning>

en/basic/space/space-invite.mdx

@@ -56,7 +56,7 @@ You can remove space collaborators from the space sharing window. Click the X ne
 
 * **Permission restriction**: Only users with Manager or Creator permissions can remove other collaborators.
 * **Self-removal**: You can remove your own access if there is at least one other Manager in the space.
-* **Scope**: Base collaborators cannot be removed from this window.
+* **Scope**: Removing someone from the space does not remove the permissions they hold on individual bases.
 
 When adding new users to a space, you can assign the following roles (see [Permission Details](/en/basic/space/space-permission)):
 
@@ -67,3 +67,9 @@ When adding new users to a space, you can assign the following roles (see [Permi
 | Editor | Can modify data. |
 | Commenter | Can comment on records but cannot modify data. |
 | Viewer | Can view but cannot comment. |
+
+## Reviewing Base Access
+
+Each person or department appears once in the space collaborator list, even when they also hold permissions on individual bases. A **Base permissions** badge next to the role shows how many bases they were invited to. Someone who was never added to the space itself is listed as **Has access to selected bases only**.
+
+Expand a row to see those bases and the role held on each. From there, **Remove base access** withdraws one base permission, and **Remove collaborator** on a base-only row withdraws every base permission that person holds in this space.

zh/basic/admin-panel/ai-setting.mdx

@@ -90,6 +90,8 @@ description: "为私有化部署实例配置 AI 对话、AI 字段、AI 自动
 
 **Teable 登录** 默认可用。只有完整配置 SMTP 后，**邮箱验证码** 才会出现在应用构建器的登录设置中；只有同时配置 Google 客户端 ID 和密钥后，**Google** 登录才会出现。
 
+**向 App 自动注入 AI API Key** 默认开启，应用可以直接调用平台提供的 AI 模型；关闭后，应用将无法再调用这些模型。
+
 ### 可选：配置语音输入
 
 如需在 AI 对话中使用语音输入，请启用该功能并填写 **OpenAI API Key**。只有使用自定义转写服务时，才需要配置 **转写 Endpoint**。你还可以按需限制录音时长和每分钟请求次数。

zh/basic/admin-panel/computed-outbox.mdx

@@ -39,21 +39,26 @@ description: "在管理面板中监控 BullMQ 投递和计算任务积压。"
 
 **清理失败记录** 只会清掉队列中保留的失败任务记录，不会修复任何问题，死信仍然保留在 **异常任务维护** 中。
 
+状态卡片的计数中还可能包含任务数据已不在 Redis 中的记录，通常是数据被驱逐或丢失后的残留。列表无法显示这类记录，页面会在表格下方说明差异。失败状态中的这类残留会被自动清理，也可以用 **清理失败记录** 立即清除。
+
 ## 处理异常任务
 
 <Info>**失败** 与 **异常任务维护** 显示的是不同类型的问题，因此数量可能不一致。</Info>
 
 **异常任务维护** 会按 Base、来源表和错误把异常合并成问题组，便于定位同一根因。恢复之前，请先查看失败原因并修复问题。展开问题组可以查看具体错误和组内任务，这些行仅供排查，恢复始终以整个问题组为单位。
 
-每个问题组只有一个操作，取决于它的类型：
+问题组可用的操作取决于它的类型：
 
 | 异常类型 | 操作 | 效果 |
 | --- | --- | --- |
 | **死信** | **恢复整个问题组** | 把该组当前的全部死信一次性恢复到持久队列并重新投递。其他问题组不受影响。 |
+| **死信** | **丢弃问题组** | 永久删除该组中的死信，删除后不可恢复、不可重放，只在确认无需重放时使用。 |
 | **执行超时** | **重新唤醒最近一条超时** | 为组内最新任务重新唤醒队列，由 Worker 接管执行。 |
 
 恢复完成后，Teable 会给出恢复条数、新入队与已在队列的条数，以及已投递和延迟投递的条数。随后 Worker 会按现有的并发和任务分片限制逐步消费这一组任务。
 
+标记为 **Base 已删除** 的问题组，对应的 Base 已经不存在，恢复后会立即再次失败，因此只提供 **丢弃问题组**。
+
 ## 暂停某个空间的计算任务
 
 当某个空间的计算任务正在加剧故障时，可以在 **计算任务暂停** 中单独暂停这个空间，而不必停掉整个实例。
@@ -70,8 +75,15 @@ description: "在管理面板中监控 BullMQ 投递和计算任务积压。"
 
 暂停到期后会自动解除，最长 2 小时。处理时间超出时，可以在本页面重新暂停续期。列表会显示所有生效中的暂停，包括操作人、原因和自动恢复时间，并显示这些暂停当前积压了多少待处理任务，便于判断恢复后会释放多少工作量。需要提前解除时，点击对应行的 **恢复** 并确认。
 
-## 调整 Worker 并发
+## 调整并发
+
+队列区域有两个并发控件。两者都写入集群级覆盖值，所有进程约 15 秒内生效，无需重启，也都可以恢复默认，让各进程回到自身环境变量的设置。覆盖生效时，控件上会显示 **已覆盖** 标记。
+
+| 控件 | 限制的内容 |
+| --- | --- |
+| **每进程并发** | 每个 Worker 进程同时处理多少个计算任务。 |
+| **每 Base claim 上限** | 同一个 Base（**每 Base**）以及其中同一张来源表（**每种子表**）同时处理多少个计算任务。两者默认都是 2，可填 1 到 16。 |
 
-队列区域的 **每进程并发** 表示每个 Worker 进程同时处理多少个计算任务。点击它可以写入集群级覆盖值，所有 Worker 约 15 秒内生效，无需重启。点击 **恢复默认** 会清除覆盖值，各进程回到自身环境变量的设置。
+单个 Base 成为瓶颈时，调大 claim 上限；多个 Base 同时排队时，调大每进程并发。
 
-<Warning>并发调高会增加数据库压力。同一个 Base 另受集群级并发上限 2 的限制，因此调大该值主要在多个 Base 同时排队时才有帮助。</Warning>
+<Warning>并发调高会增加数据库压力。使用[数据库租户](/zh/basic/admin-panel/database-tenant)存储数据的空间，claim 上限始终使用环境变量默认值，因为其连接池是按默认值配置的。</Warning>

zh/basic/space/space-invite.mdx

@@ -62,7 +62,7 @@ description: "通过邮箱或者链接来邀请他人成为空间协作者"
 
 * **权限限制**：只有`可管理`或`可搭建`的用户才能移除其他协作者
 * **自我移除**：当空间中还有其他`可管理`用户时，可以移除自己的访问权限
-* **权限范围**：无法从此窗口移除数据库协作者
+* **权限范围**：移除空间协作者，不会影响其单独获得的数据库权限
 
 添加新用户到空间时，你可以分配以下角色（详见[协作权限明细](/zh/basic/space/space-permission)）：
 
@@ -73,3 +73,9 @@ description: "通过邮箱或者链接来邀请他人成为空间协作者"
 | 可编辑 | 可以对数据进行修改。 |
 | 可评论 | 可以对记录进行评论，不能修改数据。 |
 | 可查看 | 可以查看，不可评论。 |
+
+## 查看数据库权限
+
+在空间协作者列表中，每个成员或部门只占一行，即使还单独拥有某些数据库的权限也是如此。角色旁的 **数据库权限** 标记会显示被邀请进入了几个数据库；从未加入空间的人，则显示为 **仅拥有部分数据库的访问权限**。
+
+展开该行可以看到这些数据库，以及在每个数据库中的角色。在这里点击 **移除数据库权限** 可以收回其中一个数据库的权限；在仅有数据库权限的行上点击 **移除协作者**，会一次性收回该成员在本空间内的全部数据库权限。