0.3.0: auto-classifier, manual trigger via .trigger file, GUI tabs (graphs/snapshots/summary), filter, cross-snapshot correlation, NIC delta baseline

README.md

@@ -116,11 +116,47 @@ The most informative section is **D-state processes** — the `wchan` tells you
 
 Cross-reference `wchan` with PSI io and PSI cpu to distinguish lock contention (low PSI) from genuine resource pressure (high PSI).
 
+## Auto-classification
+
+Each captured snapshot is automatically pattern-matched against known freeze signatures and gets a `## Diagnosis` section at the top:
+
+- **btrfs lock contention** — `btrfs_lock_root_node` / `btrfs_sync_log` wchans with low PSI io
+- **btrfs metadata pressure** — `btrfs_search_slot` without lock contention
+- **USB storage stall** — `usb_sg_wait`, `scsi_eh`, `sd_check_events`
+- **Memory swap thrash** — `folio_wait_bit_common` with PSI mem
+- **Page-fault stall** — `folio_wait_bit_common` without mem pressure (overly aggressive swappiness)
+- **CPU oversubscription** — high PSI cpu, few D-state procs
+- **NIC IRQ saturation** — recent NET_RX softirq concentrated on one CPU (computed against a rolling 5-minute baseline)
+- **Genuine I/O bottleneck** — high PSI io.full
+
+If no signature matches, the snapshot says "uncertain — review manually".
+
+## Cross-snapshot summary
+
+The GUI's **Summary** tab aggregates patterns across all captured snapshots:
+- Top diagnoses (which freeze types occur most)
+- Top kernel wchans (where processes get stuck)
+- Top processes seen in D-state
+- Top CPU consumers at capture time
+- Captures by hour-of-day distribution
+
+Useful for spotting "qBittorrent appears in 80% of freezes" type patterns.
+
+## Live graphs
+
+The GUI's **Live graphs** tab shows the last hour of load, PSI io/cpu, and D-state count as scrolling line graphs. Red dashed lines mark snapshot capture events so you can correlate spikes with the captured forensics.
+
+## Manual capture
+
+Click "📸 Capture Now" in the GUI status bar (or in the tray menu) to trigger a snapshot immediately, regardless of whether thresholds are crossed. Useful when you suspect something is brewing but it hasn't tripped the alarms.
+
 ## Future ideas
 
 - Web UI option (no Qt requirement)
 - Optional perf-profile capture during event
 - HTML/JSON snapshot output mode
+- Snapshot annotations (user notes per capture)
+- Anonymized export for sharing
 
 ## License