diff --git a/web/src/lib/mock/data.ts b/web/src/lib/mock/data.ts
index 192d92d..b3f64c1 100644
--- a/web/src/lib/mock/data.ts
+++ b/web/src/lib/mock/data.ts
@@ -1263,63 +1263,330 @@ export const frontier: TaskNode[] = explorationGraph.nodes.filter(
 // intent_id 的活动流。planner=worker "planner"、主 agent=worker "mainagent"。
 // 每个 worker 会话含完整工具执行链（tool_use → tool_result → …→ result）。
 export const activity: Activity[] = [
-  // planner
-  { seq: 1, worker: "planner", ts: T("2026-07-24T09:12:10Z"), kind: "round", summary: "第 0 轮 · 目标拆解" },
+  // planner —— 每轮完整决策链：读态势 → 拉 worker 产出对照 → 判目标 → add_intent 派方向
+  // ── 第 0 轮 · 目标拆解与首批意图（2026-07-24 09:12）──
+  { seq: 1000, worker: "planner", ts: T("2026-07-24T09:12:10Z"), kind: "round", summary: "第 0 轮 · 目标拆解" },
   {
-    seq: 2,
+    seq: 1001,
     worker: "planner",
-    ts: T("2026-07-24T09:12:30Z"),
+    ts: T("2026-07-24T09:12:25Z"),
     kind: "thinking",
-    summary: "acme.com 是企业站，攻击面：官网(www)、后台(admin)、API(api)、商城(shop)。先枚举资产，再挑高价值目标。",
+    summary:
+      "graph_overview：goals 已由目标层拆好——g1「获取 acme.com 后台管理权限」、g2「读取用户敏感数据」，均 open；facts=0、recent_facts 为空（图基本空白，还没有任何 worker 产出）。范围内资产只有根域 acme.com + 一个 C 段。攻击面初判：www / admin / api / shop / vpn 五个入口。图里没有 fact，我只能做【极轻量只读探测】把初始意图说具体，绝不在 plan 里把活干了。",
   },
   {
-    seq: 3,
+    seq: 1002,
+    worker: "planner",
+    ts: T("2026-07-24T09:12:40Z"),
+    kind: "tool_use",
+    tool: "bash",
+    tool_use_id: "p0-probe",
+    summary: "curl -sI https://acme.com; curl -sI https://admin.acme.com",
+    detail: "开局态势几乎空白，做 ≤3 次只读探测校准初始意图方向（不做枚举/验证，那是 worker 的活）。",
+  },
+  {
+    seq: 1003,
+    worker: "planner",
+    ts: T("2026-07-24T09:12:52Z"),
+    kind: "tool_result",
+    tool: "bash",
+    tool_use_id: "p0-probe",
+    summary: "acme.com → 302 → www；Server: nginx/1.24.0\nadmin.acme.com → 200，X-Powered-By 缺省，body 命中 element-ui/vue 特征",
+    detail: "admin 是独立后台登录页；确认五入口有效，可把初始意图描述写精准。",
+  },
+  {
+    seq: 1004,
     worker: "planner",
     ts: T("2026-07-24T09:13:00Z"),
-    kind: "text",
-    summary:
-      "拆出两个目标：① 获取后台管理权限 ② 读取用户敏感数据。派生首批意图：子域枚举、后台口令测试、注入探测、API 越权。",
+    kind: "tool_use",
+    tool: "add_intent",
+    tool_use_id: "p0-ai",
+    summary: "add_intent × 4（批量派首批探索方向）",
+    detail:
+      "intents=[\n  { summary: 'acme.com 全量子域枚举 + 存活主机端口/服务识别，摸清攻击面', asset_ids: [acme.com], priority: 6 },\n  { summary: 'admin.acme.com 后台默认口令/弱口令测试（Element-UI 登录，无验证码）', asset_ids: [admin], priority: 9 },\n  { summary: 'www.acme.com/search q 参数 SQL 注入探测', asset_ids: [www], priority: 8 },\n  { summary: 'api.acme.com 订单接口越权(IDOR)测试', asset_ids: [api], priority: 8 },\n]\nparent_ids 均空（顶层全新方向，兜底连 origin fact）。",
   },
-  { seq: 300, worker: "planner", ts: T("2026-07-25T14:12:00Z"), kind: "round", summary: "第 1 轮 · 攻击面加码" },
   {
-    seq: 301,
+    seq: 1005,
     worker: "planner",
-    ts: T("2026-07-25T14:12:20Z"),
-    kind: "text",
-    summary:
-      ".git 泄露出源码+硬编码 DB 口令，shop 指纹疑似 Fastjson。新增目标③「突破 DMZ 建立内网立足点」，派生指纹关联、反序列化 RCE 两条意图。",
+    ts: T("2026-07-24T09:13:02Z"),
+    kind: "tool_result",
+    tool: "add_intent",
+    tool_use_id: "p0-ai",
+    summary: "4 intents created → ids=[i1, i2, i4, i5]，已连入 frontier",
+    detail: "刻意保持路线多样：i1 侦察 + i2（g1 认证路线）+ i4/i5（g2 数据路线），2 条独立机理并行，不过早收敛。",
   },
   {
-    seq: 302,
+    seq: 1006,
+    worker: "planner",
+    ts: T("2026-07-24T09:13:05Z"),
+    kind: "text",
+    summary:
+      "本轮派生首批 4 条意图：i1 资产侦察、i2 后台口令、i4 注入、i5 API 越权。g1 走 i2、g2 走 i4/i5，双目标各有独立入口在推进。等 worker 产出事实后再据血缘加码。",
+  },
+
+  // ── 第 1 轮 · 攻击面加码（2026-07-25 14:12）──
+  { seq: 1100, worker: "planner", ts: T("2026-07-25T14:12:00Z"), kind: "round", summary: "第 1 轮 · 攻击面加码" },
+  {
+    seq: 1101,
+    worker: "planner",
+    ts: T("2026-07-25T14:12:15Z"),
+    kind: "thinking",
+    summary:
+      "对照 recent_facts：workG 交回 faGit「.git 可下载，git-dumper 还原出后端源码」与 faCreds「config.php 硬编码 sa/Acme@2021（疑似内网通用）」；work#6 指纹交回 fa3「shop 命中 Fastjson 1.2.24（存在已知反序列化 RCE）」。两条【材料性新机理】：① 硬编码 DB 口令可能横跨内网复用；② Fastjson 有成熟 RCE 打法。这打开一条与现有认证/注入路线【本质不同】的入口——从 shop 直接 RCE 突破进 DMZ。先拉 faGit 详情核实产物。",
+  },
+  {
+    seq: 1102,
+    worker: "planner",
+    ts: T("2026-07-25T14:12:28Z"),
+    kind: "tool_use",
+    tool: "node_detail",
+    tool_use_id: "p1-nd",
+    summary: "node_detail(faGit) —— 核对 workG 的源码还原产物",
+    detail: "add_intent 前先看 worker 到底还原出什么，避免凭指纹臆测方向。",
+  },
+  {
+    seq: 1103,
+    worker: "planner",
+    ts: T("2026-07-25T14:12:35Z"),
+    kind: "tool_result",
+    tool: "node_detail",
+    tool_use_id: "p1-nd",
+    summary:
+      "faGit 证据：git-dumper 还原出 config.php / db.php / order_api.php；config.php 内 $db=['host'=>'10.10.10.5','user'=>'sa','pass'=>'Acme@2021']",
+    detail: "硬编码指向内网 10.10.10.5(FS01)，佐证 faCreds 的「内网通用」推断——RCE 落地后这组口令值得复用。",
+  },
+  {
+    seq: 1104,
+    worker: "planner",
+    ts: T("2026-07-25T14:12:50Z"),
+    kind: "tool_use",
+    tool: "add_intent",
+    tool_use_id: "p1-ai",
+    summary: "add_intent × 2（Fastjson 突破链，串行分步先派可执行一步）",
+    detail:
+      "intents=[\n  { summary: 'shop.acme.com 组件指纹深挖 + Fastjson 1.2.24 CVE 精确关联(确认 gadget 链)', asset_ids: [shop], parent_ids: [fa3], priority: 7 },\n  { summary: '构造 Fastjson 反序列化 payload 触发 shop RCE，获取反弹 shell', asset_ids: [shop], parent_ids: [fa3], priority: 9 },\n]\n注：这是强依赖串行链，已 TodoWrite 记『指纹→RCE→立足点提权』三步，本轮只派前两步（提权依赖 shell 产出，下轮再派）。",
+  },
+  {
+    seq: 1105,
+    worker: "planner",
+    ts: T("2026-07-25T14:12:52Z"),
+    kind: "tool_result",
+    tool: "add_intent",
+    tool_use_id: "p1-ai",
+    summary: "2 intents created → ids=[i6, i7]，已由 fa3 连入血缘",
+  },
+  {
+    seq: 1106,
+    worker: "planner",
+    ts: T("2026-07-25T14:13:00Z"),
+    kind: "text",
+    summary:
+      "态势升级：源码 + 硬编码内网口令 + Fastjson RCE 构成一条全新突破路线。已请目标层登记 g3「从外网突破 DMZ，建立内网立足点」，派 i6（指纹/CVE 关联）、i7（触发 RCE）。DMZ 提权一步依赖 shell，记入待办下轮派。",
+  },
+
+  // ── 第 2 轮 · 立足点已建，转内网（2026-07-25 20:25）──
+  {
+    seq: 1200,
     worker: "planner",
     ts: T("2026-07-25T20:25:00Z"),
     kind: "round",
     summary: "第 2 轮 · 立足点已建，转内网",
   },
   {
-    seq: 303,
+    seq: 1201,
     worker: "planner",
-    ts: T("2026-07-25T20:26:00Z"),
+    ts: T("2026-07-25T20:25:18Z"),
+    kind: "thinking",
+    summary:
+      "对照血缘：i7 交回 fa4「反弹 shell www-data@dmz-web01(10.0.20.15)，位于 DMZ 段」；提权链交回 fa5「sudo -l 命中 NOPASSWD python3 → 可提权 root」、fa6「立足点第二网卡直连内网 10.10.10.0/24」。g3 的验收条件（突破 DMZ + 建立足点）已被 fa4+fa6 直接满足。先核实 fa6 的内网可达性再 prove_goal。",
+  },
+  {
+    seq: 1202,
+    worker: "planner",
+    ts: T("2026-07-25T20:25:30Z"),
+    kind: "tool_use",
+    tool: "node_detail",
+    tool_use_id: "p2-nd",
+    summary: "node_detail(fa6) —— 确认双网卡与内网可达",
+  },
+  {
+    seq: 1203,
+    worker: "planner",
+    ts: T("2026-07-25T20:25:38Z"),
+    kind: "tool_result",
+    tool: "node_detail",
+    tool_use_id: "p2-nd",
+    summary: "fa6 证据：ip a → eth0 10.0.20.15(DMZ) / eth1 10.10.10.15(内网)；ping 10.10.10.10 通，跨越 DMZ 边界成立",
+  },
+  {
+    seq: 1204,
+    worker: "planner",
+    ts: T("2026-07-25T20:25:50Z"),
+    kind: "tool_use",
+    tool: "prove_goal",
+    tool_use_id: "p2-pg",
+    summary: "prove_goal(g3, evidence=fa6)",
+    detail: "reason：i7 RCE 拿到 DMZ 立足点(fa4)、fa5 提权 root、fa6 证明第二网卡直连内网并 ping 通 DC01——『突破 DMZ 建立内网立足点』验收达成。",
+  },
+  {
+    seq: 1205,
+    worker: "planner",
+    ts: T("2026-07-25T20:25:52Z"),
+    kind: "tool_result",
+    tool: "prove_goal",
+    tool_use_id: "p2-pg",
+    summary: "goal g3 → met（证据 fa6 已连入）；仍有 g1/g2/g4 未达成，任务继续",
+  },
+  {
+    seq: 1206,
+    worker: "planner",
+    ts: T("2026-07-25T20:26:10Z"),
+    kind: "tool_use",
+    tool: "add_intent",
+    tool_use_id: "p2-ai",
+    summary: "add_intent × 4（以立足点为 pivot 展开内网横向）",
+    detail:
+      "intents=[\n  { summary: '以 dmz-web01 为 pivot 做内网 10.10.10.0/24 主机发现与端口识别', asset_ids: [dmz-web01], parent_ids: [fa6], priority: 8 },\n  { summary: '内网横向：复用硬编码口令 sa/Acme@2021 做凭据复用与密码喷洒', parent_ids: [faCreds], priority: 8 },\n  { summary: '内部 Jenkins(10.10.10.20) 未授权 /script Groovy 执行(RCE)', parent_ids: [fa6], priority: 9 },\n  { summary: '对域服务账号做 Kerberoasting 并离线破解', parent_ids: [fa6], priority: 8 },\n]\n主机发现是前置(先派)，其余三条是并行的横向探索维度。",
+  },
+  {
+    seq: 1207,
+    worker: "planner",
+    ts: T("2026-07-25T20:26:12Z"),
+    kind: "tool_result",
+    tool: "add_intent",
+    tool_use_id: "p2-ai",
+    summary: "4 intents created → ids=[i9, i10, i11, i12]",
+  },
+  {
+    seq: 1208,
+    worker: "planner",
+    ts: T("2026-07-25T20:26:20Z"),
     kind: "text",
     summary:
-      "RCE 拿到 www-data 并提权 root，立足点双网卡直连 10.10.10.0/24（g3 达成）。新增目标④「拿下内部靶标 DC01」，派生内网主机发现、凭据复用、Jenkins 利用、Kerberoasting 四条意图。",
+      "g3 达成，攻击面从外网转入内网。已请登记 g4「内网横向，拿下内部靶标域控 DC01」，派 i9（主机发现）+ i10/i11/i12 三条并行横向。凭据复用直接锚在 faCreds 上——外网源码泄露的口令喂给内网横向。",
   },
-  { seq: 304, worker: "planner", ts: T("2026-07-26T00:25:00Z"), kind: "round", summary: "第 3 轮 · 靶标达成复盘" },
+
+  // ── 第 3 轮 · 靶标达成复盘（2026-07-26 00:25）──
+  { seq: 1300, worker: "planner", ts: T("2026-07-26T00:25:00Z"), kind: "round", summary: "第 3 轮 · 靶标达成复盘" },
   {
-    seq: 305,
+    seq: 1301,
     worker: "planner",
-    ts: T("2026-07-26T00:26:00Z"),
+    ts: T("2026-07-26T00:25:16Z"),
+    kind: "thinking",
+    summary:
+      "对照本轮 worker 产出：i9→fa7「内网存活 DC01/FS01/JENKINS」；i11→fa8「Jenkins /script 无鉴权 Groovy」+ fa9「从 Jenkins 凭据库导出 acme\\svc_deploy 明文口令」；i12→fa10「Kerberoast svc_sql TGS，hashcat 破出 Sql@2020」。svc_deploy 属 Domain Admins，i13 已用其 psexec 拿下 DC01 并 secretsdump。g4 验收（拿下 DC01）应已达成，先核对 finding 证据链再盖章。",
+  },
+  {
+    seq: 1302,
+    worker: "planner",
+    ts: T("2026-07-26T00:25:30Z"),
+    kind: "tool_use",
+    tool: "list_findings",
+    tool_use_id: "p3-lf",
+    summary: "list_findings —— 核对 DC01 沦陷的确认证据",
+  },
+  {
+    seq: 1303,
+    worker: "planner",
+    ts: T("2026-07-26T00:25:40Z"),
+    kind: "tool_result",
+    tool: "list_findings",
+    tool_use_id: "p3-lf",
+    summary:
+      "F-09「域控 DC01 完全控制 / secretsdump 导出全域哈希」critical（证据：psexec svc_deploy@10.10.10.10 + NTDS.dit dump）；上游链 fa9→fa10→i13 完整",
+  },
+  {
+    seq: 1304,
+    worker: "planner",
+    ts: T("2026-07-26T00:25:52Z"),
+    kind: "tool_use",
+    tool: "prove_goal",
+    tool_use_id: "p3-pg",
+    summary: "prove_goal(g4, evidence=F-09)",
+    detail: "reason：Jenkins 泄露 svc_deploy(Domain Admin) → psexec 控制 DC01 → secretsdump 全域哈希，F-09 已确认，『拿下内部靶标域控 DC01』达成。",
+  },
+  {
+    seq: 1305,
+    worker: "planner",
+    ts: T("2026-07-26T00:25:54Z"),
+    kind: "tool_result",
+    tool: "prove_goal",
+    tool_use_id: "p3-pg",
+    summary: "goal g4 → met；系统提示：g2 仍 open，非最后一个目标，任务未整体收官",
+  },
+  {
+    seq: 1306,
+    worker: "planner",
+    ts: T("2026-07-26T00:26:10Z"),
     kind: "text",
     summary:
-      "svc_deploy 属于 Domain Admins，已 psexec 拿下 DC01 并 secretsdump 全域哈希（g4 达成）。内外网链路打通，收敛剩余 g2（后台批量用户数据）。",
+      "g4 收官，内外网链路完全打通（外网 RCE → DMZ → 内网 → 域控）。逐一比对未覆盖方向：g2「读取用户敏感数据」仍缺临门一脚，但现有 i3（后台用户接口）+ i5（API IDOR）已覆盖该方向、且都在 running。本轮无【本质不同的未覆盖新方向】——按克制原则 0 新意图，等 i3/i5 产出。",
   },
-  { seq: 4, worker: "planner", ts: T("2026-07-26T03:55:00Z"), kind: "round", summary: "第 4 轮 · 复盘" },
+
+  // ── 第 4 轮 · 后台达成，收敛 g2（2026-07-26 03:55）──
+  { seq: 1400, worker: "planner", ts: T("2026-07-26T03:55:00Z"), kind: "round", summary: "第 4 轮 · 后台达成，收敛 g2" },
   {
-    seq: 5,
+    seq: 1401,
     worker: "planner",
-    ts: T("2026-07-26T03:55:10Z"),
+    ts: T("2026-07-26T03:55:14Z"),
+    kind: "thinking",
+    summary:
+      "对照 recent_facts：work#2 用 faCreds 里的 Acme@2021 命中 admin 后台（i2 done），后台管理权限到手——g1 验收达成，先 prove_goal 盖章。随后做【量化验收核对】：g2「读取用户敏感数据」当前只有 i3/i5 摸到接口面、尚未真正取到批量数据，实测未达标，【禁止】prove_goal，改为提优先级补足取数意图。",
+  },
+  {
+    seq: 1402,
+    worker: "planner",
+    ts: T("2026-07-26T03:55:26Z"),
+    kind: "tool_use",
+    tool: "prove_goal",
+    tool_use_id: "p4-pg",
+    summary: "prove_goal(g1, evidence=fa1)",
+    detail: "reason：i2 用外网泄露的硬编码口令 Acme@2021 成功登入 admin 后台（Element-UI），获取后台管理权限，g1 达成。",
+  },
+  {
+    seq: 1403,
+    worker: "planner",
+    ts: T("2026-07-26T03:55:28Z"),
+    kind: "tool_result",
+    tool: "prove_goal",
+    tool_use_id: "p4-pg",
+    summary: "goal g1 → met；剩余未达成：g2",
+  },
+  {
+    seq: 1404,
+    worker: "planner",
+    ts: T("2026-07-26T03:55:40Z"),
+    kind: "thinking",
+    summary:
+      "g2 量化核对：目标要求『读取用户敏感数据』=实际拿到批量用户记录。graph_overview 里 findings 尚无『成功导出用户数据』条目，i3/i5 均 running 未回取数结果——实测未达标。严禁以『后台已进、大体达成』提前标 met，继续派意图补足差距。",
+  },
+  {
+    seq: 1405,
+    worker: "planner",
+    ts: T("2026-07-26T03:55:52Z"),
+    kind: "tool_use",
+    tool: "add_intent",
+    tool_use_id: "p4-ai",
+    summary: "add_intent × 2（收敛 g2 取数，提高优先级）",
+    detail:
+      "intents=[\n  { summary: '已登入 admin 后台，枚举用户管理/导出接口并批量拉取用户敏感字段', asset_ids: [admin], parent_ids: [fa1], priority: 9 },\n  { summary: 'api.acme.com 订单 IDOR 遍历 order_id 批量拉取用户订单/PII', asset_ids: [api], parent_ids: [fa2], priority: 9 },\n]\n注：i3/i5 已在 running，本轮以更精准的取数描述 + 提优先级(→9)加码，不重复派同义意图。",
+  },
+  {
+    seq: 1406,
+    worker: "planner",
+    ts: T("2026-07-26T03:55:54Z"),
+    kind: "tool_result",
+    tool: "add_intent",
+    tool_use_id: "p4-ai",
+    summary: "2 intents updated → ids=[i3, i5]（优先级升至 9，描述细化为『批量取数』）",
+  },
+  {
+    seq: 1407,
+    worker: "planner",
+    ts: T("2026-07-26T03:55:58Z"),
     kind: "text",
-    summary: "后台已拿下(g1 达成)。继续 g2：派生「枚举后台用户接口」「API IDOR 测试」两条意图并提高优先级。",
+    summary:
+      "g1 达成（4/4 里已 met 3 个：g1/g3/g4）。g2 严守量化验收——只进后台不算，必须拿到批量用户数据才盖章；已把 i3/i5 提到 priority 9 并细化为取数意图，等 worker 回传即可收官整个任务。",
   },
 
   // work#1 · i1 子域枚举与端口扫描（done）