Merge pull request 'docs(va): in-report screenshots for the mapping and the banner' (#30) from docs/va-in-report-images into main

Reviewed-on: #30

.gitea/workflows/publish.yml

@@ -3,6 +3,13 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
+
+# One deploy at a time: `surfer deploy` swaps the site atomically, so two runs
+# racing is not corruption, but it is a wasted build and the last swap wins.
+concurrency:
+  group: surfer-docs
+  cancel-in-progress: false
 
 jobs:
   build:
@@ -19,7 +26,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.12'  # Specify your desired version (e.g., 3.10 or 3.12)
+          python-version: '3.12'  # Specify your desired version (e.g. 3.10 or 3.12)
         env:
           AGENT_TOOLSDIRECTORY: /opt/hostedtoolcache
           RUNNER_TOOL_CACHE: /opt/hostedtoolcache
@@ -31,13 +38,6 @@ jobs:
           apt install -y ./google-chrome*.deb;
           export CHROME_BIN=/usr/bin/google-chrome
 
-      # Deploy tooling is pinned to exact versions: the workflow builds whatever
-      # is committed, and an unpinned `latest` would let a breaking or
-      # compromised upstream release ship straight to the live site.
-      - name: Install Surfer
-        run: |
-          npm -g install cloudron-surfer@6.4.1
-
       - name: build site
         run: |
           pip install mkdocs==1.6.1
@@ -48,5 +48,29 @@ jobs:
           mkdir site/slides
           npx @marp-team/marp-cli@4.5.1 slides/innovation/innovation.md -o ./site/slides/innovation/index.html
           npx @marp-team/marp-cli@4.5.1 slides/if/if.md -o site/if.pdf --allow-local-files --html=true
+
+      # Deploy tooling is pinned to exact versions: the workflow builds whatever
+      # is committed, and an unpinned `latest` would let a breaking or
+      # compromised upstream release ship straight to the live site.
+      #
+      # `deploy` (v7) replaces the site atomically - it extracts to a staging
+      # folder and swaps it in, so a failed upload leaves the current site
+      # serving.  The v6 `put` this replaces was token authenticated, and v7
+      # takes the Cloudron username plus an app password instead.
+      #
+      # The docs live in a NAMED site, `docs`, served at its own alias domain -
+      # not the app's default site - so the name and the domain are both passed.
       - name: Deploy docs
-        run: surfer put --token ${{ secrets.SURFERKEY }} --server docs.datacontroller.io site/* /
+        env:
+          SURFER_PASSWORD: ${{ secrets.SURFER_PASSWORD }}
+          REF_NAME: ${{ gitea.ref_name }}
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          set -euo pipefail
+          npx --yes @cloudron/surfer@7.2.0 deploy site \
+            --server docs.datacontroller.io \
+            --username allan \
+            --password "$SURFER_PASSWORD" \
+            --site-name docs \
+            --domain docs.datacontroller.io \
+            --message "Build from ${REF_NAME} @ ${COMMIT_SHA:0:8}"

docs/dc-overview.md

@@ -35,7 +35,9 @@ When importing an excel file, all rows are loaded into the web page.  You have a
 A CSV upload bypasses the part where the records are loaded into the web page, and ALL rows are sent to the staging area directly.  This makes it suitable for larger uploads.
 
 ## Edit Stage Approve Workflow
-Up to 500 rows can be edited (in the web editor) at one time.  These edits are submitted to a staging area.  After one or more approvals (acceptances) the changes are applied to the source table.
+The EDIT screen loads up to [DC_MAXOBS_WEBEDIT](/dcc-options/#dc_maxobs_webedit) rows (250 by default), or as many rows as fit within [DC_MAXCELLS_WEBEDIT](/dcc-options/#dc_maxcells_webedit) (200,000 cells) - whichever is reached first, so a wide table loads fewer rows than a narrow one.  A larger table is not refused: it loads truncated, with a warning against the table name, and the filter is the way to reach the rest.
+
+These edits are submitted to a staging area.  After one or more approvals (acceptances) the changes are applied to the source table.
 
 ![screenshot](img/dcu_flow.png)
 

docs/dcc-options.md

@@ -23,6 +23,8 @@ Set to YES or NO to enable email alerts. This requires email options to be preco
 ### DC_MAXCELLS_WEBEDIT
 By default, a maximum of 200,000 cells (observations multiplied by variables) can be edited in the browser at one time.  This limit is applied together with [DC_MAXOBS_WEBEDIT](#dc_maxobs_webedit) - whichever is reached first.
 
+A selection over either limit is served truncated: the grid carries the rows that fit, and a warning triangle next to the table name names the limit that was reached.  Filter the table to see the rest.
+
 The cell count matters because the cost of an EDIT screen load tracks the number of cells, not the number of rows.  A 10 column table is comfortable at 250 rows, but 250 rows of a 1000 column table is 250,000 cells.
 
 ### DC_MAXOBS_WEBEDIT

docs/dcu-tableviewer.md

@@ -1,7 +1,7 @@
 # Data Controller for SAS: Viewer
 
 The viewer screen provides a raw view of the underlying table.
-Choose a library, then a table, and click view to see the first 500 rows.
+Choose a library, then a table, and click view to see the first rows - up to the `DC_MAXOBS_WEBVIEW` limit, 2,000 rows by default.
 A filter option is provided should you wish to view a different section of rows.
 
 The following libraries will be visible:
@@ -21,9 +21,9 @@ The search covers **every** column of the table at once, so you do not need to k
 - **Character search** (the default) is a case sensitive CONTAINS match against every character column, so `Smith` finds `Smithson` and `smith` finds `Goldsmith`, but `smith` will not find `Smithson`.
 - **Numeric search** (tick the Numeric box) is an exact match against every numeric column, so `42` will not find `420` or `4210`.
 - If a filter is applied, the search runs within the filtered rows rather than the whole table.
-- The grid is capped by the [`DC_MAXOBS_WEBVIEW`](/dcc-options/#dc_maxobs_webview) option (500 rows by default).
+- The grid is capped by the [`DC_MAXOBS_WEBVIEW`](/dcc-options/#dc_maxobs_webview) option (2,000 rows by default).
-- For a search, the cap applies to the row count as well: a search that matches more rows than the cap returns 500 of them, and the count shown next to the table name is the number of rows returned, not the total number of matches.
+- For a search, the cap applies to the row count as well: a search that matches more rows than the cap returns 2,000 of them, and the count shown next to the table name is the number of rows returned, not the total number of matches.
-- Without a search, the count shown next to the table name is the full number of rows in the filtered view, so it can be higher than the number of rows displayed - a table of 1,200 rows reports `1,200 rows` above a grid holding the first 500.
+- Without a search, the count shown next to the table name is the full number of rows in the filtered view, so it can be higher than the number of rows displayed - a table of 5,000 rows reports `5,000 rows` above a grid holding the first 2,000.
 - A search that matches nothing shows a "No data found with given conditions" panel rather than an empty grid.
 
 ![Full table search](img/full-table-search.png)

docs/deploy-viya.md

@@ -175,4 +175,4 @@ It is possible to embed a Data Controller table within SAS Visual Analytics by s
 
 To make the portlet more visually appealing, the Data Controller title bar can be removed by adding `?embed=true` to the URL.  When opening in a new window, the title bar will be gone.
 
-For a deeper VA integration - where report row selections drive filters and column visibility in the Data Controller editor - append `?embed=va` instead.  See the [SAS Visual Analytics Embed](/embed-va/) page for details on filter modes, configuration, and debugging.
+For a deeper VA integration - where report row selections drive filters and column visibility in the Data Controller editor - append `?embed=va` instead.  See the [SAS Visual Analytics Embed](/visual-analytics/) page for details on filter modes, configuration, and debugging.

docs/derived-variables.md

@@ -6,11 +6,6 @@ description: Derived variables are computed columns that appear in the EDIT scre
 
 # Derived Variables
 
-!!! warning "Draft - not in a release yet"
-    This page describes a feature that is in development. It is published early so
-    the wording and the screenshots can be reviewed; the behaviour described here
-    ships in the next release.
-
 A derived variable is a column that does not exist in the target table, but is computed when the table is loaded into the [EDIT screen](/dc-userguide/#editor). It is read-only, it appears after the physical columns, and it can be filtered on like any other column.
 
 Derived variables are useful when users need to work with a value that is a function of the stored data - a banding, a concatenation, a calculation - without changing the table, the load process, or the ETL.
@@ -23,6 +18,8 @@ The table below is shown in the EDIT screen. `LINE_VALUE` is `QTY * PRICE` and `
 
 ![](./img/derived-grid.png)
 
+The computed columns are marked apart from the physical ones: a tinted header with an `fx` badge, tinted italic cells, and a left edge where the derived block begins. They are read-only, and the marking says so - a column that is locked by a rule or by column level security is dimmed instead, which is a different message from "computed here". Hovering a header shows the variable's label, or its name and expression where no label was configured.
+
 Because the derived columns are created before the filter is applied, they can be filtered like any other column. Here `REGION = 'West'` selects the two western states, and the filter bar names the derived variable:
 
 ![](./img/derived-filter-region.png)

docs/developer-guide/filter-pre-edit-hook.md

@@ -146,9 +146,9 @@ The captures below are the editor for a table with an `ORDER_DATE` column, opene
 
 The user's clause and Data Controller's clause have to be kept apart, because Row Level Security lives in the second one. Combining them as `( user OR previous-quarter ) AND ( validity + RLS )` keeps RLS applied to both branches. Wrapping the whole existing filter instead - `( existing OR previous-quarter )` - would let the previous-quarter rows through without their RLS condition, so do not take that shortcut.
 
-## The row cap
+## The row and cell caps
 
-`getdata` refuses a result larger than `DC_MAXOBS_WEBEDIT` (500 by default) with *Table is too big*. Widening a filter widens the result, so a hook that adds a quarter can push a table over the cap. Check the count before handing the data back, or raise the option for that table in `MPE_CONFIG`.
+`getdata` truncates a result over either `DC_MAXOBS_WEBEDIT` or `DC_MAXCELLS_WEBEDIT`, whichever binds first - a wide table runs out of cells before rows, at floor(cells / columns) rows - and warns against the table name. Widening a filter widens the result, so a hook that adds a quarter can push a table over the cap: the rows past the limit never reach the browser. Check both counts before handing the data back, or raise the options for that table in `MPE_CONFIG`.
 
 ## Matching the filter chips
 

docs/developer-guide/two-rule-sets-one-table.md

@@ -111,7 +111,7 @@ While it runs, the hook can also read `work.browser_info` and `work.browser_url_
 ### Other things to watch
 
 - Concurrency behaves correctly here. Both mirrors route their submit to the same base table, so every approval locks, loads and logs against one identity - unlike the two-libref route above.
-- The filter has already been applied to the empty mirror by the time the pre-edit hook runs, so a hook that reads the real table ignores the user's filter unless it re-applies it (`where %inc filtref`). On a small table you will not notice; on a large one the `DC_MAXOBS_WEBEDIT` cap will stop the edit screen with "Table is too big". [Updating the Filter in a Pre-Edit Hook](/developer-guide/filter-pre-edit-hook/) works through extending that filter.
+- The filter has already been applied to the empty mirror by the time the pre-edit hook runs, so a hook that reads the real table ignores the user's filter unless it re-applies it (`where %inc filtref`). On a small table you will not notice; on a large one the `DC_MAXOBS_WEBEDIT` or `DC_MAXCELLS_WEBEDIT` cap truncates the edit screen, with a warning against the table name. [Updating the Filter in a Pre-Edit Hook](/developer-guide/filter-pre-edit-hook/) works through extending that filter.
 - The hook's output must have the same columns the editor expects - the real table, minus any transaction or processing columns that Data Controller drops on load.
 - The real table must itself be registered in `MPE_TABLES`. The approval screen resolves the table's audit settings from that row, so a changeset routed to a table with no registration cannot be reviewed - the submit is refused up front, naming the table.
 - The mirror's `MPE_TABLES` row is read for the edit screen and the real table's for the load, so keep their `buskey`, `loadtype` and temporal column settings identical.

docs/embed-va.md

@@ -1,62 +0,0 @@
----
-layout: article
-title: SAS Visual Analytics Embed
-description: Embed the Data Controller editor inside a SAS VA report as a data-driven content object.  Row selections in the VA report drive filters and column visibility in the editor.
----
-
-# Embedding inside SAS Visual Analytics
-
-Data Controller can be embedded inside a SAS Visual Analytics report as a **data-driven content** (DDC) object.  This unlocks scenarios where a user can safely modify the values in an underlying SAS table, and have the visualisation updated- all from inside the same report.
-
-## URL
-
-Open the editor as a DDC by appending `?embed=va` to the editor route:
-
-```
-
-`https://yourserver/DC/#/editor/<library>/<table>?embed=va`
-
-```
-
-The `?embed=` parameter accepts three values:
-
-| Value | Behaviour |
-|---|---|
-| `true`  | Chrome (header, back button, sub-nav) is hidden.  Editor functions normally. |
-| `va`    | Same chrome-hiding as `true`, **plus** editor becomes "VA-aware" - any report filters are captured, and columns can be displayed / hidden using the Edit Report interface.  Filter button is disabled (use VA filters instead)|
-| `false` (or omitted) | Standard interactive UI. |
-
-## How VA drives the editor
-
-VA pushes a JSON payload to the iframe via `window.postMessage` whenever the selected rows change.  Data Controller listens for these messages and:
-
-1. Resolves each VA `parameter` to a DC column by matching on column label.
-2. Builds a filter (using existing [Filter](/filter/) machinery) over the selected values.
-3. Hides any VA columns marked as `brush` so the grid stays focused on the user-editable columns (except primary key cols which are always shown)
-
-If VA sends an empty / unmatched message the editor falls back to the unfiltered view but stays in VA mode.
-
-More logic available in [`va-messaging.service.ts'](https://git.datacontroller.io/dc/dc/src/branch/main/client/src/app/services/va-messaging.service.ts).
-
-## Filter Modes
-
-When running in `embed=va` mode, the editor provides two filter modes, controlled by the **Auto-apply** checkbox:
-
-* **Live (default)** - the editor updates automatically as you select rows in the VA report, so the data you see always matches your current selection.
-* **Confirm** - filter changes are held until you click the **Apply** button.  This is useful when editing, where an automatic reload would discard unsaved changes.
-
-A status indicator shows whether a filter change is pending, loading, or idle.  In edit mode, a pending filter is held until you leave edit mode, so your unsaved edits are never lost.
-
-## Configuration in VA
-
-In the VA Report Designer, add a **Data-Driven Content** object and set the URL to the editor route shown above.  Be sure that any report level filters have their corresponding parameters added to the DDC object itself.
-
-## Debugging
-
-A hook script can tell an embedded editor from a standalone one without any client-side inspection: `work.browser_info` carries the page URL and `referrer`, and `work.browser_url_vars` carries `embed=va`. See [Browser Variables](/developer-guide/browser-variables/).
-
-The following snippet can be used in console to dump the values being provided to DC from VA:
-
-```
-console.log(JSON.stringify(window.__vaLastMessage?.data, null, 2))
-```

docs/filter.md

@@ -7,7 +7,7 @@ og_image:  https://docs.datacontroller.io/img/filter_dynamic_on.png
 
 # Filtering
 
-Data Controller for SAS® enables you to create complex table filters. The "dynamic" setting enables the dropdown values to be pre-filtered by previous filter clauses.  Filtered views are shareable!  They are also used when [embedded in VA.](/embed-va)
+Data Controller for SAS® enables you to create complex table filters. The "dynamic" setting enables the dropdown values to be pre-filtered by previous filter clauses.  Filtered views are shareable!  They are also used when [embedded in VA.](/visual-analytics/)
 
 The clause shown above the grid is the resolved WHERE clause that was applied, so it uses SAS syntax - a date, datetime or time filter reads as a SAS literal, eg `SOME_DATE = '20APR2042'd`, rather than the internal day or second count.
 

docs/index.md

@@ -42,7 +42,7 @@ Data Controller is regularly updated with new features.  If you see something th
 * [Row Level Security](/row-level-security)
 * Excel [formula support](excel)
 * Dynamic [cell dropdown](/dynamic-cell-dropdown)
-* [SAS Visual Analytics embed](/embed-va/) - drive the editor from VA report selections
+* [SAS Visual Analytics embed](/visual-analytics/) - drive the editor from VA report selections
 * Works on ALL flavours of SAS (Base, EBI, Viya)
 
 

docs/roadmap.md

@@ -178,3 +178,7 @@ Delivered in v7.13.0.  Formula columns (HARDFORMULA / SOFTFORMULA) are computed
 ### Regex Rules
 
 Delivered.  HARDREGEX (blocking) and SOFTREGEX (warning) rules validate cell values against a Perl-style regular expression.  See [Regex Rules](/dcc-validations/#regex-rules).
+
+### Derived Variables
+
+Computed columns can be configured per table, so the EDIT screen shows values that are not stored anywhere - a banding from a code, a multiplication of two columns - and they can be filtered on like any other column.  The configuration lives in [MPE_DERIVED](/tables/mpe_derived/), and the grid marks the computed columns with an `fx` badge.  See [docs](/derived-variables)

docs/tables/mpe_derived.md

@@ -6,11 +6,6 @@ description: The MPE_DERIVED table is used to configure computed columns that ap
 
 # MPE_DERIVED
 
-!!! warning "Draft - not in a release yet"
-    This page describes a feature that is in development. It is published early so
-    the wording and the screenshots can be reviewed; the behaviour described here
-    ships in the next release.
-
 The MPE_DERIVED table is used to configure derived (computed) variables - columns that are created when a table is loaded into the EDIT screen, so that they can be displayed and filtered on without being stored.  More details are available in the [user guide](/derived-variables/)
 
 The table is itself registered in [MPE_TABLES](/tables/mpe_tables/), so it is maintained through the EDIT screen with the usual review and approve workflow.

docs/visual-analytics.md

@@ -0,0 +1,212 @@
+---
+layout: article
+title: SAS Visual Analytics Embed
+description: Embed the Data Controller editor inside a SAS Visual Analytics report as a data-driven content object, so report selections drive filters and column visibility in the editor.
+og_title: Embedding Data Controller in SAS Visual Analytics
+og_image: https://docs.datacontroller.io/img/va-embed-og.png
+---
+
+# Embedding inside SAS Visual Analytics
+
+Data Controller can be embedded inside a SAS Visual Analytics report as a **data-driven content** (DDC) object.  This unlocks scenarios where a user can safely modify the values in an underlying SAS table, and have the visualisation updated - all from inside the same report.
+
+## URL
+
+Open the editor as a DDC by appending `?embed=va` to the editor route:
+
+```text
+https://yourserver/DC/#/editor/<library>/<table>?embed=va
+```
+
+The `?embed=` parameter accepts three values:
+
+| Value | Data Controller header and navigation | Filter button | Report drives filtering and columns |
+|---|---|---|---|
+| `true` | hidden | **shown** - Data Controller's own filter builder works as usual | no |
+| `va` | hidden | **hidden** - filtering comes from the report instead | yes |
+| `false` (or omitted) | shown | shown | no |
+
+The header and navigation means the Data Controller title bar (with its user menu), the back button and the sub-nav - everything Data Controller would normally show around the grid.
+
+`embed=true` hides that and nothing else: the editor behaves exactly as it does outside a report, including the Filter button, Add Record, and any filtering you apply yourself.
+
+`embed=va` hides the same furniture **and** hands these over to the report:
+
+- **filtering** - the report's filters are captured and applied as selections change, in either live mode or confirm mode (see Filter Modes below).  The first table load is already filtered, so there is no unfiltered flash.
+- **column visibility** - the grid shows the columns the report sends, controlled from the report's Edit Report interface; primary-key columns are always kept visible.
+- **the Filter button is not offered** - filtering belongs to the report in this mode.
+- **Add Record is not offered** - rows are still added from Edit mode's "Add Row".
+- **a "Back to Edit table" bar** appears on the stage, approve and review pages, so a user who follows the review workflow can return to the editor without knowing Data Controller's page paths.
+
+The two filters are not combined.  A filter built inside Data Controller and a filter driven by the report are alternatives, not layers: applying one replaces the other, and in `va` mode the report's filter is re-applied the next time the selection changes.  Showing the button there would offer a filter that silently stops applying as soon as the report is touched, which is why it is hidden rather than disabled.
+
+## How VA drives the editor
+
+VA pushes a JSON payload to the iframe via `window.postMessage` whenever the selected rows change.  Data Controller listens for these messages and:
+
+1. Resolves each VA `parameter` to a DC column by matching on column label.
+2. Builds a filter (using existing [Filter](/filter/) machinery) over the selected values.
+3. Hides any VA columns marked as `brush` so the grid stays focused on the user-editable columns (primary key columns are always shown).
+
+If VA sends an empty / unmatched message the editor falls back to the unfiltered view but stays in VA mode.
+
+In the report below, two report parameters - `SOME_DROPDOWN` and `SOME_DATE` - reach one Data Controller object, and the editor shows both the combined filter and the rows it matches:
+
+![A value and a date parameter filtering the embedded editor](img/va-report-filters.png)
+
+More logic available in [`va-messaging.service.ts`](https://git.datacontroller.io/dc/dc/src/branch/main/client/src/app/services/va-messaging.service.ts).
+
+## Mapping parameters to columns
+
+By default each VA `parameter` is matched to a DC column by name: a parameter whose label is a column of the table filters that column.  That means two DC instances in the same report can only filter the same column from a parameter of the same name - so two report tabs cannot hold different filters on one column.
+
+The `va_parmap` URL parameter overrides the name match, one entry per mapping, `<VA parameter>-<DC column>`:
+
+```text
+https://yourserver/DC/#/editor/<library>/<table>?embed=va&va_parmap=REGION_TAB1-REGION
+```
+
+Repeat the parameter to add mappings.  A report with two tabs, each holding its own instance of the same table and filtering the same column from its own report parameter:
+
+| Report tab | DDC URL |
+|---|---|
+| Tab 1 | `...?embed=va&va_parmap=REGION_TAB1-REGION` |
+| Tab 2 | `...?embed=va&va_parmap=REGION_TAB2-REGION` |
+
+The applied filter is visible in the editor, above the grid - here the parameter `DROPDOWN_TAB1` filtering `SOME_DROPDOWN`, which is not its name (the date parameter beside it is name-matched, which is the default):
+
+![A va_parmap mapping filtering a column](img/va-parmap-filtered.png)
+
+The mapping is per parameter, and additive:
+
+- a mapped parameter always filters the column it names; that column's type in the table decides how the value is formatted, exactly as for a name match
+- a parameter with no mapping keeps the default name match, so a single instance can mix mapped and unmapped parameters
+- the key is matched case-insensitively against the parameter's label
+- an entry is split at its last `-`, so a label may itself contain hyphens (`Sales-2024-DEPT` maps the label `Sales-2024` to `DEPT`)
+- if the named column is not in the table being opened, the parameter is ignored rather than falling back to the name match - a typo cannot silently filter the wrong column
+- a column name that is not a plain SAS name is ignored
+- the mapping applies to filtering only; which columns the grid displays still follows the columns VA sends
+
+## When a mapping cannot be used
+
+A wrong mapping would otherwise look like a working filter over the whole table, so the editor puts a banner above the grid naming the parameter, the column, the table, and what to change:
+
+![The va_parmap warning banner](img/va-parmap-banner.png)
+
+Each line names one cause, and the parameter it concerns is skipped rather than falling back to the name match - a typo never silently filters the wrong column:
+
+| What the banner says | What it means |
+|---|---|
+| `is not a column of <libref>.<table>` | the mapped column does not exist in the table being opened |
+| `is not a date or datetime column` | a date anchor (`ADD`/`RANGE`) was applied to a column that holds something else |
+| `VA is not sending` | no message has named that parameter - usually a spelling mistake in the parameter side of the entry |
+| `all filter <COLUMN> ... different values will show no rows` | two parameters map to one column with different values, so the AND can never match |
+| `a range needs one value` | a `RANGE` mapping was sent several values - one `BETWEEN` carries one period |
+| `N of its M values was not a date` | part of a multi-value parameter could not be read as a date, so only the rest is applied |
+| `was ignored: it needs a "-"` / `is not a transform` | the entry itself is malformed |
+| `the VA parameter name is missing` | the entry starts with the `-`, so there is no parameter to map |
+| `already maps to <COLUMN>, and a parameter can filter only one column` | the same parameter is mapped twice; the first entry wins |
+
+The banner is shown to the report author, inside the report, because that is where the entry is edited: the only fix available from the editor is to change the `va_parmap` entries in the URL of the Data Controller object.
+
+!!! note
+    A parameter label containing `&` must be percent-encoded (`%26`), because `&` separates query parameters.  A space may be written as `+` or `%20`.
+
+## Deriving dates from a parameter value
+
+A mapping can resolve the parameter value through a **named date anchor** before the filter is built, by appending a transform to the column name:
+
+```text
+https://yourserver/DC/#/editor/<library>/<table>?embed=va&va_parmap=SELECTED_DATE-D_DATE:ADD(QUARTER_START,-1)
+```
+
+A report that sends `SELECTED_DATE = 27FEB1961` then filters `D_DATE` on 1961-02-27 **and** 1960-10-01 - the selected date, plus the same point one quarter earlier.
+
+The clause carries both values, so the row for the selected date and the row for the previous quarter are both included.
+
+| Transform | Result | Filter |
+|---|---|---|
+| `ADD(<anchor>,<offset>)` | the value, plus one anchor beside it | `D_DATE IN (01OCT2026, 01JUL2026)` |
+| `RANGE(<period>,<offset>)` | one closed period | `D_DATE BETWEEN 01APR2026 AND 30JUN2026` |
+
+The anchors are `QUARTER_START`, `QUARTER_END`, `MONTH_START`, `MONTH_END`, `YEAR_START` and `YEAR_END`; the periods are `QUARTER`, `MONTH` and `YEAR`.  The offset is a whole number of periods - negative for earlier - and defaults to `0`.  Names and arguments are case-insensitive.
+
+```text
+va_parmap=SELECTED_DATE-D_DATE:ADD(QUARTER_START,-1)
+va_parmap=SELECTED_DATE-D_DATE:ADD(MONTH_END,-1)
+va_parmap=SELECTED_DATE-D_DATE:RANGE(QUARTER,-1)
+va_parmap=SELECTED_DATE-D_DATE:ADD(YEAR_START,-1)
+```
+
+Notes:
+
+- the arithmetic is anchored on the parameter's value, never on today, so a saved report selects the same rows whenever it is opened
+- the result is always a single filter clause, so a transform combines with other parameters exactly as an unmapped one does
+- a transform only applies to date and datetime columns; on any other column the parameter is ignored and the warning banner says so
+- the offset is a whole number; unknown anchors, periods and operations are rejected with a warning naming the entry
+
+## Filter Modes
+
+When running in `embed=va` mode, the editor provides two filter modes, controlled by the **Auto-apply** checkbox:
+
+* **Live (default)** - the editor updates automatically as you select rows in the VA report, so the data you see always matches your current selection.
+* **Confirm** - filter changes are held until you click the **Apply** button.  This is useful when editing, where an automatic reload would discard unsaved changes.
+
+A status indicator shows whether a filter change is pending, loading, or idle.  In edit mode, a pending filter is held until you leave edit mode, so your unsaved edits are never lost.
+
+## Configuration in VA
+
+The mapping lives entirely in the URL of the report object, so the job is to get the right URL onto a **Data-driven content** object and make sure the parameters it names actually reach it.
+
+1. **Add the object.**  In the VA Report Designer, insert a **Data-Driven Content** object, or select the one already on the page.
+
+2. **Point it at Data Controller.**  Open **Options** on the right and paste the SAS Job Execution URL of your DC deployment into **Web Content URL**, with `embed=va` and one `va_parmap` entry per parameter:
+
+    ```text
+    https://yourserver/SASJobExecution/?_file=/YOUR/APPLOC/services/DC.html#/editor/YOURLIB.YOURTABLE?embed=va&va_parmap=REGION_TAB1-REGION
+    ```
+
+    Everything before the `#` is the normal deployment URL; the `#/editor/...` part is the DC route, and `?embed=va` plus the `va_parmap` entries are what this page describes.  One object per report tab, each with its own entry, is what lets two tabs filter the same column differently.
+
+    The URL is a property of the object, not a data source: it lives in **Options > Web Content > URL**, and the object needs no data assigned for Data Controller to open its own table.  In the designer that section looks like this (the field is scrolled to the end of a long URL):
+
+    ![The Web Content URL property on a Data-driven content object](img/va-report-object-options.png)
+
+3. **Make the parameter reach the object.**  VA sends an object only the parameters its query uses.  A report parameter that the object's data does not reference never arrives, and the mapping then has nothing to map - DC reports it as `VA is not sending ...` in the banner.  So bind the parameter into the object (assign it as a source on the object's query, as you would for any other visual), rather than only defining it at report level.
+
+4. **Save the report**, then open it.  DC shows the applied filter above the grid, so a correct mapping is visible without opening the editor:
+
+    ```text
+    FILTER : ( ( REGION = 'Europe' ) )
+    ```
+
+    A date parameter arrives as a display date and is rendered as a SAS date literal, the same as a date filter built inside Data Controller:
+
+    ```text
+    FILTER : ( ( SOME_DROPDOWN = 'Option 1' AND SOME_DATE BETWEEN '01JAN1960'd AND '31MAR1960'd ) )
+    ```
+
+    Something wrong shows the banner instead, with the cause and the fix - see [When a mapping cannot be used](#when-a-mapping-cannot-be-used) above.
+
+!!! note
+    The URL is read when the object loads, so a change to `va_parmap` takes effect when the report (or the page holding the object) is next opened.
+
+### Who the object runs as
+
+The object runs as the person **viewing** the report, using their SAS identity - there is no service account behind it. That person must therefore be a registered Data Controller user: if they are not, DC shows its login card inside the object instead of the editor, which looks like a broken embed rather than a permissions matter.
+
+Register everyone who will open the report before you ship it (Users in DC), and test the report as one of them rather than as the person who built it - the author often has elevated permissions, so a report that works for them can fail for everyone else.
+
+The deployment itself has to be licensed and past its End User License Agreement before it is embedded, for the same reason: an unlicensed instance shows the licensing screen (the agreement, then the free tier until a key is uploaded) inside the object, which reads as a broken embed rather than as setup that was never finished.  Accept the agreement and register the key by opening the deployment directly, then reload the report.
+
+## Debugging
+
+A hook script can tell an embedded editor from a standalone one without any client-side inspection: `work.browser_info` carries the page URL and `referrer`, and `work.browser_url_vars` carries `embed=va`. See [Browser Variables](/developer-guide/browser-variables/).
+
+The following snippet can be used in console to dump the values being provided to DC from VA:
+
+```
+console.log(JSON.stringify(window.__vaLastMessage?.data, null, 2))
+```
+
+Each entry in its `parameters` array carries a `label`, and that label is what a `va_parmap` entry has to match (and what the name match uses when there is no entry).  When a mapping appears to do nothing, compare the labels in this dump with the left-hand side of the entries in the object's URL - a parameter that VA labels differently from what was typed in the URL is silently a different parameter.

mkdocs.yml

@@ -33,7 +33,7 @@ nav:
     - MPE_DATASTATUS_TABS: tables/mpe_datastatus_tabs.md
     - MPE_DATADICTIONARY: tables/mpe_datadictionary.md
     - MPE_DATALOADS: tables/mpe_dataloads.md
-    - MPE_DERIVED (draft): tables/mpe_derived.md
+    - MPE_DERIVED: tables/mpe_derived.md
     - MPE_EMAILS: tables/mpe_emails.md
     - MPE_EXCEL_CONFIG: tables/mpe_excel_config.md
     - MPE_FILTERANYTABLE: tables/mpe_filteranytable.md
@@ -60,7 +60,7 @@ nav:
     - CAS Tables: cas-tables.md
     - Column Level Security: column-level-security.md
     - Dates / Datetimes: dcc-dates.md
-    - Derived Variables (draft): derived-variables.md
+    - Derived Variables: derived-variables.md
     - Dynamic Cell Dropdown: dynamic-cell-dropdown.md
     - Emails: emails.md
     - Excel: excel.md
@@ -73,7 +73,7 @@ nav:
     - Selectboxes: dcc-selectbox.md
     - Tables: dcc-tables.md
     - Validations: dcc-validations.md
-    - Visual Analytics: embed-va.md
+    - Visual Analytics: visual-analytics.md
 - Macros: macros.md
 - Installation:
     - System Requirements: dci-requirements.md
@@ -113,6 +113,7 @@ plugins:
       redirect_maps:
           'dci-evaluation.md': 'dci-deploysas9.md'
           'dcu-fileupload.md': 'files.md'
+          'embed-va.md': 'visual-analytics.md'
 
 # Repository
 repo_name: 'dc/docs.datacontroller.io'