diff --git a/docs/dci-troubleshooting.md b/docs/dci-troubleshooting.md
index dad4564..77e65e2 100644
--- a/docs/dci-troubleshooting.md
+++ b/docs/dci-troubleshooting.md
@@ -177,7 +177,7 @@ The page URL parameters as one row per parameter, so a SAS program can read a pa
 | `name` | The URL parameter name. |
 | `value` | The URL parameter value. |
 
-Parameters from both the search string and the hash query string (Angular routes carry them after the `#`) are included; on a name collision the hash value wins. The table is sent only when the page URL has at least one parameter.
+Parameters from both the search string and the hash query string (Angular routes carry them after the `#`) are included; on a name collision the search string value wins. The table is sent only when the page URL has at least one parameter.
 
 The values in both tables are supplied by the client, so treat them as diagnostics hints rather than a security boundary.
 
@@ -192,4 +192,35 @@ dc_version=7.15.0 adapter_version=4.19.0 browser=Chrome browser_version=120.0
 platform=Linux user_agent=...
 ```
 
-A service called directly (for instance from a URL, or by a script), or by an older frontend, has no `work.browser_info` - the log then records that fact instead.
\ No newline at end of file
+A service called directly (for instance from a URL, or by a script), or by an older frontend, has no `work.browser_info` - the log then records that fact instead.
+
+### Reading the tables from a hook
+
+A [hook script](macros.md) is `%include`d into the running service, so it shares the service's WORK library and can read the tables directly. To pick up a URL parameter by name:
+
+```sas
+%let labels=N;
+
+%if %sysfunc(exist(work.browser_url_vars)) %then %do;
+  proc sql noprint;
+    select value into :labels
+    from work.browser_url_vars
+    where name = 'labels';
+  quit;
+%end;
+```
+
+To branch on what the client reports:
+
+```sas
+%if %sysfunc(exist(work.browser_info)) %then %do;
+  data _null_;
+    set work.browser_info;
+    call symputx('dc_timezone', timezone);
+    call symputx('dc_locale', locale);
+  run;
+%end;
+```
+
+!!! warning
+    Guard with `%sysfunc(exist())` before reading. A service called directly, or by a frontend older than this feature, has no `work.browser_info` at all, so an unguarded `set` or `select` fails the job.
\ No newline at end of file