Add SHAREXP distinction, create UNKNOWNXP default

Previously, KILLXP was being set as the catchall, which caused false
positives for XP sharing.

Update documentation accordingly.

log version incremented to 4.