itswl · Nov 12, 2026 · Nov 12, 2026
diff --git a/OVERVIEW.md b/OVERVIEW.md
@@ -12,10 +12,11 @@ limit: a chat message, a ticket or a timer take the same path on the same code
 ([two deployment shapes](docs/deployments.md)). The alert deployment ran in
 production until 2026-09-23.
 
-Every screenshot is from a local run started from nothing on 2026-09-30, not a
-mockup. The investigator's pictures come from five real investigations on
-`gpt-5.6-luna` ($1.10 together, through a gateway speaking the Anthropic
-dialect). The rest come from the no-key demo and the stack smoke.
+Every screenshot is from a local run started from nothing, not a mockup. The
+investigator's pictures come from five real investigations on `glm-5.3` on
+2026-11-12 ($0.44 together at Z.ai's list rates, through Zhipu's endpoint that
+speaks the Anthropic dialect). The rest come from the no-key demo and the stack
+smoke on 2026-09-30, and the phones from the demo on 2026-11-12.
 
 ```
 upstream alert sources (Grafana / Alertmanager / cloud monitoring …)
@@ -107,30 +108,38 @@ startup; a node wider than it declared refuses to start. The one node meant to
 change things runs `danger-only`, where the credential is the blast radius and
 nothing arrives without a person's signed click.
 
-![hookprobe's sessions tab: five real investigations on the left, the payment-gateway report on the right, conclusion first, root cause unknown and said so](docs/img/hookprobe-sessions.png)
-
-The console lists sessions on the left and the conversation on the right, with
-each turn's bill (gpt-5.6-luna · in 1.5k · out 1.4k · cache 55.6kr/21kw ·
-$0.2137 · 25.1s). The report opens on its conclusion and says what it could
-not establish: the host is fictional and unreachable, so the root cause is
-**Unknown**, and the possible causes are named as inferences, not findings. It
-searched the case files first, ranked the remediation, and refused to propose
-a command it could not justify. Below it: the two rulings a person can press,
+![hookprobe's sessions tab: five real investigations on the left, the payment-gateway report on the right, its conclusion first and what it observed set apart from what it inferred](docs/img/hookprobe-sessions.png)
+
+The console lists sessions on the left and the conversation on the right,
+each turn with its bill under the report (glm-5.3 · in 24.3k · out 11.2k ·
+cache 52kr/0w · $0.0968 · 209.2s). The report opens on its conclusion and says
+what it could not establish: nothing in the container reaches production, so
+it reads gateway-2's 5xx as one symptom of a fleet-wide failure from the
+alerts' timing alone — gw-3 and gw-4 fired the same rule within seconds — and
+names db-1's filling disk as the leading shared cause, an inference and
+labelled as one. It opened the sibling case files first, set what it observed
+apart from what it inferred, and ranked the remediation; the three commands it
+proposes, two read-only checks and one that deletes old logs, wait in
+Approvals for a person. Below the report: the two rulings a person can press,
 and the button that distills the run into a runbook draft. A follow-up in the
 box at the bottom resumes the same session with everything it gathered.
 
 ![audit view: every tool call in every run, subagents included, newest first](docs/img/hookprobe-audit.png)
 
 The audit view is a flight recorder the agent cannot edit: one line per tool
-call across all runs. Here, 23 calls: the five runs reading each other's case
-files and grepping for their alerts' terms.
+call across all runs. Here, 52 calls: the five runs reading each other's case
+files, grepping the audit log for their hosts and asking DNS for the hosts,
+and the hourly selftest's four calls, refused as they should be. The disk run's
+one refusal is further down: an `ssh -G db-1` the read-only guard stopped
+before it ran.
 
 ![the waterfall: model and tool calls of one investigation on one time axis](docs/img/hookprobe-waterfall.png)
 
 The CLI reports every model call and tool result to the service itself, and
-the run's page draws them on one axis. This run took 25 seconds, all of it
-waiting on the model across five rounds; its two costliest calls were 72% of
-its $0.21.
+the run's page draws them on one axis. This run took 209 seconds, all of it
+waiting on the model across six rounds; the last call alone spent 165 seconds
+writing the 9.6k-token report, and the two costliest calls were 72% of its
+$0.10.
 
 ![skills browser: the diagnostic runbook distilled from the disk investigation, its six lookups and what they found](docs/img/hookprobe-skills.png)
 
@@ -145,8 +154,11 @@ unzipping it into `.claude/skills/`.
 The environment memory (CLAUDE.md) reaches every investigation. The demo's says
 the alerts' hosts are fictional and unreachable and that a reading nobody took
 must never be reported, and the report above is that memory arriving at the
-model: "the host is fictional/inaccessible", "Root cause: Unknown". The prompt
-view beside it holds the methodology; both are read fresh at every run.
+model: "no reading was taken on any of those systems", "No reading is reported
+below that nobody took." What the runs suggest adding waits above it for a
+person; a plain fact about this deployment, like the one about top-ups, is
+applied by itself under a heading that says so. The prompt view beside it holds
+the methodology; both are read fresh at every run.
 
 Four more things fill it out:
 

diff --git a/README.md b/README.md
@@ -36,6 +36,8 @@ The investigator is the product. The pipe and the judge are the smallest alertin
 - **Half a day, for real:** [STACK.md](STACK.md) runs all three from source; [docs/containment.md](docs/containment.md) is the boundary map you read *before* pointing it at a cluster.
 - **What it does, in full:** [docs/what-you-get.md](docs/what-you-get.md).
 
+![hookprobe's console: a real investigation on GLM-5.3, its conclusion first, what it observed set apart from what it could only infer, and its cost in the header](docs/img/hookprobe-sessions.png)
+
 ![the three boards on a phone, each laid out as an app with a frosted tab bar along the bottom: the pipe's alerts under a large title, its one sentence glowing amber because two things wait on you; the investigator's runtime page with the procedure a person approved and what each command printed; the judge's board](docs/img/hookstack-phones.png)
 
 The three boards install on a phone as apps, read in Chinese or English and follow the system's light or dark; [the full tour](OVERVIEW.md) has every screenshot, from local runs and not mockups.

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -30,6 +30,8 @@
 - **半天，真上：**[STACK.md](STACK.md) 从源码一步步跑起三个服务；[docs/containment.md](docs/containment.md) 是指向真实集群**之前**要读的边界地图。
 - **完整功能清单：**[docs/what-you-get.md](docs/what-you-get.md)（英文）。
 
+![hookprobe 的控制台：一次在 GLM-5.3 上的真实调查，结论在最前面，看到的事实和只能推断的分开写，花费在顶部](docs/img/zh/hookprobe-sessions.png)
+
 ![三块看板装在手机上，都像一个 App，底部是毛玻璃标签栏：hookrelay 的告警页，大标题下那句话泛着琥珀色的光，因为有两件事等你处理；hookprobe 的运行页，一个有人批准过的处置步骤和每条命令的输出；hookjudge 的概览](docs/img/zh/hookstack-phones.png)
 
 三块看板都能装到手机上当 App 用，能切换中英文，并跟随系统的浅色或深色；[完整介绍](OVERVIEW.md)（英文）里有全部截图，取自本地真实运行，不是效果图。

diff --git a/docs/img/hookprobe-audit.png b/docs/img/hookprobe-audit.png
diff --git a/docs/img/hookprobe-memory.png b/docs/img/hookprobe-memory.png
diff --git a/docs/img/hookprobe-sessions.png b/docs/img/hookprobe-sessions.png
diff --git a/docs/img/hookprobe-system.png b/docs/img/hookprobe-system.png
diff --git a/docs/img/hookprobe-waterfall.png b/docs/img/hookprobe-waterfall.png
diff --git a/docs/img/zh/hookprobe-sessions.png b/docs/img/zh/hookprobe-sessions.png
diff --git a/docs/index.md b/docs/index.md
@@ -35,6 +35,8 @@ The investigator is the product. The pipe and the judge are the smallest alertin
 - **Half a day, for real:** [STACK.md](https://github.com/itswl/hookstack/blob/main/STACK.md) runs all three from source; [docs/containment.md](containment.md) is the boundary map you read *before* pointing it at a cluster.
 - **What it does, in full:** [docs/what-you-get.md](what-you-get.md).
 
+![hookprobe's console: a real investigation on GLM-5.3, its conclusion first, what it observed set apart from what it could only infer, and its cost in the header](img/hookprobe-sessions.png)
+
 ![the three boards on a phone, each laid out as an app with a frosted tab bar along the bottom: the pipe's alerts under a large title, its one sentence glowing amber because two things wait on you; the investigator's runtime page with the procedure a person approved and what each command printed; the judge's board](img/hookstack-phones.png)
 
 The three boards install on a phone as apps, read in Chinese or English and follow the system's light or dark; [the full tour](https://github.com/itswl/hookstack/blob/main/OVERVIEW.md) has every screenshot, from local runs and not mockups.

diff --git a/docs/zh/index.md b/docs/zh/index.md
@@ -33,6 +33,8 @@ description: 让 agent 值班，但不把钥匙交出去 —— 管道给每条
 - **半天，真上：**[STACK.md](https://github.com/itswl/hookstack/blob/main/STACK.md) 从源码一步步跑起三个服务；[docs/containment.md](../containment.md) 是指向真实集群**之前**要读的边界地图。
 - **完整功能清单：**[docs/what-you-get.md](../what-you-get.md)（英文）。
 
+![hookprobe 的控制台：一次在 GLM-5.3 上的真实调查，结论在最前面，看到的事实和只能推断的分开写，花费在顶部](../img/zh/hookprobe-sessions.png)
+
 ![三块看板装在手机上，都像一个 App，底部是毛玻璃标签栏：hookrelay 的告警页，大标题下那句话泛着琥珀色的光，因为有两件事等你处理；hookprobe 的运行页，一个有人批准过的处置步骤和每条命令的输出；hookjudge 的概览](../img/zh/hookstack-phones.png)
 
 三块看板都能装到手机上当 App 用，能切换中英文，并跟随系统的浅色或深色；[完整介绍](https://github.com/itswl/hookstack/blob/main/OVERVIEW.md)（英文）里有全部截图，取自本地真实运行，不是效果图。

diff --git a/hookprobe/docs/cost.md b/hookprobe/docs/cost.md
@@ -255,7 +255,7 @@ harness — the part no bill itemises. `GET /v1/runs/{key}/telemetry` is the
 same shape as JSON, and the run's `/audit` record carries the totals. Nothing
 has to be deployed beside the service to see it.
 
-![the waterfall under a finished run: five model calls on one axis, 25 seconds all spent waiting on the model, the tools between them, and the two costliest calls named as 72% of $0.21](../../docs/img/hookprobe-waterfall.png)
+![the waterfall under a finished run: six model calls on one axis, 209 seconds all spent waiting on the model, the tools between them, and the two costliest calls named as 72% of $0.10](../../docs/img/hookprobe-waterfall.png)
 
 Three things about that record. Only the CLI this service launched can write
 it — the subprocess carries a per-process header the receiver checks, and

diff --git a/hookprobe/hookprobe/ui.html b/hookprobe/hookprobe/ui.html
@@ -629,6 +629,12 @@
      they never narrow the title above them. */
   .pane .row { grid-template-columns: auto minmax(0, 1fr) auto; grid-template-areas: "ttl ttl m1" "sub sub sub" "st m2 m2"; padding: 10px 14px; }
   .pane .row .st { align-self: center; padding: 0; }
+  /* A run with every flag (returned, refused N, a ruling) carried more chips
+     than its row is wide, and each chip broke inside itself — "refused" over
+     "1", "1" over "turn" (found 2026-11-12). A chip keeps its words together;
+     the row lets a chip that does not fit go to a line of its own. */
+  .pane .row .m2 { flex-wrap: wrap; row-gap: 4px; }
+  .pane .row .m2 > * { white-space: nowrap; }
   .pane .row .sub { font-family: var(--mono); font-size: 11.5px; }
   .d-head { padding: 14px 18px 10px; border-bottom: 1px solid var(--border-soft); }
   .d-title { display: flex; gap: 10px; align-items: flex-start; }