Each row now starts with a fixed-width badge naming its source, one color per source: SYSLOG, DOCKER, KERNEL (dmesg), HOST (/var/log), AUDIT, FILE and LS. The AUDIT/FILE/LS badges move there from before the app name; those sources keep their colored edge and tint. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>