diff --git a/docs/images/README.md b/docs/images/README.md
index b5aad66..165c28c 100644
--- a/docs/images/README.md
+++ b/docs/images/README.md
@@ -6,6 +6,28 @@ They are deliberately absent rather than faked — a mocked-up dashboard image i
 a monitoring repository is worse than none, because it cannot be checked against
 the JSON that produced it.
 
+## What is here now
+
+Two of the four, not four. `network-snmp.png` and `ups-power.png` pass the
+checklist at the bottom of this file. `host-overview.png` and
+`docker-containers.png` do not yet, and are absent rather than committed with a
+note apologising for them:
+
+| File | Why it is not here |
+| --- | --- |
+| `host-overview.png` | A 14-hour hole, 02:00 to 16:00, where the agent was down. Half the panels are a flat line — the exact thing "The window matters" below warns about. |
+| `docker-containers.png` | cAdvisor only started reporting correctly in [#62](https://github.com/Gerrrt/HomeLab/pull/62), so 22 of the 24 hours are empty. |
+
+Both are a re-shoot, not a repair: run `make screenshots` again once the stack
+has a clean day behind it. Tracked in
+[#12](https://github.com/Gerrrt/HomeLab/issues/12).
+
+The Container inventory panel on the Docker dashboard used to publish the
+absolute path of `compose.yaml` — and so a username — because it excluded
+fields by name and cAdvisor kept adding new ones. It now filters to an
+allowlist. That was caught by this checklist working, which is the argument for
+having it.
+
 ## Capturing them
 
 ```bash
diff --git a/docs/images/network-snmp.png b/docs/images/network-snmp.png
new file mode 100644
index 0000000..2da7d93
Binary files /dev/null and b/docs/images/network-snmp.png differ
diff --git a/docs/images/ups-power.png b/docs/images/ups-power.png
new file mode 100644
index 0000000..8810573
Binary files /dev/null and b/docs/images/ups-power.png differ
diff --git a/stacks/observability/grafana/dashboards/docker-containers.json b/stacks/observability/grafana/dashboards/docker-containers.json
index 92af132..844bedf 100644
--- a/stacks/observability/grafana/dashboards/docker-containers.json
+++ b/stacks/observability/grafana/dashboards/docker-containers.json
@@ -1151,7 +1151,7 @@
     {
       "type": "table",
       "title": "Container inventory",
-      "description": "",
+      "description": "Allowlist, not denylist. cAdvisor attaches every Docker label as a container_label_* field, and two of them (com_docker_compose_project_config_files, _project_working_dir) carry the absolute path of the compose file - i.e. a username. The previous excludeByName list did not name them, so they rendered as columns and went into a screenshot headed for a public repo. A denylist has to be updated every time a label is added; this keeps only the three fields the panel is for.",
       "datasource": {
         "type": "prometheus",
         "uid": "prometheus"
@@ -1223,22 +1223,27 @@
         }
       ],
       "transformations": [
+        {
+          "id": "filterFieldsByName",
+          "options": {
+            "include": {
+              "pattern": "^(name|host|Value)$"
+            }
+          }
+        },
         {
           "id": "organize",
           "options": {
-            "excludeByName": {
-              "Time": true,
-              "__name__": true,
-              "job": true,
-              "id": true,
-              "image": true,
-              "site": true,
-              "monitor": true,
-              "instance": true
+            "excludeByName": {},
+            "indexByName": {
+              "name": 0,
+              "host": 1,
+              "Value": 2
             },
             "renameByName": {
               "Value": "Uptime",
-              "name": "Container"
+              "name": "Container",
+              "host": "Host"
             }
           }
         }