Install wizard

Previous value: -"When true, the Log10x agents send nothing to log10x.com — engine metrics, license re-validation, and update checks all go silent. Use to reduce CISO friction. Conflicts with `\"log10x\"` in `backends` (the wizard surfaces the conflict). **Demo licenses cannot actually run airgapped** — the engine downgrades to online mode with a warning. The wizard surfaces this softly when both are picked."New value: +"When true, the Log10x agents send nothing to log10x.com: engine metrics, license re-validation, and update checks all go silent. Use to reduce CISO friction. Conflicts with `\"log10x\"` in `backends` (the wizard surfaces the conflict). **Demo licenses cannot actually run airgapped**: the engine downgrades to online mode with a warning. The wizard surfaces this softly when both are picked."

Previous value: -"Per-backend credential configuration, keyed by backend kind (must be one of: log10x, datadog, elastic, cloudwatch, prometheus). **Only set for non-`log10x` backends** — `log10x` SaaS uses the license JWT and needs no extra credentials. Each entry has a `secretName` (the Kubernetes Secret the user creates out-of-band holding sensitive env vars like `DD_API_KEY`; default per backend is `<backend>-credentials`) and optional `plainValues` (overrides for non-sensitive env vars like `DD_SITE`). Example: `{ \"datadog\": { \"secretName\": \"datadog-secret\", \"plainValues\": { \"DD_SITE\": \"us5.datadoghq.com\" } } }`."New value: +"Per-backend credential configuration, keyed by backend kind (one of: datadog, elastic, cloudwatch, prometheus; `log10x` needs none, since it authenticates with the licence JWT). Each entry has a `secretName` (the Kubernetes Secret the user creates out-of-band holding sensitive env vars like `DD_API_KEY`; default per backend is `<backend>-credentials`) and optional `plainValues` (overrides for non-sensitive env vars like `DD_SITE`). Example: `{ \"datadog\": { \"secretName\": \"datadog-secret\", \"plainValues\": { \"DD_SITE\": \"us5.datadoghq.com\" } } }`."

Previous value: -"Where the engine emits TenXSummary metrics. Multi-destination — a user can report to log10x SaaS AND their own backend simultaneously, e.g. `[\"log10x\", \"datadog\"]`. Choices: **log10x** (optional Log10x-hosted backend, for evaluation), **datadog**, **elastic**, **cloudwatch**, **prometheus** (customer-owned). The wizard pre-fills detected backends from the snapshot. The only mutual exclusion is `airgapped: true` + `\"log10x\"` in this list."New value: +"Where the engine emits TenXSummary metrics: the user's own TSDB(s), one or more of **prometheus**, **datadog**, **elastic**, **cloudwatch**. When omitted, the wizard asks, listing any backend whose agent discovery detected first. **log10x** (the Log10x-hosted TSDB) is for the public demo, not customer installs: it is never suggested, and is accepted only when the user explicitly asks for it. It then needs a user licence (`license_source: \"signin\"` or `\"paste\"`); on the default built-in evaluation licence it receives nothing. `airgapped: true` + `\"log10x\"` is rejected."

Added value: +{
+  "additionalProperties": false,
+  "description": "The fleet default for a Datadog Receiver plan (with `log_destination: \"datadog\"`). The Receiver values are written only on an engine release that reads `rateReceiverDefaultAction`.",
+  "properties": {
+    "action": {
+      "description": "Where a statement above the fleet limit goes: `tier_down` (Flex, the default where the account has Flex) or `offload` (S3).",
+      "enum": [
+        "tier_down",
+        "offload"
+      ],
+      "type": "string"
+    },
+    "cap_bytes_per_window_per_node": {
+      "description": "The limit in the engine's unit, as `log10x_configure_engine` or `log10x_poc_from_local` with `fleet_default` returns it (`fleet_default.cap_bytes_per_window_per_node`). Without it the plan writes no fleet default.",
+      "exclusiveMinimum": 0,
+      "type": "number"
+    },
+    "error_floor": {
+      "description": "Share of ERROR and CRITICAL lines above the limit that stay in Standard. Default 0.5 with offload, 0 with tier_down.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    }
+  },
+  "type": "object"
+}

Added value: +{
+  "description": "A pod label key whose value names the owning team (e.g. `team`). Receiver plans write `k8sTeamLabel` with it, on an engine release that reads that option, so the metrics carry `tenx_team`.",
+  "type": "string"
+}

Previous value: -"License JWT supplied by the user when `license_source: \"paste\"`. Mints from `POST /api/v1/license` (signed-in) or `POST /api/v1/license/demo` (anonymous). Maps to the chart's license Secret."New value: +"License JWT supplied by the user when `license_source: \"paste\"` (passing it alone implies `paste`). Minted from `POST /api/v1/license` (signed-in) or `POST /api/v1/license/demo` (anonymous). Maps to the chart's license Secret."

Removed value: -"signin"

Previous value: -"How the wizard should acquire the engine's license JWT. **Defaults to `\"signin\"`** when omitted — the wizard tries to mint a user-scoped license via the user's Auth0 session, and emits `signin_required` mode (chain through `log10x_signin_start` then re-invoke) when no session exists. Pass **`\"demo\"`** ONLY when the user explicitly asks for a quick 14-day anonymous demo (transient, can't run airgapped). Pass **`\"paste\"`** with `license_jwt_paste: \"<jwt>\"` when the user already has a JWT."New value: +"How the engine is licensed. **Defaults to `\"builtin\"`** when omitted: the plan carries no licence and the engine runs its built-in evaluation licence (10 nodes, 30 days from each start, airgapped). Nothing is minted or stored, and no licence Secret is created. Pass **`\"signin\"`** when the user wants their own user-scoped licence: the wizard mints it via the user's Auth0 session and emits `signin_required` mode (chain through `log10x_signin_start`, then re-invoke) when no session exists. Pass **`\"paste\"`** with `license_jwt_paste: \"<jwt>\"` when the user already has a JWT. Pass **`\"demo\"`** only when the user explicitly asks for the anonymous 1-node, 14-day demo JWT. Every choice other than `builtin` adds a step that creates the licence Secret. Omitting this arg on a later call keeps the earlier choice."

Previous value: -[
-  "signin",
-  "demo",
-  "paste"
-]New value: +[
+  "builtin",
+  "signin",
+  "demo",
+  "paste"
+]

Added value: +{
+  "description": "Where the forwarder ships the log events (not the metrics; `backends` is the metrics). `datadog` adds the step after the POC to a Receiver plan: the fleet default for every service the POC report gives no rule, with the Flex index and its `@routeState:tier_down` filter (or the S3 branch for offload), the always-pass sample, and what an error monitor sees.",
+  "enum": [
+    "datadog"
+  ],
+  "type": "string"
+}

Previous value: -"ID returned by `log10x_discover_env`. The snapshot is cached for 30 min."New value: +"ID returned by `log10x_discover_env`, and the one arg the wizard cannot infer. The snapshot is cached for 30 min. Call `log10x_discover_env` first when there is no snapshot yet."

Removed value: -[
-  "snapshot_id"
-]