log10x-mcp 1.30.38 → 1.30.40

package/README.md

@@ -20,7 +20,7 @@ This server is open source under MIT. A Log10x product license (API key) unlocks
 | "This message type is noise, cut it." | Sample, drop, compact, tier down, or offload a chosen message type, with examples and trend so the action is clear. `log10x_pattern_mitigate`, `log10x_pattern_examples`, `log10x_pattern_trend` |
 | "We are 100% Lambda, no cluster. Install there." | The install plan comes back for the serverless estate: the engine as a Lambda extension paired with the function's OTel collector, a CDK construct, and an AWS-native recurring tick over an S3 config plane. `log10x_advise_install`, `log10x_setup_recurring` |
 | "Get me the actual events I offloaded." | Fetch the exact events back on demand from your own S3. `log10x_retriever_query`, `log10x_offload_add`, `log10x_retriever_register` |
-| "Recognize more of my message types." | Build a custom symbol library from your own logs so the engine finds more savings. `log10x_compile`, `log10x_compile_link`, `log10x_compile_status` |
+| "Recognize more of my message types." | Compile your own source code, binaries and container images into a symbol library so the engine names more of your message types. `log10x_compile`, `log10x_compile_link`, `log10x_compile_status` |
 
 ## Install
 
@@ -91,7 +91,7 @@ All optional. The common path is just `LOG10X_API_KEY` (or no key at all).
 | `LOG10X_TENX_PATH` | Path to the local `tenx` binary (used when the resolved mode is `local`). Defaults to `tenx` on PATH. |
 | `LOG10X_RUNTIME_IMAGE` | Engine image for the run path in docker mode (default `log10x/pipeline-10x:latest`). Accepts the alias `native`, which selects the GraalVM-native `log10x/edge-10x`. |
 | `LOG10X_TENX_IMAGE` | Engine image shared by the run path and, as a fallback, `log10x_compile`. A runtime-flavor image here is refused on the compile path. |
-| `LOG10X_COMPILER_IMAGE` | Compiler image for `log10x_compile` / `log10x_compile_link` (default `log10x/compiler-10x:1.1.133` pinned by digest, so every run goes through the same compiler; set it to `:latest` to track releases; falls back to `LOG10X_TENX_IMAGE` when unset). Only the compiler flavor can build a symbol library. |
+| `LOG10X_COMPILER_IMAGE` | Compiler image for `log10x_compile` / `log10x_compile_link` (default `log10x/compiler-10x:1.1.136` pinned by digest, so every run goes through the same compiler; set it to `:latest` to track releases; falls back to `LOG10X_TENX_IMAGE` when unset). Only the compiler flavor can build a symbol library. |
 | `LOG10X_GH_REPO` / `LOG10X_GITOPS_REPO_PATH` | GitHub repo and local path for GitOps-aware config tools. |
 
 ## Connect your own data (optional)

package/build/index.js

@@ -1318,7 +1318,7 @@ async function handleCliFlags() {
             '  LOG10X_TENX_PATH          Path to local tenx CLI (used when LOG10X_TENX_MODE=local). Compile and link need the `compiler` flavor; the `mode` arg of log10x_compile states the three flavors and which are refused',
             '  LOG10X_TENX_IMAGE         Docker image when LOG10X_TENX_MODE=docker, SHARED by the run path and (as a fallback) log10x_compile (default: log10x/pipeline-10x:latest). A runtime-flavor image here is refused on the compile path — use LOG10X_RUNTIME_IMAGE instead',
             '  LOG10X_RUNTIME_IMAGE      Docker image for the run-path engine tools only, leaving log10x_compile alone. Accepts a full ref or the alias `native`, which selects the GraalVM-native log10x/edge-10x:latest (391MB vs 926MB, same @apps/mcp output). Wins over LOG10X_TENX_IMAGE',
-            '  LOG10X_COMPILER_IMAGE     Docker image for log10x_compile. Default log10x/compiler-10x:1.1.133 pinned by digest, so every run goes through the same compiler (the image ref is part of the output-folder key); set it to :latest to track releases. Falls back to LOG10X_TENX_IMAGE',
+            '  LOG10X_COMPILER_IMAGE     Docker image for log10x_compile. Default log10x/compiler-10x:1.1.136 pinned by digest, so every run goes through the same compiler (the image ref is part of the output-folder key); set it to :latest to track releases. Falls back to LOG10X_TENX_IMAGE',
             '  TENX_LICENSE_KEY          License key passed through to the compiler app (log10x_compile); omit to use the image built-in limited license',
             '  GH_TOKEN                  GitHub token for log10x_compile github_repos pull (or pass the github_token arg; required even for public repos)',
             '  DOCKER_USERNAME           Registry username for log10x_compile docker_images pull (or pass the docker_username arg; omit for public images)',

package/build/lib/compile-runner.d.ts

@@ -303,7 +303,7 @@ export declare class HelmRepoAddError extends Error {
  *
  * `LOG10X_COMPILER_IMAGE=log10x/compiler-10x:latest` restores the moving tag.
  */
-export declare const DEFAULT_IMAGE = "log10x/compiler-10x:1.1.133@sha256:b60e06945fedde01bafd60200b59f3bc0623c57e70d1b57edaa0f33fabc1332f";
+export declare const DEFAULT_IMAGE = "log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f";
 /** First engine release where a CLI option given after `@apps/compiler` overrides the app's value. */
 export declare const CLI_OVERRIDE_MIN_ENGINE = "1.1.89";
 /**

package/build/lib/compile-runner.js

@@ -205,7 +205,7 @@ export class HelmRepoAddError extends Error {
  *
  * `LOG10X_COMPILER_IMAGE=log10x/compiler-10x:latest` restores the moving tag.
  */
-export const DEFAULT_IMAGE = 'log10x/compiler-10x:1.1.133@sha256:b60e06945fedde01bafd60200b59f3bc0623c57e70d1b57edaa0f33fabc1332f';
+export const DEFAULT_IMAGE = 'log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f';
 /** First engine release where a CLI option given after `@apps/compiler` overrides the app's value. */
 export const CLI_OVERRIDE_MIN_ENGINE = '1.1.89';
 /**

package/build/lib/runtime-image.d.ts

@@ -74,7 +74,7 @@ export declare const NATIVE_RUNTIME_IMAGE = "log10x/edge-10x:latest";
  * pass-through fix (config #74) ships in this image, checked with a Fluent
  * Bit sidecar: 0 fullText fallbacks, 2,000 of 2,000 lines.
  */
-export declare const EDGE_MANIFEST_IMAGE = "log10x/edge-10x:1.1.133";
+export declare const EDGE_MANIFEST_IMAGE = "log10x/edge-10x:1.1.136";
 /**
  * Resolve the image the run-path (`@apps/mcp`) docker backend should use.
  *

package/build/lib/runtime-image.js

@@ -74,7 +74,7 @@ export const NATIVE_RUNTIME_IMAGE = 'log10x/edge-10x:latest';
  * pass-through fix (config #74) ships in this image, checked with a Fluent
  * Bit sidecar: 0 fullText fallbacks, 2,000 of 2,000 lines.
  */
-export const EDGE_MANIFEST_IMAGE = 'log10x/edge-10x:1.1.133';
+export const EDGE_MANIFEST_IMAGE = 'log10x/edge-10x:1.1.136';
 /** Aliases accepted by LOG10X_RUNTIME_IMAGE in place of a full image ref. */
 const NATIVE_ALIASES = new Set(['native', 'runtime', 'edge']);
 /**

package/build/lib/server-instructions.js

@@ -56,7 +56,7 @@ and mutes or per-pattern sample and compact rows keyed on an old name or hash no
 When new patterns cluster at an engine upgrade, tell the user they are the same statements under new
 names and offer to re-derive the per-pattern rules from the new names.
 
-VOCABULARY: the compact action minifies events: it replaces each event's repeated structure with a template-plus-values encoding so it lands smaller with every field in the encoding, and the destination's expander rebuilds it at read time. Never call it lossless or fully searchable without the destination's terms: on Splunk each event expands exactly up to 256 KB with the current 10x app (a longer one comes back cut) and a search-bar query needs the app's tenxsearch command to see the full text; on Elasticsearch match, match_phrase and multi_match queries (so Kibana and KQL) see the full text and other query types see the encoded form. When describing it, say "compact" or "minify", never "compress" or "compression": 10x does not do binary or gzip compression, and that word misleads. (Vendor billing terms are different and fine to use as-is, e.g. a destination that bills on "compressed ingest", or Datadog's "compressed GB" rehydration price, refer to the vendor's own compression, not ours.)
+VOCABULARY: the compact action minifies events: it replaces each event's repeated structure with a template-plus-values encoding so it lands smaller with every field in the encoding, and the destination's expander rebuilds it at read time. Never call it lossless or fully searchable without the destination's terms: on Splunk each event expands exactly up to 256 KB with the current 10x app (a longer one comes back cut) and a search-bar query needs the app's tenxsearch command to see the full text; on Elasticsearch match, match_phrase and multi_match queries (so Kibana and KQL) see the full text and other query types see the encoded form. Timestamps keep their instant: one written in UTC (Z, +0000) or with no zone comes back exactly, and one with any other offset or zone name (-0700, PDT, GMT) can come back written in another zone. When describing it, say "compact" or "minify", never "compress" or "compression": 10x does not do binary or gzip compression, and that word misleads. (Vendor billing terms are different and fine to use as-is, e.g. a destination that bills on "compressed ingest", or Datadog's "compressed GB" rehydration price, refer to the vendor's own compression, not ours.)
 
 NON-LOSSY FIRST: the value proposition is cutting cost WITHOUT losing data. Whenever you list the Receiver actions, LEAD with the keep-everything levers and present the lossy ones as opt-ins the user explicitly chooses. Order: (1) compact/minify, keeps everything, where the destination supports it (Splunk, self-hosted Elasticsearch/OpenSearch; a no-op on managed backends like Datadog, CloudWatch, Coralogix, and on ClickHouse, where measurement put it at about 7% of table bytes. ClickHouse: offload is the lever, the bill is compute, and every ClickHouse dollar this server prints is modeled); (2) tier_down, keeps everything, a cheaper tier in the same destination, still queryable, where it applies (Datadog Flex, CloudWatch IA, Azure Monitor Basic/Auxiliary Logs, Coralogix Monitoring); (3) offload, keeps everything, routes to the customer's own S3, recoverable on demand, the one lever that applies on every destination; then (4) sample, lossy, keep 1 in N; (5) drop, lossy, discard. NEVER lead with drop or sample. When you enumerate the actions to a prospect, say which keep everything and which are lossy opt-ins. Do not offer compact as a saving on a destination where it is a no-op; lead with that destination's cheaper tier where it has one (on Datadog that is Flex, because the moved events stay searchable in Datadog), and with offload where it has none.
 

package/build/product-kb/docs/api/js.md

@@ -1270,7 +1270,7 @@ this.status = this.symbol("ENUM", "Status"); //capture the 'ENABLED value above
 ### .symbolSequence(symbolContexts,fieldName,maxLen) ⇒ <code>string</code>
 Returns a sequence of [symbol](https://doc.log10x.com/run/transform/structure/#symbols) tokens of a specified type.
 
-This function selects a the longest set of symbol and delimiter tokens from the object's
+This function selects the symbol and delimiter tokens of the origin ranked highest by the [message](https://doc.log10x.com/run/initialize/message/) comparator from the object's
 [TenXTemplate](https://doc.log10x.com/run/template/) based on their context within the source code/binary file from which they originated.
 
 To capture a symbol sequence for the following event:
@@ -1286,7 +1286,7 @@ this.message = symbolSequence("log,class,exec"); // = 'Partition__not_found_comp
 ```
 
 The `symbolContext` argument controls the [symbol contexts](https://doc.log10x.com/run/transform/symbol/#contexts) to search for; 
-if the first type does not yield a result, the next one is tried etc. 
+the listed contexts are evaluated in a single pass, so list order acts as a filter rather than a precedence chain. 
  
 Supported values: package, class, method, log, enum, const, text, exec, any (case insensitive).
 
@@ -1342,7 +1342,7 @@ and [time-series](https://doc.log10x.com/run/output/metric/) output.
 ### .symbolOrigin(symbolContext) ⇒ <code>string</code>
 Returns a the source code/binary origin of 'symbol' tokens of a specified type.
 
-This function selects a the origin (i.e. the source code or binary executable which emitted) the longest set of [symbol](https://doc.log10x.com/run/transform/structure/#symbols) and delimiter tokens from the object's
+This function selects the origin (i.e. the source code or binary executable which emitted) the highest-ranked set of [symbol](https://doc.log10x.com/run/transform/structure/#symbols) and delimiter tokens from the object's
 TenXTemplate.
 
 To capture the origin value for the following event:
@@ -1356,7 +1356,7 @@ The following call can be used:
 this.origin = symbolOrigin("log,class,exec"); // CacheManager.scala'
 ```
 
-The 'symbolContext' argument controls the [symbol contexts](https://doc.log10x.com/run/transform/symbol/#contexts) to search for; if the first type does not yield a result, the next one is tried etc.  
+The 'symbolContext' argument controls the [symbol contexts](https://doc.log10x.com/run/transform/symbol/#contexts) to search for; the listed contexts are evaluated in a single pass, so list order acts as a filter rather than a precedence chain.  
 
 Supported values: PACKAGE, CLASS, METHOD, LOG, ENUM, CONST, TEXT, EXEC (case insensitive).
 

package/build/product-kb/docs/apps/mcp/run.md

@@ -587,8 +587,8 @@ To configure the MCP test-drive app, [:material-cog: Edit](https://doc.log10x.co
           contexts: log,exec
         
           # 'messageField' specifies the field name to assign the message pattern to target TenXObjects: the symbol
-          #  tokens of the origin ranked highest by coverage, meaning the count of distinct library-known tokens it
-          #  explains. Span length is the last tiebreak. The origin file name itself goes to 'originField'.
+          #  tokens of the origin ranked highest on the five-key comparator, message-text width first. Span length
+          #  is the last tiebreak. The origin file name itself goes to 'originField'.
           messageField: message_pattern
         
           # 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
@@ -610,8 +610,9 @@ To configure the MCP test-drive app, [:material-cog: Edit](https://doc.log10x.co
         # indented detail, banners) so the message-template skips its own message-pattern compute for them.
         # The check fires only for templates that don't already pass the (groupSize > 1) || groupHead arms;
         # i.e., for single-event templates with no head signal. A non-negator line in that case (e.g., bare
-        # "Hello World", "Heartbeat received from node-7") still gets a pattern; a negator-matching orphan
-        # (e.g., a lone "\tat com.foo.Bar(...)") does not.
+        # "Hello World", "Heartbeat received from node-7") gets a pattern from its library words; a negator-matching
+        # orphan (e.g., a lone "\tat com.foo.Bar(...)") skips origin selection and is named by a hash of its shape,
+        # template_<hash>.
         message:
           negators:
             - " "                 # any indented line (stack frames, indented app detail, multi-line JSON, banners)

package/build/product-kb/docs/apps/mcp/tools/compile/compile-link.md

@@ -36,7 +36,7 @@ A very large units tree returns a running `job_id` to poll with [`log10x_compile
 
 ## :material-check-decagram-outline: Prerequisites
 
-The Compiler flavor, docker-first: `auto` and `docker` pull `log10x/compiler-10x:1.1.125` (pinned by digest), and `local` runs a Compiler-flavor `tenx`. The Runtime flavor is refused; the `mode` argument of [`log10x_compile`](compile.md) lists the three flavors.
+The Compiler flavor, docker-first: `auto` and `docker` pull `log10x/compiler-10x:1.1.136` (pinned by digest), and `local` runs a Compiler-flavor `tenx`. The Runtime flavor is refused; the `mode` argument of [`log10x_compile`](compile.md) lists the three flavors.
 
 A link into a folder another compile or link job is still writing joins that job instead of starting a second one.
 
@@ -138,7 +138,7 @@ This is the CLI tier, so it needs no Kubernetes, deployed app, or Log10x account
           "job_id": "7b2e9c41-3f5a-4d8e-9b21-6c0f1a2d7e44",
           "job_status": "completed",
           "mode": "docker",
-          "image": "log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
+          "image": "log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
           "compiler": null,
           "exit_code": 0,
           "elapsed_ms": 6240,

package/build/product-kb/docs/apps/mcp/tools/compile/compile-status.md

@@ -149,8 +149,8 @@ The per-language scan failures and the symbol-type counts need a `compiler-10x`
           "job_id": "compile-7c2f",
           "job_status": "completed",
           "mode": "docker",
-          "image": "log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
-          "compiler": "docker:log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
+          "image": "log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
+          "compiler": "docker:log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
           "exit_code": 0,
           "elapsed_ms": 184220,
           "timed_out": false,

package/build/product-kb/docs/apps/mcp/tools/compile/compile.md

@@ -22,7 +22,7 @@ Sources combine freely in one call:
 
 Docker pulls are daemonless. GitHub and Artifactory pulls each need a token, even for public GitHub repos.
 
-The [Compiler app](../../../compiler/) runs the Compiler flavor, docker-first via the `log10x/compiler-10x:1.1.125` image (pinned by digest) or a local Compiler-flavor `tenx`. It runs without Kubernetes, a deployed app, or a Log10x account.
+The [Compiler app](../../../compiler/) runs the Compiler flavor, docker-first via the `log10x/compiler-10x:1.1.136` image (pinned by digest) or a local Compiler-flavor `tenx`. It runs without Kubernetes, a deployed app, or a Log10x account.
 
 What gets scanned, per the shipped scanner config:
 
@@ -38,7 +38,7 @@ The output folder is keyed on the sources, the library name, and the compiler (t
 
 What a re-run skips: the engine skips every local file whose checksum already has a unit in the folder. Pulled sources cost a remote round-trip each run (GitHub branch head, image manifest digest, Artifactory listing) and are downloaded again only when the remote changed; Helm charts are rendered again every run. Only the scan of unchanged files is skipped.
 
-The engine's own whole-scan cap (`scanOperationTimeout`, bundled default 10 minutes) is raised to 90% of `timeout_ms` on the command line, so the engine cap follows `timeout_ms`. That needs compiler 1.1.89 or newer; the pinned default is 1.1.125, and an older local engine keeps its 10 minute cap. A run the engine stopped early is reported as `incomplete` by [Status](compile-status.md).
+The engine's own whole-scan cap (`scanOperationTimeout`, bundled default 10 minutes) is raised to 90% of `timeout_ms` on the command line, so the engine cap follows `timeout_ms`. That needs compiler 1.1.89 or newer; the pinned default is 1.1.136, and an older local engine keeps its 10 minute cap. A run the engine stopped early is reported as `incomplete` by [Status](compile-status.md).
 
 ## :material-code-braces: Example
 
@@ -208,14 +208,14 @@ Archives are scanned as-is: `.jar`, `.war`, `.ear`, `.zip` and tarballs are expa
             "local"
           ],
           "default": "auto",
-          "description": "Execution backend. `auto` (default) prefers Docker (the compiler image, guaranteed compiler flavor) and falls back to a local compiler-flavor tenx; the backend is chosen once, before the output folder is keyed. `docker` forces the image (LOG10X_COMPILER_IMAGE or LOG10X_TENX_IMAGE, default log10x/compiler-10x:1.1.125 pinned by digest, so every run goes through the same compiler). `local` forces the binary (LOG10X_TENX_PATH or `tenx` on PATH) and refuses it unless its version banner reports the compiler flavor (`compiler`, or `cloud` on an engine built before the flavor rename). Of the three shipped flavors only `compiler` can compile: `runtime` (native binary) and `runtime-jvm` (JVM-packaged runtime, the only runtime available on Windows) are both refused, since neither carries the `generate` pipeline unit. With a local install, local-folder compilation and GitHub pull (REST API + token) work out of the box; docker_images pull additionally needs a container engine (podman or docker) on the host. The docker `compiler-10x` image bundles all of those (podman included, daemonless), which is why Docker is the default."
+          "description": "Execution backend. `auto` (default) prefers Docker (the compiler image, guaranteed compiler flavor) and falls back to a local compiler-flavor tenx; the backend is chosen once, before the output folder is keyed. `docker` forces the image (LOG10X_COMPILER_IMAGE or LOG10X_TENX_IMAGE, default log10x/compiler-10x:1.1.136 pinned by digest, so every run goes through the same compiler). `local` forces the binary (LOG10X_TENX_PATH or `tenx` on PATH) and refuses it unless its version banner reports the compiler flavor (`compiler`, or `cloud` on an engine built before the flavor rename). Of the three shipped flavors only `compiler` can compile: `runtime` (native binary) and `runtime-jvm` (JVM-packaged runtime, the only runtime available on Windows) are both refused, since neither carries the `generate` pipeline unit. With a local install, local-folder compilation and GitHub pull (REST API + token) work out of the box; docker_images pull additionally needs a container engine (podman or docker) on the host. The docker `compiler-10x` image bundles all of those (podman included, daemonless), which is why Docker is the default."
         },
         "timeout_ms": {
           "type": "integer",
           "minimum": 10000,
           "maximum": 3600000,
           "default": 1800000,
-          "description": "Hard cap on compile wall time in milliseconds. Default 1,800,000 (30 min). The engine's own whole-scan cap (scanOperationTimeout, bundled default 10 min) is raised to 90% of this value on the command line, so the engine cap follows this value (needs compiler 1.1.89+; the pinned default is 1.1.125; an older local engine keeps its 10 min cap). A re-run over unchanged local sources skips every file whose checksum already has a unit and finishes in seconds. Pulled sources (GitHub, images, Artifactory) are re-checked remotely each run and downloaded again only when the remote changed; Helm charts are rendered again every run."
+          "description": "Hard cap on compile wall time in milliseconds. Default 1,800,000 (30 min). The engine's own whole-scan cap (scanOperationTimeout, bundled default 10 min) is raised to 90% of this value on the command line, so the engine cap follows this value (needs compiler 1.1.89+; the pinned default is 1.1.136; an older local engine keeps its 10 min cap). A re-run over unchanged local sources skips every file whose checksum already has a unit and finishes in seconds. Pulled sources (GitHub, images, Artifactory) are re-checked remotely each run and downloaded again only when the remote changed; Helm charts are rendered again every run."
         },
         "max_wait_ms": {
           "type": "integer",
@@ -264,8 +264,8 @@ Archives are scanned as-is: `.jar`, `.war`, `.ear`, `.zip` and tarballs are expa
           "job_id": "9f2c1a3e-7b4d-4e1a-9f0c-2a1b3c4d5e6f",
           "job_status": "completed",
           "mode": "docker",
-          "image": "log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
-          "compiler": "docker:log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
+          "image": "log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
+          "compiler": "docker:log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
           "exit_code": 0,
           "elapsed_ms": 38120,
           "timed_out": false,

package/build/product-kb/docs/apps/mcp/tools/compile/index.md

@@ -52,7 +52,7 @@ To re-link an existing units tree into a library with no source scan, use [`log1
 
 ## :material-check-decagram-outline: Prerequisites
 
-The compile family runs the [Compiler app](../../../compiler/), which executes the [compile pipeline](../../../../compile/), docker-first. By default it pulls `log10x/compiler-10x:1.1.125`, pinned by digest, so every run goes through the same compiler.
+The compile family runs the [Compiler app](../../../compiler/), which executes the [compile pipeline](../../../../compile/), docker-first. By default it pulls `log10x/compiler-10x:1.1.136`, pinned by digest, so every run goes through the same compiler.
 
 That image bundles the following, so no host docker socket is needed:
 

package/build/product-kb/docs/apps/receiver/compact/index.md

@@ -14,7 +14,7 @@ Reduce storage costs by forwarding [compact](https://doc.log10x.com/run/transfor
 
 <h3 id="analytics-costs"><span class="twemoji" ><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 21H7v-2h4v2m4.5-2H17v2h-4v-2h.2l-1.4-6.1-2.5.6c-.1.5-.3.9-.5 1.3-.9 1.5-2.8 1.9-4.3 1-1.5-.9-1.9-2.8-1-4.3.9-1.5 2.8-1.9 4.3-1 .4.2.7.6.9.9l2.5-.6-.6-2.5c-.4-.1-.8-.3-1.2-.5C8 6.9 7.5 5 8.4 3.5c.9-1.5 2.8-1.9 4.3-1 1.5.9 1.9 2.8 1 4.3-.2.4-.6.7-.9.9L15.5 19M7 11.8c-.7-.5-1.7-.2-2.2.5-.5.7-.2 1.7.5 2.1.7.5 1.7.3 2.2-.5.4-.7.2-1.7-.5-2.1M12.4 6c.5-.7.2-1.7-.5-2.2-.7-.5-1.7-.2-2.2.5-.4.7-.2 1.7.6 2.2.7.4 1.7.2 2.1-.5m.4 5.3c-.2-.1-.4-.1-.5.1-.1.2-.1.4.1.5.2.1.4.1.5-.1.2-.2.1-.4-.1-.5M21 8.5 14.5 10l.5 2.2 7.5-1.8.5-.7-2-1.2M23 19h-4v2h4v-2M5 19H1v2h4v-2Z"></path></svg></span> Cut Log Analytics Costs</h3>
 
-Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [Log10x App](splunk.md) and [L1ES Elasticsearch plugin](elasticsearch.md) expand events in real-time, maintaining full querying, dashboard, and alerting capabilities; compact is lossless, so expanded events match the originals (on Splunk, up to 256 KB per event).
+Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [Log10x App](splunk.md) and [L1ES Elasticsearch plugin](elasticsearch.md) expand events in real-time, maintaining full querying, dashboard, and alerting capabilities; compact is lossless, so expanded events match the originals (on Splunk, up to 256 KB per event). A timestamp that carries an offset or zone name other than UTC (`-0700`, `PDT`) keeps its instant but can come back written in another zone; see [Compact](https://doc.log10x.com/run/transform/#compact).
 
 ## :material-cog-transfer-outline: Workflow
 

package/build/product-kb/docs/apps/receiver/deploy.md

@@ -2179,7 +2179,7 @@ The OTel Collector overlay moves the sidecar's OTLP listener with `TENX_OTEL_COL
 
     **Phase C: processed events flowing**
 
-    The receiver stamps a `tenx_hash` field on every record it hands back, so that field arriving at the destination is the proof that events completed the round trip through 10x. For a real destination, query for the field there: Elasticsearch `exists: tenx_hash`, Splunk `tenx_hash=*`, Datadog `@tenx_hash:*`. For the stdout / `debug` placeholder destination from Step 3, count it on the container that writes to the destination. Pick your forwarder:
+    The receiver hands each record back byte-for-byte unless `symbolMessageHashField` names a field (the forwarder args above). Name one, for example `symbolMessageHashField tenx_hash`, and the receiver adds that field to every record it hands back, so the field arriving at the destination is the proof that events completed the round trip through 10x. For a real destination, query for the field there: Elasticsearch `exists: tenx_hash`, Splunk `tenx_hash=*`, Datadog `@tenx_hash:*`. For the stdout / `debug` placeholder destination from Step 3, count it on the container that writes to the destination. Pick your forwarder:
 
     === ":simple-fluentd: Fluentd"
 

package/build/product-kb/docs/apps/receiver/faq.md

@@ -3,7 +3,7 @@ icon: material/help-circle-outline
 title: "FAQ"
 ---
 
-The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of the 10x pipeline. The rate regulator finds which patterns are over the byte cap set for their service, and an action decides what happens to that excess. The keep-everything actions (compact, offload, tier_down) cut cost without losing data; sample and drop are lossy actions you opt into; pass leaves the pattern untouched. An AI agent picks the action per service through the log10x MCP (the `configure_engine` tool); the engine enforces it, and the decision travels as a config change through the GitOps repo. The Receiver runs as a sidecar alongside your forwarder.
+The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of the 10x pipeline. The rate regulator finds which patterns are over the byte cap set for their service, and an action decides what happens to that excess. The keep-everything actions (compact, offload, tier_down) cut cost without losing data; sample and drop, the Receiver's Filter modes, are lossy: they apply only to the share of a pattern over a cap the operator sets, and that share is dropped unless the operator chooses another action; pass leaves the pattern untouched. An AI agent picks the action per service through the log10x MCP (the `configure_engine` tool); the engine enforces it, and the decision travels as a config change through the GitOps repo. The Receiver runs as a sidecar alongside your forwarder.
 
 <div class="grid cards" markdown>
 
@@ -27,31 +27,30 @@ The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of th
     - **offload**: route the pattern to customer-owned object storage (S3 or any S3-compatible bucket) instead of the destination.
     - **drop**: stop forwarding the pattern.
 
-    An AI agent picks the action per service through the log10x MCP (the `configure_engine` tool), which turns a target percent or budget into a per-pattern action set carried as a cap/action CSV. The CSV lands in the config repo through a GitOps PR and hot-reloads on the next pull. The sample action runs in [per-node budget mode](https://doc.log10x.com/run/receive/rate/){target="_blank"} or [mute file mode](https://doc.log10x.com/run/receive/rate/#mute-file-mode-declarative-field-set-caps){target="_blank"}, a declarative field-set keyed cap file committed to git and pulled via GitOps.
+    An AI agent picks the action per service through the log10x MCP (the `configure_engine` tool), which turns a target percent or budget into per-service caps and actions carried as cap and action CSV files. The files land in the config repo through a GitOps PR and hot-reload on the next pull. Per-pattern rates come from the [mute file](https://doc.log10x.com/run/receive/rate/#protection-list){target="_blank"}, a CSV keyed by pattern, committed to git and pulled the same way.
 
     Log10x is normally driven by an AI agent (Claude, or a model the customer brings) through the log10x MCP server, which installs, configures, and queries via MCP tools. The manual steps in these docs are the same operations without an agent.
 
 ??? tenx-overview "How do budget policies work"
 
-    Configuration is a YAML file, written by hand or generated by the MCP `configure_engine` tool and delivered through GitOps. The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} tracks per-event-type spend using automatic [symbol identity](https://doc.log10x.com/run/initialize/message/){target="_blank"} enrichment. You configure:
+    Configuration is a YAML file, written by hand or generated by the MCP `configure_engine` tool and delivered through GitOps. The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} caps the bytes each pattern ([symbol identity](https://doc.log10x.com/run/initialize/message/){target="_blank"}) may spend in its container over a rolling window. You configure:
 
-    - **Budget per hour**, target ingestion cost rate (e.g., $1.50/hour)
-    - **Max share per event type**, prevents any single event type from dominating the budget (e.g., 20%)
-    - **Severity floors**, ERROR events keep a higher minimum share than DEBUG noise
+    - **A byte cap per pattern per container**, fleet-wide or per container from a cap file; the MCP derives it from a monthly dollar budget
+    - **A share guard**, a pattern below a minimum share of its container's volume (default 5%) is left alone
+    - **Severity floors**, an over-cap pattern keeps at least a set share of each level (by default ERROR 50%, WARN 30%, INFO 10%)
+    - **An action per service** for the excess: drop (the default), offload, tier_down, compact, sample or pass
 
-    Example policy: cap total ingestion at $500/hour, cap any single event type at 20% of the budget, prioritize ERROR over INFO.
-
-    When an event type exceeds its max share, the Receiver samples it down proportionally. For [multi-app environments](https://doc.log10x.com/run/receive/rate/#multi-app-regulation){target="_blank"} (Kubernetes), cap per-app budgets using the [container name](https://doc.log10x.com/run/initialize/k8s/){target="_blank"} field, scaling replicas doesn't bypass limits.
+    Cost is reported per pattern; the cap itself is in bytes. Caps are scoped by the [container name](https://doc.log10x.com/run/receive/rate/#containers){target="_blank"}, so scaling replicas doesn't bypass them.
 
 ??? tenx-overview "What happens to logs when budget limits are reached (sample action)"
 
-    The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} applies cost-based sampling. Each event is either **retained** or **dropped** based on how much its event type has spent relative to the budget:
+    The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} decides per event, on bytes:
 
-    - **Under budget**, all events flow through normally
-    - **Event type over its max share**, that type gets sampled down proportionally (e.g., an event type consuming 60% of the budget with a 20% cap gets sampled to ~33%)
-    - **Severity floors**, ERROR events keep a higher minimum share of the over-cap slice than DEBUG noise
+    - **At or below the pattern's cap**, every event flows through
+    - **Over the cap**, each level keeps its floor share and the rest takes the container's action (drop when none is set); nothing targets the excess back down to the cap line
+    - **Severity floors**, ERROR events keep a higher share of the over-cap slice than DEBUG noise
 
-    The result: noisy event types are automatically throttled while critical events are preserved. The Receiver exports [metrics](https://doc.log10x.com/run/output/metric/){target="_blank"} tracking what each pattern's action did, so policies can be tuned over time. Routed-away events carry the label `routeState` (for example `routeState="drop"`).
+    The result: a noisy pattern is throttled while its errors keep flowing. The Receiver exports [metrics](https://doc.log10x.com/run/output/metric/){target="_blank"} tracking what each pattern's action did, so policies can be tuned over time. Routed-away events carry the label `routeState` (for example `routeState="drop"`).
 
 ### :material-cog-outline: Configuration
 
@@ -69,10 +68,10 @@ The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of th
 
     The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} uses two mechanisms that naturally protect critical events:
 
-    - **Severity floors**, ERROR and WARN events keep a higher minimum share during sampling. Even when their pattern is over its cap, critical-severity events keep flowing at a higher rate than DEBUG noise
-    - **Max share targeting**, sampling only kicks in when a specific [event type](https://doc.log10x.com/run/initialize/message/){target="_blank"} exceeds its configured share of the budget (e.g., 20%). Low-volume event types, which security and authentication logs typically are, stay well under their share and pass through unaffected
+    - **Severity floors**, ERROR and WARN events keep a higher minimum share of the over-cap slice. Even when their pattern is over its cap, critical-severity events keep flowing at a higher rate than DEBUG noise
+    - **Per-pattern caps**, the regulator engages only on a [pattern](https://doc.log10x.com/run/initialize/message/){target="_blank"} over its byte cap and above the share guard (default 5% of its container's volume). Low-volume patterns, which security and authentication logs typically are, stay under their cap and pass through unaffected
 
-    The Receiver targets noisy, high-volume event types that dominate your budget, not broad categories. Security events that don't spike beyond their budget share flow through without sampling.
+    The Receiver targets noisy, high-volume patterns, not broad categories. Security events that stay under their cap flow through untouched.
 
 ??? tenx-capabilities "How do I monitor budget consumption"
 

package/build/product-kb/docs/apps/receiver/index.md

@@ -7,7 +7,7 @@ icon: "material/pipe-valve"
 ---
 The Receiver runs as a forwarder sidecar and acts on each pattern before events reach your analyzer.
 
-It picks one action per pattern: **pass, sample, compact, tier_down, offload, or drop**. An AI agent sets the action per service through the [log10x MCP](https://doc.log10x.com/apps/mcp/) (`configure_engine`); the engine enforces it, carried as a config change through the [GitOps](https://doc.log10x.com/engine/gitops/) repo.
+Its actions are **pass, sample, compact, tier_down, offload, and drop**. The action is set per service and applies to every pattern over its cap in that service. An AI agent sets the action per service through the [log10x MCP](https://doc.log10x.com/apps/mcp/) (`configure_engine`); the engine enforces it, carried as a config change through the [GitOps](https://doc.log10x.com/engine/gitops/) repo.
 
 ## :material-cog-transfer-outline: Workflow
 
@@ -71,7 +71,7 @@ The Receiver executes as a [forwarder sidecar](https://doc.log10x.com/engine/lau
 
 === ":material-file-document-edit-outline: Mute File (GitOps)"
 
-    A declarative file keyed by the joined `rateReceiverFieldNames` values (e.g. `symbolMessage`, `container`) caps specific patterns with an explicit sample rate and expiry. Operators (or an AI assistant via the [Log10x MCP](https://github.com/log-10x/log10x-mcp)) append entries based on [Reporter](https://doc.log10x.com/apps/reporter/) cost attribution, commit to git, and every receiver pulls the file on its next reload. Each mute is diff-reviewed, self-expires, and maps 1:1 to the field-sets the Reporter attributes cost to. See [mute file mode](https://doc.log10x.com/run/receive/rate/#mute-file-mode-declarative-field-set-caps).
+    A declarative file keyed by the joined `rateReceiverFieldNames` values (e.g. `symbolMessage`, `container`) caps specific patterns with an explicit sample rate and expiry. Operators (or an AI assistant via the [Log10x MCP](https://github.com/log-10x/log10x-mcp)) append entries based on [Reporter](https://doc.log10x.com/apps/reporter/) cost attribution, commit to git, and every receiver pulls the file on its next reload. Each mute is diff-reviewed, self-expires, and maps 1:1 to the field-sets the Reporter attributes cost to. See [mute file mode](https://doc.log10x.com/run/receive/rate/#protection-list).
 
 ## :material-shield-check-outline: Safety & Reliability
 

package/build/product-kb/docs/apps/receiver/run.md

@@ -1303,8 +1303,8 @@ To configure the Receiver app, [:material-cog: Edit](https://doc.log10x.com/conf
           contexts: log,exec
         
           # 'messageField' specifies the field name to assign the message pattern to target TenXObjects: the symbol
-          #  tokens of the origin ranked highest by coverage, meaning the count of distinct library-known tokens it
-          #  explains. Span length is the last tiebreak. The origin file name itself goes to 'originField'.
+          #  tokens of the origin ranked highest on the five-key comparator, message-text width first. Span length
+          #  is the last tiebreak. The origin file name itself goes to 'originField'.
           messageField: message_pattern
         
           # 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
@@ -1326,8 +1326,9 @@ To configure the Receiver app, [:material-cog: Edit](https://doc.log10x.com/conf
         # indented detail, banners) so the message-template skips its own message-pattern compute for them.
         # The check fires only for templates that don't already pass the (groupSize > 1) || groupHead arms;
         # i.e., for single-event templates with no head signal. A non-negator line in that case (e.g., bare
-        # "Hello World", "Heartbeat received from node-7") still gets a pattern; a negator-matching orphan
-        # (e.g., a lone "\tat com.foo.Bar(...)") does not.
+        # "Hello World", "Heartbeat received from node-7") gets a pattern from its library words; a negator-matching
+        # orphan (e.g., a lone "\tat com.foo.Bar(...)") skips origin selection and is named by a hash of its shape,
+        # template_<hash>.
         message:
           negators:
             - " "                 # any indented line (stack frames, indented app detail, multi-line JSON, banners)
@@ -6405,7 +6406,7 @@ To configure advanced options (optional) for the Receiver app, [:material-cog: E
             </div>
         </dialog>
         
-        <template class="tenx-config-schema" data-encoding="base64">ewogICJ0eXBlIiA6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIiA6IHsKICAgICJ0ZW54IiA6IHsKICAgICAgInR5cGUiIDogInN0cmluZyIKICAgIH0sCiAgICAic3ltYm9sIiA6IHsKICAgICAgInR5cGUiIDogIm9iamVjdCIsCiAgICAgICJhZGRpdGlvbmFsUHJvcGVydGllcyIgOiBmYWxzZSwKICAgICAgInByb3BlcnRpZXMiIDogewogICAgICAgICJzZXF1ZW5jZVJlc2VydmVkIiA6IHsKICAgICAgICAgICJ0eXBlIiA6IFsKICAgICAgICAgICAgImFycmF5IiwKICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICJudWxsIgogICAgICAgICAgXSwKICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJMaXN0IG9mIHRlcm1zIHRvIGlnbm9yZSB3aGVuIHNjYW5uaW5nIHN5bWJvbCB0b2tlbnNcblxuRGVmaW5lcyBhIGxpc3Qgb2YgdGVybXMgdGhhdCB0byBpZ25vcmUgd2hlbiBzZWFyY2hpbmcgZm9yIHRoZSBzeW1ib2wgdG9rZW5zIGNvbnN0aXR1dGluZyBhbiBUZW5YVGVtcGxhdGUncyAnbWVzc2FnZScgcG9ydGlvbiAoaS5lLiwgdGhlIFtzeW1ib2xdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zdHJ1Y3R1cmUvI3N5bWJvbHMpIHRva2VucyBvZiB0aGUgb3JpZ2luIHJhbmtlZCBoaWdoZXN0IGJ5IGNvdmVyYWdlLCBtZWFuaW5nIHRoZSBjb3VudCBvZiBkaXN0aW5jdCBsaWJyYXJ5LWtub3duIHRva2VucyBpdCBleHBsYWluczsgc3BhbiBsZW5ndGggaXMgdGhlIGxhc3QgdGllYnJlYWspLiBGb3IgZXhhbXBsZSwgZm9yIGFuIFRlblhPYmplY3Qgd2hvc2UgdGV4dCBjb250YWluczogJ2Nvbm5lY3Qgc3VjY2VzcyA9IHRydWUnLCB0aGUgdmFsdWUgJ3RydWUnIHdpbGwgbm90IGJlIGNvbnNpZGVyZWQgYSBwYXJ0IG9mIHRoZSBpbnN0YW5jZSdzIG1lc3NhZ2UsIGFzIGl0IGlzIG1vc3RseSBsaWtlbHkgdGhlIHJlc3VsdCBvZiBhIHZhcmlhYmxlIGJvb2xlYW4gc3RhdGUuIFRvIGxlYXJuIG1vcmUgc2VlIFtzeW1ib2xTZXF1ZW5jZV0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9hcGkvanMvI1RlblhPYmplY3Qrc3ltYm9sU2VxdWVuY2UpLiAoRGVmYXVsdDogW1wibnVsbFwiLFwibmlsXCIsXCJ0cnVlXCIsXCJmYWxzZVwiXSkiLAogICAgICAgICAgIml0ZW1zIiA6IHsKICAgICAgICAgICAgInR5cGUiIDogInN0cmluZyIKICAgICAgICAgIH0sCiAgICAgICAgICAiZGVmYXVsdCIgOiBbCiAgICAgICAgICAgICJudWxsIiwKICAgICAgICAgICAgIm5pbCIsCiAgICAgICAgICAgICJ0cnVlIiwKICAgICAgICAgICAgImZhbHNlIgogICAgICAgICAgXQogICAgICAgIH0sCiAgICAgICAgInByZWFtYmxlIiA6IHsKICAgICAgICAgICJ0eXBlIiA6ICJvYmplY3QiLAogICAgICAgICAgImFkZGl0aW9uYWxQcm9wZXJ0aWVzIiA6IGZhbHNlLAogICAgICAgICAgInByb3BlcnRpZXMiIDogewogICAgICAgICAgICAiZW5jbG9zdXJlcyIgOiB7CiAgICAgICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAgICAgImFycmF5IiwKICAgICAgICAgICAgICAgICJzdHJpbmciLAogICAgICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICAgICAgXSwKICAgICAgICAgICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiUGFpcnMgb2Ygb3BlbiBhbmQgY2xvc2UgY2hhcmFjdGVycyB3aG9zZSB0ZXh0IGJlZm9yZSB0aGUgbWVzc2FnZSBpcyBlbnZlbG9wZVxuXG5EZWZpbmVzIHRoZSBlbmNsb3N1cmVzIG9mIGEgbGluZSdzIHByZWFtYmxlLCBlYWNoIGFuIG9wZW4gYW5kIGEgY2xvc2UgY2hhcmFjdGVyLiBBIHdvcmQgaW5zaWRlIG9uZSBvZiB0aGVtIGJlZm9yZSB0aGUgbWVzc2FnZSAoZS5nLiwgJ21haW4nIGluICdbbWFpbl0gU3RhcnRpbmcgd29ya2VyJykgaXMgZW52ZWxvcGUgYW5kIHN0YXlzIG91dCBvZiB0aGUgVGVuWFRlbXBsYXRlJ3MgbWVzc2FnZSBuYW1lLiBUaGUgbWVzc2FnZSBzdGFydHMgYXQgdGhlIGZpcnN0IHdvcmQgdGhhdCBubyBwYXJ0IG9mIHRoZSBwcmVhbWJsZSBkZXNjcmliZXM6IG5vdCBbcmVzZXJ2ZWRdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zeW1ib2wvI3N5bWJvbHNlcXVlbmNlcmVzZXJ2ZWQpLCBub3QgYSBbbWVzc2FnZSBrZXldKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zeW1ib2wvI3N5bWJvbHByZWFtYmxlbWVzc2FnZWtleXMpLCBub3QgZW5jbG9zZWQgYW5kIG5vdCBhIHJlc2VydmVkIGtleSBvciBpdHMgdmFsdWUuIChEZWZhdWx0OiBbXCJbXVwiLFwiKClcIl0pIiwKICAgICAgICAgICAgICAiaXRlbXMiIDogewogICAgICAgICAgICAgICAgInR5cGUiIDogInN0cmluZyIKICAgICAgICAgICAgICB9LAogICAgICAgICAgICAgICJkZWZhdWx0IiA6IFsKICAgICAgICAgICAgICAgICJbXSIsCiAgICAgICAgICAgICAgICAiKCkiCiAgICAgICAgICAgICAgXQogICAgICAgICAgICB9LAogICAgICAgICAgICAiYXNzaWduZXJzIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAiYXJyYXkiLAogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJDaGFyYWN0ZXJzIHRoYXQgYmluZCBhIGtleSB0byBpdHMgdmFsdWUgd2hlbiB0aGUga2V5IG9yIHRoZSB2YWx1ZSBpcyBxdW90ZWRcblxuRGVmaW5lcyB0aGUgY2hhcmFjdGVycyB0aGF0IGJpbmQgYSBrZXkgdG8gaXRzIHZhbHVlLCBvbmUgY2hhcmFjdGVyIGVhY2gsIHdoZW4gdGhlIGtleSBvciB0aGUgdmFsdWUgaXMgcXVvdGVkIChlLmcuLCAnXCJsZXZlbFwiOlwiaW5mb1wiJywgXCJib2R5OiAnQ2hhcmdlIHJlcXVlc3QgcmVjZWl2ZWQuJ1wiKS4gQSBbcmVzZXJ2ZWRdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zeW1ib2wvI3N5bWJvbHNlcXVlbmNlcmVzZXJ2ZWQpIGtleSBhbmQgaXRzIHZhbHVlIGFyZSBlbnZlbG9wZTsgdGhlIG1lc3NhZ2Ugc3RhcnRzIGluc2lkZSBhIFttZXNzYWdlIGtleV0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vdHJhbnNmb3JtL3N5bWJvbC8jc3ltYm9scHJlYW1ibGVtZXNzYWdla2V5cykncyB2YWx1ZS4gVW5xdW90ZWQsIGEgY29sb24gYmluZHMgbm90aGluZywgc28gJ0Vycm9yOiAxMyBJTlRFUk5BTCcgYW5kICdJTkZPOnJvb3Q6U3RhcnRpbmcnIGtlZXAgdGhlaXIgd29yZHMuIChEZWZhdWx0OiBbXCI9XCIsXCI6XCJdKSIsCiAgICAgICAgICAgICAgIml0ZW1zIiA6IHsKICAgICAgICAgICAgICAgICJ0eXBlIiA6ICJzdHJpbmciCiAgICAgICAgICAgICAgfSwKICAgICAgICAgICAgICAiZGVmYXVsdCIgOiBbCiAgICAgICAgICAgICAgICAiPSIsCiAgICAgICAgICAgICAgICAiOiIKICAgICAgICAgICAgICBdCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJiYXJlQXNzaWduZXJzIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAiYXJyYXkiLAogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJDaGFyYWN0ZXJzIHRoYXQgYWxzbyBiaW5kIGFuIHVucXVvdGVkIGtleSB0byBhbiB1bnF1b3RlZCB2YWx1ZVxuXG5EZWZpbmVzIHRoZSBhc3NpZ25lcnMgdGhhdCBiaW5kIGEga2V5IHdpdGhvdXQgcXVvdGVzLCBvbmUgY2hhcmFjdGVyIGVhY2gsIGFzIGxvZ2ZtdCB3cml0ZXMgdGhlbSAoZS5nLiwgJ2xldmVsPWluZm8nLCAnbG9nZ2VyPWNsZWFudXAnKS4gQW4gYXNzaWduZXIgbGlzdGVkIGhlcmUgYmluZHMgaW4gcmVjb3JkIGZvcm0gdG9vLiAoRGVmYXVsdDogW1wiPVwiXSkiLAogICAgICAgICAgICAgICJpdGVtcyIgOiB7CiAgICAgICAgICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICAgICAgICAgIH0sCiAgICAgICAgICAgICAgImRlZmF1bHQiIDogWwogICAgICAgICAgICAgICAgIj0iCiAgICAgICAgICAgICAgXQogICAgICAgICAgICB9LAogICAgICAgICAgICAiam9pbmVycyIgOiB7CiAgICAgICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAgICAgImFycmF5IiwKICAgICAgICAgICAgICAgICJzdHJpbmciLAogICAgICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICAgICAgXSwKICAgICAgICAgICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiU2VwYXJhdG9ycyB0aGF0IGNoYWluIHdvcmRzIGludG8gb25lIG5hbWUsIHJlYWQgdG8gZmluZCBhIGdyb3VwJ3MgbGVhZFxuXG5EZWZpbmVzIHRoZSBzZXBhcmF0b3JzIHRoYXQgY2hhaW4gdHdvIG9yIG1vcmUgd29yZHMsIHdyaXR0ZW4gd2l0aG91dCB3aGl0ZXNwYWNlLCBpbnRvIG9uZSBuYW1lIChlLmcuLCAnb3JnLmFwYWNoZS5rYWZrYS5sb2cuTG9jYWxMb2cnLCAnY2FydC5jYXJ0c3RvcmUuVmFsa2V5Q2FydFN0b3JlJyksIHR5cGljYWxseSBhIGxvZ2dlciwgY2xhc3Mgb3IgZmlsZSBuYW1lLiBUaGV5IGRlY2lkZSBvbmx5IHdoaWNoIG1lbWJlciBvZiBhIG11bHRpLWxpbmUgZXZlbnQgbmFtZXMgaXQ6IGEgbWVtYmVyIHdob3NlIGV2ZXJ5IHdvcmQgaXMgc3VjaCBhIG5hbWUgb3Igb3RoZXIgZW52ZWxvcGUgZG9lcyBub3QgbGVhZCB0aGUgZ3JvdXAgKHNlZSBbc3ltYm9sR3JvdXBMZWFkXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi90cmFuc2Zvcm0vc3ltYm9sLyNzeW1ib2xncm91cGxlYWQpKS4gSW4gYSBtZXNzYWdlIG5hbWUgYSBqb2luZWQgbmFtZSBzdGF5cywgYXMgYSBsb2dnZXIgb3IgY2xhc3MgbmFtZSBpcyBvZnRlbiB0aGUgb25seSB0ZXh0IHRoYXQgdGVsbHMgdHdvIHN0YXRlbWVudHMgYXBhcnQuIChEZWZhdWx0OiBbXCIuXCIsXCI6OlwiXSkiLAogICAgICAgICAgICAgICJpdGVtcyIgOiB7CiAgICAgICAgICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICAgICAgICAgIH0sCiAgICAgICAgICAgICAgImRlZmF1bHQiIDogWwogICAgICAgICAgICAgICAgIi4iLAogICAgICAgICAgICAgICAgIjo6IgogICAgICAgICAgICAgIF0KICAgICAgICAgICAgfSwKICAgICAgICAgICAgIm1lc3NhZ2VLZXlzIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAiYXJyYXkiLAogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJLZXlzIHdob3NlIGJvdW5kIHZhbHVlIGhvbGRzIHRoZSBtZXNzYWdlXG5cbkRlZmluZXMgdGhlIGtleXMgd2hvc2UgdmFsdWUgaG9sZHMgdGhlIG1lc3NhZ2UuIFRoZSBtZXNzYWdlIHN0YXJ0cyBhdCB0aGUgdmFsdWUncyBmaXJzdCB3b3JkIHRoZSBwcmVhbWJsZSBkb2VzIG5vdCBkZXNjcmliZSAoZS5nLiwgJ3N0YXJ0aW5nJyBpbiAnbXNnPXN0YXJ0aW5nJywgJ1N1YmNoYW5uZWwnIGluICdcIm1zZ1wiOlwiW2NvcmVdW0NoYW5uZWwgIzFdIFN1YmNoYW5uZWwgY3JlYXRlZFwiJywgJ0NoYXJnZScgaW4gXCJib2R5OiAnQ2hhcmdlIHJlcXVlc3QgcmVjZWl2ZWQuJ1wiKS4gSW4gYSByZWNvcmQgdGhhdCBvcGVucyB3aXRoICd7JywgcmVhZGluZyBzdGFydHMgYXQgdGhlIGZpcnN0IG1lc3NhZ2Uga2V5IHdpdGggYSB2YWx1ZS4gQSBtZXNzYWdlIGtleSB3aXRob3V0IGEgdmFsdWUgaXMgZW52ZWxvcGUsIGFzIGEgcmVzZXJ2ZWQgd29yZCBpcy4gKERlZmF1bHQ6IFtcIm1zZ1wiLFwibWVzc2FnZVwiLFwiYm9keVwiXSkiLAogICAgICAgICAgICAgICJpdGVtcyIgOiB7CiAgICAgICAgICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICAgICAgICAgIH0sCiAgICAgICAgICAgICAgImRlZmF1bHQiIDogWwogICAgICAgICAgICAgICAgIm1zZyIsCiAgICAgICAgICAgICAgICAibWVzc2FnZSIsCiAgICAgICAgICAgICAgICAiYm9keSIKICAgICAgICAgICAgICBdCiAgICAgICAgICAgIH0KICAgICAgICAgIH0KICAgICAgICB9LAogICAgICAgICJncm91cExlYWQiIDogewogICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICBdLAogICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIk1lbWJlciBvZiBhIG11bHRpLWxpbmUgZ3JvdXAgd2hvc2UgdGV4dCBuYW1lcyB0aGUgZ3JvdXBcblxuU2VsZWN0cyB0aGUgbWVtYmVyIG9mIGEgbXVsdGktbGluZSBldmVudCBncm91cCB3aG9zZSB0ZXh0IG5hbWVzIGl0LiAnZmlyc3RXaXRoTWVzc2FnZScgbmFtZXMgYSBncm91cCBmcm9tIGl0cyBmaXJzdCBtZW1iZXIgd2hvc2UgaW5wdXQgZmllbGQgaXMgbm90IGFsbCBlbnZlbG9wZSwgYSBuYW1lIG9mIHdvcmRzIGNoYWluZWQgYnkgYSBbam9pbmVyXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi90cmFuc2Zvcm0vc3ltYm9sLyNzeW1ib2xwcmVhbWJsZWpvaW5lcnMpIGNvdW50aW5nIGFzIGVudmVsb3BlIGhlcmUsIHNvIGEgaGVhZCBzdWNoIGFzIHRoZSAuTkVUIGNvbnNvbGUgbG9nZ2VyJ3MgJ2luZm86IGNhcnQuY2FydHN0b3JlLlZhbGtleUNhcnRTdG9yZVswXScgYmVmb3JlIHRoZSByZWNvcmQgaG9sZGluZyB0aGUgbWVzc2FnZSBsZWF2ZXMgdGhlIG5hbWUsIG9yaWdpbiBhbmQgc2tlbGV0b24gdG8gdGhhdCByZWNvcmQuIEEgaGVhZCB0aGF0IGhvbGRzIGEgbWVzc2FnZSAoZS5nLiwgYSBzdGFjayB0cmFjZSdzIGV4Y2VwdGlvbiBsaW5lKSBuYW1lcyB0aGUgZ3JvdXAuICdoZWFkJyBhbHdheXMgbmFtZXMgYSBncm91cCBmcm9tIGl0cyBoZWFkLiAoRGVmYXVsdDogZmlyc3RXaXRoTWVzc2FnZSkiLAogICAgICAgICAgImRlZmF1bHQiIDogImZpcnN0V2l0aE1lc3NhZ2UiCiAgICAgICAgfSwKICAgICAgICAibWF4T3JpZ2lucyIgOiB7CiAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICJudW1iZXIiLAogICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICBdLAogICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIk1heCBudW1iZXIgb2Ygc291cmNlL2JpbmFyeSBvcmlnaW5zIHRvIGxpc3QgcGVyIHN5bWJvbFxuXG5Db250cm9scyB0aGUgbnVtYmVyIG9mIHNvdXJjZSBjb2RlL2JpbmFyeSBvcmlnaW5zIHRvIGxpc3QgcGVyIHN5bWJvbCB0b2tlbiBzZXF1ZW5jZS4gQXMgYSBzZXJpZXMgb2YgdG9rZW5zIHdpdGhpbiAgYSBnaXZlbiB0ZW1wbGF0ZSAoZS5nLiwgJ0VSUk9SJywgJ2NvdWxkIG5vdCBjb25uZWN0IHRvIFwie30nKSBtYXkgYXBwZWFyICBpbiBtdWx0aXBsZSBzb3VyY2UvYmluYXJ5IGZpbGVzIHdpdGhpbiB0aGUgcGlwZWxpbmUncyBzeW1ib2wgZmlsZXMsIHRoZSBzb3J0aW5nIGFsZ29yaXRobSBzZWxlY3RzIFttYXhTeW1ib2xPcmlnaW5zXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi90cmFuc2Zvcm0vc3ltYm9sLyNzeW1ib2xtYXhvcmlnaW5zKSBmb3IgY29tcGFyaXNvbi4gKEFjY2VwdHMgbnVtYmVyIG9yIHN0cmluZyB3aXRoICQ9IHByZWZpeCBmb3IgcnVudGltZSBldmFsdWF0aW9uKSAoRGVmYXVsdDogNjQpIiwKICAgICAgICAgICJkZWZhdWx0IiA6IDY0CiAgICAgICAgfSwKICAgICAgICAiZGVidWciIDogewogICAgICAgICAgInR5cGUiIDogIm9iamVjdCIsCiAgICAgICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiIDogZmFsc2UsCiAgICAgICAgICAicHJvcGVydGllcyIgOiB7CiAgICAgICAgICAgICJvcmlnaW5zIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAiYXJyYXkiLAogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJMaXN0IG9mIHNvdXJjZSBzY2FubmVkIGZpbGUgbmFtZXMgZm9yIHdoaWNoIHRvIGxvZyBpbmZvcm1hdGlvblxuXG5TcGVjaWZpZXMgYSBsaXN0IG9mIGlucHV0IGZpbGUgbmFtZXMgd2l0aGluIHRoZSBsb2FkZWQgc3ltYm9sIGxpYnJhcnkgKGUuZy4sICdteS5zY2FsYScsICdmb28uamF2YScpIGZvciB3aGljaCB0byBsb2cgaW5mb3JtYXRpb24gb24gaWYvaG93IHRoZXkgcGFydGljaXBhdGUgaW4gc2VsZWN0aW5nIHRoZSBvcmlnaW4gb2YgYSB0YXJnZXQgVGVuWFRlbXBsYXRlIHN5bWJvbCBzZXF1ZW5jZS4gVGhpcyBvcHRpb24gaGVscHMgZGVidWcgaG93IHRoZSBbc3ltYm9sU2VxdWVuY2VdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vYXBpL2pzLyNUZW5YT2JqZWN0K3N5bWJvbFNlcXVlbmNlKSBmdW5jdGlvbiBzZWxlY3RzICBvcmlnaW4gdmFsdWVzIGZvciBhIHRhcmdldCBUZW5YVGVtcGxhdGUgc3ltYm9sIHNlcXVlbmNlLiAgU3BlY2lmeSAnKicgZm9yIGFsbCBpbnB1dCBmaWxlcy4iLAogICAgICAgICAgICAgICJpdGVtcyIgOiB7CiAgICAgICAgICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICAgICAgICAgIH0KICAgICAgICAgICAgfSwKICAgICAgICAgICAgInN5bWJvbHMiIDogewogICAgICAgICAgICAgICJ0eXBlIiA6IFsKICAgICAgICAgICAgICAgICJhcnJheSIsCiAgICAgICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgICAgICJudWxsIgogICAgICAgICAgICAgIF0sCiAgICAgICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIkxpc3Qgb2YgVGVuWFRlbXBsYXRlIHN5bWJvbCB2YWx1ZXMgZm9yIHdoaWNoIHRvIGxvZyBpbmZvcm1hdGlvblxuXG5MaXN0IG9mIHN5bWJvbCB2YWx1ZXMgc3VjaCBhcyBjbGFzcyBhbmQgbWV0aG9kIG5hbWVzKGUuZy4sICdNeUNsYXNzJywgJ2ZvbycpIGZvciB3aGljaCB0byBsb2cgaW5mb3JtYXRpb24gb24gaG93IHRoZWlyIG9yaWdpbiBpbmZvcm1hdGlvbiBpcyBzZWxlY3RlZC4gVGhpcyBvcHRpb24gaGVscHMgZGVidWcgaG93IHRoZSBbc3ltYm9sU2VxdWVuY2VdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vYXBpL2pzLyNUZW5YT2JqZWN0K3N5bWJvbFNlcXVlbmNlKSBmdW5jdGlvbiBzZWxlY3RzICBvcmlnaW4gdmFsdWVzIGZvciBhIHRhcmdldCBUZW5YVGVtcGxhdGUgc3ltYm9sIHNlcXVlbmNlLiAgU3BlY2lmeSAnKicgZm9yIGFsbCBzeW1ib2xzLiIsCiAgICAgICAgICAgICAgIml0ZW1zIiA6IHsKICAgICAgICAgICAgICAgICJ0eXBlIiA6ICJzdHJpbmciCiAgICAgICAgICAgICAgfQogICAgICAgICAgICB9LAogICAgICAgICAgICAibG9nZ2VyTmFtZSIgOiB7CiAgICAgICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJEZWJ1ZyBsb2dnZXIgbmFtZVxuXG5Db250cm9scyB0aGUgbmFtZSBvZiB0aGUgbG9nNGogbG9nZ2VyIHVzZWQgYnkgW2RlYnVnT3JpZ2luc10oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vdHJhbnNmb3JtL3N5bWJvbC8jc3ltYm9sZGVidWdvcmlnaW5zKSBhbmQgW2RlYnVnU3ltYm9sc10oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vdHJhbnNmb3JtL3N5bWJvbC8jc3ltYm9sZGVidWdzeW1ib2xzKS4gKERlZmF1bHQ6IFtjb25zb2xlT3V0XShodHRwczovL2dpdGh1Yi5jb20vbG9nLTEweC9jb25maWcvYmxvYi9tYWluL2xvZzRqMi55YW1sI0w2NikpIiwKICAgICAgICAgICAgICAiZGVmYXVsdCIgOiAiW2NvbnNvbGVPdXRdKGh0dHBzOi8vZ2l0aHViLmNvbS9sb2ctMTB4L2NvbmZpZy9ibG9iL21haW4vbG9nNGoyLnlhbWwjTDY2KSIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfQogICAgfQogIH0sCiAgImFkZGl0aW9uYWxQcm9wZXJ0aWVzIiA6IGZhbHNlCn0=</template>
+        <template class="tenx-config-schema" data-encoding="base64">ewogICJ0eXBlIiA6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIiA6IHsKICAgICJ0ZW54IiA6IHsKICAgICAgInR5cGUiIDogInN0cmluZyIKICAgIH0sCiAgICAic3ltYm9sIiA6IHsKICAgICAgInR5cGUiIDogIm9iamVjdCIsCiAgICAgICJhZGRpdGlvbmFsUHJvcGVydGllcyIgOiBmYWxzZSwKICAgICAgInByb3BlcnRpZXMiIDogewogICAgICAgICJzZXF1ZW5jZVJlc2VydmVkIiA6IHsKICAgICAgICAgICJ0eXBlIiA6IFsKICAgICAgICAgICAgImFycmF5IiwKICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICJudWxsIgogICAgICAgICAgXSwKICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJMaXN0IG9mIHRlcm1zIHRvIGlnbm9yZSB3aGVuIHNjYW5uaW5nIHN5bWJvbCB0b2tlbnNcblxuRGVmaW5lcyBhIGxpc3Qgb2YgdGVybXMgdGhhdCB0byBpZ25vcmUgd2hlbiBzZWFyY2hpbmcgZm9yIHRoZSBzeW1ib2wgdG9rZW5zIGNvbnN0aXR1dGluZyBhbiBUZW5YVGVtcGxhdGUncyAnbWVzc2FnZScgcG9ydGlvbiAoaS5lLiwgdGhlIFtzeW1ib2xdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zdHJ1Y3R1cmUvI3N5bWJvbHMpIHRva2VucyBvZiB0aGUgb3JpZ2luIHJhbmtlZCBoaWdoZXN0IGJ5IGNvdmVyYWdlLCBtZWFuaW5nIHRoZSBjb3VudCBvZiBkaXN0aW5jdCBsaWJyYXJ5LWtub3duIHRva2VucyBpdCBleHBsYWluczsgc3BhbiBsZW5ndGggaXMgdGhlIGxhc3QgdGllYnJlYWspLiBGb3IgZXhhbXBsZSwgZm9yIGFuIFRlblhPYmplY3Qgd2hvc2UgdGV4dCBjb250YWluczogJ2Nvbm5lY3Qgc3VjY2VzcyA9IHRydWUnLCB0aGUgdmFsdWUgJ3RydWUnIHdpbGwgbm90IGJlIGNvbnNpZGVyZWQgYSBwYXJ0IG9mIHRoZSBpbnN0YW5jZSdzIG1lc3NhZ2UsIGFzIGl0IGlzIG1vc3RseSBsaWtlbHkgdGhlIHJlc3VsdCBvZiBhIHZhcmlhYmxlIGJvb2xlYW4gc3RhdGUuIFRvIGxlYXJuIG1vcmUgc2VlIFtzeW1ib2xTZXF1ZW5jZV0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9hcGkvanMvI1RlblhPYmplY3Qrc3ltYm9sU2VxdWVuY2UpLiAoRGVmYXVsdDogW1wibnVsbFwiLFwibmlsXCIsXCJ0cnVlXCIsXCJmYWxzZVwiXSkiLAogICAgICAgICAgIml0ZW1zIiA6IHsKICAgICAgICAgICAgInR5cGUiIDogInN0cmluZyIKICAgICAgICAgIH0sCiAgICAgICAgICAiZGVmYXVsdCIgOiBbCiAgICAgICAgICAgICJudWxsIiwKICAgICAgICAgICAgIm5pbCIsCiAgICAgICAgICAgICJ0cnVlIiwKICAgICAgICAgICAgImZhbHNlIgogICAgICAgICAgXQogICAgICAgIH0sCiAgICAgICAgInByZWFtYmxlIiA6IHsKICAgICAgICAgICJ0eXBlIiA6ICJvYmplY3QiLAogICAgICAgICAgImFkZGl0aW9uYWxQcm9wZXJ0aWVzIiA6IGZhbHNlLAogICAgICAgICAgInByb3BlcnRpZXMiIDogewogICAgICAgICAgICAiZW5jbG9zdXJlcyIgOiB7CiAgICAgICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAgICAgImFycmF5IiwKICAgICAgICAgICAgICAgICJzdHJpbmciLAogICAgICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICAgICAgXSwKICAgICAgICAgICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiUGFpcnMgb2Ygb3BlbiBhbmQgY2xvc2UgY2hhcmFjdGVycyB3aG9zZSB0ZXh0IGJlZm9yZSB0aGUgbWVzc2FnZSBpcyBlbnZlbG9wZVxuXG5EZWZpbmVzIHRoZSBlbmNsb3N1cmVzIG9mIGEgbGluZSdzIHByZWFtYmxlLCBlYWNoIGFuIG9wZW4gYW5kIGEgY2xvc2UgY2hhcmFjdGVyLiBBIHdvcmQgaW5zaWRlIG9uZSBvZiB0aGVtIGJlZm9yZSB0aGUgbWVzc2FnZSAoZS5nLiwgJ21haW4nIGluICdbbWFpbl0gU3RhcnRpbmcgd29ya2VyJykgaXMgZW52ZWxvcGUgYW5kIHN0YXlzIG91dCBvZiB0aGUgVGVuWFRlbXBsYXRlJ3MgbWVzc2FnZSBuYW1lLiBBbiBvcGVuIHdpdGggbm8gY2xvc2UgYWZ0ZXIgaXQgaW4gdGhlIHNhbWUgZmllbGQgZW5jbG9zZXMgbm90aGluZywgc3VjaCBhcyB0aGUgJ1snIG9mIGEgY29sb3IgY29kZSAoJ1xcMDMzWzA7MzNtV0FSTicpIG9yIG9uZSB0aGF0IGNsb3NlcyBvbiBhIGxhdGVyIGxpbmUgb2YgYSBtdWx0aS1saW5lIGV2ZW50LiBUaGUgbWVzc2FnZSBzdGFydHMgYXQgdGhlIGZpcnN0IHdvcmQgdGhhdCBubyBwYXJ0IG9mIHRoZSBwcmVhbWJsZSBkZXNjcmliZXM6IG5vdCBbcmVzZXJ2ZWRdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zeW1ib2wvI3N5bWJvbHNlcXVlbmNlcmVzZXJ2ZWQpLCBub3QgYSBbbWVzc2FnZSBrZXldKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zeW1ib2wvI3N5bWJvbHByZWFtYmxlbWVzc2FnZWtleXMpLCBub3QgZW5jbG9zZWQgYW5kIG5vdCBhIHJlc2VydmVkIGtleSBvciBpdHMgdmFsdWUuIChEZWZhdWx0OiBbXCJbXVwiLFwiKClcIl0pIiwKICAgICAgICAgICAgICAiaXRlbXMiIDogewogICAgICAgICAgICAgICAgInR5cGUiIDogInN0cmluZyIKICAgICAgICAgICAgICB9LAogICAgICAgICAgICAgICJkZWZhdWx0IiA6IFsKICAgICAgICAgICAgICAgICJbXSIsCiAgICAgICAgICAgICAgICAiKCkiCiAgICAgICAgICAgICAgXQogICAgICAgICAgICB9LAogICAgICAgICAgICAiYXNzaWduZXJzIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAiYXJyYXkiLAogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJDaGFyYWN0ZXJzIHRoYXQgYmluZCBhIGtleSB0byBpdHMgdmFsdWUgd2hlbiB0aGUga2V5IG9yIHRoZSB2YWx1ZSBpcyBxdW90ZWRcblxuRGVmaW5lcyB0aGUgY2hhcmFjdGVycyB0aGF0IGJpbmQgYSBrZXkgdG8gaXRzIHZhbHVlLCBvbmUgY2hhcmFjdGVyIGVhY2gsIHdoZW4gdGhlIGtleSBvciB0aGUgdmFsdWUgaXMgcXVvdGVkIChlLmcuLCAnXCJsZXZlbFwiOlwiaW5mb1wiJywgXCJib2R5OiAnQ2hhcmdlIHJlcXVlc3QgcmVjZWl2ZWQuJ1wiKS4gQSBbcmVzZXJ2ZWRdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vcnVuL3RyYW5zZm9ybS9zeW1ib2wvI3N5bWJvbHNlcXVlbmNlcmVzZXJ2ZWQpIGtleSBhbmQgaXRzIHZhbHVlIGFyZSBlbnZlbG9wZTsgdGhlIG1lc3NhZ2Ugc3RhcnRzIGluc2lkZSBhIFttZXNzYWdlIGtleV0oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vdHJhbnNmb3JtL3N5bWJvbC8jc3ltYm9scHJlYW1ibGVtZXNzYWdla2V5cykncyB2YWx1ZS4gVW5xdW90ZWQsIGEgY29sb24gYmluZHMgbm90aGluZywgc28gJ0Vycm9yOiAxMyBJTlRFUk5BTCcgYW5kICdJTkZPOnJvb3Q6U3RhcnRpbmcnIGtlZXAgdGhlaXIgd29yZHMuIChEZWZhdWx0OiBbXCI9XCIsXCI6XCJdKSIsCiAgICAgICAgICAgICAgIml0ZW1zIiA6IHsKICAgICAgICAgICAgICAgICJ0eXBlIiA6ICJzdHJpbmciCiAgICAgICAgICAgICAgfSwKICAgICAgICAgICAgICAiZGVmYXVsdCIgOiBbCiAgICAgICAgICAgICAgICAiPSIsCiAgICAgICAgICAgICAgICAiOiIKICAgICAgICAgICAgICBdCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJiYXJlQXNzaWduZXJzIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAiYXJyYXkiLAogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJDaGFyYWN0ZXJzIHRoYXQgYWxzbyBiaW5kIGFuIHVucXVvdGVkIGtleSB0byBhbiB1bnF1b3RlZCB2YWx1ZVxuXG5EZWZpbmVzIHRoZSBhc3NpZ25lcnMgdGhhdCBiaW5kIGEga2V5IHdpdGhvdXQgcXVvdGVzLCBvbmUgY2hhcmFjdGVyIGVhY2gsIGFzIGxvZ2ZtdCB3cml0ZXMgdGhlbSAoZS5nLiwgJ2xldmVsPWluZm8nLCAnbG9nZ2VyPWNsZWFudXAnKS4gQW4gYXNzaWduZXIgbGlzdGVkIGhlcmUgYmluZHMgaW4gcmVjb3JkIGZvcm0gdG9vLiAoRGVmYXVsdDogW1wiPVwiXSkiLAogICAgICAgICAgICAgICJpdGVtcyIgOiB7CiAgICAgICAgICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICAgICAgICAgIH0sCiAgICAgICAgICAgICAgImRlZmF1bHQiIDogWwogICAgICAgICAgICAgICAgIj0iCiAgICAgICAgICAgICAgXQogICAgICAgICAgICB9LAogICAgICAgICAgICAiam9pbmVycyIgOiB7CiAgICAgICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAgICAgImFycmF5IiwKICAgICAgICAgICAgICAgICJzdHJpbmciLAogICAgICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICAgICAgXSwKICAgICAgICAgICAgICAibWFya2Rvd25EZXNjcmlwdGlvbiIgOiAiU2VwYXJhdG9ycyB0aGF0IGNoYWluIHdvcmRzIGludG8gb25lIG5hbWUsIHJlYWQgdG8gZmluZCBhIGdyb3VwJ3MgbGVhZFxuXG5EZWZpbmVzIHRoZSBzZXBhcmF0b3JzIHRoYXQgY2hhaW4gdHdvIG9yIG1vcmUgd29yZHMsIHdyaXR0ZW4gd2l0aG91dCB3aGl0ZXNwYWNlLCBpbnRvIG9uZSBuYW1lIChlLmcuLCAnb3JnLmFwYWNoZS5rYWZrYS5sb2cuTG9jYWxMb2cnLCAnY2FydC5jYXJ0c3RvcmUuVmFsa2V5Q2FydFN0b3JlJyksIHR5cGljYWxseSBhIGxvZ2dlciwgY2xhc3Mgb3IgZmlsZSBuYW1lLiBUaGV5IGRlY2lkZSBvbmx5IHdoaWNoIG1lbWJlciBvZiBhIG11bHRpLWxpbmUgZXZlbnQgbmFtZXMgaXQ6IGEgbWVtYmVyIHdob3NlIGV2ZXJ5IHdvcmQgaXMgc3VjaCBhIG5hbWUgb3Igb3RoZXIgZW52ZWxvcGUgZG9lcyBub3QgbGVhZCB0aGUgZ3JvdXAgKHNlZSBbc3ltYm9sR3JvdXBMZWFkXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi90cmFuc2Zvcm0vc3ltYm9sLyNzeW1ib2xncm91cGxlYWQpKS4gSW4gYSBtZXNzYWdlIG5hbWUgYSBqb2luZWQgbmFtZSBzdGF5cywgYXMgYSBsb2dnZXIgb3IgY2xhc3MgbmFtZSBpcyBvZnRlbiB0aGUgb25seSB0ZXh0IHRoYXQgdGVsbHMgdHdvIHN0YXRlbWVudHMgYXBhcnQuIChEZWZhdWx0OiBbXCIuXCIsXCI6OlwiXSkiLAogICAgICAgICAgICAgICJpdGVtcyIgOiB7CiAgICAgICAgICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICAgICAgICAgIH0sCiAgICAgICAgICAgICAgImRlZmF1bHQiIDogWwogICAgICAgICAgICAgICAgIi4iLAogICAgICAgICAgICAgICAgIjo6IgogICAgICAgICAgICAgIF0KICAgICAgICAgICAgfSwKICAgICAgICAgICAgIm1lc3NhZ2VLZXlzIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAiYXJyYXkiLAogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJLZXlzIHdob3NlIGJvdW5kIHZhbHVlIGhvbGRzIHRoZSBtZXNzYWdlXG5cbkRlZmluZXMgdGhlIGtleXMgd2hvc2UgdmFsdWUgaG9sZHMgdGhlIG1lc3NhZ2UuIFRoZSBtZXNzYWdlIHN0YXJ0cyBhdCB0aGUgdmFsdWUncyBmaXJzdCB3b3JkIHRoZSBwcmVhbWJsZSBkb2VzIG5vdCBkZXNjcmliZSAoZS5nLiwgJ3N0YXJ0aW5nJyBpbiAnbXNnPXN0YXJ0aW5nJywgJ1N1YmNoYW5uZWwnIGluICdcIm1zZ1wiOlwiW2NvcmVdW0NoYW5uZWwgIzFdIFN1YmNoYW5uZWwgY3JlYXRlZFwiJywgJ0NoYXJnZScgaW4gXCJib2R5OiAnQ2hhcmdlIHJlcXVlc3QgcmVjZWl2ZWQuJ1wiKS4gSW4gYSByZWNvcmQgdGhhdCBvcGVucyB3aXRoICd7JywgcmVhZGluZyBzdGFydHMgYXQgdGhlIGZpcnN0IG1lc3NhZ2Uga2V5IHdpdGggYSB2YWx1ZS4gQSBtZXNzYWdlIGtleSB3aXRob3V0IGEgdmFsdWUgaXMgZW52ZWxvcGUsIGFzIGEgcmVzZXJ2ZWQgd29yZCBpcy4gKERlZmF1bHQ6IFtcIm1zZ1wiLFwibWVzc2FnZVwiLFwiYm9keVwiXSkiLAogICAgICAgICAgICAgICJpdGVtcyIgOiB7CiAgICAgICAgICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICAgICAgICAgIH0sCiAgICAgICAgICAgICAgImRlZmF1bHQiIDogWwogICAgICAgICAgICAgICAgIm1zZyIsCiAgICAgICAgICAgICAgICAibWVzc2FnZSIsCiAgICAgICAgICAgICAgICAiYm9keSIKICAgICAgICAgICAgICBdCiAgICAgICAgICAgIH0KICAgICAgICAgIH0KICAgICAgICB9LAogICAgICAgICJncm91cExlYWQiIDogewogICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICBdLAogICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIk1lbWJlciBvZiBhIG11bHRpLWxpbmUgZ3JvdXAgd2hvc2UgdGV4dCBuYW1lcyB0aGUgZ3JvdXBcblxuU2VsZWN0cyB0aGUgbWVtYmVyIG9mIGEgbXVsdGktbGluZSBldmVudCBncm91cCB3aG9zZSB0ZXh0IG5hbWVzIGl0LiAnZmlyc3RXaXRoTWVzc2FnZScgbmFtZXMgYSBncm91cCBmcm9tIGl0cyBmaXJzdCBtZW1iZXIgd2hvc2UgaW5wdXQgZmllbGQgaXMgbm90IGFsbCBlbnZlbG9wZSwgYSBuYW1lIG9mIHdvcmRzIGNoYWluZWQgYnkgYSBbam9pbmVyXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi90cmFuc2Zvcm0vc3ltYm9sLyNzeW1ib2xwcmVhbWJsZWpvaW5lcnMpIGNvdW50aW5nIGFzIGVudmVsb3BlIGhlcmUsIHNvIGEgaGVhZCBzdWNoIGFzIHRoZSAuTkVUIGNvbnNvbGUgbG9nZ2VyJ3MgJ2luZm86IGNhcnQuY2FydHN0b3JlLlZhbGtleUNhcnRTdG9yZVswXScgYmVmb3JlIHRoZSByZWNvcmQgaG9sZGluZyB0aGUgbWVzc2FnZSBsZWF2ZXMgdGhlIG5hbWUsIG9yaWdpbiBhbmQgc2tlbGV0b24gdG8gdGhhdCByZWNvcmQuIEEgaGVhZCB0aGF0IGhvbGRzIGEgbWVzc2FnZSAoZS5nLiwgYSBzdGFjayB0cmFjZSdzIGV4Y2VwdGlvbiBsaW5lKSBuYW1lcyB0aGUgZ3JvdXAuICdoZWFkJyBhbHdheXMgbmFtZXMgYSBncm91cCBmcm9tIGl0cyBoZWFkLiAoRGVmYXVsdDogZmlyc3RXaXRoTWVzc2FnZSkiLAogICAgICAgICAgImRlZmF1bHQiIDogImZpcnN0V2l0aE1lc3NhZ2UiCiAgICAgICAgfSwKICAgICAgICAibWF4T3JpZ2lucyIgOiB7CiAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICJudW1iZXIiLAogICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgIm51bGwiCiAgICAgICAgICBdLAogICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIk1heCBudW1iZXIgb2Ygc291cmNlL2JpbmFyeSBvcmlnaW5zIHRvIGxpc3QgcGVyIHN5bWJvbFxuXG5Db250cm9scyB0aGUgbnVtYmVyIG9mIHNvdXJjZSBjb2RlL2JpbmFyeSBvcmlnaW5zIHRvIGxpc3QgcGVyIHN5bWJvbCB0b2tlbiBzZXF1ZW5jZS4gQXMgYSBzZXJpZXMgb2YgdG9rZW5zIHdpdGhpbiAgYSBnaXZlbiB0ZW1wbGF0ZSAoZS5nLiwgJ0VSUk9SJywgJ2NvdWxkIG5vdCBjb25uZWN0IHRvIFwie30nKSBtYXkgYXBwZWFyICBpbiBtdWx0aXBsZSBzb3VyY2UvYmluYXJ5IGZpbGVzIHdpdGhpbiB0aGUgcGlwZWxpbmUncyBzeW1ib2wgZmlsZXMsIHRoZSBzb3J0aW5nIGFsZ29yaXRobSBzZWxlY3RzIFttYXhTeW1ib2xPcmlnaW5zXShodHRwczovL2RvYy5sb2cxMHguY29tL3J1bi90cmFuc2Zvcm0vc3ltYm9sLyNzeW1ib2xtYXhvcmlnaW5zKSBmb3IgY29tcGFyaXNvbi4gKEFjY2VwdHMgbnVtYmVyIG9yIHN0cmluZyB3aXRoICQ9IHByZWZpeCBmb3IgcnVudGltZSBldmFsdWF0aW9uKSAoRGVmYXVsdDogNjQpIiwKICAgICAgICAgICJkZWZhdWx0IiA6IDY0CiAgICAgICAgfSwKICAgICAgICAiZGVidWciIDogewogICAgICAgICAgInR5cGUiIDogIm9iamVjdCIsCiAgICAgICAgICAiYWRkaXRpb25hbFByb3BlcnRpZXMiIDogZmFsc2UsCiAgICAgICAgICAicHJvcGVydGllcyIgOiB7CiAgICAgICAgICAgICJvcmlnaW5zIiA6IHsKICAgICAgICAgICAgICAidHlwZSIgOiBbCiAgICAgICAgICAgICAgICAiYXJyYXkiLAogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJMaXN0IG9mIHNvdXJjZSBzY2FubmVkIGZpbGUgbmFtZXMgZm9yIHdoaWNoIHRvIGxvZyBpbmZvcm1hdGlvblxuXG5TcGVjaWZpZXMgYSBsaXN0IG9mIGlucHV0IGZpbGUgbmFtZXMgd2l0aGluIHRoZSBsb2FkZWQgc3ltYm9sIGxpYnJhcnkgKGUuZy4sICdteS5zY2FsYScsICdmb28uamF2YScpIGZvciB3aGljaCB0byBsb2cgaW5mb3JtYXRpb24gb24gaWYvaG93IHRoZXkgcGFydGljaXBhdGUgaW4gc2VsZWN0aW5nIHRoZSBvcmlnaW4gb2YgYSB0YXJnZXQgVGVuWFRlbXBsYXRlIHN5bWJvbCBzZXF1ZW5jZS4gVGhpcyBvcHRpb24gaGVscHMgZGVidWcgaG93IHRoZSBbc3ltYm9sU2VxdWVuY2VdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vYXBpL2pzLyNUZW5YT2JqZWN0K3N5bWJvbFNlcXVlbmNlKSBmdW5jdGlvbiBzZWxlY3RzICBvcmlnaW4gdmFsdWVzIGZvciBhIHRhcmdldCBUZW5YVGVtcGxhdGUgc3ltYm9sIHNlcXVlbmNlLiAgU3BlY2lmeSAnKicgZm9yIGFsbCBpbnB1dCBmaWxlcy4iLAogICAgICAgICAgICAgICJpdGVtcyIgOiB7CiAgICAgICAgICAgICAgICAidHlwZSIgOiAic3RyaW5nIgogICAgICAgICAgICAgIH0KICAgICAgICAgICAgfSwKICAgICAgICAgICAgInN5bWJvbHMiIDogewogICAgICAgICAgICAgICJ0eXBlIiA6IFsKICAgICAgICAgICAgICAgICJhcnJheSIsCiAgICAgICAgICAgICAgICAic3RyaW5nIiwKICAgICAgICAgICAgICAgICJudWxsIgogICAgICAgICAgICAgIF0sCiAgICAgICAgICAgICAgIm1hcmtkb3duRGVzY3JpcHRpb24iIDogIkxpc3Qgb2YgVGVuWFRlbXBsYXRlIHN5bWJvbCB2YWx1ZXMgZm9yIHdoaWNoIHRvIGxvZyBpbmZvcm1hdGlvblxuXG5MaXN0IG9mIHN5bWJvbCB2YWx1ZXMgc3VjaCBhcyBjbGFzcyBhbmQgbWV0aG9kIG5hbWVzKGUuZy4sICdNeUNsYXNzJywgJ2ZvbycpIGZvciB3aGljaCB0byBsb2cgaW5mb3JtYXRpb24gb24gaG93IHRoZWlyIG9yaWdpbiBpbmZvcm1hdGlvbiBpcyBzZWxlY3RlZC4gVGhpcyBvcHRpb24gaGVscHMgZGVidWcgaG93IHRoZSBbc3ltYm9sU2VxdWVuY2VdKGh0dHBzOi8vZG9jLmxvZzEweC5jb20vYXBpL2pzLyNUZW5YT2JqZWN0K3N5bWJvbFNlcXVlbmNlKSBmdW5jdGlvbiBzZWxlY3RzICBvcmlnaW4gdmFsdWVzIGZvciBhIHRhcmdldCBUZW5YVGVtcGxhdGUgc3ltYm9sIHNlcXVlbmNlLiAgU3BlY2lmeSAnKicgZm9yIGFsbCBzeW1ib2xzLiIsCiAgICAgICAgICAgICAgIml0ZW1zIiA6IHsKICAgICAgICAgICAgICAgICJ0eXBlIiA6ICJzdHJpbmciCiAgICAgICAgICAgICAgfQogICAgICAgICAgICB9LAogICAgICAgICAgICAibG9nZ2VyTmFtZSIgOiB7CiAgICAgICAgICAgICAgInR5cGUiIDogWwogICAgICAgICAgICAgICAgInN0cmluZyIsCiAgICAgICAgICAgICAgICAibnVsbCIKICAgICAgICAgICAgICBdLAogICAgICAgICAgICAgICJtYXJrZG93bkRlc2NyaXB0aW9uIiA6ICJEZWJ1ZyBsb2dnZXIgbmFtZVxuXG5Db250cm9scyB0aGUgbmFtZSBvZiB0aGUgbG9nNGogbG9nZ2VyIHVzZWQgYnkgW2RlYnVnT3JpZ2luc10oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vdHJhbnNmb3JtL3N5bWJvbC8jc3ltYm9sZGVidWdvcmlnaW5zKSBhbmQgW2RlYnVnU3ltYm9sc10oaHR0cHM6Ly9kb2MubG9nMTB4LmNvbS9ydW4vdHJhbnNmb3JtL3N5bWJvbC8jc3ltYm9sZGVidWdzeW1ib2xzKS4gKERlZmF1bHQ6IFtjb25zb2xlT3V0XShodHRwczovL2dpdGh1Yi5jb20vbG9nLTEweC9jb25maWcvYmxvYi9tYWluL2xvZzRqMi55YW1sI0w2NikpIiwKICAgICAgICAgICAgICAiZGVmYXVsdCIgOiAiW2NvbnNvbGVPdXRdKGh0dHBzOi8vZ2l0aHViLmNvbS9sb2ctMTB4L2NvbmZpZy9ibG9iL21haW4vbG9nNGoyLnlhbWwjTDY2KSIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIH0KICAgICAgfQogICAgfQogIH0sCiAgImFkZGl0aW9uYWxQcm9wZXJ0aWVzIiA6IGZhbHNlCn0=</template>
 
         ```yaml
         # 🔟❎ 'run' symbol origin configuration
@@ -6481,13 +6482,8 @@ To configure advanced options (optional) for the Receiver app, [:material-cog: E
             - FATAL
             - PANIC
             # severity levels, lowercase (engine matching is case-sensitive).
-            # Note. The token "error" is intentionally NOT reserved here.
-            # Verification against 3254 demo events (2026-05-20) found 1280
-            # signal hits where the "error" key carries the actual message
-            # body the pattern groups; reserving it would collapse distinct
-            # error patterns into one.
-            # Note. The token "emergency" is also intentionally NOT reserved
-            #, sample showed only prose hits, no envelope use observed.
+            #  'error' and 'emergency' are not reserved: an 'error' key often
+            #  carries the message itself, and 'emergency' appears as prose.
             - "trace"
             - "debug"
             - "info"
@@ -6509,8 +6505,7 @@ To configure advanced options (optional) for the Receiver app, [:material-cog: E
             - "timestamp"
             - "ts"
             # 'msg' and 'message' are message keys (see 'preamble.messageKeys')
-            # OpenTelemetry / collector envelope (these tokens leak from the
-            # otelcol's Go-package logging into pattern names)
+            # OpenTelemetry / collector envelope
             - "otel"
             - "otelcol"
             - "opentelemetry"
@@ -6524,9 +6519,7 @@ To configure advanced options (optional) for the Receiver app, [:material-cog: E
             - "exporters"
             - "pipeline"
             - "pipelines"
-            # structured / envelope keys (singular + plural, engine matcher
-            # is exact, no stem; both forms appear in real otel logs).
-            # Note: "trace" is already reserved above under lowercase severity.
+            # structured / envelope keys, singular and plural (matching is exact)
             - "service"
             - "services"
             - "instance"
@@ -6549,9 +6542,7 @@ To configure advanced options (optional) for the Receiver app, [:material-cog: E
             - "context"
             - "contexts"
             - "baggage"
-            # K8s audit / Kubernetes API envelope (verified zero signal in
-            # the 2026-05-20 sample, every occurrence was a JSON metadata
-            # key or audit field)
+            # Kubernetes API / audit envelope
             - "metadata"
             - "namespace"
             - "verb"
@@ -6562,8 +6553,7 @@ To configure advanced options (optional) for the Receiver app, [:material-cog: E
             - "encoding"
             - "headers"
             - "duration"
-            # HTTP / request envelope (verified safe, appear only as
-            # klog field markers or JSON keys, not as message content)
+            # HTTP / request envelope
             - "path"
             - "status"
             # generic identity keys (very common envelope tokens in JSON logs)
@@ -6572,7 +6562,7 @@ To configure advanced options (optional) for the Receiver app, [:material-cog: E
             - "kind"
             - "version"
             - "type"
-            # source-location envelope (Go / Java / Python loggers leak these)
+            # source-location envelope (Go / Java / Python loggers print these)
             - "caller"
             - "func"
             - "function"
@@ -6584,15 +6574,9 @@ To configure advanced options (optional) for the Receiver app, [:material-cog: E
             - "method"
             - "stack"
             - "stacktrace"
-            # process / runtime context.
-            # Note. The token "host" is intentionally NOT reserved, 1018 of
-            # 1024 occurrences in the verification corpus were the content
-            # phrase "no such host" inside DNS-failure messages; reserving
-            # it would collapse every "no such host" pattern into one.
-            # Note. The token "app" is intentionally NOT reserved, 42 of 44
-            # occurrences were the Flask logger-name discriminator in
-            # "INFO in app:" lines; reserving it would collapse Python-app
-            # logger structure.
+            # process / runtime context. 'host' and 'app' are not reserved:
+            #  'host' is message text in 'no such host', and 'app' is the Flask
+            #  logger name that tells one application's statements from another's.
             - "pid"
             - "tid"
             - "process"
@@ -6621,6 +6605,9 @@ To configure advanced options (optional) for the Receiver app, [:material-cog: E
         
             # 'enclosures' lists open and close character pairs: text inside them
             #  before the message is envelope (e.g., 'main' in '[main] Starting worker').
+            #  An open with no close after it in the same field encloses nothing, such
+            #  as the '[' of a color code ('\033[0;33mWARN') or one that closes on a
+            #  later line of a multi-line event.
             enclosures: ['[]', '()']
         
             # 'assigners' lists the characters that bind a key to its value when the