log10x-mcp 1.30.39 → 1.30.40

package/README.md

@@ -20,7 +20,7 @@ This server is open source under MIT. A Log10x product license (API key) unlocks
 | "This message type is noise, cut it." | Sample, drop, compact, tier down, or offload a chosen message type, with examples and trend so the action is clear. `log10x_pattern_mitigate`, `log10x_pattern_examples`, `log10x_pattern_trend` |
 | "We are 100% Lambda, no cluster. Install there." | The install plan comes back for the serverless estate: the engine as a Lambda extension paired with the function's OTel collector, a CDK construct, and an AWS-native recurring tick over an S3 config plane. `log10x_advise_install`, `log10x_setup_recurring` |
 | "Get me the actual events I offloaded." | Fetch the exact events back on demand from your own S3. `log10x_retriever_query`, `log10x_offload_add`, `log10x_retriever_register` |
-| "Recognize more of my message types." | Build a custom symbol library from your own logs so the engine finds more savings. `log10x_compile`, `log10x_compile_link`, `log10x_compile_status` |
+| "Recognize more of my message types." | Compile your own source code, binaries and container images into a symbol library so the engine names more of your message types. `log10x_compile`, `log10x_compile_link`, `log10x_compile_status` |
 
 ## Install
 

package/build/product-kb/docs/api/js.md

@@ -1270,7 +1270,7 @@ this.status = this.symbol("ENUM", "Status"); //capture the 'ENABLED value above
 ### .symbolSequence(symbolContexts,fieldName,maxLen) ⇒ <code>string</code>
 Returns a sequence of [symbol](https://doc.log10x.com/run/transform/structure/#symbols) tokens of a specified type.
 
-This function selects a the longest set of symbol and delimiter tokens from the object's
+This function selects the symbol and delimiter tokens of the origin ranked highest by the [message](https://doc.log10x.com/run/initialize/message/) comparator from the object's
 [TenXTemplate](https://doc.log10x.com/run/template/) based on their context within the source code/binary file from which they originated.
 
 To capture a symbol sequence for the following event:
@@ -1286,7 +1286,7 @@ this.message = symbolSequence("log,class,exec"); // = 'Partition__not_found_comp
 ```
 
 The `symbolContext` argument controls the [symbol contexts](https://doc.log10x.com/run/transform/symbol/#contexts) to search for; 
-if the first type does not yield a result, the next one is tried etc. 
+the listed contexts are evaluated in a single pass, so list order acts as a filter rather than a precedence chain. 
  
 Supported values: package, class, method, log, enum, const, text, exec, any (case insensitive).
 
@@ -1342,7 +1342,7 @@ and [time-series](https://doc.log10x.com/run/output/metric/) output.
 ### .symbolOrigin(symbolContext) ⇒ <code>string</code>
 Returns a the source code/binary origin of 'symbol' tokens of a specified type.
 
-This function selects a the origin (i.e. the source code or binary executable which emitted) the longest set of [symbol](https://doc.log10x.com/run/transform/structure/#symbols) and delimiter tokens from the object's
+This function selects the origin (i.e. the source code or binary executable which emitted) the highest-ranked set of [symbol](https://doc.log10x.com/run/transform/structure/#symbols) and delimiter tokens from the object's
 TenXTemplate.
 
 To capture the origin value for the following event:
@@ -1356,7 +1356,7 @@ The following call can be used:
 this.origin = symbolOrigin("log,class,exec"); // CacheManager.scala'
 ```
 
-The 'symbolContext' argument controls the [symbol contexts](https://doc.log10x.com/run/transform/symbol/#contexts) to search for; if the first type does not yield a result, the next one is tried etc.  
+The 'symbolContext' argument controls the [symbol contexts](https://doc.log10x.com/run/transform/symbol/#contexts) to search for; the listed contexts are evaluated in a single pass, so list order acts as a filter rather than a precedence chain.  
 
 Supported values: PACKAGE, CLASS, METHOD, LOG, ENUM, CONST, TEXT, EXEC (case insensitive).
 

package/build/product-kb/docs/apps/mcp/run.md

@@ -587,8 +587,8 @@ To configure the MCP test-drive app, [:material-cog: Edit](https://doc.log10x.co
           contexts: log,exec
         
           # 'messageField' specifies the field name to assign the message pattern to target TenXObjects: the symbol
-          #  tokens of the origin ranked highest by coverage, meaning the count of distinct library-known tokens it
-          #  explains. Span length is the last tiebreak. The origin file name itself goes to 'originField'.
+          #  tokens of the origin ranked highest on the five-key comparator, message-text width first. Span length
+          #  is the last tiebreak. The origin file name itself goes to 'originField'.
           messageField: message_pattern
         
           # 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
@@ -610,8 +610,9 @@ To configure the MCP test-drive app, [:material-cog: Edit](https://doc.log10x.co
         # indented detail, banners) so the message-template skips its own message-pattern compute for them.
         # The check fires only for templates that don't already pass the (groupSize > 1) || groupHead arms;
         # i.e., for single-event templates with no head signal. A non-negator line in that case (e.g., bare
-        # "Hello World", "Heartbeat received from node-7") still gets a pattern; a negator-matching orphan
-        # (e.g., a lone "\tat com.foo.Bar(...)") does not.
+        # "Hello World", "Heartbeat received from node-7") gets a pattern from its library words; a negator-matching
+        # orphan (e.g., a lone "\tat com.foo.Bar(...)") skips origin selection and is named by a hash of its shape,
+        # template_<hash>.
         message:
           negators:
             - " "                 # any indented line (stack frames, indented app detail, multi-line JSON, banners)

package/build/product-kb/docs/apps/mcp/tools/compile/compile-link.md

@@ -36,7 +36,7 @@ A very large units tree returns a running `job_id` to poll with [`log10x_compile
 
 ## :material-check-decagram-outline: Prerequisites
 
-The Compiler flavor, docker-first: `auto` and `docker` pull `log10x/compiler-10x:1.1.125` (pinned by digest), and `local` runs a Compiler-flavor `tenx`. The Runtime flavor is refused; the `mode` argument of [`log10x_compile`](compile.md) lists the three flavors.
+The Compiler flavor, docker-first: `auto` and `docker` pull `log10x/compiler-10x:1.1.136` (pinned by digest), and `local` runs a Compiler-flavor `tenx`. The Runtime flavor is refused; the `mode` argument of [`log10x_compile`](compile.md) lists the three flavors.
 
 A link into a folder another compile or link job is still writing joins that job instead of starting a second one.
 
@@ -138,7 +138,7 @@ This is the CLI tier, so it needs no Kubernetes, deployed app, or Log10x account
           "job_id": "7b2e9c41-3f5a-4d8e-9b21-6c0f1a2d7e44",
           "job_status": "completed",
           "mode": "docker",
-          "image": "log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
+          "image": "log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
           "compiler": null,
           "exit_code": 0,
           "elapsed_ms": 6240,

package/build/product-kb/docs/apps/mcp/tools/compile/compile-status.md

@@ -149,8 +149,8 @@ The per-language scan failures and the symbol-type counts need a `compiler-10x`
           "job_id": "compile-7c2f",
           "job_status": "completed",
           "mode": "docker",
-          "image": "log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
-          "compiler": "docker:log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
+          "image": "log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
+          "compiler": "docker:log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
           "exit_code": 0,
           "elapsed_ms": 184220,
           "timed_out": false,

package/build/product-kb/docs/apps/mcp/tools/compile/compile.md

@@ -22,7 +22,7 @@ Sources combine freely in one call:
 
 Docker pulls are daemonless. GitHub and Artifactory pulls each need a token, even for public GitHub repos.
 
-The [Compiler app](../../../compiler/) runs the Compiler flavor, docker-first via the `log10x/compiler-10x:1.1.125` image (pinned by digest) or a local Compiler-flavor `tenx`. It runs without Kubernetes, a deployed app, or a Log10x account.
+The [Compiler app](../../../compiler/) runs the Compiler flavor, docker-first via the `log10x/compiler-10x:1.1.136` image (pinned by digest) or a local Compiler-flavor `tenx`. It runs without Kubernetes, a deployed app, or a Log10x account.
 
 What gets scanned, per the shipped scanner config:
 
@@ -38,7 +38,7 @@ The output folder is keyed on the sources, the library name, and the compiler (t
 
 What a re-run skips: the engine skips every local file whose checksum already has a unit in the folder. Pulled sources cost a remote round-trip each run (GitHub branch head, image manifest digest, Artifactory listing) and are downloaded again only when the remote changed; Helm charts are rendered again every run. Only the scan of unchanged files is skipped.
 
-The engine's own whole-scan cap (`scanOperationTimeout`, bundled default 10 minutes) is raised to 90% of `timeout_ms` on the command line, so the engine cap follows `timeout_ms`. That needs compiler 1.1.89 or newer; the pinned default is 1.1.125, and an older local engine keeps its 10 minute cap. A run the engine stopped early is reported as `incomplete` by [Status](compile-status.md).
+The engine's own whole-scan cap (`scanOperationTimeout`, bundled default 10 minutes) is raised to 90% of `timeout_ms` on the command line, so the engine cap follows `timeout_ms`. That needs compiler 1.1.89 or newer; the pinned default is 1.1.136, and an older local engine keeps its 10 minute cap. A run the engine stopped early is reported as `incomplete` by [Status](compile-status.md).
 
 ## :material-code-braces: Example
 
@@ -208,14 +208,14 @@ Archives are scanned as-is: `.jar`, `.war`, `.ear`, `.zip` and tarballs are expa
             "local"
           ],
           "default": "auto",
-          "description": "Execution backend. `auto` (default) prefers Docker (the compiler image, guaranteed compiler flavor) and falls back to a local compiler-flavor tenx; the backend is chosen once, before the output folder is keyed. `docker` forces the image (LOG10X_COMPILER_IMAGE or LOG10X_TENX_IMAGE, default log10x/compiler-10x:1.1.125 pinned by digest, so every run goes through the same compiler). `local` forces the binary (LOG10X_TENX_PATH or `tenx` on PATH) and refuses it unless its version banner reports the compiler flavor (`compiler`, or `cloud` on an engine built before the flavor rename). Of the three shipped flavors only `compiler` can compile: `runtime` (native binary) and `runtime-jvm` (JVM-packaged runtime, the only runtime available on Windows) are both refused, since neither carries the `generate` pipeline unit. With a local install, local-folder compilation and GitHub pull (REST API + token) work out of the box; docker_images pull additionally needs a container engine (podman or docker) on the host. The docker `compiler-10x` image bundles all of those (podman included, daemonless), which is why Docker is the default."
+          "description": "Execution backend. `auto` (default) prefers Docker (the compiler image, guaranteed compiler flavor) and falls back to a local compiler-flavor tenx; the backend is chosen once, before the output folder is keyed. `docker` forces the image (LOG10X_COMPILER_IMAGE or LOG10X_TENX_IMAGE, default log10x/compiler-10x:1.1.136 pinned by digest, so every run goes through the same compiler). `local` forces the binary (LOG10X_TENX_PATH or `tenx` on PATH) and refuses it unless its version banner reports the compiler flavor (`compiler`, or `cloud` on an engine built before the flavor rename). Of the three shipped flavors only `compiler` can compile: `runtime` (native binary) and `runtime-jvm` (JVM-packaged runtime, the only runtime available on Windows) are both refused, since neither carries the `generate` pipeline unit. With a local install, local-folder compilation and GitHub pull (REST API + token) work out of the box; docker_images pull additionally needs a container engine (podman or docker) on the host. The docker `compiler-10x` image bundles all of those (podman included, daemonless), which is why Docker is the default."
         },
         "timeout_ms": {
           "type": "integer",
           "minimum": 10000,
           "maximum": 3600000,
           "default": 1800000,
-          "description": "Hard cap on compile wall time in milliseconds. Default 1,800,000 (30 min). The engine's own whole-scan cap (scanOperationTimeout, bundled default 10 min) is raised to 90% of this value on the command line, so the engine cap follows this value (needs compiler 1.1.89+; the pinned default is 1.1.125; an older local engine keeps its 10 min cap). A re-run over unchanged local sources skips every file whose checksum already has a unit and finishes in seconds. Pulled sources (GitHub, images, Artifactory) are re-checked remotely each run and downloaded again only when the remote changed; Helm charts are rendered again every run."
+          "description": "Hard cap on compile wall time in milliseconds. Default 1,800,000 (30 min). The engine's own whole-scan cap (scanOperationTimeout, bundled default 10 min) is raised to 90% of this value on the command line, so the engine cap follows this value (needs compiler 1.1.89+; the pinned default is 1.1.136; an older local engine keeps its 10 min cap). A re-run over unchanged local sources skips every file whose checksum already has a unit and finishes in seconds. Pulled sources (GitHub, images, Artifactory) are re-checked remotely each run and downloaded again only when the remote changed; Helm charts are rendered again every run."
         },
         "max_wait_ms": {
           "type": "integer",
@@ -264,8 +264,8 @@ Archives are scanned as-is: `.jar`, `.war`, `.ear`, `.zip` and tarballs are expa
           "job_id": "9f2c1a3e-7b4d-4e1a-9f0c-2a1b3c4d5e6f",
           "job_status": "completed",
           "mode": "docker",
-          "image": "log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
-          "compiler": "docker:log10x/compiler-10x:1.1.125@sha256:ee875d49b9a25ef98b6b9edfe69a4b60888fd68fd370e8a0020f1b4777ecf12b",
+          "image": "log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
+          "compiler": "docker:log10x/compiler-10x:1.1.136@sha256:ffcd9890935804b06fcb1791994dfbb32cdb270f3e35fc423ede78ced2097b1f",
           "exit_code": 0,
           "elapsed_ms": 38120,
           "timed_out": false,

package/build/product-kb/docs/apps/mcp/tools/compile/index.md

@@ -52,7 +52,7 @@ To re-link an existing units tree into a library with no source scan, use [`log1
 
 ## :material-check-decagram-outline: Prerequisites
 
-The compile family runs the [Compiler app](../../../compiler/), which executes the [compile pipeline](../../../../compile/), docker-first. By default it pulls `log10x/compiler-10x:1.1.125`, pinned by digest, so every run goes through the same compiler.
+The compile family runs the [Compiler app](../../../compiler/), which executes the [compile pipeline](../../../../compile/), docker-first. By default it pulls `log10x/compiler-10x:1.1.136`, pinned by digest, so every run goes through the same compiler.
 
 That image bundles the following, so no host docker socket is needed:
 

package/build/product-kb/docs/apps/receiver/deploy.md

@@ -2179,7 +2179,7 @@ The OTel Collector overlay moves the sidecar's OTLP listener with `TENX_OTEL_COL
 
     **Phase C: processed events flowing**
 
-    The receiver stamps a `tenx_hash` field on every record it hands back, so that field arriving at the destination is the proof that events completed the round trip through 10x. For a real destination, query for the field there: Elasticsearch `exists: tenx_hash`, Splunk `tenx_hash=*`, Datadog `@tenx_hash:*`. For the stdout / `debug` placeholder destination from Step 3, count it on the container that writes to the destination. Pick your forwarder:
+    The receiver hands each record back byte-for-byte unless `symbolMessageHashField` names a field (the forwarder args above). Name one, for example `symbolMessageHashField tenx_hash`, and the receiver adds that field to every record it hands back, so the field arriving at the destination is the proof that events completed the round trip through 10x. For a real destination, query for the field there: Elasticsearch `exists: tenx_hash`, Splunk `tenx_hash=*`, Datadog `@tenx_hash:*`. For the stdout / `debug` placeholder destination from Step 3, count it on the container that writes to the destination. Pick your forwarder:
 
     === ":simple-fluentd: Fluentd"
 

package/build/product-kb/docs/apps/receiver/faq.md

@@ -3,7 +3,7 @@ icon: material/help-circle-outline
 title: "FAQ"
 ---
 
-The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of the 10x pipeline. The rate regulator finds which patterns are over the byte cap set for their service, and an action decides what happens to that excess. The keep-everything actions (compact, offload, tier_down) cut cost without losing data; sample and drop are lossy actions you opt into; pass leaves the pattern untouched. An AI agent picks the action per service through the log10x MCP (the `configure_engine` tool); the engine enforces it, and the decision travels as a config change through the GitOps repo. The Receiver runs as a sidecar alongside your forwarder.
+The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of the 10x pipeline. The rate regulator finds which patterns are over the byte cap set for their service, and an action decides what happens to that excess. The keep-everything actions (compact, offload, tier_down) cut cost without losing data; sample and drop, the Receiver's Filter modes, are lossy: they apply only to the share of a pattern over a cap the operator sets, and that share is dropped unless the operator chooses another action; pass leaves the pattern untouched. An AI agent picks the action per service through the log10x MCP (the `configure_engine` tool); the engine enforces it, and the decision travels as a config change through the GitOps repo. The Receiver runs as a sidecar alongside your forwarder.
 
 <div class="grid cards" markdown>
 
@@ -27,31 +27,30 @@ The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of th
     - **offload**: route the pattern to customer-owned object storage (S3 or any S3-compatible bucket) instead of the destination.
     - **drop**: stop forwarding the pattern.
 
-    An AI agent picks the action per service through the log10x MCP (the `configure_engine` tool), which turns a target percent or budget into a per-pattern action set carried as a cap/action CSV. The CSV lands in the config repo through a GitOps PR and hot-reloads on the next pull. The sample action runs in [per-node budget mode](https://doc.log10x.com/run/receive/rate/){target="_blank"} or [mute file mode](https://doc.log10x.com/run/receive/rate/#mute-file-mode-declarative-field-set-caps){target="_blank"}, a declarative field-set keyed cap file committed to git and pulled via GitOps.
+    An AI agent picks the action per service through the log10x MCP (the `configure_engine` tool), which turns a target percent or budget into per-service caps and actions carried as cap and action CSV files. The files land in the config repo through a GitOps PR and hot-reload on the next pull. Per-pattern rates come from the [mute file](https://doc.log10x.com/run/receive/rate/#protection-list){target="_blank"}, a CSV keyed by pattern, committed to git and pulled the same way.
 
     Log10x is normally driven by an AI agent (Claude, or a model the customer brings) through the log10x MCP server, which installs, configures, and queries via MCP tools. The manual steps in these docs are the same operations without an agent.
 
 ??? tenx-overview "How do budget policies work"
 
-    Configuration is a YAML file, written by hand or generated by the MCP `configure_engine` tool and delivered through GitOps. The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} tracks per-event-type spend using automatic [symbol identity](https://doc.log10x.com/run/initialize/message/){target="_blank"} enrichment. You configure:
+    Configuration is a YAML file, written by hand or generated by the MCP `configure_engine` tool and delivered through GitOps. The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} caps the bytes each pattern ([symbol identity](https://doc.log10x.com/run/initialize/message/){target="_blank"}) may spend in its container over a rolling window. You configure:
 
-    - **Budget per hour**, target ingestion cost rate (e.g., $1.50/hour)
-    - **Max share per event type**, prevents any single event type from dominating the budget (e.g., 20%)
-    - **Severity floors**, ERROR events keep a higher minimum share than DEBUG noise
+    - **A byte cap per pattern per container**, fleet-wide or per container from a cap file; the MCP derives it from a monthly dollar budget
+    - **A share guard**, a pattern below a minimum share of its container's volume (default 5%) is left alone
+    - **Severity floors**, an over-cap pattern keeps at least a set share of each level (by default ERROR 50%, WARN 30%, INFO 10%)
+    - **An action per service** for the excess: drop (the default), offload, tier_down, compact, sample or pass
 
-    Example policy: cap total ingestion at $500/hour, cap any single event type at 20% of the budget, prioritize ERROR over INFO.
-
-    When an event type exceeds its max share, the Receiver samples it down proportionally. For [multi-app environments](https://doc.log10x.com/run/receive/rate/#multi-app-regulation){target="_blank"} (Kubernetes), cap per-app budgets using the [container name](https://doc.log10x.com/run/initialize/k8s/){target="_blank"} field, scaling replicas doesn't bypass limits.
+    Cost is reported per pattern; the cap itself is in bytes. Caps are scoped by the [container name](https://doc.log10x.com/run/receive/rate/#containers){target="_blank"}, so scaling replicas doesn't bypass them.
 
 ??? tenx-overview "What happens to logs when budget limits are reached (sample action)"
 
-    The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} applies cost-based sampling. Each event is either **retained** or **dropped** based on how much its event type has spent relative to the budget:
+    The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} decides per event, on bytes:
 
-    - **Under budget**, all events flow through normally
-    - **Event type over its max share**, that type gets sampled down proportionally (e.g., an event type consuming 60% of the budget with a 20% cap gets sampled to ~33%)
-    - **Severity floors**, ERROR events keep a higher minimum share of the over-cap slice than DEBUG noise
+    - **At or below the pattern's cap**, every event flows through
+    - **Over the cap**, each level keeps its floor share and the rest takes the container's action (drop when none is set); nothing targets the excess back down to the cap line
+    - **Severity floors**, ERROR events keep a higher share of the over-cap slice than DEBUG noise
 
-    The result: noisy event types are automatically throttled while critical events are preserved. The Receiver exports [metrics](https://doc.log10x.com/run/output/metric/){target="_blank"} tracking what each pattern's action did, so policies can be tuned over time. Routed-away events carry the label `routeState` (for example `routeState="drop"`).
+    The result: a noisy pattern is throttled while its errors keep flowing. The Receiver exports [metrics](https://doc.log10x.com/run/output/metric/){target="_blank"} tracking what each pattern's action did, so policies can be tuned over time. Routed-away events carry the label `routeState` (for example `routeState="drop"`).
 
 ### :material-cog-outline: Configuration
 
@@ -69,10 +68,10 @@ The [Receiver](https://doc.log10x.com/apps/receiver/) is the execution arm of th
 
     The [rate receiver](https://doc.log10x.com/run/receive/rate/){target="_blank"} uses two mechanisms that naturally protect critical events:
 
-    - **Severity floors**, ERROR and WARN events keep a higher minimum share during sampling. Even when their pattern is over its cap, critical-severity events keep flowing at a higher rate than DEBUG noise
-    - **Max share targeting**, sampling only kicks in when a specific [event type](https://doc.log10x.com/run/initialize/message/){target="_blank"} exceeds its configured share of the budget (e.g., 20%). Low-volume event types, which security and authentication logs typically are, stay well under their share and pass through unaffected
+    - **Severity floors**, ERROR and WARN events keep a higher minimum share of the over-cap slice. Even when their pattern is over its cap, critical-severity events keep flowing at a higher rate than DEBUG noise
+    - **Per-pattern caps**, the regulator engages only on a [pattern](https://doc.log10x.com/run/initialize/message/){target="_blank"} over its byte cap and above the share guard (default 5% of its container's volume). Low-volume patterns, which security and authentication logs typically are, stay under their cap and pass through unaffected
 
-    The Receiver targets noisy, high-volume event types that dominate your budget, not broad categories. Security events that don't spike beyond their budget share flow through without sampling.
+    The Receiver targets noisy, high-volume patterns, not broad categories. Security events that stay under their cap flow through untouched.
 
 ??? tenx-capabilities "How do I monitor budget consumption"
 

package/build/product-kb/docs/apps/receiver/index.md

@@ -7,7 +7,7 @@ icon: "material/pipe-valve"
 ---
 The Receiver runs as a forwarder sidecar and acts on each pattern before events reach your analyzer.
 
-It picks one action per pattern: **pass, sample, compact, tier_down, offload, or drop**. An AI agent sets the action per service through the [log10x MCP](https://doc.log10x.com/apps/mcp/) (`configure_engine`); the engine enforces it, carried as a config change through the [GitOps](https://doc.log10x.com/engine/gitops/) repo.
+Its actions are **pass, sample, compact, tier_down, offload, and drop**. The action is set per service and applies to every pattern over its cap in that service. An AI agent sets the action per service through the [log10x MCP](https://doc.log10x.com/apps/mcp/) (`configure_engine`); the engine enforces it, carried as a config change through the [GitOps](https://doc.log10x.com/engine/gitops/) repo.
 
 ## :material-cog-transfer-outline: Workflow
 
@@ -71,7 +71,7 @@ The Receiver executes as a [forwarder sidecar](https://doc.log10x.com/engine/lau
 
 === ":material-file-document-edit-outline: Mute File (GitOps)"
 
-    A declarative file keyed by the joined `rateReceiverFieldNames` values (e.g. `symbolMessage`, `container`) caps specific patterns with an explicit sample rate and expiry. Operators (or an AI assistant via the [Log10x MCP](https://github.com/log-10x/log10x-mcp)) append entries based on [Reporter](https://doc.log10x.com/apps/reporter/) cost attribution, commit to git, and every receiver pulls the file on its next reload. Each mute is diff-reviewed, self-expires, and maps 1:1 to the field-sets the Reporter attributes cost to. See [mute file mode](https://doc.log10x.com/run/receive/rate/#mute-file-mode-declarative-field-set-caps).
+    A declarative file keyed by the joined `rateReceiverFieldNames` values (e.g. `symbolMessage`, `container`) caps specific patterns with an explicit sample rate and expiry. Operators (or an AI assistant via the [Log10x MCP](https://github.com/log-10x/log10x-mcp)) append entries based on [Reporter](https://doc.log10x.com/apps/reporter/) cost attribution, commit to git, and every receiver pulls the file on its next reload. Each mute is diff-reviewed, self-expires, and maps 1:1 to the field-sets the Reporter attributes cost to. See [mute file mode](https://doc.log10x.com/run/receive/rate/#protection-list).
 
 ## :material-shield-check-outline: Safety & Reliability
 

package/build/product-kb/docs/apps/receiver/run.md

@@ -1303,8 +1303,8 @@ To configure the Receiver app, [:material-cog: Edit](https://doc.log10x.com/conf
           contexts: log,exec
         
           # 'messageField' specifies the field name to assign the message pattern to target TenXObjects: the symbol
-          #  tokens of the origin ranked highest by coverage, meaning the count of distinct library-known tokens it
-          #  explains. Span length is the last tiebreak. The origin file name itself goes to 'originField'.
+          #  tokens of the origin ranked highest on the five-key comparator, message-text width first. Span length
+          #  is the last tiebreak. The origin file name itself goes to 'originField'.
           messageField: message_pattern
         
           # 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
@@ -1326,8 +1326,9 @@ To configure the Receiver app, [:material-cog: Edit](https://doc.log10x.com/conf
         # indented detail, banners) so the message-template skips its own message-pattern compute for them.
         # The check fires only for templates that don't already pass the (groupSize > 1) || groupHead arms;
         # i.e., for single-event templates with no head signal. A non-negator line in that case (e.g., bare
-        # "Hello World", "Heartbeat received from node-7") still gets a pattern; a negator-matching orphan
-        # (e.g., a lone "\tat com.foo.Bar(...)") does not.
+        # "Hello World", "Heartbeat received from node-7") gets a pattern from its library words; a negator-matching
+        # orphan (e.g., a lone "\tat com.foo.Bar(...)") skips origin selection and is named by a hash of its shape,
+        # template_<hash>.
         message:
           negators:
             - " "                 # any indented line (stack frames, indented app detail, multi-line JSON, banners)

package/build/product-kb/docs/apps/reporter/run.md

@@ -826,8 +826,8 @@ To configure the Reporter app, [:material-cog: Edit](https://doc.log10x.com/conf
           contexts: log,exec
         
           # 'messageField' specifies the field name to assign the message pattern to target TenXObjects: the symbol
-          #  tokens of the origin ranked highest by coverage, meaning the count of distinct library-known tokens it
-          #  explains. Span length is the last tiebreak. The origin file name itself goes to 'originField'.
+          #  tokens of the origin ranked highest on the five-key comparator, message-text width first. Span length
+          #  is the last tiebreak. The origin file name itself goes to 'originField'.
           messageField: message_pattern
         
           # 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
@@ -849,8 +849,9 @@ To configure the Reporter app, [:material-cog: Edit](https://doc.log10x.com/conf
         # indented detail, banners) so the message-template skips its own message-pattern compute for them.
         # The check fires only for templates that don't already pass the (groupSize > 1) || groupHead arms;
         # i.e., for single-event templates with no head signal. A non-negator line in that case (e.g., bare
-        # "Hello World", "Heartbeat received from node-7") still gets a pattern; a negator-matching orphan
-        # (e.g., a lone "\tat com.foo.Bar(...)") does not.
+        # "Hello World", "Heartbeat received from node-7") gets a pattern from its library words; a negator-matching
+        # orphan (e.g., a lone "\tat com.foo.Bar(...)") skips origin selection and is named by a hash of its shape,
+        # template_<hash>.
         message:
           negators:
             - " "                 # any indented line (stack frames, indented app detail, multi-line JSON, banners)

package/build/product-kb/docs/apps/retriever/run.md

@@ -1373,8 +1373,8 @@ To configure the Retriever app, [:material-cog: Edit](https://doc.log10x.com/con
           contexts: log,exec
         
           # 'messageField' specifies the field name to assign the message pattern to target TenXObjects: the symbol
-          #  tokens of the origin ranked highest by coverage, meaning the count of distinct library-known tokens it
-          #  explains. Span length is the last tiebreak. The origin file name itself goes to 'originField'.
+          #  tokens of the origin ranked highest on the five-key comparator, message-text width first. Span length
+          #  is the last tiebreak. The origin file name itself goes to 'originField'.
           messageField: message_pattern
         
           # 'messageHashField' specifies the field name to assign a stable, URL-safe pattern hash (xxHash64 of the messageField value, base64url, 11 chars). Safe as a SIEM query term or forwarder filter key.
@@ -1396,8 +1396,9 @@ To configure the Retriever app, [:material-cog: Edit](https://doc.log10x.com/con
         # indented detail, banners) so the message-template skips its own message-pattern compute for them.
         # The check fires only for templates that don't already pass the (groupSize > 1) || groupHead arms;
         # i.e., for single-event templates with no head signal. A non-negator line in that case (e.g., bare
-        # "Hello World", "Heartbeat received from node-7") still gets a pattern; a negator-matching orphan
-        # (e.g., a lone "\tat com.foo.Bar(...)") does not.
+        # "Hello World", "Heartbeat received from node-7") gets a pattern from its library words; a negator-matching
+        # orphan (e.g., a lone "\tat com.foo.Bar(...)") skips origin selection and is named by a hash of its shape,
+        # template_<hash>.
         message:
           negators:
             - " "                 # any indented line (stack frames, indented app detail, multi-line JSON, banners)

package/build/product-kb/docs/compile/faq.md

@@ -26,13 +26,13 @@ The [Compiler](https://doc.log10x.com/compile/) extracts symbol vocabulary from
 
 ??? tenx-security "What information does the compiler generate"
 
-    The compiler extracts **symbol values**, tokens that appear in log statements, such as string literals, enum values, and format patterns. Extracted string constants, from log statement formats (e.g., `"error in %s"`), [binary executables](https://doc.log10x.com/compile/scanner/executable/) (via `strings`), or [text/JSON/YAML files](https://doc.log10x.com/compile/scanner/text/), are stored as **64-bit hashes** in the symbol library. The original plain text is never written to the output. The runtime engine matches incoming events against these hashes, not against your source strings.
+    The compiler extracts **symbol values**, tokens that appear in log statements, such as string literals, enum values, and format patterns. Extracted string constants, from log statement formats (e.g., `"error in %s"`), [binary executables](https://doc.log10x.com/compile/scanner/executable/) (via `strings`), or [text/JSON/YAML files](https://doc.log10x.com/compile/scanner/text/), are stored as **64-bit hashes** in the symbol library. The original plain text of a string is never written to the output; file names and class, method and enum names are. The runtime engine matches incoming events against these hashes, not against your source strings.
 
     Class and method names are stored alongside hashes to identify the source of each log statement, comparable to what appears in a stack trace.
 
     The compiler does **not** extract application logic, control flow, full source file contents, or environment variables. It does not read `.env` files or runtime state.
 
-    Output is a [symbol library](https://doc.log10x.com/compile/link/#symbol-library) file (`.10x.tar`) containing hash mappings and their source locations. You can inspect the contents before deploying (`tar tf library.10x.tar`).
+    Output is a [symbol library](https://doc.log10x.com/compile/link/#symbol-library) file (`.10x.tar`) containing hashes and the file names they came from. You can inspect the contents before deploying (`tar tf library.10x.tar`).
 
 ??? tenx-security "What permissions does the compiler need, and how do I scope access"
 
@@ -45,7 +45,7 @@ The [Compiler](https://doc.log10x.com/compile/) extracts symbol vocabulary from
     | [Helm charts](https://doc.log10x.com/compile/pull/helm/) | Same as GitHub + Docker | Resolves chart image references, then pulls each image |
     | [Artifactory](https://doc.log10x.com/compile/pull/artifactory/) | `ARTIFACTORY_TOKEN` | Read access to target repositories |
 
-    You control exactly which repos and images the compiler accesses via your [configuration](https://doc.log10x.com/compile/test/#config-files). The compiler only pulls sources you explicitly list, it does not discover or scan anything beyond what you configure.
+    You control exactly which repos and images the compiler accesses via your [configuration](https://doc.log10x.com/compile/test/#config-files). The compiler only pulls sources you explicitly list, and the images and repositories those sources reference (a Helm chart's images, an image's source repository, a `go.mod` file's dependencies).
 
     All processing runs inside your infrastructure (CI/CD pipeline or k8s CronJob). No source code or symbol data is sent to Log10x or any external service.
 
@@ -73,7 +73,7 @@ The [Compiler](https://doc.log10x.com/compile/) extracts symbol vocabulary from
 
 ??? tenx-info "Do I need to run the compiler, or do the built-in defaults cover my stack"
 
-    The 10x runtime ships with a [default symbol library](https://doc.log10x.com/compile/pull/#default-symbols) covering 131 open-source repositories and 14 public container images across Java, Python, Node.js, Go, C++, Rust, Ruby, .NET, and Scala, including Kubernetes, OpenTelemetry, Spring Boot, Django, Express, nginx, PostgreSQL, Redis, Kafka, and many more.
+    The 10x runtime ships with a [default symbol library](https://doc.log10x.com/compile/pull/#default-symbols) covering the open-source repositories and public container images listed in the manifest shipped inside the library archive, across Java, Python, Node.js, Go, C++, Rust, Ruby, .NET, and Scala, including Kubernetes, OpenTelemetry, Spring Boot, Django, Express, nginx, PostgreSQL, Redis, Kafka, and many more.
 
     **Start with the defaults.** Run a local cost POC on your own log files to see how much the built-in library covers. The runtime reports which events matched known symbols and which did not.
 
@@ -95,7 +95,7 @@ The [Compiler](https://doc.log10x.com/compile/) extracts symbol vocabulary from
 
 ??? tenx-coverage "My stack uses common open-source frameworks, do I need to run the compiler at all"
 
-    The 10x runtime ships with a [default symbol library](https://doc.log10x.com/compile/pull/#default-symbols) covering 131 open-source repositories and 14 public container images. If your stack is covered by the defaults, you don't need to run the compiler.
+    The 10x runtime ships with a [default symbol library](https://doc.log10x.com/compile/pull/#default-symbols) covering the repositories and container images listed in the manifest shipped inside the library archive. If your stack is covered by the defaults, you don't need to run the compiler.
 
     Run the compiler to **add custom symbols** for your proprietary application code on top of the defaults. This improves template accuracy for your specific log formats. The compiler output supplements the default library, not replaces it.
 
@@ -107,23 +107,23 @@ The [Compiler](https://doc.log10x.com/compile/) extracts symbol vocabulary from
 
     1. **[Docker image scanning](https://doc.log10x.com/compile/pull/docker/)**, Pull any Docker image from any registry (public or private), including closed-source vendor agents. The compiler exports and scans the image filesystem for symbol content. Images are only re-pulled when their SHA256 changes, making incremental runs efficient. Works for `nginx:latest`, Datadog agent images, Splunk UF, or any vendor-provided image.
 
-    2. **[Executable scanning](https://doc.log10x.com/compile/scanner/executable/)**, Runs the OS `strings` utility on compiled binaries (`.so`, `.dll`, `.dynlib`) to extract symbol values. Runs inside your infrastructure; output is only 64-bit hashes (no binary content leaves your network).
+    2. **[Executable scanning](https://doc.log10x.com/compile/scanner/executable/)**, Runs the OS `strings` utility on compiled binaries (`.so`, `.dll`, `.dynlib`) to extract symbol values. Runs inside your infrastructure; output is the binary's file name plus 64-bit hashes of its strings (no binary content leaves your network).
 
     3. **JIT fallback**, For truly opaque sources (AWS-managed service logs, SaaS tools with no Docker image), the JIT runtime handles them automatically at runtime. The engine creates a template on the first event seen, giving ~80% efficiency without any compiler setup needed.
 
 ??? tenx-coverage "Do you support custom and proprietary log formats, or just the default library"
 
-    **Both.** The default library covers common frameworks, but the compiler lets you add custom symbols for proprietary logging patterns. Custom formats work out of the box with 80% coverage from the built-in library.
+    **Both.** The default library covers common frameworks, but the compiler lets you add custom symbols for proprietary logging patterns. Custom formats work out of the box with the built-in library.
 
-    **How it works:** The runtime [tokenizes](https://doc.log10x.com/run/transform/structure/) incoming events and matches tokens against the symbol library. With 80% built-in coverage, most generic tokens (class names, log levels, timestamps, method names) already match. For logs from your proprietary services, the runtime still processes them, but template inference is less precise.
+    **How it works:** The runtime [tokenizes](https://doc.log10x.com/run/transform/structure/) incoming events and matches tokens against the symbol library. With the built-in library, most generic tokens (class names, log levels, method names) already match; timestamps are [variables](https://doc.log10x.com/run/transform/structure/#variables), not library words. For logs from your proprietary services, the runtime still processes them, but template inference is less precise.
 
-    **When to optimize:** If you want accurate [message extraction](https://doc.log10x.com/run/initialize/message/) for cost attribution and metrics, capturing the intended "essence" of each custom event type, run the compiler on your custom code. This generates additional symbols, so the runtime recognizes your proprietary patterns and builds more accurate templates. The compiler is iterative: initial runs take 10-30 minutes to scan your code. Subsequent runs only process changed files, completing in seconds, perfect for CI/CD pipelines. You point it at your repositories once, then it automatically supplements the default symbol library on each deploy.
+    **When to optimize:** If you want accurate [message extraction](https://doc.log10x.com/run/initialize/message/) for cost attribution and metrics, capturing the intended "essence" of each custom event type, run the compiler on your custom code. This generates additional symbols, so the runtime recognizes your proprietary patterns and builds more accurate templates. The compiler is iterative: an initial run scans all of your code; later runs scan only what changed. Subsequent runs only process changed files, completing in seconds, perfect for CI/CD pipelines. You point it at your repositories once, then it automatically supplements the default symbol library on each deploy.
 
     See [real-world before/after examples](https://doc.log10x.com/apps/receiver/){target="_blank"} showing how symbol coverage improves lossless volume reduction on production logs.
 
 ??? tenx-coverage "My custom format isn't in the library, does it still work"
 
-    Yes. The engine creates a template for every event type it encounters, there are no "unrecognized" events. The [symbol library](https://doc.log10x.com/run/symbol/) provides vocabulary that determines how much of each event is classified as structure (low-cardinality, stored in the template) vs variable data (high-cardinality, shipped per event). The [default library](https://doc.log10x.com/compile/pull/#default-symbols) covers 145 pinned sources and delivers strong reduction on most workloads.
+    Yes. The engine creates a template for every event type it encounters, there are no "unrecognized" events. The [symbol library](https://doc.log10x.com/run/symbol/) provides vocabulary that determines how much of each event is classified as structure (low-cardinality, stored in the template) vs variable data (high-cardinality, shipped per event). The [default library](https://doc.log10x.com/compile/pull/#default-symbols) covers the sources listed in its manifest, each pinned to a commit or image digest, and delivers strong reduction on most workloads.
 
     Running the compiler on custom application code enriches the vocabulary further, producing richer templates, more accurate [message extraction](https://doc.log10x.com/run/initialize/message/), and higher reduction ratios. Without it, the format still works using the default vocabulary, with no configuration or manual regex rules.
 
@@ -131,7 +131,7 @@ The [Compiler](https://doc.log10x.com/compile/) extracts symbol vocabulary from
 
 ??? tenx-operations "How often do I need to run the compiler, and what is the maintenance overhead"
 
-    Minimal. Initial runs take a few minutes; incremental runs on unchanged code complete in seconds. Deploy as a [k8s CronJob](https://doc.log10x.com/compile/deploy/) (every 30 minutes) or trigger from CI/CD on commits.
+    Minimal. Initial runs take a few minutes; incremental runs on unchanged code complete in seconds. Deploy as a [k8s CronJob](https://doc.log10x.com/compile/deploy/) on a schedule you choose, or trigger from CI/CD on commits. A rebuilt library can rename the affected patterns once, so a schedule is a choice with that consequence. To pin the library, load it from a branch you update deliberately, or set `syncInterval` to null in the [GitHub](https://doc.log10x.com/config/github/) pull so the runtime loads it once at start-up.
 
     How it stays lightweight:
 
@@ -149,7 +149,7 @@ The [Compiler](https://doc.log10x.com/compile/) extracts symbol vocabulary from
 
     To troubleshoot:
 
-    - Extract and inspect [symbol library contents](https://doc.log10x.com/compile/link/#file-structure) (`tar tf library.10x.tar`), verify your target symbols were captured
+    - Extract and inspect [symbol library contents](https://doc.log10x.com/compile/link/#file-structure) (`tar tf library.10x.tar`); units list file, class and method names, and each string only as a hash
     - Run the engine locally on test logs and enable [debug output](https://doc.log10x.com/run/transform/symbol/#debug) to see symbol matching and template assignment in detail
     - Check the engine [log file](https://doc.log10x.com/manage/logging/#log-file-location) for runtime template assignment messages
 
@@ -162,7 +162,7 @@ The [Compiler](https://doc.log10x.com/compile/) extracts symbol vocabulary from
     - **[GitHub repos](https://doc.log10x.com/compile/pull/github/)**, extracts symbols from source code and compiled binaries
     - **[Artifactory](https://doc.log10x.com/compile/pull/artifactory/)**, pulls from artifact repositories
 
-    The runtime ships with a [default symbol library](https://doc.log10x.com/compile/pull/#default-symbols) covering 131 open-source repositories and 14 public container images (Spring Boot, Django, Express, Kafka, Kubernetes, and more). Most environments work out of the box, custom compilation is only needed for proprietary logging frameworks or application-specific log formats.
+    The runtime ships with a [default symbol library](https://doc.log10x.com/compile/pull/#default-symbols) covering the repositories and container images listed in the manifest shipped inside the library archive (Spring Boot, Django, Express, Kafka, Kubernetes, and more). Most environments work out of the box, custom compilation is only needed for proprietary logging frameworks or application-specific log formats.
 
     The compiler commits custom symbol libraries to GitHub as part of its pipeline. Edge and cloud apps pull them automatically via the [`@github` launch macro](https://doc.log10x.com/config/github/) at startup and poll for changes at a configurable interval. See [compiler workflow](https://doc.log10x.com/compile/#workflow) for the full CI/CD → Pull → Scan → Link → Push → Distribute pipeline.
 

package/build/product-kb/docs/compile/index.md

@@ -8,7 +8,7 @@ icon: "material/cogs"
 ---
 The `AOT compile` pipeline produces [symbol library](https://doc.log10x.com/compile/link/#symbol-library) files that enable the [run](https://doc.log10x.com/run/) stream processor pipeline to transform input events into typed [TenXObjects](https://doc.log10x.com/api/js/#TenXObject "Provide structured, reflective access to log/trace events read from input(s)."). To launch this pipeline use the [compiler app](https://doc.log10x.com/apps/compiler/).
 
-The 10x Engine's [default library](https://doc.log10x.com/compile/pull/#default-symbols) covers 150+ frameworks. Running the compiler on your own environment's repos is **optional** and enables the runtime to increase its level of efficiency in aggregating and reducing event volume.
+The 10x Engine ships a [default library](https://doc.log10x.com/compile/pull/#default-symbols); the manifest inside it lists every repository and container image it was built from. See [naming](https://doc.log10x.com/run/initialize/message/#message-extraction) for how a line gets its pattern name. Running the compiler on your own environment's repos is **optional** and enables the runtime to increase its level of efficiency in aggregating and reducing event volume.
 
 ## :material-cog-transfer-outline: Workflow
 

package/build/product-kb/docs/compile/link/index.md

@@ -24,6 +24,7 @@ Operating on typed TenXObjects enables direct access to [symbol](https://doc.log
 Each symbol library `.10x.tar` archive file contains:
 
 - A `.10x.json` file combining the symbol unit files generated during the [scan](https://doc.log10x.com/compile/scan/ "Capture symbol values from source code/binary files and link to an output symbol library") phase.
+- A `manifest.10x.json` file listing each source with the commit or digest it was built from.
 - A `.10x.pb` Protocol Buffer file which provides a reverse in-mem index of the symbols values contained within the JSON for fast loading and random access. To learn more see the [.proto IDL](https://github.com/log-10x/pipeline-extensions/blob/main/api-extensions/src/main/proto/FsSymbolUnitsIndex.proto){target="\_blank"}.
 
 ## :material-wrench-outline: Config Files
@@ -290,7 +291,7 @@ Token types read from input source/binary files written to output.
 
 |Type|Default|
 |---|---|
-|List|\[package, class, enum, log, text, exec\]|
+|List|\[class, enum, log\]|
 
 Filter symbol values to write to [outputSymbolLibraryFile](https://doc.log10x.com/compile/link/#outputsymbollibraryfile "location of output symbol library file") based on their [context](https://doc.log10x.com/run/transform/symbol/#contexts).
 This option reduces the size of the output symbol library file by omitting symbol types not required at run time.

package/build/product-kb/docs/compile/pull/index.md

@@ -13,6 +13,8 @@ Pulling [symbol files](https://doc.log10x.com/compile/scanner/symbol/ "Discover
 
 The 10x runtime comes with a built-in symbol library that includes symbols for industry-standard frameworks and infrastructure components. This pre-compiled symbol library enables immediate log optimization capabilities without requiring users to scan and compile symbols for common technologies and popular open-source projects.
 
+The library's [manifest](https://doc.log10x.com/compile/link/#file-structure) lists each source with the commit or digest it was built from. From container images the library takes the strings in their binaries. Test files, vendored copies and log files inside the repositories are left out. Each project keeps its own license: the library holds hashes of its strings and the names of its files, classes and methods, not its source text.
+
 ??? tenx-symbols "Container Images (Helm Charts)"
 
     Symbols extracted from Docker container images and their source code dependencies via Helm chart scanning.
@@ -21,7 +23,7 @@ The 10x runtime comes with a built-in symbol library that includes symbols for i
     |------------|------------|
     | [open-telemetry/opentelemetry-demo](https://github.com/open-telemetry/opentelemetry-demo) | Polyglot microservices demo (14 services in Go, Java, Node.js, Python, .NET, Rust, PHP, Ruby, C++) |
     | [ingress-nginx/ingress-nginx](https://github.com/kubernetes/ingress-nginx) | NGINX binary, HTTP error codes, upstream timeouts, load balancer logs |
-    | [prometheus-community/kube-prometheus-stack](https://github.com/prometheus-community/helm-charts) | Prometheus, Alertmanager, Grafana, node-exporter, kube-state-metrics |
+    | [prometheus-community/kube-prometheus-stack](https://github.com/prometheus-community/helm-charts) | Prometheus, Prometheus Operator, node-exporter, kube-state-metrics |
 
 ??? tenx-symbols "Java Frameworks"
 

package/build/product-kb/docs/compile/scan/index.md

@@ -691,7 +691,7 @@ Maximum number of input files to scan per sub-process.
 
 |Type|Default|Category|
 |---|---|---|
-|Number|40|Subprocess|
+|Number|200|Subprocess|
 
 Sets the maximum number of source/binary input files to scan by a single 'compile' sub-process.  
 Set to 0 to unlimited.
@@ -720,7 +720,7 @@ Timeout interval for scanning a source code /binary input file.
 
 |Type|Default|Category|
 |---|---|---|
-|String|20s|Parallel|
+|String|30s|Parallel|
 
 Sets the timeout interval when scanning a source code /binary input file before dropping it.
 Set to null to ignore.
@@ -768,9 +768,9 @@ It is a standard programming practice to use string formats to log messages in t
 log.error("could not connect to {} with status {}", host, status);
 ```
 
-When an TenXTemplate tokenizer processing an event identifies a format prefix (e.g., `%`)
-it skips it and appends subsequent symbol tokens (e.g., `with status`)
-to the symbol sequence preceding them (e.g., `could not connect to`).
+The scanner splits the literal at each format prefix (e.g., `%`) into sections
+(`could not connect to`, `with status`) and stores each section; at run time a
+multi-section format matches only when every section is present on the line.
 
 
 #### :material-menu-right-outline:**`maxSymbolUnitsPerToken`**

package/build/product-kb/docs/compile/scanner/logMethods/index.md

@@ -14,7 +14,7 @@ logger.error("could not connect to {}", host);
 cerr << "could not connect to" << host << << std::endl;
 ```
 
-The string constants receive a 'log' context, unlike non-logging calls:
+The string constants receive a 'log' context. So does every literal in a method that logs, throws or raises (in Java source, Python and Scala, only those preceding the logging or throwing statement), and any literal carrying a format placeholder. A literal in a method that does neither keeps a 'const' context:
 
 ```js
 foo("could not connect to " + host);

package/build/product-kb/docs/compile/scanner/text/index.md

@@ -9,7 +9,7 @@ Extracts [symbol](https://doc.log10x.com/run/transform/structure/#symbols) value
 
 Parses input by splitting lines with delimiters or using a [JsonFactory](https://fasterxml.github.io/jackson-core/javadoc/2.8/com/fasterxml/jackson/core/JsonFactory.html){target="\_blank"} for structured token reading.
 
-When source code for a log format is unavailable (e.g., third-party services), scan a sample log to extract symbols for future parsing.
+When source code for a log format is unavailable (e.g., third-party services), a sample log can be scanned at compile time as an optional input to extract its symbols. Nothing is learned at run time.
 
 !!! note "Size limit"