An investigation that runs out of time writes up what it found
A root-cause investigation now keeps its own clock instead of trusting the worker to stop it. It stops starting checks it has no time to finish, holds time back to write its conclusion, and when there is still nothing written the row tells you whether the evidence is there or the run gathered nothing.
Every finding on a device carries an Investigate chip. Press it and Wegweiser sends a root-cause investigator at that one machine: it reads the analyser's verdict, then goes and asks the endpoint questions of its own through the agent, until it can name a contributing cause. It gets four minutes.
Being told to stop after four minutes turned out to be a suggestion, and the runs that overran were the ones you most wanted to read.
The spinner was the visible part
What you saw was a finding stuck at "Investigating...". The chip reuses a running investigation rather than starting a second one, so there was nothing to press. Half an hour later the beat swept the row up and failed it as an orphaned run, and everything the investigator had gathered went with it. On a metered provider you had paid for those checks.
Underneath, the interrupt that should have stopped the run was being absorbed. Sometimes by a tool, which catches its own failures on purpose because a check that fails is still evidence the model can reason about. Sometimes inside a model call, by the provider's SDK, which caught the interrupt and quietly retried the request. The second one is not Wegweiser's code, which settles the argument: an investigation cannot rely on being interrupted.
The run keeps its own clock
It now reads the limit it is running under and counts against it. Before starting another round of checks it asks whether there is time to finish that round and still write the conclusion. Seventy seconds are held back for the write-up, which is prose only, one call, and measured at 10 to 50 seconds. Below that, the loop stops asking questions and starts writing.
That is the change on the page. An investigation that used to be killed at four minutes with nothing to show now ends a little sooner with a conclusion on the row, drawn from whatever it managed to check. Fewer checks than it wanted, and a report you can act on.
A round has to fit in the time that is left
The first live run through that clock was not killed, which was the point, and still was not worth reading. Ten rounds of real evidence, then the concluding turn timed out and the row said the investigation had produced no written conclusion.
The check had asked only whether time remained beyond the reserve, and then let the round run as long as it liked. That round started at 150 seconds of 240 and took 65, so the write-up was handed 13 and died on its own timeout. The reserve was checked and then spent.
So a round must now fit inside what is left beyond the reserve, and what a round costs is measured rather than assumed: the longest one this run has actually taken. Within that single run the rounds ranged from 4 seconds to 65, so an average would have made the same mistake more slowly.
When there is still nothing written
Two different things can leave an investigation without a conclusion, and they need different things from you, so the row now says which happened. A run that gathered nothing is worth re-running. A run that gathered plenty and ran out of road before writing it up is not: its evidence is already on the row, in the list of steps under the summary, and a re-run buys the same wall clock again. That row now says how many checks it ran and points you at chat, where the same evidence can be reasoned over with no time limit at all.
Also shipped
The Zammad wizard has a way forward on step 3. An organisation that is already linked shows as a disabled checkbox, and a browser does not submit those, so pressing Import when everything was already linked posted an empty list and sent you back to step 2, every time. An empty import with something already linked is now treated as nothing new to import and moves on, and step 3 carries a Continue to tickets button whenever anything is linked.
The connector says what its last run did. Step 4 used to print the stored sync summary as a raw dictionary under the Save button. It is a sentence now: "Last run 2 hours ago: nothing needed a ticket.", or the counts when there were any, or the reason the run failed. The integrations index also stopped printing a raw HTML entity where the separator between a card's facts should be.
The blog is published at wegweiser.tech/blog. These posts were only served from the app host, which tells every crawler to stay out, so the writing whose whole job is to explain Wegweiser to somebody who has not bought it could not be found by anybody who had not. The marketing site publishes them now, the sitemap lists every post, and the old address redirects to the new one.