docs(7.19): the RLS restriction on derived variables, and the startup Show log button

Two gaps found reviewing the pages against the code that is shipping:

- A derived variable cannot be named by an active row level security rule of
  any scope - mpe_derived_postedit.sas rejects it, because rules are validated
  against the physical table where a derived column does not exist. Neither the
  derived variables page nor row-level-security.md said so.

- The startup failure modal's Show log button (#356, in this release) was not
  documented anywhere. Added to troubleshooting, with why the browser request
  is what gets the log on Viya.

docs/dci-troubleshooting.md

@@ -142,6 +142,12 @@ The app version is bundled into the frontend during the release, and is visible
 
 You can also determine the app version (and SASjs Version, and build time) by opening browser Development Tools and running `appinfo()` in the console.
 
+## The app does not start - Show log
+
+A startup failure shows a modal with the error and the service that failed. When that service is `public/startupservice`, the modal offers **Show log**, which opens the service in a new browser window with `_debug=131`, so the SAS log is the page body.
+
+The button exists because of how Viya runs a request from JavaScript: it can go through a Compute execution task (`_executionTasks=true`), where the log is not returned and the request can time out before the service finishes. The browser request runs the same stored program without a task, so the log is available even when the adapter got nothing back. On SAS 9 it opens the stored process, and on SASjs Server the route returns the service output rather than a log.
+
 ## Support Diagnostics
 
 The frontend sends two input tables with the startup service and with the services that execute customer-provided code - the [hook scripts](macros.md) (pre/post edit and approve hooks) and the dynamic cell dropdown programs. They are available in those services as `work.browser_info` and `work.browser_url_vars`, so a support ticket can be diagnosed from the job log without asking the user follow-up questions, and a hook can adapt to its context. Other services do not receive them.

docs/derived-variables.md

@@ -120,6 +120,7 @@ Derived columns themselves are an EDIT screen feature: the VIEW screen and the d
  - **Dependencies declared.** `VAR_DEPS` lists every input the expression uses - physical columns and derived variables alike. Statements are generated in dependency order, so no sequence number is maintained, and the declaration is checked in both directions: every reference must be declared, and every declared name must be referenced and must exist. Circular references are rejected.
  - **No collisions.** `VAR_NM` must not match an existing column of the target table, or `_____DELETE__THIS__RECORD_____`.
  - **Read-only.** Derived columns cannot be edited in the grid, and any value submitted for them is discarded before the approval package is created.
+ - **Not for row level security.** A derived variable cannot be named by an active [row level security](/row-level-security/) rule, of any scope. RLS rules are validated against the physical table, where a derived column does not exist, so a rule naming one is rejected when it is submitted.
  - **Recomputed on every read.** The value always reflects the current data and the current definition, and there is no history of previous derived values.
 
 A configuration error - a bad name, an invalid type or length, a name collision, or a reference to a derived variable that is not declared in `VAR_DEPS` - stops the EDIT screen with a message naming the variable. A syntax error or an unknown column in the expression itself is caught when the view is compiled, and stops the screen with a message naming the table.

docs/row-level-security.md

@@ -41,6 +41,8 @@ This variable is an integer, and used to divide a complex filter into numerous s
 ### RLS_VARIABLE_NM
 This is the name of the variable against which a filter value will be applied
 
+It must be a physical column of the table. A [derived variable](/derived-variables/) cannot be named here: rules are validated against the table itself, where a derived column does not exist, so such a rule is rejected when it is submitted.
+
 ### RLS_OPERATOR
 The available operator will depend on whether the column is character or numeric.  Example values: