diff --git a/.env.example b/.env.example
index 3b93fe20ee..1405b45193 100644
--- a/.env.example
+++ b/.env.example
@@ -240,7 +240,8 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # `req`, `count`, or `close`. `http` is one line per HTTP request, written
 # by one layer when the response is ready (not proof the body was delivered):
 # `route` is the matched route template (never the raw path), with the response
-# `status` and `time_to_response_ms` on every line. It carries the login
+# `status` and `time_to_response_ms` on every line; the method is the
+# enclosing `http.request` span's `http.request.method`. It carries the login
 # (`method`, `pubkey`, `pubkey_verified`) and `outcome` (`success`, `denied`,
 # `failed`, `challenged`, or `undecided` when the route recorded no decision; a
 # refusal is final). `/query` and `/count` add the filter summary and
@@ -261,7 +262,10 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # `auth` is one line per WebSocket login, written when it succeeds or is
 # refused; every root WebSocket `auth` line carries the TCP `peer_addr`.
 # `req` / `count` is one line per WebSocket read, with the same filter summary
-# (search text is never logged, only `search: true`). `close` is the
+# (search text is never logged, only `search: true`). The summary lists up to
+# 10 kinds, channel ids, authors and `p` values each; `kind_count`,
+# `channel_count`, `author_count` and `p_count` appear only when the list is
+# `*` or shows fewer values than the filters held. `close` is the
 # connection's one line: duration, totals, the login's `pubkey`, `method` and
 # `pubkey_verified`, and `reads_suppressed` / `auth_suppressed` for repeated
 # refusals past the first 16. It is written however the connection ends, with
@@ -270,7 +274,9 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # their own lines.
 # Successful lines and git's credential-less first request
 # (`outcome=challenged`) are INFO; refusals, error statuses and aborted
-# requests are WARN. A WebSocket read is WARN only when it ends in `error`;
+# requests are WARN. A successful `/query` or `/count` that returned nothing
+# (`result_count=0`) is DEBUG, since polling clients make most of them. A
+# WebSocket read is WARN only when it ends in `error`;
 # refused and `aborted` reads stay INFO, since `aborted` means the client
 # closed the connection mid-read, which is routine. Turn it down with
 # `buzz_relay::access=warn` (keeps refusals, errors and aborted HTTP requests,