From 7574ee8403b30dbe3142c114e6633228986ac0a6 Mon Sep 17 00:00:00 2001
From: iverJisty <iverJisty@users.noreply.github.com>
Date: Fri, 4 Sep 2026 13:19:40 +0800
Subject: [PATCH 01/58] fix(ports): route the status-bar popover scan to the
 workspace's host (#17048)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(ports): route the status-bar popover scan to the workspace's host

- PortsStatusSegment resolved its runtime target from the global active
  runtime, so opening the popover on a paired-remote workspace scanned the
  client OS and reported zero workspace ports
- Resolve the target from the active worktree's owner host, matching
  PortsPanel, PortRow, and WorktreeCardPorts
- Add publishWorkspacePortScanForHost: store the host's scan under its own
  key, then republish the aggregate through setWorkspacePortScanProjection
  so a single-host refresh no longer drops every other host's ports
- Publish through the projection setter instead of setWorkspacePortScan,
  which wrote the synthetic all-hosts key back into workspacePortScansByKey
  and made the next merge fold the aggregate into itself (duplicate rows)
- Reuse the helper for the manual panel refresh and the post-stop refresh,
  and share the aggregate key constant with WorkspacePortScanner

* test(ports): cover popover host routing and aggregate preservation

- PortsStatusSegment.host-routing: popover scans the active workspace's
  owner host, keeps other hosts in the projection, publishes a failed scan
  under its own host, and stays local when the workspace has no owner
- workspace-port-scan-publish: single-host key vs all-hosts projection, and
  repeated publishes never accumulate duplicate rows

* fix(ports): surface a host whose port scan failed instead of dropping it

- The merged projection only carries unavailableReason when every host failed,
  so one unreachable server read as "this workspace has no ports"
- Add getUnavailableWorkspacePortHosts: hosts that failed while another host
  still answered, with the local host distinguished by a null environment id
- Show one notice per failed host in the popover, named by its runtime
  environment or the local host label, above the surviving hosts' ports
- Reuse the existing scan-unavailable string so no catalog entry is added

* test(ports): prove the popover's own failed scan reaches the host notice

- Make the mocked store setters write back, so a publish and the notice that
  reads it can no longer name different scan keys with every assertion green
- Cover open popover -> remote scan rejects -> notice names the host, the seam
  the store-write and render-only tests each stopped short of
- Drop an assertion comment that claimed to prove port preservation when it
  only exercised the render path

* fix(ports): review nits — single-write publish, colon-safe host keys, failure port retention, docstrings

* fix(ports): keep the popover count and body in agreement, name every failed host

- A failed scan retains the host's last-good ports, and the badge/header count
  them; the notice now sits above the list instead of replacing it, so the
  popover no longer claims N ports over an empty body.
- getUnavailableWorkspacePortHosts reports all-hosts-failed too, so total loss
  of contact names each host instead of printing raw scan keys under platform
  'unknown'.
- Scan keys parse to a discriminated host ref, so an unrecognised key is
  'unknown' rather than silently blamed on the local machine.
- Extract useWorktreeRuntimeTarget for the four ports surfaces that hand-rolled
  the same owner-settings spread.

* fix(ports): label the local host from the failed scan's platform, not the renderer's userAgent

A paired web client's browser is not the Orca host, so deriving 'Local Mac'
from navigator.userAgent mislabels a Linux host. Carry each failed scan's
own platform through the unavailable-host list instead.

* fix(ports): keep the Ports panel list under its failure notice too

The retained-ports change gave a failed scan both ports and an
unavailableReason, and the right-sidebar panel hid every section behind the
notice — stripping the stop and open actions for ports the status bar still
counts. Gate the sections on whether anything is left to list, matching the
popover, behind a testable predicate.

* fix(ports): let a retained-port failure keep its debounce grace period

The popover publishes the host's last-good ports alongside the failure reason
the moment its own scan fails. reconcileTransientPortScanFailures treated any
published result carrying unavailableReason as a spent grace period, so the
very next background poll replaced those ports with an empty unavailable scan
— the retention never survived one poll interval. Keep the grace while the
published result still has ports; the tolerance still clears them on schedule.

* fix(ports): prune stale hosts in the poll's single map write

A manual publish (the ports popover) can resolve after the host-set change
already pruned its key, re-adding it; the poll's per-key writes only ever added,
so a removed host kept its ports in the count and held a permanent unavailable
notice until the next host-set change. Publish the poll's already-pruned map in
one replaceWorkspacePortScans instead, which also collapses N per-host
notifications into one and drops any synthetic all-hosts key that leaked in.

* fix(ports): fail closed for direct SSH workspaces

---------

Co-authored-by: Neil <4138956+nwparker@users.noreply.github.com>
---
 .../ports/WorkspacePortScanner.test.tsx       |  31 ++
 .../components/ports/WorkspacePortScanner.tsx |  37 +-
 .../right-sidebar/PortsPanel.test.tsx         |  53 +--
 .../local-workspace-port-sections.test.ts     |  30 ++
 .../local-workspace-port-sections.ts          |  20 +
 .../local-workspace-ports-panel.tsx           |  63 ++-
 .../WorktreeCard.compact-hover.test.tsx       |   4 +-
 ....compact-ports-hover-independence.test.tsx |   4 +-
 .../sidebar/WorktreeCardPorts.test.tsx        |   2 +-
 .../components/sidebar/WorktreeCardPorts.tsx  |  24 +-
 .../PortsStatusSegment.host-routing.test.tsx  | 407 ++++++++++++++++++
 .../status-bar/PortsStatusSegment.tsx         | 141 ++++--
 .../ports-status-popover-rows.test.tsx        |   5 +-
 .../status-bar/ports-status-popover-rows.tsx  |  26 +-
 .../src/lib/workspace-port-actions.ts         |  85 ++--
 .../workspace-port-host-availability.test.ts  | 148 +++++++
 .../lib/workspace-port-host-availability.ts   |  65 +++
 .../lib/workspace-port-scan-debounce.test.ts  |  32 ++
 .../src/lib/workspace-port-scan-debounce.ts   |  10 +-
 .../lib/workspace-port-scan-publish.test.ts   | 153 +++++++
 .../src/runtime/runtime-client-target.ts      |  15 +
 .../runtime/use-worktree-runtime-target.ts    |  16 +
 22 files changed, 1185 insertions(+), 186 deletions(-)
 create mode 100644 src/renderer/src/components/right-sidebar/local-workspace-port-sections.test.ts
 create mode 100644 src/renderer/src/components/status-bar/PortsStatusSegment.host-routing.test.tsx
 create mode 100644 src/renderer/src/lib/workspace-port-host-availability.test.ts
 create mode 100644 src/renderer/src/lib/workspace-port-host-availability.ts
 create mode 100644 src/renderer/src/lib/workspace-port-scan-publish.test.ts
 create mode 100644 src/renderer/src/runtime/use-worktree-runtime-target.ts

diff --git a/src/renderer/src/components/ports/WorkspacePortScanner.test.tsx b/src/renderer/src/components/ports/WorkspacePortScanner.test.tsx
index be1c69cbac7..0ae53fee931 100644
--- a/src/renderer/src/components/ports/WorkspacePortScanner.test.tsx
+++ b/src/renderer/src/components/ports/WorkspacePortScanner.test.tsx
@@ -493,6 +493,37 @@ describe('WorkspacePortScanner', () => {
     expect(useAppStore.getState().workspacePortScansByKey['environment:env-3:all']).toBeUndefined()
   })
 
+  // Why: a manual publish (the ports popover) can resolve after the host-set
+  // change already pruned its key, re-adding it. Per-key writes never delete, so
+  // that removed host would otherwise hold its ports and a permanent
+  // unavailable notice until the next host-set change.
+  it('drops a stale host re-added after pruning on the next poll', async () => {
+    await act(async () => {
+      root?.render(<WorkspacePortScanner />)
+      await flushPromises()
+    })
+
+    const staleKey = 'environment:env-removed:all'
+    act(() => {
+      const state = useAppStore.getState()
+      state.replaceWorkspacePortScans(
+        {
+          ...state.workspacePortScansByKey,
+          [staleKey]: { ...emptyScan, unavailableReason: 'gone' }
+        },
+        state.workspacePortScan
+      )
+    })
+    expect(useAppStore.getState().workspacePortScansByKey[staleKey]).toBeDefined()
+
+    await act(async () => {
+      vi.advanceTimersByTime(30_000)
+      await flushPromises()
+    })
+
+    expect(useAppStore.getState().workspacePortScansByKey[staleKey]).toBeUndefined()
+  })
+
   it('clears ports immediately when the final worktree is removed', async () => {
     runtimeEnvironmentCall.mockImplementation(({ method }) => {
       if (method === 'workspacePorts.scan') {
diff --git a/src/renderer/src/components/ports/WorkspacePortScanner.tsx b/src/renderer/src/components/ports/WorkspacePortScanner.tsx
index f2805eb88a7..2b12bd86cd8 100644
--- a/src/renderer/src/components/ports/WorkspacePortScanner.tsx
+++ b/src/renderer/src/components/ports/WorkspacePortScanner.tsx
@@ -4,10 +4,11 @@ import { getHasAnyWorktreesFromState } from '@/store/selectors'
 import { getActiveRuntimeTarget, type RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
 import {
   mergeWorkspacePortScans,
-  runtimeTargetForExecutionHostId,
+  WORKSPACE_PORT_ALL_HOSTS_SCAN_KEY,
   scanWorkspacePortsForTarget,
   workspacePortScanKeyForTarget
 } from '@/lib/workspace-port-actions'
+import { runtimeTargetForExecutionHostId } from '@/runtime/runtime-client-target'
 import { installWindowVisibilityInterval, isWindowVisible } from '@/lib/window-visibility-interval'
 import {
   reconcileTransientPortScanFailures,
@@ -41,7 +42,6 @@ export function WorkspacePortScanner({ enabled = true }: { enabled?: boolean }):
   const setWorkspacePortScan = useAppStore((s) => s.setWorkspacePortScan)
   const setWorkspacePortScanProjection = useAppStore((s) => s.setWorkspacePortScanProjection)
   const replaceWorkspacePortScans = useAppStore((s) => s.replaceWorkspacePortScans)
-  const setWorkspacePortScanForKey = useAppStore((s) => s.setWorkspacePortScanForKey)
   const setWorkspacePortScanRefreshing = useAppStore((s) => s.setWorkspacePortScanRefreshing)
   const inFlightRef = useRef<Promise<void> | null>(null)
   const generationRef = useRef(0)
@@ -124,40 +124,40 @@ export function WorkspacePortScanner({ enabled = true }: { enabled?: boolean }):
             const activeTargetKeys = new Set(
               allTargets.map((target) => workspacePortScanKeyForTarget(target))
             )
+            const publishedScans = useAppStore.getState().workspacePortScansByKey
             const reconciled = reconcileTransientPortScanFailures(
               results,
-              useAppStore.getState().workspacePortScansByKey,
+              publishedScans,
               portScanDebounceRef.current,
               WORKSPACE_PORT_SCAN_FAILURE_THRESHOLD,
               activeTargetKeys
             )
             const scansByKey = Object.fromEntries(
-              Object.entries(useAppStore.getState().workspacePortScansByKey).filter(([key]) =>
-                activeTargetKeys.has(key)
-              )
+              Object.entries(publishedScans).filter(([key]) => activeTargetKeys.has(key))
             )
-            let sourceChanged = false
+            // Why: a manual publish that lands after a host is pruned re-adds its key,
+            // and per-key writes never delete. Dropping the inactive keys here is what
+            // stops a removed host from holding a permanent unavailable notice.
+            let sourceChanged =
+              Object.keys(scansByKey).length !== Object.keys(publishedScans).length
             for (const { key, result } of reconciled) {
               sourceChanged ||= scansByKey[key] !== result
               scansByKey[key] = result
-              setWorkspacePortScanForKey(key, result)
             }
             const activeScan = scansByKey[scanKey]
             const merged = mergeWorkspacePortScans(scansByKey)
             const projectionKey =
               allTargets.length > 1
-                ? 'all-hosts:all'
+                ? WORKSPACE_PORT_ALL_HOSTS_SCAN_KEY
                 : activeScan
                   ? scanKey
                   : workspacePortScanKeyForTarget(allTargets[0])
             if (sourceChanged || useAppStore.getState().workspacePortScan?.key !== projectionKey) {
-              setWorkspacePortScanProjection(
-                merged
-                  ? {
-                      key: projectionKey,
-                      result: merged
-                    }
-                  : null
+              // Why: one store update for the whole poll — a large host set must not
+              // fan out a notification to every subscriber per host.
+              replaceWorkspacePortScans(
+                sourceChanged ? scansByKey : publishedScans,
+                merged ? { key: projectionKey, result: merged } : null
               )
             }
           }
@@ -177,8 +177,7 @@ export function WorkspacePortScanner({ enabled = true }: { enabled?: boolean }):
       hasWorktrees,
       scanKey,
       setWorkspacePortScan,
-      setWorkspacePortScanProjection,
-      setWorkspacePortScanForKey,
+      replaceWorkspacePortScans,
       setWorkspacePortScanRefreshing
     ]
   )
@@ -215,7 +214,7 @@ export function WorkspacePortScanner({ enabled = true }: { enabled?: boolean }):
         : Object.fromEntries(retainedEntries)
     const retainedProjection = mergeWorkspacePortScans(retainedScans)
     const retainedProjectionKey =
-      targetKeys.size > 1 ? 'all-hosts:all' : Object.keys(retainedScans)[0]
+      targetKeys.size > 1 ? WORKSPACE_PORT_ALL_HOSTS_SCAN_KEY : Object.keys(retainedScans)[0]
     // Why: unchanged hosts stay visible while the replacement RPC runs; removed
     // hosts and the old synthetic aggregate are excluded immediately.
     const nextProjection =
diff --git a/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx b/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx
index ea1d85f15b8..1121a05ae64 100644
--- a/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx
+++ b/src/renderer/src/components/right-sidebar/PortsPanel.test.tsx
@@ -451,25 +451,26 @@ describe('PortsPanel runtime routing', () => {
   })
 
   it('returns post-stop refresh failures without throwing', async () => {
-    const setWorkspacePortScan = vi.fn()
+    const replaceWorkspacePortScans = vi.fn()
     const setWorkspacePortScanRefreshing = vi.fn()
     localScan.mockRejectedValueOnce(new Error('scan failed'))
 
     await expect(
       refreshWorkspacePortScanAfterStop({
         runtimeTarget: { kind: 'local' },
-        setWorkspacePortScan: setWorkspacePortScan as never,
+        replaceWorkspacePortScans: replaceWorkspacePortScans as never,
+        getWorkspacePortScansByKey: () => ({}),
         setWorkspacePortScanRefreshing: setWorkspacePortScanRefreshing as never
       })
     ).resolves.toEqual({ ok: false, reason: 'scan failed' })
 
-    expect(setWorkspacePortScan).not.toHaveBeenCalled()
+    expect(replaceWorkspacePortScans).not.toHaveBeenCalled()
     expect(setWorkspacePortScanRefreshing).toHaveBeenNthCalledWith(1, true)
     expect(setWorkspacePortScanRefreshing).toHaveBeenNthCalledWith(2, false)
   })
 
   it('ignores settled remote post-stop refresh failures after updating state', async () => {
-    const setWorkspacePortScan = vi.fn()
+    const replaceWorkspacePortScans = vi.fn()
     const setWorkspacePortScanRefreshing = vi.fn()
     const firstScan = { ...emptyScan, scannedAt: 2 }
     let scanCalls = 0
@@ -500,7 +501,8 @@ describe('PortsPanel runtime routing', () => {
     await expect(
       refreshWorkspacePortScanAfterStop({
         runtimeTarget: { kind: 'environment', environmentId: 'env-1' },
-        setWorkspacePortScan: setWorkspacePortScan as never,
+        replaceWorkspacePortScans: replaceWorkspacePortScans as never,
+        getWorkspacePortScansByKey: () => ({}),
         setWorkspacePortScanRefreshing: setWorkspacePortScanRefreshing as never
       })
     ).resolves.toEqual({ ok: true })
@@ -510,18 +512,20 @@ describe('PortsPanel runtime routing', () => {
       'workspacePorts.scan',
       'workspacePorts.scan'
     ])
-    expect(setWorkspacePortScan).toHaveBeenCalledTimes(1)
-    expect(setWorkspacePortScan).toHaveBeenCalledWith({
-      key: 'environment:env-1:all',
-      result: firstScan
-    })
+    expect(replaceWorkspacePortScans).toHaveBeenCalledTimes(1)
+    expect(replaceWorkspacePortScans).toHaveBeenCalledWith(
+      { 'environment:env-1:all': firstScan },
+      {
+        key: 'environment:env-1:all',
+        result: firstScan
+      }
+    )
     expect(setWorkspacePortScanRefreshing).toHaveBeenNthCalledWith(1, true)
     expect(setWorkspacePortScanRefreshing).toHaveBeenNthCalledWith(2, false)
   })
 
   it('preserves an all-host projection after refreshing one host post-stop', async () => {
-    const setWorkspacePortScan = vi.fn()
-    const setWorkspacePortScanForKey = vi.fn()
+    const replaceWorkspacePortScans = vi.fn()
     const setWorkspacePortScanRefreshing = vi.fn()
     const localPort: WorkspacePort = { ...workspacePort, id: 'local-port', port: 5173 }
     const refreshedRemotePort: WorkspacePort = {
@@ -571,23 +575,24 @@ describe('PortsPanel runtime routing', () => {
     await expect(
       refreshWorkspacePortScanAfterStop({
         runtimeTarget: { kind: 'environment', environmentId: 'env-1' },
-        setWorkspacePortScan: setWorkspacePortScan as never,
-        setWorkspacePortScanForKey: setWorkspacePortScanForKey as never,
+        replaceWorkspacePortScans: replaceWorkspacePortScans as never,
         getWorkspacePortScansByKey: () => ({ 'local:all': localHostScan }),
         setWorkspacePortScanRefreshing: setWorkspacePortScanRefreshing as never
       })
     ).resolves.toEqual({ ok: true })
 
-    expect(setWorkspacePortScanForKey).toHaveBeenCalledWith('environment:env-1:all', remoteHostScan)
-    expect(setWorkspacePortScan).toHaveBeenLastCalledWith({
-      key: 'all-hosts:all',
-      result: expect.objectContaining({
-        ports: expect.arrayContaining([
-          expect.objectContaining({ port: 5173 }),
-          expect.objectContaining({ port: 3000 })
-        ])
-      })
-    })
+    expect(replaceWorkspacePortScans).toHaveBeenLastCalledWith(
+      { 'local:all': localHostScan, 'environment:env-1:all': remoteHostScan },
+      {
+        key: 'all-hosts:all',
+        result: expect.objectContaining({
+          ports: expect.arrayContaining([
+            expect.objectContaining({ port: 5173 }),
+            expect.objectContaining({ port: 3000 })
+          ])
+        })
+      }
+    )
     expect(scanCalls).toBe(2)
   })
 
diff --git a/src/renderer/src/components/right-sidebar/local-workspace-port-sections.test.ts b/src/renderer/src/components/right-sidebar/local-workspace-port-sections.test.ts
new file mode 100644
index 00000000000..68733927ee7
--- /dev/null
+++ b/src/renderer/src/components/right-sidebar/local-workspace-port-sections.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest'
+import { shouldShowLocalWorkspacePortSections } from './local-workspace-port-sections'
+
+const empty = { activePorts: [], otherWorkspacePorts: [], externalPorts: [] }
+
+describe('shouldShowLocalWorkspacePortSections', () => {
+  it('shows the sections whenever the scan succeeded', () => {
+    expect(shouldShowLocalWorkspacePortSections(null, empty)).toBe(true)
+    expect(shouldShowLocalWorkspacePortSections({}, empty)).toBe(true)
+  })
+
+  // Why: a failed scan keeps the host's last-good ports, and the status bar
+  // still counts and lists them — hiding the sections here would strip the
+  // stop and open actions for ports the user can still see elsewhere.
+  it.each([
+    ['activePorts', { ...empty, activePorts: [{}] }],
+    ['otherWorkspacePorts', { ...empty, otherWorkspacePorts: [{}] }],
+    ['externalPorts', { ...empty, externalPorts: [{}] }]
+  ])('keeps the sections when a failed scan retained %s', (_section, sections) => {
+    expect(shouldShowLocalWorkspacePortSections({ unavailableReason: 'dropped' }, sections)).toBe(
+      true
+    )
+  })
+
+  it('lets the notice stand alone when a failed scan has nothing left to list', () => {
+    expect(shouldShowLocalWorkspacePortSections({ unavailableReason: 'dropped' }, empty)).toBe(
+      false
+    )
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/local-workspace-port-sections.ts b/src/renderer/src/components/right-sidebar/local-workspace-port-sections.ts
index d968bb85144..2a0eadf380a 100644
--- a/src/renderer/src/components/right-sidebar/local-workspace-port-sections.ts
+++ b/src/renderer/src/components/right-sidebar/local-workspace-port-sections.ts
@@ -35,6 +35,26 @@ export function getLocalWorkspacePortSections(
   }
 }
 
+/**
+ * Whether the panel still renders its port sections under a failure notice.
+ * Why: a failed scan retains the host's last-good ports, so hiding every
+ * section would drop the stop and open actions for ports the status bar still
+ * counts and lists.
+ */
+export function shouldShowLocalWorkspacePortSections(
+  scan: { unavailableReason?: string } | null | undefined,
+  sections: { activePorts: unknown[]; otherWorkspacePorts: unknown[]; externalPorts: unknown[] }
+): boolean {
+  if (!scan?.unavailableReason) {
+    return true
+  }
+  return (
+    sections.activePorts.length > 0 ||
+    sections.otherWorkspacePorts.length > 0 ||
+    sections.externalPorts.length > 0
+  )
+}
+
 function workspacePortAsExternal(port: WorkspacePort & { kind: 'workspace' }): WorkspacePort {
   return {
     id: port.id,
diff --git a/src/renderer/src/components/right-sidebar/local-workspace-ports-panel.tsx b/src/renderer/src/components/right-sidebar/local-workspace-ports-panel.tsx
index 0955e89031b..1737e7da487 100644
--- a/src/renderer/src/components/right-sidebar/local-workspace-ports-panel.tsx
+++ b/src/renderer/src/components/right-sidebar/local-workspace-ports-panel.tsx
@@ -4,11 +4,11 @@ import { toast } from 'sonner'
 import { useAppStore } from '@/store'
 import { useActiveWorktree, useRepoById } from '@/store/selectors'
 import { cn } from '@/lib/utils'
-import { getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
-import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { useWorktreeRuntimeTarget } from '@/runtime/use-worktree-runtime-target'
 import {
   killWorkspacePortForTarget,
   openWorkspacePortInBrowser,
+  publishWorkspacePortScanForHost,
   refreshWorkspacePortScanAfterStop,
   resolvePortOpenInOrcaBrowser,
   scanWorkspacePortsForTarget,
@@ -19,10 +19,14 @@ import { Button } from '@/components/ui/button'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import type { WorkspacePort } from '../../../../shared/workspace-ports'
 import { translate } from '@/i18n/i18n'
-import { getLocalWorkspacePortSections } from './local-workspace-port-sections'
+import {
+  getLocalWorkspacePortSections,
+  shouldShowLocalWorkspacePortSections
+} from './local-workspace-port-sections'
 import { LocalPortSection } from './local-port-section'
 import { LocalPortDetailsDialog } from './local-port-details-dialog'
 
+/** Right-sidebar Ports panel scoped to the active workspace's owner host. */
 export function LocalWorkspacePortsPanel({ isVisible }: { isVisible: boolean }): React.JSX.Element {
   const activeWorktree = useActiveWorktree()
   const activeRepo = useRepoById(activeWorktree?.repoId ?? null)
@@ -31,8 +35,7 @@ export function LocalWorkspacePortsPanel({ isVisible }: { isVisible: boolean }):
   const setRemoteBrowserPageHandle = useAppStore((s) => s.setRemoteBrowserPageHandle)
   const scansByKey = useAppStore((s) => s.workspacePortScansByKey)
   const refreshing = useAppStore((s) => s.workspacePortScanRefreshing)
-  const setWorkspacePortScan = useAppStore((s) => s.setWorkspacePortScan)
-  const setWorkspacePortScanForKey = useAppStore((s) => s.setWorkspacePortScanForKey)
+  const replaceWorkspacePortScans = useAppStore((s) => s.replaceWorkspacePortScans)
   const setWorkspacePortScanRefreshing = useAppStore((s) => s.setWorkspacePortScanRefreshing)
   const [detailsPort, setDetailsPort] = useState<WorkspacePort | null>(null)
   const [collapsedSections, setCollapsedSections] = useState<Record<string, boolean>>({
@@ -40,26 +43,24 @@ export function LocalWorkspacePortsPanel({ isVisible }: { isVisible: boolean }):
     external: true
   })
 
-  const runtimeTarget = useMemo(() => {
-    const activeRuntimeEnvironmentId = getRuntimeEnvironmentIdForWorktree(
-      useAppStore.getState(),
-      activeWorktree?.id
-    )
-    // Why: the Ports panel acts on the active workspace; use that workspace's
-    // host owner even if the sidebar is focused elsewhere.
-    return getActiveRuntimeTarget({ ...settings, activeRuntimeEnvironmentId })
-  }, [activeWorktree?.id, settings])
-  const scanKey = `${workspacePortRuntimeTargetKey(runtimeTarget)}:all`
+  // Why: the Ports panel acts on the active workspace; use that workspace's
+  // host owner even if the sidebar is focused elsewhere.
+  const runtimeTarget = useWorktreeRuntimeTarget(activeWorktree?.id)
+  const scanKey = runtimeTarget ? `${workspacePortRuntimeTargetKey(runtimeTarget)}:all` : null
 
   const refresh = useCallback(() => {
-    if (!activeRepo) {
+    if (!activeRepo || !runtimeTarget || !scanKey) {
       return Promise.resolve()
     }
     setWorkspacePortScanRefreshing(true)
     const promise = scanWorkspacePortsForTarget(runtimeTarget)
       .then((nextScan) => {
-        setWorkspacePortScanForKey(scanKey, nextScan)
-        setWorkspacePortScan({ key: scanKey, result: nextScan })
+        publishWorkspacePortScanForHost({
+          scanKey,
+          scan: nextScan,
+          replaceWorkspacePortScans,
+          getWorkspacePortScansByKey: () => useAppStore.getState().workspacePortScansByKey
+        })
       })
       .catch((error) => {
         const message = error instanceof Error ? error.message : String(error)
@@ -86,14 +87,13 @@ export function LocalWorkspacePortsPanel({ isVisible }: { isVisible: boolean }):
     activeRepo,
     runtimeTarget,
     scanKey,
-    setWorkspacePortScan,
-    setWorkspacePortScanForKey,
+    replaceWorkspacePortScans,
     setWorkspacePortScanRefreshing
   ])
 
   // Why: WorkspacePortScanner already owns the 30s all-worktree poll. The
   // panel scopes that shared result instead of starting a second scan loop.
-  const displayScan = isVisible ? (scansByKey[scanKey] ?? null) : null
+  const displayScan = isVisible && scanKey ? (scansByKey[scanKey] ?? null) : null
 
   const toggleSection = useCallback((sectionId: string) => {
     setCollapsedSections((current) => ({ ...current, [sectionId]: !current[sectionId] }))
@@ -122,8 +122,7 @@ export function LocalWorkspacePortsPanel({ isVisible }: { isVisible: boolean }):
       )
       const refreshResult = await refreshWorkspacePortScanAfterStop({
         runtimeTarget,
-        setWorkspacePortScan,
-        setWorkspacePortScanForKey,
+        replaceWorkspacePortScans,
         getWorkspacePortScansByKey: () => useAppStore.getState().workspacePortScansByKey,
         setWorkspacePortScanRefreshing
       })
@@ -139,13 +138,7 @@ export function LocalWorkspacePortsPanel({ isVisible }: { isVisible: boolean }):
         )
       }
     },
-    [
-      activeRepo,
-      runtimeTarget,
-      setWorkspacePortScan,
-      setWorkspacePortScanForKey,
-      setWorkspacePortScanRefreshing
-    ]
+    [activeRepo, runtimeTarget, replaceWorkspacePortScans, setWorkspacePortScanRefreshing]
   )
 
   const handleOpenPortInBrowser = useCallback(
@@ -181,6 +174,12 @@ export function LocalWorkspacePortsPanel({ isVisible }: { isVisible: boolean }):
     [activeRepo?.id, activeWorktree?.id, displayScan]
   )
 
+  const showPortSections = shouldShowLocalWorkspacePortSections(displayScan, {
+    activePorts,
+    otherWorkspacePorts,
+    externalPorts
+  })
+
   if (!activeRepo) {
     return (
       <div className="flex flex-col items-center justify-center h-full px-4 text-center text-muted-foreground">
@@ -209,7 +208,7 @@ export function LocalWorkspacePortsPanel({ isVisible }: { isVisible: boolean }):
               size="icon-xs"
               className="text-muted-foreground hover:text-foreground"
               onClick={() => void refresh()}
-              disabled={refreshing}
+              disabled={refreshing || !runtimeTarget}
               aria-label={translate(
                 'auto.components.right.sidebar.PortsPanel.7822e3edc6',
                 'Refresh Ports'
@@ -237,7 +236,7 @@ export function LocalWorkspacePortsPanel({ isVisible }: { isVisible: boolean }):
         </div>
       )}
 
-      {!displayScan?.unavailableReason && (
+      {showPortSections && (
         <>
           <LocalPortSection
             id="active"
diff --git a/src/renderer/src/components/sidebar/WorktreeCard.compact-hover.test.tsx b/src/renderer/src/components/sidebar/WorktreeCard.compact-hover.test.tsx
index 6c63e1aec6e..2d6678fb11c 100644
--- a/src/renderer/src/components/sidebar/WorktreeCard.compact-hover.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCard.compact-hover.test.tsx
@@ -16,7 +16,7 @@ const openModal = vi.fn()
 const openTaskPage = vi.fn()
 const updateWorktreeMeta = vi.fn()
 const recordFeatureInteraction = vi.fn()
-const setWorkspacePortScan = vi.fn()
+const replaceWorkspacePortScans = vi.fn()
 const setWorkspacePortScanRefreshing = vi.fn()
 const cacheTimerMocks = vi.hoisted(() => ({
   usePromptCacheCountdownStartedAt: vi.fn()
@@ -52,7 +52,7 @@ vi.mock('@/store', () => ({
       recordFeatureInteraction,
       remoteBranchConflictByWorktreeId: {},
       setRemoteBrowserPageHandle: vi.fn(),
-      setWorkspacePortScan,
+      replaceWorkspacePortScans,
       setWorkspacePortScanRefreshing,
       settings,
       sshConnectionStates: new Map(),
diff --git a/src/renderer/src/components/sidebar/WorktreeCard.compact-ports-hover-independence.test.tsx b/src/renderer/src/components/sidebar/WorktreeCard.compact-ports-hover-independence.test.tsx
index e8376a64f08..2c1f10945d3 100644
--- a/src/renderer/src/components/sidebar/WorktreeCard.compact-ports-hover-independence.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCard.compact-ports-hover-independence.test.tsx
@@ -13,7 +13,7 @@ import type { WorkspacePortScanResult } from '../../../../shared/workspace-ports
 const fetchHostedReviewForBranch = vi.fn()
 const fetchIssue = vi.fn()
 const fetchLinearIssue = vi.fn()
-const setWorkspacePortScan = vi.fn()
+const replaceWorkspacePortScans = vi.fn()
 const setWorkspacePortScanRefreshing = vi.fn()
 const cacheTimerMocks = vi.hoisted(() => ({
   usePromptCacheCountdownStartedAt: vi.fn()
@@ -43,7 +43,7 @@ vi.mock('@/store', () => ({
       recordFeatureInteraction: vi.fn(),
       remoteBranchConflictByWorktreeId: {},
       setRemoteBrowserPageHandle: vi.fn(),
-      setWorkspacePortScan,
+      replaceWorkspacePortScans,
       setWorkspacePortScanRefreshing,
       settings,
       sshConnectionStates: new Map(),
diff --git a/src/renderer/src/components/sidebar/WorktreeCardPorts.test.tsx b/src/renderer/src/components/sidebar/WorktreeCardPorts.test.tsx
index 0a8bb4d248e..db23d18dbc2 100644
--- a/src/renderer/src/components/sidebar/WorktreeCardPorts.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCardPorts.test.tsx
@@ -8,7 +8,7 @@ vi.mock('@/store', () => ({
     selector({
       createBrowserTab: vi.fn(),
       setRemoteBrowserPageHandle: vi.fn(),
-      setWorkspacePortScan: vi.fn(),
+      replaceWorkspacePortScans: vi.fn(),
       setWorkspacePortScanRefreshing: vi.fn(),
       settings: null
     })
diff --git a/src/renderer/src/components/sidebar/WorktreeCardPorts.tsx b/src/renderer/src/components/sidebar/WorktreeCardPorts.tsx
index 7f7c411dfa2..cc4f567e50a 100644
--- a/src/renderer/src/components/sidebar/WorktreeCardPorts.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCardPorts.tsx
@@ -1,11 +1,10 @@
-import React, { useCallback, useMemo } from 'react'
+import React, { useCallback } from 'react'
 import { Plug, Copy, ExternalLink, Trash2 } from 'lucide-react'
 import { toast } from 'sonner'
 import { useAppStore } from '@/store'
 import { Button } from '@/components/ui/button'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
-import { getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
-import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { useWorktreeRuntimeTarget } from '@/runtime/use-worktree-runtime-target'
 import {
   canStopWorkspacePort,
   getPortOpenBrowserTooltipLabel,
@@ -97,21 +96,18 @@ function PortAction({
   )
 }
 
+/** One port row on a sidebar worktree card, with open/copy/stop actions on its owner host. */
 function WorktreePortRow({ port }: { port: WorkspacePort }): React.JSX.Element {
   const settings = useAppStore((s) => s.settings)
   const localhostLabelRoute = useLocalhostLabelRouteForPort(port)
-  const runtimeEnvironmentId = useAppStore((s) =>
-    getRuntimeEnvironmentIdForWorktree(s, port.kind === 'workspace' ? port.owner.worktreeId : null)
-  )
+
   const createBrowserTab = useAppStore((s) => s.createBrowserTab)
   const setRemoteBrowserPageHandle = useAppStore((s) => s.setRemoteBrowserPageHandle)
-  const setWorkspacePortScan = useAppStore((s) => s.setWorkspacePortScan)
-  const setWorkspacePortScanForKey = useAppStore((s) => s.setWorkspacePortScanForKey)
+  const replaceWorkspacePortScans = useAppStore((s) => s.replaceWorkspacePortScans)
   const setWorkspacePortScanRefreshing = useAppStore((s) => s.setWorkspacePortScanRefreshing)
   const recordFeatureInteraction = useAppStore((s) => s.recordFeatureInteraction)
-  const runtimeTarget = useMemo(
-    () => getActiveRuntimeTarget({ ...settings, activeRuntimeEnvironmentId: runtimeEnvironmentId }),
-    [runtimeEnvironmentId, settings]
+  const runtimeTarget = useWorktreeRuntimeTarget(
+    port.kind === 'workspace' ? port.owner.worktreeId : null
   )
   const processLabel = port.processName ?? (port.pid ? `PID ${port.pid}` : 'Unknown process')
   const address = addressForPort(port)
@@ -203,8 +199,7 @@ function WorktreePortRow({ port }: { port: WorkspacePort }): React.JSX.Element {
         )
         const refreshResult = await refreshWorkspacePortScanAfterStop({
           runtimeTarget,
-          setWorkspacePortScan,
-          setWorkspacePortScanForKey,
+          replaceWorkspacePortScans,
           getWorkspacePortScansByKey: () => useAppStore.getState().workspacePortScansByKey,
           setWorkspacePortScanRefreshing
         })
@@ -226,8 +221,7 @@ function WorktreePortRow({ port }: { port: WorkspacePort }): React.JSX.Element {
       port,
       recordFeatureInteraction,
       runtimeTarget,
-      setWorkspacePortScan,
-      setWorkspacePortScanForKey,
+      replaceWorkspacePortScans,
       setWorkspacePortScanRefreshing
     ]
   )
diff --git a/src/renderer/src/components/status-bar/PortsStatusSegment.host-routing.test.tsx b/src/renderer/src/components/status-bar/PortsStatusSegment.host-routing.test.tsx
new file mode 100644
index 00000000000..9b22826d6bd
--- /dev/null
+++ b/src/renderer/src/components/status-bar/PortsStatusSegment.host-routing.test.tsx
@@ -0,0 +1,407 @@
+// @vitest-environment happy-dom
+
+import React, { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { WorkspacePort, WorkspacePortScanResult } from '../../../../shared/workspace-ports'
+
+const { popoverHandle, runWorkspacePortScanForTargetMock, storeState } = vi.hoisted(() => {
+  const storeState = {
+    settings: { activeRuntimeEnvironmentId: null as string | null },
+    activeWorktreeId: 'runtime-repo::/srv/app',
+    workspacePortScan: null as { key: string; result: WorkspacePortScanResult } | null,
+    workspacePortScansByKey: {} as Record<string, WorkspacePortScanResult>,
+    workspacePortScanRefreshing: false,
+    runtimeEnvironments: [] as { id: string; name: string }[],
+    recordFeatureInteraction: vi.fn(),
+    replaceWorkspacePortScans:
+      vi.fn<
+        (
+          scansByKey: Record<string, WorkspacePortScanResult>,
+          projection: { key: string; result: WorkspacePortScanResult } | null
+        ) => void
+      >()
+  }
+  // Why: the real store writes back. A bare spy lets a publish and the notice
+  // that reads it drift onto different scan keys with every assertion green.
+  storeState.replaceWorkspacePortScans.mockImplementation((scansByKey, projection) => {
+    storeState.workspacePortScansByKey = scansByKey
+    storeState.workspacePortScan = projection
+  })
+  return {
+    popoverHandle: { onOpenChange: null as ((open: boolean) => void) | null },
+    runWorkspacePortScanForTargetMock: vi.fn(),
+    storeState
+  }
+})
+
+vi.mock('@/store', () => {
+  const useAppStore = Object.assign(
+    (selector: (state: typeof storeState) => unknown) => selector(storeState),
+    { getState: () => storeState }
+  )
+  return { useAppStore }
+})
+
+vi.mock('@/lib/worktree-runtime-owner', () => ({
+  getExecutionHostIdForWorktree: (_state: unknown, worktreeId: string | null | undefined) => {
+    if (worktreeId === 'runtime-repo::/srv/app') {
+      return 'runtime:env-1'
+    }
+    if (worktreeId === 'ssh-repo::/srv/app') {
+      return 'ssh:server-1'
+    }
+    return 'local'
+  }
+}))
+
+vi.mock('@/runtime/runtime-rpc-client', async () => {
+  const actual = await import('@/runtime/runtime-client-target')
+  return {
+    getActiveRuntimeTarget: actual.getActiveRuntimeTarget,
+    callRuntimeRpc: vi.fn(),
+    assertRuntimeEnvironmentCapability: vi.fn(),
+    RuntimeRpcCallError: class RuntimeRpcCallError extends Error {
+      code?: string
+    }
+  }
+})
+
+vi.mock('@/lib/workspace-port-scan-client', () => ({
+  runWorkspacePortScanForTarget: runWorkspacePortScanForTargetMock
+}))
+
+vi.mock('@/lib/worktree-activation', () => ({
+  activateAndRevealWorktree: vi.fn()
+}))
+
+vi.mock('@/components/ui/popover', () => ({
+  Popover: ({
+    children,
+    onOpenChange
+  }: {
+    children: React.ReactNode
+    onOpenChange: (open: boolean) => void
+  }) => {
+    popoverHandle.onOpenChange = onOpenChange
+    return <>{children}</>
+  },
+  PopoverContent: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  PopoverTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('@/components/ui/tooltip', () => ({
+  Tooltip: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipContent: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('@/components/SelectedTextCopyMenu', () => ({
+  SelectedTextCopyMenu: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('./ports-status-popover-rows', () => ({
+  PortRow: () => <div data-testid="port-row" />,
+  WorkspaceGroupRows: () => <div data-testid="workspace-group-rows" />
+}))
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string, options?: Record<string, unknown>) =>
+    options
+      ? fallback.replace(/{{(\w+)}}/g, (_match, name: string) => String(options[name] ?? ''))
+      : fallback
+}))
+
+import { PortsStatusSegment } from './PortsStatusSegment'
+
+function workspacePort(overrides: Partial<WorkspacePort> & { port: number; id: string }) {
+  return {
+    bindHost: '0.0.0.0',
+    connectHost: '127.0.0.1',
+    port: overrides.port,
+    id: overrides.id,
+    pid: 4321,
+    processName: 'node',
+    protocol: 'http' as const,
+    kind: 'workspace' as const,
+    owner: {
+      worktreeId: 'runtime-repo::/srv/app',
+      repoId: 'runtime-repo',
+      displayName: 'runtime app',
+      path: '/srv/app',
+      confidence: 'cwd' as const
+    }
+  }
+}
+
+const localHostScan: WorkspacePortScanResult = {
+  platform: 'linux',
+  scannedAt: 10,
+  ports: [workspacePort({ id: 'local-5173', port: 5173 })]
+}
+
+const remoteHostScan: WorkspacePortScanResult = {
+  platform: 'linux',
+  scannedAt: 20,
+  ports: [workspacePort({ id: 'remote-3000', port: 3000 })]
+}
+
+describe('PortsStatusSegment popover host routing', () => {
+  let container: HTMLDivElement
+  let root: Root
+
+  beforeEach(() => {
+    popoverHandle.onOpenChange = null
+    storeState.settings = { activeRuntimeEnvironmentId: null }
+    storeState.activeWorktreeId = 'runtime-repo::/srv/app'
+    storeState.workspacePortScan = null
+    storeState.workspacePortScansByKey = { 'local:all': localHostScan }
+    storeState.runtimeEnvironments = [{ id: 'env-1', name: 'linux-box' }]
+    storeState.recordFeatureInteraction.mockClear()
+    storeState.replaceWorkspacePortScans.mockClear()
+    runWorkspacePortScanForTargetMock.mockReset()
+    runWorkspacePortScanForTargetMock.mockResolvedValue(remoteHostScan)
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+    act(() => {
+      root.render(<PortsStatusSegment iconOnly={false} />)
+    })
+  })
+
+  afterEach(() => {
+    act(() => {
+      root.unmount()
+    })
+    container.remove()
+  })
+
+  async function openPopover(): Promise<void> {
+    await act(async () => {
+      popoverHandle.onOpenChange?.(true)
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+  }
+
+  it("scans the active workspace's host, not the globally focused runtime", async () => {
+    await openPopover()
+
+    expect(runWorkspacePortScanForTargetMock).toHaveBeenCalledWith(
+      { kind: 'environment', environmentId: 'env-1' },
+      undefined
+    )
+    expect(storeState.replaceWorkspacePortScans).toHaveBeenCalledTimes(1)
+    expect(storeState.workspacePortScansByKey['environment:env-1:all']).toBe(remoteHostScan)
+  })
+
+  it('keeps other hosts in the projection instead of overwriting it with one host', async () => {
+    await openPopover()
+
+    const [, projection] = storeState.replaceWorkspacePortScans.mock.calls.at(-1) as [
+      Record<string, WorkspacePortScanResult>,
+      { key: string; result: WorkspacePortScanResult }
+    ]
+    expect(projection).toEqual({
+      key: 'all-hosts:all',
+      result: expect.objectContaining({
+        ports: expect.arrayContaining([
+          expect.objectContaining({ port: 5173 }),
+          expect.objectContaining({ port: 3000 })
+        ])
+      })
+    })
+  })
+
+  it('publishes a failed scan under its own host without dropping other hosts', async () => {
+    runWorkspacePortScanForTargetMock.mockRejectedValueOnce(new Error('remote scan failed'))
+
+    await openPopover()
+
+    const [, projection] = storeState.replaceWorkspacePortScans.mock.calls.at(-1) as [
+      Record<string, WorkspacePortScanResult>,
+      { key: string; result: WorkspacePortScanResult }
+    ]
+    expect(projection.key).toBe('all-hosts:all')
+    expect(projection.result.ports).toEqual([expect.objectContaining({ port: 5173 })])
+    expect(storeState.workspacePortScansByKey['environment:env-1:all']).toEqual(
+      expect.objectContaining({ unavailableReason: 'remote scan failed' })
+    )
+  })
+
+  it('keeps the failed host last-good ports while naming the failure', async () => {
+    storeState.workspacePortScansByKey = {
+      'local:all': localHostScan,
+      'environment:env-1:all': remoteHostScan
+    }
+    runWorkspacePortScanForTargetMock.mockRejectedValueOnce(new Error('remote scan failed'))
+
+    await openPopover()
+
+    // Why: one dropped scan must not clear the host's ports the way the
+    // background poll's debounce does not — the notice names the failure
+    // while the projection keeps serving the last-good rows.
+    const failed = storeState.workspacePortScansByKey['environment:env-1:all']
+    expect(failed.unavailableReason).toBe('remote scan failed')
+    expect(failed.platform).toBe('linux')
+    expect(failed.ports).toEqual([expect.objectContaining({ port: 3000 })])
+    const [, projection] = storeState.replaceWorkspacePortScans.mock.calls.at(-1) as [
+      Record<string, WorkspacePortScanResult>,
+      { key: string; result: WorkspacePortScanResult }
+    ]
+    expect(projection.key).toBe('all-hosts:all')
+    expect(projection.result.ports.map((port) => port.port).sort()).toEqual([3000, 5173])
+  })
+
+  // Why: separate tests already cover "the failure is stored" and "a stored
+  // failure renders". Only this one proves both halves name the same scan key.
+  it('surfaces the host it just failed to scan on the next render', async () => {
+    runWorkspacePortScanForTargetMock.mockRejectedValueOnce(new Error('remote scan failed'))
+
+    await openPopover()
+    act(() => {
+      root.render(<PortsStatusSegment iconOnly={false} />)
+    })
+
+    expect(container.textContent).toContain(
+      'Port scan unavailable on linux-box: remote scan failed'
+    )
+  })
+
+  it('names the host whose scan failed while another host still reports ports', () => {
+    act(() => {
+      root.unmount()
+    })
+    storeState.workspacePortScansByKey = {
+      'local:all': localHostScan,
+      'environment:env-1:all': {
+        platform: 'linux',
+        scannedAt: 30,
+        ports: [],
+        unavailableReason: 'Remote connection dropped'
+      }
+    }
+    storeState.workspacePortScan = { key: 'all-hosts:all', result: localHostScan }
+    root = createRoot(container)
+    act(() => {
+      root.render(<PortsStatusSegment iconOnly={false} />)
+    })
+
+    expect(container.textContent).toContain(
+      'Port scan unavailable on linux-box: Remote connection dropped'
+    )
+    // The notice sits above the list rather than replacing it: a reachable
+    // host's count still renders.
+    expect(container.textContent).toContain('1 workspace')
+  })
+
+  // Why: a failed scan keeps the host's last-good ports, and the badge and
+  // header count them. Replacing the list with the notice left the popover
+  // claiming N ports over an empty body.
+  it('keeps the list under the notice when a failed scan retained its ports', () => {
+    act(() => {
+      root.unmount()
+    })
+    storeState.activeWorktreeId = 'local-repo::/home/dev/app'
+    const retained: WorkspacePortScanResult = {
+      ...localHostScan,
+      unavailableReason: 'lsof is unavailable'
+    }
+    storeState.workspacePortScansByKey = { 'local:all': retained }
+    storeState.workspacePortScan = { key: 'local:all', result: retained }
+    root = createRoot(container)
+    act(() => {
+      root.render(<PortsStatusSegment iconOnly={false} />)
+    })
+
+    expect(container.textContent).toContain('1 workspace · 0 external')
+    expect(container.querySelectorAll('[data-testid="workspace-group-rows"]')).toHaveLength(1)
+    expect(container.textContent).toContain('Port scan unavailable on Local Linux')
+  })
+
+  // Why: total loss of contact is where naming the host matters most, and the
+  // merged projection can only offer platform 'unknown' and raw scan keys.
+  it('names every host when all of them failed with nothing left to list', () => {
+    act(() => {
+      root.unmount()
+    })
+    const merged: WorkspacePortScanResult = {
+      platform: 'unknown',
+      scannedAt: 30,
+      ports: [],
+      unavailableReason: 'local:all: lsof is unavailable; environment:env-1:all: dropped'
+    }
+    storeState.workspacePortScansByKey = {
+      'local:all': {
+        platform: 'darwin',
+        scannedAt: 30,
+        ports: [],
+        unavailableReason: 'lsof is unavailable'
+      },
+      'environment:env-1:all': {
+        platform: 'linux',
+        scannedAt: 30,
+        ports: [],
+        unavailableReason: 'dropped'
+      }
+    }
+    storeState.workspacePortScan = { key: 'all-hosts:all', result: merged }
+    root = createRoot(container)
+    act(() => {
+      root.render(<PortsStatusSegment iconOnly={false} />)
+    })
+
+    // Local label comes from the scan's own platform, not the renderer's
+    // userAgent — a paired web client is not the Orca host.
+    expect(container.textContent).toContain(
+      'Port scan unavailable on Local Mac: lsof is unavailable'
+    )
+    expect(container.textContent).toContain('Port scan unavailable on linux-box: dropped')
+    expect(container.textContent).not.toContain('unavailable on unknown')
+    expect(container.textContent).not.toContain('environment:env-1:all:')
+    // The notice takes over the body only when there is nothing left to list.
+    expect(container.querySelectorAll('[data-testid="workspace-group-rows"]')).toHaveLength(0)
+    expect(container.textContent).not.toContain('No workspace ports detected')
+  })
+
+  it('stays on the local host when the active workspace has no runtime owner', async () => {
+    act(() => {
+      root.unmount()
+    })
+    storeState.activeWorktreeId = 'local-repo::/home/dev/app'
+    root = createRoot(container)
+    act(() => {
+      root.render(<PortsStatusSegment iconOnly={false} />)
+    })
+
+    await openPopover()
+
+    expect(runWorkspacePortScanForTargetMock).toHaveBeenCalledWith({ kind: 'local' }, undefined)
+    const [nextScans, projection] = storeState.replaceWorkspacePortScans.mock.calls.at(-1) as [
+      Record<string, WorkspacePortScanResult>,
+      { key: string; result: WorkspacePortScanResult }
+    ]
+    expect(nextScans['local:all']).toBe(remoteHostScan)
+    expect(projection).toEqual({
+      key: 'local:all',
+      result: remoteHostScan
+    })
+  })
+
+  it('does not substitute the local host for a direct-SSH workspace', async () => {
+    act(() => {
+      root.unmount()
+    })
+    storeState.activeWorktreeId = 'ssh-repo::/srv/app'
+    root = createRoot(container)
+    act(() => {
+      root.render(<PortsStatusSegment iconOnly={false} />)
+    })
+
+    await openPopover()
+
+    expect(runWorkspacePortScanForTargetMock).not.toHaveBeenCalled()
+    expect(storeState.replaceWorkspacePortScans).not.toHaveBeenCalled()
+    expect(storeState.recordFeatureInteraction).toHaveBeenCalledWith('ports')
+  })
+})
diff --git a/src/renderer/src/components/status-bar/PortsStatusSegment.tsx b/src/renderer/src/components/status-bar/PortsStatusSegment.tsx
index 0626137c010..b56f5432cc8 100644
--- a/src/renderer/src/components/status-bar/PortsStatusSegment.tsx
+++ b/src/renderer/src/components/status-bar/PortsStatusSegment.tsx
@@ -3,39 +3,83 @@ import { Plug, ChevronDown, ChevronRight, LoaderCircle } from 'lucide-react'
 import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { useAppStore } from '@/store'
-import { getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
 import {
+  publishWorkspacePortScanForHost,
   scanWorkspacePortsForTarget,
   workspacePortScanKeyForTarget
 } from '@/lib/workspace-port-actions'
+import { useWorktreeRuntimeTarget } from '@/runtime/use-worktree-runtime-target'
+import {
+  getUnavailableWorkspacePortHosts,
+  type WorkspacePortHostRef
+} from '@/lib/workspace-port-host-availability'
+import { getLocalExecutionHostLabel } from '../../../../shared/execution-host'
 import { getExternalWorkspacePorts, getWorkspacePortGroups } from '@/lib/workspace-port-groups'
 import { SelectedTextCopyMenu } from '@/components/SelectedTextCopyMenu'
 import { STATUS_BAR_CONTEXT_MENU_EXEMPT_PROPS } from './status-bar-context-menu-policy'
 import { PortRow, WorkspaceGroupRows } from './ports-status-popover-rows'
 import { translate } from '@/i18n/i18n'
+import type { WorkspacePortScanResult } from '../../../../shared/workspace-ports'
 
 type PortsStatusSegmentProps = {
   compact?: boolean
   iconOnly: boolean
 }
 
+/** Status-bar plug icon with the workspace port count and a per-host ports popover. */
 export function PortsStatusSegment({ iconOnly }: PortsStatusSegmentProps): React.JSX.Element {
-  const settings = useAppStore((s) => s.settings)
   const scan = useAppStore((s) => s.workspacePortScan?.result ?? null)
   const refreshing = useAppStore((s) => s.workspacePortScanRefreshing)
   const activeWorktreeId = useAppStore((s) => s.activeWorktreeId)
-  const setWorkspacePortScan = useAppStore((s) => s.setWorkspacePortScan)
-  const setWorkspacePortScanForKey = useAppStore((s) => s.setWorkspacePortScanForKey)
+  const replaceWorkspacePortScans = useAppStore((s) => s.replaceWorkspacePortScans)
+  const scansByKey = useAppStore((s) => s.workspacePortScansByKey)
+  const runtimeEnvironments = useAppStore((s) => s.runtimeEnvironments)
   const recordFeatureInteraction = useAppStore((s) => s.recordFeatureInteraction)
   const [open, setOpen] = useState(false)
   const [externalOpen, setExternalOpen] = useState(false)
-  const runtimeTarget = useMemo(() => getActiveRuntimeTarget(settings), [settings])
-  const scanKey = workspacePortScanKeyForTarget(runtimeTarget)
+  const runtimeTarget = useWorktreeRuntimeTarget(activeWorktreeId)
+  const scanKey = runtimeTarget ? workspacePortScanKeyForTarget(runtimeTarget) : null
 
   const workspaceGroups = useMemo(() => getWorkspacePortGroups(scan), [scan])
   const externalPorts = useMemo(() => getExternalWorkspacePorts(scan), [scan])
+  const unavailableHosts = useMemo(() => getUnavailableWorkspacePortHosts(scansByKey), [scansByKey])
+  const hostLabel = useCallback(
+    (host: WorkspacePortHostRef, hostScanKey: string, platform: NodeJS.Platform | null) => {
+      if (host.kind === 'local') {
+        // Why: a paired web client's own userAgent is not the Orca host's
+        // platform, so name the machine the scan actually ran on.
+        return getLocalExecutionHostLabel(platform)
+      }
+      if (host.kind === 'unknown') {
+        return hostScanKey
+      }
+      return (
+        runtimeEnvironments.find((environment) => environment.id === host.environmentId)?.name ??
+        host.environmentId
+      )
+    },
+    [runtimeEnvironments]
+  )
   const workspacePortCount = workspaceGroups.reduce((count, group) => count + group.ports.length, 0)
   const totalCount = workspacePortCount + externalPorts.length
+  const unavailableNotices = useMemo<PortScanUnavailableNotice[]>(() => {
+    if (unavailableHosts.length > 0) {
+      return unavailableHosts.map((entry) => ({
+        id: entry.scanKey,
+        host: hostLabel(entry.host, entry.scanKey, entry.platform),
+        reason: entry.reason
+      }))
+    }
+    // Why: a projection published without per-host scans has no host to name.
+    return scan?.unavailableReason
+      ? [{ id: 'projection', host: scan.platform, reason: scan.unavailableReason }]
+      : []
+  }, [hostLabel, scan?.platform, scan?.unavailableReason, unavailableHosts])
+  // Why: a failed scan keeps the host's last-good ports, and those ports are
+  // counted in the badge and header — replacing the list with the notice would
+  // leave the popover claiming N ports over an empty body. Only take over the
+  // body when there is genuinely nothing left to list.
+  const noticeReplacesList = Boolean(scan?.unavailableReason) && totalCount === 0
   const handleOpenChange = useCallback(
     (nextOpen: boolean) => {
       setOpen(nextOpen)
@@ -43,33 +87,36 @@ export function PortsStatusSegment({ iconOnly }: PortsStatusSegmentProps): React
         return
       }
       recordFeatureInteraction('ports')
+      if (!runtimeTarget || !scanKey) {
+        return
+      }
       // Why: the 30s background poll is intentionally quiet; opening the
       // popover should still collapse that stale window without flashing icons.
-      void scanWorkspacePortsForTarget(runtimeTarget)
-        .then((result) => {
-          setWorkspacePortScanForKey(scanKey, result)
-          setWorkspacePortScan({ key: scanKey, result })
+      const publish = (result: WorkspacePortScanResult): void => {
+        publishWorkspacePortScanForHost({
+          scanKey,
+          scan: result,
+          replaceWorkspacePortScans,
+          getWorkspacePortScansByKey: () => useAppStore.getState().workspacePortScansByKey
         })
+      }
+      void scanWorkspacePortsForTarget(runtimeTarget)
+        .then(publish)
         .catch((error) => {
           const message = error instanceof Error ? error.message : String(error)
-          setWorkspacePortScan({
-            key: scanKey,
-            result: {
-              platform: 'unknown',
-              scannedAt: Date.now(),
-              ports: [],
-              unavailableReason: message || 'Workspace port scan failed.'
-            }
+          // Why: one dropped scan must not clear the host's last-good ports the
+          // way the background poll's debounce does not; the failure is still
+          // recorded so the host is named by the unavailable notice below.
+          const previous = useAppStore.getState().workspacePortScansByKey[scanKey]
+          publish({
+            platform: previous?.platform ?? 'unknown',
+            scannedAt: Date.now(),
+            ports: previous?.ports ?? [],
+            unavailableReason: message || 'Workspace port scan failed.'
           })
         })
     },
-    [
-      recordFeatureInteraction,
-      runtimeTarget,
-      scanKey,
-      setWorkspacePortScan,
-      setWorkspacePortScanForKey
-    ]
+    [recordFeatureInteraction, runtimeTarget, scanKey, replaceWorkspacePortScans]
   )
 
   return (
@@ -153,14 +200,18 @@ export function PortsStatusSegment({ iconOnly }: PortsStatusSegmentProps): React
             </span>
           </div>
 
-          {scan?.unavailableReason ? (
-            <div className="px-3 py-3 text-xs text-muted-foreground">
-              {translate(
-                'auto.components.status.bar.PortsStatusSegment.95495019ed',
-                'Port scan unavailable on {{value0}}: {{value1}}',
-                { value0: scan.platform, value1: scan.unavailableReason }
-              )}
-            </div>
+          {unavailableNotices.length > 0 && !noticeReplacesList && (
+            <PortScanUnavailableNotices
+              notices={unavailableNotices}
+              className="border-b border-border/40 px-3 py-1.5 text-[11px] text-muted-foreground"
+            />
+          )}
+
+          {noticeReplacesList ? (
+            <PortScanUnavailableNotices
+              notices={unavailableNotices}
+              className="px-3 py-3 text-xs text-muted-foreground"
+            />
           ) : (
             <div className="max-h-[28rem] overflow-y-auto scrollbar-sleek">
               {workspaceGroups.length > 0 ? (
@@ -237,3 +288,27 @@ export function PortsStatusSegment({ iconOnly }: PortsStatusSegmentProps): React
     </Popover>
   )
 }
+
+type PortScanUnavailableNotice = { id: string; host: string; reason: string }
+
+function PortScanUnavailableNotices({
+  notices,
+  className
+}: {
+  notices: PortScanUnavailableNotice[]
+  className: string
+}): React.JSX.Element {
+  return (
+    <div className={className}>
+      {notices.map((notice) => (
+        <div key={notice.id} className="truncate">
+          {translate(
+            'auto.components.status.bar.PortsStatusSegment.95495019ed',
+            'Port scan unavailable on {{value0}}: {{value1}}',
+            { value0: notice.host, value1: notice.reason }
+          )}
+        </div>
+      ))}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/status-bar/ports-status-popover-rows.test.tsx b/src/renderer/src/components/status-bar/ports-status-popover-rows.test.tsx
index 47c86d89c57..ba926909272 100644
--- a/src/renderer/src/components/status-bar/ports-status-popover-rows.test.tsx
+++ b/src/renderer/src/components/status-bar/ports-status-popover-rows.test.tsx
@@ -17,8 +17,7 @@ const {
     settings: { openLinksInApp: true },
     createBrowserTab: vi.fn(),
     setRemoteBrowserPageHandle: vi.fn(),
-    setWorkspacePortScan: vi.fn(),
-    setWorkspacePortScanForKey: vi.fn(),
+    replaceWorkspacePortScans: vi.fn(),
     setWorkspacePortScanRefreshing: vi.fn(),
     recordFeatureInteraction: vi.fn(),
     workspacePortScansByKey: {}
@@ -46,7 +45,7 @@ vi.mock('@/lib/worktree-activation', () => ({
 }))
 
 vi.mock('@/lib/worktree-runtime-owner', () => ({
-  getRuntimeEnvironmentIdForWorktree: () => null
+  getExecutionHostIdForWorktree: () => 'local'
 }))
 
 vi.mock('@/runtime/runtime-rpc-client', () => ({
diff --git a/src/renderer/src/components/status-bar/ports-status-popover-rows.tsx b/src/renderer/src/components/status-bar/ports-status-popover-rows.tsx
index c6d7eb41625..4c07c44ed21 100644
--- a/src/renderer/src/components/status-bar/ports-status-popover-rows.tsx
+++ b/src/renderer/src/components/status-bar/ports-status-popover-rows.tsx
@@ -1,4 +1,4 @@
-import React, { useCallback, useMemo } from 'react'
+import React, { useCallback } from 'react'
 import { Copy, ExternalLink, FolderOpen, Trash2 } from 'lucide-react'
 import { toast } from 'sonner'
 import { Button } from '@/components/ui/button'
@@ -15,9 +15,8 @@ import {
 } from '@/lib/workspace-port-actions'
 import type { WorkspacePortGroup } from '@/lib/workspace-port-groups'
 import { useLocalhostLabelRouteForPort } from '@/lib/workspace-port-localhost-label-selector'
-import { getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
+import { useWorktreeRuntimeTarget } from '@/runtime/use-worktree-runtime-target'
 import { useAppStore } from '@/store'
-import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import type { WorkspacePort } from '../../../../shared/workspace-ports'
 import { translate } from '@/i18n/i18n'
 
@@ -67,6 +66,7 @@ function PortAction({
   )
 }
 
+/** One port row in the status-bar popover, with open/copy/stop actions on its owner host. */
 export function PortRow({
   port,
   activeWorktreeId,
@@ -78,21 +78,13 @@ export function PortRow({
 }): React.JSX.Element {
   const settings = useAppStore((s) => s.settings)
   const localhostLabelRoute = useLocalhostLabelRouteForPort(port)
-  const runtimeEnvironmentId = useAppStore((s) =>
-    getRuntimeEnvironmentIdForWorktree(
-      s,
-      port.kind === 'workspace' ? port.owner.worktreeId : activeWorktreeId
-    )
-  )
   const createBrowserTab = useAppStore((s) => s.createBrowserTab)
   const setRemoteBrowserPageHandle = useAppStore((s) => s.setRemoteBrowserPageHandle)
-  const setWorkspacePortScan = useAppStore((s) => s.setWorkspacePortScan)
-  const setWorkspacePortScanForKey = useAppStore((s) => s.setWorkspacePortScanForKey)
+  const replaceWorkspacePortScans = useAppStore((s) => s.replaceWorkspacePortScans)
   const setWorkspacePortScanRefreshing = useAppStore((s) => s.setWorkspacePortScanRefreshing)
   const recordFeatureInteraction = useAppStore((s) => s.recordFeatureInteraction)
-  const runtimeTarget = useMemo(
-    () => getActiveRuntimeTarget({ ...settings, activeRuntimeEnvironmentId: runtimeEnvironmentId }),
-    [runtimeEnvironmentId, settings]
+  const runtimeTarget = useWorktreeRuntimeTarget(
+    port.kind === 'workspace' ? port.owner.worktreeId : activeWorktreeId
   )
   const processLabel = port.processName ?? (port.pid ? `PID ${port.pid}` : 'Unknown process')
   const canStop = canStopWorkspacePort(port)
@@ -187,8 +179,7 @@ export function PortRow({
         )
         const refreshResult = await refreshWorkspacePortScanAfterStop({
           runtimeTarget,
-          setWorkspacePortScan,
-          setWorkspacePortScanForKey,
+          replaceWorkspacePortScans,
           getWorkspacePortScansByKey: () => useAppStore.getState().workspacePortScansByKey,
           setWorkspacePortScanRefreshing
         })
@@ -210,8 +201,7 @@ export function PortRow({
       port,
       recordFeatureInteraction,
       runtimeTarget,
-      setWorkspacePortScan,
-      setWorkspacePortScanForKey,
+      replaceWorkspacePortScans,
       setWorkspacePortScanRefreshing
     ]
   )
diff --git a/src/renderer/src/lib/workspace-port-actions.ts b/src/renderer/src/lib/workspace-port-actions.ts
index cca201234a4..cf745d3e25f 100644
--- a/src/renderer/src/lib/workspace-port-actions.ts
+++ b/src/renderer/src/lib/workspace-port-actions.ts
@@ -7,7 +7,6 @@ import {
   type RuntimeClientTarget
 } from '@/runtime/runtime-rpc-client'
 import { toRuntimeWorktreeSelector } from '@/runtime/runtime-worktree-selector'
-import { parseExecutionHostId, type ExecutionHostId } from '../../../shared/execution-host'
 import type {
   WorkspacePort,
   WorkspacePortKillResult,
@@ -22,6 +21,11 @@ import { RUNTIME_BROWSER_UNAVAILABLE_MESSAGE } from './client-creation-action-po
 export { addressForPort } from './workspace-port-urls'
 
 const WORKSPACE_PORT_STOP_SETTLE_MS = 500
+const WORKSPACE_PORT_TARGET_UNAVAILABLE_REASON =
+  'Workspace ports are unavailable for this execution host.'
+
+/** Projection key for the merged multi-host view; never a per-host scan key. */
+export const WORKSPACE_PORT_ALL_HOSTS_SCAN_KEY = 'all-hosts:all'
 
 export function canStopWorkspacePort(
   port: WorkspacePort
@@ -33,13 +37,17 @@ type BrowserTabCreator = ReturnType<typeof useAppStore.getState>['createBrowserT
 type RemoteBrowserPageHandleSetter = ReturnType<
   typeof useAppStore.getState
 >['setRemoteBrowserPageHandle']
-type WorkspacePortScanSetter = ReturnType<typeof useAppStore.getState>['setWorkspacePortScan']
-type WorkspacePortScanByKeySetter = ReturnType<
-  typeof useAppStore.getState
->['setWorkspacePortScanForKey']
 type WorkspacePortScanRefreshingSetter = ReturnType<
   typeof useAppStore.getState
 >['setWorkspacePortScanRefreshing']
+type ReplaceWorkspacePortScansSetter = ReturnType<
+  typeof useAppStore.getState
+>['replaceWorkspacePortScans']
+
+export type WorkspacePortScanPublisher = {
+  replaceWorkspacePortScans: ReplaceWorkspacePortScansSetter
+  getWorkspacePortScansByKey: () => Record<string, WorkspacePortScanResult>
+}
 
 function delay(ms: number): Promise<void> {
   return new Promise((resolve) => window.setTimeout(resolve, ms))
@@ -94,12 +102,15 @@ export function goToWorkspacePortOwner(port: WorkspacePort): boolean {
 export async function openWorkspacePortInBrowser(args: {
   port: WorkspacePort
   activeWorktreeId?: string | null
-  runtimeTarget: RuntimeClientTarget
+  runtimeTarget: RuntimeClientTarget | null
   createBrowserTab: BrowserTabCreator
   setRemoteBrowserPageHandle: RemoteBrowserPageHandleSetter
   openInOrcaBrowser?: boolean
   localhostLabelRoute?: LocalhostWorktreeLabelRoute | null
 }): Promise<{ ok: true } | { ok: false; reason: string }> {
+  if (!args.runtimeTarget) {
+    return { ok: false, reason: WORKSPACE_PORT_TARGET_UNAVAILABLE_REASON }
+  }
   const rawUrl = browserUrlForPort(args.port)
   let url = rawUrl
   if (args.runtimeTarget.kind === 'local' && args.localhostLabelRoute) {
@@ -166,22 +177,38 @@ export async function openWorkspacePortInBrowser(args: {
   }
 }
 
-export async function refreshWorkspacePortScanAfterStop(args: {
-  runtimeTarget: RuntimeClientTarget
-  setWorkspacePortScan: WorkspacePortScanSetter
-  setWorkspacePortScanForKey?: WorkspacePortScanByKeySetter
-  setWorkspacePortScanRefreshing: WorkspacePortScanRefreshingSetter
-  getWorkspacePortScansByKey?: () => Record<string, WorkspacePortScanResult>
-}): Promise<{ ok: true } | { ok: false; reason: string }> {
+/**
+ * Stores one host's scan and republishes the aggregate the status bar reads.
+ * Why: a single-host publish used to overwrite that aggregate, so every other
+ * host's ports vanished from the count until the next background poll. One
+ * replaceWorkspacePortScans update (not setWorkspacePortScan) keeps the synthetic
+ * all-hosts key out of workspacePortScansByKey, where re-merging it would
+ * duplicate rows — and notifies subscribers once instead of twice for one scan.
+ */
+export function publishWorkspacePortScanForHost(
+  args: WorkspacePortScanPublisher & { scanKey: string; scan: WorkspacePortScanResult }
+): void {
+  const scansByKey = { ...args.getWorkspacePortScansByKey(), [args.scanKey]: args.scan }
+  const merged = mergeWorkspacePortScans(scansByKey)
+  args.replaceWorkspacePortScans(scansByKey, {
+    key: Object.keys(scansByKey).length > 1 ? WORKSPACE_PORT_ALL_HOSTS_SCAN_KEY : args.scanKey,
+    result: merged ?? args.scan
+  })
+}
+
+/** Re-scans one host after a port stop (immediately, then settled) and republishes the aggregate. */
+export async function refreshWorkspacePortScanAfterStop(
+  args: WorkspacePortScanPublisher & {
+    runtimeTarget: RuntimeClientTarget | null
+    setWorkspacePortScanRefreshing: WorkspacePortScanRefreshingSetter
+  }
+): Promise<{ ok: true } | { ok: false; reason: string }> {
+  if (!args.runtimeTarget) {
+    return { ok: false, reason: WORKSPACE_PORT_TARGET_UNAVAILABLE_REASON }
+  }
   const scanKey = workspacePortScanKeyForTarget(args.runtimeTarget)
   const publishScan = (scan: WorkspacePortScanResult): void => {
-    args.setWorkspacePortScanForKey?.(scanKey, scan)
-    const currentScans = args.getWorkspacePortScansByKey?.() ?? {}
-    const merged = mergeWorkspacePortScans({ ...currentScans, [scanKey]: scan })
-    args.setWorkspacePortScan({
-      key: merged && Object.keys(currentScans).length > 0 ? 'all-hosts:all' : scanKey,
-      result: merged ?? scan
-    })
+    publishWorkspacePortScanForHost({ ...args, scanKey, scan })
   }
   args.setWorkspacePortScanRefreshing(true)
   try {
@@ -216,19 +243,6 @@ export function workspacePortRuntimeTargetKey(target: RuntimeClientTarget): stri
   return target.kind === 'local' ? 'local' : `environment:${target.environmentId}`
 }
 
-export function runtimeTargetForExecutionHostId(
-  hostId: ExecutionHostId
-): RuntimeClientTarget | null {
-  const parsed = parseExecutionHostId(hostId)
-  if (parsed?.kind === 'local') {
-    return { kind: 'local' }
-  }
-  if (parsed?.kind === 'runtime') {
-    return { kind: 'environment', environmentId: parsed.environmentId }
-  }
-  return null
-}
-
 export function workspacePortScanKeyForTarget(target: RuntimeClientTarget): string {
   return `${workspacePortRuntimeTargetKey(target)}:all`
 }
@@ -295,9 +309,12 @@ export async function scanWorkspacePortsForTarget(
 }
 
 export async function killWorkspacePortForTarget(
-  target: RuntimeClientTarget,
+  target: RuntimeClientTarget | null,
   args: { repoId: string; pid: number; port: number }
 ): Promise<WorkspacePortKillResult> {
+  if (!target) {
+    return { ok: false, reason: WORKSPACE_PORT_TARGET_UNAVAILABLE_REASON }
+  }
   if (target.kind === 'local') {
     return window.api.workspacePorts.kill(args)
   }
diff --git a/src/renderer/src/lib/workspace-port-host-availability.test.ts b/src/renderer/src/lib/workspace-port-host-availability.test.ts
new file mode 100644
index 00000000000..7652c65a21a
--- /dev/null
+++ b/src/renderer/src/lib/workspace-port-host-availability.test.ts
@@ -0,0 +1,148 @@
+import { describe, expect, it } from 'vitest'
+import type { WorkspacePortScanResult } from '../../../shared/workspace-ports'
+import {
+  getUnavailableWorkspacePortHosts,
+  workspacePortHostForScanKey
+} from './workspace-port-host-availability'
+
+function scan(overrides: Partial<WorkspacePortScanResult> = {}): WorkspacePortScanResult {
+  return { platform: 'linux', scannedAt: 1, ports: [], ...overrides }
+}
+
+describe('getUnavailableWorkspacePortHosts', () => {
+  it('reports the failed host while another host still answers', () => {
+    expect(
+      getUnavailableWorkspacePortHosts({
+        'local:all': scan(),
+        'environment:env-1:all': scan({ unavailableReason: 'Remote connection dropped' })
+      })
+    ).toEqual([
+      {
+        scanKey: 'environment:env-1:all',
+        host: { kind: 'environment', environmentId: 'env-1' },
+        platform: 'linux',
+        reason: 'Remote connection dropped'
+      }
+    ])
+  })
+
+  it('reports the local host as a local host ref, not an absent environment id', () => {
+    expect(
+      getUnavailableWorkspacePortHosts({
+        'local:all': scan({ unavailableReason: 'lsof is unavailable' }),
+        'environment:env-1:all': scan()
+      })
+    ).toEqual([
+      {
+        scanKey: 'local:all',
+        host: { kind: 'local' },
+        platform: 'linux',
+        reason: 'lsof is unavailable'
+      }
+    ])
+  })
+
+  it('keeps colons inside an environment id when parsing the scan key', () => {
+    // Why: keys are `${targetKey}:all`, so the id runs to the last `:all` —
+    // splitting on the first colon would truncate ids that contain colons.
+    expect(
+      getUnavailableWorkspacePortHosts({
+        'local:all': scan(),
+        'environment:weird:id:all': scan({ unavailableReason: 'Remote connection dropped' })
+      })
+    ).toEqual([
+      {
+        scanKey: 'environment:weird:id:all',
+        host: { kind: 'environment', environmentId: 'weird:id' },
+        platform: 'linux',
+        reason: 'Remote connection dropped'
+      }
+    ])
+  })
+
+  // Why: total loss of contact is where naming the host matters most — the merged
+  // projection joins raw internal scan keys, so it cannot name them itself.
+  it('names every host when all of them failed', () => {
+    expect(
+      getUnavailableWorkspacePortHosts({
+        'local:all': scan({ unavailableReason: 'lsof is unavailable' }),
+        'environment:env-1:all': scan({ unavailableReason: 'Remote connection dropped' })
+      })
+    ).toEqual([
+      {
+        scanKey: 'local:all',
+        host: { kind: 'local' },
+        platform: 'linux',
+        reason: 'lsof is unavailable'
+      },
+      {
+        scanKey: 'environment:env-1:all',
+        host: { kind: 'environment', environmentId: 'env-1' },
+        platform: 'linux',
+        reason: 'Remote connection dropped'
+      }
+    ])
+  })
+
+  it('names a single failed host', () => {
+    expect(
+      getUnavailableWorkspacePortHosts({
+        'local:all': scan({ unavailableReason: 'lsof is unavailable' })
+      })
+    ).toEqual([
+      {
+        scanKey: 'local:all',
+        host: { kind: 'local' },
+        platform: 'linux',
+        reason: 'lsof is unavailable'
+      }
+    ])
+  })
+
+  // Why: the synthetic all-hosts projection key must never be labelled as the
+  // local machine — that would blame the wrong host for a remote failure.
+  it('marks an unrecognised scan key as an unknown host', () => {
+    expect(
+      getUnavailableWorkspacePortHosts({
+        'all-hosts:all': scan({ unavailableReason: 'Remote connection dropped' })
+      })
+    ).toEqual([
+      {
+        scanKey: 'all-hosts:all',
+        host: { kind: 'unknown' },
+        platform: 'linux',
+        reason: 'Remote connection dropped'
+      }
+    ])
+  })
+
+  // Why: a paired web client's userAgent is not the Orca host's platform, so the
+  // caller labels the local host from the scan's own platform.
+  it("carries the failed scan's platform, and null when it is unknown", () => {
+    expect(
+      getUnavailableWorkspacePortHosts({
+        'local:all': scan({ platform: 'win32', unavailableReason: 'netstat failed' }),
+        'environment:env-1:all': scan({ platform: 'unknown', unavailableReason: 'dropped' })
+      }).map((entry) => entry.platform)
+    ).toEqual(['win32', null])
+  })
+
+  it('stays silent when nothing failed', () => {
+    expect(getUnavailableWorkspacePortHosts({ 'local:all': scan() })).toEqual([])
+    expect(getUnavailableWorkspacePortHosts({})).toEqual([])
+  })
+})
+
+describe('workspacePortHostForScanKey', () => {
+  it.each([
+    ['local:all', { kind: 'local' }],
+    ['environment:env-1:all', { kind: 'environment', environmentId: 'env-1' }],
+    ['environment:weird:id:all', { kind: 'environment', environmentId: 'weird:id' }],
+    ['all-hosts:all', { kind: 'unknown' }],
+    ['environment::all', { kind: 'unknown' }],
+    ['environment:env-1', { kind: 'unknown' }],
+    ['local', { kind: 'unknown' }]
+  ])('maps %s', (scanKey, expected) => {
+    expect(workspacePortHostForScanKey(scanKey)).toEqual(expected)
+  })
+})
diff --git a/src/renderer/src/lib/workspace-port-host-availability.ts b/src/renderer/src/lib/workspace-port-host-availability.ts
new file mode 100644
index 00000000000..4c643a5a118
--- /dev/null
+++ b/src/renderer/src/lib/workspace-port-host-availability.ts
@@ -0,0 +1,65 @@
+import type { WorkspacePortScanResult } from '../../../shared/workspace-ports'
+
+/**
+ * Host a per-host scan key points at. `unknown` is kept distinct from `local` so
+ * an unrecognised key (a synthetic projection key that leaked into the per-host
+ * map, say) is never mislabelled as a local failure.
+ */
+export type WorkspacePortHostRef =
+  | { kind: 'local' }
+  | { kind: 'environment'; environmentId: string }
+  | { kind: 'unknown' }
+
+export type UnavailableWorkspacePortHost = {
+  scanKey: string
+  host: WorkspacePortHostRef
+  /** Platform the failed scan last ran on; drives the local host's label. */
+  platform: NodeJS.Platform | null
+  reason: string
+}
+
+// Why: mirrors workspacePortScanKeyForTarget (`${targetKey}:all`, where the
+// target key is `local` or `environment:<id>`) without importing the heavier
+// workspace-port-actions module into this pure helper. Splitting on the last
+// `:all` keeps environment ids that themselves contain colons intact.
+const ENVIRONMENT_SCAN_KEY_PREFIX = 'environment:'
+const SCAN_KEY_SUFFIX = ':all'
+const LOCAL_SCAN_KEY = `local${SCAN_KEY_SUFFIX}`
+
+/** Host a per-host scan key names; `unknown` for any other key shape. */
+export function workspacePortHostForScanKey(scanKey: string): WorkspacePortHostRef {
+  if (scanKey === LOCAL_SCAN_KEY) {
+    return { kind: 'local' }
+  }
+  if (!scanKey.endsWith(SCAN_KEY_SUFFIX) || !scanKey.startsWith(ENVIRONMENT_SCAN_KEY_PREFIX)) {
+    return { kind: 'unknown' }
+  }
+  const environmentId = scanKey.slice(
+    ENVIRONMENT_SCAN_KEY_PREFIX.length,
+    scanKey.length - SCAN_KEY_SUFFIX.length
+  )
+  return environmentId ? { kind: 'environment', environmentId } : { kind: 'unknown' }
+}
+
+/**
+ * Every host whose latest scan failed, named by host rather than by scan key.
+ * Why: on a remote host "none listening" and "could not look" are different
+ * answers, and the merged projection collapses both the partial case (no reason
+ * at all) and the total case (reasons joined with raw internal keys).
+ */
+export function getUnavailableWorkspacePortHosts(
+  scansByKey: Record<string, WorkspacePortScanResult>
+): UnavailableWorkspacePortHost[] {
+  return Object.entries(scansByKey).flatMap(([scanKey, scan]) =>
+    scan?.unavailableReason
+      ? [
+          {
+            scanKey,
+            host: workspacePortHostForScanKey(scanKey),
+            platform: scan.platform === 'unknown' ? null : scan.platform,
+            reason: scan.unavailableReason
+          }
+        ]
+      : []
+  )
+}
diff --git a/src/renderer/src/lib/workspace-port-scan-debounce.test.ts b/src/renderer/src/lib/workspace-port-scan-debounce.test.ts
index bacac7ecacf..747de6672aa 100644
--- a/src/renderer/src/lib/workspace-port-scan-debounce.test.ts
+++ b/src/renderer/src/lib/workspace-port-scan-debounce.test.ts
@@ -25,6 +25,11 @@ function unavailable(): WorkspacePortScanResult {
   return { platform: 'unknown', scannedAt: 1, ports: [], unavailableReason: 'scan failed' }
 }
 
+/** What the ports popover publishes when its own scan fails: reason + last-good ports. */
+function unavailableWithRetainedPorts(portIds: string[]): WorkspacePortScanResult {
+  return { ...good(portIds), unavailableReason: 'scan failed' }
+}
+
 const FAILURE_THRESHOLD = 2
 
 function createHarness(): {
@@ -125,6 +130,33 @@ describe('reconcileTransientPortScanFailures', () => {
     expect(state.has('flaky:all')).toBe(false)
   })
 
+  // Why: the popover publishes reason + last-good ports the moment its own scan
+  // fails. Counting that as a spent grace period would drop those ports on the
+  // very next poll, so the retention would never survive one poll interval.
+  it('still grants the grace period after a failure that retained its ports', () => {
+    const { apply, publish } = createHarness()
+    apply([{ key: 'h:all', result: good(['tcp:3000']) }])
+    const popoverResult = unavailableWithRetainedPorts(['tcp:3000'])
+    publish('h:all', popoverResult)
+
+    const next = apply([{ key: 'h:all', result: unavailable() }])
+
+    expect(next[0].result).toBe(popoverResult)
+    expect(next[0].result.ports).toHaveLength(1)
+  })
+
+  it('still drops retained ports once failures reach the tolerance', () => {
+    const { apply, publish } = createHarness()
+    apply([{ key: 'h:all', result: good(['tcp:3000']) }])
+    publish('h:all', unavailableWithRetainedPorts(['tcp:3000']))
+    apply([{ key: 'h:all', result: unavailable() }])
+
+    const next = apply([{ key: 'h:all', result: unavailable() }])
+
+    expect(next[0].result.ports).toHaveLength(0)
+    expect(next[0].result.unavailableReason).toBe('scan failed')
+  })
+
   it('uses a newer manual result instead of resurrecting stale ports', () => {
     const { apply, publish } = createHarness()
     apply([{ key: 'h:all', result: good(['tcp:3000']) }])
diff --git a/src/renderer/src/lib/workspace-port-scan-debounce.ts b/src/renderer/src/lib/workspace-port-scan-debounce.ts
index a6281f0ed9f..2677cbb0e52 100644
--- a/src/renderer/src/lib/workspace-port-scan-debounce.ts
+++ b/src/renderer/src/lib/workspace-port-scan-debounce.ts
@@ -34,10 +34,14 @@ export function reconcileTransientPortScanFailures(
       return { key, result }
     }
     const failures = previousFailures + 1
+    // Why: a surface that hit the same failure first (the ports popover) republishes
+    // the host's last-good ports alongside the reason. Treating that as a spent grace
+    // period would drop those ports on the very next poll, undoing the retention.
+    const publishedIsRetainable =
+      Boolean(publishedResult) &&
+      (!publishedResult.unavailableReason || publishedResult.ports.length > 0)
     const nextResult =
-      failures < failureThreshold && publishedResult && !publishedResult.unavailableReason
-        ? publishedResult
-        : result
+      failures < failureThreshold && publishedIsRetainable ? publishedResult : result
     state.set(key, { consecutiveFailures: failures, publishedResult: nextResult })
     return { key, result: nextResult }
   })
diff --git a/src/renderer/src/lib/workspace-port-scan-publish.test.ts b/src/renderer/src/lib/workspace-port-scan-publish.test.ts
new file mode 100644
index 00000000000..2f1386855a8
--- /dev/null
+++ b/src/renderer/src/lib/workspace-port-scan-publish.test.ts
@@ -0,0 +1,153 @@
+// @vitest-environment happy-dom
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { WorkspacePortScanResult } from '../../../shared/workspace-ports'
+
+vi.mock('@/lib/worktree-activation', () => ({
+  activateAndRevealWorktree: vi.fn()
+}))
+
+vi.mock('@/runtime/runtime-rpc-client', () => ({
+  getActiveRuntimeTarget: vi.fn(),
+  callRuntimeRpc: vi.fn(),
+  assertRuntimeEnvironmentCapability: vi.fn(),
+  RuntimeRpcCallError: class RuntimeRpcCallError extends Error {
+    code?: string
+  }
+}))
+
+vi.mock('./workspace-port-scan-client', () => ({
+  runWorkspacePortScanForTarget: vi.fn()
+}))
+
+const { publishWorkspacePortScanForHost, WORKSPACE_PORT_ALL_HOSTS_SCAN_KEY } =
+  await import('./workspace-port-actions')
+type WorkspacePortScanPublisher = Parameters<typeof publishWorkspacePortScanForHost>[0]
+
+function scanWithPort(port: number, scannedAt: number): WorkspacePortScanResult {
+  return {
+    platform: 'linux',
+    scannedAt,
+    ports: [
+      {
+        id: `tcp:${port}`,
+        bindHost: '0.0.0.0',
+        connectHost: '127.0.0.1',
+        port,
+        pid: 100 + port,
+        processName: 'node',
+        protocol: 'http',
+        kind: 'external'
+      }
+    ]
+  }
+}
+
+/** Mirrors the store's replaceWorkspacePortScans semantics: one atomic update. */
+function makeStoreHarness(initial: Record<string, WorkspacePortScanResult> = {}): {
+  scansByKey: Record<string, WorkspacePortScanResult>
+  projections: { key: string; result: WorkspacePortScanResult }[]
+  publisher: Omit<WorkspacePortScanPublisher, 'scanKey' | 'scan'>
+} {
+  let scansByKey: Record<string, WorkspacePortScanResult> = { ...initial }
+  const projections: { key: string; result: WorkspacePortScanResult }[] = []
+  return {
+    get scansByKey() {
+      return scansByKey
+    },
+    projections,
+    publisher: {
+      replaceWorkspacePortScans: (
+        nextScansByKey: Record<string, WorkspacePortScanResult>,
+        projection: { key: string; result: WorkspacePortScanResult } | null
+      ) => {
+        scansByKey = nextScansByKey
+        if (projection) {
+          projections.push(projection)
+        }
+      },
+      getWorkspacePortScansByKey: () => scansByKey
+    }
+  }
+}
+
+describe('publishWorkspacePortScanForHost', () => {
+  let localScan: WorkspacePortScanResult
+  let remoteScan: WorkspacePortScanResult
+
+  beforeEach(() => {
+    localScan = scanWithPort(5173, 10)
+    remoteScan = scanWithPort(3000, 20)
+  })
+
+  it('publishes the single tracked host under its own key', () => {
+    const harness = makeStoreHarness()
+
+    publishWorkspacePortScanForHost({
+      ...harness.publisher,
+      scanKey: 'local:all',
+      scan: localScan
+    })
+
+    expect(harness.projections).toEqual([{ key: 'local:all', result: localScan }])
+    expect(Object.keys(harness.scansByKey)).toEqual(['local:all'])
+  })
+
+  it('keeps the other host in the projection when one host refreshes', () => {
+    const harness = makeStoreHarness({ 'local:all': localScan })
+
+    publishWorkspacePortScanForHost({
+      ...harness.publisher,
+      scanKey: 'environment:env-1:all',
+      scan: remoteScan
+    })
+
+    const projection = harness.projections.at(-1)
+    expect(projection?.key).toBe(WORKSPACE_PORT_ALL_HOSTS_SCAN_KEY)
+    expect(projection?.result.ports.map((port) => port.port).sort()).toEqual([3000, 5173])
+    expect(Object.keys(harness.scansByKey).sort()).toEqual(['environment:env-1:all', 'local:all'])
+  })
+
+  it('publishes map and projection in a single store update', () => {
+    const harness = makeStoreHarness({ 'local:all': localScan })
+    const replaceSpy = vi.spyOn(harness.publisher, 'replaceWorkspacePortScans')
+
+    publishWorkspacePortScanForHost({
+      ...harness.publisher,
+      scanKey: 'environment:env-1:all',
+      scan: remoteScan
+    })
+
+    // Why: two sequential setter calls notify subscribers twice for one scan;
+    // one atomic replace keeps map and projection from ever disagreeing.
+    expect(replaceSpy).toHaveBeenCalledTimes(1)
+    const [nextScans, projection] = replaceSpy.mock.calls[0]
+    expect(Object.keys(nextScans).sort()).toEqual(['environment:env-1:all', 'local:all'])
+    expect(projection?.key).toBe(WORKSPACE_PORT_ALL_HOSTS_SCAN_KEY)
+  })
+
+  it('does not accumulate duplicate rows across repeated publishes', () => {
+    const harness = makeStoreHarness({ 'local:all': localScan })
+
+    publishWorkspacePortScanForHost({
+      ...harness.publisher,
+      scanKey: 'environment:env-1:all',
+      scan: remoteScan
+    })
+    publishWorkspacePortScanForHost({
+      ...harness.publisher,
+      scanKey: 'environment:env-1:all',
+      scan: { ...remoteScan, scannedAt: 30 }
+    })
+
+    // Why: the aggregate must never land in the per-host map, or the next merge
+    // folds the merged result back into itself and rows multiply.
+    expect(harness.scansByKey[WORKSPACE_PORT_ALL_HOSTS_SCAN_KEY]).toBeUndefined()
+    expect(
+      harness.projections
+        .at(-1)
+        ?.result.ports.map((port) => port.port)
+        .sort()
+    ).toEqual([3000, 5173])
+  })
+})
diff --git a/src/renderer/src/runtime/runtime-client-target.ts b/src/renderer/src/runtime/runtime-client-target.ts
index 1a0b8e4b8a4..fbf9af17374 100644
--- a/src/renderer/src/runtime/runtime-client-target.ts
+++ b/src/renderer/src/runtime/runtime-client-target.ts
@@ -1,4 +1,5 @@
 import type { GlobalSettings } from '../../../shared/global-settings-types'
+import { parseExecutionHostId, type ExecutionHostId } from '../../../shared/execution-host'
 
 export type RuntimeClientTarget = { kind: 'local' } | { kind: 'environment'; environmentId: string }
 
@@ -9,6 +10,20 @@ export function getActiveRuntimeTarget(
   return environmentId ? { kind: 'environment', environmentId } : { kind: 'local' }
 }
 
+/** RPC target for a dispatchable host; direct SSH cannot use this client path. */
+export function runtimeTargetForExecutionHostId(
+  hostId: ExecutionHostId
+): RuntimeClientTarget | null {
+  const parsed = parseExecutionHostId(hostId)
+  if (parsed?.kind === 'local') {
+    return { kind: 'local' }
+  }
+  if (parsed?.kind === 'runtime') {
+    return { kind: 'environment', environmentId: parsed.environmentId }
+  }
+  return null
+}
+
 export function settingsForRuntimeOwner(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   runtimeEnvironmentId: string | null | undefined
diff --git a/src/renderer/src/runtime/use-worktree-runtime-target.ts b/src/renderer/src/runtime/use-worktree-runtime-target.ts
new file mode 100644
index 00000000000..25bd9099e90
--- /dev/null
+++ b/src/renderer/src/runtime/use-worktree-runtime-target.ts
@@ -0,0 +1,16 @@
+import { useAppStore } from '@/store'
+import { getExecutionHostIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { runtimeTargetForExecutionHostId, type RuntimeClientTarget } from './runtime-client-target'
+
+/**
+ * Runtime target that owns `worktreeId`, which is not always the globally
+ * focused runtime — acting on the focused one scans the wrong host and reports
+ * that workspace as having no ports. Direct-SSH owners return null.
+ */
+export function useWorktreeRuntimeTarget(
+  worktreeId: string | null | undefined
+): RuntimeClientTarget | null {
+  return useAppStore((state) =>
+    runtimeTargetForExecutionHostId(getExecutionHostIdForWorktree(state, worktreeId))
+  )
+}

From 3941edd4b6d474bf1c170cfbb7a0c80798d97bdc Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Thu, 3 Sep 2026 22:20:35 -0700
Subject: [PATCH 02/58] perf(ipc): build the filesystem allowed-root list once
 per authorization (#18423)

* perf(ipc): build the filesystem allowed-root list once per authorization

* perf(ipc): keep the allowed-root snapshot lazy so granted external paths build nothing

Hoisting getAllowedRoots to the top of resolveAuthorizedPath made every read of a
path covered by an external grant build the full root list, where main built none
(the grant answered before isPathAllowed reached the roots). Build on first use
instead: still one build per authorization, zero when a grant already answers.

* test(ipc): skip the allowed-root symlink escapes on Windows

Unprivileged Windows cannot create symlinks (EPERM), so both cases failed in
setup instead of exercising the escape check.
---
 src/main/ipc/filesystem-allowed-roots.test.ts | 372 ++++++++++++++++++
 src/main/ipc/filesystem-allowed-roots.ts      |  59 ++-
 src/main/ipc/filesystem-auth.ts               |  65 ++-
 src/main/project-runtime-git-options.ts       |   7 +-
 src/shared/project-groups.ts                  |  23 +-
 5 files changed, 492 insertions(+), 34 deletions(-)
 create mode 100644 src/main/ipc/filesystem-allowed-roots.test.ts

diff --git a/src/main/ipc/filesystem-allowed-roots.test.ts b/src/main/ipc/filesystem-allowed-roots.test.ts
new file mode 100644
index 00000000000..f94c99c5fdb
--- /dev/null
+++ b/src/main/ipc/filesystem-allowed-roots.test.ts
@@ -0,0 +1,372 @@
+import { mkdir, mkdtemp, realpath, rm, symlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+import type * as RepoWorktrees from '../repo-worktrees'
+import { listRepoWorktreeGraph } from '../repo-worktrees'
+import type * as ProjectGroupsModule from '../../shared/project-groups'
+import { buildProjectGroupChildIndex, getProjectGroupSubtreeIds } from '../../shared/project-groups'
+import { isPathInsideOrEqual } from '../../shared/cross-platform-path'
+import { getWorktreeMirrorDistro } from '../project-runtime-git-options'
+import type { FolderWorkspace } from '../../shared/folder-workspace-types'
+import type { ProjectGroup } from '../../shared/project-group-types'
+import type { Project } from '../../shared/project-types'
+import type { Repo } from '../../shared/repo-types'
+import { getAllowedRoots } from './filesystem-allowed-roots'
+import { authorizeExternalPath, resolveAuthorizedPath } from './filesystem-auth'
+import { invalidateAuthorizedRootsCache } from './registered-worktree-roots-cache'
+import { computeWorkspaceRoot, getWorktreePathSettings } from './worktree-logic'
+
+vi.mock('../repo-worktrees', async () => {
+  const actual = await vi.importActual<typeof RepoWorktrees>('../repo-worktrees')
+  return { ...actual, listRepoWorktreeGraph: vi.fn(async () => []) }
+})
+
+vi.mock('../../shared/project-groups', async () => {
+  const actual = await vi.importActual<typeof ProjectGroupsModule>('../../shared/project-groups')
+  return {
+    ...actual,
+    buildProjectGroupChildIndex: vi.fn(actual.buildProjectGroupChildIndex),
+    getProjectGroupSubtreeIds: vi.fn(actual.getProjectGroupSubtreeIds)
+  }
+})
+
+type StoreFixture = {
+  repos: Repo[]
+  projects: Project[]
+  projectGroups: ProjectGroup[]
+  folderWorkspaces: FolderWorkspace[]
+  workspaceDir?: string
+}
+
+type StoreCallCounts = {
+  getRepos: number
+  getProjects: number
+  getProjectGroups: number
+  getFolderWorkspaces: number
+}
+
+function makeCountingStore(fixture: StoreFixture): { store: Store; counts: StoreCallCounts } {
+  const counts: StoreCallCounts = {
+    getRepos: 0,
+    getProjects: 0,
+    getProjectGroups: 0,
+    getFolderWorkspaces: 0
+  }
+  const store = {
+    getRepos: () => {
+      counts.getRepos += 1
+      // Match the real store, which rehydrates fresh repo objects on every read.
+      return fixture.repos.map((repo) => ({ ...repo }))
+    },
+    getProjects: () => {
+      counts.getProjects += 1
+      return fixture.projects.map((project) => ({ ...project }))
+    },
+    getProjectGroups: () => {
+      counts.getProjectGroups += 1
+      return fixture.projectGroups.map((group) => ({ ...group }))
+    },
+    getFolderWorkspaces: () => {
+      counts.getFolderWorkspaces += 1
+      return fixture.folderWorkspaces.map((workspace) => ({ ...workspace }))
+    },
+    getSettings: () => ({ nestWorkspaces: false, workspaceDir: fixture.workspaceDir ?? '' })
+  } as unknown as Store
+  return { store, counts }
+}
+
+/**
+ * The pre-change `getAllowedRoots` algorithm, kept verbatim so the equivalence test compares the
+ * new root list against the old one rather than against a hand-written expectation.
+ */
+function referenceAllowedRoots(store: Store): string[] {
+  const scopeStore = store as unknown as {
+    getRepos: () => Repo[]
+    getProjectGroups?: () => ProjectGroup[]
+    getFolderWorkspaces?: () => FolderWorkspace[]
+    getSettings: () => { workspaceDir?: string; nestWorkspaces?: boolean }
+  }
+  const localRepos = scopeStore.getRepos().filter((repo) => !repo.connectionId)
+  const settings = scopeStore.getSettings()
+
+  const scopeRepos = scopeStore.getRepos()
+  const projectGroups = scopeStore.getProjectGroups?.() ?? []
+  const isRemoteOnly = (
+    folderPath: string,
+    projectGroupId: string,
+    connectionId: string | null | undefined
+  ): boolean => {
+    if (connectionId) {
+      return true
+    }
+    const groupIds = getProjectGroupSubtreeIds(projectGroups, projectGroupId)
+    const candidates = scopeRepos.filter(
+      (repo) =>
+        (typeof repo.projectGroupId === 'string' && groupIds.has(repo.projectGroupId)) ||
+        isPathInsideOrEqual(folderPath, repo.path)
+    )
+    return candidates.length > 0 && candidates.every((repo) => Boolean(repo.connectionId))
+  }
+  const folderScopeRoots: string[] = []
+  for (const group of projectGroups) {
+    if (group.parentPath && !isRemoteOnly(group.parentPath, group.id, group.connectionId)) {
+      folderScopeRoots.push(resolve(group.parentPath))
+    }
+  }
+  for (const workspace of scopeStore.getFolderWorkspaces?.() ?? []) {
+    const connectionId =
+      workspace.connectionId ??
+      projectGroups.find((group) => group.id === workspace.projectGroupId)?.connectionId ??
+      null
+    if (!isRemoteOnly(workspace.folderPath, workspace.projectGroupId, connectionId)) {
+      folderScopeRoots.push(resolve(workspace.folderPath))
+    }
+  }
+
+  const roots = [...localRepos.map((repo) => resolve(repo.path)), ...folderScopeRoots]
+  if (settings.workspaceDir) {
+    if (localRepos.length === 0) {
+      roots.push(resolve(settings.workspaceDir))
+    } else {
+      for (const repo of localRepos) {
+        roots.push(
+          resolve(
+            computeWorkspaceRoot(
+              repo.path,
+              getWorktreePathSettings(repo, settings as never, getWorktreeMirrorDistro(store, repo))
+            )
+          )
+        )
+      }
+    }
+  }
+  return roots
+}
+
+function makeRepo(overrides: Partial<Repo> & Pick<Repo, 'id' | 'path'>): Repo {
+  return {
+    displayName: overrides.id,
+    badgeColor: '#000000',
+    addedAt: 1,
+    kind: 'git',
+    ...overrides
+  }
+}
+
+function makeGroup(overrides: Partial<ProjectGroup> & Pick<ProjectGroup, 'id'>): ProjectGroup {
+  return {
+    name: overrides.id,
+    parentPath: null,
+    parentGroupId: null,
+    createdFrom: 'folder-scan',
+    tabOrder: 0,
+    isCollapsed: false,
+    color: null,
+    createdAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+function makeWorkspace(
+  overrides: Partial<FolderWorkspace> & Pick<FolderWorkspace, 'id' | 'folderPath'>
+): FolderWorkspace {
+  return {
+    projectGroupId: 'group-root',
+    name: overrides.id,
+    comment: '',
+    linkedTask: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 1,
+    lastActivityAt: 1,
+    createdAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+/** Repos, nested groups, folder workspaces (one not a git worktree), and an SSH repo. */
+function makeMixedFixture(): StoreFixture {
+  const repos = [
+    makeRepo({ id: 'repo-local', path: '/repos/app', projectGroupId: 'group-root' }),
+    makeRepo({ id: 'repo-nested', path: '/repos/nested', projectGroupId: 'group-child' }),
+    makeRepo({ id: 'repo-folder', path: '/folders/plain', kind: 'folder' }),
+    makeRepo({
+      id: 'repo-ssh',
+      path: '/remote/app',
+      connectionId: 'ssh-1',
+      projectGroupId: 'group-remote'
+    })
+  ]
+  const projectGroups = [
+    makeGroup({ id: 'group-root', parentPath: '/folders/root' }),
+    makeGroup({ id: 'group-child', parentGroupId: 'group-root', parentPath: '/folders/child' }),
+    makeGroup({ id: 'group-grandchild', parentGroupId: 'group-child' }),
+    makeGroup({ id: 'group-remote', parentPath: '/remote/scope' }),
+    makeGroup({ id: 'group-connection', parentPath: '/remote/via-group', connectionId: 'ssh-1' })
+  ]
+  const folderWorkspaces = [
+    makeWorkspace({ id: 'ws-git', folderPath: '/folders/root/feature' }),
+    // Not a git worktree: a plain folder workspace under a folder-kind repo.
+    makeWorkspace({
+      id: 'ws-plain',
+      folderPath: '/folders/plain/scratch',
+      projectGroupId: 'group-child'
+    }),
+    makeWorkspace({ id: 'ws-remote', folderPath: '/remote/ws', projectGroupId: 'group-remote' }),
+    makeWorkspace({
+      id: 'ws-connection',
+      folderPath: '/remote/direct',
+      projectGroupId: 'group-connection'
+    }),
+    makeWorkspace({
+      id: 'ws-unlinked',
+      folderPath: '/folders/unlinked',
+      projectGroupId: 'group-orphan'
+    })
+  ]
+  const projects: Project[] = [
+    {
+      id: 'project-1',
+      displayName: 'App',
+      badgeColor: '#000000',
+      sourceRepoIds: ['repo-local', 'repo-nested'],
+      createdAt: 1,
+      updatedAt: 1
+    },
+    {
+      id: 'project-2',
+      displayName: 'Folder',
+      badgeColor: '#000000',
+      sourceRepoIds: ['repo-folder'],
+      createdAt: 1,
+      updatedAt: 1
+    }
+  ]
+  return { repos, projects, projectGroups, folderWorkspaces, workspaceDir: '/workspaces' }
+}
+
+beforeEach(() => {
+  invalidateAuthorizedRootsCache()
+  vi.mocked(buildProjectGroupChildIndex).mockClear()
+  vi.mocked(getProjectGroupSubtreeIds).mockClear()
+})
+
+describe('getAllowedRoots', () => {
+  it('produces the same roots as the pre-change implementation', () => {
+    const { store } = makeCountingStore(makeMixedFixture())
+
+    expect(getAllowedRoots(store)).toEqual(referenceAllowedRoots(store))
+  })
+
+  it('reads the store once and indexes project groups once per build', () => {
+    const fixture = makeMixedFixture()
+    const { store, counts } = makeCountingStore(fixture)
+
+    getAllowedRoots(store)
+
+    expect.soft(counts.getRepos).toBe(1)
+    expect.soft(counts.getProjectGroups).toBe(1)
+    expect.soft(counts.getFolderWorkspaces).toBe(1)
+    // Batched runtime resolution scans the project list once, not once per local repo.
+    expect.soft(counts.getProjects).toBe(1)
+    // The per-scope subtree walk no longer rebuilds the parent->children index.
+    expect.soft(vi.mocked(buildProjectGroupChildIndex)).toHaveBeenCalledTimes(1)
+    expect.soft(vi.mocked(getProjectGroupSubtreeIds)).not.toHaveBeenCalled()
+  })
+})
+
+describe('resolveAuthorizedPath allowed-root reuse', () => {
+  let repoRoot: string
+  let outsideRoot: string
+  let store: Store
+  let counts: StoreCallCounts
+
+  beforeEach(async () => {
+    repoRoot = await mkdtemp(join(await realpath(tmpdir()), 'orca-allowed-roots-'))
+    outsideRoot = await mkdtemp(join(await realpath(tmpdir()), 'orca-outside-'))
+    const fixture = makeMixedFixture()
+    fixture.repos = [makeRepo({ id: 'repo-local', path: repoRoot }), ...fixture.repos]
+    fixture.projects[0]!.sourceRepoIds = ['repo-local']
+    ;({ store, counts } = makeCountingStore(fixture))
+  })
+
+  afterEach(async () => {
+    await rm(repoRoot, { recursive: true, force: true })
+    await rm(outsideRoot, { recursive: true, force: true })
+  })
+
+  it('builds the allowed-root list once per call across repeated reads', async () => {
+    const dirPath = join(repoRoot, 'src')
+    await mkdir(dirPath)
+    await writeFile(join(dirPath, 'index.ts'), 'export {}\n')
+    const callCount = 5
+
+    for (let index = 0; index < callCount; index += 1) {
+      await resolveAuthorizedPath(dirPath, store)
+      await resolveAuthorizedPath(join(dirPath, 'index.ts'), store)
+    }
+
+    const buildCount = callCount * 2
+    // One build per authorization, not one per raw-path check plus one per realpath check.
+    expect.soft(counts.getFolderWorkspaces).toBe(buildCount)
+    expect.soft(counts.getRepos).toBe(buildCount)
+    expect.soft(counts.getProjects).toBe(buildCount)
+    expect.soft(vi.mocked(buildProjectGroupChildIndex)).toHaveBeenCalledTimes(buildCount)
+    expect.soft(vi.mocked(getProjectGroupSubtreeIds)).not.toHaveBeenCalled()
+  })
+
+  // Why (both symlink cases): creating a symlink on Windows needs elevation or
+  // Developer Mode, so these would fail EPERM in setup rather than exercise the
+  // escape check. Every non-symlink case still runs there.
+  it.skipIf(process.platform === 'win32')(
+    'still refuses a symlink that escapes every allowed root',
+    async () => {
+      const secret = join(outsideRoot, 'secret.txt')
+      await writeFile(secret, 'secret\n')
+      const escape = join(repoRoot, 'escape.txt')
+      await symlink(secret, escape)
+
+      await expect(resolveAuthorizedPath(escape, store)).rejects.toThrow('Access denied')
+      expect(vi.mocked(listRepoWorktreeGraph)).toHaveBeenCalled()
+    }
+  )
+
+  it('builds no allowed-root list at all for a granted external path', async () => {
+    const external = join(outsideRoot, 'external.md')
+    await writeFile(external, 'notes\n')
+    authorizeExternalPath(external)
+    counts.getRepos = 0
+    counts.getProjects = 0
+    counts.getFolderWorkspaces = 0
+
+    for (let index = 0; index < 5; index += 1) {
+      await expect(resolveAuthorizedPath(external, store)).resolves.toBe(external)
+    }
+
+    // The grant answers on its own; hoisting the snapshot must not turn zero builds into one per read.
+    expect.soft(counts.getRepos).toBe(0)
+    expect.soft(counts.getProjects).toBe(0)
+    expect.soft(counts.getFolderWorkspaces).toBe(0)
+    expect.soft(vi.mocked(buildProjectGroupChildIndex)).not.toHaveBeenCalled()
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'still refuses a directory symlink that escapes every allowed root',
+    async () => {
+      const outsideDir = join(outsideRoot, 'nested')
+      await mkdir(outsideDir)
+      await writeFile(join(outsideDir, 'file.txt'), 'secret\n')
+      const escape = join(repoRoot, 'escape-dir')
+      await symlink(outsideDir, escape)
+
+      await expect(resolveAuthorizedPath(join(escape, 'file.txt'), store)).rejects.toThrow(
+        'Access denied'
+      )
+    }
+  )
+})
diff --git a/src/main/ipc/filesystem-allowed-roots.ts b/src/main/ipc/filesystem-allowed-roots.ts
index 3cb7fe4fa55..cef249430c6 100644
--- a/src/main/ipc/filesystem-allowed-roots.ts
+++ b/src/main/ipc/filesystem-allowed-roots.ts
@@ -1,9 +1,16 @@
 import { resolve } from 'node:path'
 import type { Store } from '../persistence'
 import { computeWorkspaceRoot, getWorktreePathSettings } from './worktree-logic'
-import { getWorktreeMirrorDistro } from '../project-runtime-git-options'
+import {
+  getWorktreeMirrorDistroForRuntime,
+  resolveLocalProjectRuntimesForRepos
+} from '../project-runtime-git-options'
 import { isPathInsideOrEqual } from '../../shared/cross-platform-path'
-import { getProjectGroupSubtreeIds } from '../../shared/project-groups'
+import {
+  buildProjectGroupChildIndex,
+  collectProjectGroupSubtreeIds,
+  type ProjectGroupChildIndex
+} from '../../shared/project-groups'
 import type { FolderWorkspace } from '../../shared/folder-workspace-types'
 import type { ProjectGroup } from '../../shared/project-group-types'
 import type { Repo } from '../../shared/repo-types'
@@ -11,18 +18,22 @@ import type { Repo } from '../../shared/repo-types'
 type FolderScopeStore = Pick<Store, 'getRepos'> &
   Partial<Pick<Store, 'getProjectGroups' | 'getFolderWorkspaces'>>
 
+// Why: SSH repo paths are remote-host paths; treating them as local roots could authorize unrelated local folders or probe SSH-only paths.
+function filterLocalRepos(repos: readonly Repo[]): Repo[] {
+  return repos.filter((repo) => !repo.connectionId)
+}
+
 export function getLocalRepos(store: Store) {
-  // Why: SSH repo paths are remote-host paths; treating them as local roots could authorize unrelated local folders or probe SSH-only paths.
-  return store.getRepos().filter((repo) => !repo.connectionId)
+  return filterLocalRepos(store.getRepos())
 }
 
 function getFolderScopeCandidateRepos(
   folderPath: string,
   projectGroupId: string,
-  projectGroups: readonly ProjectGroup[],
+  childGroupIndex: ProjectGroupChildIndex,
   repos: readonly Repo[]
 ): Repo[] {
-  const groupIds = getProjectGroupSubtreeIds(projectGroups, projectGroupId)
+  const groupIds = collectProjectGroupSubtreeIds(childGroupIndex, projectGroupId)
   return repos.filter(
     (repo) =>
       (typeof repo.projectGroupId === 'string' && groupIds.has(repo.projectGroupId)) ||
@@ -34,13 +45,18 @@ function isRemoteOnlyFolderScope(
   folderPath: string,
   projectGroupId: string,
   connectionId: string | null | undefined,
-  projectGroups: readonly ProjectGroup[],
+  childGroupIndex: ProjectGroupChildIndex,
   repos: readonly Repo[]
 ): boolean {
   if (connectionId) {
     return true
   }
-  const candidates = getFolderScopeCandidateRepos(folderPath, projectGroupId, projectGroups, repos)
+  const candidates = getFolderScopeCandidateRepos(
+    folderPath,
+    projectGroupId,
+    childGroupIndex,
+    repos
+  )
   return candidates.length > 0 && candidates.every((repo) => Boolean(repo.connectionId))
 }
 
@@ -55,16 +71,22 @@ function getFolderWorkspaceConnectionId(
   )
 }
 
-function getLocalFolderScopeRoots(store: Store): string[] {
+function getLocalFolderScopeRoots(store: Store, repos: readonly Repo[]): string[] {
   const scopeStore = store as FolderScopeStore
-  const repos = scopeStore.getRepos()
   // Why: many filesystem tests use narrow Store doubles; folder scopes are additive.
   const projectGroups = scopeStore.getProjectGroups?.() ?? []
+  const childGroupIndex = buildProjectGroupChildIndex(projectGroups)
   const roots: string[] = []
   for (const group of projectGroups) {
     if (
       group.parentPath &&
-      !isRemoteOnlyFolderScope(group.parentPath, group.id, group.connectionId, projectGroups, repos)
+      !isRemoteOnlyFolderScope(
+        group.parentPath,
+        group.id,
+        group.connectionId,
+        childGroupIndex,
+        repos
+      )
     ) {
       roots.push(resolve(group.parentPath))
     }
@@ -75,7 +97,7 @@ function getLocalFolderScopeRoots(store: Store): string[] {
         workspace.folderPath,
         workspace.projectGroupId,
         getFolderWorkspaceConnectionId(workspace, projectGroups),
-        projectGroups,
+        childGroupIndex,
         repos
       )
     ) {
@@ -86,16 +108,19 @@ function getLocalFolderScopeRoots(store: Store): string[] {
 }
 
 export function getAllowedRoots(store: Store): string[] {
-  const localRepos = getLocalRepos(store)
+  // Why one read: `getRepos` rehydrates every repo, and this runs twice per filesystem IPC.
+  const repos = store.getRepos()
+  const localRepos = filterLocalRepos(repos)
   const settings = store.getSettings()
   const roots = [
     ...localRepos.map((repo) => resolve(repo.path)),
-    ...getLocalFolderScopeRoots(store)
+    ...getLocalFolderScopeRoots(store, repos)
   ]
   if (settings.workspaceDir) {
     if (localRepos.length === 0) {
       roots.push(resolve(settings.workspaceDir))
     } else {
+      const projectRuntimeByRepoId = resolveLocalProjectRuntimesForRepos(store, localRepos)
       for (const repo of localRepos) {
         roots.push(
           resolve(
@@ -104,7 +129,11 @@ export function getAllowedRoots(store: Store): string[] {
               // Why enriched here too: placement has to agree with the create
               // flow, or renderer file access is denied for a worktree Orca
               // just put on the WSL side.
-              getWorktreePathSettings(repo, settings, getWorktreeMirrorDistro(store, repo))
+              getWorktreePathSettings(
+                repo,
+                settings,
+                getWorktreeMirrorDistroForRuntime(projectRuntimeByRepoId.get(repo.id))
+              )
             )
           )
         )
diff --git a/src/main/ipc/filesystem-auth.ts b/src/main/ipc/filesystem-auth.ts
index 122617845ed..894e39945c1 100644
--- a/src/main/ipc/filesystem-auth.ts
+++ b/src/main/ipc/filesystem-auth.ts
@@ -43,7 +43,24 @@ export function authorizeExternalPath(targetPath: string): void {
   } catch {}
 }
 
-export function isPathAllowed(targetPath: string, store: Store): boolean {
+/**
+ * One allowed-root list shared by every check in a single authorization.
+ *
+ * Lazy so a path already covered by an external grant still builds nothing at all, the way it did
+ * before the list was hoisted out of the individual checks.
+ */
+type AllowedRootsSnapshot = { get: () => readonly string[] }
+
+function createAllowedRootsSnapshot(store: Store): AllowedRootsSnapshot {
+  let roots: readonly string[] | undefined
+  return { get: () => (roots ??= getAllowedRoots(store)) }
+}
+
+export function isPathAllowed(
+  targetPath: string,
+  store: Store,
+  allowedRoots?: AllowedRootsSnapshot
+): boolean {
   const resolvedTarget = resolve(targetPath)
   if (authorizedExternalPaths.has(resolvedTarget)) {
     return true
@@ -53,7 +70,9 @@ export function isPathAllowed(targetPath: string, store: Store): boolean {
       return true
     }
   }
-  return getAllowedRoots(store).some((root) => isDescendantOrEqual(resolvedTarget, root))
+  return (allowedRoots?.get() ?? getAllowedRoots(store)).some((root) =>
+    isDescendantOrEqual(resolvedTarget, root)
+  )
 }
 
 export type ResolveAuthorizedPathOptions = {
@@ -69,7 +88,10 @@ export async function resolveAuthorizedPath(
   options: ResolveAuthorizedPathOptions = {}
 ): Promise<string> {
   const resolvedTarget = resolve(targetPath)
-  if (!(await isPathAllowedIncludingRegisteredWorktrees(resolvedTarget, store))) {
+  // Why: the roots depend only on store state, not on the candidate path, so one snapshot serves
+  // every authorization below; each candidate is still checked against it in full.
+  const allowedRoots = createAllowedRootsSnapshot(store)
+  if (!(await isPathAllowedIncludingRegisteredWorktrees(resolvedTarget, store, { allowedRoots }))) {
     throw new Error(PATH_ACCESS_DENIED_MESSAGE)
   }
 
@@ -80,14 +102,15 @@ export async function resolveAuthorizedPath(
       realParent = await realpath(dirname(resolvedTarget))
     } catch (error) {
       if (isENOENT(error)) {
-        return resolveAuthorizedMissingPath(resolvedTarget, store)
+        return resolveAuthorizedMissingPath(resolvedTarget, store, allowedRoots)
       }
       throw error
     }
     const candidateTarget = resolve(realParent, basename(resolvedTarget))
     if (
       !(await isPathAllowedIncludingRegisteredWorktrees(candidateTarget, store, {
-        canonicalSourcePath: resolvedTarget
+        canonicalSourcePath: resolvedTarget,
+        allowedRoots
       }))
     ) {
       throw new Error(PATH_ACCESS_DENIED_MESSAGE)
@@ -100,7 +123,8 @@ export async function resolveAuthorizedPath(
     const realTarget = resolve(await realpath(resolvedTarget))
     if (
       !(await isPathAllowedIncludingRegisteredWorktrees(realTarget, store, {
-        canonicalSourcePath: resolvedTarget
+        canonicalSourcePath: resolvedTarget,
+        allowedRoots
       }))
     ) {
       throw new Error(PATH_ACCESS_DENIED_MESSAGE)
@@ -110,11 +134,15 @@ export async function resolveAuthorizedPath(
     if (!isENOENT(error)) {
       throw error
     }
-    return resolveAuthorizedMissingPath(resolvedTarget, store)
+    return resolveAuthorizedMissingPath(resolvedTarget, store, allowedRoots)
   }
 }
 
-async function resolveAuthorizedMissingPath(resolvedTarget: string, store: Store): Promise<string> {
+async function resolveAuthorizedMissingPath(
+  resolvedTarget: string,
+  store: Store,
+  allowedRoots: AllowedRootsSnapshot
+): Promise<string> {
   let existingAncestor = resolvedTarget
   const missingSegments: string[] = []
 
@@ -124,7 +152,8 @@ async function resolveAuthorizedMissingPath(resolvedTarget: string, store: Store
       const candidateTarget = resolve(realAncestor, ...missingSegments)
       if (
         !(await isPathAllowedIncludingRegisteredWorktrees(candidateTarget, store, {
-          canonicalSourcePath: resolvedTarget
+          canonicalSourcePath: resolvedTarget,
+          allowedRoots
         }))
       ) {
         throw new Error(PATH_ACCESS_DENIED_MESSAGE)
@@ -148,9 +177,9 @@ async function resolveAuthorizedMissingPath(resolvedTarget: string, store: Store
 async function isPathAllowedIncludingRegisteredWorktrees(
   targetPath: string,
   store: Store,
-  options: { canonicalSourcePath?: string } = {}
+  options: { canonicalSourcePath?: string; allowedRoots?: AllowedRootsSnapshot } = {}
 ): Promise<boolean> {
-  if (isPathAllowed(targetPath, store)) {
+  if (isPathAllowed(targetPath, store, options.allowedRoots)) {
     return true
   }
 
@@ -158,7 +187,14 @@ async function isPathAllowedIncludingRegisteredWorktrees(
     return true
   }
 
-  if (await isPathAllowedByCanonicalAllowedRoot(targetPath, options.canonicalSourcePath, store)) {
+  if (
+    await isPathAllowedByCanonicalAllowedRoot(
+      targetPath,
+      options.canonicalSourcePath,
+      store,
+      options.allowedRoots
+    )
+  ) {
     return true
   }
 
@@ -178,12 +214,13 @@ async function isPathAllowedIncludingRegisteredWorktrees(
 async function isPathAllowedByCanonicalAllowedRoot(
   targetPath: string,
   sourcePath: string | undefined,
-  store: Store
+  store: Store,
+  allowedRoots?: AllowedRootsSnapshot
 ): Promise<boolean> {
   if (!sourcePath) {
     return false
   }
-  for (const root of getAllowedRoots(store)) {
+  for (const root of allowedRoots?.get() ?? getAllowedRoots(store)) {
     const resolvedRoot = resolve(root)
     if (!isDescendantOrEqual(sourcePath, resolvedRoot)) {
       continue
diff --git a/src/main/project-runtime-git-options.ts b/src/main/project-runtime-git-options.ts
index 808d31d5fcf..20aa0e9659a 100644
--- a/src/main/project-runtime-git-options.ts
+++ b/src/main/project-runtime-git-options.ts
@@ -102,7 +102,12 @@ export function getWorktreeMirrorDistro(
   store: ProjectRuntimeResolutionStore,
   repo: Repo
 ): string | undefined {
-  const projectRuntime = resolveLocalProjectRuntimeForRepo(store, repo)
+  return getWorktreeMirrorDistroForRuntime(resolveLocalProjectRuntimeForRepo(store, repo))
+}
+
+export function getWorktreeMirrorDistroForRuntime(
+  projectRuntime: ProjectExecutionRuntimeResolution | undefined
+): string | undefined {
   if (!projectRuntime || projectRuntime.status !== 'resolved') {
     return undefined
   }
diff --git a/src/shared/project-groups.ts b/src/shared/project-groups.ts
index 67c2897ead6..c4fe8badb47 100644
--- a/src/shared/project-groups.ts
+++ b/src/shared/project-groups.ts
@@ -109,10 +109,12 @@ export function clearMissingProjectGroupMemberships(repos: Repo[], groups: Proje
   )
 }
 
-export function getProjectGroupSubtreeIds(
-  groups: readonly Pick<ProjectGroup, 'id' | 'parentGroupId'>[],
-  rootGroupId: string
-): Set<string> {
+export type ProjectGroupChildIndex = ReadonlyMap<string, string[]>
+
+/** Build once and reuse when collecting subtrees for more than one root. */
+export function buildProjectGroupChildIndex(
+  groups: readonly Pick<ProjectGroup, 'id' | 'parentGroupId'>[]
+): ProjectGroupChildIndex {
   const childGroupsByParentId = new Map<string, string[]>()
   for (const group of groups) {
     if (!group.parentGroupId) {
@@ -122,7 +124,20 @@ export function getProjectGroupSubtreeIds(
     children.push(group.id)
     childGroupsByParentId.set(group.parentGroupId, children)
   }
+  return childGroupsByParentId
+}
 
+export function getProjectGroupSubtreeIds(
+  groups: readonly Pick<ProjectGroup, 'id' | 'parentGroupId'>[],
+  rootGroupId: string
+): Set<string> {
+  return collectProjectGroupSubtreeIds(buildProjectGroupChildIndex(groups), rootGroupId)
+}
+
+export function collectProjectGroupSubtreeIds(
+  childGroupsByParentId: ProjectGroupChildIndex,
+  rootGroupId: string
+): Set<string> {
   const subtreeIds = new Set<string>()
   const pending = [rootGroupId]
   while (pending.length > 0) {

From 79d5fb469a31f0fce51fe360bb894ac2f9d7b121 Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 01:23:54 -0400
Subject: [PATCH 03/58] fix(cloud): recalibrate the relay monitor's
 postgres-retry freeze to a measured bar (#18580)

The global relay_cells FOR UPDATE lock made successful retries a
steady-state rate: fleet-wide p50 430 / p90 924 / p99 1320 / max 1504
per five minutes over the last 24 h, 55% of windows over the 300 bar,
only 22% of 15-minute gates clean. Three read-only dry-runs on
2026-09-04 froze on it, blocking the same-cap roll that carries #18521
and the beginProof crash guard to the 23 cells. 2000 clears every
measured healthy gate; the exhausted-retry, director concurrency, and
pool bars keep the incident discriminator role.
---
 .../relay-ops/src/incident-monitor.test.ts    | 17 +++++++++------
 cloud/apps/relay-ops/src/incident-monitor.ts  | 21 +++++++++++++------
 cloud/docs/relay-incident-monitor.md          | 16 +++++++++++++-
 3 files changed, 41 insertions(+), 13 deletions(-)

diff --git a/cloud/apps/relay-ops/src/incident-monitor.test.ts b/cloud/apps/relay-ops/src/incident-monitor.test.ts
index 61a73b64dbe..4e1da9fab26 100644
--- a/cloud/apps/relay-ops/src/incident-monitor.test.ts
+++ b/cloud/apps/relay-ops/src/incident-monitor.test.ts
@@ -111,14 +111,19 @@ describe('incident monitor evaluator', () => {
     })
   })
 
-  it('freezes when postgres retries exceed the recalibrated ceiling', () => {
-    const sample = healthySample()
-    sample.sources['relay-logs']!.signals['relay.postgres_retries'] =
-      signal(INCIDENT_MONITOR_THRESHOLDS.relayPostgresRetries + 1)
-    expect(evaluateIncidentSample(sample, startedAt)).toMatchObject({
+  // Why: the global relay_cells lock made retries a steady-state rate (24 h p99
+  // 1320/5min on 2026-09-04); the bar fences only unbounded growth beyond that.
+  it('tolerates the measured healthy retry rate and freezes above the bar', () => {
+    const healthy = healthySample()
+    healthy.sources['relay-logs']!.signals['relay.postgres_retries'] = signal(1504)
+    expect(evaluateIncidentSample(healthy, startedAt).status).toBe('green')
+
+    const incident = healthySample()
+    incident.sources['relay-logs']!.signals['relay.postgres_retries'] = signal(2001)
+    expect(evaluateIncidentSample(incident, startedAt)).toMatchObject({
       status: 'freeze',
       failures: [
-        expect.objectContaining({ signal: 'relay.postgres_retries', threshold: 300 })
+        expect.objectContaining({ signal: 'relay.postgres_retries', threshold: 2000 })
       ]
     })
   })
diff --git a/cloud/apps/relay-ops/src/incident-monitor.ts b/cloud/apps/relay-ops/src/incident-monitor.ts
index 868bb86fb93..a121568d918 100644
--- a/cloud/apps/relay-ops/src/incident-monitor.ts
+++ b/cloud/apps/relay-ops/src/incident-monitor.ts
@@ -32,11 +32,20 @@ export const INCIDENT_MONITOR_THRESHOLDS = {
   relayPoolWaiting: 800,
   relayPoolWaitMs: 2_500,
   // Why: successful lock retries are the contention machinery working, not harm.
-  // Healthy 2026-08-26 baseline bursts to 234/5min (26% of windows crossed the old
-  // bar of 20, set unmeasured at the monitor's 2026-07-28 birth); the 2026-08-23
-  // incident ran ~2,200-3,000/5min. 300 clears healthy bursts with ~10x incident
-  // margin; relayPostgresRetryExhausted below bounds the terminally failed share.
-  relayPostgresRetries: 300,
+  // Recalibrated 2026-09-04 from 300, which was set 2026-08-26 when healthy bursts
+  // reached 234/5min. The global relay_cells FOR UPDATE lock has since become the
+  // fleet's steady state: measured fleet-wide (director + cells, summed per five
+  // minutes) 2026-09-03T05Z..2026-09-04T05Z p50 430 / p90 924 / p99 1320 / max
+  // 1504, with 55% of windows over 300 and only 22% of 15-minute gates clean, so
+  // the bar blocked the very cell roll that carries the 500 ms lock wait (#18521)
+  // and the beginProof crash guard to the cells. The 2026-08-23 lock incident on
+  // this same metric peaked at 1510 in one window and 646 in the next, so it is
+  // not separable from today's contention by retries alone; it is caught by
+  // relayPostgresRetryExhausted (467 at the peak vs a 300 bar), director
+  // concurrency, and the pool bars. 2000 passes every healthy 15-minute window
+  // measured in the last 24 h and still fences unbounded growth. Re-tighten once
+  // the fleet is on the 500 ms lock wait and the baseline is re-measured.
+  relayPostgresRetries: 2000,
   // Why: 300 per five minutes, recalibrated 2026-09-04 from a bar of zero that no
   // production window has cleared since #18521 shipped to the director. That
   // change cut the request-path cell-inventory wait from the 1 s pool lock_timeout
@@ -48,7 +57,7 @@ export const INCIDENT_MONITOR_THRESHOLDS = {
   // quiet hours p50 2 / max 36; pre-#18521 daytime p50 10 / p90 25 / max 87;
   // post-#18521 p50 42 / p90 147 / max 220. The 2026-08-23 lock incident peaked
   // at 467. 300 clears every measured healthy window and still sits below the
-  // incident shape; relayPostgresRetries above stays the ~10x discriminator.
+  // incident shape; retries above fence only unbounded growth.
   // User-facing /v1/assign 503 share did not move with #18521 (13.9% old image
   // vs 12.3% new, same evening), so exhaustion is not a proxy for user harm.
   relayPostgresRetryExhausted: 300,
diff --git a/cloud/docs/relay-incident-monitor.md b/cloud/docs/relay-incident-monitor.md
index 337d3f1b20f..5c563f6a2e2 100644
--- a/cloud/docs/relay-incident-monitor.md
+++ b/cloud/docs/relay-incident-monitor.md
@@ -99,7 +99,7 @@ durably marked consumed before mutation and cannot authorize another run.
 | Cloud SQL deadlocks | over 0 |
 | Relay pool waiters | over 800 |
 | Relay pool wait | over 2,500 ms |
-| PostgreSQL retries in five minutes | over 300 |
+| PostgreSQL retries in five minutes | over 2,000 |
 | Exhausted PostgreSQL retries in five minutes | over 300 |
 | Director instances | outside 5–6 |
 | Director CPU or memory | over 80% |
@@ -139,6 +139,20 @@ heartbeats, and matching live admission.
   logs: healthy-day bursts reach 234/5min with zero exhausted retries and 26%
   of five-minute windows over 20, while the 2026-08-23 lock-contention
   incident ran roughly 2,200–3,000/5min.
+- Recalibrated the PostgreSQL-retry freeze from 300 to 2,000 per five minutes
+  (2026-09-04). Basis: the global `relay_cells FOR UPDATE` lock made
+  successful retries a steady-state rate. Measured fleet-wide (director +
+  cells, summed per five minutes from the `orca_relay_postgres_retries`
+  log metric) over 2026-09-03T05Z..2026-09-04T05Z: p50 430 / p90 924 /
+  p99 1,320 / max 1,504; 55% of windows over 300; only 22% of 15-minute gates
+  clean at 300 versus 100% at 2,000. Three read-only dry-runs on 2026-09-04
+  froze on this bar (runs 33836470590, 33838698725) or on a genuine six-cell
+  crash storm (33837160275), blocking the same-cap roll that carries #18521
+  and the `beginProof` crash guard to the 23 cells. The 2026-08-23 incident
+  on this metric peaked at 1,510 then 646, so retries alone no longer
+  separate it from today's baseline; the exhausted-retry bar (incident peak
+  467 vs bar 300), director concurrency, and the pool bars carry that role.
+  Re-tighten after the fleet is on the 500 ms lock wait.
 - Recalibrated the exhausted-PostgreSQL-retry freeze from 0 to 300 per five
   minutes (2026-09-04). Basis: #18521 cut the request-path cell-inventory
   lock wait from the 1 s pool `lock_timeout` to 500 ms, so contended waiters

From b378101901d8062765ec81faa88addf6ad037d94 Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 01:40:55 -0400
Subject: [PATCH 04/58] docs(cloud): reconcile the 2026-08-23 retry figure with
 the gate metric (#18581)

---
 cloud/docs/relay-incident-monitor.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cloud/docs/relay-incident-monitor.md b/cloud/docs/relay-incident-monitor.md
index 5c563f6a2e2..870c95dd413 100644
--- a/cloud/docs/relay-incident-monitor.md
+++ b/cloud/docs/relay-incident-monitor.md
@@ -138,7 +138,9 @@ heartbeats, and matching live admission.
   `jsonPayload.event="orca_relay_postgres_transaction_retry"` in production
   logs: healthy-day bursts reach 234/5min with zero exhausted retries and 26%
   of five-minute windows over 20, while the 2026-08-23 lock-contention
-  incident ran roughly 2,200–3,000/5min.
+  incident ran roughly 2,200–3,000/5min by raw log-line count (the gate's
+  own `orca_relay_postgres_retries` metric read 1,510 for that window; see the
+  2026-09-04 entry).
 - Recalibrated the PostgreSQL-retry freeze from 300 to 2,000 per five minutes
   (2026-09-04). Basis: the global `relay_cells FOR UPDATE` lock made
   successful retries a steady-state rate. Measured fleet-wide (director +

From 561a94038c3ab550be22bbf680f15e06b6afd7dc Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 00:06:09 -0700
Subject: [PATCH 05/58] fix(ssh): stop the daemon's own services from blocking
 the superseded-relay reap (#18586)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`isReapableRelayHusk` required `childCount === 0`, where `childCount` came from
`pgrep -P <relay> | grep -c .`. But the relay forks service children of its own,
and `relay-ai-vault-service.js` never exits once spawned. Any relay that had
served a single AI Vault request therefore reported a non-zero child count
forever, so the sweep answered `retained-live-work` for a superseded,
disconnected relay holding no user work at all — and its version directory
stayed pinned against GC by its own live socket.

The probe now censuses each direct child instead of counting them, and the reap
gate reads the count of children it could *not* positively identify as relay
infrastructure. The asymmetry is the safety argument
(docs/reference/ssh-execution-boundary.md): subtracting a child we can name is
positive knowledge, assuming about one we cannot is not. An unrecognised argv,
an argv `ps` would not print, and a host without `pgrep` all keep the relay
unreapable. `reapEmptyRelayHuskCommand` re-runs the same census on the host
immediately before signalling.

Fixes #13614
---
 src/main/ssh/relay-daemon-service-children.ts |  62 +++++++++
 ...dpoint-incumbent-shell.integration.test.ts | 118 ++++++++++++++++--
 .../ssh/ssh-relay-endpoint-incumbent.test.ts  |  64 +++++++---
 src/main/ssh/ssh-relay-endpoint-incumbent.ts  |  47 +++++--
 .../ssh/ssh-relay-endpoint-takeover.test.ts   |  29 +++--
 src/main/ssh/ssh-relay-endpoint-takeover.ts   |  15 ++-
 .../ssh-relay-superseded-endpoints.test.ts    |  10 +-
 src/shared/relay-artifacts.ts                 |  18 ++-
 8 files changed, 307 insertions(+), 56 deletions(-)
 create mode 100644 src/main/ssh/relay-daemon-service-children.ts

diff --git a/src/main/ssh/relay-daemon-service-children.ts b/src/main/ssh/relay-daemon-service-children.ts
new file mode 100644
index 00000000000..35e755ea518
--- /dev/null
+++ b/src/main/ssh/relay-daemon-service-children.ts
@@ -0,0 +1,62 @@
+/**
+ * Telling a relay daemon's own service processes apart from the work it holds.
+ *
+ * The reap gate used to ask `pgrep -P <relay> | grep -c .` and demand zero. But the daemon
+ * forks service children of its own — `relay-ai-vault-service.js` is spawned lazily and then
+ * never exits — so that count is permanently non-zero on any relay that has touched the AI
+ * Vault, whether or not it holds a single PTY. A superseded, disconnected relay holding
+ * nothing therefore reported `retained-live-work` forever, its version directory stayed
+ * pinned against GC by its own live socket, and the population grew without bound (#13614).
+ *
+ * The asymmetry below is the whole safety argument, and it follows
+ * docs/reference/ssh-execution-boundary.md: *subtracting a child we can positively identify
+ * as relay infrastructure is sound; assuming anything about a child we cannot identify is
+ * not.* An argv that does not match, an argv `ps` would not print, and a host without
+ * `pgrep` all count against the relay and keep it unreapable. Losing sight of a child is
+ * never evidence that it holds nothing.
+ */
+import { RELAY_DAEMON_SERVICE_ENTRY_FILENAMES } from '../../shared/relay-artifacts'
+import { shellEscape } from './ssh-connection-utils'
+
+/** Shell variable set to the daemon's direct-child count, or `unknown`. */
+export const RELAY_CHILD_COUNT_VAR = 'kids'
+
+/** Shell variable set to the count of children not identified as relay services, or `unknown`. */
+export const RELAY_UNRECOGNIZED_CHILD_COUNT_VAR = 'unrecognized_kids'
+
+/**
+ * `case` patterns matching a service child's argv. Suffix-anchored on purpose: both entries
+ * are forked with no script arguments, so the argv ends at the filename, and the leading `/`
+ * requires the absolute path the daemon forks rather than a bare mention of the name. A
+ * future arg would stop matching and the relay would go back to being retained — the safe
+ * direction to fail in.
+ */
+function serviceChildArgvPatterns(): string {
+  return RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.map(
+    (filename) => `*${shellEscape(`/${filename}`)}`
+  ).join('|')
+}
+
+/**
+ * POSIX shell that censuses the direct children of `$pid`, setting `kids` and
+ * `unrecognized_kids`. Both stay `unknown` when the host cannot enumerate children at all.
+ */
+export function relayDaemonChildCensusShell(): string[] {
+  return [
+    `${RELAY_CHILD_COUNT_VAR}=unknown`,
+    `${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}=unknown`,
+    'if command -v pgrep >/dev/null 2>&1; then',
+    `  ${RELAY_CHILD_COUNT_VAR}=0`,
+    `  ${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}=0`,
+    '  for kid in $(pgrep -P "$pid" 2>/dev/null); do',
+    `    ${RELAY_CHILD_COUNT_VAR}=$((${RELAY_CHILD_COUNT_VAR}+1))`,
+    '    kid_args=$(ps -o args= -p "$kid" 2>/dev/null | tr -d "\\n")',
+    '    case "$kid_args" in',
+    `      ${serviceChildArgvPatterns()}) ;;`,
+    // An unreadable or unrecognised argv lands here, which is what keeps the relay retained.
+    `      *) ${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}=$((${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}+1)) ;;`,
+    '    esac',
+    '  done',
+    'fi'
+  ]
+}
diff --git a/src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts b/src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts
index 7ece0b6532e..a8975d0520b 100644
--- a/src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts
+++ b/src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts
@@ -4,7 +4,7 @@
  * generated scripts through /bin/sh against real unix sockets and real processes.
  */
 import { execFile, spawn, type ChildProcess } from 'node:child_process'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest'
@@ -15,21 +15,32 @@ import {
   type RelayEndpointIncumbent
 } from './ssh-relay-endpoint-incumbent'
 import { reapEmptyRelayHuskCommand } from './ssh-relay-endpoint-takeover'
+import { RELAY_DAEMON_SERVICE_ENTRY_FILENAMES } from '../../shared/relay-artifacts'
 
 const posixOnly = process.platform === 'win32' ? describe.skip : describe
 
 const FAKE_RELAY_SOURCE = `
 const net = require('net')
+const path = require('path')
 const sock = process.argv[process.argv.indexOf('--sock-path') + 1]
+function spawnChild(args) {
+  require('child_process').spawn(process.execPath, args, { stdio: 'ignore' })
+}
 if (process.argv.includes('--with-child')) {
-  require('child_process').spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], {
-    stdio: 'ignore'
-  })
+  spawnChild(['-e', 'setTimeout(() => {}, 60000)'])
+}
+// Why forked the same way production does: the exclusion is argv-shaped, so a hand-written
+// stand-in would test the test rather than the shell that runs on someone's host.
+for (const name of process.argv.filter((arg) => arg.startsWith('--service-child='))) {
+  spawnChild([path.join(__dirname, name.slice('--service-child='.length))])
 }
 net.createServer(() => {}).listen(sock, () => process.stdout.write('READY\\n'))
 process.on('SIGTERM', () => process.exit(0))
 `
 
+// Self-limiting: these are orphaned when the relay under test is reaped.
+const IDLE_SERVICE_SOURCE = 'setTimeout(() => {}, 60000)\n'
+
 function sh(script: string): Promise<string> {
   return new Promise((resolve, reject) => {
     execFile('/bin/sh', ['-c', script], { timeout: 20_000 }, (error, stdout) => {
@@ -43,14 +54,21 @@ function sh(script: string): Promise<string> {
 }
 
 let workDir: string
+let pgreplessBinDir: string
 let hasLsof = false
 const running: ChildProcess[] = []
 
-function startFakeRelay(sockPath: string, withChild = false): Promise<ChildProcess> {
+function startFakeRelay(
+  sockPath: string,
+  options: { withChild?: boolean; serviceChildren?: readonly string[] } = {}
+): Promise<ChildProcess> {
   const args = [join(workDir, 'relay.js'), '--sock-path', sockPath]
-  if (withChild) {
+  if (options.withChild) {
     args.push('--with-child')
   }
+  for (const name of options.serviceChildren ?? []) {
+    args.push(`--service-child=${name}`)
+  }
   const child = spawn(process.execPath, args, { stdio: ['ignore', 'pipe', 'ignore'] })
   running.push(child)
   return new Promise((resolve, reject) => {
@@ -68,9 +86,31 @@ async function probe(sockPath: string): Promise<RelayEndpointIncumbent> {
   return parseRelayEndpointIncumbentProbe(sockPath, output)
 }
 
+/** The relay forks its children after it starts listening, so the probe can race them. */
+async function waitForChildCount(
+  sockPath: string,
+  expected: number
+): Promise<RelayEndpointIncumbent> {
+  let incumbent = await probe(sockPath)
+  for (let attempt = 0; attempt < 50 && incumbent.holders[0]?.childCount !== expected; attempt++) {
+    await new Promise((resolve) => setTimeout(resolve, 100))
+    incumbent = await probe(sockPath)
+  }
+  return incumbent
+}
+
 beforeAll(async () => {
   workDir = mkdtempSync(join(tmpdir(), 'orca-relay-incumbent-'))
   writeFileSync(join(workDir, 'relay.js'), FAKE_RELAY_SOURCE)
+  for (const filename of RELAY_DAEMON_SERVICE_ENTRY_FILENAMES) {
+    writeFileSync(join(workDir, filename), IDLE_SERVICE_SOURCE)
+  }
+  writeFileSync(join(workDir, 'looks-like-relay-watcher.js'), IDLE_SERVICE_SOURCE)
+  pgreplessBinDir = join(workDir, 'pgrepless-bin')
+  mkdirSync(pgreplessBinDir)
+  for (const tool of ['ps', 'tr']) {
+    symlinkSync((await sh(`command -v ${tool}`)).trim(), join(pgreplessBinDir, tool))
+  }
   hasLsof = await sh('command -v lsof >/dev/null 2>&1 && echo yes || echo no').then(
     (out) => out.trim() === 'yes'
   )
@@ -105,13 +145,51 @@ posixOnly('relay endpoint probe against a real socket', () => {
       return
     }
     expect(incumbent.holders.map((holder) => holder.pid)).toEqual([relay.pid])
-    expect(incumbent.holders[0]).toMatchObject({ matchesRelayArgv: true, childCount: 0 })
+    expect(incumbent.holders[0]).toMatchObject({
+      matchesRelayArgv: true,
+      childCount: 0,
+      unrecognizedChildCount: 0
+    })
     expect(isReapableRelayHusk(incumbent)).toBe(true)
   })
 
+  it("counts the daemon's own service children but does not hold them against it", async () => {
+    const sockPath = join(workDir, 'services.sock')
+    await startFakeRelay(sockPath, { serviceChildren: RELAY_DAEMON_SERVICE_ENTRY_FILENAMES })
+    const incumbent = await waitForChildCount(sockPath, RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.length)
+
+    expect(incumbent.holders[0].childCount).toBe(RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.length)
+    expect(incumbent.holders[0].unrecognizedChildCount).toBe(0)
+    expect(isReapableRelayHusk(incumbent)).toBe(true)
+  })
+
+  it('still retains a relay holding work alongside its service children', async () => {
+    const sockPath = join(workDir, 'services-and-work.sock')
+    await startFakeRelay(sockPath, {
+      withChild: true,
+      serviceChildren: RELAY_DAEMON_SERVICE_ENTRY_FILENAMES
+    })
+    const incumbent = await waitForChildCount(
+      sockPath,
+      RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.length + 1
+    )
+
+    expect(incumbent.holders[0].unrecognizedChildCount).toBe(1)
+    expect(isReapableRelayHusk(incumbent)).toBe(false)
+  })
+
+  it('does not excuse a child that merely mentions a service entry name', async () => {
+    const sockPath = join(workDir, 'lookalike.sock')
+    await startFakeRelay(sockPath, { serviceChildren: ['looks-like-relay-watcher.js'] })
+    const incumbent = await waitForChildCount(sockPath, 1)
+
+    expect(incumbent.holders[0].unrecognizedChildCount).toBe(1)
+    expect(isReapableRelayHusk(incumbent)).toBe(false)
+  })
+
   it('refuses to call a relay with a live child an empty husk', async () => {
     const sockPath = join(workDir, 'busy.sock')
-    await startFakeRelay(sockPath, true)
+    await startFakeRelay(sockPath, { withChild: true })
     const incumbent = await probe(sockPath)
 
     expect(incumbent.verdict).toBe('live')
@@ -150,12 +228,34 @@ posixOnly('empty relay husk reap against a real process', () => {
 
   it('refuses to signal a relay that acquired a child after it was probed', async () => {
     const sockPath = join(workDir, 'raced.sock')
-    const relay = await startFakeRelay(sockPath, true)
+    const relay = await startFakeRelay(sockPath, { withChild: true })
     const output = await sh(reapEmptyRelayHuskCommand(relay.pid!, sockPath))
     expect(output.trim()).toBe('BUSY')
     expect(relay.killed).toBe(false)
   })
 
+  it('terminates a relay whose only children are its own service processes (#13614)', async () => {
+    const sockPath = join(workDir, 'service-husk.sock')
+    const relay = await startFakeRelay(sockPath, {
+      serviceChildren: RELAY_DAEMON_SERVICE_ENTRY_FILENAMES
+    })
+    await waitForChildCount(sockPath, RELAY_DAEMON_SERVICE_ENTRY_FILENAMES.length)
+    const output = await sh(reapEmptyRelayHuskCommand(relay.pid!, sockPath))
+    expect(output.trim()).toBe('GONE')
+  })
+
+  it('refuses to signal when the host cannot enumerate children at all', async () => {
+    const sockPath = join(workDir, 'no-pgrep.sock')
+    const relay = await startFakeRelay(sockPath)
+    // A PATH carrying every tool the script needs except `pgrep`: the census answers
+    // `unknown`, which must reach BUSY rather than the zero a missing tool would imply.
+    const output = await sh(
+      `PATH=${pgreplessBinDir}\n${reapEmptyRelayHuskCommand(relay.pid!, sockPath)}`
+    )
+    expect(output.trim()).toBe('BUSY')
+    expect(relay.killed).toBe(false)
+  })
+
   it('refuses to signal a pid whose argv is not this relay at this socket', async () => {
     const sockPath = join(workDir, 'mismatch.sock')
     await startFakeRelay(sockPath)
diff --git a/src/main/ssh/ssh-relay-endpoint-incumbent.test.ts b/src/main/ssh/ssh-relay-endpoint-incumbent.test.ts
index a65cb33fc57..de4cc28d170 100644
--- a/src/main/ssh/ssh-relay-endpoint-incumbent.test.ts
+++ b/src/main/ssh/ssh-relay-endpoint-incumbent.test.ts
@@ -32,17 +32,24 @@ describe('parseRelayEndpointIncumbentProbe', () => {
   it('reports live when the socket accepted a connection', () => {
     const incumbent = parseRelayEndpointIncumbentProbe(
       SOCK,
-      probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=4242 yes 13'])
+      probeOutput([
+        'PRESENT=yes',
+        'LISTEN=accepted',
+        'HOLDERS_SOURCE=lsof',
+        'HOLDER=4242 yes 13 11'
+      ])
     )
     expect(incumbent.verdict).toBe('live')
     expect(incumbent.evidence).toBe('accepted-connection')
-    expect(incumbent.holders).toEqual([{ pid: 4242, matchesRelayArgv: true, childCount: 13 }])
+    expect(incumbent.holders).toEqual([
+      { pid: 4242, matchesRelayArgv: true, childCount: 13, unrecognizedChildCount: 11 }
+    ])
   })
 
   it('reports live when a process still holds an inode that refuses connections', () => {
     const incumbent = parseRelayEndpointIncumbentProbe(
       SOCK,
-      probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof', 'HOLDER=91 yes 2'])
+      probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof', 'HOLDER=91 yes 2 2'])
     )
     expect(incumbent.verdict).toBe('live')
     expect(incumbent.evidence).toBe('holder-process')
@@ -85,7 +92,12 @@ describe('parseRelayEndpointIncumbentProbe', () => {
   it('drops holder lines that do not carry a usable pid', () => {
     const incumbent = parseRelayEndpointIncumbentProbe(
       SOCK,
-      probeOutput(['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof', 'HOLDER=- no unknown'])
+      probeOutput([
+        'PRESENT=yes',
+        'LISTEN=refused',
+        'HOLDERS_SOURCE=lsof',
+        'HOLDER=- no unknown unknown'
+      ])
     )
     expect(incumbent.holders).toEqual([])
     expect(incumbent.verdict).toBe('exited')
@@ -94,9 +106,24 @@ describe('parseRelayEndpointIncumbentProbe', () => {
   it('keeps an unreadable child count as null rather than zero', () => {
     const [holder] = parseRelayEndpointIncumbentProbe(
       SOCK,
-      probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=7 yes unknown'])
+      probeOutput([
+        'PRESENT=yes',
+        'LISTEN=accepted',
+        'HOLDERS_SOURCE=lsof',
+        'HOLDER=7 yes unknown unknown'
+      ])
     ).holders
     expect(holder.childCount).toBeNull()
+    expect(holder.unrecognizedChildCount).toBeNull()
+  })
+
+  it('keeps a holder line with no unrecognized-child field unreapable', () => {
+    const incumbent = parseRelayEndpointIncumbentProbe(
+      SOCK,
+      probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=7 yes 0'])
+    )
+    expect(incumbent.holders[0].unrecognizedChildCount).toBeNull()
+    expect(isReapableRelayHusk(incumbent)).toBe(false)
   })
 })
 
@@ -172,27 +199,36 @@ describe('mayLaunchOverRelayEndpoint', () => {
 describe('isReapableRelayHusk', () => {
   const husk = parseRelayEndpointIncumbentProbe(
     SOCK,
-    probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=500 yes 0'])
+    probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=500 yes 0 0'])
   )
 
-  it('accepts a single proven relay holder with zero children', () => {
+  it('accepts a single proven relay holder with no unaccounted-for children', () => {
     expect(isReapableRelayHusk(husk)).toBe(true)
   })
 
-  it('refuses a relay that still holds children', () => {
+  it('accepts a relay whose only children are its own service processes (#13614)', () => {
+    const withServices = parseRelayEndpointIncumbentProbe(
+      SOCK,
+      probeOutput(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=500 yes 2 0'])
+    )
+    expect(withServices.holders[0].childCount).toBe(2)
+    expect(isReapableRelayHusk(withServices)).toBe(true)
+  })
+
+  it('refuses a relay that still holds children it could not account for', () => {
     expect(
       isReapableRelayHusk({
         ...husk,
-        holders: [{ pid: 500, matchesRelayArgv: true, childCount: 1 }]
+        holders: [{ pid: 500, matchesRelayArgv: true, childCount: 3, unrecognizedChildCount: 1 }]
       })
     ).toBe(false)
   })
 
-  it('refuses a holder whose child count could not be read', () => {
+  it('refuses a holder whose unrecognized-child count could not be read', () => {
     expect(
       isReapableRelayHusk({
         ...husk,
-        holders: [{ pid: 500, matchesRelayArgv: true, childCount: null }]
+        holders: [{ pid: 500, matchesRelayArgv: true, childCount: 0, unrecognizedChildCount: null }]
       })
     ).toBe(false)
   })
@@ -201,7 +237,7 @@ describe('isReapableRelayHusk', () => {
     expect(
       isReapableRelayHusk({
         ...husk,
-        holders: [{ pid: 500, matchesRelayArgv: false, childCount: 0 }]
+        holders: [{ pid: 500, matchesRelayArgv: false, childCount: 0, unrecognizedChildCount: 0 }]
       })
     ).toBe(false)
   })
@@ -211,8 +247,8 @@ describe('isReapableRelayHusk', () => {
       isReapableRelayHusk({
         ...husk,
         holders: [
-          { pid: 500, matchesRelayArgv: true, childCount: 0 },
-          { pid: 501, matchesRelayArgv: true, childCount: 0 }
+          { pid: 500, matchesRelayArgv: true, childCount: 0, unrecognizedChildCount: 0 },
+          { pid: 501, matchesRelayArgv: true, childCount: 0, unrecognizedChildCount: 0 }
         ]
       })
     ).toBe(false)
diff --git a/src/main/ssh/ssh-relay-endpoint-incumbent.ts b/src/main/ssh/ssh-relay-endpoint-incumbent.ts
index 2688267f4c7..628a9558793 100644
--- a/src/main/ssh/ssh-relay-endpoint-incumbent.ts
+++ b/src/main/ssh/ssh-relay-endpoint-incumbent.ts
@@ -20,6 +20,11 @@
  */
 import type { SshConnection } from './ssh-connection'
 import { shellEscape } from './ssh-connection-utils'
+import {
+  RELAY_CHILD_COUNT_VAR,
+  RELAY_UNRECOGNIZED_CHILD_COUNT_VAR,
+  relayDaemonChildCensusShell
+} from './relay-daemon-service-children'
 import { execCommand, isUnconfirmedSshCommandTermination } from './ssh-relay-deploy-helpers'
 import { isWindowsRemoteHost, type RemoteHostPlatform } from './ssh-remote-platform'
 
@@ -38,6 +43,12 @@ export type RelayEndpointHolder = {
   matchesRelayArgv: boolean
   /** Direct children, or null when `pgrep` could not answer. Never guessed. */
   childCount: number | null
+  /**
+   * Direct children *not* positively identified as the daemon's own service processes, or
+   * null when the host could not enumerate them. This — not `childCount` — is what says
+   * whether the relay holds anything; see relay-daemon-service-children.ts.
+   */
+  unrecognizedChildCount: number | null
 }
 
 export type RelayEndpointIncumbent = {
@@ -95,11 +106,9 @@ export function relayEndpointIncumbentProbeCommand(nodePath: string, sockPath: s
     '    args=$(ps -o args= -p "$pid" 2>/dev/null | tr "\\n" " ")',
     '    match=no',
     '    case "$args" in *relay.js*"$sock"*) match=yes ;; esac',
-    '    kids=unknown',
-    '    if command -v pgrep >/dev/null 2>&1; then',
-    '      kids=$(pgrep -P "$pid" 2>/dev/null | grep -c .)',
-    '    fi',
-    '    printf \'HOLDER=%s %s %s\\n\' "$pid" "$match" "$kids"',
+    ...relayDaemonChildCensusShell().map((line) => `    ${line}`),
+    '    printf \'HOLDER=%s %s %s %s\\n\' "$pid" "$match" ' +
+      `"$${RELAY_CHILD_COUNT_VAR}" "$${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}"`,
     '  done',
     'else',
     "  printf 'HOLDERS_SOURCE=unavailable\\n'",
@@ -159,19 +168,25 @@ export function parseRelayEndpointIncumbentProbe(
 }
 
 function parseHolder(value: string): RelayEndpointHolder | null {
-  const [rawPid, rawMatch, rawKids] = value.split(/\s+/)
+  const [rawPid, rawMatch, rawKids, rawUnrecognized] = value.split(/\s+/)
   const pid = Number.parseInt(rawPid ?? '', 10)
   if (!Number.isInteger(pid) || pid <= 0) {
     return null
   }
-  const childCount = Number.parseInt(rawKids ?? '', 10)
   return {
     pid,
     matchesRelayArgv: rawMatch === 'yes',
-    childCount: Number.isInteger(childCount) && childCount >= 0 ? childCount : null
+    childCount: parseChildCount(rawKids),
+    unrecognizedChildCount: parseChildCount(rawUnrecognized)
   }
 }
 
+/** `unknown`, a missing field, and anything unparseable are all "could not tell" — never 0. */
+function parseChildCount(raw: string | undefined): number | null {
+  const count = Number.parseInt(raw ?? '', 10)
+  return Number.isInteger(count) && count >= 0 ? count : null
+}
+
 function unverifiableEndpoint(sockPath: string): RelayEndpointIncumbent {
   return {
     sockPath,
@@ -239,8 +254,12 @@ export function mayLaunchOverRelayEndpoint(incumbent: RelayEndpointIncumbent): b
 
 /**
  * A live relay that provably holds nothing: identity confirmed against its argv, exactly one
- * holder, and zero children. Reaping it destroys no user work. Anything less is retained —
- * killing the wrong pid on someone's remote host is the worst outcome available here.
+ * holder, and no child the host could not account for as one of the daemon's own service
+ * processes. Reaping it destroys no user work. Anything less is retained — killing the wrong
+ * pid on someone's remote host is the worst outcome available here.
+ *
+ * Why not `childCount === 0`: the daemon's AI Vault sidecar never exits once spawned, so that
+ * gate was unreachable for any relay that had ever served a vault request (#13614).
  */
 export function isReapableRelayHusk(incumbent: RelayEndpointIncumbent): boolean {
   if (incumbent.verdict !== 'live' || !incumbent.holdersEnumerable) {
@@ -250,12 +269,16 @@ export function isReapableRelayHusk(incumbent: RelayEndpointIncumbent): boolean
     return false
   }
   const [holder] = incumbent.holders
-  return holder.matchesRelayArgv && holder.childCount === 0
+  return holder.matchesRelayArgv && holder.unrecognizedChildCount === 0
 }
 
 export function describeRelayEndpointIncumbent(incumbent: RelayEndpointIncumbent): string {
   const holders = incumbent.holders
-    .map((holder) => `${holder.pid}(children=${holder.childCount ?? 'unknown'})`)
+    .map(
+      (holder) =>
+        `${holder.pid}(children=${holder.childCount ?? 'unknown'},` +
+        `unrecognized=${holder.unrecognizedChildCount ?? 'unknown'})`
+    )
     .join(',')
   return (
     `${incumbent.sockPath} verdict=${incumbent.verdict} evidence=${incumbent.evidence} ` +
diff --git a/src/main/ssh/ssh-relay-endpoint-takeover.test.ts b/src/main/ssh/ssh-relay-endpoint-takeover.test.ts
index 687d633b92b..d23f065f478 100644
--- a/src/main/ssh/ssh-relay-endpoint-takeover.test.ts
+++ b/src/main/ssh/ssh-relay-endpoint-takeover.test.ts
@@ -14,6 +14,7 @@ import {
   resolveRelayEndpointBeforeRelaunch
 } from './ssh-relay-endpoint-takeover'
 import { RelayVersionMismatchError } from './ssh-relay-version-mismatch-error'
+import { RELAY_DAEMON_SERVICE_ENTRY_FILENAMES } from '../../shared/relay-artifacts'
 import type { SshConnection } from './ssh-connection'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 
@@ -42,7 +43,7 @@ beforeEach(() => {
 describe('incumbent alive and refusing', () => {
   it('refuses to rebind a live relay holding PTYs, and signals nothing', async () => {
     execCommand.mockResolvedValueOnce(
-      probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13'])
+      probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13 11'])
     )
     await expect(resolve()).rejects.toSatisfy(isRelayEndpointHeldError)
     // The whole point of #8585: the incumbent's socket must survive so it is not orphaned.
@@ -52,9 +53,9 @@ describe('incumbent alive and refusing', () => {
 
   it('names the incumbent pid and the Reset Relay escape hatch in the error', async () => {
     execCommand.mockResolvedValue(
-      probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13'])
+      probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13 11'])
     )
-    await expect(resolve()).rejects.toThrow(/3669803\(children=13\)/)
+    await expect(resolve()).rejects.toThrow(/3669803\(children=13,unrecognized=11\)/)
     await expect(resolve()).rejects.toThrow(/Reset Relay/)
   })
 
@@ -70,7 +71,7 @@ describe('incumbent alive and refusing', () => {
   it('reaps a live relay only when it provably holds nothing, and confirms it is gone', async () => {
     execCommand
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('GONE\n')
     await expect(resolve()).resolves.toMatchObject({ verdict: 'live' })
@@ -80,7 +81,7 @@ describe('incumbent alive and refusing', () => {
   it('does not launch over an empty relay whose death could not be confirmed', async () => {
     execCommand
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('LIVE\n')
     await expect(resolve()).rejects.toSatisfy(isRelayEndpointHeldError)
@@ -89,7 +90,7 @@ describe('incumbent alive and refusing', () => {
   it('does not launch over a relay the host refused to signal on its own re-check', async () => {
     execCommand
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('BUSY\n')
     await expect(resolve()).rejects.toSatisfy(isRelayEndpointHeldError)
@@ -138,9 +139,19 @@ describe('reapEmptyRelayHuskCommand', () => {
   })
 
   it('aborts without signalling when the host cannot count children', () => {
-    expect(reapEmptyRelayHuskCommand(4242, SOCK)).toContain(
-      "command -v pgrep >/dev/null 2>&1 || { printf 'BUSY\\n'; exit 0; }"
-    )
+    const command = reapEmptyRelayHuskCommand(4242, SOCK)
+    // The census leaves both counters at `unknown` without pgrep, and the gate demands "0".
+    expect(command).toContain('unrecognized_kids=unknown')
+    expect(command).toContain('command -v pgrep >/dev/null 2>&1')
+    expect(command).toContain('[ "$unrecognized_kids" = "0" ] ||')
+  })
+
+  it('subtracts only the daemon service children it can name from the reap gate', () => {
+    const command = reapEmptyRelayHuskCommand(4242, SOCK)
+    for (const filename of RELAY_DAEMON_SERVICE_ENTRY_FILENAMES) {
+      expect(command).toContain(`*'/${filename}'`)
+    }
+    expect(command).toContain('unrecognized_kids=$((unrecognized_kids+1))')
   })
 })
 
diff --git a/src/main/ssh/ssh-relay-endpoint-takeover.ts b/src/main/ssh/ssh-relay-endpoint-takeover.ts
index f104aab5256..8f6130620cb 100644
--- a/src/main/ssh/ssh-relay-endpoint-takeover.ts
+++ b/src/main/ssh/ssh-relay-endpoint-takeover.ts
@@ -2,13 +2,17 @@
  * Deciding whether a relay socket path is ours to take, and acting on the answer.
  *
  * The only destructive action available here is a SIGTERM to a relay that has been proven —
- * by argv, by socket-holder enumeration, and by a zero child count re-checked on the host
- * immediately before the signal — to hold nothing at all. Everything else is left running.
+ * by argv, by socket-holder enumeration, and by a child census re-run on the host immediately
+ * before the signal — to hold nothing at all. Everything else is left running.
  * Per docs/reference/ssh-execution-boundary.md, a relay we merely failed to reach is
  * `unverifiable`, and `unverifiable` never authorizes a kill or a rebind.
  */
 import type { SshConnection } from './ssh-connection'
 import { shellEscape } from './ssh-connection-utils'
+import {
+  RELAY_UNRECOGNIZED_CHILD_COUNT_VAR,
+  relayDaemonChildCensusShell
+} from './relay-daemon-service-children'
 import { execCommand, isUnconfirmedSshCommandTermination } from './ssh-relay-deploy-helpers'
 import {
   describeRelayEndpointIncumbent,
@@ -39,9 +43,10 @@ export function reapEmptyRelayHuskCommand(pid: number, sockPath: string): string
     `sock=${shellEscape(sockPath)}`,
     'args=$(ps -o args= -p "$pid" 2>/dev/null | tr "\\n" " ")',
     'case "$args" in *relay.js*"$sock"*) ;; *) printf \'MISMATCH\\n\'; exit 0 ;; esac',
-    "command -v pgrep >/dev/null 2>&1 || { printf 'BUSY\\n'; exit 0; }",
-    'kids=$(pgrep -P "$pid" 2>/dev/null | grep -c .)',
-    '[ "$kids" = "0" ] || { printf \'BUSY\\n\'; exit 0; }',
+    // Why the same census as the probe: `unknown` (no pgrep) and any child this host could
+    // not account for as a relay service both land on BUSY, so nothing is signalled.
+    ...relayDaemonChildCensusShell(),
+    `[ "$${RELAY_UNRECOGNIZED_CHILD_COUNT_VAR}" = "0" ] || { printf 'BUSY\\n'; exit 0; }`,
     // SIGTERM only: the relay's own handler disposes and unlinks. SIGKILL would leave the
     // socket inode behind and skip that shutdown path for no gain on an empty daemon.
     'kill -TERM "$pid" 2>/dev/null || true',
diff --git a/src/main/ssh/ssh-relay-superseded-endpoints.test.ts b/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
index 874d9aae3fe..9168f4688bd 100644
--- a/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
+++ b/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
@@ -67,7 +67,7 @@ describe('classifySupersededRelay', () => {
           'PRESENT=yes',
           'LISTEN=accepted',
           'HOLDERS_SOURCE=lsof',
-          'HOLDER=3669803 yes 13'
+          'HOLDER=3669803 yes 13 11'
         ])
       )
     ).toBe('retained-live-work')
@@ -76,7 +76,7 @@ describe('classifySupersededRelay', () => {
   it('nominates only a proven empty relay for reaping', () => {
     expect(
       classifySupersededRelay(
-        incumbent(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        incumbent(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
     ).toBe('reap-candidate')
   })
@@ -101,7 +101,7 @@ describe('sweepSupersededRelayEndpoints', () => {
     execCommand
       .mockResolvedValueOnce(`${OLD_SOCK}\n`)
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=3669803 yes 13 11'])
       )
     const findings = await sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)
     expect(findings).toHaveLength(1)
@@ -114,7 +114,7 @@ describe('sweepSupersededRelayEndpoints', () => {
     execCommand
       .mockResolvedValueOnce(`${OLD_SOCK}\n`)
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('GONE\n')
     const findings = await sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)
@@ -126,7 +126,7 @@ describe('sweepSupersededRelayEndpoints', () => {
     execCommand
       .mockResolvedValueOnce(`${OLD_SOCK}\n`)
       .mockResolvedValueOnce(
-        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 0'])
+        probe(['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0'])
       )
       .mockResolvedValueOnce('LIVE\n')
     const findings = await sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)
diff --git a/src/shared/relay-artifacts.ts b/src/shared/relay-artifacts.ts
index 273f6e059b8..2f9e563f839 100644
--- a/src/shared/relay-artifacts.ts
+++ b/src/shared/relay-artifacts.ts
@@ -37,6 +37,12 @@ export type RelayArtifact = {
    * optional one would loop forever redeploying a relay that is already correct.
    */
   optional?: boolean
+  /**
+   * Forked by the relay daemon as a long-lived child of its own. These are relay
+   * infrastructure, never user work, and the reap gate subtracts them from a daemon's
+   * child census; see src/main/ssh/relay-daemon-service-children.ts.
+   */
+  daemonServiceChild?: boolean
 }
 
 /** The bare Windows process-table addon; see docs/reference/windows-process-enumeration.md. */
@@ -44,8 +50,8 @@ export const RELAY_WINDOWS_PROCESS_TREE_FILENAME = 'windows-process-tree.node'
 
 export const RELAY_ARTIFACTS: readonly RelayArtifact[] = [
   { filename: 'relay.js' },
-  { filename: 'relay-watcher.js' },
-  { filename: 'relay-ai-vault-service.js' },
+  { filename: 'relay-watcher.js', daemonServiceChild: true },
+  { filename: 'relay-ai-vault-service.js', daemonServiceChild: true },
   { filename: 'managed-hook-runtime.js' },
   // Forked by the AI Vault title reader; without it a relay answers every WSL
   // title request with no title and no error.
@@ -62,6 +68,14 @@ export const RELAY_ARTIFACTS: readonly RelayArtifact[] = [
   { filename: RELAY_WINDOWS_PROCESS_TREE_FILENAME, windowsOnly: true, optional: true }
 ]
 
+/**
+ * The daemon's own service children, by entry filename. Anything else under a relay pid is
+ * either user work or unidentified, and both keep the relay unreapable.
+ */
+export const RELAY_DAEMON_SERVICE_ENTRY_FILENAMES: readonly string[] = RELAY_ARTIFACTS.filter(
+  (artifact) => artifact.daemonServiceChild
+).map((artifact) => artifact.filename)
+
 /** Written after the artifacts, so it is never an input to its own hash. */
 export const RELAY_VERSION_FILENAME = '.version'
 

From b85510f3a9a3751b7320f18f6c753720c265ed86 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 00:51:21 -0700
Subject: [PATCH 06/58] fix(terminal): warn about remote work when closing the
 window or quitting (#18593)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The native window-close warning was built from a local-only pty set: any
worktree with a connectionId was dropped whole, and any remote runtime pty
was filtered out. A build, test run, or agent on an SSH or Orca Remote host
was therefore structurally invisible to it, on every platform. The quit path
skipped the check entirely (#524), so remote work got no prompt at all.

Route both paths through the same probe the tab-close guard uses, so the two
cannot drift, and keep the verdict vocabulary of the SSH execution boundary:
only a host that answers "no children" suppresses the warning. An unreachable
host is `unverifiable`, never `exited`, so it warns rather than quitting
silently — with its own copy, because "could not reach the host" is a
different claim than "processes are running".

Quit still ignores local ptys, preserving #524: quitting is an unambiguous
instruction to end this machine's processes, but not to end execution on
someone else's, which a bounded relay grace period will SIGKILL once the
countdown expires.

The probe budget is 1.5s (vs the tab guard's 4s) because quit is time
sensitive; expiry raises the prompt, so an unreachable host costs a click
rather than the 15s RPC timeout or a silently orphaned build.
---
 config/scripts/locale-ko-key-overrides.json   |   2 +-
 .../components/TerminalWorkspaceDialogs.tsx   |  14 +-
 .../terminal/pty-running-work-probe.ts        |  88 +++++++
 .../running-terminal-close-guard.test.ts      |  12 +-
 .../terminal/running-terminal-close-guard.ts  |  38 +--
 ...terminal-tab-close-running-confirm.test.ts |   8 +-
 .../window-close-running-work.test.ts         | 231 ++++++++++++++++++
 .../terminal/window-close-running-work.ts     |  70 ++++++
 .../use-terminal-editor-close-foundation.ts   |  53 ++--
 ...tor-close-foundation.window-close.test.tsx | 103 ++++++++
 src/renderer/src/i18n/locales/en.json         |   3 +-
 src/renderer/src/i18n/locales/es.json         |   2 +-
 src/renderer/src/i18n/locales/fr.json         |   2 +-
 src/renderer/src/i18n/locales/ja.json         |   2 +-
 src/renderer/src/i18n/locales/ko.json         |   2 +-
 src/renderer/src/i18n/locales/zh.json         |   2 +-
 src/shared/remote-execution-host-pty-id.ts    |  14 ++
 17 files changed, 575 insertions(+), 71 deletions(-)
 create mode 100644 src/renderer/src/components/terminal/pty-running-work-probe.ts
 create mode 100644 src/renderer/src/components/terminal/window-close-running-work.test.ts
 create mode 100644 src/renderer/src/components/terminal/window-close-running-work.ts
 create mode 100644 src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx
 create mode 100644 src/shared/remote-execution-host-pty-id.ts

diff --git a/config/scripts/locale-ko-key-overrides.json b/config/scripts/locale-ko-key-overrides.json
index f368ecc3cbc..bf5f62d1fa5 100644
--- a/config/scripts/locale-ko-key-overrides.json
+++ b/config/scripts/locale-ko-key-overrides.json
@@ -492,7 +492,7 @@
     "ko": "agent CLI를 찾지 못했습니다. 하나를 설치하거나 설정에서 기본 agent를 선택하세요."
   },
   "auto.components.Terminal.7958465754": {
-    "ko": "실행 중인 프로세스가 있는 로컬 terminals이 있습니다. 그래도 창을 닫으시겠습니까?"
+    "ko": "실행 중인 프로세스가 있는 terminals이 있습니다. 그래도 창을 닫으시겠습니까?"
   },
   "auto.components.Terminal.cdc9ac4b2d": {
     "ko": "편집기"
diff --git a/src/renderer/src/components/TerminalWorkspaceDialogs.tsx b/src/renderer/src/components/TerminalWorkspaceDialogs.tsx
index 52ddbf1ba5d..bb3ffbfd621 100644
--- a/src/renderer/src/components/TerminalWorkspaceDialogs.tsx
+++ b/src/renderer/src/components/TerminalWorkspaceDialogs.tsx
@@ -24,6 +24,7 @@ export function TerminalWorkspaceDialogs({
     saveDialogFile,
     saveDialogFileId,
     setWindowCloseDialogOpen,
+    windowCloseDialogKind,
     windowCloseDialogOpen
   } = controller
   return (
@@ -82,10 +83,15 @@ export function TerminalWorkspaceDialogs({
               {translate('auto.components.Terminal.2fa9c69ff3', 'Close Window?')}
             </DialogTitle>
             <DialogDescription className="text-xs">
-              {translate(
-                'auto.components.Terminal.7958465754',
-                'There are local terminals with running processes. Close the window anyway?'
-              )}
+              {windowCloseDialogKind === 'unverifiable'
+                ? translate(
+                    'auto.components.Terminal.b7c1f0a934',
+                    'A remote host could not be reached, so Orca cannot tell whether work is still running there. Close the window anyway?'
+                  )
+                : translate(
+                    'auto.components.Terminal.7958465754',
+                    'There are terminals with running processes. Close the window anyway?'
+                  )}
             </DialogDescription>
           </DialogHeader>
           <DialogFooter className="gap-2">
diff --git a/src/renderer/src/components/terminal/pty-running-work-probe.ts b/src/renderer/src/components/terminal/pty-running-work-probe.ts
new file mode 100644
index 00000000000..609b71f12ca
--- /dev/null
+++ b/src/renderer/src/components/terminal/pty-running-work-probe.ts
@@ -0,0 +1,88 @@
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+import { inspectRuntimeTerminalProcess } from '@/runtime/runtime-terminal-inspection'
+import { isRemoteExecutionHostPtyId } from '../../../../shared/remote-execution-host-pty-id'
+import { isClientOnlyUnverifiableInspection } from '../../../../shared/terminal-process-inspection'
+
+/**
+ * One probe answer in the fixed `live` / `unverifiable` / `exited` vocabulary of
+ * `docs/reference/ssh-execution-boundary.md`. `exited` is only ever produced by a host that
+ * answered; every failure to reach the owner — a rejection, a closed transport, or a deadline
+ * that expired first — stays `unverifiable`, because loss of contact is not evidence of death.
+ */
+export type PtyRunningWorkVerdict = 'live' | 'unverifiable' | 'exited'
+
+export type PtyRunningWorkProbe = {
+  ptyId: string
+  verdict: PtyRunningWorkVerdict
+  /** Why the owner could not be observed. Only set for `unverifiable`. */
+  reason?: string
+  /** The deadline expired before this pty's probe answered at all. */
+  timedOut: boolean
+  /** The pty is owned by a remote execution host (relay runtime or app SSH). */
+  remote: boolean
+}
+
+type ProbeSettings = Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined
+
+/**
+ * Probes every pty for running work and resolves at whichever comes first: every answer, or the
+ * deadline. Never rejects, and never reports a pty it did not hear back about as idle.
+ *
+ * Callers own the policy. This owns only the measurement, so the tab-close guard and the
+ * window-close guard cannot drift apart on what an unanswered remote host means.
+ */
+export async function probePtyRunningWork(
+  settings: ProbeSettings,
+  ptyIds: readonly string[],
+  options: { timeoutMs: number }
+): Promise<PtyRunningWorkProbe[]> {
+  if (ptyIds.length === 0) {
+    return []
+  }
+  const probes: PtyRunningWorkProbe[] = ptyIds.map((ptyId) => ({
+    ptyId,
+    verdict: 'unverifiable',
+    reason: 'probe_deadline',
+    timedOut: true,
+    remote: isRemoteExecutionHostPtyId(ptyId)
+  }))
+
+  const settle = Promise.all(
+    ptyIds.map(async (ptyId, index) => {
+      const probe = probes[index]
+      if (!probe) {
+        return
+      }
+      try {
+        const inspection = await inspectRuntimeTerminalProcess(settings, ptyId)
+        probe.timedOut = false
+        if (isClientOnlyUnverifiableInspection(inspection)) {
+          probe.verdict = 'unverifiable'
+          probe.reason = inspection.reason
+          return
+        }
+        probe.verdict = inspection.hasChildProcesses ? 'live' : 'exited'
+        delete probe.reason
+      } catch {
+        // Why: `inspectRuntimeTerminalProcess` already maps every failure it can classify onto a
+        // reason; an unclassified throw is still a failure to observe, so it stays unverifiable.
+        probe.timedOut = false
+        probe.verdict = 'unverifiable'
+        probe.reason = 'probe_failed'
+      }
+    })
+  )
+
+  let deadline: ReturnType<typeof setTimeout> | undefined
+  try {
+    await Promise.race([
+      settle,
+      new Promise<void>((resolve) => {
+        deadline = setTimeout(resolve, options.timeoutMs)
+      })
+    ])
+  } finally {
+    clearTimeout(deadline)
+  }
+  return probes
+}
diff --git a/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts b/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts
index d63c69df7c9..165119f8b31 100644
--- a/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts
+++ b/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts
@@ -46,10 +46,12 @@ function visibleRequest() {
   return useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm
 }
 
+// Drains pending microtasks. The probe resolves through several await points (per-pty inspect,
+// the batch join, the deadline race), so this flushes generously rather than counting ticks.
 async function settleProbe(): Promise<void> {
-  await Promise.resolve()
-  await Promise.resolve()
-  await Promise.resolve()
+  for (let tick = 0; tick < 12; tick += 1) {
+    await Promise.resolve()
+  }
 }
 
 describe('shouldConfirmRunningTerminalClose', () => {
@@ -329,6 +331,7 @@ describe('guardRunningTerminalClose', () => {
 
     vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS)
     vi.useRealTimers()
+    await settleProbe()
 
     expect(onClose).not.toHaveBeenCalled()
     expect(visibleRequest()).toMatchObject({ terminalTabId: 'tab-1', tabLabel: 'npm run dev' })
@@ -351,6 +354,7 @@ describe('guardRunningTerminalClose', () => {
     guard()
     vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS)
     vi.useRealTimers()
+    await settleProbe()
 
     expect(visibleRequest()?.copyKind).toBe('agent')
   })
@@ -368,6 +372,7 @@ describe('guardRunningTerminalClose', () => {
     guard(onClose)
     vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS)
     vi.useRealTimers()
+    await settleProbe()
     requestSpy.mockRestore()
 
     expect(onClose).toHaveBeenCalledTimes(1)
@@ -385,6 +390,7 @@ describe('guardRunningTerminalClose', () => {
     vi.advanceTimersByTime(RUNNING_CLOSE_PROBE_TIMEOUT_MS)
     vi.useRealTimers()
     await settleProbe()
+    await settleProbe()
 
     expect(onClose).not.toHaveBeenCalled()
     useRunningTerminalCloseConfirmStore.getState().confirmRunningTerminalClose()
diff --git a/src/renderer/src/components/terminal/running-terminal-close-guard.ts b/src/renderer/src/components/terminal/running-terminal-close-guard.ts
index 881cd262353..6bb9ff5a582 100644
--- a/src/renderer/src/components/terminal/running-terminal-close-guard.ts
+++ b/src/renderer/src/components/terminal/running-terminal-close-guard.ts
@@ -1,10 +1,9 @@
 import { useAppStore } from '@/store'
-import { inspectRuntimeTerminalProcess } from '@/runtime/runtime-terminal-inspection'
 import { useRunningTerminalCloseConfirmStore } from '@/store/running-terminal-close-confirm'
 import type { TerminalTabCloseReason } from '@/store/slices/terminal-tab-retirement'
 import type { AppState } from '@/store/types'
 import { resolveBusyPtyCloseCopyKind } from './terminal-close-copy-kind'
-import { isClientOnlyUnverifiableInspection } from '../../../../shared/terminal-process-inspection'
+import { probePtyRunningWork } from './pty-running-work-probe'
 
 export type RunningTerminalCloseGuardOptions = {
   force?: boolean
@@ -44,7 +43,7 @@ export function shouldConfirmRunningTerminalClose(
  *  the store's own teardown collector unions both for exactly that reason — reading only
  *  the map would let a close slip through the window with no prompt. A stale id costs
  *  nothing: its probe fails and the guard falls open. */
-function collectTabPtyIds(
+export function collectTabPtyIds(
   state: Pick<AppState, 'ptyIdsByTabId' | 'terminalLayoutsByTabId'>,
   terminalTabId: string
 ): string[] {
@@ -112,44 +111,33 @@ export function guardRunningTerminalClose(params: {
     decided = true
   }
 
-  const probeTimeout = setTimeout(() => {
-    try {
+  void probePtyRunningWork(settings, ptyIds, { timeoutMs: RUNNING_CLOSE_PROBE_TIMEOUT_MS })
+    .then((probes) => {
+      if (decided) {
+        return
+      }
       // Why: a probe that has not answered yet is unknown, not idle. Ask, treating every pty
       // as a candidate, so a degraded relay costs a click instead of a killed remote command.
-      confirmClose(ptyIds)
-    } catch {
-      closeNow()
-    }
-  }, RUNNING_CLOSE_PROBE_TIMEOUT_MS)
-
-  void Promise.allSettled(ptyIds.map((ptyId) => inspectRuntimeTerminalProcess(settings, ptyId)))
-    .then((results) => {
-      clearTimeout(probeTimeout)
-      if (decided) {
+      if (probes.some((probe) => probe.timedOut)) {
+        confirmClose(ptyIds)
         return
       }
       // Why: fail open on an *answered* probe, matching the Cmd+W pane path — a rejection
       // (wedged relay, legacy provider) or a stale remote handle is not evidence of a live
       // child, and a close button that silently does nothing is worse than closing a busy tab.
-      const busyPtyIds = ptyIds.filter((_, index) => {
-        const result = results[index]
-        return (
-          result?.status === 'fulfilled' &&
-          !isClientOnlyUnverifiableInspection(result.value) &&
-          result.value.hasChildProcesses
-        )
-      })
+      const busyPtyIds = probes
+        .filter((probe) => probe.verdict === 'live')
+        .map((probe) => probe.ptyId)
       if (busyPtyIds.length === 0) {
         closeNow()
         return
       }
       confirmClose(busyPtyIds)
     })
-    // Why: allSettled never rejects, so this only fires when the decision above throws (a
+    // Why: the probe never rejects, so this only fires when the decision above throws (a
     // copy-kind lookup, a store subscriber). Without it the tab would silently never close
     // and the user would get no feedback at all; the pane path it replaced had this catch.
     .catch(() => {
-      clearTimeout(probeTimeout)
       closeNow()
     })
 }
diff --git a/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts b/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts
index 066c5795ef9..9dfe20ef501 100644
--- a/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts
+++ b/src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts
@@ -87,10 +87,12 @@ function visibleRequest() {
   return useRunningTerminalCloseConfirmStore.getState().runningTerminalCloseConfirm
 }
 
+// Drains pending microtasks. The probe resolves through several await points (per-pty inspect,
+// the batch join, the deadline race), so this flushes generously rather than counting ticks.
 async function settleProbe(): Promise<void> {
-  await Promise.resolve()
-  await Promise.resolve()
-  await Promise.resolve()
+  for (let tick = 0; tick < 12; tick += 1) {
+    await Promise.resolve()
+  }
 }
 
 describe('closeTerminalTab running-process confirmation', () => {
diff --git a/src/renderer/src/components/terminal/window-close-running-work.test.ts b/src/renderer/src/components/terminal/window-close-running-work.test.ts
new file mode 100644
index 00000000000..77dc4ad745b
--- /dev/null
+++ b/src/renderer/src/components/terminal/window-close-running-work.test.ts
@@ -0,0 +1,231 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { getStateMock, inspectRuntimeTerminalProcessMock } = vi.hoisted(() => ({
+  getStateMock: vi.fn(),
+  inspectRuntimeTerminalProcessMock: vi.fn()
+}))
+
+vi.mock('@/store', () => ({
+  useAppStore: { getState: getStateMock }
+}))
+
+vi.mock('@/runtime/runtime-terminal-inspection', () => ({
+  inspectRuntimeTerminalProcess: inspectRuntimeTerminalProcessMock
+}))
+
+import {
+  assessWindowCloseRunningWork,
+  WINDOW_CLOSE_PROBE_TIMEOUT_MS
+} from './window-close-running-work'
+
+const LOCAL_PTY = 'pty-local'
+const SSH_PTY = 'ssh:openclaw@@pty-7'
+const RUNTIME_PTY = 'remote:env-1@@handle-1'
+/** A runtime pty minted without an owner id. Still someone else's machine. */
+const OWNERLESS_RUNTIME_PTY = 'remote:handle-2'
+
+const BUSY = {
+  foregroundProcess: 'pnpm build',
+  hasChildProcesses: true,
+  foregroundProcessEvidence: {}
+}
+const IDLE = { foregroundProcess: 'bash', hasChildProcesses: false, foregroundProcessEvidence: {} }
+const UNVERIFIABLE = {
+  foregroundProcess: null,
+  hasChildProcesses: false,
+  verdict: 'unverifiable',
+  reason: 'transport_loss'
+}
+
+/** One worktree, one tab, owning `ptyIds`. */
+function setState(ptyIds: string[]): void {
+  getStateMock.mockReturnValue({
+    settings: { activeRuntimeEnvironmentId: null },
+    tabsByWorktree: { 'worktree-1': [{ id: 'tab-1' }] },
+    ptyIdsByTabId: { 'tab-1': ptyIds },
+    terminalLayoutsByTabId: {}
+  })
+}
+
+/** Answers each pty id from `byPtyId`; anything unlisted never settles. */
+function answerWith(byPtyId: Record<string, unknown>): void {
+  inspectRuntimeTerminalProcessMock.mockImplementation((_settings: unknown, ptyId: string) =>
+    ptyId in byPtyId ? Promise.resolve(byPtyId[ptyId]) : new Promise(() => {})
+  )
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('assessWindowCloseRunningWork', () => {
+  it('warns about a live process on an SSH host (F15: remote work was filtered out entirely)', async () => {
+    setState([SSH_PTY])
+    answerWith({ [SSH_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: false })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('warns on quit about a live process on an SSH host', async () => {
+    setState([SSH_PTY])
+    answerWith({ [SSH_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('warns on quit about a live process on a paired runtime host', async () => {
+    setState([RUNTIME_PTY])
+    answerWith({ [RUNTIME_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('counts an owner-less remote pty as remote work', async () => {
+    setState([OWNERLESS_RUNTIME_PTY])
+    answerWith({ [OWNERLESS_RUNTIME_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  // The crux of docs/reference/ssh-execution-boundary.md: an unreachable host is `unverifiable`,
+  // and quitting on `unverifiable` as though it were `exited` is what orphans live remote work.
+  it('warns rather than quitting silently when a remote host answers unverifiable', async () => {
+    setState([SSH_PTY])
+    answerWith({ [SSH_PTY]: UNVERIFIABLE })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'unverifiable'
+    })
+  })
+
+  it('warns rather than quitting silently when a remote probe throws', async () => {
+    setState([SSH_PTY])
+    inspectRuntimeTerminalProcessMock.mockRejectedValue(new Error('relay wedged'))
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'unverifiable'
+    })
+  })
+
+  it('stops waiting at the budget and warns, so an unreachable host cannot hang the quit', async () => {
+    setState([SSH_PTY])
+    answerWith({})
+    vi.useFakeTimers()
+
+    const pending = assessWindowCloseRunningWork({ isQuitting: true })
+    await vi.advanceTimersByTimeAsync(WINDOW_CLOSE_PROBE_TIMEOUT_MS)
+
+    await expect(pending).resolves.toEqual({ kind: 'unverifiable' })
+  })
+
+  it('does not resolve before the budget expires', async () => {
+    setState([SSH_PTY])
+    answerWith({})
+    vi.useFakeTimers()
+    const settled = vi.fn()
+
+    void assessWindowCloseRunningWork({ isQuitting: true }).then(settled)
+    await vi.advanceTimersByTimeAsync(WINDOW_CLOSE_PROBE_TIMEOUT_MS - 1)
+
+    expect(settled).not.toHaveBeenCalled()
+  })
+
+  it('does not warn when the owning remote host reports an idle shell', async () => {
+    setState([SSH_PTY])
+    answerWith({ [SSH_PTY]: IDLE })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'none'
+    })
+  })
+
+  it('reports a live process even when a sibling remote pane is only unverifiable', async () => {
+    setState([SSH_PTY, RUNTIME_PTY])
+    answerWith({ [SSH_PTY]: UNVERIFIABLE, [RUNTIME_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('still warns about a live local process when closing the window', async () => {
+    setState([LOCAL_PTY])
+    answerWith({ [LOCAL_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: false })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  // A local probe has no transport to lose, so its failure means the pty is gone — unlike a
+  // remote host going quiet, it is not a reason to hold up the close.
+  it('does not warn when only a local probe is unverifiable', async () => {
+    setState([LOCAL_PTY])
+    answerWith({ [LOCAL_PTY]: UNVERIFIABLE })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: false })).resolves.toEqual({
+      kind: 'none'
+    })
+  })
+
+  // #524 decided quitting is an unambiguous instruction to end this machine's processes. It is
+  // not an instruction to end execution on someone else's, which is why remote still warns above.
+  it('leaves local-only quit unprompted, and never probes for it', async () => {
+    setState([LOCAL_PTY])
+    answerWith({ [LOCAL_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'none'
+    })
+    expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled()
+  })
+
+  it('probes a pane the layout has bound before the liveness map caught up', async () => {
+    getStateMock.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: null },
+      tabsByWorktree: { 'worktree-1': [{ id: 'tab-1' }] },
+      ptyIdsByTabId: {},
+      terminalLayoutsByTabId: { 'tab-1': { ptyIdsByLeafId: { leaf: SSH_PTY } } }
+    })
+    answerWith({ [SSH_PTY]: BUSY })
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: true })).resolves.toEqual({
+      kind: 'running'
+    })
+  })
+
+  it('probes each pty once when the map and the layout name the same one', async () => {
+    getStateMock.mockReturnValue({
+      settings: { activeRuntimeEnvironmentId: null },
+      tabsByWorktree: { 'worktree-1': [{ id: 'tab-1' }] },
+      ptyIdsByTabId: { 'tab-1': [SSH_PTY] },
+      terminalLayoutsByTabId: { 'tab-1': { ptyIdsByLeafId: { leaf: SSH_PTY } } }
+    })
+    answerWith({ [SSH_PTY]: IDLE })
+
+    await assessWindowCloseRunningWork({ isQuitting: true })
+
+    expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('closes without probing when no workspace owns a pty', async () => {
+    setState([])
+
+    await expect(assessWindowCloseRunningWork({ isQuitting: false })).resolves.toEqual({
+      kind: 'none'
+    })
+    expect(inspectRuntimeTerminalProcessMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/terminal/window-close-running-work.ts b/src/renderer/src/components/terminal/window-close-running-work.ts
new file mode 100644
index 00000000000..427ee72dae6
--- /dev/null
+++ b/src/renderer/src/components/terminal/window-close-running-work.ts
@@ -0,0 +1,70 @@
+import { useAppStore } from '@/store'
+import { isRemoteExecutionHostPtyId } from '../../../../shared/remote-execution-host-pty-id'
+import { collectTabPtyIds } from './running-terminal-close-guard'
+import { probePtyRunningWork } from './pty-running-work-probe'
+
+/**
+ * Upper bound on how long closing the window or quitting may wait on the probes.
+ *
+ * Shorter than the tab-close guard's 4s because quit is time-sensitive in a way one tab close is
+ * not: the user has already asked to leave, and a quit that stalls on an unreachable host is its
+ * own bug. A healthy local inspect answers in single-digit milliseconds and a healthy remote one
+ * is a single RPC round-trip on an already-open mux channel, so this leaves roughly 3x headroom
+ * over a slow-but-live transcontinental host while capping the worst case — a host that is simply
+ * gone — at ~1.5s instead of the 15s RPC timeout the probe would otherwise inherit.
+ *
+ * Expiry raises the prompt rather than quitting silently: an unanswered probe is `unverifiable`,
+ * and `unverifiable` is never evidence that remote work has stopped.
+ */
+export const WINDOW_CLOSE_PROBE_TIMEOUT_MS = 1_500
+
+/** Which warning the close should raise, if any. */
+export type WindowCloseRunningWork =
+  /** Every pty that mattered answered, and none had children. */
+  | { kind: 'none' }
+  /** An owning host reported a live child process. */
+  | { kind: 'running' }
+  /** A remote execution host could not be observed, so its work may still be live. */
+  | { kind: 'unverifiable' }
+
+/**
+ * Decides whether a window close or quit should stop and ask.
+ *
+ * Two deliberate asymmetries:
+ *
+ * - **Quit only considers remote ptys.** Quitting is an unambiguous instruction to end this
+ *   machine's processes (#524), but it is not an instruction to end execution on someone else's:
+ *   the client detaches while the relay keeps running, and a target with a bounded grace period
+ *   then SIGKILLs that work once the countdown expires.
+ * - **Only a remote `unverifiable` warns.** A local probe has no transport to lose, so its failure
+ *   means the pty is gone. A remote one that cannot be reached is the case
+ *   `docs/reference/ssh-execution-boundary.md` exists to protect: loss of contact is not evidence
+ *   of `exited`, so it must fail toward asking rather than toward a silent quit.
+ */
+export async function assessWindowCloseRunningWork(params: {
+  isQuitting: boolean
+}): Promise<WindowCloseRunningWork> {
+  const state = useAppStore.getState()
+  const ptyIds = new Set(
+    Object.values(state.tabsByWorktree)
+      .flatMap((worktreeTabs) => worktreeTabs ?? [])
+      .flatMap((tab) => collectTabPtyIds(state, tab.id))
+  )
+  const candidatePtyIds = params.isQuitting
+    ? [...ptyIds].filter(isRemoteExecutionHostPtyId)
+    : [...ptyIds]
+  if (candidatePtyIds.length === 0) {
+    return { kind: 'none' }
+  }
+
+  const probes = await probePtyRunningWork(state.settings, candidatePtyIds, {
+    timeoutMs: WINDOW_CLOSE_PROBE_TIMEOUT_MS
+  })
+  if (probes.some((probe) => probe.verdict === 'live')) {
+    return { kind: 'running' }
+  }
+  if (probes.some((probe) => probe.remote && probe.verdict === 'unverifiable')) {
+    return { kind: 'unverifiable' }
+  }
+  return { kind: 'none' }
+}
diff --git a/src/renderer/src/components/use-terminal-editor-close-foundation.ts b/src/renderer/src/components/use-terminal-editor-close-foundation.ts
index 74849e3f5a2..2aceced683d 100644
--- a/src/renderer/src/components/use-terminal-editor-close-foundation.ts
+++ b/src/renderer/src/components/use-terminal-editor-close-foundation.ts
@@ -1,8 +1,9 @@
 import { useCallback, useRef, useState } from 'react'
-import { useAppStore } from '../store'
-import { getConnectionId } from '../lib/connection-context'
-import { isRemoteRuntimePtyId } from '@/runtime/runtime-terminal-inspection'
 import { CLOSE_DIALOG_DEBOUNCE_MS } from './terminal-workspace-model'
+import {
+  assessWindowCloseRunningWork,
+  type WindowCloseRunningWork
+} from './terminal/window-close-running-work'
 import type { TerminalWorkspaceProjectionController } from './use-terminal-workspace-projection'
 import { runWithWindowCloseCheckpointScope } from './window-close-request-coordinator'
 import { showShutdownCheckpointFailureToast } from '@/lib/shutdown-checkpoint-failure-toast'
@@ -27,6 +28,11 @@ export function useTerminalEditorCloseFoundation(
     closeDialogDebounceTimersRef.current.add(timer)
   }, [])
   const [windowCloseDialogOpen, setWindowCloseDialogOpen] = useState(false)
+  // Why: "running" and "could not reach the host" are different claims, and telling the user
+  // processes are running when the truth is that a host went quiet is the fabricated certainty
+  // docs/reference/ssh-execution-boundary.md forbids.
+  const [windowCloseDialogKind, setWindowCloseDialogKind] =
+    useState<Exclude<WindowCloseRunningWork['kind'], 'none'>>('running')
   const windowCloseAfterDirtyRef = useRef<{ isQuitting: boolean } | null>(null)
 
   const confirmNativeWindowClose = useCallback(() => {
@@ -46,33 +52,21 @@ export function useTerminalEditorCloseFoundation(
 
   const proceedToNativeWindowClose = useCallback(
     (isQuitting: boolean) => {
-      if (!isQuitting) {
-        const state = useAppStore.getState()
-        const localPtyIds = Object.entries(state.tabsByWorktree).flatMap(
-          ([worktreeId, worktreeTabs]) => {
-            const connectionId = getConnectionId(worktreeId)
-            if (connectionId !== null) {
-              return []
-            }
-            return worktreeTabs
-              .flatMap((tab) => state.ptyIdsByTabId[tab.id] ?? [])
-              .filter((ptyId) => !isRemoteRuntimePtyId(ptyId))
+      void assessWindowCloseRunningWork({ isQuitting })
+        .then((runningWork) => {
+          if (runningWork.kind === 'none') {
+            confirmNativeWindowClose()
+            return
           }
-        )
-        if (localPtyIds.length > 0) {
-          void Promise.all(localPtyIds.map((id) => window.api.pty.hasChildProcesses(id))).then(
-            (results) => {
-              if (results.some(Boolean)) {
-                setWindowCloseDialogOpen(true)
-              } else {
-                confirmNativeWindowClose()
-              }
-            }
-          )
-          return
-        }
-      }
-      confirmNativeWindowClose()
+          setWindowCloseDialogKind(runningWork.kind)
+          setWindowCloseDialogOpen(true)
+        })
+        // Why: the assessment must never be able to trap the window. A thrown store read is
+        // not evidence either way, and a close that silently does nothing is unrecoverable
+        // without SIGKILL, so fall through to the close the user actually asked for.
+        .catch(() => {
+          confirmNativeWindowClose()
+        })
     },
     [confirmNativeWindowClose]
   )
@@ -88,6 +82,7 @@ export function useTerminalEditorCloseFoundation(
     releaseCloseDialogGuardAfterDebounce,
     windowCloseDialogOpen,
     setWindowCloseDialogOpen,
+    windowCloseDialogKind,
     windowCloseAfterDirtyRef,
     confirmNativeWindowClose,
     proceedToNativeWindowClose
diff --git a/src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx b/src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx
new file mode 100644
index 00000000000..d7f3f69d925
--- /dev/null
+++ b/src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx
@@ -0,0 +1,103 @@
+// @vitest-environment happy-dom
+
+/**
+ * Wiring for the window-close/quit running-work warning. The policy in
+ * `terminal/window-close-running-work.ts` is inert unless `proceedToNativeWindowClose` actually
+ * consults it, so pin that it does — and that a warning stops the native close rather than
+ * confirming it.
+ */
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { assessWindowCloseRunningWorkMock, confirmWindowCloseMock } = vi.hoisted(() => ({
+  assessWindowCloseRunningWorkMock: vi.fn(),
+  confirmWindowCloseMock: vi.fn()
+}))
+
+vi.mock('./terminal/window-close-running-work', () => ({
+  assessWindowCloseRunningWork: assessWindowCloseRunningWorkMock
+}))
+vi.mock('./window-close-request-coordinator', () => ({
+  runWithWindowCloseCheckpointScope: (fn: () => unknown) => fn()
+}))
+vi.mock('@/lib/shutdown-checkpoint-failure-toast', () => ({
+  showShutdownCheckpointFailureToast: vi.fn()
+}))
+
+const { useTerminalEditorCloseFoundation } = await import('./use-terminal-editor-close-foundation')
+
+const controller = { openFiles: [] } as unknown as Parameters<
+  typeof useTerminalEditorCloseFoundation
+>[0]
+
+function mountFoundation() {
+  return renderHook(() => useTerminalEditorCloseFoundation(controller))
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  Object.assign(globalThis, {
+    window: Object.assign(globalThis.window, {
+      api: { ui: { confirmWindowClose: confirmWindowCloseMock } }
+    })
+  })
+})
+
+afterEach(() => {
+  cleanup()
+})
+
+describe('proceedToNativeWindowClose', () => {
+  it('asks the running-work policy about the quit rather than assuming it is safe', async () => {
+    assessWindowCloseRunningWorkMock.mockResolvedValue({ kind: 'none' })
+    const { result } = mountFoundation()
+
+    await act(async () => {
+      result.current.proceedToNativeWindowClose(true)
+    })
+
+    expect(assessWindowCloseRunningWorkMock).toHaveBeenCalledWith({ isQuitting: true })
+    expect(confirmWindowCloseMock).toHaveBeenCalledTimes(1)
+    expect(result.current.windowCloseDialogOpen).toBe(false)
+  })
+
+  it('raises the dialog and does not close when a host reports live work', async () => {
+    assessWindowCloseRunningWorkMock.mockResolvedValue({ kind: 'running' })
+    const { result } = mountFoundation()
+
+    await act(async () => {
+      result.current.proceedToNativeWindowClose(true)
+    })
+
+    expect(result.current.windowCloseDialogOpen).toBe(true)
+    expect(result.current.windowCloseDialogKind).toBe('running')
+    expect(confirmWindowCloseMock).not.toHaveBeenCalled()
+  })
+
+  it('raises the unverifiable copy when a remote host could not be reached', async () => {
+    assessWindowCloseRunningWorkMock.mockResolvedValue({ kind: 'unverifiable' })
+    const { result } = mountFoundation()
+
+    await act(async () => {
+      result.current.proceedToNativeWindowClose(true)
+    })
+
+    expect(result.current.windowCloseDialogOpen).toBe(true)
+    expect(result.current.windowCloseDialogKind).toBe('unverifiable')
+    expect(confirmWindowCloseMock).not.toHaveBeenCalled()
+  })
+
+  // Why: a thrown assessment is not evidence either way, and a close that silently does nothing
+  // leaves SIGKILL as the user's only exit.
+  it('falls through to the close when the assessment throws', async () => {
+    assessWindowCloseRunningWorkMock.mockRejectedValue(new Error('store blew up'))
+    const { result } = mountFoundation()
+
+    await act(async () => {
+      result.current.proceedToNativeWindowClose(false)
+    })
+
+    expect(confirmWindowCloseMock).toHaveBeenCalledTimes(1)
+    expect(result.current.windowCloseDialogOpen).toBe(false)
+  })
+})
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index 87fcb50a2a1..f2da58bffb3 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -2251,7 +2251,8 @@
       "Terminal": {
         "73768427cf": "Close",
         "f82e9f02df": "Cancel",
-        "7958465754": "There are local terminals with running processes. Close the window anyway?",
+        "7958465754": "There are terminals with running processes. Close the window anyway?",
+        "b7c1f0a934": "A remote host could not be reached, so Orca cannot tell whether work is still running there. Close the window anyway?",
         "2fa9c69ff3": "Close Window?",
         "cd51e28d8b": "Save",
         "0037b21794": "Don't Save",
diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json
index 9999634daee..98b07917880 100644
--- a/src/renderer/src/i18n/locales/es.json
+++ b/src/renderer/src/i18n/locales/es.json
@@ -1924,7 +1924,7 @@
       "Terminal": {
         "73768427cf": "Cerrar",
         "f82e9f02df": "Cancelar",
-        "7958465754": "Hay terminales locales con procesos en ejecución. ¿Cerrar la ventana de todos modos?",
+        "7958465754": "Hay terminales con procesos en ejecución. ¿Cerrar la ventana de todos modos?",
         "2fa9c69ff3": "¿Cerrar ventana?",
         "cd51e28d8b": "Guardar",
         "0037b21794": "No guardar",
diff --git a/src/renderer/src/i18n/locales/fr.json b/src/renderer/src/i18n/locales/fr.json
index 8eff250a820..5bf316d36f7 100644
--- a/src/renderer/src/i18n/locales/fr.json
+++ b/src/renderer/src/i18n/locales/fr.json
@@ -2087,7 +2087,7 @@
       "Terminal": {
         "73768427cf": "Fermer",
         "f82e9f02df": "Annuler",
-        "7958465754": "Des terminaux locaux exécutent des processus. Fermer quand même la fenêtre ?",
+        "7958465754": "Des terminaux exécutent des processus. Fermer quand même la fenêtre ?",
         "2fa9c69ff3": "Fermer la fenêtre ?",
         "cd51e28d8b": "Enregistrer",
         "0037b21794": "Ne pas enregistrer",
diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json
index b3c30da9446..4dc81b9201d 100644
--- a/src/renderer/src/i18n/locales/ja.json
+++ b/src/renderer/src/i18n/locales/ja.json
@@ -1924,7 +1924,7 @@
       "Terminal": {
         "73768427cf": "閉じる",
         "f82e9f02df": "キャンセル",
-        "7958465754": "プロセスが実行中のローカルターミナルがあります。このままウィンドウを閉じますか?",
+        "7958465754": "プロセスが実行中のターミナルがあります。このままウィンドウを閉じますか?",
         "2fa9c69ff3": "ウィンドウを閉じますか?",
         "cd51e28d8b": "保存",
         "0037b21794": "保存しないでください",
diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json
index ac75cca2209..d9d822b8fc3 100644
--- a/src/renderer/src/i18n/locales/ko.json
+++ b/src/renderer/src/i18n/locales/ko.json
@@ -1929,7 +1929,7 @@
       "Terminal": {
         "73768427cf": "닫기",
         "f82e9f02df": "취소",
-        "7958465754": "실행 중인 프로세스가 있는 로컬 terminals이 있습니다. 그래도 창을 닫으시겠습니까?",
+        "7958465754": "실행 중인 프로세스가 있는 terminals이 있습니다. 그래도 창을 닫으시겠습니까?",
         "2fa9c69ff3": "창을 닫으시겠습니까?",
         "cd51e28d8b": "저장",
         "0037b21794": "저장하지 않음",
diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json
index 7a3b47c8f2a..46dc592dd2c 100644
--- a/src/renderer/src/i18n/locales/zh.json
+++ b/src/renderer/src/i18n/locales/zh.json
@@ -1927,7 +1927,7 @@
       "Terminal": {
         "73768427cf": "关闭",
         "f82e9f02df": "取消",
-        "7958465754": "有正在运行的进程的本地终端。还是关窗吧？",
+        "7958465754": "有正在运行的进程的终端。还是关窗吧？",
         "2fa9c69ff3": "关闭窗口？",
         "cd51e28d8b": "保存",
         "0037b21794": "不保存",
diff --git a/src/shared/remote-execution-host-pty-id.ts b/src/shared/remote-execution-host-pty-id.ts
new file mode 100644
index 00000000000..c76ada39e03
--- /dev/null
+++ b/src/shared/remote-execution-host-pty-id.ts
@@ -0,0 +1,14 @@
+import { parseRemoteRuntimePtyId } from './remote-runtime-pty-id'
+import { parseAppSshPtyId } from './ssh-pty-id'
+
+/**
+ * Whether the process behind this pty runs on an execution host other than this machine —
+ * a paired runtime environment or an app SSH target.
+ *
+ * Deliberately broader than the inspection module's private remote check, which only counts a
+ * `remote:` id that carries an owner environment id. An owner-less `remote:<handle>` still runs
+ * somewhere else, and treating it as local is how remote work becomes invisible to a guard.
+ */
+export function isRemoteExecutionHostPtyId(ptyId: string): boolean {
+  return parseRemoteRuntimePtyId(ptyId) !== null || parseAppSshPtyId(ptyId) !== null
+}

From 11e459e9330b0712988b9c4afb063c71ee0b1507 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 00:53:24 -0700
Subject: [PATCH 07/58] fix(crash-reporting): bound replay-guard wedge bursts
 in the ring without losing their spans (#18441)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`terminal_replay_guard_wedged_release` was not in
COALESCED_RENDERER_BREADCRUMB_NAMES, and its per-pane hashes give every entry a
unique ring identity. One mount/reveal/wake transition expires every in-flight
replay write at once, so a burst arrives as N distinct entries against a 30-slot
FIFO ring.

Measured, from the 09-02 corpus (121 `renderer.breadcrumb` spans across 9 of 55
diagnostic bundles):
- bundle 26461769: 26 events in 0.96s
- murlock1000: 62 events over 85s
- 8907a508 mixes two call sites in one window (2 crumbs carry `tabIdHash`, 2 do not)

Not measured: no captured report's ring actually lost slots to this crumb. All
57 reports have zero wedge crumbs in `Recent activity:`, and in all 9 bundles the
burst predates the report's ring window — for 26461769 the burst ran
13:36:03.784Z-13:36:04.742Z while the ring-owning main process started at
13:43:44.380Z, 7m40s later. So this bounds a demonstrated hazard, not an observed
loss. An earlier draft of this commit asserted "26 of 30 slots / 87% of the
pre-crash trail" as a measurement; that was a model, and it is removed.

The burst evidence lives entirely in the durable span stream, and suppressed
repeats normally emit no span (see the 1000-emissions/1-span case in
crash-reporting-renderer-breadcrumbs.test.ts), so coalescing alone would have cut
that 121-event corpus to 13 with the multiplicity recorded nowhere. Instead:

- the ring coalesces: one slot per call site, plus `suppressedSinceLast`
- every wedge event still emits its own `renderer.breadcrumb` span, via
  PER_EVENT_TRACED_COALESCED_BREADCRUMB_NAMES. Span volume is unchanged at 121,
  and the span deliberately carries no count so a span-stream total cannot
  double-count what the ring already claims
- the coalesce key is `ptyId`/`tabIdHash` *presence*, not name alone: those
  fields are absent on the restore call site (restoreScrollbackBuffers) and
  present on reattach, so name-only keying would collapse 8907a508's two call
  sites into whichever crumb landed last. Bounded at 4 slots per storm, matching
  the webgl `kind` and duplicate-tab `resolvedToActiveWorktree` precedents in the
  same file. Replaying the corpus timestamps: 121 events -> 14 ring writes.

This is a diagnostics fix, not a crash fix. It does not stop panes wedging, and
it does not explain the "can't type" reports in this round.
---
 .../crash-reporting-renderer-breadcrumbs.ts   |  24 +++-
 ...reporting-replay-guard-wedge-burst.test.ts | 128 ++++++++++++++++++
 2 files changed, 149 insertions(+), 3 deletions(-)
 create mode 100644 src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts

diff --git a/src/main/ipc/crash-reporting-renderer-breadcrumbs.ts b/src/main/ipc/crash-reporting-renderer-breadcrumbs.ts
index 97e0a8f9d65..8d126f557b5 100644
--- a/src/main/ipc/crash-reporting-renderer-breadcrumbs.ts
+++ b/src/main/ipc/crash-reporting-renderer-breadcrumbs.ts
@@ -49,6 +49,7 @@ function recordRendererBreadcrumbTrace(
 const DUPLICATE_TAB_OWNER_BREADCRUMB = 'terminal_tab_id_owned_by_multiple_worktrees'
 const PARK_VERDICT_CHURN_BREADCRUMB = 'terminal_park_verdict_churn'
 const REACT_COMMIT_CASCADE_BREADCRUMB = 'react_commit_cascade'
+const REPLAY_GUARD_WEDGED_BREADCRUMB = 'terminal_replay_guard_wedged_release'
 const COALESCED_RENDERER_BREADCRUMB_NAMES = new Set([
   'renderer_error',
   'renderer_unhandled_rejection',
@@ -56,6 +57,7 @@ const COALESCED_RENDERER_BREADCRUMB_NAMES = new Set([
   DUPLICATE_TAB_OWNER_BREADCRUMB,
   PARK_VERDICT_CHURN_BREADCRUMB,
   REACT_COMMIT_CASCADE_BREADCRUMB,
+  REPLAY_GUARD_WEDGED_BREADCRUMB,
   TERMINAL_WEBGL_DIAGNOSTIC_BREADCRUMB
 ])
 const RENDERER_BREADCRUMB_COALESCE_MS = 30_000
@@ -69,6 +71,11 @@ const RENDERER_BREADCRUMB_COALESCE_MS = 30_000
 // 30-entry ring to two such bursts. `suppressedSinceLast` keeps the pane count
 // — the only signal these carry — in one slot.
 const NAME_ONLY_COALESCED_BREADCRUMB_NAMES = new Set(['terminal_safe_fit_retry_exhausted'])
+// Why: the 30-slot ring is the scarce sink; the durable span stream is not. For
+// bounded-rate pane telemetry whose multiplicity is the whole signal, spans are the
+// only place a burst survives the restart that clears the ring, so coalesce the ring
+// but keep every event's span.
+const PER_EVENT_TRACED_COALESCED_BREADCRUMB_NAMES = new Set([REPLAY_GUARD_WEDGED_BREADCRUMB])
 
 function rendererBreadcrumbCoalesceKey(
   name: string,
@@ -77,6 +84,13 @@ function rendererBreadcrumbCoalesceKey(
   if (NAME_ONLY_COALESCED_BREADCRUMB_NAMES.has(name)) {
     return name
   }
+  // Why presence and not value: `ptyId`/`tabIdHash` are absent on the restore call
+  // site (layout-serialization restoreScrollbackBuffers) and present on reattach, so
+  // their presence is the call-site identity a mixed burst would otherwise lose. Four
+  // slots per storm at most, regardless of pane count.
+  if (name === REPLAY_GUARD_WEDGED_BREADCRUMB) {
+    return `${name}:${data?.ptyId ? 'pty' : ''}:${data?.tabIdHash ? 'tab' : ''}`
+  }
   // Why trigger and not name alone: `burst` means damping engaged a commit
   // short of React #185, `window` means slow benign churn. Collapsing them
   // would drop the near-crash signal into a slow-churn slot. Still bounded —
@@ -191,9 +205,13 @@ export function recordRendererBreadcrumbFromRenderer(
       minIntervalMs: RENDERER_BREADCRUMB_COALESCE_MS,
       ...(origin ? { origin } : {})
     })
-    // Why: tracing every suppressed duplicate would preserve the same
-    // serialization and disk churn that breadcrumb coalescing removes.
-    if (coalesceResult) {
+    if (PER_EVENT_TRACED_COALESCED_BREADCRUMB_NAMES.has(args.name)) {
+      // Why the raw data: every event already gets its own span, so folding the ring's
+      // running count in here would double-count in any span-stream total.
+      recordRendererBreadcrumbTrace(args.name, data)
+    } else if (coalesceResult) {
+      // Why gated: tracing every suppressed duplicate would preserve the same
+      // serialization and disk churn that breadcrumb coalescing removes.
       recordRendererBreadcrumbTrace(
         args.name,
         coalesceResult.suppressedSinceLast > 0
diff --git a/src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts b/src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts
new file mode 100644
index 00000000000..e3823f0b313
--- /dev/null
+++ b/src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts
@@ -0,0 +1,128 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import {
+  clearCrashBreadcrumbsForTest,
+  getCrashBreadcrumbSnapshot,
+  recordCrashBreadcrumb
+} from '../crash-reporting/crash-breadcrumb-store'
+import { recordRendererBreadcrumbFromRenderer } from './crash-reporting-renderer-breadcrumbs'
+
+type SpanOptions = { attributes: Record<string, unknown> }
+const startSpanMock = vi.fn((_name: string, _options: SpanOptions) => ({ end: () => {} }))
+vi.mock('../observability/tracer', () => ({
+  startSpan: (name: string, options: SpanOptions) => startSpanMock(name, options)
+}))
+
+const WEDGE_BREADCRUMB = 'terminal_replay_guard_wedged_release'
+
+/** Reattach-path shape: identity-bearing (`tabIdHash`, optionally `ptyId`). */
+function emitReattachWedge(pane: number, withPtyId = false): void {
+  recordRendererBreadcrumbFromRenderer({
+    name: WEDGE_BREADCRUMB,
+    data: {
+      paneId: pane,
+      leafIdHash: `leaf${String(pane).padStart(5, '0')}`,
+      tabIdHash: `tab${String(pane).padStart(6, '0')}`,
+      worktreeIdHash: 'caa15fa9',
+      ...(withPtyId ? { ptyId: `…@@pty-${pane}` } : {})
+    }
+  })
+}
+
+/** Restore-path shape (restoreScrollbackBuffers): no tabIdHash, no ptyId. */
+function emitRestoreWedge(pane: number): void {
+  recordRendererBreadcrumbFromRenderer({
+    name: WEDGE_BREADCRUMB,
+    data: { paneId: pane, leafIdHash: `leaf${String(pane).padStart(5, '0')}` }
+  })
+}
+
+function wedgeCrumbs(): ReturnType<typeof getCrashBreadcrumbSnapshot> {
+  return getCrashBreadcrumbSnapshot().filter((entry) => entry.name === WEDGE_BREADCRUMB)
+}
+
+function wedgeSpanCount(): number {
+  return startSpanMock.mock.calls.filter(
+    (call) => call[1].attributes['breadcrumb.name'] === WEDGE_BREADCRUMB
+  ).length
+}
+
+beforeEach(() => {
+  startSpanMock.mockClear()
+})
+
+afterEach(() => {
+  clearCrashBreadcrumbsForTest()
+})
+
+// One mount/reveal/wake transition expires every in-flight replay write at once, so
+// the burst reaches the 30-slot ring as N distinct entries. Field span streams measure
+// bursts of 26 in 0.96s and 62 over 85s. No captured report in the 09-02 corpus shows
+// a ring that actually drained — all nine bursts predate their report's ring window —
+// so this bounds a demonstrated hazard, not an observed loss, and must not cost the
+// durable span evidence that did carry those bursts.
+describe('replay-guard wedge burst against the fixed-size breadcrumb ring', () => {
+  it('costs one ring slot per call site and preserves the pre-crash trail', () => {
+    for (let index = 0; index < 10; index += 1) {
+      recordCrashBreadcrumb(`pre_crash_evidence_${index}`, { index })
+    }
+
+    for (let pane = 0; pane < 26; pane += 1) {
+      emitReattachWedge(pane)
+    }
+
+    const snapshot = getCrashBreadcrumbSnapshot()
+    expect(snapshot.filter((entry) => entry.name.startsWith('pre_crash_evidence_'))).toHaveLength(
+      10
+    )
+    expect(wedgeCrumbs()).toHaveLength(1)
+  })
+
+  it('carries the burst multiplicity into the ring as suppressedSinceLast', () => {
+    for (let pane = 0; pane < 26; pane += 1) {
+      emitReattachWedge(pane)
+    }
+
+    // 26 emissions: one owns the slot, 25 fold into it.
+    expect(wedgeCrumbs()[0]?.data?.suppressedSinceLast).toBe(25)
+  })
+
+  // The 121-event field corpus lives entirely in the renderer.breadcrumb span stream,
+  // and the ring is cleared by the restart that usually precedes the crash report, so
+  // ring coalescing must not suppress the per-event spans.
+  it('still emits one durable span per wedge event', () => {
+    for (let pane = 0; pane < 26; pane += 1) {
+      emitReattachWedge(pane)
+    }
+
+    expect(wedgeSpanCount()).toBe(26)
+    // Why no count on the span: one span per event already carries the multiplicity.
+    expect(
+      startSpanMock.mock.calls.some((call) =>
+        JSON.stringify(call[1]).includes('suppressedSinceLast')
+      )
+    ).toBe(false)
+  })
+
+  // Bundle 8907a508 mixes restore-path (identity-less) and reattach-path crumbs in one
+  // window; name-only keying would report only the last one's shape.
+  it('keeps restore-path and reattach-path call sites in separate slots', () => {
+    emitRestoreWedge(1)
+    emitRestoreWedge(2)
+    emitReattachWedge(3)
+    emitReattachWedge(4, true)
+
+    const crumbs = wedgeCrumbs()
+    expect(crumbs).toHaveLength(3)
+    expect(crumbs.map((crumb) => Boolean(crumb.data?.tabIdHash))).toEqual([false, true, true])
+    expect(crumbs.map((crumb) => Boolean(crumb.data?.ptyId))).toEqual([false, false, true])
+  })
+
+  it('bounds a many-pane burst to one slot within a call site', () => {
+    for (let pane = 0; pane < 40; pane += 1) {
+      emitReattachWedge(pane, pane % 2 === 0)
+    }
+
+    expect(wedgeCrumbs()).toHaveLength(2)
+  })
+})

From 9acfba401a91f6be5419950fe920447f3bf047f6 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 00:53:31 -0700
Subject: [PATCH 08/58] fix(crash-reporting): stop claiming kills that never
 landed, and leave proof when the own-Chromium pid set is unreadable (#18578)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(crash-reporting): stop the codex POSIX teardown claiming a group that was already gone

terminatePosixTree's default group signal swallowed every process.kill error and
then recorded a self_tree_kill unconditionally, so an ESRCH — proof the group was
already gone and this teardown killed nothing — still put a suspect in the
five-second render-process-gone attribution window.

Every sibling group-kill in the tree already records only on a proven signal:
terminateDedicatedPosixGroup in this same file, forceKillPosixPtyProcessGroups,
and the claude account-login teardown. This makes the outlier match them.

* fix(crash-reporting): leave proof when the own-Chromium pid set cannot be read

`readOrcaChromiumProcessPids` returns an empty set when `getAppMetrics()`
throws, which is the right decision — refusing every kill would orphan every
PTY, git, codex and notebook tree main tears down, and on main a refusal from
`killSourceControlAgentProcess` releases the managed-home lock with the agent
still alive. But the empty set was byte-identical to "no Chromium on this
host", so the fail-open was invisible in a field bundle.

Keeps the decision, adds a coalesced durable `own_chromium_pids_unreadable`
crumb so the two cases are distinguishable. Coalesced because the gate reads
this set on every tree kill.

* style(crash-reporting): tighten the group-signal comments to the WHY
---
 .../codex-app-server-process-teardown.test.ts | 62 ++++++++++++++++++-
 .../codex-app-server-process-teardown.ts      | 29 +++++----
 src/main/orca-chromium-process-pids.ts        | 30 ++++++++-
 src/main/own-chromium-tree-kill-guard.test.ts | 34 ++++++++++
 4 files changed, 141 insertions(+), 14 deletions(-)

diff --git a/src/main/codex/codex-app-server-process-teardown.test.ts b/src/main/codex/codex-app-server-process-teardown.test.ts
index 1ddb672a531..cec8f91d081 100644
--- a/src/main/codex/codex-app-server-process-teardown.test.ts
+++ b/src/main/codex/codex-app-server-process-teardown.test.ts
@@ -1,7 +1,14 @@
 import type { ChildProcess } from 'node:child_process'
-import { describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  findSelfInitiatedTreeKills,
+  resetSelfInitiatedTreeKillLogForTest
+} from '../crash-reporting/self-initiated-tree-kill-log'
 import { terminateCodexAppServerProcessTree } from './codex-app-server-process-teardown'
 
+/** Above pid_max on every supported POSIX host, so the group signal is a real ESRCH. */
+const UNREACHABLE_PGID = 2_147_483_647
+
 function child() {
   return {
     pid: 1234,
@@ -10,6 +17,10 @@ function child() {
 }
 
 describe('terminateCodexAppServerProcessTree', () => {
+  beforeEach(() => {
+    resetSelfInitiatedTreeKillLogForTest()
+  })
+
   it('waits for the Windows tree kill before releasing the wrapper', async () => {
     const target = child()
     const release = Promise.withResolvers<void>()
@@ -120,6 +131,55 @@ describe('terminateCodexAppServerProcessTree', () => {
     expect(target.kill).not.toHaveBeenCalled()
   })
 
+  /**
+   * `selfInitiatedTreeKillCount` decides whether a `render-process-gone` was
+   * ours. A group that had already exited was killed by nobody, so crediting it
+   * puts a suspect in the five-second window that Orca never issued. Exercised
+   * through the real `process.kill(-pgid)` because the swallow being tested
+   * lives in the production default, not in an injectable seam.
+   */
+  it('does not claim a snapshot group that was already gone', async () => {
+    const target = { pid: UNREACHABLE_PGID, kill: vi.fn(() => true) as ChildProcess['kill'] }
+
+    await expect(
+      terminateCodexAppServerProcessTree(target, undefined, {
+        platform: 'darwin',
+        captureDescendants: async () => ({
+          rootPgid: UNREACHABLE_PGID,
+          descendants: [],
+          capturedAtMs: 1
+        }),
+        terminateDescendants: async () => true
+      })
+    ).resolves.toBe(true)
+
+    expect(target.kill).toHaveBeenLastCalledWith('SIGKILL')
+    expect(findSelfInitiatedTreeKills(Date.now())).toEqual([])
+  })
+
+  it('claims a snapshot group the signal actually reached', async () => {
+    const target = child()
+    const signalProcessGroup = vi.fn()
+
+    await expect(
+      terminateCodexAppServerProcessTree(target, undefined, {
+        platform: 'darwin',
+        captureDescendants: async () => ({ rootPgid: 1234, descendants: [], capturedAtMs: 1 }),
+        terminateDescendants: async () => true,
+        signalProcessGroup
+      })
+    ).resolves.toBe(true)
+
+    expect(signalProcessGroup).toHaveBeenCalledWith(1234, 'SIGKILL')
+    expect(findSelfInitiatedTreeKills(Date.now())).toEqual([
+      expect.objectContaining({
+        pid: 1234,
+        site: 'codex-app-server-teardown',
+        scope: 'posix-process-group'
+      })
+    ])
+  })
+
   it('tears down 40 dedicated groups without process-table scans or cross-group fanout', async () => {
     const killMocks = Array.from({ length: 40 }, () => vi.fn(() => true))
     const targets = killMocks.map((kill, index) => ({
diff --git a/src/main/codex/codex-app-server-process-teardown.ts b/src/main/codex/codex-app-server-process-teardown.ts
index a35ad4d3164..5a9c6e3574b 100644
--- a/src/main/codex/codex-app-server-process-teardown.ts
+++ b/src/main/codex/codex-app-server-process-teardown.ts
@@ -128,19 +128,24 @@ async function terminatePosixTree(
   if (descendantsExited && snapshot.rootPgid === rootPid) {
     const signalGroup =
       deps.signalProcessGroup ??
-      ((pgid: number, signal: NodeJS.Signals) => {
-        try {
-          process.kill(-pgid, signal)
-        } catch {
-          // Group already exited.
-        }
+      ((pgid: number, signal: NodeJS.Signals) => process.kill(-pgid, signal))
+    let groupSignalled = false
+    try {
+      signalGroup(snapshot.rootPgid, 'SIGKILL')
+      groupSignalled = true
+    } catch {
+      // Already-gone is still the desired outcome, but nothing here killed it,
+      // and a crumb for a kill we never landed is a false render-process-gone suspect.
+    }
+    if (groupSignalled) {
+      // Outside the try, as in terminateDedicatedPosixGroup: that catch is the
+      // already-gone contract, not a breadcrumb handler.
+      recordSelfInitiatedTreeKill({
+        pid: snapshot.rootPgid,
+        site: 'codex-app-server-teardown',
+        scope: 'posix-process-group'
       })
-    signalGroup(snapshot.rootPgid, 'SIGKILL')
-    recordSelfInitiatedTreeKill({
-      pid: snapshot.rootPgid,
-      site: 'codex-app-server-teardown',
-      scope: 'posix-process-group'
-    })
+    }
   }
   if (!descendantsExited) {
     child.kill('SIGCONT')
diff --git a/src/main/orca-chromium-process-pids.ts b/src/main/orca-chromium-process-pids.ts
index f22babc6921..b2613e42b79 100644
--- a/src/main/orca-chromium-process-pids.ts
+++ b/src/main/orca-chromium-process-pids.ts
@@ -1,4 +1,5 @@
 import { getAppEnvironment, hasAppEnvironment } from '../shared/app-environment'
+import { recordCoalescedDurableCrashBreadcrumb } from './crash-reporting/durable-crash-breadcrumb'
 
 /**
  * PIDs of Orca's own Chromium processes — browser, renderers, GPU, utilities.
@@ -11,6 +12,14 @@ import { getAppEnvironment, hasAppEnvironment } from '../shared/app-environment'
  * Empty on a Node host and empty on failure: that is "no refusal proven", never
  * "safe to kill" — callers must keep every other guard they already have.
  *
+ * Why failure stays open rather than refusing everything: a refusal is not free.
+ * `terminateWindowsProcessTree` resolves without killing, and
+ * `killSourceControlAgentProcess` returns that straight to a caller that then
+ * releases the managed-home lock, so failing closed would trade one unreadable
+ * metrics table for every PTY, git, codex and notebook tree in main leaking at
+ * once. The `own_chromium_pids_unreadable` crumb is the price of that choice:
+ * without it a throw is byte-identical to "no Chromium on this host".
+ *
  * Host coverage: only Electron main installs a Chromium-backed AppEnvironment
  * (main-process-preflight). The standalone daemon installs none and `orcad`
  * installs a Node one whose `getAppMetrics()` is `[]`, so this set is empty in
@@ -30,7 +39,26 @@ export function readOrcaChromiumProcessPids(): ReadonlySet<number> {
       .map((metric) => metric.pid)
       .filter((pid) => Number.isInteger(pid) && pid > 0)
     return new Set(pids)
-  } catch {
+  } catch (error) {
+    recordUnreadableOwnChromiumMetrics(error)
     return new Set()
   }
 }
+
+// Why coalesced: the gate reads this set on every tree kill, so a persistently
+// broken metrics table would otherwise flood the 30-slot ring it shares.
+const UNREADABLE_METRICS_COALESCE_MS = 60_000
+
+function recordUnreadableOwnChromiumMetrics(error: unknown): void {
+  try {
+    recordCoalescedDurableCrashBreadcrumb({
+      name: 'own_chromium_pids_unreadable',
+      data: { cause: error instanceof Error ? error.message : String(error) },
+      coalesceKey: 'own-chromium-pids-unreadable',
+      minIntervalMs: UNREADABLE_METRICS_COALESCE_MS
+    })
+  } catch {
+    // Diagnostics must never turn an admitted kill into a thrown one: callers
+    // read this set outside their own try.
+  }
+}
diff --git a/src/main/own-chromium-tree-kill-guard.test.ts b/src/main/own-chromium-tree-kill-guard.test.ts
index 7e98661aca6..bd3b1674e18 100644
--- a/src/main/own-chromium-tree-kill-guard.test.ts
+++ b/src/main/own-chromium-tree-kill-guard.test.ts
@@ -143,6 +143,40 @@ describe('refusing to tree-kill our own Chromium processes', () => {
     )
   })
 
+  /**
+   * Fail-open is the deliberate choice — see `orca-chromium-process-pids.ts` for
+   * why refusing everything is worse — so the crumb is the only thing that keeps
+   * an unreadable metrics table distinguishable from a host that has no Chromium.
+   */
+  it('leaves proof, and still admits the kill, when the Chromium metrics cannot be read', () => {
+    appMetricsMock.mockImplementation(() => {
+      throw new Error('getAppMetrics unavailable')
+    })
+
+    expect([...readOrcaChromiumProcessPids()]).toEqual([])
+    // Coalesced: the gate reads this set on every kill, so a broken table must
+    // not evict the ring it shares with the refusal crumb.
+    expect([...readOrcaChromiumProcessPids()]).toEqual([])
+    expect(
+      admitSelfInitiatedTreeKill({
+        pid: RENDERER_PID,
+        site: 'pty-descendant-sweep',
+        scope: 'win-taskkill-tree'
+      })
+    ).toBe(true)
+
+    expect(
+      getCrashBreadcrumbSnapshot().filter(
+        (breadcrumb) => breadcrumb.name === 'own_chromium_pids_unreadable'
+      )
+    ).toEqual([
+      expect.objectContaining({
+        name: 'own_chromium_pids_unreadable',
+        data: expect.objectContaining({ cause: 'getAppMetrics unavailable' })
+      })
+    ])
+  })
+
   it('refuses an own-Chromium pid at the gate the account teardowns share', () => {
     expect(
       admitSelfInitiatedTreeKill({

From 7a714d1bd2750789cd26ad213f9ae2f129807eef Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 00:53:34 -0700
Subject: [PATCH 09/58] fix(terminals): add equality bailouts to the tab
 pane-expansion actions (#18332)

* fix(terminals): bail out of no-op pane-expansion store writes

* test(terminals): lock the root-state identity of the bailout

A `return {}` bailout keeps the map reference but still allocates a new
root state, so zustand walks every listener. Assert root identity too.
---
 .../store/terminals/terminal-layout-state.ts  |  17 +-
 ...inal-pane-expansion-write-bailout.test.tsx | 152 ++++++++++++++++++
 2 files changed, 163 insertions(+), 6 deletions(-)
 create mode 100644 src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx

diff --git a/src/renderer/src/store/terminals/terminal-layout-state.ts b/src/renderer/src/store/terminals/terminal-layout-state.ts
index d95439cf5a8..9b5cf8323c2 100644
--- a/src/renderer/src/store/terminals/terminal-layout-state.ts
+++ b/src/renderer/src/store/terminals/terminal-layout-state.ts
@@ -43,15 +43,20 @@ export function createTerminalLayoutActions(
         }
       })
     },
+    // Why: pane mount/unmount re-asserts the same booleans; bailing like setTabLayout keeps map subscribers asleep.
     setTabPaneExpanded: (tabId, expanded) => {
-      set((s) => ({
-        expandedPaneByTabId: { ...s.expandedPaneByTabId, [tabId]: expanded }
-      }))
+      set((s) =>
+        s.expandedPaneByTabId[tabId] === expanded
+          ? s
+          : { expandedPaneByTabId: { ...s.expandedPaneByTabId, [tabId]: expanded } }
+      )
     },
     setTabCanExpandPane: (tabId, canExpand) => {
-      set((s) => ({
-        canExpandPaneByTabId: { ...s.canExpandPaneByTabId, [tabId]: canExpand }
-      }))
+      set((s) =>
+        s.canExpandPaneByTabId[tabId] === canExpand
+          ? s
+          : { canExpandPaneByTabId: { ...s.canExpandPaneByTabId, [tabId]: canExpand } }
+      )
     },
     setTabLayout: (tabId, layout) => {
       let ownershipTransfers: ReturnType<typeof resolveTerminalLayoutPtyOwnershipTransfers> = []
diff --git a/src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx b/src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx
new file mode 100644
index 00000000000..d0d32f7742f
--- /dev/null
+++ b/src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx
@@ -0,0 +1,152 @@
+// @vitest-environment happy-dom
+
+import { Profiler } from 'react'
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, describe, expect, it } from 'vitest'
+import { createTestStore } from '../slices/store-test-helpers'
+
+afterEach(cleanup)
+
+type TestStore = ReturnType<typeof createTestStore>
+
+const TAB_ID = 'tab-1'
+const NO_OP_WRITES = 25
+
+function recordPublishedMapKeys(store: TestStore): string[] {
+  const published: string[] = []
+  store.subscribe((next, previous) => {
+    if (next.expandedPaneByTabId !== previous.expandedPaneByTabId) {
+      published.push('expandedPaneByTabId')
+    }
+    if (next.canExpandPaneByTabId !== previous.canExpandPaneByTabId) {
+      published.push('canExpandPaneByTabId')
+    }
+  })
+  return published
+}
+
+// Mirrors use-terminal-workspace-store-bindings.ts:17, which subscribes to the raw map.
+function ExpandedPaneSubscriber({ store }: { store: TestStore }): React.JSX.Element {
+  const expandedPaneByTabId = store((s) => s.expandedPaneByTabId)
+  return <span>{String(expandedPaneByTabId[TAB_ID] === true)}</span>
+}
+
+function CanExpandPaneSubscriber({ store }: { store: TestStore }): React.JSX.Element {
+  const canExpandPaneByTabId = store((s) => s.canExpandPaneByTabId)
+  return <span>{String(canExpandPaneByTabId[TAB_ID] === true)}</span>
+}
+
+function renderCommitCounter(subscriber: React.JSX.Element): () => number {
+  let commits = 0
+  render(
+    <Profiler
+      id="terminal-pane-expansion"
+      onRender={() => {
+        commits += 1
+      }}
+    >
+      {subscriber}
+    </Profiler>
+  )
+  const mountCommits = commits
+  return () => commits - mountCommits
+}
+
+describe('setTabPaneExpanded', () => {
+  it('publishes the first write for an unseen tab and a real toggle', () => {
+    const store = createTestStore()
+    const published = recordPublishedMapKeys(store)
+
+    store.getState().setTabPaneExpanded(TAB_ID, false)
+    expect(published).toEqual(['expandedPaneByTabId'])
+    expect(store.getState().expandedPaneByTabId[TAB_ID]).toBe(false)
+
+    store.getState().setTabPaneExpanded(TAB_ID, true)
+    expect(published).toEqual(['expandedPaneByTabId', 'expandedPaneByTabId'])
+    expect(store.getState().expandedPaneByTabId[TAB_ID]).toBe(true)
+  })
+
+  it('bails out when the value is unchanged', () => {
+    const store = createTestStore()
+    store.getState().setTabPaneExpanded(TAB_ID, false)
+    const before = store.getState().expandedPaneByTabId
+    // Root identity too: returning `{}` keeps the map but allocates a new root, so zustand still walks every listener.
+    const rootBefore = store.getState()
+    const published = recordPublishedMapKeys(store)
+
+    for (let i = 0; i < NO_OP_WRITES; i += 1) {
+      store.getState().setTabPaneExpanded(TAB_ID, false)
+    }
+
+    expect(published).toEqual([])
+    expect(store.getState().expandedPaneByTabId).toBe(before)
+    expect(store.getState()).toBe(rootBefore)
+  })
+
+  it('costs no React commit in a map subscriber when the value is unchanged', () => {
+    const store = createTestStore()
+    store.getState().setTabPaneExpanded(TAB_ID, false)
+    const commitsSinceMount = renderCommitCounter(<ExpandedPaneSubscriber store={store} />)
+
+    for (let i = 0; i < NO_OP_WRITES; i += 1) {
+      act(() => {
+        store.getState().setTabPaneExpanded(TAB_ID, false)
+      })
+    }
+    expect(commitsSinceMount()).toBe(0)
+
+    act(() => {
+      store.getState().setTabPaneExpanded(TAB_ID, true)
+    })
+    expect(commitsSinceMount()).toBe(1)
+  })
+})
+
+describe('setTabCanExpandPane', () => {
+  it('publishes the first write for an unseen tab and a real toggle', () => {
+    const store = createTestStore()
+    const published = recordPublishedMapKeys(store)
+
+    store.getState().setTabCanExpandPane(TAB_ID, false)
+    expect(published).toEqual(['canExpandPaneByTabId'])
+    expect(store.getState().canExpandPaneByTabId[TAB_ID]).toBe(false)
+
+    store.getState().setTabCanExpandPane(TAB_ID, true)
+    expect(published).toEqual(['canExpandPaneByTabId', 'canExpandPaneByTabId'])
+    expect(store.getState().canExpandPaneByTabId[TAB_ID]).toBe(true)
+  })
+
+  it('bails out when the value is unchanged', () => {
+    const store = createTestStore()
+    store.getState().setTabCanExpandPane(TAB_ID, false)
+    const before = store.getState().canExpandPaneByTabId
+    const rootBefore = store.getState()
+    const published = recordPublishedMapKeys(store)
+
+    for (let i = 0; i < NO_OP_WRITES; i += 1) {
+      store.getState().setTabCanExpandPane(TAB_ID, false)
+    }
+
+    expect(published).toEqual([])
+    expect(store.getState().canExpandPaneByTabId).toBe(before)
+    expect(store.getState()).toBe(rootBefore)
+  })
+
+  it('costs no React commit in a map subscriber when the value is unchanged', () => {
+    const store = createTestStore()
+    store.getState().setTabCanExpandPane(TAB_ID, false)
+    const commitsSinceMount = renderCommitCounter(<CanExpandPaneSubscriber store={store} />)
+
+    for (let i = 0; i < NO_OP_WRITES; i += 1) {
+      act(() => {
+        store.getState().setTabCanExpandPane(TAB_ID, false)
+      })
+    }
+    expect(commitsSinceMount()).toBe(0)
+
+    act(() => {
+      store.getState().setTabCanExpandPane(TAB_ID, true)
+    })
+    expect(commitsSinceMount()).toBe(1)
+  })
+})

From cc9e9ed65fc3d4f69d79224eb66c437fb819528d Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 00:53:37 -0700
Subject: [PATCH 10/58] fix(crash-reporting): sample system memory before the
 process is gone (#18356)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(crash-reporting): sample system memory before the renderer dies

* fix(crash-reporting): make the pre-gone host sample decisive, not just present

Round-1 review said the shipped field set could not decide G4-oom. Fixed.

Decisive field (blocking #1). The investigation's own win-lowspec repro
falsified "low available commit kills": at a 127 MB commit floor Windows grew
the pagefile to 2029 MB and nothing died, and it named the missing datum —
pagefile-growth headroom / system-drive free space. `getSystemMemoryInfo()`
gives neither. Added `swap-volume-free-space.ts`: one `fs.statfs` on the volume
backing the pagefile (SystemRoot on Windows, the root fs elsewhere, resolved
via `path.parse().root`), published as `systemMemoryPreGoneSwapVolumeFreeMB`.
Together with the already-emitted commit limit that separates "commit was low"
from "commit was refused". Pagefile *max* size needs a registry read; skipped
deliberately — per-operation interpreter spawning is exactly what
docs/reference/windows-edr-posture.md says not to add for telemetry.

Darwin honesty (blocking #2). Every reading now carries
`systemMemoryPressureSignal`: `available-commit` on Windows (swapFree is
ullAvailPageFile), `mem-available` on Linux when MemAvailable is present,
`none` otherwise — which is always on darwin. A future analyst cannot now table
`freeMB: 272` from a healthy Mac as evidence of exhaustion, because the same
record says the platform gave no pressure verdict. Partial rebuttal on the
suggested reuse: `host-memory.ts:86` was considered and rejected as a periodic
source. It spawns `/usr/bin/memory_pressure` per call, and the sampler this PR
needs runs every 10 s for the app's lifetime; a subprocess at that cadence is
worse than the gap it closes. The reviewer conceded this tradeoff is arguable —
what was not acceptable was shipping the darwin gap silently, so it is now in
the data, not only in a comment.

Staleness (blocking #3). Confirmed the measurement: four of five G4 reports
carried a ~37 s-old sample (4872/36796/37332/38017/39715 ms). Host memory no
longer rides the 60 s process-metrics sweep; `pre-gone-host-memory.ts` samples
it on its own 10 s timer with its own `systemMemoryPreGoneSampleAgeMs`. One
GlobalMemoryStatusEx-class call plus one statfs is cheap enough at that rate. A
refusal shorter than the interval stays invisible and the module comment says
so — no polling cadence fixes that.

Non-blocking, all taken: renamed `gone-time-system-memory.ts` ->
`system-memory-details.ts` with the now-false "reads AFTER the crash" framing
scoped to the gone-time caller; pre-gone host keys moved out of the
`processMetrics` namespace to `systemMemoryPreGone*`, so the string-surgery
`preGoneDetailKey` helper is gone and a `systemMemory` prefix scan sees both
reads; the bare catch no longer spans both halves of the sample, and a test
pins that a throwing host read leaves the process-metric sample intact; the
inert second test is replaced by three that go red without this change
(verified: swap-volume, pressure-signal and cadence assertions all fail when
the production hunks are reverted).

Rebuttal, non-blocking #5 (duplicated electron mock across two test files):
declined. `vi.mock` is hoisted per file, so the mock cannot be shared without a
setup module, and this directory already has 26 focused test files that each
re-declare it. Splitting by concern is the local convention.

`startPreGoneProcessMetricsSampling` is renamed `startPreGoneCrashSampling`
since it now starts two samplers.

* fix(crash-reporting): test the arming, gate the swap volume, unblock the host read

Round-2 review blocked on four items. All four addressed.

WHAT THIS BRANCH ACTUALLY DOES, AT HEAD (blocking #4). The commit-1 message
("13 lines, 1 production file, no new module, new optional numeric fields
only", `processMetricsPreGoneSystemMemory*` keys, a `preGoneDetailKey` helper,
a `pre-gone-system-memory.test.ts`) describes a superseded revision; every one
of those claims is false now, so it must not be used as the PR description.
The change against origin/main is: 3 new production modules
(`pre-gone-host-memory.ts`, `system-memory-details.ts`,
`swap-volume-free-space.ts`), 1 deleted (`gone-time-system-memory.ts`), plus
edits to `process-gone-diagnostics.ts` and `main-process-ready-runtime.ts` and
2 test files. It adds a second main-process interval timer that runs for the
life of the app: every 10 s one synchronous GlobalMemoryStatusEx-class read,
and on win32/darwin one `fs.statfs` on the swap-backing volume. Details are
`systemMemoryPreGone*`, and two of them are STRINGS, not numbers:
`systemMemoryPreGonePressureSignal` (enum) and `systemMemoryPreGoneSwapVolume`
(a drive label, separator-trimmed so it is not a path). Both are assigned after
`sanitizeCrashReportDetails`; neither carries user content.

Arming is now tested (blocking #1). The reviewer deleted
`startPreGoneSystemMemorySampling(...)` from `startPreGoneCrashSampling` and
all 264 tests stayed green — confirmed and fixed. `pre-gone-host-memory.test.ts`
now calls `startPreGoneCrashSampling()` with production defaults and asserts
both `setInterval` calls, their literal periods `[60_000, 10_000]`, that both
timers are unref'd, and that advancing 10 s takes a fresh host sample that
reaches `buildProcessGoneCrashDetails` with `SampleAgeMs: 0`. Verified red on
revert: deleting the arming line -> 1 failure; changing the interval constant
to 30_000 -> 1 failure (the old assertion compared the constant to itself and
caught neither). The tautological `10_000 < 60_000 / 2` test is gone,
superseded by this one.

Swap volume is win32/darwin only (blocking #2). On Linux swap is a fixed
partition, a fixed-size swapfile, or zram; none grow into root-fs free space,
so `SwapVolumeFreeMB: 380000` beside `SwapFreeMB: 0` would have invited exactly
the wrong verdict on the two Linux cluster members. `swapVolumeAnchor` returns
undefined off win32/darwin, so no field and no statfs at all. The comment
claiming "elsewhere swap is on the root fs" was wrong and is gone. The Windows
anchor is still the DEFAULT pagefile volume, so the measured volume now ships
with the number (`systemMemoryPreGoneSwapVolume: 'C:'`) instead of being
implied. The honesty label covers it: win32 reads `available-commit` only when
the volume datum is present, and `available-commit-unqualified` otherwise —
which also fixes non-blocking #5, where the synchronous gone-time read claimed
a verdict its own fields could not support.

Host read no longer waits on statfs (blocking #3). `samplePreGoneSystemMemory`
now commits the synchronous memory reading first and merges volume free space
in afterwards, so the cadence is 10 s regardless of disk-metadata latency and a
hung volume can no longer stop host sampling — precisely the paging-storm case
this exists for. The in-flight latch now guards only the statfs. Verified red
on revert to the serialized shape (2 failures). A stale-but-slow-moving volume
value merging into a newer memory sample is deliberate and commented.

Non-blocking #3 (reset does not invalidate an in-flight sample): fixed with a
generation counter bumped by `resetPreGoneSystemMemorySamplingForTest`, so a
late statfs cannot repopulate a reset sample. Separately, the volume read now
only runs after a host sample committed, which removes the real `statfs('/')`
side effect from `process-gone-diagnostics.test.ts` entirely.

REBUTTAL, darwin `memory_pressure` reuse (non-blocking #2): declined, with
evidence. `readDarwinAvailableMemory` at src/main/memory/host-memory.ts:87 is
reached only via `collectHostMemory` <- `runSnapshot` <- `collectMemorySnapshot`,
whose only callers are the `memory:getSnapshot` IPC handler and
orca-runtime-pty-foreground-process-reads.ts:170 — both on demand. There is no
periodic snapshot, so there is no cached reading to reuse for free; adopting it
means spawning `/usr/bin/memory_pressure` on a main-process timer for the life
of the app, and its module-global `darwinAvailabilitySupported` latch is shared
with the memory UI. The gap is not hidden: darwin ships
`PressureSignal: 'none'` in the data, and the module comment now cites the
existing reader and why it is not used here rather than claiming Orca lacks
one.

Verified: `vitest src/main/crash-reporting src/main/startup src/main/memory` =
769 passed / 6 skipped (crash-reporting re-run 5x, no flake);
`tsc --noEmit -p config/tsconfig.node.json` 0; `oxlint` 0; `oxfmt --check` 0.

* fix(crash-reporting): stop a stale statfs qualifying the commit verdict

Round-3 adversarial review, 2 blocking. Both fixed with mutation-verified
tests.

1. `mergeSwapVolumeFreeSpace` merged the volume reading into whatever sample
   was current at RESOLUTION time, and `pressureSignal` then upgraded win32
   from `available-commit-unqualified` to the decisive `available-commit` on
   the strength of it. The `swapVolumeReadInFlight` latch makes every
   intervening tick skip the merge, so the lag is as old as the last STARTED
   statfs, not the last tick — and no age field exposed it, because
   `systemMemoryPreGoneSampleAgeMs` describes only the synchronous memory read.

   Reviewer's executed scenario: a statfs issued at t=0 on a healthy host
   (40 GB free) resolving at t=20 s of commit pressure emitted
   `SwapFreeMB: 200` beside `SwapVolumeFreeMB: 40000`, labelled
   `available-commit`, with `SampleAgeMs: 0`. That reads as "the pagefile had
   room, so this was not a commit refusal" — the opposite conclusion, wearing
   the branch's highest-confidence label, on exactly the win32 G4-oom reports
   this exists to decide.

   The datum still ships (it is the only pagefile-expandability signal there
   is), but now:
   - the sample carries `swapVolumeSampledAtMs` — the tick that ISSUED the
     statfs, never the one it resolved on — surfaced as
     `systemMemoryPreGoneSwapVolumeAgeMs`;
   - only a statfs that answers on its own tick may qualify the verdict.
     `withSwapVolumeFreeSpace` takes `coTimed`; false keeps
     `available-commit-unqualified`.
   The next tick issues a fresh statfs, so the verdict recovers on its own.

2. The branch's sole production entry point — `startPreGoneCrashSampling()` at
   main-process-ready-runtime.ts:128 — was untested. Deleting it left 691
   tests across crash-reporting/ and startup/ green, while a comment in the
   new test file claimed that gap was why the test was written. This is pure
   instrumentation, so that one line is the whole of its value in the shipped
   app. Added a source-level wiring test (the pattern this repo already uses
   for arm-once ready-phase lines) that pins the import, exactly one call, the
   call at statement indent, and that `main-process-ready.ts` awaits the
   function it lives in. The misleading comment is gone.

Mutation-verified — each goes red alone:
  coTimed -> always true                     1 failed (verdict)
  drop swapVolumeSampledAtMs age             1 failed (verdict test)
  delete startPreGoneCrashSampling()         1 failed (wiring)
  wrap it in `if (!is.dev) { ... }`          1 failed (wiring)

Verified: tsc -p config/tsconfig.node.json exit 0; oxlint
src/main/crash-reporting src/main/startup exit 0; 268 tests in
crash-reporting/ pass. Across crash-reporting/ + startup/ + memory/: 769
passed, 2 failed — both environment-dependent and failing identically on the
unmodified tree (Xvfb rebind, and a whole-repo glob census that times out).

* fix(crash-reporting): stop free disk standing in for pagefile growability

The win32 reading was promoted to the decisive `available-commit` whenever a
co-timed volume number merely existed, which the data cannot support: a fixed
or disabled pagefile grows into no amount of empty disk, its maximum is
unreadable here, and the measured volume is only the DEFAULT pagefile drive. A
host with 180 MB of available commit, a commit limit at RAM and 812 GB free
read as "the pagefile had room" — the opposite conclusion, under the branch's
most confident label.

The volume datum is now named for what it is (`available-commit-volume-cotimed`,
context beside the commit number), and the one decisive win32 case — a commit
limit at or below RAM, i.e. no pagefile behind it — gets its own label.

Also: carry the last volume reading onto the sample that replaces it, aged and
non-qualifying, so a statfs slower than one tick no longer makes the field
vanish from the reports it exists for; don't commit a reading whose every
memory field failed, which shipped an age and a disk-free number with no host
memory beside them; and move the startup wiring test beside the file it pins,
scoped to the ready-phase entry's own body so the call cannot satisfy it from
a sibling export nothing calls.

* fix(crash-reporting): co-time the statfs by tick, not sample identity

A tick whose host read fails leaves the pre-gone sample object in place, so
the identity check still read a 25 s-late statfs as co-timed.
---
 .../gone-time-system-memory.ts                |  77 ----
 .../pre-gone-host-memory.test.ts              | 379 ++++++++++++++++++
 .../crash-reporting/pre-gone-host-memory.ts   | 164 ++++++++
 .../process-gone-diagnostics.test.ts          |  22 +-
 .../process-gone-diagnostics.ts               |  23 +-
 .../crash-reporting/swap-volume-free-space.ts |  67 ++++
 .../crash-reporting/system-memory-details.ts  | 161 ++++++++
 .../startup/main-process-ready-runtime.ts     |   9 +-
 .../pre-gone-crash-sampling-wiring.test.ts    |  49 +++
 9 files changed, 854 insertions(+), 97 deletions(-)
 delete mode 100644 src/main/crash-reporting/gone-time-system-memory.ts
 create mode 100644 src/main/crash-reporting/pre-gone-host-memory.test.ts
 create mode 100644 src/main/crash-reporting/pre-gone-host-memory.ts
 create mode 100644 src/main/crash-reporting/swap-volume-free-space.ts
 create mode 100644 src/main/crash-reporting/system-memory-details.ts
 create mode 100644 src/main/startup/pre-gone-crash-sampling-wiring.test.ts

diff --git a/src/main/crash-reporting/gone-time-system-memory.ts b/src/main/crash-reporting/gone-time-system-memory.ts
deleted file mode 100644
index 7cca89d2d4b..00000000000
--- a/src/main/crash-reporting/gone-time-system-memory.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-import type { CrashReportDetailValue } from '../../shared/crash-reporting'
-
-// ─── System memory at gone time ─────────────────────────────────────
-// Why: the system outlives the crashed process, so this IS sampleable at
-// process-gone — it separates "renderer grew huge" from "machine out of
-// memory/commit", which the per-process buckets alone cannot.
-// Timing honesty: this reads AFTER the crashed process's memory returned to
-// the OS, so free/swapFree can look healthier than they were at kill time.
-// Platform honesty: swap* exist on Windows/Linux only. On Linux `free` is
-// /proc/meminfo MemFree and is NOT the pressure signal — it excludes page cache
-// and other reclaimable memory; `available` (MemAvailable, Linux-only) is. On
-// macOS `free` is near-meaningless (file cache and compression keep it low on
-// healthy machines); fileBacked/purgeable are the only reclaimability proxy this
-// API gives there, and none of these fields answers "was the machine under
-// pressure" on macOS — that needs a signal Electron does not expose.
-
-type CrashReportDetails = Record<string, CrashReportDetailValue>
-
-export function memoryKBFieldMB(value: unknown): number | undefined {
-  const kb = typeof value === 'number' && Number.isFinite(value) ? value : undefined
-  return kb === undefined ? undefined : Math.round(Math.max(0, kb) / 1024)
-}
-
-type SystemMemoryInfoLike = {
-  total?: unknown
-  free?: unknown
-  available?: unknown
-  swapTotal?: unknown
-  swapFree?: unknown
-  fileBacked?: unknown
-  purgeable?: unknown
-}
-
-type SystemMemoryInfoReader = () => SystemMemoryInfoLike | null
-
-function readElectronSystemMemoryInfo(): SystemMemoryInfoLike | null {
-  const read = (process as NodeJS.Process & { getSystemMemoryInfo?: () => SystemMemoryInfoLike })
-    .getSystemMemoryInfo
-  if (typeof read !== 'function') {
-    return null
-  }
-  try {
-    return read.call(process)
-  } catch {
-    return null
-  }
-}
-
-let systemMemoryInfoReader: SystemMemoryInfoReader = readElectronSystemMemoryInfo
-
-export function setSystemMemoryInfoReaderForTest(reader: SystemMemoryInfoReader | null): void {
-  systemMemoryInfoReader = reader ?? readElectronSystemMemoryInfo
-}
-
-export function getSystemMemoryAtGoneDetails(): CrashReportDetails {
-  const info = systemMemoryInfoReader()
-  if (!info) {
-    return {}
-  }
-  const details: CrashReportDetails = {}
-  const fields: readonly [keyof SystemMemoryInfoLike, string][] = [
-    ['total', 'systemMemoryTotalMB'],
-    ['free', 'systemMemoryFreeMB'],
-    ['available', 'systemMemoryAvailableMB'],
-    ['swapTotal', 'systemMemorySwapTotalMB'],
-    ['swapFree', 'systemMemorySwapFreeMB'],
-    ['fileBacked', 'systemMemoryFileBackedMB'],
-    ['purgeable', 'systemMemoryPurgeableMB']
-  ]
-  for (const [field, key] of fields) {
-    const mb = memoryKBFieldMB(info[field])
-    if (mb !== undefined) {
-      details[key] = mb
-    }
-  }
-  return details
-}
diff --git a/src/main/crash-reporting/pre-gone-host-memory.test.ts b/src/main/crash-reporting/pre-gone-host-memory.test.ts
new file mode 100644
index 00000000000..0df13d4fee5
--- /dev/null
+++ b/src/main/crash-reporting/pre-gone-host-memory.test.ts
@@ -0,0 +1,379 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  getSystemMemoryDetails,
+  setSystemMemoryInfoReaderForTest,
+  withSwapVolumeFreeSpace
+} from './system-memory-details'
+import {
+  readSwapVolumeFreeSpace,
+  setSwapVolumeFreeSpaceReaderForTest,
+  type SwapVolumeFreeSpace
+} from './swap-volume-free-space'
+import { samplePreGoneSystemMemory } from './pre-gone-host-memory'
+import {
+  buildProcessGoneCrashDetails,
+  resetPreGoneCrashSamplingForTest,
+  samplePreGoneProcessMetrics,
+  startPreGoneCrashSampling
+} from './process-gone-diagnostics'
+
+type MetricFixture = {
+  pid: number
+  creationTime: number
+  type: string
+  memory: { workingSetSize: number; peakWorkingSetSize?: number; privateBytes?: number }
+}
+
+const { appMetricsMock } = vi.hoisted(() => ({
+  appMetricsMock: vi.fn<() => MetricFixture[]>(() => [])
+}))
+
+vi.mock('electron', () => ({ app: { getAppMetrics: appMetricsMock } }))
+
+const BROWSER_AND_RENDERER: MetricFixture[] = [
+  { pid: 10, creationTime: 1, type: 'Browser', memory: { workingSetSize: 1024 * 250 } },
+  {
+    pid: 11,
+    creationTime: 2,
+    type: 'Tab',
+    memory: { workingSetSize: 1024 * 400, peakWorkingSetSize: 1024 * 420, privateBytes: 1024 * 260 }
+  }
+]
+
+const BROWSER_ONLY: MetricFixture[] = [BROWSER_AND_RENDERER[0]]
+
+const UNDER_COMMIT_PRESSURE = {
+  total: 16_000 * 1024,
+  free: 400 * 1024,
+  swapTotal: 48_000 * 1024,
+  swapFree: 200 * 1024
+}
+
+const AFTER_THE_CORPSE_RELEASED = {
+  total: 16_000 * 1024,
+  free: 3_000 * 1024,
+  swapTotal: 48_000 * 1024,
+  swapFree: 2_900 * 1024
+}
+
+// Commit limit ~= RAM: a disabled or fixed pagefile, which no amount of empty
+// disk can grow into. `swapTotal > total` is all this API can say about that.
+const FIXED_PAGEFILE_UNDER_PRESSURE = {
+  total: 16_000 * 1024,
+  free: 300 * 1024,
+  swapTotal: 16_100 * 1024,
+  swapFree: 180 * 1024
+}
+
+const NO_PAGEFILE_UNDER_PRESSURE = {
+  ...FIXED_PAGEFILE_UNDER_PRESSURE,
+  swapTotal: 15_900 * 1024
+}
+
+const BEFORE_THE_STORM = {
+  total: 16_000 * 1024,
+  free: 9_000 * 1024,
+  swapTotal: 48_000 * 1024,
+  swapFree: 30_000 * 1024
+}
+
+describe('pre-gone host memory', () => {
+  beforeEach(() => {
+    resetPreGoneCrashSamplingForTest()
+    setSystemMemoryInfoReaderForTest(null)
+    setSwapVolumeFreeSpaceReaderForTest(null)
+    appMetricsMock.mockClear()
+    appMetricsMock.mockReturnValue(BROWSER_AND_RENDERER)
+  })
+
+  it('carries a pre-gone host reading, not only the post-mortem one', async () => {
+    setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+    setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 120, volume: 'C:' }))
+    await samplePreGoneSystemMemory(Date.now() - 5_000)
+
+    // The renderer dies; its ~400 MB returns to the OS, so the gone-time read
+    // now shows a much healthier machine than the one that refused the alloc.
+    setSystemMemoryInfoReaderForTest(() => AFTER_THE_CORPSE_RELEASED)
+    appMetricsMock.mockReturnValue(BROWSER_ONLY)
+
+    const details = buildProcessGoneCrashDetails({ processType: 'renderer' }, 'renderer')
+
+    expect(details.systemMemorySwapFreeMB).toBe(2_900)
+    expect(details.systemMemoryPreGoneSwapFreeMB).toBe(200)
+    expect(details.systemMemoryPreGoneFreeMB).toBe(400)
+    expect(details.systemMemoryPreGoneTotalMB).toBe(16_000)
+    // Why: host memory keeps its own key family, so a `systemMemory` prefix scan sees both reads.
+    expect(
+      Object.keys(details).filter((key) => key.startsWith('processMetricsPreGoneSystem'))
+    ).toEqual([])
+  })
+
+  // Why this decides the cluster: 200 MB available commit is only a REFUSAL when
+  // the pagefile cannot grow, which is what the volume's free space says.
+  it('reports swap-volume free space so low commit can be told from refused commit', async () => {
+    setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+    setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 120, volume: 'C:' }))
+    await samplePreGoneSystemMemory(Date.now() - 5_000)
+
+    const details = buildProcessGoneCrashDetails({ processType: 'renderer' }, 'renderer')
+
+    expect(details.systemMemoryPreGoneSwapVolumeFreeMB).toBe(120)
+    // Which volume was measured: Windows only names the DEFAULT pagefile drive.
+    expect(details.systemMemoryPreGoneSwapVolume).toBe('C:')
+  })
+
+  it('omits swap-volume free space on Linux, where swap cannot grow into free disk', async () => {
+    // Linux swap is a fixed partition, a fixed-size swapfile, or zram; reporting
+    // root-fs free space next to SwapFreeMB 0 would read as headroom that is not there.
+    setSwapVolumeFreeSpaceReaderForTest(null)
+
+    await expect(readSwapVolumeFreeSpace('linux')).resolves.toBeUndefined()
+  })
+
+  it('labels the reading with the pressure verdict the platform can actually give', () => {
+    // Windows available commit is only a REFUSAL when the pagefile cannot grow,
+    // which nothing here proves, so no label may read as that verdict.
+    setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+    const windowsCommit = getSystemMemoryDetails('win32')
+    expect(windowsCommit.systemMemoryPressureSignal).toBe('available-commit-unqualified')
+    expect(
+      withSwapVolumeFreeSpace(windowsCommit, { freeMB: 120, volume: 'C:' }, 'win32')
+        .systemMemoryPressureSignal
+    ).toBe('available-commit-volume-cotimed')
+    // A volume number from a different moment describes a different machine.
+    expect(
+      withSwapVolumeFreeSpace(windowsCommit, { freeMB: 120, volume: 'C:' }, 'win32', false)
+        .systemMemoryPressureSignal
+    ).toBe('available-commit-unqualified')
+
+    setSystemMemoryInfoReaderForTest(() => ({ total: 16_000 * 1024, free: 400 * 1024 }))
+    expect(getSystemMemoryDetails('linux').systemMemoryPressureSignal).toBe('none')
+
+    setSystemMemoryInfoReaderForTest(() => ({ total: 16_000 * 1024, available: 900 * 1024 }))
+    expect(getSystemMemoryDetails('linux').systemMemoryPressureSignal).toBe('mem-available')
+
+    // darwin free/fileBacked/purgeable answer reclaimability, never pressure.
+    setSystemMemoryInfoReaderForTest(() => ({
+      total: 16_000 * 1024,
+      free: 272 * 1024,
+      fileBacked: 2_694 * 1024,
+      purgeable: 0
+    }))
+    expect(getSystemMemoryDetails('darwin').systemMemoryPressureSignal).toBe('none')
+  })
+
+  // Why this and not the volume number: the branch's own repro needed a pagefile
+  // that CANNOT grow to kill anything, and neither the pagefile maximum nor its
+  // drive is readable here — `swapVolumeAnchor` measures SystemRoot's volume,
+  // which a relocated pagefile does not live on.
+  it('never reads free disk as proof the pagefile could have grown', () => {
+    setSystemMemoryInfoReaderForTest(() => FIXED_PAGEFILE_UNDER_PRESSURE)
+    const fixedPagefile = withSwapVolumeFreeSpace(
+      getSystemMemoryDetails('win32'),
+      { freeMB: 812_000, volume: 'C:' },
+      'win32'
+    )
+    // 180 MB of commit beside 812 GB of free disk: co-timed, and still not a
+    // verdict — reading it as "the pagefile had room" is the opposite conclusion.
+    expect(fixedPagefile.systemMemoryPressureSignal).toBe('available-commit-volume-cotimed')
+
+    // The one decisive win32 case: commit limit at or below RAM means there is
+    // no pagefile behind it, so the floor cannot heal however empty the disk is.
+    setSystemMemoryInfoReaderForTest(() => NO_PAGEFILE_UNDER_PRESSURE)
+    expect(
+      withSwapVolumeFreeSpace(
+        getSystemMemoryDetails('win32'),
+        { freeMB: 812_000, volume: 'C:' },
+        'win32'
+      ).systemMemoryPressureSignal
+    ).toBe('available-commit-hard-capped')
+  })
+
+  // Why the verdict and not just the field: a statfs issued on a healthy host at
+  // t=0 that resolves 20 s into a commit storm prints "200 MB commit, 40 GB of
+  // pagefile headroom" — which reads as NOT a commit refusal, the opposite
+  // conclusion, under the branch's most confident label.
+  it('will not let a statfs that outlived its tick qualify the win32 commit verdict', async () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')!
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    vi.useFakeTimers()
+    let resolveVolume: (value: SwapVolumeFreeSpace) => void = () => {}
+    try {
+      setSystemMemoryInfoReaderForTest(() => BEFORE_THE_STORM)
+      setSwapVolumeFreeSpaceReaderForTest(
+        () =>
+          new Promise<SwapVolumeFreeSpace>((resolve) => {
+            resolveVolume = resolve
+          })
+      )
+      void samplePreGoneSystemMemory(0)
+
+      // The storm arrives; the in-flight latch makes every tick skip the merge,
+      // so the pending statfs is as old as the tick that STARTED it.
+      setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+      await samplePreGoneSystemMemory(10_000)
+      await samplePreGoneSystemMemory(20_000)
+
+      resolveVolume({ freeMB: 40_000, volume: 'C:' })
+      await vi.advanceTimersByTimeAsync(0)
+
+      vi.setSystemTime(20_000)
+      const stale = buildProcessGoneCrashDetails({}, 'renderer')
+      expect(stale.systemMemoryPreGoneSwapFreeMB).toBe(200)
+      // The pre-storm volume number still ships — but carrying its own age, and
+      // without promoting the verdict the analyst reads.
+      expect(stale.systemMemoryPreGoneSwapVolumeFreeMB).toBe(40_000)
+      expect(stale.systemMemoryPreGoneSampleAgeMs).toBe(0)
+      expect(stale.systemMemoryPreGoneSwapVolumeAgeMs).toBe(20_000)
+      expect(stale.systemMemoryPreGonePressureSignal).toBe('available-commit-unqualified')
+
+      // The next tick's statfs answers on its own tick, so it qualifies again.
+      setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 900, volume: 'C:' }))
+      await samplePreGoneSystemMemory(30_000)
+      vi.setSystemTime(30_000)
+      const fresh = buildProcessGoneCrashDetails({}, 'renderer')
+      expect(fresh.systemMemoryPreGoneSwapVolumeFreeMB).toBe(900)
+      expect(fresh.systemMemoryPreGoneSwapVolumeAgeMs).toBe(0)
+      expect(fresh.systemMemoryPreGonePressureSignal).toBe('available-commit-volume-cotimed')
+    } finally {
+      vi.useRealTimers()
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  // Round 5: sample identity alone could not see these ticks. A host read that
+  // returns nothing leaves the sample object in place, so `sample === issuedFor`
+  // still held 25 s and two ticks later and the statfs re-qualified the verdict.
+  it('will not let ticks with a failed host read pass a stale statfs off as co-timed', async () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')!
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    vi.useFakeTimers()
+    let resolveVolume: (value: SwapVolumeFreeSpace) => void = () => {}
+    try {
+      setSystemMemoryInfoReaderForTest(() => BEFORE_THE_STORM)
+      setSwapVolumeFreeSpaceReaderForTest(
+        () =>
+          new Promise<SwapVolumeFreeSpace>((resolve) => {
+            resolveVolume = resolve
+          })
+      )
+      void samplePreGoneSystemMemory(0)
+
+      // GlobalMemoryStatusEx starts failing: the sample is neither replaced nor erased.
+      setSystemMemoryInfoReaderForTest(() => null)
+      await samplePreGoneSystemMemory(10_000)
+      await samplePreGoneSystemMemory(20_000)
+
+      resolveVolume({ freeMB: 40_000, volume: 'C:' })
+      await vi.advanceTimersByTimeAsync(0)
+
+      vi.setSystemTime(25_000)
+      const details = buildProcessGoneCrashDetails({}, 'renderer')
+      // 25 s of lag: the label must not say co-timed beside that age.
+      expect(details.systemMemoryPreGoneSwapVolumeAgeMs).toBe(25_000)
+      expect(details.systemMemoryPreGonePressureSignal).toBe('available-commit-unqualified')
+    } finally {
+      vi.useRealTimers()
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  it("arms the host sampler on its own unref'd 10 s timer, not the metric sweep's", async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(0)
+    const readHostMemory = vi.fn(() => UNDER_COMMIT_PRESSURE)
+    setSystemMemoryInfoReaderForTest(readHostMemory)
+    setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 120, volume: 'C:' }))
+    const setIntervalSpy = vi.spyOn(globalThis, 'setInterval')
+    try {
+      startPreGoneCrashSampling()
+
+      // Literal millisecond values: asserting the constants against themselves
+      // would let a cadence regression through, and 37 s of staleness is the bug.
+      expect(setIntervalSpy.mock.calls.map(([, ms]) => ms)).toEqual([60_000, 10_000])
+      for (const { value } of setIntervalSpy.mock.results) {
+        expect((value as NodeJS.Timeout).hasRef()).toBe(false)
+      }
+      expect(readHostMemory).toHaveBeenCalledTimes(1)
+
+      readHostMemory.mockReturnValue(AFTER_THE_CORPSE_RELEASED)
+      await vi.advanceTimersByTimeAsync(10_000)
+      // One host tick, no extra metric sweep: the two samplers run independently.
+      expect(readHostMemory).toHaveBeenCalledTimes(2)
+      expect(appMetricsMock).toHaveBeenCalledTimes(1)
+
+      const details = buildProcessGoneCrashDetails({}, 'renderer')
+      expect(details.systemMemoryPreGoneSampleAgeMs).toBe(0)
+      expect(details.systemMemoryPreGoneSwapFreeMB).toBe(2_900)
+    } finally {
+      setIntervalSpy.mockRestore()
+      vi.useRealTimers()
+    }
+  })
+
+  it('commits the host reading without waiting on the swap-volume statfs', async () => {
+    // Why: statfs is slowest during the paging storm this sampler targets, and
+    // a hung volume must not stall or silently skip host sampling.
+    setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+    setSwapVolumeFreeSpaceReaderForTest(() => new Promise(() => {}))
+
+    void samplePreGoneSystemMemory(Date.now() - 5_000)
+    expect(buildProcessGoneCrashDetails({}, 'renderer').systemMemoryPreGoneSwapFreeMB).toBe(200)
+
+    // A second tick still refreshes the reading while that statfs hangs.
+    setSystemMemoryInfoReaderForTest(() => AFTER_THE_CORPSE_RELEASED)
+    void samplePreGoneSystemMemory(Date.now())
+    expect(buildProcessGoneCrashDetails({}, 'renderer').systemMemoryPreGoneSwapFreeMB).toBe(2_900)
+  })
+
+  it('publishes no pre-gone host keys when every memory field failed to read', async () => {
+    // Why not "no keys at all": the reading always carries its signal label, so a
+    // committed empty one would ship an age and a volume number with no memory
+    // numbers beside them — a disk-free figure standing in for a host reading.
+    setSystemMemoryInfoReaderForTest(() => ({ total: Number.NaN, free: undefined }))
+    await samplePreGoneSystemMemory(Date.now())
+
+    const details = buildProcessGoneCrashDetails({}, 'renderer')
+
+    expect(Object.keys(details).filter((key) => key.startsWith('systemMemoryPreGone'))).toEqual([])
+  })
+
+  it('carries the last volume reading forward, aged, instead of dropping it', async () => {
+    vi.useFakeTimers()
+    try {
+      setSystemMemoryInfoReaderForTest(() => UNDER_COMMIT_PRESSURE)
+      setSwapVolumeFreeSpaceReaderForTest(() => Promise.resolve({ freeMB: 42, volume: 'C:' }))
+      await samplePreGoneSystemMemory(0)
+
+      // The next tick's statfs hangs — during the paging storm this targets, that
+      // is the normal case — so the tick has no volume reading of its own, and
+      // the sample that replaces the last one would otherwise drop the field.
+      setSwapVolumeFreeSpaceReaderForTest(() => new Promise<never>(() => {}))
+      void samplePreGoneSystemMemory(10_000)
+      vi.setSystemTime(10_000)
+
+      const details = buildProcessGoneCrashDetails({}, 'renderer')
+      expect(details.systemMemoryPreGoneSwapVolumeFreeMB).toBe(42)
+      expect(details.systemMemoryPreGoneSwapVolume).toBe('C:')
+      expect(details.systemMemoryPreGoneSampleAgeMs).toBe(0)
+      // Carried, not re-read: it ships at its real age, never as a fresh number.
+      expect(details.systemMemoryPreGoneSwapVolumeAgeMs).toBe(10_000)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps a failed host read from erasing the process-metric sample', async () => {
+    samplePreGoneProcessMetrics(Date.now() - 5_000)
+    setSystemMemoryInfoReaderForTest(() => {
+      throw new Error('getSystemMemoryInfo unavailable')
+    })
+    await samplePreGoneSystemMemory(Date.now() - 5_000)
+    setSystemMemoryInfoReaderForTest(null)
+
+    const details = buildProcessGoneCrashDetails({ processType: 'renderer' }, 'renderer')
+
+    expect(details.processMetricsPreGoneRendererWorkingSetMB).toBe(400)
+    expect(Object.keys(details).filter((key) => key.startsWith('systemMemoryPreGone'))).toEqual([])
+  })
+})
diff --git a/src/main/crash-reporting/pre-gone-host-memory.ts b/src/main/crash-reporting/pre-gone-host-memory.ts
new file mode 100644
index 00000000000..0db56796750
--- /dev/null
+++ b/src/main/crash-reporting/pre-gone-host-memory.ts
@@ -0,0 +1,164 @@
+import type { CrashReportDetailValue } from '../../shared/crash-reporting'
+import { readSwapVolumeFreeSpace } from './swap-volume-free-space'
+import {
+  getSystemMemoryDetails,
+  SYSTEM_MEMORY_KEY_PREFIX,
+  withSwapVolumeFreeSpace
+} from './system-memory-details'
+
+// ─── Pre-gone host memory sampling ──────────────────────────────────
+// Why sample at all: the gone-time host read lands after the corpse released
+// its pages, so it reports a healthier machine than the one that refused the
+// allocation.
+// Why 10 s and not the 60 s process-metrics cadence: at 60 s, four of five
+// field OOMs carried a ~37 s old host reading — far too stale to see a
+// transient commit refusal. A refusal shorter than the interval stays
+// invisible; no cadence fixes that.
+
+export const PRE_GONE_SYSTEM_MEMORY_SAMPLE_INTERVAL_MS = 10_000
+
+type CrashReportDetails = Record<string, CrashReportDetailValue>
+
+type PreGoneSystemMemorySample = {
+  details: CrashReportDetails
+  sampledAtMs: number
+  /** Tick that ISSUED the statfs now merged in — never the tick it resolved on. */
+  swapVolumeSampledAtMs?: number
+}
+
+let preGoneSample: PreGoneSystemMemorySample | null = null
+let preGoneTimer: ReturnType<typeof setInterval> | null = null
+let swapVolumeReadInFlight = false
+let samplingGeneration = 0
+let sampleTick = 0
+
+const PRESSURE_SIGNAL_KEY = `${SYSTEM_MEMORY_KEY_PREFIX}PressureSignal`
+
+/**
+ * Carries the last volume reading onto the sample that replaces its own.
+ *
+ * Why: a statfs slower than one tick would otherwise make the field vanish from
+ * the reports it exists for — the next tick replaces the sample wholesale, and
+ * the in-flight latch keeps intervening ticks from merging anything. It ships
+ * with its own (now larger) age and, not being co-timed, never names the label.
+ */
+function withCarriedSwapVolume(sample: PreGoneSystemMemorySample): PreGoneSystemMemorySample {
+  const previous = preGoneSample
+  if (!previous || previous.swapVolumeSampledAtMs === undefined) {
+    return sample
+  }
+  const freeMB = previous.details[`${SYSTEM_MEMORY_KEY_PREFIX}SwapVolumeFreeMB`]
+  const volume = previous.details[`${SYSTEM_MEMORY_KEY_PREFIX}SwapVolume`]
+  if (typeof freeMB !== 'number' || typeof volume !== 'string') {
+    return sample
+  }
+  return {
+    ...sample,
+    details: withSwapVolumeFreeSpace(sample.details, { freeMB, volume }, process.platform, false),
+    swapVolumeSampledAtMs: previous.swapVolumeSampledAtMs
+  }
+}
+
+function commitHostMemorySample(nowMs: number): boolean {
+  try {
+    const details = getSystemMemoryDetails()
+    // Why not `length === 0`: the signal label is appended unconditionally, so a
+    // reading that resolved no memory field at all still arrives with one key.
+    if (!Object.keys(details).some((key) => key !== PRESSURE_SIGNAL_KEY)) {
+      return false
+    }
+    preGoneSample = withCarriedSwapVolume({ details, sampledAtMs: nowMs })
+    return true
+  } catch {
+    // Why: a failed read must not erase the previous good sample.
+    return false
+  }
+}
+
+async function mergeSwapVolumeFreeSpace(issuedOnTick: number): Promise<void> {
+  if (swapVolumeReadInFlight) {
+    return
+  }
+  swapVolumeReadInFlight = true
+  const generation = samplingGeneration
+  const issuedFor = preGoneSample
+  try {
+    const volume = await readSwapVolumeFreeSpace()
+    if (volume && preGoneSample && generation === samplingGeneration) {
+      // Why only its own tick qualifies: a statfs that outlived its tick carries a
+      // pre-storm volume number, and the latch makes that lag unbounded. It still
+      // ships beside its age, but it may not decide the verdict.
+      // Why the tick counter and not sample identity: a tick whose host read fails
+      // leaves the sample object in place, so identity alone reads as co-timed.
+      const coTimed = issuedOnTick === sampleTick
+      preGoneSample = {
+        ...preGoneSample,
+        details: withSwapVolumeFreeSpace(preGoneSample.details, volume, process.platform, coTimed),
+        swapVolumeSampledAtMs: issuedFor?.sampledAtMs
+      }
+    }
+  } catch {
+    // Why: the memory reading is already committed and stands on its own.
+  } finally {
+    swapVolumeReadInFlight = false
+  }
+}
+
+export async function samplePreGoneSystemMemory(nowMs: number = Date.now()): Promise<void> {
+  // Why commit before awaiting: the volume read is a statfs, and under the very
+  // paging storm this targets it is slowest — it must never delay, or (via an
+  // in-flight latch) skip, the cheap synchronous host reading.
+  const tick = ++sampleTick
+  if (!commitHostMemorySample(nowMs)) {
+    return
+  }
+  await mergeSwapVolumeFreeSpace(tick)
+}
+
+export function startPreGoneSystemMemorySampling(
+  intervalMs: number = PRE_GONE_SYSTEM_MEMORY_SAMPLE_INTERVAL_MS
+): void {
+  if (preGoneTimer) {
+    return
+  }
+  void samplePreGoneSystemMemory()
+  preGoneTimer = setInterval(() => void samplePreGoneSystemMemory(), intervalMs)
+  preGoneTimer.unref?.()
+}
+
+export function resetPreGoneSystemMemorySamplingForTest(): void {
+  if (preGoneTimer) {
+    clearInterval(preGoneTimer)
+  }
+  preGoneTimer = null
+  preGoneSample = null
+  swapVolumeReadInFlight = false
+  // Why bump: an already-awaited volume read must not repopulate a reset sample.
+  samplingGeneration += 1
+}
+
+/** Keyed as `systemMemoryPreGone*` so a scan over the `systemMemory` family sees both reads. */
+export function preGoneSystemMemoryDetails(nowMs: number): CrashReportDetails {
+  if (!preGoneSample) {
+    return {}
+  }
+  const details: CrashReportDetails = {
+    [`${SYSTEM_MEMORY_KEY_PREFIX}PreGoneSampleAgeMs`]: Math.max(
+      0,
+      nowMs - preGoneSample.sampledAtMs
+    )
+  }
+  // Why its own age: the volume read resolves out of band, so it can be older
+  // than the memory reading printed beside it, and that gap must be readable.
+  if (preGoneSample.swapVolumeSampledAtMs !== undefined) {
+    details[`${SYSTEM_MEMORY_KEY_PREFIX}PreGoneSwapVolumeAgeMs`] = Math.max(
+      0,
+      nowMs - preGoneSample.swapVolumeSampledAtMs
+    )
+  }
+  for (const [key, value] of Object.entries(preGoneSample.details)) {
+    details[`${SYSTEM_MEMORY_KEY_PREFIX}PreGone${key.slice(SYSTEM_MEMORY_KEY_PREFIX.length)}`] =
+      value
+  }
+  return details
+}
diff --git a/src/main/crash-reporting/process-gone-diagnostics.test.ts b/src/main/crash-reporting/process-gone-diagnostics.test.ts
index e31645865d8..6a6ec410733 100644
--- a/src/main/crash-reporting/process-gone-diagnostics.test.ts
+++ b/src/main/crash-reporting/process-gone-diagnostics.test.ts
@@ -2,11 +2,11 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   buildProcessGoneCrashDetails,
   collectProcessGoneMetricDetails,
-  resetPreGoneProcessMetricsSamplingForTest,
+  resetPreGoneCrashSamplingForTest,
   samplePreGoneProcessMetrics,
-  startPreGoneProcessMetricsSampling
+  startPreGoneCrashSampling
 } from './process-gone-diagnostics'
-import { setSystemMemoryInfoReaderForTest } from './gone-time-system-memory'
+import { setSystemMemoryInfoReaderForTest } from './system-memory-details'
 
 type MetricFixture = {
   pid?: number
@@ -27,7 +27,7 @@ vi.mock('electron', () => ({
 
 describe('process gone diagnostics', () => {
   beforeEach(() => {
-    resetPreGoneProcessMetricsSamplingForTest()
+    resetPreGoneCrashSamplingForTest()
     setSystemMemoryInfoReaderForTest(null)
   })
 
@@ -141,8 +141,8 @@ describe('process gone diagnostics', () => {
     appMetricsMock.mockReturnValue([
       { pid: 30, type: 'Tab', memory: { workingSetSize: 1024 * 100 } }
     ])
-    startPreGoneProcessMetricsSampling(1_000)
-    startPreGoneProcessMetricsSampling(1_000)
+    startPreGoneCrashSampling(1_000)
+    startPreGoneCrashSampling(1_000)
 
     // A crash inside the first interval already has a sample to draw from.
     expect(buildProcessGoneCrashDetails({}, 'renderer')).toMatchObject({
@@ -582,12 +582,12 @@ describe('process gone diagnostics', () => {
   it("arms an unref'd interval so sampling never holds the event loop open", () => {
     const setIntervalSpy = vi.spyOn(globalThis, 'setInterval')
     try {
-      startPreGoneProcessMetricsSampling(60_000)
+      startPreGoneCrashSampling(60_000)
       const timer = setIntervalSpy.mock.results[0]?.value as NodeJS.Timeout
       expect(timer.hasRef()).toBe(false)
     } finally {
       setIntervalSpy.mockRestore()
-      resetPreGoneProcessMetricsSamplingForTest()
+      resetPreGoneCrashSamplingForTest()
     }
   })
 
@@ -641,7 +641,7 @@ describe('process gone diagnostics', () => {
     expect(details.systemMemoryTotalMB).toBe(16_384)
   })
 
-  it('samples system memory at gone time but never into the pre-gone snapshot', () => {
+  it('samples system memory at gone time but never into the processMetrics family', () => {
     appMetricsMock.mockReturnValue([{ pid: 1, type: 'Browser', memory: { workingSetSize: 0 } }])
     samplePreGoneProcessMetrics()
     setSystemMemoryInfoReaderForTest(() => ({
@@ -658,7 +658,9 @@ describe('process gone diagnostics', () => {
       systemMemorySwapTotalMB: 8_192,
       systemMemorySwapFreeMB: 40
     })
-    expect(details.processMetricsPreGoneSystemMemoryTotalMB).toBeUndefined()
+    expect(
+      Object.keys(details).filter((key) => key.startsWith('processMetricsPreGoneSystem'))
+    ).toEqual([])
   })
 
   it('leaves records unflagged when the crashed bucket is still populated', () => {
diff --git a/src/main/crash-reporting/process-gone-diagnostics.ts b/src/main/crash-reporting/process-gone-diagnostics.ts
index d0bb380a2b6..bf0d735a2c7 100644
--- a/src/main/crash-reporting/process-gone-diagnostics.ts
+++ b/src/main/crash-reporting/process-gone-diagnostics.ts
@@ -3,7 +3,13 @@ import {
   sanitizeCrashReportDetails,
   type CrashReportDetailValue
 } from '../../shared/crash-reporting'
-import { getSystemMemoryAtGoneDetails, memoryKBFieldMB } from './gone-time-system-memory'
+import { getSystemMemoryDetails, memoryKBFieldMB } from './system-memory-details'
+import {
+  PRE_GONE_SYSTEM_MEMORY_SAMPLE_INTERVAL_MS,
+  preGoneSystemMemoryDetails,
+  resetPreGoneSystemMemorySamplingForTest,
+  startPreGoneSystemMemorySampling
+} from './pre-gone-host-memory'
 
 type ProcessMetricLike = {
   pid?: unknown
@@ -204,8 +210,9 @@ export function samplePreGoneProcessMetrics(nowMs: number = Date.now()): void {
   }
 }
 
-export function startPreGoneProcessMetricsSampling(
-  intervalMs: number = PROCESS_METRICS_PRE_GONE_SAMPLE_INTERVAL_MS
+export function startPreGoneCrashSampling(
+  intervalMs: number = PROCESS_METRICS_PRE_GONE_SAMPLE_INTERVAL_MS,
+  systemMemoryIntervalMs: number = PRE_GONE_SYSTEM_MEMORY_SAMPLE_INTERVAL_MS
 ): void {
   if (preGoneSampleTimer) {
     return
@@ -213,14 +220,16 @@ export function startPreGoneProcessMetricsSampling(
   samplePreGoneProcessMetrics()
   preGoneSampleTimer = setInterval(() => samplePreGoneProcessMetrics(), intervalMs)
   preGoneSampleTimer.unref?.()
+  startPreGoneSystemMemorySampling(systemMemoryIntervalMs)
 }
 
-export function resetPreGoneProcessMetricsSamplingForTest(): void {
+export function resetPreGoneCrashSamplingForTest(): void {
   if (preGoneSampleTimer) {
     clearInterval(preGoneSampleTimer)
   }
   preGoneSampleTimer = null
   preGoneSample = null
+  resetPreGoneSystemMemorySamplingForTest()
 }
 
 const PROCESS_METRICS_KEY_PREFIX = 'processMetrics'
@@ -271,7 +280,7 @@ export function buildProcessGoneCrashDetails(
   const crashDetails: CrashReportDetails = {
     ...sanitizedDetails,
     ...liveMetricDetails,
-    ...getSystemMemoryAtGoneDetails()
+    ...getSystemMemoryDetails()
   }
   // Why: with the crasher gone, Largest names a survivor — flag that so the
   // live buckets are read as "everyone else", not as the crashed process.
@@ -290,8 +299,10 @@ export function buildProcessGoneCrashDetails(
   if (liveMetricDetails[crashedBucketCountKey] === 0 || sampledSameBucketProcessVanished) {
     crashDetails.processMetricsCrashedProcessAbsent = true
   }
+  const nowMs = Date.now()
   if (preGoneSample) {
-    Object.assign(crashDetails, preGoneSampleDetails(preGoneSample, Date.now()))
+    Object.assign(crashDetails, preGoneSampleDetails(preGoneSample, nowMs))
   }
+  Object.assign(crashDetails, preGoneSystemMemoryDetails(nowMs))
   return crashDetails
 }
diff --git a/src/main/crash-reporting/swap-volume-free-space.ts b/src/main/crash-reporting/swap-volume-free-space.ts
new file mode 100644
index 00000000000..3ad40b7629b
--- /dev/null
+++ b/src/main/crash-reporting/swap-volume-free-space.ts
@@ -0,0 +1,67 @@
+import { statfs } from 'node:fs/promises'
+import path from 'node:path'
+
+// Why: a system-managed Windows pagefile — and a macOS swapfile — only grows
+// into free space on its own volume, so low available commit is a REFUSED
+// allocation only when that volume is full too. Linux is excluded on purpose:
+// its swap is a fixed partition, a fixed-size swapfile, or zram, none of which
+// grow into root-fs free space, so the number would read as headroom that
+// cannot exist. The measured volume ships alongside because Windows only names
+// the DEFAULT pagefile drive; a relocated pagefile lives elsewhere.
+
+const BYTES_PER_MB = 1024 * 1024
+
+export type SwapVolumeFreeSpace = {
+  freeMB: number
+  /** Which volume was measured, separator-trimmed so redaction sees no path. */
+  volume: string
+}
+
+type SwapVolumeFreeSpaceReader = (
+  platform: NodeJS.Platform
+) => Promise<SwapVolumeFreeSpace | undefined>
+
+function swapVolumeAnchor(platform: NodeJS.Platform): string | undefined {
+  if (platform === 'win32') {
+    const anchor = process.env.SystemRoot || process.env.SystemDrive
+    return anchor ? path.parse(anchor).root || anchor : undefined
+  }
+  return platform === 'darwin' ? path.sep : undefined
+}
+
+function volumeLabel(root: string): string {
+  const trimmed = root.replace(/[\\/]+$/, '')
+  return trimmed.length > 0 ? trimmed : root
+}
+
+async function statfsSwapVolumeFreeSpace(
+  platform: NodeJS.Platform
+): Promise<SwapVolumeFreeSpace | undefined> {
+  const root = swapVolumeAnchor(platform)
+  if (!root) {
+    return undefined
+  }
+  try {
+    const stats = await statfs(root)
+    const bytes = Number(stats.bsize) * Number(stats.bavail)
+    return Number.isFinite(bytes)
+      ? { freeMB: Math.round(Math.max(0, bytes) / BYTES_PER_MB), volume: volumeLabel(root) }
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+let swapVolumeFreeSpaceReader: SwapVolumeFreeSpaceReader = statfsSwapVolumeFreeSpace
+
+export function setSwapVolumeFreeSpaceReaderForTest(
+  reader: SwapVolumeFreeSpaceReader | null
+): void {
+  swapVolumeFreeSpaceReader = reader ?? statfsSwapVolumeFreeSpace
+}
+
+export function readSwapVolumeFreeSpace(
+  platform: NodeJS.Platform = process.platform
+): Promise<SwapVolumeFreeSpace | undefined> {
+  return swapVolumeFreeSpaceReader(platform)
+}
diff --git a/src/main/crash-reporting/system-memory-details.ts b/src/main/crash-reporting/system-memory-details.ts
new file mode 100644
index 00000000000..1f2cf556faa
--- /dev/null
+++ b/src/main/crash-reporting/system-memory-details.ts
@@ -0,0 +1,161 @@
+import type { CrashReportDetailValue } from '../../shared/crash-reporting'
+import type { SwapVolumeFreeSpace } from './swap-volume-free-space'
+
+// ─── Host system memory for crash reports ───────────────────────────
+// Why: the system outlives the crashed process, so this IS sampleable at
+// process-gone — it separates "renderer grew huge" from "machine out of
+// memory/commit", which the per-process buckets alone cannot. The gone-time
+// caller reads AFTER the corpse returned its pages, so free/swapFree read
+// healthier than at kill time; the pre-gone sampler carries a live reading past
+// that.
+// Every reading is labelled `systemMemoryPressureSignal` so no report can be
+// read as a pressure verdict the platform never gave:
+//   win32  — swapFree is MEMORYSTATUSEX.ullAvailPageFile, i.e. available
+//     COMMIT, which pagefile growth can heal (a 127 MB commit floor healed to
+//     2029 MB mid-hold on the win-lowspec repro, killing nothing). Free space on
+//     the swap volume does NOT establish that it could: a fixed-size or disabled
+//     pagefile grows into no amount of empty disk, its maximum is unreadable
+//     here (needs a registry read), and the measured volume is only the DEFAULT
+//     pagefile drive. So a co-timed volume reading is context beside the commit
+//     number — `available-commit-volume-cotimed` — never a verdict. The one
+//     decisive win32 case is a commit limit at or below RAM: no pagefile exists
+//     to grow, so the floor cannot heal (`available-commit-hard-capped`).
+//   linux  — MemAvailable is the real signal; MemFree is not (it excludes page
+//     cache and other reclaimable memory).
+//   darwin — none. `free` stays low on healthy machines and
+//     fileBacked/purgeable are only a reclaimability proxy. The real signal
+//     needs `memory_pressure -Q`; Orca's reader for it
+//     (src/main/memory/host-memory.ts) is on-demand, and spawning a subprocess
+//     on a 10 s app-lifetime timer costs more than the gap it closes.
+
+type CrashReportDetails = Record<string, CrashReportDetailValue>
+
+export const SYSTEM_MEMORY_KEY_PREFIX = 'systemMemory'
+
+export function memoryKBFieldMB(value: unknown): number | undefined {
+  const kb = typeof value === 'number' && Number.isFinite(value) ? value : undefined
+  return kb === undefined ? undefined : Math.round(Math.max(0, kb) / 1024)
+}
+
+type SystemMemoryInfoLike = {
+  total?: unknown
+  free?: unknown
+  available?: unknown
+  swapTotal?: unknown
+  swapFree?: unknown
+  fileBacked?: unknown
+  purgeable?: unknown
+}
+
+type SystemMemoryInfoReader = () => SystemMemoryInfoLike | null
+
+/** How far this reading may be read as a "was the host under pressure" verdict. */
+export type SystemMemoryPressureSignal =
+  | 'available-commit-hard-capped'
+  | 'available-commit-volume-cotimed'
+  | 'available-commit-unqualified'
+  | 'mem-available'
+  | 'none'
+
+function readElectronSystemMemoryInfo(): SystemMemoryInfoLike | null {
+  const read = (process as NodeJS.Process & { getSystemMemoryInfo?: () => SystemMemoryInfoLike })
+    .getSystemMemoryInfo
+  if (typeof read !== 'function') {
+    return null
+  }
+  try {
+    return read.call(process)
+  } catch {
+    return null
+  }
+}
+
+let systemMemoryInfoReader: SystemMemoryInfoReader = readElectronSystemMemoryInfo
+
+export function setSystemMemoryInfoReaderForTest(reader: SystemMemoryInfoReader | null): void {
+  systemMemoryInfoReader = reader ?? readElectronSystemMemoryInfo
+}
+
+function numericDetail(details: CrashReportDetails, suffix: string): number | undefined {
+  const value = details[`${SYSTEM_MEMORY_KEY_PREFIX}${suffix}`]
+  return typeof value === 'number' ? value : undefined
+}
+
+/** Windows commit limit = RAM + pagefile, so a limit at or below RAM has no pagefile behind it. */
+function pagefileBacksCommit(details: CrashReportDetails): boolean | undefined {
+  const total = numericDetail(details, 'TotalMB')
+  const swapTotal = numericDetail(details, 'SwapTotalMB')
+  return total === undefined || swapTotal === undefined ? undefined : swapTotal > total
+}
+
+function pressureSignal(
+  platform: NodeJS.Platform,
+  details: CrashReportDetails,
+  volumeCoTimed = true
+): SystemMemoryPressureSignal {
+  if (platform === 'win32' && `${SYSTEM_MEMORY_KEY_PREFIX}SwapFreeMB` in details) {
+    if (pagefileBacksCommit(details) === false) {
+      return 'available-commit-hard-capped'
+    }
+    return volumeCoTimed && `${SYSTEM_MEMORY_KEY_PREFIX}SwapVolumeFreeMB` in details
+      ? 'available-commit-volume-cotimed'
+      : 'available-commit-unqualified'
+  }
+  if (platform === 'linux' && `${SYSTEM_MEMORY_KEY_PREFIX}AvailableMB` in details) {
+    return 'mem-available'
+  }
+  return 'none'
+}
+
+export function getSystemMemoryDetails(
+  platform: NodeJS.Platform = process.platform
+): CrashReportDetails {
+  const info = systemMemoryInfoReader()
+  if (!info) {
+    return {}
+  }
+  const details: CrashReportDetails = {}
+  const fields: readonly [keyof SystemMemoryInfoLike, string][] = [
+    ['total', 'TotalMB'],
+    ['free', 'FreeMB'],
+    ['available', 'AvailableMB'],
+    ['swapTotal', 'SwapTotalMB'],
+    ['swapFree', 'SwapFreeMB'],
+    ['fileBacked', 'FileBackedMB'],
+    ['purgeable', 'PurgeableMB']
+  ]
+  for (const [field, suffix] of fields) {
+    const mb = memoryKBFieldMB(info[field])
+    if (mb !== undefined) {
+      details[`${SYSTEM_MEMORY_KEY_PREFIX}${suffix}`] = mb
+    }
+  }
+  details[`${SYSTEM_MEMORY_KEY_PREFIX}PressureSignal`] = pressureSignal(platform, details)
+  return details
+}
+
+/**
+ * Merges the statfs-derived volume datum, which needs an await and so is only
+ * reachable from the periodic sampler, and relabels the reading it sits beside.
+ *
+ * `coTimed` false means the statfs outlived the tick that issued it, so this
+ * volume number and the commit number beside it describe different moments —
+ * during a pagefile-growth storm that is exactly when they diverge, and a
+ * pre-storm 40 GB printed next to 200 MB of commit reads as "the pagefile had
+ * room", the opposite conclusion. The datum still ships (with its own age), but
+ * only a co-timed one is named in the label.
+ */
+export function withSwapVolumeFreeSpace(
+  details: CrashReportDetails,
+  volume: SwapVolumeFreeSpace,
+  platform: NodeJS.Platform = process.platform,
+  coTimed = true
+): CrashReportDetails {
+  const merged: CrashReportDetails = {
+    ...details,
+    [`${SYSTEM_MEMORY_KEY_PREFIX}SwapVolumeFreeMB`]: volume.freeMB,
+    [`${SYSTEM_MEMORY_KEY_PREFIX}SwapVolume`]: volume.volume
+  }
+  merged[`${SYSTEM_MEMORY_KEY_PREFIX}PressureSignal`] = pressureSignal(platform, merged, coTimed)
+  return merged
+}
diff --git a/src/main/startup/main-process-ready-runtime.ts b/src/main/startup/main-process-ready-runtime.ts
index 75784a4c196..26b920652df 100644
--- a/src/main/startup/main-process-ready-runtime.ts
+++ b/src/main/startup/main-process-ready-runtime.ts
@@ -9,7 +9,7 @@ import { RpcDispatcher } from '../runtime/rpc/dispatcher'
 import { browserManager } from '../browser/browser-manager'
 import { configureBrowserClientPageAutomationRuntime } from '../browser/browser-client-page-automation-runtime'
 import { BrowserClientPageCommandError } from '../browser/browser-client-page-command-failure'
-import { startPreGoneProcessMetricsSampling } from '../crash-reporting/process-gone-diagnostics'
+import { startPreGoneCrashSampling } from '../crash-reporting/process-gone-diagnostics'
 import { recordProcessGoneCrash } from './main-window-lifecycle-flags'
 import { handleGpuChildCrash } from './gpu-lifecycle'
 import { isGpuFallbackCrashCandidate } from '../crash-reporting/gpu-crash-fallback-decision'
@@ -130,9 +130,10 @@ export async function initializeReadyRuntimeServices(): Promise<void> {
         console.warn('[agent-hooks] failed to reconcile managed hooks on startup:', error)
       )
   }
-  // Why: process-gone metrics only see survivors; retain a recent whole-app
-  // snapshot for comparison in crash reports.
-  startPreGoneProcessMetricsSampling()
+  // Why: process-gone metrics only see survivors, and the gone-time host memory
+  // read lands after the corpse released its pages; both need a live pre-gone
+  // sample to compare against in crash reports.
+  startPreGoneCrashSampling()
   app.on('child-process-gone', (_event, details) => {
     recordProcessGoneCrash('child', details.type, details.reason, details.exitCode ?? null, {
       name: details.name,
diff --git a/src/main/startup/pre-gone-crash-sampling-wiring.test.ts b/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
new file mode 100644
index 00000000000..2a8e008c0b3
--- /dev/null
+++ b/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
@@ -0,0 +1,49 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * Guards the one line that arms pre-gone crash sampling.
+ *
+ * That branch is pure instrumentation, so this line is the whole of its value in
+ * the shipped app: deleting it left all 691 tests across `src/main/crash-reporting/`
+ * and `src/main/startup/` green while every crash report silently lost its only
+ * host reading taken before the dying process returned its pages.
+ *
+ * Source-level because that is the property: the sampler is armed once inside the
+ * ready-phase composition, which has no runtime seam to assert against.
+ */
+describe('pre-gone crash sampling startup wiring', () => {
+  // Why normalize: the indent anchors below are `\n`-prefixed, and nothing pins
+  // src/**/*.ts to LF, so a CRLF Windows checkout would fail them spuriously.
+  const readSource = (name: string): string =>
+    readFileSync(join(process.cwd(), 'src/main/startup', name), 'utf8').replace(/\r\n/g, '\n')
+
+  const readyRuntimeSource = readSource('main-process-ready-runtime.ts')
+  const readySource = readSource('main-process-ready.ts')
+
+  const READY_ENTRY = 'export async function initializeReadyRuntimeServices('
+  // Why the entry's body and not the file: the call satisfies a whole-file grep
+  // just as well from a sibling export nothing calls, which arms nothing.
+  const readyRuntimeEntryBody = readyRuntimeSource
+    .slice(readyRuntimeSource.indexOf(READY_ENTRY) + READY_ENTRY.length)
+    .split('\nexport ')[0]
+
+  it('arms the sampler unconditionally inside the function app readiness runs', () => {
+    expect(readyRuntimeSource).toContain(
+      "import { startPreGoneCrashSampling } from '../crash-reporting/process-gone-diagnostics'"
+    )
+    expect(readyRuntimeSource).toContain(READY_ENTRY)
+    expect(readyRuntimeEntryBody.split('startPreGoneCrashSampling()').length - 1).toBe(1)
+    // Why pin the indent: the call also matches as the body of an added
+    // `if (...)` guard, which keeps every other assertion here true while the
+    // sampler silently stops arming on most startups.
+    expect(readyRuntimeEntryBody).toContain('\n  startPreGoneCrashSampling()')
+
+    // ...and that this really is the function app readiness runs.
+    expect(readySource).toContain(
+      "import { initializeReadyRuntimeServices } from './main-process-ready-runtime'"
+    )
+    expect(readySource).toContain('\n  await initializeReadyRuntimeServices()')
+  })
+})

From 2ee507d744b8f8abc61f91bd0c77563ee3bb5c79 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 01:22:09 -0700
Subject: [PATCH 11/58] fix(ssh): move Windows file writes off PowerShell 5.1
 stdin onto sftp (#18596)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(ssh): move Windows file writes off PowerShell 5.1 stdin onto sftp

#16432 was fixed by chunking writes to 32KB, on the belief that a
`DefaultShell=cmd.exe` host caps one stdin at roughly 50KB. Re-measured on
Windows 11 26200.9168 / OpenSSH_for_Windows_10.0p2, that premise is wrong in
both directions, and the chunking does not fix the hang.

The real constraint: a read on Windows PowerShell 5.1's redirected-stdin handle
over a non-pty ssh exec can die permanently when it finds the stream momentarily
empty, taking both the remaining data and the EOF with it. It is probabilistic
per such read — not a size threshold, and not certain on the first one. Measured
by swapping the copy loop for a counting reader:

  a 1.5s gap before any byte    -> 0 bytes received, 6 of 6
  1 byte, 1.5s gap, then 32767  -> exactly 1 byte
  32768, 1.5s gap, then 32768   -> exactly 32768
  a continuous 2MB              -> 167936 / 270336 / 372736

Those three 2MB figures are one payload run three times under the same
conditions, which is what rules out a threshold. Independently reproduced by a
second harness where one 1.9MB counted read completed through 39 reads and
another died after 11.

A payload that fits one burst usually presents only one read that can find the
stream empty, which is why 32KB mostly works — and it still failed 15 times in
120 under load, and 1 in 40 on a quiet host. Neither rate survives the 62 execs
a 1.9MB file needs: even 2.5% compounds to about four uploads in five failing.
No chunk size helps, because the defect is per blocking read, not per byte.
Three controls on the same host, same DefaultShell, rule out both a size limit
and cmd.exe: `findstr` took 2,016,000 bytes through one exec's stdin, sftp moved
1.9MB 5/5, and PowerShell 7 took 2MB in one exec.

Windows writes now go over the sftp subsystem, whose batch script is read by
the *local* client, so no remote process reads a pipe at all. PowerShell 7 is
the fallback where sftp is unavailable, and Windows PowerShell 5.1 is last,
still bounded, and now reports the host limitation and its remedy instead of a
bare timeout.

Measured on the same host, through this code: 1.9MB x20 all succeeded,
hash-verified, median 315ms, against 0/6 before. 32KB x120 zero hangs, against
15/120.

Also:
- Stage under a unique name per attempt. An abandoned write leaves a remote
  process that may still hold the staging file, and losing contact is not
  evidence it died (docs/reference/ssh-execution-boundary.md), so a retry must
  not reuse a name its predecessor may own. Sweep is best-effort and never
  treated as proof of anything.
- Create upload directories over sftp too; the JSON mkdir batch rode the same
  defective read.
- Cover makeWindowsWriteFileCommand and the publish command against the
  8000-char budget, which F11 flagged as untested.

* fix(ssh): replace the staged Windows write atomically, and translate ssh -l

Three review findings, all on the failure path that the success-path
measurements say nothing about.

CodeRabbit, Critical: the publish deleted the destination before moving the
staged file onto it, so a failed move destroyed the user's existing file and
left a window where a reader saw no file at all. That is worse than the
truncated partial the staging discipline exists to prevent. Now File.Replace
(Win32 ReplaceFile, atomic), falling back to a plain Move only when the
destination is absent — and that race is safe, because a destination appearing
in between makes Move throw with the staged file preserved. The exclusive
branch already had it right: Move throwing on an existing destination is the
exclusive contract. Append stays non-atomic and now says why.

buildSshArgs can emit '-l <username>' for a config alias no Host block claims,
and the translator threw on it. isSftpUnavailableError read that throw as 'this
host cannot do sftp', so those hosts fell back to the defective PowerShell 5.1
path and had the refusal cached against them for 30 minutes, silently. '-l' now
maps to '-o User=', with a test for the exact argument shape buildSshArgs
produces in that case.

CodeRabbit, minor: two assertions passed on an absent observation — an
unmatched regex yields '' and every() is true of an empty list. Both now assert
the positive form first, and the same audit was applied to the three other
some()/every() assertions in the file. The temp-file test now asserts mode 0600
rather than only that the file is cleaned up.

* fix(ssh): keep a path sftp cannot spell from becoming a verdict about the host

Audit of isSftpUnavailableError, prompted by the '-l' gap having the same
shape: a per-operation condition being written into a per-host cache that
holds for 30 minutes.

It had a second instance, and this one was mine. UnsupportedSftpPathError was
classified as 'this host cannot do sftp', but it is thrown for a UNC or
relative destination and for any path sftp's batch lexer cannot quote --
including a *local* filename containing a newline, which POSIX clients allow.
One such file would have routed every later Windows write to that host down
the defective PowerShell 5.1 path for the rest of the cache window.

The host verdict is now only the errors that really are host-scoped: a refused
subsystem, a client that will not start, and an untranslatable argument list.
A path refusal falls back for that one write and leaves the cache alone, in
both the file-write and directory-creation paths.

Revert-tested. Removing the operation-scoped catch fails all three new tests,
whether or not the predicate is also widened. Widening the predicate alone
does not fail them, correctly: with the catch in place the predicate no longer
gates that path, so keeping it narrow is defence-in-depth rather than the live
mechanism.

Flag audit at the same time: -F, -o, -T, -S, -p, -i, -J, -l and -- are now the
complete set buildSshArgs can emit, and all are handled.

* fix(ssh): make the atomic publish actually run, and unroll the mkdir batch

Two runtime defects that only a real host could surface. Both were invisible
to unit tests that assert the shape of the generated command string, because
both are PowerShell rejecting an argument at execution time.

File.Replace was passed a bare $null for destinationBackupFileName. PowerShell
coerces $null to an empty string when binding a .NET string parameter, and
Replace rejects that with 'The path is not of a legal form' -- so every
create-mode publish failed. The Critical fix was inert as shipped. Now
[NullString]::Value, which is the construct that exists for this.

Measured on awin, same staging-file lock, opposite outcomes:

  old publish  rc=1  destination MISSING          <- prior contents destroyed
  new publish  rc=1  destination PRESENT, sha 7f06b7e0... unchanged
  control, destination present, no lock  rc=0  replaced exactly
  control, destination absent, no lock   rc=0  Move fallback created it

End-to-end through the real uploader afterwards: 1.9MB x15 all hashes exact,
median 303ms; overwrite of an existing destination exact both times.

Separately, the PowerShell mkdir fallback could not create a tree of more than
one directory. '@($json | ConvertFrom-Json)' wraps the parsed array in another
array, so the loop variable binds to the whole thing and [string] of it is the
paths joined by spaces. It only ever worked for a one-element batch, where
stringifying a single-element array happens to yield the element -- which is
why no existing test caught it. Pre-existing on main; fixed here because this
PR puts that command on the fallback tier and claims the ladder works.
Both tiers now verified live against a three-directory tree.
---
 src/main/ssh/ssh-remote-powershell.ts         |  20 +-
 ...-remote-windows-command-line-limit.test.ts |  44 ++
 src/main/ssh/ssh-system-fallback.test.ts      |  85 ++-
 .../ssh/system-ssh-file-binary-transfer.ts    | 236 ++-----
 src/main/ssh/system-ssh-file-transfer.ts      |  80 ++-
 src/main/ssh/system-ssh-sftp-args.test.ts     | 141 ++++
 src/main/ssh/system-ssh-sftp-args.ts          |  95 +++
 src/main/ssh/system-ssh-sftp-path.test.ts     |  59 ++
 src/main/ssh/system-ssh-sftp-path.ts          |  46 ++
 src/main/ssh/system-ssh-sftp-transfer.ts      | 191 +++++
 src/main/ssh/system-ssh-windows-file-write.ts | 138 ++++
 .../ssh/system-ssh-windows-upload.test.ts     | 659 ++++++++++++++----
 ...tem-ssh-windows-write-capabilities.test.ts |  79 +++
 .../system-ssh-windows-write-capabilities.ts  |  52 ++
 .../ssh/system-ssh-windows-write-strategy.ts  | 329 +++++++++
 15 files changed, 1900 insertions(+), 354 deletions(-)
 create mode 100644 src/main/ssh/system-ssh-sftp-args.test.ts
 create mode 100644 src/main/ssh/system-ssh-sftp-args.ts
 create mode 100644 src/main/ssh/system-ssh-sftp-path.test.ts
 create mode 100644 src/main/ssh/system-ssh-sftp-path.ts
 create mode 100644 src/main/ssh/system-ssh-sftp-transfer.ts
 create mode 100644 src/main/ssh/system-ssh-windows-file-write.ts
 create mode 100644 src/main/ssh/system-ssh-windows-write-capabilities.test.ts
 create mode 100644 src/main/ssh/system-ssh-windows-write-capabilities.ts
 create mode 100644 src/main/ssh/system-ssh-windows-write-strategy.ts

diff --git a/src/main/ssh/ssh-remote-powershell.ts b/src/main/ssh/ssh-remote-powershell.ts
index 8c94fd3c483..420223ced29 100644
--- a/src/main/ssh/ssh-remote-powershell.ts
+++ b/src/main/ssh/ssh-remote-powershell.ts
@@ -11,14 +11,24 @@ export {
 // to leave room for the `/c` wrapper sshd adds before cmd.exe counts the line.
 const WINDOWS_REMOTE_COMMAND_LINE_BUDGET_CHARS = 8_000
 
-export function powerShellCommand(script: string): string {
-  const inline = encodedPowerShellCommand(script)
+/**
+ * `pwsh.exe` is PowerShell 7. It is not present on a stock Windows install, so it is only ever
+ * chosen after a probe — but where it exists it reads a redirected stdin correctly, which Windows
+ * PowerShell 5.1 does not (see `system-ssh-file-binary-transfer.ts`).
+ */
+export type WindowsPowerShellExecutable = 'powershell.exe' | 'pwsh.exe'
+
+export function powerShellCommand(
+  script: string,
+  executable: WindowsPowerShellExecutable = 'powershell.exe'
+): string {
+  const inline = encodedPowerShellCommand(script, executable)
   if (inline.length <= WINDOWS_REMOTE_COMMAND_LINE_BUDGET_CHARS) {
     return inline
   }
   // Why: these scripts are repetitive enough that gzip beats the UTF-16LE tax by
   // ~4x, which is the difference between a line cmd.exe runs and one it refuses.
-  const compressed = encodedPowerShellCommand(selfExtractingPowerShellScript(script))
+  const compressed = encodedPowerShellCommand(selfExtractingPowerShellScript(script), executable)
   if (compressed.length > WINDOWS_REMOTE_COMMAND_LINE_BUDGET_CHARS) {
     throw new Error(
       `Remote Windows command needs ${compressed.length} characters; Orca budgets ${WINDOWS_REMOTE_COMMAND_LINE_BUDGET_CHARS} for a line sshd hands to cmd.exe, which itself refuses more than ${CMD_EXE_COMMAND_LINE_MAX_CHARS}.`
@@ -27,8 +37,8 @@ export function powerShellCommand(script: string): string {
   return compressed
 }
 
-function encodedPowerShellCommand(script: string): string {
-  return `powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodePowerShellCommand(script)}`
+function encodedPowerShellCommand(script: string, executable: WindowsPowerShellExecutable): string {
+  return `${executable} -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodePowerShellCommand(script)}`
 }
 
 /** Orca-prefixed names so the payload can never shadow the bootstrap's own state. */
diff --git a/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts b/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts
index c104078238e..fa34a8fbda7 100644
--- a/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts
+++ b/src/main/ssh/ssh-remote-windows-command-line-limit.test.ts
@@ -4,6 +4,10 @@ import { CMD_EXE_COMMAND_LINE_MAX_CHARS } from '../providers/windows-shell-args'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
 import { tryStealInstallLockCommand } from './ssh-relay-install-lock-commands'
 import { decodeRemotePowerShellScript, powerShellCommand } from './ssh-remote-powershell'
+import {
+  makeWindowsPublishStagedFileCommand,
+  makeWindowsWriteFileCommand
+} from './system-ssh-windows-file-write'
 import {
   cleanupOwnedRelayUploadStageCommand,
   promoteOwnedRelayUploadStageCommand,
@@ -38,6 +42,17 @@ describe('Windows remote command line limit', () => {
     [
       'steal stale install lock',
       tryStealInstallLockCommand(windows, 'C:\\Users\\orca\\.orca-remote\\relay', 1_200)
+    ],
+    // F11 flagged these two as uncovered. They carry one path literal each, so they are the file
+    // commands whose length a caller can actually move.
+    ['write file', makeWindowsWriteFileCommand('C:\\Users\\orca\\.orca-remote\\relay.js')],
+    [
+      'publish staged file',
+      makeWindowsPublishStagedFileCommand(
+        'C:\\Users\\orca\\.orca-remote\\relay.js.orca-partial-0123456789ab',
+        'C:\\Users\\orca\\.orca-remote\\relay.js',
+        'create'
+      )
     ]
   ])('keeps the %s command inside what sshd\u2019s cmd.exe accepts', (_name, command) => {
     expect(command.length).toBeLessThanOrEqual(CMD_EXE_COMMAND_LINE_MAX_CHARS)
@@ -76,3 +91,32 @@ describe('Windows remote command line limit', () => {
     )
   })
 })
+
+/**
+ * F11 asked whether a pathological path could reach the budget, and what happens if it does.
+ * Measured: the inline encoding crosses 8000 at roughly 2500 high-entropy path characters — an
+ * order of magnitude past what Windows itself accepts — and the failure is a throw before any ssh
+ * is spawned, never a hang.
+ */
+describe('Windows file command budget headroom', () => {
+  it('absorbs a path far longer than Windows will accept', () => {
+    const deep = `C:\\Users\\orca\\${'segment\\'.repeat(30)}relay.js`
+
+    expect(deep.length).toBeGreaterThan(260)
+    expect(makeWindowsWriteFileCommand(deep).length).toBeLessThanOrEqual(
+      CMD_EXE_COMMAND_LINE_MAX_CHARS
+    )
+  })
+
+  it('throws rather than spawning a line cmd.exe would refuse', () => {
+    // Random segments so gzip cannot rescue it, which is the only way to reach the ceiling at all.
+    const incompressible = Array.from(
+      { length: 400 },
+      (_unused, index) => `${index}-${Math.random().toString(36).slice(2)}`
+    ).join('\\')
+
+    expect(() => makeWindowsWriteFileCommand(`C:\\${incompressible}\\f.bin`)).toThrow(
+      /Orca budgets 8000/
+    )
+  })
+})
diff --git a/src/main/ssh/ssh-system-fallback.test.ts b/src/main/ssh/ssh-system-fallback.test.ts
index c366e899bf6..b477ad682ef 100644
--- a/src/main/ssh/ssh-system-fallback.test.ts
+++ b/src/main/ssh/ssh-system-fallback.test.ts
@@ -709,9 +709,13 @@ describe('spawnSystemSsh', () => {
     expect(args[standaloneControlIdx + 1]).toBe('none')
   })
 
-  it('writes files to Windows system SSH targets with PowerShell stdin bytes', async () => {
-    const proc = createEventedProcess()
-    spawnMock.mockImplementation(() => closeOnceSpawned(proc))
+  it('sends Windows file writes over sftp, not through a remote PowerShell stdin', async () => {
+    const spawned: EventedProcess[] = []
+    spawnMock.mockImplementation(() => {
+      const proc = createEventedProcess()
+      spawned.push(proc)
+      return closeOnceSpawned(proc)
+    })
     const hostPlatform = getRemoteHostPlatform('win32-x64')
 
     const promise = writeFileViaSystemSsh(
@@ -722,16 +726,24 @@ describe('spawnSystemSsh', () => {
     )
 
     await expect(promise).resolves.toBeUndefined()
-    const args = spawnMock.mock.calls[0][1] as string[]
-    const remoteCommand = args.at(-1) ?? ''
-    expect(remoteCommand).toContain('powershell.exe')
-    expect(remoteCommand).not.toContain('/bin/sh')
-    expect(proc.stdin.end).toHaveBeenCalledWith(Buffer.from('0.1.0', 'utf-8'))
+    // #16432, re-measured: Windows PowerShell 5.1 can lose a redirected stdin for good when a read
+    // finds it momentarily empty, so the bytes must not travel that way at all.
+    const batch = String(spawned[0]!.stdin.end.mock.calls[0]?.[0] ?? '')
+    expect(batch).toContain('put ')
+    expect(batch).toContain('/C:/Users/me/.orca-remote/relay/.version.orca-partial-')
+    const sftpArgs = spawnMock.mock.calls[0][1] as string[]
+    expect(sftpArgs).toContain('-b')
+    // The rename that publishes it reads the staged file, never a pipe.
+    const publish = (spawnMock.mock.calls[1][1] as string[]).at(-1) ?? ''
+    expect(publish).toContain('powershell.exe')
+    expect(decodePowerShellCommand(publish)).toContain(
+      '[System.IO.File]::Replace($staging, $path, [NullString]::Value)'
+    )
+    expect(publish).not.toContain('/bin/sh')
   })
 
-  it('writes binary buffers to Windows system SSH targets with CreateNew mode', async () => {
-    const proc = createEventedProcess()
-    spawnMock.mockImplementation(() => closeOnceSpawned(proc))
+  it('enforces an exclusive Windows buffer write at the rename, where it is atomic', async () => {
+    spawnMock.mockImplementation(() => closeOnceSpawned(createEventedProcess()))
     const hostPlatform = getRemoteHostPlatform('win32-x64')
 
     const promise = writeBufferViaSystemSsh(
@@ -742,12 +754,11 @@ describe('spawnSystemSsh', () => {
     )
 
     await expect(promise).resolves.toBeUndefined()
-    const args = spawnMock.mock.calls[0][1] as string[]
-    const remoteCommand = args.at(-1) ?? ''
-    expect(remoteCommand).toContain('powershell.exe')
-    expect(decodePowerShellCommand(remoteCommand)).toContain('CreateNew')
-    expect(remoteCommand).not.toContain('/bin/sh')
-    expect(proc.stdin.end).toHaveBeenCalledWith(Buffer.from('png'))
+    const publish = decodePowerShellCommand((spawnMock.mock.calls[1][1] as string[]).at(-1) ?? '')
+    // `File::Move` raising on an existing destination is what carries the exclusive contract now;
+    // a `CreateNew` on the staged file would only refuse a leftover of our own.
+    expect(publish).toContain('[System.IO.File]::Move($staging, $path)')
+    expect(publish).not.toContain('[System.IO.File]::Delete($path)')
   })
 
   it('downloads files from Windows system SSH targets with PowerShell stdout bytes', async () => {
@@ -779,8 +790,7 @@ describe('spawnSystemSsh', () => {
   })
 
   it('forces standalone SSH for Windows file writes when requested', async () => {
-    const proc = createEventedProcess()
-    spawnMock.mockImplementation(() => closeOnceSpawned(proc))
+    spawnMock.mockImplementation(() => closeOnceSpawned(createEventedProcess()))
     const hostPlatform = getRemoteHostPlatform('win32-x64')
 
     const promise = writeFileViaSystemSsh(
@@ -791,10 +801,14 @@ describe('spawnSystemSsh', () => {
     )
 
     await expect(promise).resolves.toBeUndefined()
-    const args = spawnMock.mock.calls[0][1] as string[]
-    const standaloneControlIdx = args.indexOf('-S')
+    const sftpArgs = spawnMock.mock.calls[0][1] as string[]
+    // sftp's own `-S` names a program to run, so the same request has to be spelled as an option.
+    expect(sftpArgs).not.toContain('-S')
+    expect(sftpArgs).toContain('ControlPath=none')
+    const publishArgs = spawnMock.mock.calls[1][1] as string[]
+    const standaloneControlIdx = publishArgs.indexOf('-S')
     expect(standaloneControlIdx).toBeGreaterThan(-1)
-    expect(args[standaloneControlIdx + 1]).toBe('none')
+    expect(publishArgs[standaloneControlIdx + 1]).toBe('none')
   })
 
   it('uploads a Windows directory as a mkdir batch plus per-file writes, never one blob', async () => {
@@ -819,19 +833,20 @@ describe('spawnSystemSsh', () => {
       rmSync(localDir, { recursive: true, force: true })
     }
 
+    // #16432: directories first, then the file — but both over sftp now, so the only PowerShell
+    // left is the rename that publishes the staged file, which reads a file rather than a pipe.
+    const mkdirBatch = String(spawned[0]!.stdin.end.mock.calls[0]?.[0] ?? '')
+    expect(mkdirBatch).toBe('-mkdir "/C:/Users/me/.orca-remote/relay"\n')
+    const putBatch = String(spawned[1]!.stdin.end.mock.calls[0]?.[0] ?? '')
+    expect(putBatch).toContain('put ')
+    expect(putBatch).toContain('/C:/Users/me/.orca-remote/relay/relay.js.orca-partial-')
     const commands = spawnMock.mock.calls.map((call) => (call[1] as string[]).at(-1) ?? '')
-    // #16432: directories first (metadata only), then the file bytes on their own stdin. One batch
-    // meant base64-ing the whole bundle into a single PowerShell string, which the remote never read.
-    expect(commands).toHaveLength(2)
-    expect(commands.every((command) => command.includes('powershell.exe'))).toBe(true)
     expect(commands.every((command) => !command.includes('/bin/sh'))).toBe(true)
     expect(commands.join('\n')).not.toContain('tar -xzf')
-    expect(JSON.parse(spawned[0].stdin.end.mock.calls[0]?.[0] as string)).toEqual([
-      'C:/Users/me/.orca-remote/relay'
-    ])
-    expect(Buffer.from(spawned[1].stdin.end.mock.calls[0]?.[0] as Buffer).toString('utf-8')).toBe(
-      'console.log("relay")'
-    )
+    // Nothing base64s the bundle into one PowerShell string any more, and nothing reads one.
+    expect(
+      commands.some((command) => decodePowerShellCommand(command).includes('OpenStandardInput'))
+    ).toBe(false)
   })
 
   it('forces standalone SSH for Windows upload packages when requested', async () => {
@@ -855,9 +870,9 @@ describe('spawnSystemSsh', () => {
     }
 
     const args = spawnMock.mock.calls[0][1] as string[]
-    const standaloneControlIdx = args.indexOf('-S')
-    expect(standaloneControlIdx).toBeGreaterThan(-1)
-    expect(args[standaloneControlIdx + 1]).toBe('none')
+    // The first spawn is the sftp client, whose own `-S` names a program to run.
+    expect(args).not.toContain('-S')
+    expect(args).toContain('ControlPath=none')
   })
 
   it('throws when no system ssh is found', () => {
diff --git a/src/main/ssh/system-ssh-file-binary-transfer.ts b/src/main/ssh/system-ssh-file-binary-transfer.ts
index b0c5b662ed1..149d10dfbd3 100644
--- a/src/main/ssh/system-ssh-file-binary-transfer.ts
+++ b/src/main/ssh/system-ssh-file-binary-transfer.ts
@@ -1,5 +1,7 @@
 import { constants, createWriteStream } from 'node:fs'
-import { lstat, open } from 'node:fs/promises'
+import { lstat, mkdtemp, open, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import type { Writable } from 'node:stream'
 import { pipeline } from 'node:stream/promises'
 import type { SshTarget } from '../../shared/ssh-types'
@@ -16,6 +18,16 @@ import {
   throwIfAborted,
   waitForChannelClose
 } from './system-ssh-operation-lifecycle'
+import {
+  writeWindowsRemoteFile,
+  type WindowsWriteSource
+} from './system-ssh-windows-write-strategy'
+
+export {
+  WINDOWS_STDIN_WRITE_CHUNK_BYTES,
+  WINDOWS_STDIN_WRITE_TIMEOUT_MS
+} from './system-ssh-windows-write-strategy'
+export { WINDOWS_STAGED_WRITE_SUFFIX } from './system-ssh-windows-file-write'
 
 type SystemSshOperationOptions = SystemSshBuildArgsOptions & {
   signal?: AbortSignal
@@ -74,13 +86,16 @@ export async function writeBufferViaSystemSsh(
 ): Promise<void> {
   throwIfAborted(options?.signal)
   if (options?.hostPlatform && isWindowsRemoteHost(options.hostPlatform)) {
-    await writeWindowsBytesViaSystemSsh(
+    await writeWindowsRemoteFile(
       target,
       remotePath,
-      contents.length,
-      (offset, maxBytes) =>
-        Promise.resolve(contents.subarray(offset, Math.min(offset + maxBytes, contents.length))),
-      options
+      {
+        totalBytes: contents.length,
+        readChunk: (offset, maxBytes) =>
+          Promise.resolve(contents.subarray(offset, Math.min(offset + maxBytes, contents.length))),
+        withLocalFile: (send) => withTemporaryLocalFile(contents, send)
+      },
+      options ?? {}
     )
     return
   }
@@ -127,20 +142,19 @@ export async function uploadFileViaSystemSsh(
     throwIfAborted(options?.signal)
 
     if (options?.hostPlatform && isWindowsRemoteHost(options.hostPlatform)) {
-      // #16432: a Windows host cannot take a whole file through one stdin, however the local side
-      // paces it — see WINDOWS_STDIN_WRITE_CHUNK_BYTES. This is the path that carries the large
-      // files, so it is the one that has to be chunked and bounded.
-      await writeWindowsBytesViaSystemSsh(
-        target,
-        remotePath,
-        openedStat.size,
-        async (offset, maxBytes) => {
+      // This is the path that carries the large files, so it is the one the transport choice is
+      // made for; see the #16432 note below.
+      const source: WindowsWriteSource = {
+        totalBytes: openedStat.size,
+        readChunk: async (offset, maxBytes) => {
           const buffer = Buffer.allocUnsafe(Math.min(maxBytes, openedStat.size - offset))
           const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset)
           return buffer.subarray(0, bytesRead)
         },
-        options
-      )
+        // The verified local file is already exactly the payload, so sftp sends it as is.
+        withLocalFile: (send) => send(localPath)
+      }
+      await writeWindowsRemoteFile(target, remotePath, source, options ?? {})
       return
     }
 
@@ -173,158 +187,56 @@ export async function uploadFileViaSystemSsh(
 }
 
 /**
- * #16432: Windows PowerShell 5.1 stops draining a redirected stdin over a non-pty ssh exec
- * somewhere between 50KB and 1MB, depending on the host's `DefaultShell`, and it hangs rather than
- * failing. The reporter measured that on both constructs he tried — `[Console]::In.ReadToEnd()` and
- * `new IO.StreamReader([Console]::OpenStandardInput())`, the latter reading incrementally, which is
- * why the limit cannot be attributed to materializing the payload. `Stream.CopyTo` reads the same
- * `[Console]::OpenStandardInput()` object with the same incremental `Read` loop, so nothing in it
- * escapes that limit either: no single write may exceed what one stdin is known to carry.
+ * #16432, re-measured: the constraint is not a size limit, and it is not cmd.exe's.
  *
- * 32KB is an order of magnitude under the low end of the measured range, and under 50KB, which the
- * reporter measured succeeding against a stream reader on the worse of the two `DefaultShell`
- * settings.
- */
-export const WINDOWS_STDIN_WRITE_CHUNK_BYTES = 32 * 1024
-
-/** No Windows stdin write should ever outlive this; a wedged PowerShell never closes on its own. */
-export const WINDOWS_STDIN_WRITE_TIMEOUT_MS = 60_000
-
-/** Suffix for the path a multi-exec Windows write lands on before it is published by rename. */
-export const WINDOWS_STAGED_WRITE_SUFFIX = '.orca-partial'
-
-/**
- * Splits one logical Windows write into stdin-sized execs.
+ * A read on Windows PowerShell 5.1's redirected-stdin handle over a non-pty ssh exec can die
+ * permanently when it finds the stream momentarily empty: no further bytes arrive, and no EOF ever
+ * does. It is probabilistic per such read — not a size threshold, and not certain on the first one.
+ * Measured on Windows 11 26200.9168 / OpenSSH_for_Windows_10.0p2 with `DefaultShell = cmd.exe`, by
+ * replacing the copy loop with a counting reader:
  *
- * A write that needs more than one exec cannot land on the destination directly: a chunk failing
- * mid-file would leave a truncated artifact under the real name with nothing marking it incomplete,
- * and the retry would then meet its own leftovers — under `exclusive` the retry's `CreateNew` fails
- * on them. Multi-exec creates therefore land on a staging path and are published by a rename, which
- * is also where `exclusive` is enforced: once, at the destination, instead of smeared across the
- * first chunk. A caller-requested append cannot be staged without reading the remote file back, so
- * it keeps writing straight through, as its own protocol already implies.
+ *   - a 1.5s gap before any byte, which forces the first read to find nothing -> 0 bytes, 6 of 6
+ *   - one byte, a 1.5s gap, then 32767 more  -> exactly 1 byte, then nothing
+ *   - 32768, a 1.5s gap, then 32768 more     -> exactly 32768, then nothing
+ *   - a continuous 2MB                       -> 167936 / 270336 / 372736, then nothing
+ *
+ * Those three 2MB death points are one payload run three times under the same conditions, which is
+ * what rules out a threshold: a stream that died at a fixed point would not vary by 2x. Independently reproduced by
+ * a second harness, where one 1.9MB counted read survived 39 reads to completion and another died
+ * after 11 — same construct, same payload.
+ *
+ * A payload small enough to arrive in one burst usually presents only one read that can find the
+ * stream empty (the one waiting for EOF), which is why 32KB mostly works: it still failed 15 times
+ * in 120 with the host under load, and 1 in 40 on a quiet one. Neither rate is survivable across
+ * the 62 execs a 1.9MB file needs — even 2.5% compounds to roughly four uploads in five failing —
+ * and no chunk size helps, because the client does not control whether its bytes arrive together.
+ *
+ * The same host, same `DefaultShell`, same connection pattern contradicts every size-limit reading:
+ * `findstr` took 2,016,000 bytes through one exec's stdin, and PowerShell 7 took 2MB. So cmd.exe is
+ * not the ceiling and neither is ~50KB. Writes now go over sftp, which moves the whole payload
+ * without any remote process reading a pipe; see `system-ssh-windows-write-strategy.ts` for the
+ * fallback order.
+ *
+ * Successes are never partial. Across every run in both harnesses a failed write hung; not one
+ * produced a short file, so this defect cannot silently truncate an upload.
  */
-async function writeWindowsBytesViaSystemSsh(
-  target: SshTarget,
-  remotePath: string,
-  totalBytes: number,
-  readChunk: (offset: number, maxBytes: number) => Promise<Buffer>,
-  options: SystemSshWriteBufferOptions
-): Promise<void> {
-  throwIfAborted(options.signal)
-  const staged = !options.append && totalBytes > WINDOWS_STDIN_WRITE_CHUNK_BYTES
-  const writePath = staged ? `${remotePath}${WINDOWS_STAGED_WRITE_SUFFIX}` : remotePath
-  let offset = 0
-  // An empty write still has to run: it is what creates (or truncates) the file.
-  do {
-    const chunk = await readChunk(offset, WINDOWS_STDIN_WRITE_CHUNK_BYTES)
-    if (chunk.length === 0 && offset < totalBytes) {
-      throw new Error(`Source ran short during upload of ${remotePath}`)
-    }
-    await writeWindowsChunkViaSystemSsh(
-      target,
-      writePath,
-      chunk,
-      {
-        ...options,
-        append: staged ? offset > 0 : options.append === true || offset > 0,
-        exclusive: staged ? false : options.exclusive === true && offset === 0
-      },
-      offset
-    )
-    offset += chunk.length
-  } while (offset < totalBytes)
-  if (staged) {
-    await publishWindowsStagedWrite(target, writePath, remotePath, options)
+
+/** A staged write is materialized locally first when the source is a buffer rather than a file. */
+async function withTemporaryLocalFile<T>(
+  contents: Buffer,
+  send: (localPath: string) => Promise<T>
+): Promise<T> {
+  const directory = await mkdtemp(join(tmpdir(), 'orca-win-upload-'))
+  const localPath = join(directory, 'payload.bin')
+  try {
+    // 0600: the payload can be repository content, and tmpdir is shared on every platform.
+    await writeFile(localPath, contents, { mode: 0o600 })
+    return await send(localPath)
+  } finally {
+    await rm(directory, { recursive: true, force: true }).catch(() => {})
   }
 }
 
-async function writeWindowsChunkViaSystemSsh(
-  target: SshTarget,
-  remotePath: string,
-  chunk: Buffer,
-  options: SystemSshWriteBufferOptions,
-  offset: number
-): Promise<void> {
-  throwIfAborted(options.signal)
-  const channel = spawnSystemSshCommand(target, makeWindowsWriteFileCommand(remotePath, options), {
-    wrapCommand: false,
-    ...getSystemSshBuildArgsFromOperationOptions(options)
-  })
-  const closePromise = awaitWithSystemSshAbort(
-    options.signal,
-    () => channel.close(),
-    waitForChannelClose(
-      channel,
-      `write ${remotePath} at offset ${offset}`,
-      WINDOWS_STDIN_WRITE_TIMEOUT_MS
-    )
-  )
-  if (!options.signal?.aborted) {
-    channel.stdin.end(chunk)
-  }
-  await closePromise
-}
-
-async function publishWindowsStagedWrite(
-  target: SshTarget,
-  stagingPath: string,
-  remotePath: string,
-  options: SystemSshWriteBufferOptions
-): Promise<void> {
-  throwIfAborted(options.signal)
-  const channel = spawnSystemSshCommand(
-    target,
-    makeWindowsPublishStagedFileCommand(stagingPath, remotePath, options.exclusive === true),
-    { wrapCommand: false, ...getSystemSshBuildArgsFromOperationOptions(options) }
-  )
-  const closePromise = awaitWithSystemSshAbort(
-    options.signal,
-    () => channel.close(),
-    waitForChannelClose(channel, `publish ${remotePath}`, WINDOWS_STDIN_WRITE_TIMEOUT_MS)
-  )
-  if (!options.signal?.aborted) {
-    channel.stdin.end()
-  }
-  await closePromise
-}
-
-function makeWindowsWriteFileCommand(
-  remotePath: string,
-  options?: { append?: boolean; exclusive?: boolean }
-): string {
-  const fileMode = options?.append ? 'Append' : options?.exclusive ? 'CreateNew' : 'Create'
-  return powerShellCommand(
-    [
-      '$ErrorActionPreference = "Stop"',
-      `$path = ${powerShellLiteral(remotePath)}`,
-      '$parent = [System.IO.Path]::GetDirectoryName($path)',
-      'if ($parent) { $null = [System.IO.Directory]::CreateDirectory($parent) }',
-      '$inputStream = [Console]::OpenStandardInput()',
-      `$outputStream = [System.IO.File]::Open($path, [System.IO.FileMode]::${fileMode}, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)`,
-      'try { $inputStream.CopyTo($outputStream) } finally { $outputStream.Dispose() }'
-    ].join('; ')
-  )
-}
-
-// `File::Move` throws when the destination exists, which is exactly the exclusive contract; the
-// non-exclusive caller asked to replace, so it deletes first (a no-op on an absent path).
-function makeWindowsPublishStagedFileCommand(
-  stagingPath: string,
-  remotePath: string,
-  exclusive: boolean
-): string {
-  return powerShellCommand(
-    [
-      '$ErrorActionPreference = "Stop"',
-      `$staging = ${powerShellLiteral(stagingPath)}`,
-      `$path = ${powerShellLiteral(remotePath)}`,
-      ...(exclusive ? [] : ['[System.IO.File]::Delete($path)']),
-      '[System.IO.File]::Move($staging, $path)'
-    ].join('; ')
-  )
-}
-
 function makePosixWriteFileCommand(
   remotePath: string,
   options?: { append?: boolean; exclusive?: boolean }
diff --git a/src/main/ssh/system-ssh-file-transfer.ts b/src/main/ssh/system-ssh-file-transfer.ts
index f728c0eab02..d5757904356 100644
--- a/src/main/ssh/system-ssh-file-transfer.ts
+++ b/src/main/ssh/system-ssh-file-transfer.ts
@@ -27,6 +27,12 @@ import {
   WINDOWS_STDIN_WRITE_TIMEOUT_MS,
   writeBufferViaSystemSsh
 } from './system-ssh-file-binary-transfer'
+import {
+  isSftpPathUnsupportedError,
+  isSftpUnavailableError,
+  makeDirectoriesViaSftp
+} from './system-ssh-sftp-transfer'
+import { getWindowsRemoteWriteCapabilities } from './system-ssh-windows-write-capabilities'
 
 type SystemSshOperationOptions = SystemSshBuildArgsOptions & {
   signal?: AbortSignal
@@ -161,9 +167,14 @@ async function collectWindowsUploadPlan(
   return plan
 }
 
-// Why the JSON envelope survives here: a path list is metadata, so this payload stays in the
-// hundreds of bytes even for a deep tree. Batched anyway, so a pathological tree cannot walk back
-// into the same stdin size that wedges PowerShell.
+/**
+ * Creates the upload's directories, preferring sftp's own `mkdir`.
+ *
+ * The PowerShell fallback keeps the JSON envelope, batched under one stdin's worth: a path list is
+ * metadata, so it stays in the hundreds of bytes even for a deep tree. It is still a redirected
+ * stdin read though, so on Windows PowerShell 5.1 it carries the same defect as any other — which
+ * is why sftp is tried first even for a payload this small.
+ */
 async function createWindowsUploadDirectories(
   target: SshTarget,
   directories: readonly string[],
@@ -175,23 +186,27 @@ async function createWindowsUploadDirectories(
     if (batch.length === 0) {
       return
     }
+    const pending = batch
     const payload = JSON.stringify(batch)
     batch = []
     batchBytes = 0
     throwIfAborted(options.signal)
-    const channel = spawnSystemSshCommand(target, makeWindowsCreateDirectoriesCommand(), {
-      wrapCommand: false,
-      ...getSystemSshBuildArgsFromOperationOptions(options)
-    })
-    const closePromise = awaitWithSystemSshAbort(
-      options.signal,
-      () => channel.close(),
-      waitForChannelClose(channel, 'windows relay upload mkdir', WINDOWS_STDIN_WRITE_TIMEOUT_MS)
+    await getWindowsRemoteWriteCapabilities(target).runWithFallback(
+      'sftp-subsystem',
+      async () => {
+        try {
+          await makeDirectoriesViaSftp(target, pending, options)
+        } catch (error) {
+          // A directory sftp cannot address is this batch's problem, not the host's verdict.
+          if (!isSftpPathUnsupportedError(error)) {
+            throw error
+          }
+          await createWindowsUploadDirectoriesViaPowerShell(target, payload, options)
+        }
+      },
+      () => createWindowsUploadDirectoriesViaPowerShell(target, payload, options),
+      isSftpUnavailableError
     )
-    if (!options.signal?.aborted) {
-      channel.stdin.end(payload)
-    }
-    await closePromise
   }
   for (const directory of directories) {
     const entryBytes = Buffer.byteLength(directory) + 4
@@ -204,17 +219,44 @@ async function createWindowsUploadDirectories(
   await flush()
 }
 
+async function createWindowsUploadDirectoriesViaPowerShell(
+  target: SshTarget,
+  payload: string,
+  options: SystemSshOperationOptions
+): Promise<void> {
+  const channel = spawnSystemSshCommand(target, makeWindowsCreateDirectoriesCommand(), {
+    wrapCommand: false,
+    ...getSystemSshBuildArgsFromOperationOptions(options)
+  })
+  const closePromise = awaitWithSystemSshAbort(
+    options.signal,
+    () => channel.close(),
+    waitForChannelClose(channel, 'windows relay upload mkdir', WINDOWS_STDIN_WRITE_TIMEOUT_MS)
+  )
+  if (!options.signal?.aborted) {
+    channel.stdin.end(payload)
+  }
+  await closePromise
+}
+
 function makeWindowsCreateDirectoriesCommand(): string {
   return powerShellCommand(
     [
       '$ErrorActionPreference = "Stop"',
-      // The reporter measured this reader surviving 50KB where `[Console]::In` wedged at the same
-      // size (#16432); the batch above stays under that.
+      // Reached only where the host has no sftp subsystem. Windows PowerShell 5.1 can lose a
+      // redirected stdin for good when a read finds it empty (#16432); a batch this small usually
+      // arrives in one piece, and "usually" is exactly why sftp is preferred.
       '$reader = New-Object System.IO.StreamReader([Console]::OpenStandardInput())',
       'try { $json = $reader.ReadToEnd() } finally { $reader.Dispose() }',
       'if ([string]::IsNullOrWhiteSpace($json)) { return }',
-      'foreach ($path in @($json | ConvertFrom-Json)) {',
-      '  $null = [System.IO.Directory]::CreateDirectory([string]$path)',
+      // `[string[]]`, not `@(...)`: ConvertFrom-Json emits the parsed array as a single pipeline
+      // object, so `@(...)` wraps it in *another* array and the loop variable binds to the whole
+      // thing. `[string]` of that is the paths joined by spaces, which CreateDirectory rejects with
+      // "The given path's format is not supported". It only ever worked for a one-element batch,
+      // where stringifying a single-element array happens to yield the element. Measured on
+      // WindowsPowerShell 5.1.26100 against a three-directory tree.
+      'foreach ($path in [string[]]($json | ConvertFrom-Json)) {',
+      '  $null = [System.IO.Directory]::CreateDirectory($path)',
       '}'
     ].join('; ')
   )
diff --git a/src/main/ssh/system-ssh-sftp-args.test.ts b/src/main/ssh/system-ssh-sftp-args.test.ts
new file mode 100644
index 00000000000..d971390f8dd
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-args.test.ts
@@ -0,0 +1,141 @@
+/**
+ * `buildSshArgs` is shared with the sftp client, and three of its flags mean something else there.
+ * Every case below is a silent wrong-target rather than an error if the translation is skipped,
+ * which is why the fallback is "refuse and use another transport", never "pass it through".
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  SftpArgTranslationError,
+  translateSshArgsToSftpArgs,
+  withSftpKeepalive
+} from './system-ssh-sftp-args'
+
+describe('translateSshArgsToSftpArgs', () => {
+  it('sends the port as an option, since sftp -p preserves mtimes instead', () => {
+    const args = translateSshArgsToSftpArgs(['-p', '2222', '--', 'dev@win.example'])
+
+    expect(args).toEqual(['-o', 'Port=2222', '--', 'dev@win.example'])
+  })
+
+  it('sends the login name as an option, since sftp has no -l', () => {
+    // `buildSshArgs` emits `-l` for a config alias no Host block claims. Throwing here would send
+    // exactly those hosts to the transport this PR exists to stop using, silently.
+    const args = translateSshArgsToSftpArgs(['-l', 'neil', '--', 'awin'])
+
+    expect(args).toEqual(['-o', 'User=neil', '--', 'awin'])
+  })
+
+  it('translates the whole unclaimed-alias shape buildSshArgs emits', () => {
+    const args = translateSshArgsToSftpArgs([
+      '-o',
+      'BatchMode=no',
+      '-T',
+      '-S',
+      'none',
+      '-o',
+      'Hostname=192.168.0.186',
+      '-p',
+      '2222',
+      '-l',
+      'neil',
+      '--',
+      'awin'
+    ])
+
+    expect(args).toEqual([
+      '-o',
+      'BatchMode=no',
+      '-o',
+      'ControlPath=none',
+      '-o',
+      'Hostname=192.168.0.186',
+      '-o',
+      'Port=2222',
+      '-o',
+      'User=neil',
+      '--',
+      'awin'
+    ])
+  })
+
+  it('spells ControlPath=none out, since sftp -S names a program to run', () => {
+    // `sftp -S none` would try to exec a binary called `none`.
+    const args = translateSshArgsToSftpArgs(['-S', 'none', '--', 'dev@win.example'])
+
+    expect(args).toEqual(['-o', 'ControlPath=none', '--', 'dev@win.example'])
+  })
+
+  it('refuses any other -S, which would hand sftp an ssh binary Orca did not choose', () => {
+    expect(() => translateSshArgsToSftpArgs(['-S', '/tmp/ctl.sock'])).toThrow(
+      SftpArgTranslationError
+    )
+  })
+
+  it('drops -T, which sftp does not have', () => {
+    expect(translateSshArgsToSftpArgs(['-T', '--', 'host'])).toEqual(['--', 'host'])
+  })
+
+  it('passes through the flags both clients spell the same way', () => {
+    const args = translateSshArgsToSftpArgs([
+      '-F',
+      '/tmp/config',
+      '-o',
+      'BatchMode=yes',
+      '-i',
+      '/tmp/key',
+      '-J',
+      'jump.example',
+      '--',
+      'dev@win.example'
+    ])
+
+    expect(args).toEqual([
+      '-F',
+      '/tmp/config',
+      '-o',
+      'BatchMode=yes',
+      '-i',
+      '/tmp/key',
+      '-J',
+      'jump.example',
+      '--',
+      'dev@win.example'
+    ])
+  })
+
+  it('takes everything after -- as the destination without reinterpreting it', () => {
+    // A host literally named `-p` is not a flag once `--` has been seen.
+    expect(translateSshArgsToSftpArgs(['--', '-p'])).toEqual(['--', '-p'])
+  })
+
+  it('refuses an unknown flag rather than guessing what sftp would do with it', () => {
+    // The point of the throw: a flag added to buildSshArgs later must degrade to another
+    // transport, not reach sftp carrying a different meaning.
+    expect(() => translateSshArgsToSftpArgs(['-A', '--', 'host'])).toThrow(SftpArgTranslationError)
+  })
+
+  it('refuses a value flag with no value', () => {
+    expect(() => translateSshArgsToSftpArgs(['-o'])).toThrow(SftpArgTranslationError)
+  })
+})
+
+describe('withSftpKeepalive', () => {
+  it('asks OpenSSH to notice a dead peer, since the transfer itself has no wall-clock bound', () => {
+    expect(withSftpKeepalive(['--', 'host'])).toEqual([
+      '-o',
+      'ServerAliveInterval=15',
+      '-o',
+      'ServerAliveCountMax=3',
+      '--',
+      'host'
+    ])
+  })
+
+  it('leaves a caller-stated keepalive policy alone', () => {
+    const args = withSftpKeepalive(['-o', 'ServerAliveInterval=60', '--', 'host'])
+
+    expect(args.filter((arg) => arg.startsWith('ServerAliveInterval'))).toEqual([
+      'ServerAliveInterval=60'
+    ])
+  })
+})
diff --git a/src/main/ssh/system-ssh-sftp-args.ts b/src/main/ssh/system-ssh-sftp-args.ts
new file mode 100644
index 00000000000..17fa37e78bb
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-args.ts
@@ -0,0 +1,95 @@
+/**
+ * Rewrites `buildSshArgs` output for the sftp(1) client.
+ *
+ * Three flags ssh and sftp share spell different things: sftp's `-p` is "preserve mtime", its `-S`
+ * names the ssh binary to run, and it has no `-T` at all. Passing ssh's list through unchanged
+ * would silently connect to the wrong port and try to exec a program called `none`.
+ *
+ * Anything this table does not recognize throws. A flag added to `buildSshArgs` later must degrade
+ * to the non-sftp transfer path, never reach sftp carrying a different meaning.
+ */
+
+/** `buildSshArgs` emitted a flag with no sftp equivalent; the caller should use another transport. */
+export class SftpArgTranslationError extends Error {
+  constructor(flag: string) {
+    super(`No sftp equivalent for system ssh argument ${JSON.stringify(flag)}`)
+    this.name = 'SftpArgTranslationError'
+  }
+}
+
+/** Flags whose spelling and meaning are identical in both clients. */
+const PASSTHROUGH_VALUE_FLAGS = new Set(['-F', '-o', '-i', '-J'])
+
+export function translateSshArgsToSftpArgs(sshArgs: readonly string[]): string[] {
+  const sftpArgs: string[] = []
+  let index = 0
+  while (index < sshArgs.length) {
+    const flag = sshArgs[index]!
+    if (flag === '--') {
+      // Everything after `--` is the destination, which both clients spell the same way.
+      sftpArgs.push(...sshArgs.slice(index))
+      return sftpArgs
+    }
+    const value = sshArgs[index + 1]
+    if (PASSTHROUGH_VALUE_FLAGS.has(flag)) {
+      if (value === undefined) {
+        throw new SftpArgTranslationError(flag)
+      }
+      sftpArgs.push(flag, value)
+      index += 2
+      continue
+    }
+    if (flag === '-T') {
+      // sftp never allocates a tty, so ssh's "no tty" request has nothing to translate to.
+      index += 1
+      continue
+    }
+    if (flag === '-p') {
+      if (value === undefined) {
+        throw new SftpArgTranslationError(flag)
+      }
+      sftpArgs.push('-o', `Port=${value}`)
+      index += 2
+      continue
+    }
+    if (flag === '-l') {
+      // sftp has no `-l`; the login name is an option there. `buildSshArgs` emits this for an
+      // unclaimed config alias, so throwing would route those hosts down the defective path and
+      // then cache the refusal against them for half an hour.
+      if (value === undefined) {
+        throw new SftpArgTranslationError(flag)
+      }
+      sftpArgs.push('-o', `User=${value}`)
+      index += 2
+      continue
+    }
+    if (flag === '-S') {
+      // ssh's `-S none` is ControlPath=none; sftp's `-S` would run a binary called `none`.
+      if (value !== 'none') {
+        throw new SftpArgTranslationError(flag)
+      }
+      sftpArgs.push('-o', 'ControlPath=none')
+      index += 2
+      continue
+    }
+    throw new SftpArgTranslationError(flag)
+  }
+  return sftpArgs
+}
+
+/**
+ * A transfer that stalls mid-stream has no per-write bound to catch it, so ask OpenSSH to notice a
+ * dead peer itself. Only added when the caller has not already stated a keepalive policy.
+ */
+export function withSftpKeepalive(sftpArgs: readonly string[]): string[] {
+  const hasOption = (name: string): boolean =>
+    sftpArgs.some((arg, position) => sftpArgs[position - 1] === '-o' && arg.startsWith(`${name}=`))
+  const keepalive: string[] = []
+  if (!hasOption('ServerAliveInterval')) {
+    keepalive.push('-o', 'ServerAliveInterval=15')
+  }
+  if (!hasOption('ServerAliveCountMax')) {
+    keepalive.push('-o', 'ServerAliveCountMax=3')
+  }
+  return [...keepalive, ...sftpArgs]
+}
diff --git a/src/main/ssh/system-ssh-sftp-path.test.ts b/src/main/ssh/system-ssh-sftp-path.test.ts
new file mode 100644
index 00000000000..e196c2e3e8f
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-path.test.ts
@@ -0,0 +1,59 @@
+/**
+ * Both functions here guard against the same measured failure: sftp's batch lexer treats `\` as an
+ * escape, so a Windows path handed over raw is silently mis-targeted *and the client still exits
+ * 0*. On Windows 11 / OpenSSH 10.0p2, `put src C:\Users\neil\qt\a.bin` created a file literally
+ * named `C` in the start directory and reported success.
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  quoteSftpBatchArgument,
+  toSftpRemotePath,
+  UnsupportedSftpPathError
+} from './system-ssh-sftp-path'
+
+describe('toSftpRemotePath', () => {
+  it('roots a drive path under /, which is the namespace the Windows sftp-server exposes', () => {
+    // `pwd` in that session reports `/C:/Users/dev`.
+    expect(toSftpRemotePath('C:/Users/dev/f.bin')).toBe('/C:/Users/dev/f.bin')
+  })
+
+  it('accepts a path already in that namespace unchanged', () => {
+    expect(toSftpRemotePath('/C:/Users/dev/f.bin')).toBe('/C:/Users/dev/f.bin')
+  })
+
+  it('converts the separators Orca stores paths with', () => {
+    expect(toSftpRemotePath('C:\\Users\\dev\\f.bin')).toBe('/C:/Users/dev/f.bin')
+  })
+
+  it('declines a UNC path rather than guessing where it lands', () => {
+    // A guess here writes real bytes to the wrong place; declining falls back to another transport.
+    expect(() => toSftpRemotePath('//server/share/f.bin')).toThrow(UnsupportedSftpPathError)
+  })
+
+  it('declines a relative path, which would resolve against the session start directory', () => {
+    expect(() => toSftpRemotePath('Users/dev/f.bin')).toThrow(UnsupportedSftpPathError)
+  })
+})
+
+describe('quoteSftpBatchArgument', () => {
+  it('escapes the backslashes in a Windows client local path', () => {
+    // Unescaped, sftp reads this as C:srcf.bin and fails to find the source.
+    expect(quoteSftpBatchArgument('C:\\src\\f.bin')).toBe('"C:\\\\src\\\\f.bin"')
+  })
+
+  it('keeps a path with spaces as one argument', () => {
+    expect(quoteSftpBatchArgument('/tmp/two words.bin')).toBe('"/tmp/two words.bin"')
+  })
+
+  it('escapes an embedded quote, which would otherwise end the argument early', () => {
+    expect(quoteSftpBatchArgument('/tmp/dq".bin')).toBe('"/tmp/dq\\".bin"')
+  })
+
+  it('refuses a line break, which would split one batch command into two', () => {
+    expect(() => quoteSftpBatchArgument('/tmp/a\nrm -rf b')).toThrow(UnsupportedSftpPathError)
+  })
+
+  it('refuses a NUL, which truncates the argument', () => {
+    expect(() => quoteSftpBatchArgument('/tmp/a\0b')).toThrow(UnsupportedSftpPathError)
+  })
+})
diff --git a/src/main/ssh/system-ssh-sftp-path.ts b/src/main/ssh/system-ssh-sftp-path.ts
new file mode 100644
index 00000000000..2b5bfe53f02
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-path.ts
@@ -0,0 +1,46 @@
+import { normalizeWindowsRemotePath } from './ssh-remote-platform'
+
+/**
+ * A path this transfer cannot express to sftp. Callers treat it as "use another transport", never
+ * as a transfer failure.
+ */
+export class UnsupportedSftpPathError extends Error {
+  constructor(path: string) {
+    super(`Path cannot be addressed over sftp: ${JSON.stringify(path)}`)
+    this.name = 'UnsupportedSftpPathError'
+  }
+}
+
+/**
+ * Converts a Windows remote path to the namespace OpenSSH's Windows sftp-server exposes, which
+ * roots every drive under `/`: `C:/Users/dev/f` is `/C:/Users/dev/f`, and `pwd` there reports
+ * `/C:/Users/dev`.
+ */
+export function toSftpRemotePath(remotePath: string): string {
+  const normalized = normalizeWindowsRemotePath(remotePath)
+  if (/^\/[a-zA-Z]:\//.test(normalized)) {
+    return normalized
+  }
+  if (/^[a-zA-Z]:\//.test(normalized)) {
+    return `/${normalized}`
+  }
+  // UNC (`//server/share`) and relative paths have no settled mapping in this namespace, and a
+  // guess here writes real bytes to the wrong place. Decline instead.
+  throw new UnsupportedSftpPathError(remotePath)
+}
+
+/**
+ * Quotes one argument of an sftp batch line.
+ *
+ * Escaping is load-bearing, not cosmetic: sftp's batch lexer treats `\` as an escape even inside
+ * double quotes, so an unescaped Windows local path `C:\src\f.bin` is read as `C:srcf.bin`, and an
+ * unescaped destination `C:\Users\dev\f.bin` writes a file literally named `C` in the start
+ * directory — while sftp still exits 0. Both measured on Windows 11 / OpenSSH 10.0p2.
+ */
+export function quoteSftpBatchArgument(value: string): string {
+  if (/[\n\r\0]/.test(value)) {
+    // A line break would split one batch command into two; NUL truncates the argument.
+    throw new UnsupportedSftpPathError(value)
+  }
+  return `"${value.replace(/([\\"])/g, '\\$1')}"`
+}
diff --git a/src/main/ssh/system-ssh-sftp-transfer.ts b/src/main/ssh/system-ssh-sftp-transfer.ts
new file mode 100644
index 00000000000..c50375fa8eb
--- /dev/null
+++ b/src/main/ssh/system-ssh-sftp-transfer.ts
@@ -0,0 +1,191 @@
+import { accessSync, constants, existsSync, statSync } from 'node:fs'
+import { posix, win32 } from 'node:path'
+import type { SshTarget } from '../../shared/ssh-types'
+import { buildSshArgs, type SystemSshBuildArgsOptions } from './system-ssh-args'
+import { findSystemSsh } from './system-ssh-binary'
+import {
+  SftpArgTranslationError,
+  translateSshArgsToSftpArgs,
+  withSftpKeepalive
+} from './system-ssh-sftp-args'
+import {
+  quoteSftpBatchArgument,
+  toSftpRemotePath,
+  UnsupportedSftpPathError
+} from './system-ssh-sftp-path'
+import { throwIfAborted } from './system-ssh-operation-lifecycle'
+import { runProcess } from '../../shared/child-process/run-process'
+
+/** The host answered, but not with an sftp subsystem. The caller must fall back, not fail. */
+export class SftpSubsystemUnavailableError extends Error {
+  constructor(detail: string) {
+    super(`Remote host has no usable sftp subsystem: ${detail}`)
+    this.name = 'SftpSubsystemUnavailableError'
+  }
+}
+
+/**
+ * True for the errors that mean "this host cannot serve sftp at all".
+ *
+ * Host-scoped, and therefore the only errors safe to remember: a capability cache keyed by host
+ * turns anything it accepts into a verdict about every later write to that host. Deliberately
+ * narrow — a permission denial or a missing directory is a real failure that must surface, not a
+ * reason to retry the whole upload down a slower path.
+ */
+export function isSftpUnavailableError(error: unknown): boolean {
+  return error instanceof SftpSubsystemUnavailableError || error instanceof SftpArgTranslationError
+}
+
+/**
+ * True when *this path* cannot be spelled for sftp, which says nothing about the host.
+ *
+ * Kept apart from the host verdict on purpose. A UNC destination, or a local file whose name
+ * contains a newline, is a property of one operation; caching it would degrade every subsequent
+ * write to that host for the cache's whole retry window on the strength of one odd filename.
+ */
+export function isSftpPathUnsupportedError(error: unknown): boolean {
+  return error instanceof UnsupportedSftpPathError
+}
+
+/** Neither kind of refusal moves a byte, so a staged file cannot exist to sweep. */
+export function isSftpRefusalBeforeStaging(error: unknown): boolean {
+  return isSftpUnavailableError(error) || isSftpPathUnsupportedError(error)
+}
+
+function systemSftpCandidates(sshPath: string | null, platform: NodeJS.Platform): string[] {
+  const pathApi = platform === 'win32' ? win32 : posix
+  const executable = platform === 'win32' ? 'sftp.exe' : 'sftp'
+  const candidates: string[] = []
+  // Why the ssh binary's own directory first: a host with two OpenSSH installs must pair the sftp
+  // client with the ssh that `buildSshArgs` was built for, not whichever one PATH happens to reach.
+  if (sshPath) {
+    candidates.push(pathApi.join(pathApi.dirname(sshPath), executable))
+  }
+  if (platform === 'win32') {
+    const systemRoot = process.env.SystemRoot || process.env.WINDIR
+    if (systemRoot) {
+      candidates.push(win32.join(systemRoot, 'System32', 'OpenSSH', executable))
+    }
+  } else {
+    candidates.push('/usr/bin/sftp', '/usr/local/bin/sftp', '/opt/homebrew/bin/sftp')
+  }
+  return candidates
+}
+
+/** Locate the sftp client paired with the system ssh binary. Returns null when there is none. */
+export function findSystemSftp(): string | null {
+  if (process.env.ORCA_SYSTEM_SFTP_PATH) {
+    return process.env.ORCA_SYSTEM_SFTP_PATH
+  }
+  const sshPath = findSystemSsh()
+  for (const candidate of systemSftpCandidates(sshPath, process.platform)) {
+    try {
+      if (!statSync(candidate).isFile()) {
+        continue
+      }
+      if (process.platform !== 'win32') {
+        accessSync(candidate, constants.X_OK)
+      }
+      return candidate
+    } catch {
+      continue
+    }
+  }
+  return findSftpOnPath()
+}
+
+function findSftpOnPath(): string | null {
+  const pathValue = process.env.PATH
+  if (!pathValue) {
+    return null
+  }
+  const pathApi = process.platform === 'win32' ? win32 : posix
+  const executable = process.platform === 'win32' ? 'sftp.exe' : 'sftp'
+  for (const entry of pathValue.split(pathApi.delimiter)) {
+    const directory = entry.trim().replace(/^"|"$/g, '')
+    if (!directory) {
+      continue
+    }
+    const candidate = pathApi.join(directory, executable)
+    if (existsSync(candidate)) {
+      return candidate
+    }
+  }
+  return null
+}
+
+/**
+ * OpenSSH prints this when the server refuses the subsystem — a host with `Subsystem sftp`
+ * commented out, or an internal-sftp block that does not apply to this user.
+ */
+const SUBSYSTEM_REFUSED_PATTERN = /subsystem request failed|no such file or directory.*sftp-server/i
+
+export type SftpBatchOptions = SystemSshBuildArgsOptions & { signal?: AbortSignal }
+
+/**
+ * Runs one sftp batch script.
+ *
+ * The script goes to the *local* sftp client's stdin, which is the point: no remote process ever
+ * reads a redirected stdin, so none of this rides the Windows PowerShell stdin defect.
+ */
+export async function runSftpBatch(
+  target: SshTarget,
+  commands: readonly string[],
+  options?: SftpBatchOptions
+): Promise<void> {
+  throwIfAborted(options?.signal)
+  const sftpPath = findSystemSftp()
+  if (!sftpPath) {
+    throw new SftpSubsystemUnavailableError('no sftp client binary found alongside ssh')
+  }
+  const args = withSftpKeepalive(translateSshArgsToSftpArgs(buildSshArgs(target, options)))
+  let result
+  try {
+    result = await runProcess({
+      program: sftpPath,
+      args: ['-b', '-', ...args],
+      // `-b -` takes the script on stdin, and that stdin is the *local* client's — no remote
+      // process reads a pipe anywhere in this transfer, which is the whole point of preferring it.
+      input: `${commands.join('\n')}\n`,
+      // Why no timeout: a large upload is legitimately slow, and a wall-clock cap would fail a
+      // healthy transfer on a slow link. A dead peer is caught by the ServerAlive options instead.
+      timeoutMs: null,
+      signal: options?.signal
+    })
+  } catch (error) {
+    // A client that will not start is "this host cannot do sftp" from the caller's side, not a
+    // transfer failure: the payload never left. Falling back is the only useful answer.
+    throw new SftpSubsystemUnavailableError(
+      `sftp client at ${sftpPath} could not be started: ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+  if (result.code === 0) {
+    return
+  }
+  throwIfAborted(options?.signal)
+  const detail = result.stderr.trim()
+  if (SUBSYSTEM_REFUSED_PATTERN.test(detail)) {
+    throw new SftpSubsystemUnavailableError(detail)
+  }
+  throw new Error(`sftp batch failed (exit ${result.code}): ${detail}`)
+}
+
+/**
+ * Creates remote directories, parents first.
+ *
+ * `-mkdir` keeps sftp going when a directory is already there; batch mode otherwise aborts the
+ * whole script on the first non-zero status, which for an idempotent tree walk is not a failure.
+ */
+export function makeDirectoriesViaSftp(
+  target: SshTarget,
+  remoteDirectories: readonly string[],
+  options?: SftpBatchOptions
+): Promise<void> {
+  const commands = remoteDirectories.map(
+    (directory) => `-mkdir ${quoteSftpBatchArgument(toSftpRemotePath(directory))}`
+  )
+  if (commands.length === 0) {
+    return Promise.resolve()
+  }
+  return runSftpBatch(target, commands, options)
+}
diff --git a/src/main/ssh/system-ssh-windows-file-write.ts b/src/main/ssh/system-ssh-windows-file-write.ts
new file mode 100644
index 00000000000..8b98d4aec50
--- /dev/null
+++ b/src/main/ssh/system-ssh-windows-file-write.ts
@@ -0,0 +1,138 @@
+import { randomBytes } from 'node:crypto'
+import { powerShellCommand, powerShellLiteral } from './ssh-remote-powershell'
+import { normalizeWindowsRemotePath } from './ssh-remote-platform'
+
+/**
+ * Suffix marking the path a Windows write lands on before it is published by rename.
+ *
+ * The random tail is the fix for a measured harm, not decoration. A write that loses contact with
+ * the host leaves a remote process that may still hold the staging file open exclusively, and
+ * `docs/reference/ssh-execution-boundary.md` is explicit that losing contact is not evidence that
+ * process died — so the retry must not reuse the name it may still own. A fresh name per attempt
+ * means a retry never meets its predecessor's lock; the abandoned file is cleaned up best-effort
+ * and never treated as proof of anything.
+ */
+export const WINDOWS_STAGED_WRITE_SUFFIX = '.orca-partial'
+
+export function makeWindowsStagingPath(remotePath: string): string {
+  return `${remotePath}${WINDOWS_STAGED_WRITE_SUFFIX}-${randomBytes(6).toString('hex')}`
+}
+
+export type WindowsPublishMode = 'create' | 'exclusive' | 'append'
+
+/**
+ * Publishes a staged upload onto its real name.
+ *
+ * Every branch reads the staged *file*, never a redirected stdin, which is what makes this safe on
+ * a host whose Windows PowerShell 5.1 cannot drain a piped stdin.
+ *
+ * The replacing branch must never delete the destination first. Deleting and then moving loses the
+ * user's existing file outright if the move fails, and exposes a window where a reader sees no file
+ * at all — a worse outcome than the truncated-partial this staging discipline exists to prevent.
+ * `File.Replace` is the atomic swap (Win32 `ReplaceFile`), and it requires the destination to
+ * exist, so an absent one falls back to a plain `Move`. That fallback is raced deliberately: if the
+ * destination appears in between, `Move` throws, the staged file survives, and the destination is
+ * left exactly as whoever created it left it.
+ *
+ * `File::Move` throwing on an existing destination is also precisely the exclusive contract, which
+ * is why that branch needs nothing else.
+ */
+export function makeWindowsPublishStagedFileCommand(
+  stagingPath: string,
+  remotePath: string,
+  mode: WindowsPublishMode
+): string {
+  const preamble = [
+    '$ErrorActionPreference = "Stop"',
+    `$staging = ${powerShellLiteral(stagingPath)}`,
+    `$path = ${powerShellLiteral(remotePath)}`,
+    '$parent = [System.IO.Path]::GetDirectoryName($path)',
+    'if ($parent) { $null = [System.IO.Directory]::CreateDirectory($parent) }'
+  ]
+  if (mode === 'append') {
+    return powerShellCommand(
+      [
+        ...preamble,
+        // Not atomic, and cannot cheaply be: appending is defined as extending the destination, so
+        // a failure part-way leaves it longer than it was rather than destroyed. The caller's
+        // chunked-append protocol already restarts from its own offset.
+        '$in = [System.IO.File]::OpenRead($staging)',
+        '$out = [System.IO.File]::Open($path, [System.IO.FileMode]::Append, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)',
+        'try { $in.CopyTo($out) } finally { $out.Dispose(); $in.Dispose() }',
+        '[System.IO.File]::Delete($staging)'
+      ].join('; ')
+    )
+  }
+  if (mode === 'exclusive') {
+    return powerShellCommand([...preamble, '[System.IO.File]::Move($staging, $path)'].join('; '))
+  }
+  return powerShellCommand(
+    [
+      ...preamble,
+      // `[NullString]::Value`, not `$null`: PowerShell coerces a bare `$null` to an empty string
+      // when binding a .NET `string` parameter, and `Replace` rejects that with "The path is not
+      // of a legal form" — so every publish would fail. Measured on WindowsPowerShell 5.1.26100.
+      'try { [System.IO.File]::Replace($staging, $path, [NullString]::Value) } catch [System.IO.FileNotFoundException] { [System.IO.File]::Move($staging, $path) }'
+    ].join('; ')
+  )
+}
+
+/** Best-effort removal of a staged file whose write was abandoned. Never asserts the writer died. */
+export function makeWindowsDiscardStagedFileCommand(stagingPath: string): string {
+  return powerShellCommand(
+    [
+      // Deliberately not `Stop`: the previous writer may still hold this file, and that is a
+      // possibility to tolerate, not an error to report. The unique staging name means a leftover
+      // blocks nothing; sweeping it is housekeeping.
+      '$ErrorActionPreference = "SilentlyContinue"',
+      `$staging = ${powerShellLiteral(stagingPath)}`,
+      '[System.IO.File]::Delete($staging)'
+    ].join('; ')
+  )
+}
+
+/**
+ * The ancestor directories of a Windows remote path, drive root first.
+ *
+ * sftp's `mkdir` creates one level, so a batch has to name each level itself. The drive root is
+ * excluded: `-mkdir "/C:/"` is not a directory anyone creates.
+ */
+export function windowsRemoteAncestorDirectories(remotePath: string): string[] {
+  const normalized = normalizeWindowsRemotePath(remotePath)
+  const segments = normalized.split('/')
+  segments.pop()
+  const ancestors: string[] = []
+  // Start past the drive (`C:`) or the UNC host, which are never created.
+  for (let depth = 2; depth <= segments.length; depth += 1) {
+    const directory = segments.slice(0, depth).join('/')
+    if (directory) {
+      ancestors.push(directory)
+    }
+  }
+  return ancestors
+}
+
+/**
+ * `[Console]::OpenStandardInput()` into a `FileStream`, used only by the two stdin fallbacks.
+ *
+ * On Windows PowerShell 5.1 this is the defective read; see the strategy comment in
+ * `system-ssh-file-binary-transfer.ts`. It is correct under PowerShell 7.
+ */
+export function makeWindowsWriteFileCommand(
+  remotePath: string,
+  options?: { append?: boolean; exclusive?: boolean; executable?: 'powershell.exe' | 'pwsh.exe' }
+): string {
+  const fileMode = options?.append ? 'Append' : options?.exclusive ? 'CreateNew' : 'Create'
+  return powerShellCommand(
+    [
+      '$ErrorActionPreference = "Stop"',
+      `$path = ${powerShellLiteral(remotePath)}`,
+      '$parent = [System.IO.Path]::GetDirectoryName($path)',
+      'if ($parent) { $null = [System.IO.Directory]::CreateDirectory($parent) }',
+      '$inputStream = [Console]::OpenStandardInput()',
+      `$outputStream = [System.IO.File]::Open($path, [System.IO.FileMode]::${fileMode}, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)`,
+      'try { $inputStream.CopyTo($outputStream) } finally { $outputStream.Dispose() }'
+    ].join('; '),
+    options?.executable ?? 'powershell.exe'
+  )
+}
diff --git a/src/main/ssh/system-ssh-windows-upload.test.ts b/src/main/ssh/system-ssh-windows-upload.test.ts
index 207c3e2df8e..c3a5ff80276 100644
--- a/src/main/ssh/system-ssh-windows-upload.test.ts
+++ b/src/main/ssh/system-ssh-windows-upload.test.ts
@@ -1,29 +1,40 @@
 /**
- * #16432: the Windows relay upload pushed the whole bundle into one PowerShell stdin, which
- * Windows PowerShell 5.1 cannot drain over a non-pty ssh exec — the remote blocks forever, and
- * `waitForChannelClose()` had no timeout, so the UI sat at "Connecting…" with no error. Covered
- * here: no write exceeds one stdin's worth on any Windows path (bundle upload *and* single-file
- * upload, which is the one that carries large files), a partial write never lands under the real
- * name, and a remote that never closes fails instead of hanging.
+ * #16432. The original fix chunked the payload because the constraint was believed to be a ~50KB
+ * cmd.exe stdin ceiling. Re-measured on Windows 11 26200.9168 / OpenSSH_for_Windows_10.0p2, it is
+ * not a size limit and not cmd.exe's: a read on Windows PowerShell 5.1's redirected-stdin handle
+ * over a non-pty ssh exec can die permanently when it finds the stream momentarily empty, taking
+ * both the remaining data and the EOF with it. It is probabilistic per such read — identical 2MB
+ * payloads died at 167936, 270336 and 372736 — so a 32KB chunk still failed 15 times in 120 under
+ * load, while `findstr` took 2,016,000 bytes through one exec on the same host.
+ *
+ * So the covering property is no longer "every write is small". It is "the bytes do not cross a
+ * remote process's stdin at all": sftp first, PowerShell 7 next, and Windows PowerShell 5.1 last,
+ * bounded and loud. The staging-and-rename discipline is kept on every path, with a unique staging
+ * name per attempt so a retry never meets a predecessor's lock.
  */
 import { EventEmitter } from 'node:events'
 import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
-import { rm } from 'node:fs/promises'
+import { readFile, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { PassThrough, Writable } from 'node:stream'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as SystemSshOperationLifecycle from './system-ssh-operation-lifecycle'
 
-const { spawnSystemSshCommandMock, waitForChannelCloseSpy } = vi.hoisted(() => ({
+const { spawnSystemSshCommandMock, waitForChannelCloseSpy, runProcessMock } = vi.hoisted(() => ({
   spawnSystemSshCommandMock: vi.fn(),
-  waitForChannelCloseSpy: vi.fn()
+  waitForChannelCloseSpy: vi.fn(),
+  runProcessMock: vi.fn()
 }))
 
 vi.mock('./system-ssh-command', () => ({
   spawnSystemSshCommand: spawnSystemSshCommandMock
 }))
 
+vi.mock('../../shared/child-process/run-process', () => ({
+  runProcess: runProcessMock
+}))
+
 // Delegates to the real implementation; the spy only records whether each wait was given a bound.
 vi.mock('./system-ssh-operation-lifecycle', async (importActual) => {
   const actual = (await importActual()) as typeof SystemSshOperationLifecycle
@@ -41,6 +52,11 @@ import {
 } from './system-ssh-file-binary-transfer'
 import { waitForChannelClose } from './system-ssh-operation-lifecycle'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
+import {
+  clearWindowsRemoteWriteCapabilitiesForTests,
+  getWindowsRemoteWriteCapabilities
+} from './system-ssh-windows-write-capabilities'
+import { explainWindowsPowerShellStdinFailure } from './system-ssh-windows-write-strategy'
 import type { SshTarget } from '../../shared/ssh-types'
 
 type FakeChannel = EventEmitter & {
@@ -50,7 +66,12 @@ type FakeChannel = EventEmitter & {
   written: Buffer
 }
 
-const target = { id: 'win-1', host: 'win.example', username: 'dev' } as unknown as SshTarget
+const target = {
+  id: 'win-1',
+  host: 'win.example',
+  username: 'dev',
+  port: 22
+} as unknown as SshTarget
 const hostPlatform = getRemoteHostPlatform('win32-x64')
 const remoteRoot = 'C:/Users/dev/.orca-remote'
 
@@ -78,96 +99,238 @@ function createFakeChannel(onEnd: (channel: FakeChannel) => void): FakeChannel {
   return channel
 }
 
-type RecordedCommand = { script: string; stdin: Buffer }
+type RecordedCommand = { script: string; executable: string; stdin: Buffer }
+type RecordedSftpBatch = { args: string[]; script: string }
 
-describe('Windows upload stdin framing', () => {
-  let localDir: string
-  const commands: RecordedCommand[] = []
-  /** Index of the spawn that should report a non-zero exit, to model a chunk failing mid-file. */
-  let failAtSpawn = -1
+const sftpBatches: RecordedSftpBatch[] = []
+const commands: RecordedCommand[] = []
+/** Index of the exec that should report a non-zero exit, to model a chunk failing mid-file. */
+let failAtSpawn = -1
+let localDir: string
 
-  const fileWrites = (): RecordedCommand[] =>
-    commands.filter((command) => command.script.includes('FileMode]::'))
-  const writtenPath = (command: RecordedCommand): string =>
-    /\$path = '((?:[^']|'')*)'/.exec(command.script)?.[1].replace(/''/g, "'") ?? ''
-  const fileMode = (command: RecordedCommand): string | undefined =>
-    /FileMode\]::(\w+)/.exec(command.script)?.[1]
+const fileWrites = (): RecordedCommand[] =>
+  commands.filter((command) => command.script.includes('OpenStandardInput'))
+const writtenPath = (command: RecordedCommand): string =>
+  /\$path = '((?:[^']|'')*)'/.exec(command.script)?.[1]?.replace(/''/g, "'") ?? ''
+const fileMode = (command: RecordedCommand): string | undefined =>
+  /FileMode\]::(\w+)/.exec(command.script)?.[1]
+const putLines = (): string[] =>
+  sftpBatches.flatMap((batch) => batch.script.split('\n').filter((line) => line.startsWith('put ')))
+const putDestination = (line: string): string => /put "(?:[^"]*)" "([^"]*)"/.exec(line)?.[1] ?? ''
+const putSource = (line: string): string => /put "([^"]*)"/.exec(line)?.[1] ?? ''
 
-  beforeEach(() => {
-    commands.length = 0
-    failAtSpawn = -1
-    waitForChannelCloseSpy.mockClear()
-    localDir = mkdtempSync(join(tmpdir(), 'orca-win-upload-'))
-    spawnSystemSshCommandMock.mockReset()
-    spawnSystemSshCommandMock.mockImplementation((_target: SshTarget, command: string) => {
-      const spawnIndex = spawnSystemSshCommandMock.mock.calls.length - 1
-      return createFakeChannel((channel) => {
-        commands.push({ script: decodePowerShellCommand(command), stdin: channel.written })
-        setImmediate(() =>
-          spawnIndex === failAtSpawn
-            ? channel.emit('close', 1, null)
-            : channel.emit('close', 0, null)
-        )
+/** Makes every sftp batch succeed, recording what it was asked to do. */
+function acceptSftp(): void {
+  runProcessMock.mockImplementation(
+    async (spec: { args: string[]; input: string; program: string }) => {
+      const script = spec.input
+      sftpBatches.push({ args: spec.args, script })
+      // Model the real client: `put` copies the local file, so read it while it still exists.
+      for (const line of script.split('\n').filter((entry) => entry.startsWith('put '))) {
+        await readFile(putSource(line))
+      }
+      return { code: 0, signal: null, stdout: '', stderr: '', timedOut: false }
+    }
+  )
+}
+
+/** Models a host whose sshd has no `Subsystem sftp` line. */
+function refuseSftp(): void {
+  runProcessMock.mockImplementation(async (spec: { args: string[]; input: string }) => {
+    sftpBatches.push({ args: spec.args, script: spec.input })
+    return {
+      code: 255,
+      signal: null,
+      stdout: '',
+      stderr: 'subsystem request failed on channel 0\nConnection closed',
+      timedOut: false
+    }
+  })
+}
+
+/** Models a host with no PowerShell 7, which cmd.exe reports as an unrecognized command. */
+function refusePwsh(): void {
+  spawnSystemSshCommandMock.mockImplementation((_target: SshTarget, command: string) => {
+    const spawnIndex = spawnSystemSshCommandMock.mock.calls.length - 1
+    const executable = command.split(' ')[0] ?? ''
+    return createFakeChannel((channel) => {
+      commands.push({
+        script: decodePowerShellCommand(command),
+        executable,
+        stdin: channel.written
+      })
+      setImmediate(() => {
+        if (executable === 'pwsh.exe') {
+          channel.stderr.write(
+            "'pwsh.exe' is not recognized as an internal or external command,\noperable program or batch file."
+          )
+          channel.emit('close', 9009, null)
+          return
+        }
+        channel.emit('close', spawnIndex === failAtSpawn ? 1 : 0, null)
       })
     })
   })
+}
 
-  afterEach(async () => {
-    await rm(localDir, { recursive: true, force: true })
+beforeEach(() => {
+  commands.length = 0
+  sftpBatches.length = 0
+  failAtSpawn = -1
+  clearWindowsRemoteWriteCapabilitiesForTests()
+  waitForChannelCloseSpy.mockClear()
+  localDir = mkdtempSync(join(tmpdir(), 'orca-win-upload-'))
+  process.env.ORCA_SYSTEM_SFTP_PATH = '/usr/bin/sftp'
+  runProcessMock.mockReset()
+  acceptSftp()
+  spawnSystemSshCommandMock.mockReset()
+  spawnSystemSshCommandMock.mockImplementation((_target: SshTarget, command: string) => {
+    const spawnIndex = spawnSystemSshCommandMock.mock.calls.length - 1
+    return createFakeChannel((channel) => {
+      commands.push({
+        script: decodePowerShellCommand(command),
+        executable: command.split(' ')[0] ?? '',
+        stdin: channel.written
+      })
+      setImmediate(() =>
+        spawnIndex === failAtSpawn ? channel.emit('close', 1, null) : channel.emit('close', 0, null)
+      )
+    })
   })
+})
 
-  it('never pushes a whole artifact bundle into one PowerShell stdin', async () => {
-    mkdirSync(join(localDir, 'node'), { recursive: true })
-    // Comfortably past the ~50KB point at which the reporter measured PowerShell 5.1 wedging.
-    writeFileSync(join(localDir, 'node', 'relay.js'), Buffer.alloc(600 * 1024, 0x61))
-    writeFileSync(join(localDir, 'index.js'), Buffer.alloc(300 * 1024, 0x62))
+afterEach(async () => {
+  delete process.env.ORCA_SYSTEM_SFTP_PATH
+  await rm(localDir, { recursive: true, force: true })
+})
 
-    await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
-
-    const largest = Math.max(...commands.map((command) => command.stdin.length))
-    expect(largest).toBeLessThanOrEqual(WINDOWS_STDIN_WRITE_CHUNK_BYTES)
-    // The base64 + JSON envelope is gone entirely: nothing reads the bundle as one string.
-    expect(commands.some((command) => command.script.includes('FromBase64String'))).toBe(false)
-    // `[Console]::In` wedged at 50KB where the stream reader did not, so the mkdir batch — the one
-    // payload still read as a string — must use the reader the reporter measured surviving.
-    expect(commands.some((command) => command.script.includes('[Console]::In.ReadToEnd()'))).toBe(
-      false
-    )
-    expect(
-      commands.filter((command) => command.script.includes('StreamReader([Console]::'))
-    ).toHaveLength(1)
-  })
-
-  it('bounds the single-file upload too, which is the path large files take', async () => {
-    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3 + 11, 0x64)
+describe('Windows upload over sftp', () => {
+  it('moves the payload without any remote process reading a stdin', async () => {
+    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 60 + 11, 0x64)
     const localPath = join(localDir, 'big.node')
     writeFileSync(localPath, contents)
 
     await uploadFileViaSystemSsh(target, localPath, `${remoteRoot}/big.node`, { hostPlatform })
 
-    const writes = fileWrites()
-    expect(writes).toHaveLength(4)
-    expect(Math.max(...writes.map((write) => write.stdin.length))).toBe(
-      WINDOWS_STDIN_WRITE_CHUNK_BYTES
-    )
-    expect(Buffer.concat(writes.map((write) => write.stdin)).equals(contents)).toBe(true)
-    // A wedged PowerShell never closes on its own, so no wait on this path may be unbounded.
-    expect(
-      waitForChannelCloseSpy.mock.calls.every((call) => call[2] === WINDOWS_STDIN_WRITE_TIMEOUT_MS)
-    ).toBe(true)
+    // The defect is a remote stdin read; the fix is that there is not one.
+    expect(fileWrites()).toHaveLength(0)
+    expect(putLines()).toHaveLength(1)
+    // One transfer, not 61 execs: the whole point of the change.
+    expect(sftpBatches).toHaveLength(1)
   })
 
-  it('writes every byte of every artifact across the chunked writes', async () => {
-    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 2 + 17, 0x63)
-    writeFileSync(join(localDir, 'relay.js'), contents)
+  it('creates the parent chain and sends the payload in one round trip', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
 
-    await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/a/b/relay.js`, {
+      hostPlatform
+    })
 
-    const writes = fileWrites()
-    expect(writes).toHaveLength(3)
-    expect(Buffer.concat(writes.map((write) => write.stdin)).equals(contents)).toBe(true)
-    // Only the first write creates the staging file; the rest must extend it or it is truncated.
-    expect(writes.map(fileMode)).toEqual(['Create', 'Append', 'Append'])
+    expect(sftpBatches).toHaveLength(1)
+    expect(sftpBatches[0]!.script.split('\n').filter(Boolean)).toEqual([
+      '-mkdir "/C:/Users"',
+      '-mkdir "/C:/Users/dev"',
+      '-mkdir "/C:/Users/dev/.orca-remote"',
+      '-mkdir "/C:/Users/dev/.orca-remote/a"',
+      '-mkdir "/C:/Users/dev/.orca-remote/a/b"',
+      expect.stringContaining('put ') as unknown as string
+    ])
+  })
+
+  it('addresses the destination in the drive-rooted namespace sftp exposes', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    // A backslash destination silently writes a file named `C` and still exits 0, so the leading
+    // slash and forward separators are correctness, not style.
+    expect(putDestination(putLines()[0]!)).toMatch(
+      /^\/C:\/Users\/dev\/\.orca-remote\/relay\.js\.orca-partial-[0-9a-f]{12}$/
+    )
+  })
+
+  it('never lands a partial under the real name, and publishes by rename', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+    const remotePath = `${remoteRoot}/relay.js`
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), remotePath, { hostPlatform })
+
+    const destination = putDestination(putLines()[0]!)
+    // Assert the positive first: an unmatched regex yields '', which would satisfy the `not.toBe`
+    // below without this test ever having seen a destination.
+    expect(destination).toContain(WINDOWS_STAGED_WRITE_SUFFIX)
+    expect(destination).not.toBe(`/C:${remotePath.slice(2)}`)
+    const publish = commands.at(-1)!
+    expect(publish.script).toContain(
+      '[System.IO.File]::Replace($staging, $path, [NullString]::Value)'
+    )
+    // The publish reads the staged file, never a pipe, so it is safe on PowerShell 5.1.
+    expect(publish.script).not.toContain('OpenStandardInput')
+  })
+
+  it('never deletes the destination it is replacing', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    const publish = commands.at(-1)!
+    // Delete-then-move destroys the user's existing file outright if the move then fails, and
+    // exposes a window where a reader sees no file at all — worse than the truncated partial the
+    // staging discipline exists to prevent. `File.Replace` is the atomic swap.
+    expect(publish.script).not.toContain('[System.IO.File]::Delete($path)')
+    expect(publish.script).toContain(
+      '[System.IO.File]::Replace($staging, $path, [NullString]::Value)'
+    )
+    // An absent destination cannot be Replaced, so that case falls back to a plain Move.
+    expect(publish.script).toContain(
+      'catch [System.IO.FileNotFoundException] { [System.IO.File]::Move($staging, $path) }'
+    )
+  })
+
+  it('gives every attempt its own staging name, so a retry cannot meet a predecessor lock', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    const [first, second] = putLines().map(putDestination)
+    expect(first).toContain(WINDOWS_STAGED_WRITE_SUFFIX)
+    // Losing contact is not evidence the previous writer died, so the name must not be reused.
+    expect(second).not.toBe(first)
+  })
+
+  it('enforces exclusive at the rename, where it is atomic', async () => {
+    writeFileSync(join(localDir, 'import.bin'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'import.bin'), `${remoteRoot}/import.bin`, {
+      hostPlatform,
+      exclusive: true
+    })
+
+    const publish = commands.at(-1)!
+    expect(publish.script).toContain('[System.IO.File]::Move($staging, $path)')
+    expect(publish.script).not.toContain('[System.IO.File]::Delete($path)')
+  })
+
+  it('appends by concatenating the staged file, not by piping bytes to the remote', async () => {
+    await writeBufferViaSystemSsh(target, `${remoteRoot}/log.bin`, Buffer.from('tail'), {
+      hostPlatform,
+      append: true
+    })
+
+    expect(fileWrites()).toHaveLength(0)
+    const publish = commands.at(-1)!
+    expect(publish.script).toContain('FileMode]::Append')
+    expect(publish.script).toContain('$in.CopyTo($out)')
+    expect(publish.script).toContain('[System.IO.File]::Delete($staging)')
   })
 
   it('still creates an empty artifact on the host', async () => {
@@ -175,80 +338,310 @@ describe('Windows upload stdin framing', () => {
 
     await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
 
-    expect(fileWrites().map(writtenPath)).toEqual([`${remoteRoot}/empty.txt`])
-    expect(fileWrites()[0].stdin).toHaveLength(0)
-    expect(fileMode(fileWrites()[0])).toBe('Create')
+    expect(putLines()).toHaveLength(1)
+    expect(commands.at(-1)!.script).toContain('[System.IO.File]::Move($staging, $path)')
   })
 
-  it('lands a multi-chunk write on a staging path and publishes it by rename', async () => {
-    const remotePath = `${remoteRoot}/relay.js`
-    writeFileSync(join(localDir, 'relay.js'), Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES + 1))
+  it('writes a buffer through a 0600 temp file that does not outlive the transfer', async () => {
+    const seen: { path: string; contents: Buffer; mode: number }[] = []
+    runProcessMock.mockImplementation(async (spec: { args: string[]; input: string }) => {
+      sftpBatches.push({ args: spec.args, script: spec.input })
+      for (const line of spec.input.split('\n').filter((entry) => entry.startsWith('put '))) {
+        const path = putSource(line)
+        seen.push({
+          path,
+          contents: await readFile(path),
+          mode: (await stat(path)).mode & 0o777
+        })
+      }
+      return { code: 0, signal: null, stdout: '', stderr: '', timedOut: false }
+    })
+
+    await writeBufferViaSystemSsh(target, `${remoteRoot}/version`, Buffer.from('1.2.3'), {
+      hostPlatform
+    })
+
+    expect(seen).toHaveLength(1)
+    expect(seen[0]!.contents.toString()).toBe('1.2.3')
+    // The payload can be repository content and tmpdir is world-readable on every platform, so the
+    // window between write and upload must not be group- or world-readable.
+    expect(seen[0]!.mode).toBe(0o600)
+    await expect(readFile(seen[0]!.path)).rejects.toThrow()
+  })
+
+  it('creates upload directories over sftp rather than a PowerShell stdin batch', async () => {
+    mkdirSync(join(localDir, 'node'), { recursive: true })
+    writeFileSync(join(localDir, 'node', 'relay.js'), 'x')
 
     await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
 
-    // Nothing touches the real name until every byte is on the host.
-    expect(fileWrites().map(writtenPath)).toEqual([
-      `${remotePath}${WINDOWS_STAGED_WRITE_SUFFIX}`,
-      `${remotePath}${WINDOWS_STAGED_WRITE_SUFFIX}`
-    ])
-    const publish = commands.at(-1)!
-    expect(publish.script).toContain('[System.IO.File]::Move($staging, $path)')
-    expect(publish.script).toContain('[System.IO.File]::Delete($path)')
+    // Anchor on a non-empty observation: `some` is false of an empty list, so this would pass even
+    // if no command had been recorded at all.
+    expect(commands.length).toBeGreaterThan(0)
+    expect(commands.some((command) => command.script.includes('StreamReader([Console]::'))).toBe(
+      false
+    )
+    expect(sftpBatches[0]!.script).toContain('-mkdir "/C:/Users/dev/.orca-remote"')
+  })
+
+  it('sweeps the staged bytes when the publish is the thing that fails', async () => {
+    writeFileSync(join(localDir, 'import.bin'), 'x')
+    // An exclusive conflict is the ordinary way to get here: the payload is on the host, and the
+    // rename that would have given it a name refuses.
+    spawnSystemSshCommandMock.mockImplementation((_target: SshTarget, command: string) => {
+      const script = decodePowerShellCommand(command)
+      return createFakeChannel((channel) => {
+        commands.push({ script, executable: command.split(' ')[0] ?? '', stdin: channel.written })
+        const failed = script.includes('::Move($staging, $path)')
+        setImmediate(() => channel.emit('close', failed ? 1 : 0, null))
+      })
+    })
+
+    await expect(
+      uploadFileViaSystemSsh(target, join(localDir, 'import.bin'), `${remoteRoot}/import.bin`, {
+        hostPlatform,
+        exclusive: true
+      })
+    ).rejects.toThrow()
+
+    const sweep = commands.at(-1)!
+    expect(sweep.script).toContain('[System.IO.File]::Delete($staging)')
+    // Tolerated, not asserted: the previous writer may still hold the file, and losing contact is
+    // not evidence it died.
+    expect(sweep.script).toContain('$ErrorActionPreference = "SilentlyContinue"')
+  })
+
+  it('reports a cancelled transfer as an abort, not as a failed one', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+    const controller = new AbortController()
+    // runProcess reports the kill as a non-zero exit rather than throwing, so without checking the
+    // signal first a user pressing cancel is indistinguishable from the transfer genuinely failing.
+    runProcessMock.mockImplementation(async (spec: { args: string[]; input: string }) => {
+      sftpBatches.push({ args: spec.args, script: spec.input })
+      controller.abort()
+      return { code: 255, signal: 'SIGTERM', stdout: '', stderr: '', timedOut: false }
+    })
+
+    let error: Error | undefined
+    try {
+      await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+        hostPlatform,
+        signal: controller.signal
+      })
+    } catch (thrown) {
+      error = thrown as Error
+    }
+
+    expect(error?.name).toBe('AbortError')
+    expect(error?.message).not.toContain('sftp batch failed')
+    // A cancel is also not evidence about the host, so it must not send later writes to the slow
+    // path, and must not fall through to the defective reader now.
+    expect(getWindowsRemoteWriteCapabilities(target).shouldTry('sftp-subsystem')).toBe(true)
+    expect(fileWrites()).toHaveLength(0)
+  })
+
+  it('does not let one unaddressable path become a verdict about the host', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    // A UNC destination has no settled mapping in sftp's drive-rooted namespace, so this write
+    // falls back — but the host still serves sftp perfectly well for every other path.
+    await uploadFileViaSystemSsh(
+      target,
+      join(localDir, 'relay.js'),
+      '//fileserver/share/relay.js',
+      { hostPlatform }
+    )
+
+    expect(fileWrites().length).toBeGreaterThan(0)
+    expect(sftpBatches).toHaveLength(0)
+    // The 30-minute capability cache is keyed by host; caching this would send every later write
+    // to the same machine down the defective path on the strength of one odd destination.
+    expect(getWindowsRemoteWriteCapabilities(target).shouldTry('sftp-subsystem')).toBe(true)
+  })
+
+  it('keeps using sftp for the next file after one path it could not spell', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), '//fileserver/share/a.js', {
+      hostPlatform
+    })
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/b.js`, {
+      hostPlatform
+    })
+
+    expect(putLines()).toHaveLength(1)
+    expect(putDestination(putLines()[0]!)).toContain('/C:/Users/dev/.orca-remote/b.js')
+  })
+
+  it('does not let a local filename sftp cannot quote become a verdict either', async () => {
+    // POSIX clients allow a newline in a filename, and sftp's batch lexer would read it as the end
+    // of one command and the start of another.
+    const awkward = join(localDir, 'two\nlines.js')
+    writeFileSync(awkward, 'x')
+
+    await uploadFileViaSystemSsh(target, awkward, `${remoteRoot}/relay.js`, { hostPlatform })
+
+    expect(fileWrites().length).toBeGreaterThan(0)
+    expect(getWindowsRemoteWriteCapabilities(target).shouldTry('sftp-subsystem')).toBe(true)
+  })
+
+  it('translates the ssh argument list rather than passing it to a client that reads it differently', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform,
+      disableControlMaster: true
+    })
+
+    const args = sftpBatches[0]!.args
+    // sftp's `-T` does not exist, its `-p` preserves mtime, and its `-S` names a program to run.
+    expect(args).not.toContain('-T')
+    expect(args).not.toContain('-p')
+    expect(args).not.toContain('-S')
+    expect(args).toContain('ControlPath=none')
+    expect(args).toContain('ServerAliveInterval=15')
+  })
+})
+
+describe('Windows upload on a host with no sftp subsystem', () => {
+  beforeEach(() => {
+    refuseSftp()
+  })
+
+  it('creates a multi-directory tree, which the one-element case never exercised', async () => {
+    mkdirSync(join(localDir, 'node', 'deep'), { recursive: true })
+    writeFileSync(join(localDir, 'index.js'), 'a')
+    writeFileSync(join(localDir, 'node', 'deep', 'x.js'), 'b')
+
+    await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
+
+    const mkdir = commands.find((command) => command.script.includes('ConvertFrom-Json'))!
+    // `@($json | ConvertFrom-Json)` wraps the parsed array in another array, so the loop variable
+    // binds to the whole thing and `[string]` of it is the paths joined by spaces — which
+    // CreateDirectory rejects. It only ever worked for a single directory, where stringifying a
+    // one-element array happens to yield the element, so no batch of one can catch this.
+    expect(mkdir.script).toContain('[string[]]($json | ConvertFrom-Json)')
+    expect(mkdir.script).not.toContain('@($json | ConvertFrom-Json)')
+    const batch = JSON.parse(mkdir.stdin.toString('utf-8')) as string[]
+    expect(batch.length).toBeGreaterThan(1)
+  })
+
+  it('falls back rather than failing the transfer', async () => {
+    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES + 5, 0x61)
+    writeFileSync(join(localDir, 'relay.js'), contents)
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    expect(Buffer.concat(fileWrites().map((write) => write.stdin)).equals(contents)).toBe(true)
+  })
+
+  it('remembers the refusal, so a multi-file upload probes once', async () => {
+    writeFileSync(join(localDir, 'a.js'), 'a')
+    writeFileSync(join(localDir, 'b.js'), 'b')
+    writeFileSync(join(localDir, 'c.js'), 'c')
+
+    await uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
+
+    // One refusal is enough; re-probing per file is a wasted round trip on every file.
+    expect(sftpBatches).toHaveLength(1)
+  })
+
+  it('does not spend a sweep round trip when sftp declined before moving any bytes', async () => {
+    writeFileSync(join(localDir, 'relay.js'), 'x')
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    // A refused subsystem staged nothing, so there is nothing to delete — and on a host without
+    // sftp that sweep would otherwise be paid on every single write.
+    expect(commands.length).toBeGreaterThan(0)
+    expect(commands.some((command) => command.script.includes('Delete($staging)'))).toBe(false)
+  })
+
+  it('prefers PowerShell 7, which reads a redirected stdin correctly', async () => {
+    writeFileSync(join(localDir, 'relay.js'), Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3))
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+      hostPlatform
+    })
+
+    expect(fileWrites().map((write) => write.executable)).toEqual(['pwsh.exe'])
+    // PowerShell 7 took 2MB through one exec when measured, so chunking it buys nothing.
+    expect(fileWrites()[0]!.stdin).toHaveLength(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3)
+  })
+
+  it('bounds every write when only Windows PowerShell 5.1 is available', async () => {
+    refusePwsh()
+    const contents = Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3 + 11, 0x64)
+    writeFileSync(join(localDir, 'big.node'), contents)
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'big.node'), `${remoteRoot}/big.node`, {
+      hostPlatform
+    })
+
+    const writes = fileWrites().filter((write) => write.executable === 'powershell.exe')
+    expect(writes).toHaveLength(4)
+    expect(Math.max(...writes.map((write) => write.stdin.length))).toBe(
+      WINDOWS_STDIN_WRITE_CHUNK_BYTES
+    )
+    expect(Buffer.concat(writes.map((write) => write.stdin)).equals(contents)).toBe(true)
+    expect(writes.map(fileMode)).toEqual(['Create', 'Append', 'Append', 'Append'])
+    // A wedged PowerShell never closes on its own, so no wait on this path may be unbounded.
+    // Count first: `every` is true of zero calls, so a wait that moved to a different helper would
+    // pass this silently.
+    expect(waitForChannelCloseSpy.mock.calls.length).toBeGreaterThan(0)
+    expect(
+      waitForChannelCloseSpy.mock.calls.every((call) => call[2] === WINDOWS_STDIN_WRITE_TIMEOUT_MS)
+    ).toBe(true)
+  })
+
+  it('remembers that PowerShell 7 is absent instead of re-probing per chunk', async () => {
+    refusePwsh()
+    writeFileSync(join(localDir, 'big.node'), Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3))
+
+    await uploadFileViaSystemSsh(target, join(localDir, 'big.node'), `${remoteRoot}/big.node`, {
+      hostPlatform
+    })
+
+    expect(fileWrites().filter((write) => write.executable === 'pwsh.exe')).toHaveLength(1)
   })
 
   it('leaves no truncated file under the real name when a chunk fails mid-file', async () => {
     writeFileSync(join(localDir, 'relay.js'), Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES * 3))
-    // Spawns: 0 = mkdir batch, 1..3 = chunk writes. Fail the second chunk.
-    failAtSpawn = 2
+    // Spawn 0 is the pwsh write; fail it and every retry beneath it.
+    failAtSpawn = 0
 
     await expect(
-      uploadDirectoryViaSystemSsh(target, localDir, remoteRoot, { hostPlatform })
+      uploadFileViaSystemSsh(target, join(localDir, 'relay.js'), `${remoteRoot}/relay.js`, {
+        hostPlatform
+      })
     ).rejects.toThrow()
 
+    expect(fileWrites().length).toBeGreaterThan(0)
     expect(fileWrites().map(writtenPath)).not.toContain(`${remoteRoot}/relay.js`)
     expect(commands.some((command) => command.script.includes('::Move('))).toBe(false)
   })
+})
 
-  it('enforces exclusive once at the rename, so a retry is not blocked by its own leftovers', async () => {
-    const localPath = join(localDir, 'import.bin')
-    writeFileSync(localPath, Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES + 1))
+describe('last-resort Windows PowerShell failure reporting', () => {
+  it('names the host limitation and its remedy, not just the timeout', () => {
+    const timeout = new Error('write C:/x at offset 0 timed out after 60000ms with no response')
 
-    await uploadFileViaSystemSsh(target, localPath, `${remoteRoot}/import.bin`, {
-      hostPlatform,
-      exclusive: true
-    })
+    const explained = explainWindowsPowerShellStdinFailure(timeout) as Error
 
-    // CreateNew on chunk one would fail against a leftover staging file from a failed attempt;
-    // `File::Move` raising on an existing destination is what carries the exclusive contract.
-    expect(fileWrites().map(fileMode)).toEqual(['Create', 'Append'])
-    const publish = commands.at(-1)!
-    expect(publish.script).toContain('[System.IO.File]::Move($staging, $path)')
-    expect(publish.script).not.toContain('[System.IO.File]::Delete($path)')
+    // "timed out" alone sends the user to retry a network they cannot fix; the fix is host-side.
+    expect(explained.message).toContain('Windows PowerShell 5.1')
+    expect(explained.message).toContain('Subsystem sftp sftp-server.exe')
+    expect(explained.cause).toBe(timeout)
   })
 
-  it('keeps a single-chunk write on the destination, with the caller mode intact', async () => {
-    await writeBufferViaSystemSsh(target, `${remoteRoot}/version`, Buffer.from('1.2.3'), {
-      hostPlatform,
-      exclusive: true
-    })
+  it('leaves a real failure alone, so a permission error is not reported as a host limitation', () => {
+    const denied = new Error('write C:/x at offset 0 failed (exit 1): Access to the path is denied')
 
-    expect(fileWrites()).toHaveLength(1)
-    expect(writtenPath(fileWrites()[0])).toBe(`${remoteRoot}/version`)
-    expect(fileMode(fileWrites()[0])).toBe('CreateNew')
-    expect(commands.some((command) => command.script.includes('::Move('))).toBe(false)
-  })
-
-  it('appends onto the destination rather than staging, since append cannot be staged', async () => {
-    const remotePath = `${remoteRoot}/log.bin`
-    await writeBufferViaSystemSsh(
-      target,
-      remotePath,
-      Buffer.alloc(WINDOWS_STDIN_WRITE_CHUNK_BYTES + 1),
-      { hostPlatform, append: true }
-    )
-
-    expect(fileWrites().map(writtenPath)).toEqual([remotePath, remotePath])
-    expect(fileWrites().map(fileMode)).toEqual(['Append', 'Append'])
+    expect(explainWindowsPowerShellStdinFailure(denied)).toBe(denied)
   })
 })
 
diff --git a/src/main/ssh/system-ssh-windows-write-capabilities.test.ts b/src/main/ssh/system-ssh-windows-write-capabilities.test.ts
new file mode 100644
index 00000000000..ad723d592b0
--- /dev/null
+++ b/src/main/ssh/system-ssh-windows-write-capabilities.test.ts
@@ -0,0 +1,79 @@
+/**
+ * Whether a Windows host has an sftp subsystem is a fact about that host, so the cache is keyed by
+ * the endpoint that executes rather than by Orca's target id — otherwise a hardened host is
+ * re-probed once per file, and two targets pointing at one machine learn the same fact twice.
+ */
+import { afterEach, describe, expect, it } from 'vitest'
+import type { SshTarget } from '../../shared/ssh-types'
+import {
+  clearWindowsRemoteWriteCapabilitiesForTests,
+  getWindowsRemoteWriteCapabilities,
+  getWindowsRemoteWriteExecutionHostKey
+} from './system-ssh-windows-write-capabilities'
+
+const asTarget = (fields: Partial<SshTarget>): SshTarget => fields as SshTarget
+
+afterEach(() => {
+  clearWindowsRemoteWriteCapabilitiesForTests()
+})
+
+describe('getWindowsRemoteWriteExecutionHostKey', () => {
+  it('gives two targets on one endpoint the same key', () => {
+    const first = asTarget({ id: 'a', host: 'win.example', username: 'dev', port: 22 })
+    const second = asTarget({ id: 'b', host: 'win.example', username: 'dev', port: 22 })
+
+    // A target re-created under a new id has not changed what the host supports.
+    expect(getWindowsRemoteWriteExecutionHostKey(first)).toBe(
+      getWindowsRemoteWriteExecutionHostKey(second)
+    )
+  })
+
+  it('separates hosts, ports and users', () => {
+    const base = { id: 'a', host: 'win.example', username: 'dev', port: 22 }
+    const keys = [
+      asTarget(base),
+      asTarget({ ...base, host: 'other.example' }),
+      asTarget({ ...base, port: 2222 }),
+      asTarget({ ...base, username: 'ops' })
+    ].map(getWindowsRemoteWriteExecutionHostKey)
+
+    expect(new Set(keys).size).toBe(4)
+  })
+
+  it('keys a config alias by the alias, since ssh_config decides where it lands', () => {
+    const alias = asTarget({ id: 'a', host: 'stale.example', configHost: 'winbox' })
+
+    expect(getWindowsRemoteWriteExecutionHostKey(alias)).toBe('config:winbox')
+  })
+})
+
+describe('getWindowsRemoteWriteCapabilities', () => {
+  it('shares one cache across targets that reach the same host', () => {
+    const first = asTarget({ id: 'a', host: 'win.example', username: 'dev', port: 22 })
+    const second = asTarget({ id: 'b', host: 'win.example', username: 'dev', port: 22 })
+
+    getWindowsRemoteWriteCapabilities(first).rememberUnsupported('sftp-subsystem')
+
+    expect(getWindowsRemoteWriteCapabilities(second).shouldTry('sftp-subsystem')).toBe(false)
+  })
+
+  it('does not let one host answer for another', () => {
+    const hardened = asTarget({ id: 'a', host: 'hardened.example', username: 'dev', port: 22 })
+    const ordinary = asTarget({ id: 'b', host: 'ordinary.example', username: 'dev', port: 22 })
+
+    getWindowsRemoteWriteCapabilities(hardened).rememberUnsupported('sftp-subsystem')
+
+    expect(getWindowsRemoteWriteCapabilities(ordinary).shouldTry('sftp-subsystem')).toBe(true)
+  })
+
+  it('keeps the two capabilities independent', () => {
+    const target = asTarget({ id: 'a', host: 'win.example', username: 'dev', port: 22 })
+    const capabilities = getWindowsRemoteWriteCapabilities(target)
+
+    capabilities.rememberUnsupported('pwsh')
+
+    // No PowerShell 7 says nothing about whether the host will serve sftp.
+    expect(capabilities.shouldTry('sftp-subsystem')).toBe(true)
+    expect(capabilities.shouldTry('pwsh')).toBe(false)
+  })
+})
diff --git a/src/main/ssh/system-ssh-windows-write-capabilities.ts b/src/main/ssh/system-ssh-windows-write-capabilities.ts
new file mode 100644
index 00000000000..dcd03f19807
--- /dev/null
+++ b/src/main/ssh/system-ssh-windows-write-capabilities.ts
@@ -0,0 +1,52 @@
+import type { SshTarget } from '../../shared/ssh-types'
+import { CapabilityProbeCache } from '../../shared/capability-probe-cache'
+
+/**
+ * Whether a Windows host can take a file write over the sftp subsystem, and whether it has a
+ * PowerShell 7 to fall back to. Both are host facts, so they are cached per execution host rather
+ * than per transfer — a hardened host with `Subsystem sftp` removed must not be re-probed on every
+ * file of a multi-file upload.
+ */
+export type WindowsRemoteWriteCapability = 'sftp-subsystem' | 'pwsh'
+
+// Why re-probe at all: an admin can enable the subsystem, or install PowerShell 7, without the
+// user restarting Orca. Long enough that a hardened host costs one failed probe per half hour.
+export const WINDOWS_WRITE_CAPABILITY_RETRY_INTERVAL_MS = 30 * 60_000
+
+const capabilitiesByExecutionHost = new Map<
+  string,
+  CapabilityProbeCache<WindowsRemoteWriteCapability>
+>()
+
+/**
+ * Keyed by the endpoint that executes, not by target id: two Orca targets pointing at one host
+ * describe the same sshd, and a target re-created under a new id has not changed what that host
+ * supports. A config alias is its own key because ssh_config, not Orca, resolves where it lands.
+ */
+export function getWindowsRemoteWriteExecutionHostKey(target: SshTarget): string {
+  if (target.configHost) {
+    return `config:${target.configHost}`
+  }
+  const port = target.port ?? 22
+  return target.username
+    ? `host:${target.username}@${target.host}:${port}`
+    : `host:${target.host}:${port}`
+}
+
+export function getWindowsRemoteWriteCapabilities(
+  target: SshTarget
+): CapabilityProbeCache<WindowsRemoteWriteCapability> {
+  const key = getWindowsRemoteWriteExecutionHostKey(target)
+  let cache = capabilitiesByExecutionHost.get(key)
+  if (!cache) {
+    cache = new CapabilityProbeCache<WindowsRemoteWriteCapability>(
+      WINDOWS_WRITE_CAPABILITY_RETRY_INTERVAL_MS
+    )
+    capabilitiesByExecutionHost.set(key, cache)
+  }
+  return cache
+}
+
+export function clearWindowsRemoteWriteCapabilitiesForTests(): void {
+  capabilitiesByExecutionHost.clear()
+}
diff --git a/src/main/ssh/system-ssh-windows-write-strategy.ts b/src/main/ssh/system-ssh-windows-write-strategy.ts
new file mode 100644
index 00000000000..f2cdca12516
--- /dev/null
+++ b/src/main/ssh/system-ssh-windows-write-strategy.ts
@@ -0,0 +1,329 @@
+import type { SshTarget } from '../../shared/ssh-types'
+import { getSystemSshBuildArgsFromOperationOptions } from './system-ssh-args'
+import { spawnSystemSshCommand } from './system-ssh-command'
+import {
+  awaitWithSystemSshAbort,
+  throwIfAborted,
+  waitForChannelClose
+} from './system-ssh-operation-lifecycle'
+import {
+  isSftpPathUnsupportedError,
+  isSftpRefusalBeforeStaging,
+  isSftpUnavailableError,
+  runSftpBatch
+} from './system-ssh-sftp-transfer'
+import { quoteSftpBatchArgument, toSftpRemotePath } from './system-ssh-sftp-path'
+import { getWindowsRemoteWriteCapabilities } from './system-ssh-windows-write-capabilities'
+import {
+  makeWindowsDiscardStagedFileCommand,
+  makeWindowsPublishStagedFileCommand,
+  makeWindowsStagingPath,
+  makeWindowsWriteFileCommand,
+  windowsRemoteAncestorDirectories,
+  type WindowsPublishMode
+} from './system-ssh-windows-file-write'
+
+/** No Windows stdin write should ever outlive this; a wedged PowerShell never closes on its own. */
+export const WINDOWS_STDIN_WRITE_TIMEOUT_MS = 60_000
+
+/**
+ * Bound on one stdin write for the last-resort Windows PowerShell 5.1 path.
+ *
+ * Measured on Windows 11 26200 / OpenSSH 10.0p2: a 32KB write still hangs 15 times in 120 under
+ * load, and no smaller value removes the risk. The defect is per blocking read, not per byte, so
+ * shrinking the chunk trades one risky read for more execs that each carry their own. This is a
+ * damage bound on a path known to be unreliable, not a safe size.
+ */
+export const WINDOWS_STDIN_WRITE_CHUNK_BYTES = 32 * 1024
+
+export type WindowsWriteOptions = Parameters<
+  typeof getSystemSshBuildArgsFromOperationOptions
+>[0] & {
+  signal?: AbortSignal
+  append?: boolean
+  exclusive?: boolean
+}
+
+/** Bytes to write, plus a way to present them to sftp, which can only send a local file. */
+export type WindowsWriteSource = {
+  totalBytes: number
+  readChunk: (offset: number, maxBytes: number) => Promise<Buffer>
+  withLocalFile: <T>(send: (localPath: string) => Promise<T>) => Promise<T>
+}
+
+function publishMode(options: WindowsWriteOptions): WindowsPublishMode {
+  return options.append ? 'append' : options.exclusive === true ? 'exclusive' : 'create'
+}
+
+/**
+ * Writes one file to a Windows host, preferring transports that do not push bytes through a remote
+ * PowerShell's stdin.
+ *
+ * Order, and why: sftp carries the whole payload in one transfer and never has a remote process
+ * read a pipe. Measured on Windows 11 / OpenSSH 10.0p2: 1.9MB in a median 315ms over sftp against
+ * 0 of 6 completions on the chunked path, whose best case was ~62 execs at ~350ms each. PowerShell
+ * 7 reads a redirected stdin correctly but is not installed by default. Windows PowerShell 5.1 is
+ * always present and is the defective reader, so it is last and it is bounded.
+ *
+ * Every transport stages under a unique name and publishes by rename, so no partial write is ever
+ * visible under the real name and no retry inherits a predecessor's lock.
+ */
+export async function writeWindowsRemoteFile(
+  target: SshTarget,
+  remotePath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions
+): Promise<void> {
+  throwIfAborted(options.signal)
+  const capabilities = getWindowsRemoteWriteCapabilities(target)
+  await capabilities.runWithFallback(
+    'sftp-subsystem',
+    () => writeViaSftp(target, remotePath, source, options),
+    () => writeViaRemoteStdin(target, remotePath, source, options),
+    isSftpUnavailableError
+  )
+}
+
+/**
+ * Stages under a name nothing else can own, publishes it, and sweeps the staging file if either
+ * step fails.
+ *
+ * Shared by both transports so the cleanup contract cannot drift between them: a failed publish —
+ * an exclusive conflict is the ordinary case — leaves bytes on the host that no longer have a
+ * purpose, and the sweep is what stops them accumulating.
+ */
+async function stageThenPublish(
+  target: SshTarget,
+  remotePath: string,
+  options: WindowsWriteOptions,
+  stage: (stagingPath: string) => Promise<void>,
+  nothingStaged: (error: unknown) => boolean = () => false
+): Promise<void> {
+  const stagingPath = makeWindowsStagingPath(remotePath)
+  try {
+    await stage(stagingPath)
+    await publishStagedWrite(target, stagingPath, remotePath, options)
+  } catch (error) {
+    // A transport that declined before it moved any bytes has nothing to sweep, and sweeping
+    // anyway would spend a round trip on every write to a host that has no sftp subsystem.
+    if (!nothingStaged(error)) {
+      await discardStagedWrite(target, stagingPath, options)
+    }
+    throw error
+  }
+}
+
+/**
+ * A path sftp cannot address falls back for this write alone, without touching the host verdict.
+ *
+ * The distinction matters because the capability cache is keyed by host and holds for half an hour:
+ * routing one UNC destination, or one local filename containing a newline, into
+ * `rememberUnsupported` would send every later write to that host down the defective path too.
+ */
+async function writeViaSftp(
+  target: SshTarget,
+  remotePath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions
+): Promise<void> {
+  try {
+    await attemptSftpWrite(target, remotePath, source, options)
+  } catch (error) {
+    if (!isSftpPathUnsupportedError(error)) {
+      throw error
+    }
+    await writeViaRemoteStdin(target, remotePath, source, options)
+  }
+}
+
+function attemptSftpWrite(
+  target: SshTarget,
+  remotePath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions
+): Promise<void> {
+  const mkdirs = windowsRemoteAncestorDirectories(remotePath).map(
+    (directory) => `-mkdir ${quoteSftpBatchArgument(toSftpRemotePath(directory))}`
+  )
+  return stageThenPublish(
+    target,
+    remotePath,
+    options,
+    (stagingPath) =>
+      source.withLocalFile((localPath) =>
+        // One round trip: the parent chain and the payload travel in the same batch.
+        runSftpBatch(
+          target,
+          [
+            ...mkdirs,
+            `put ${quoteSftpBatchArgument(localPath)} ${quoteSftpBatchArgument(toSftpRemotePath(stagingPath))}`
+          ],
+          options
+        )
+      ),
+    isSftpRefusalBeforeStaging
+  )
+}
+
+function writeViaRemoteStdin(
+  target: SshTarget,
+  remotePath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions
+): Promise<void> {
+  const capabilities = getWindowsRemoteWriteCapabilities(target)
+  return stageThenPublish(target, remotePath, options, (stagingPath) =>
+    capabilities.runWithFallback(
+      'pwsh',
+      () => writeStdinChunks(target, stagingPath, source, options, 'pwsh.exe'),
+      () => writeStdinChunks(target, stagingPath, source, options, 'powershell.exe'),
+      isPwshUnavailableError
+    )
+  )
+}
+
+/**
+ * PowerShell 7 takes the whole payload in one exec — measured at 2MB — so only the 5.1 path pays
+ * for chunking, and only because a bounded write is the most that path can be trusted with.
+ */
+async function writeStdinChunks(
+  target: SshTarget,
+  stagingPath: string,
+  source: WindowsWriteSource,
+  options: WindowsWriteOptions,
+  executable: 'powershell.exe' | 'pwsh.exe'
+): Promise<void> {
+  const chunkBytes =
+    executable === 'pwsh.exe' ? Math.max(source.totalBytes, 1) : WINDOWS_STDIN_WRITE_CHUNK_BYTES
+  let offset = 0
+  // An empty write still has to run: it is what creates the staged file.
+  do {
+    const chunk = await source.readChunk(offset, chunkBytes)
+    if (chunk.length === 0 && offset < source.totalBytes) {
+      throw new Error(`Source ran short during upload of ${stagingPath}`)
+    }
+    await writeOneStdinChunk(
+      target,
+      stagingPath,
+      chunk,
+      { ...options, append: offset > 0, exclusive: false },
+      offset,
+      executable
+    )
+    offset += chunk.length
+  } while (offset < source.totalBytes)
+}
+
+async function writeOneStdinChunk(
+  target: SshTarget,
+  stagingPath: string,
+  chunk: Buffer,
+  options: WindowsWriteOptions,
+  offset: number,
+  executable: 'powershell.exe' | 'pwsh.exe'
+): Promise<void> {
+  throwIfAborted(options.signal)
+  const channel = spawnSystemSshCommand(
+    target,
+    makeWindowsWriteFileCommand(stagingPath, {
+      append: options.append,
+      exclusive: options.exclusive,
+      executable
+    }),
+    { wrapCommand: false, ...getSystemSshBuildArgsFromOperationOptions(options) }
+  )
+  const closePromise = awaitWithSystemSshAbort(
+    options.signal,
+    () => channel.close(),
+    waitForChannelClose(
+      channel,
+      `write ${stagingPath} at offset ${offset}`,
+      WINDOWS_STDIN_WRITE_TIMEOUT_MS
+    )
+  ).catch((error: unknown) => {
+    throw executable === 'powershell.exe' ? explainWindowsPowerShellStdinFailure(error) : error
+  })
+  if (!options.signal?.aborted) {
+    channel.stdin.end(chunk)
+  }
+  await closePromise
+}
+
+/**
+ * Names the cause on the one path that can hang, so the failure is not just "timed out".
+ *
+ * A user seeing this needs to know it is a host limitation with a host-side remedy, not a network
+ * fault they should retry into.
+ */
+export function explainWindowsPowerShellStdinFailure(error: unknown): unknown {
+  const message = error instanceof Error ? error.message : String(error)
+  if (!/timed out/i.test(message)) {
+    return error
+  }
+  return new Error(
+    `${message}\nWindows PowerShell 5.1 can lose a redirected stdin permanently when a read finds it momentarily empty, so this write cannot be made reliable from the client. Enable the sftp subsystem on the host (sshd_config: "Subsystem sftp sftp-server.exe"), or install PowerShell 7, and Orca will use it automatically.`,
+    { cause: error instanceof Error ? error : undefined }
+  )
+}
+
+function isPwshUnavailableError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error)
+  // cmd.exe's "not recognized" and sshd's exit 9009 both mean "no pwsh here". A timeout does not:
+  // that is the stdin defect, and PowerShell 7 does not have it, so it must not be cached as absent.
+  return /is not recognized as an internal or external command|9009|CommandNotFoundException/i.test(
+    message
+  )
+}
+
+async function publishStagedWrite(
+  target: SshTarget,
+  stagingPath: string,
+  remotePath: string,
+  options: WindowsWriteOptions
+): Promise<void> {
+  await runWindowsCommandWithoutStdin(
+    target,
+    makeWindowsPublishStagedFileCommand(stagingPath, remotePath, publishMode(options)),
+    `publish ${remotePath}`,
+    options
+  )
+}
+
+async function discardStagedWrite(
+  target: SshTarget,
+  stagingPath: string,
+  options: WindowsWriteOptions
+): Promise<void> {
+  try {
+    await runWindowsCommandWithoutStdin(
+      target,
+      makeWindowsDiscardStagedFileCommand(stagingPath),
+      `discard ${stagingPath}`,
+      { ...options, signal: undefined }
+    )
+  } catch {
+    // Housekeeping only. The staging name is unique, so a leftover blocks nothing, and a failure
+    // here says nothing about whether the abandoned writer is still alive.
+  }
+}
+
+function runWindowsCommandWithoutStdin(
+  target: SshTarget,
+  command: string,
+  label: string,
+  options: WindowsWriteOptions
+): Promise<void> {
+  const channel = spawnSystemSshCommand(target, command, {
+    wrapCommand: false,
+    ...getSystemSshBuildArgsFromOperationOptions(options)
+  })
+  const closePromise = awaitWithSystemSshAbort(
+    options.signal,
+    () => channel.close(),
+    waitForChannelClose(channel, label, WINDOWS_STDIN_WRITE_TIMEOUT_MS)
+  )
+  if (!options.signal?.aborted) {
+    channel.stdin.end()
+  }
+  return closePromise
+}

From 7b108abf710d21069691554da8bb4e7d3e2c805a Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 04:34:22 -0400
Subject: [PATCH 12/58] fix(relay): stop taking the fleet-wide cell inventory
 lock on per-connection paths (#18606)

* fix(relay): stop taking the fleet-wide cell inventory lock on per-connection paths

activateControl, acquireActivity, changeActivity and
removeSupersededSameCellControls each adjust exactly one cell's
reservation, yet took SELECT * FROM relay_cells FOR UPDATE, so every
desktop rebind and phone reconnect in the fleet queued behind every
other one and behind placement. They now use the single-row atomic
update (or lock only their own cell row), leaving the inventory lock to
placement and sweeps.

Fleet-wide 55P03 retries ran p50 430 / p99 1320 per five minutes on
2026-09-03, every cell pinned sqlLatencyMsMax at the lock timeout, and
the old cell image crashed on the resulting pool timeouts ~every 15
minutes. A real-Postgres test holds another cell's row and asserts a
rebind proceeds; re-adding the inventory lock fails it.

* fix(relay): lock the touched cell rows in order on cross-cell activity moves

Review found that acquireActivity's existing-lease branch could lock the
old lease's cell row (via removeActivityLease) before the new cell's row,
which cycles with placement's ascending inventory lock; reproduced on
real Postgres as paired 55P03 retries. lockCellRows now takes the one or
two rows a per-connection path touches in cell_id order with the 500 ms
request bound, and the census fails on any inline relay_cells FOR UPDATE
outside the named lock helpers. A three-cell Postgres test moves an
activity from the highest cell to a lower one while the target row is
held and asserts the mover holds nothing else; five revert-mutants
(inventory lock on each path, dropped ordering, dropped ORDER BY) fail it.

* test(relay): make the inline relay_cells lock census scan whole statements

Review showed two evasions: a FOR UPDATE inside query() and a queryLocked
whose FROM relay_cells sat past a fixed line window. The guard now matches
every query()/queryLocked() template statement in full; both evasions
fail it. Also clears relay_cell_connection_snapshots in the connection-
headroom Postgres suite so an aborted run does not poison the next.
---
 ...nment-connection-headroom-postgres.test.ts |   6 +
 ...ment-control-supersession-postgres.test.ts |   4 +
 cloud/apps/relay/src/assignment-store.ts      |  32 ++-
 .../src/cell-inventory-lock-census.test.ts    |  73 ++++-
 ...rol-rebind-inventory-lock-postgres.test.ts | 260 ++++++++++++++++++
 5 files changed, 361 insertions(+), 14 deletions(-)
 create mode 100644 cloud/apps/relay/src/control-rebind-inventory-lock-postgres.test.ts

diff --git a/cloud/apps/relay/src/assignment-connection-headroom-postgres.test.ts b/cloud/apps/relay/src/assignment-connection-headroom-postgres.test.ts
index 6ac9521c3d6..80a74a47eeb 100644
--- a/cloud/apps/relay/src/assignment-connection-headroom-postgres.test.ts
+++ b/cloud/apps/relay/src/assignment-connection-headroom-postgres.test.ts
@@ -44,6 +44,12 @@ describePostgres('PostgreSQL assignment connection headroom', () => {
         `DELETE FROM relay_assignments
          WHERE user_id LIKE 'connection-headroom-postgres-%'`
       )
+      // A snapshot left by an aborted run rejects the replayed watermark
+      // with stale_connection_snapshot.
+      await database.query(
+        `DELETE FROM relay_cell_connection_snapshots WHERE cell_id = ?`,
+        [cell.id]
+      )
       await database.query(
         `DELETE FROM relay_cell_connection_runtime WHERE cell_id = ?`,
         [cell.id]
diff --git a/cloud/apps/relay/src/assignment-control-supersession-postgres.test.ts b/cloud/apps/relay/src/assignment-control-supersession-postgres.test.ts
index 10193b78cc6..cf8819686b5 100644
--- a/cloud/apps/relay/src/assignment-control-supersession-postgres.test.ts
+++ b/cloud/apps/relay/src/assignment-control-supersession-postgres.test.ts
@@ -38,6 +38,10 @@ describePostgres('PostgreSQL control supersession', () => {
         [identity.userId]
       )
       await database.query(`DELETE FROM relay_assignments WHERE user_id = ?`, [identity.userId])
+      // A snapshot left by an aborted run rejects the replayed watermark with stale_connection_snapshot.
+      await database.query(`DELETE FROM relay_cell_connection_snapshots WHERE cell_id = ?`, [
+        cell.id
+      ])
       await database.query(`DELETE FROM relay_cell_connection_runtime WHERE cell_id = ?`, [cell.id])
       await database.query(`DELETE FROM relay_cell_connection_limits WHERE cell_id = ?`, [cell.id])
       await database.query(`DELETE FROM relay_cell_runtime WHERE cell_id = ?`, [cell.id])
diff --git a/cloud/apps/relay/src/assignment-store.ts b/cloud/apps/relay/src/assignment-store.ts
index d0517d46746..9d240e304a7 100644
--- a/cloud/apps/relay/src/assignment-store.ts
+++ b/cloud/apps/relay/src/assignment-store.ts
@@ -3202,8 +3202,7 @@ export class RelayAssignmentStore {
         )
         const requestDelta = ACTIVITY_REQUEST_UNITS[kind] * (after - before)
         if (requestDelta !== 0) {
-          await this.lockCellInventory(transaction, 'request')
-          await this.adjustCellReservation(transaction, text(row, 'cell_id'), requestDelta)
+          await this.adjustCellReservationAtomically(transaction, text(row, 'cell_id'), requestDelta)
         }
       })
     })
@@ -3263,9 +3262,12 @@ export class RelayAssignmentStore {
         }
         const units = ACTIVITY_REQUEST_UNITS[input.kind]
         if (existing) {
-          await this.lockCellInventory(transaction, 'request')
+          // Why: a client-chosen activity id can move between cells, so lock the
+          // one or two rows this path touches in cell_id order, the same order
+          // placement takes the inventory in, and no cycle can form.
+          await this.lockCellRows(transaction, [text(existing, 'cell_id'), input.cellId])
           await this.removeActivityLease(transaction, identity, existing, now)
-          await this.adjustCellReservation(transaction, input.cellId, units)
+          await this.adjustCellReservationAtomically(transaction, input.cellId, units)
         }
         await this.adjustActivityCount(transaction, identity, input.kind, 1, expiresAt, now)
         await transaction.query(
@@ -3580,8 +3582,7 @@ export class RelayAssignmentStore {
             )
             await this.touchAssignment(transaction, identity, expiresAt, now)
           } else {
-            await this.lockCellInventory(transaction, 'request')
-            await this.adjustCellReservation(transaction, input.cellId, 1)
+            await this.adjustCellReservationAtomically(transaction, input.cellId, 1)
             await this.adjustActivityCount(transaction, identity, 'control', 1, expiresAt, now)
             await transaction.query(
               `INSERT INTO relay_assignment_activity_leases
@@ -6954,6 +6955,19 @@ export class RelayAssignmentStore {
     return rows
   }
 
+  // Per-connection paths touch one or two cells. Locking exactly those rows,
+  // in the same ascending order the inventory lock uses (ORDER BY fixes the
+  // row-lock order), keeps them off the fleet-wide lock without a cycle.
+  private async lockCellRows(database: RelayDatabase, cellIds: string[]): Promise<SqlRow[]> {
+    const distinct = [...new Set(cellIds)]
+    return await database.queryLocked(
+      `SELECT * FROM relay_cells WHERE cell_id IN (${distinct.map(() => '?').join(', ')})
+       ORDER BY cell_id ASC`,
+      distinct,
+      { lockTimeoutMs: CELL_INVENTORY_LOCK_TIMEOUT_MS }
+    )
+  }
+
   private async lockGeneralCellInventory(
     database: RelayDatabase,
     mode: CellInventoryLockMode
@@ -7590,7 +7604,10 @@ export class RelayAssignmentStore {
     ) {
       throw new Error('activity_lease_shape_mismatch')
     }
-    const cells = await this.lockCellInventory(database, 'request')
+    // Why: this recomputes one cell's reservation from its leases, so only that
+    // row needs to be held; the 23-row inventory lock here serialised every
+    // desktop control rebind in the fleet behind every other one.
+    const cellRow = (await this.lockCellRows(database, [cellId]))[0]
     await database.query(
       `DELETE FROM relay_assignment_activity_leases
        WHERE user_id = ? AND relay_host_id = ? AND activity_kind = 'control'
@@ -7611,7 +7628,6 @@ export class RelayAssignmentStore {
         [cellId]
       )
     )[0]!
-    const cellRow = cells.find((cell) => text(cell, 'cell_id') === cellId)
     const cellUnits = integer(cellUnitsRow, 'request_units')
     if (!cellRow) throw new Error('assigned_cell_missing')
     if (cellUnits > integer(cellRow, 'capacity_requests')) {
diff --git a/cloud/apps/relay/src/cell-inventory-lock-census.test.ts b/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
index 8ca7cee55f5..a26e15f8e1d 100644
--- a/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
+++ b/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
@@ -25,10 +25,12 @@ const CENSUS: CensusEntry[] = [
   { method: 'assignOnce', mode: 'nowait', reach: 'both' },
   { method: 'assignOnce', mode: 'nowait', reach: 'both' },
   { method: 'refreshDrainMigrationLeasesOnce', mode: 'request', reach: 'request' },
-  // Reachable from neither: changeActivity has no production callers, only tests.
-  { method: 'changeActivity', mode: 'request', reach: 'orphan' },
-  { method: 'acquireActivity', mode: 'request', reach: 'request' },
-  { method: 'activateControl', mode: 'request', reach: 'request' },
+  // changeActivity, acquireActivity, activateControl and
+  // removeSupersededSameCellControls no longer take the inventory: they lock
+  // only the one or two cell rows they touch, in cell_id order (lockCellRows),
+  // so they cannot cycle with placement's ordered inventory lock, and the
+  // 23-row lock there had serialised every reconnect in the fleet behind every
+  // other one.
   { method: 'startEvacuation', mode: 'request', reach: 'request' },
   { method: 'completeEvacuationFromDeadSourceOnce', mode: 'request', reach: 'request' },
   { method: 'completeEvacuationFromDeadSourceOnce', mode: 'nowait', reach: 'request' },
@@ -48,8 +50,31 @@ const CENSUS: CensusEntry[] = [
   { method: 'releaseExpiredActivityLeases', mode: 'nowait', reach: 'sweep' },
   { method: 'releaseExpiredActivity', mode: 'nowait', reach: 'sweep' },
   { method: 'reconcileReservationAccounting', mode: 'pool-default', reach: 'both' },
-  { method: 'leastLoadedCell', mode: 'pool-default', reach: 'both' },
-  { method: 'removeSupersededSameCellControls', mode: 'request', reach: 'request' }
+  { method: 'leastLoadedCell', mode: 'pool-default', reach: 'both' }
+]
+
+// Every inline `FROM relay_cells ... FOR UPDATE` outside the named lock helpers,
+// in source order: whole-table locks in reconciliation and sticky placement,
+// and single-row locks for a cell the method is already scoped to (heartbeat,
+// fence, drain generation, configuration, or a reservation adjust that runs
+// under a lock its caller already holds). A new inline lock fails the census
+// below until it is listed here; per-connection paths that touch more than one
+// cell go through lockCellRows so the order is fixed.
+const NAMED_LOCK_HELPERS = ['lockCellInventory', 'lockGeneralCellInventory', 'lockCellRows']
+
+const INLINE_CELL_LOCK_SITES = [
+  'reconcileCellsWithOptions',
+  'assignStickyOnce',
+  'recordCellHeartbeat',
+  'attestCellFence',
+  'adoptLegacyCellFence',
+  'commitLegacyCellFenceAdoption',
+  'prepareCellFenceAttempt',
+  'attestCellFenceAttempt',
+  'attestCellFenceAttempt',
+  'configureCell',
+  'assertDrainCellGeneration',
+  'adjustCellReservation'
 ]
 
 // The background sweeps, and nothing else. A method reachable from one of these
@@ -151,6 +176,42 @@ describe('cell inventory lock call-site census', () => {
     )
   })
 
+  // Why: the census only sees lockCellInventory calls, so a hand-written
+  // `relay_cells ... FOR UPDATE` would escape classification entirely.
+  it('routes every relay_cells row lock through a named lock helper', () => {
+    const lines = storeSource()
+    const rawSites: string[] = []
+    // Whole statements, not a fixed window: a wide column list or a raw
+    // FOR UPDATE inside query() must not slip past.
+    const source = lines.join('\n')
+    const bounds: { name: string; start: number }[] = []
+    lines.forEach((line, index) => {
+      const declaration = DECLARATION.exec(line)
+      if (declaration) bounds.push({ name: declaration[1]!, start: index })
+    })
+    const methodAt = (offset: number): string => {
+      const lineIndex = source.slice(0, offset).split('\n').length - 1
+      let name = '<module>'
+      for (const bound of bounds) if (bound.start <= lineIndex) name = bound.name
+      return name
+    }
+    const tick = String.fromCharCode(96)
+    const statementCall = new RegExp(
+      '\\.(queryLocked|query)\\(\\s*' + tick + '([^' + tick + ']*)' + tick,
+      'g'
+    )
+    for (const call of source.matchAll(statementCall)) {
+      const statement = call[2]!
+      if (!/\bFROM\s+relay_cells\b/.test(statement)) continue
+      const locks = call[1] === 'queryLocked' || /\bFOR\s+UPDATE\b/.test(statement)
+      if (!locks) continue
+      const method = methodAt(call.index)
+      if (NAMED_LOCK_HELPERS.includes(method)) continue
+      rawSites.push(method)
+    }
+    expect(rawSites).toEqual(INLINE_CELL_LOCK_SITES)
+  })
+
   it('leaves no call site taking the inventory without naming a mode', () => {
     const source = readFileSync(new URL('./assignment-store.ts', import.meta.url), 'utf8')
     const unclassified = source
diff --git a/cloud/apps/relay/src/control-rebind-inventory-lock-postgres.test.ts b/cloud/apps/relay/src/control-rebind-inventory-lock-postgres.test.ts
new file mode 100644
index 00000000000..e990ac1ed1a
--- /dev/null
+++ b/cloud/apps/relay/src/control-rebind-inventory-lock-postgres.test.ts
@@ -0,0 +1,260 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { RelayAssignmentStore } from './assignment-store.js'
+import { openRelayDatabase, type RelayDatabase } from './database.js'
+
+const databaseUrl = process.env.ORCA_RELAY_TEST_POSTGRES_URL
+const describePostgres = databaseUrl ? describe : describe.skip
+
+// Three cells: the inventory lock covers more than the rows a move touches, and
+// a high-to-low move exposes any lock taken out of cell_id order.
+const cells = [
+  {
+    id: 'rebind-inventory-postgres-a',
+    url: 'https://rebind-inventory-postgres-a.example.com',
+    capacityRequests: 1_000,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  },
+  {
+    id: 'rebind-inventory-postgres-b',
+    url: 'https://rebind-inventory-postgres-b.example.com',
+    capacityRequests: 1_000,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  },
+  {
+    id: 'rebind-inventory-postgres-c',
+    url: 'https://rebind-inventory-postgres-c.example.com',
+    capacityRequests: 1_000,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  }
+]
+const identity = { userId: 'rebind-inventory-postgres-user', relayHostId: 'rebindinvhost001' }
+
+function heartbeat(cell: (typeof cells)[number]) {
+  return {
+    cellId: cell.id,
+    cellUrl: cell.url,
+    cellIncarnation: '11111111-1111-4111-8111-111111111111',
+    startedAt: 50,
+    ready: true,
+    observedRequests: 0,
+    totalConnections: 0,
+    inFlightConnections: 0,
+    reservedConnectionUnits: 0,
+    enforcedConnectionUnits: 0,
+    connectionInclusionWatermark: 1,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  }
+}
+
+// Why: every desktop control rebind used to take the fleet-wide relay_cells
+// FOR UPDATE lock, so a rebind on one cell queued behind whatever held any
+// other cell's row, until COMMIT (55P03 at the request bound). A rebind only
+// touches its own cell row, so it must proceed while another cell's row is
+// held elsewhere.
+describePostgres('PostgreSQL control rebind under a held cell row', () => {
+  const databases: RelayDatabase[] = []
+
+  beforeAll(async () => {
+    databases.push(
+      await openRelayDatabase({ databaseUrl, dataDir: '' }),
+      await openRelayDatabase({ databaseUrl, dataDir: '' })
+    )
+  })
+
+  async function removeTestRows(database: RelayDatabase): Promise<void> {
+    await database.query(
+      `DELETE FROM relay_control_connection_reservations WHERE user_id = ?`,
+      [identity.userId]
+    )
+    for (const table of [
+      'relay_assignment_activity_leases',
+      'relay_post_drain_migration_pins',
+      'relay_assignment_migration_incarnations',
+      'relay_assignment_migrations',
+      'relay_assignments'
+    ]) {
+      await database.query(`DELETE FROM ${table} WHERE user_id = ?`, [identity.userId])
+    }
+    for (const cell of cells) {
+      for (const table of [
+        'relay_cell_connection_snapshots',
+        'relay_cell_connection_runtime',
+        'relay_cell_connection_limits',
+        'relay_cell_runtime',
+        'relay_cells'
+      ]) {
+        await database.query(`DELETE FROM ${table} WHERE cell_id = ?`, [cell.id])
+      }
+    }
+  }
+
+  afterAll(async () => {
+    if (databases[0]) await removeTestRows(databases[0])
+    for (const connection of databases) await connection.close()
+  })
+
+  it("rebinds and supersedes a control while another cell's row is held", async () => {
+    // A prior aborted run leaves connection snapshots that reject a replayed watermark.
+    await removeTestRows(databases[0]!)
+    const store = new RelayAssignmentStore(databases[0]!, () => 100)
+    await store.reconcileCells(cells)
+    for (const cell of cells) await store.recordCellHeartbeat(heartbeat(cell))
+    // Pin the host to cell A so placement is deterministic.
+    await store.setCellEnabled(cells[1]!.id, false)
+    await store.setCellEnabled(cells[2]!.id, false)
+    const assignment = await store.assign(identity)
+    expect(assignment.cellId).toBe(cells[0]!.id)
+    await store.setCellEnabled(cells[1]!.id, true)
+    await store.setCellEnabled(cells[2]!.id, true)
+    await store.activateControl(identity, {
+      cellId: cells[0]!.id,
+      assignmentEpoch: assignment.assignmentEpoch,
+      generation: 1,
+      connectionInclusionWatermark: 10
+    })
+
+    // Hold only cell B's row on a second connection, the way a rebind on B
+    // does, for longer than the request-path lock bound.
+    let releaseInventory!: () => void
+    const inventoryReleased = new Promise<void>((resolve) => {
+      releaseInventory = resolve
+    })
+    let inventoryHeld!: () => void
+    const inventoryHeldPromise = new Promise<void>((resolve) => {
+      inventoryHeld = resolve
+    })
+    const holder = databases[1]!.transaction(async (transaction) => {
+      await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cells[1]!.id])
+      inventoryHeld()
+      await inventoryReleased
+    })
+    await inventoryHeldPromise
+
+    // A generation-2 rebind on cell A supersedes generation 1. It must not
+    // wait on cell B's row.
+    const startedAt = Date.now()
+    const blockedStatement = async (): Promise<string> => {
+      const rows = await databases[1]!.query(
+        `SELECT left(query, 160) AS q FROM pg_stat_activity
+         WHERE datname = current_database() AND wait_event_type = 'Lock'`
+      )
+      return rows.map((row) => String(row.q)).join(' | ')
+    }
+    const timeout = new Promise<never>((_, reject) =>
+      setTimeout(
+        () =>
+          void blockedStatement().then((statement) =>
+            reject(new Error(`rebind on cell A blocked behind cell B's row: ${statement}`))
+          ),
+        2_000
+      )
+    )
+    const rebound = await Promise.race([
+      store.activateControl(identity, {
+        cellId: cells[0]!.id,
+        assignmentEpoch: assignment.assignmentEpoch,
+        generation: 2,
+        connectionInclusionWatermark: 11
+      }),
+      timeout
+    ])
+    const elapsedMs = Date.now() - startedAt
+    releaseInventory()
+    await holder
+
+    expect(rebound).toBe(`control:${cells[0]!.id}:2`)
+    expect(elapsedMs).toBeLessThan(2_000)
+    const controls = await databases[0]!.query(
+      `SELECT activity_id FROM relay_assignment_activity_leases
+       WHERE user_id = ? AND activity_kind = 'control' ORDER BY activity_id`,
+      [identity.userId]
+    )
+    expect(controls).toEqual([{ activity_id: `control:${cells[0]!.id}:2` }])
+    const reserved = await databases[0]!.query(
+      `SELECT reserved_requests FROM relay_cells WHERE cell_id = ?`,
+      [cells[0]!.id]
+    )
+    expect(Number(reserved[0]!.reserved_requests)).toBe(1)
+  }, 15_000)
+
+  // Why: a phone's activity id is client-chosen and can follow the host across
+  // a migration, so acquireActivity may touch two cell rows. Moving from the
+  // higher cell to the lower one is where an unordered lock cycles with
+  // placement's ascending inventory lock (reproduced live before this fix).
+  it('moves an activity from a higher cell to a lower one in cell_id order', async () => {
+    await removeTestRows(databases[0]!)
+    const [cellA, cellB, cellC] = cells as [typeof cells[0], typeof cells[0], typeof cells[0]]
+    const store = new RelayAssignmentStore(databases[0]!, () => 100)
+    await store.reconcileCells(cells)
+    for (const cell of cells) await store.recordCellHeartbeat(heartbeat(cell))
+    await store.setCellEnabled(cellA.id, false)
+    await store.setCellEnabled(cellB.id, false)
+    const assignment = await store.assign(identity)
+    expect(assignment.cellId).toBe(cellC.id)
+    await store.setCellEnabled(cellA.id, true)
+    await store.setCellEnabled(cellB.id, true)
+    const activityId = 'splice:rebind-inventory-postgres'
+    await store.acquireActivity(identity, { activityId, kind: 'splice', cellId: cellC.id })
+    // The migration makes B authoritative; the lease still sits on C.
+    const migration = await store.startEvacuation(identity, cellB.id)
+    expect(migration.targetCellId).toBe(cellB.id)
+
+    // Hold B elsewhere. An ordered move locks B first and queues here holding
+    // nothing else. Locking C first (the old lease's row, as an unordered move
+    // does) or the whole inventory (which takes A) shows up as a held row.
+    let releaseRow!: () => void
+    const rowReleased = new Promise<void>((resolve) => {
+      releaseRow = resolve
+    })
+    let rowHeld!: () => void
+    const rowHeldPromise = new Promise<void>((resolve) => {
+      rowHeld = resolve
+    })
+    const heldWhileMoverWaits: string[] = []
+    const holder = databases[1]!.transaction(async (transaction) => {
+      await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cellB.id])
+      rowHeld()
+      await rowReleased
+      for (const cell of [cellA, cellC]) {
+        try {
+          await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cell.id], {
+            failIfUnavailable: true
+          })
+        } catch {
+          heldWhileMoverWaits.push(cell.id)
+        }
+      }
+    })
+    await rowHeldPromise
+    const move = store.acquireActivity(identity, { activityId, kind: 'splice', cellId: cellB.id })
+    let moved = false
+    void move.then(() => {
+      moved = true
+    })
+    await new Promise((resolve) => setTimeout(resolve, 250))
+    expect(moved).toBe(false)
+    releaseRow()
+    await holder
+    await move
+    expect(heldWhileMoverWaits).toEqual([])
+
+    const reservations = await databases[0]!.query(
+      `SELECT cell_id, reserved_requests FROM relay_cells
+       WHERE cell_id IN (?, ?, ?) ORDER BY cell_id ASC`,
+      [cellA.id, cellB.id, cellC.id]
+    )
+    const reserved = reservations.map((row) => [String(row.cell_id), Number(row.reserved_requests)])
+    expect(reserved).toEqual([
+      [cellA.id, 0],
+      // Migration grant plus the moved splice, as in the SQLite origin-scoped
+      // reservation case: the lock change did not alter accounting.
+      [cellB.id, 6],
+      // The sticky grant stays on the source until the migration completes.
+      [cellC.id, 1]
+    ])
+  }, 15_000)
+})

From fb69f00b65bb3096ae58010a780fcbf771b7ea17 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 01:34:47 -0700
Subject: [PATCH 13/58] fix(hosts): resolve a folder workspace's SSH host from
 the repo's host, not its raw connectionId (#18598)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(hosts): resolve a folder workspace's SSH host from the repo's host, not its raw connectionId

`resolveFolderWorkspaceHost` inferred a workspace's host by reading
`repo.connectionId` directly. SSH ownership has two spellings on a repo row, and
a row carrying only `executionHostId: 'ssh:<target>'` has no `connectionId` to
read — so it counted as a local repo and the workspace resolved `{ kind: 'local' }`.
That is an execute-here answer for a workspace whose files are on an SSH host,
the #11163 class, and it fires on a well-formed row.

Resolve the host first, then read the target off it. Every other row keeps its
existing contribution, including a `runtime:` row's nested SSH target: that
target is not this client's to dial, but narrowing it here would be a second
behaviour change riding on this one. The runtime branch above still answers
`local`, and now says so — `FolderWorkspaceHost` has no runtime variant, and
widening the type is its own change, not an oversight to be silently corrected.

Three smaller items that stand on their own:

- `resolveWorktreeExecutionHost` gains a `malformed` reason distinct from
  `unknown`. `unknown` (nothing carries the id) is a verdict the launch path may
  legitimately dispose of as a plain local folder; `malformed` (the row named a
  host that cannot be parsed) must fail closed. One word for two situations is
  the shape that lost the distinction in #18006. The strict read is private to
  that module: `getRepoExecutionHostId` stays the answer everywhere else, since
  its fall-through to `local` is harmless for the grouping, label and index
  callers that are nearly all of its ~340 call sites.
- `readAllWorktreeMetaForRepo` / `readWorktreeMetaForRepo` replace four
  open-coded copies of the same host-qualified read (the F7/F8 lockstep shape).
- `getExecutionHostLabel` answers 'Unknown host' rather than 'All hosts' for an
  id that names no host. Showing one unroutable row as though it were on every
  host is wrong on its own terms. Plain English like every other label in that
  module, none of which resolve through the renderer's i18n catalog.

* fix(hosts): resolve the host in candidate selection too, not just in resolution

The first pass fixed how a repo row is classified once it reaches
`resolveFolderWorkspaceHost`. The candidate filter decides which rows reach it at
all, and it read `repo.connectionId` raw as well — so an SSH-only row outside the
project-group subtree was dropped before the new logic could see it, and the
execute-here bug survived for the population the fix was for, via a different
path. Found in review by CodeRabbit.

Three repo-row reads had the same root cause, not one:

- the scope-connection filter, comparing a path repo's raw field against the
  workspace/group connection;
- the group-connection set, built from group repos' raw fields;
- that set's membership test against path repos' raw fields.

The last two are one comparison with the mismatch on either side, so resolving
only the path side would have reintroduced it from the other direction.

All three, plus the resolution loop, now go through one `getRepoScopeConnectionId`
helper. Non-SSH hosts still fall back to the raw field, so a `runtime:` row keeps
contributing its nested target exactly as before.

The new tests use a repo matched only by path, outside the subtree — the
population every existing test missed, which is why four passing revert-tests
did not catch this. One of them is labelled as pinning the resolver rather than
the filter: under the old raw read both rows came back connectionless and matched
each other by accident, so it survives a filter revert and must not be counted as
coverage for it.
---
 .../listing/detected-provider-listing.ts      |   7 +-
 .../register-worktree-catalog-handlers.ts     |  11 +-
 .../listing/ssh-worktree-fallback.ts          |   4 +-
 .../listing/worktree-discovery-metadata.ts    |   4 +-
 .../host-qualified-worktree-meta.ts           |  23 ++-
 src/main/runtime/worktree-launch-host-repo.ts |  10 +-
 src/shared/execution-host.test.ts             |  13 ++
 src/shared/execution-host.ts                  |   9 +-
 .../folder-workspace-execution-host.test.ts   | 188 ++++++++++++++++++
 src/shared/folder-workspace-execution-host.ts |  38 +++-
 ...worktree-execution-host-resolution.test.ts |  34 ++++
 .../worktree-execution-host-resolution.ts     |  38 +++-
 12 files changed, 348 insertions(+), 31 deletions(-)

diff --git a/src/main/ipc/worktrees/listing/detected-provider-listing.ts b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
index 25c08d262fb..388c825530f 100644
--- a/src/main/ipc/worktrees/listing/detected-provider-listing.ts
+++ b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
@@ -26,8 +26,7 @@ import {
   type DetectedWorktreeSideEffectToken
 } from './detected-worktree-scan-cache'
 import { loggedWorktreeListFailures, warnOnce } from './worktree-listing-diagnostics'
-import { readAllWorktreeMetaForHost } from '../../../persistence/host-qualified-worktree-meta'
-import { getRepoExecutionHostId } from '../../../../shared/execution-host'
+import { readAllWorktreeMetaForRepo } from '../../../persistence/host-qualified-worktree-meta'
 
 export async function listDetectedWorktreesForCapturedRepo(
   store: Store,
@@ -40,9 +39,7 @@ export async function listDetectedWorktreesForCapturedRepo(
     providerAbort?.signal.aborted
       ? ({ providerAbortStatus: providerAbort.status() } as const)
       : undefined
-  const allMeta = isFolderRepo(repo)
-    ? undefined
-    : readAllWorktreeMetaForHost(store, getRepoExecutionHostId(repo))
+  const allMeta = isFolderRepo(repo) ? undefined : readAllWorktreeMetaForRepo(store, repo)
   // Why: only the disconnected fallbacks read this, so keep parseWorktreeId over the whole host snapshot
   // off the connected path entirely.
   let cachedSshWorktreeMetaIndex: SshWorktreeMetaIndex | undefined
diff --git a/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts b/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
index d684461a381..4f3055c63a2 100644
--- a/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
+++ b/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
@@ -23,7 +23,10 @@ import {
   warnOnce
 } from './worktree-listing-diagnostics'
 import type { WorktreeIpcContext } from '../worktree-ipc-context'
-import { readAllWorktreeMetaForHost } from '../../../persistence/host-qualified-worktree-meta'
+import {
+  readAllWorktreeMetaForHost,
+  readAllWorktreeMetaForRepo
+} from '../../../persistence/host-qualified-worktree-meta'
 import type { WorktreeMeta } from '../../../../shared/worktree/meta-types'
 
 const WORKTREE_LIST_ALL_CONCURRENCY = 8
@@ -174,9 +177,7 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
     if (!repo) {
       return []
     }
-    const allMeta = repo.connectionId
-      ? readAllWorktreeMetaForHost(store, getRepoExecutionHostId(repo))
-      : undefined
+    const allMeta = repo.connectionId ? readAllWorktreeMetaForRepo(store, repo) : undefined
     const sshWorktreeMetaIndex = repo.connectionId
       ? createSshWorktreeMetaIndex(Object.entries(allMeta ?? {}))
       : new Map()
@@ -226,7 +227,7 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
         })
       }
       loggedWorktreeListFailures.delete(`${repo.id}:${repo.path}`)
-      const metadata = allMeta ?? readAllWorktreeMetaForHost(store, getRepoExecutionHostId(repo))
+      const metadata = allMeta ?? readAllWorktreeMetaForRepo(store, repo)
       return buildDetectedGitWorktrees(store, repo, gitWorktrees, metadata)
         .filter((worktree) => worktree.visible)
         .map((worktree) => stampAndMergeVisibleDetectedWorktree(store, repo, worktree, metadata))
diff --git a/src/main/ipc/worktrees/listing/ssh-worktree-fallback.ts b/src/main/ipc/worktrees/listing/ssh-worktree-fallback.ts
index 5c734d8bcd9..ecf8ab3abc1 100644
--- a/src/main/ipc/worktrees/listing/ssh-worktree-fallback.ts
+++ b/src/main/ipc/worktrees/listing/ssh-worktree-fallback.ts
@@ -9,7 +9,7 @@ import type { GitWorktreeInfo, DetectedWorktree, Worktree } from '../../../../sh
 import type { Store } from '../../../persistence/loading-store/store'
 import { getRepoExecutionHostId } from '../../../../shared/execution-host'
 import {
-  readWorktreeMetaForHost,
+  readWorktreeMetaForRepo,
   writeWorktreeMetaForHost
 } from '../../../persistence/host-qualified-worktree-meta'
 import { getRepoOwnedWorktreeMeta } from '../../../worktree-metadata-ownership'
@@ -159,7 +159,7 @@ export function buildDetectedGitWorktrees(
     const legacyMeta = allMeta === undefined ? store.getWorktreeMeta?.(worktreeId) : undefined
     const metaById = allMeta ?? (legacyMeta ? { [worktreeId]: legacyMeta } : {})
     const meta =
-      readWorktreeMetaForHost(store, worktreeId, getRepoExecutionHostId(repo)) ??
+      readWorktreeMetaForRepo(store, worktreeId, repo) ??
       getRepoOwnedWorktreeMeta(repo, worktreeId, metaById, repoOwnerCount)
     const worktree = mergeWorktree(repo.id, gitWorktree, meta, repo.displayName)
     const detected = toDetectedWorktree({
diff --git a/src/main/ipc/worktrees/listing/worktree-discovery-metadata.ts b/src/main/ipc/worktrees/listing/worktree-discovery-metadata.ts
index b17677ddfcc..3edb8efc1d7 100644
--- a/src/main/ipc/worktrees/listing/worktree-discovery-metadata.ts
+++ b/src/main/ipc/worktrees/listing/worktree-discovery-metadata.ts
@@ -4,7 +4,7 @@ import type { WorktreeMeta } from '../../../../shared/worktree/meta-types'
 import { getProjectHostSetupWorktreeMeta } from '../../../../shared/project-host-setup-lookup'
 import { getRepoExecutionHostId } from '../../../../shared/execution-host'
 import {
-  readWorktreeMetaForHost,
+  readWorktreeMetaForRepo,
   writeWorktreeMetaForHost
 } from '../../../persistence/host-qualified-worktree-meta'
 import { getRepoOwnedWorktreeMeta } from '../../../worktree-metadata-ownership'
@@ -44,7 +44,7 @@ export function resolveWorktreeMetaWithDiscoveryBackfill(
   // Why: the locator-keyed row is only a stand-in for a missing snapshot, so don't read it when we have one.
   const legacyMeta = allMeta === undefined ? store.getWorktreeMeta?.(worktreeId) : undefined
   const existing =
-    readWorktreeMetaForHost(store, worktreeId, executionHostId) ??
+    readWorktreeMetaForRepo(store, worktreeId, repo) ??
     getRepoOwnedWorktreeMeta(
       repo,
       worktreeId,
diff --git a/src/main/persistence/host-qualified-worktree-meta.ts b/src/main/persistence/host-qualified-worktree-meta.ts
index a9d1c0e8fb1..6267311f471 100644
--- a/src/main/persistence/host-qualified-worktree-meta.ts
+++ b/src/main/persistence/host-qualified-worktree-meta.ts
@@ -1,4 +1,5 @@
-import type { ExecutionHostId } from '../../shared/execution-host'
+import { getRepoExecutionHostId, type ExecutionHostId } from '../../shared/execution-host'
+import type { Repo } from '../../shared/repo-types'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
 
 /**
@@ -52,6 +53,26 @@ export function readWorktreeMetaForHost(
   return store.getWorktreeMetaForHost?.(worktreeId, executionHostId)
 }
 
+/**
+ * The same two reads keyed off a repo row, so the resolve-then-read pair lives in one place. Four
+ * call sites had open-coded it identically, which is the shape that lets one copy drift from the
+ * rest (F7/F8).
+ */
+export function readAllWorktreeMetaForRepo(
+  store: Pick<HostQualifiedWorktreeMetaStore, 'getAllWorktreeMeta' | 'getAllWorktreeMetaForHost'>,
+  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
+): Record<string, WorktreeMeta> {
+  return readAllWorktreeMetaForHost(store, getRepoExecutionHostId(repo))
+}
+
+export function readWorktreeMetaForRepo(
+  store: Pick<HostQualifiedWorktreeMetaStore, 'getWorktreeMetaForHost'>,
+  worktreeId: string,
+  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
+): WorktreeMeta | undefined {
+  return readWorktreeMetaForHost(store, worktreeId, getRepoExecutionHostId(repo))
+}
+
 export function writeWorktreeMetaForHost(
   store: Pick<HostQualifiedWorktreeMetaStore, 'setWorktreeMeta' | 'setWorktreeMetaForHost'>,
   worktreeId: string,
diff --git a/src/main/runtime/worktree-launch-host-repo.ts b/src/main/runtime/worktree-launch-host-repo.ts
index 4decb7acb56..7db9f4dae18 100644
--- a/src/main/runtime/worktree-launch-host-repo.ts
+++ b/src/main/runtime/worktree-launch-host-repo.ts
@@ -17,7 +17,10 @@ export type WorktreeHostRouting<T extends LaunchHostRepo> =
   | { kind: 'resolved'; hostId: ExecutionHostId; repo: T | null }
   /** No row carries this repo id and the worktree names no host — nothing ever named a host. */
   | { kind: 'unowned' }
-  /** Rival rows disagree about the host; guessing one is the cross-host leak. */
+  /**
+   * No single trustworthy host: rival rows disagree, or the resolved row named one that cannot be
+   * parsed. Guessing is the cross-host leak in both cases.
+   */
   | { kind: 'ambiguous' }
 
 /**
@@ -33,7 +36,10 @@ export function resolveWorktreeHostRouting<T extends LaunchHostRepo & ExecutionH
 ): WorktreeHostRouting<T> {
   const resolution = resolveWorktreeExecutionHost(createRepoRowExecutionHostLookup(repos), worktree)
   if (resolution.kind === 'unresolved') {
-    return resolution.reason === 'ambiguous' ? { kind: 'ambiguous' } : { kind: 'unowned' }
+    // Only `unknown` — nothing anywhere carries the id — becomes `unowned`, which callers dispose of
+    // as a plain local folder. `malformed` is a row that declared a host and named an unparseable
+    // one, so it joins `ambiguous`: guessing is the cross-host leak either way.
+    return resolution.reason === 'unknown' ? { kind: 'unowned' } : { kind: 'ambiguous' }
   }
   return { kind: 'resolved', hostId: resolution.hostId, repo: resolution.owner }
 }
diff --git a/src/shared/execution-host.test.ts b/src/shared/execution-host.test.ts
index 9905fc5fe2a..fba1d1fee8d 100644
--- a/src/shared/execution-host.test.ts
+++ b/src/shared/execution-host.test.ts
@@ -2,6 +2,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
   ALL_EXECUTION_HOSTS_SCOPE,
   LOCAL_EXECUTION_HOST_ID,
+  getExecutionHostLabel,
   getLocalExecutionHostLabel,
   getRepoExecutionHostId,
   getRepoSshConnectionId,
@@ -169,4 +170,16 @@ describe('execution host id delimiter invariant', () => {
       targetId: 'a|b'
     })
   })
+
+  // "All hosts" is the everything-scope. Answering with it for an id that names no host shows one
+  // unroutable row as though it were on every host, which is the opposite of what it is.
+  it('labels an id that names no host as one unknown host, not as every host', () => {
+    for (const id of ['ssh:', 'ssh:a|b', 'ssh:%zz', 'runtime:', 'quantum:box'] as const) {
+      expect(getExecutionHostLabel(id as never)).toBe('Unknown host')
+    }
+    expect(getExecutionHostLabel(null)).toBe('Unknown host')
+    expect(getExecutionHostLabel(ALL_EXECUTION_HOSTS_SCOPE)).toBe('All hosts')
+    expect(getExecutionHostLabel('ssh:box')).toBe('box')
+    expect(getExecutionHostLabel('runtime:env-1')).toBe('env-1')
+  })
 })
diff --git a/src/shared/execution-host.ts b/src/shared/execution-host.ts
index a77d02b3882..bbe55aea1a0 100644
--- a/src/shared/execution-host.ts
+++ b/src/shared/execution-host.ts
@@ -226,13 +226,18 @@ export function getSettingsFocusedExecutionHostId(
     : LOCAL_EXECUTION_HOST_ID
 }
 
-export function getExecutionHostLabel(id: ExecutionHostScope): string {
+export function getExecutionHostLabel(id: ExecutionHostScope | null | undefined): string {
   if (id === ALL_EXECUTION_HOSTS_SCOPE) {
     return 'All hosts'
   }
   const parsed = parseExecutionHostId(id)
   if (!parsed) {
-    return 'All hosts'
+    // Not "All hosts": an id that names no host is one *unknown* host, and answering with the
+    // everything-scope label shows an unroutable row as though it were on every host.
+    // Plain English like every other label in this module (`Local Mac`, `This computer`,
+    // `All hosts`) — none of them resolve through the renderer's i18n catalog, so a lone
+    // translated string here would read inconsistently.
+    return 'Unknown host'
   }
   switch (parsed.kind) {
     case 'local':
diff --git a/src/shared/folder-workspace-execution-host.test.ts b/src/shared/folder-workspace-execution-host.test.ts
index 2ccced49907..e1af0a7920e 100644
--- a/src/shared/folder-workspace-execution-host.test.ts
+++ b/src/shared/folder-workspace-execution-host.test.ts
@@ -174,6 +174,194 @@ describe('folder workspace execution host', () => {
     expect(resolveFolderWorkspaceHost(state({ repos: [] }), 'fw-1')).toEqual({ kind: 'local' })
   })
 
+  // SSH ownership has two spellings on a repo row. A row carrying only `executionHostId: 'ssh:*'`
+  // has no `connectionId`, and reading the raw field counted it as a local repo — so a workspace
+  // whose files live on an SSH host resolved `local`, which is an execute-here answer for a remote
+  // path. These fire on well-formed rows; nothing malformed is involved.
+  it('resolves a repo that names its SSH host only through executionHostId', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        repos: [
+          repo({
+            id: 'repo-1',
+            path: '/work/app/a',
+            projectGroupId: 'group-1',
+            executionHostId: 'ssh:box'
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ssh', targetId: 'box' })
+  })
+
+  it('mixes such a repo with a local one as ambiguous rather than local', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        repos: [
+          repo({ id: 'repo-1', path: '/work/app/a', projectGroupId: 'group-1' }),
+          repo({
+            id: 'repo-2',
+            path: '/work/app/b',
+            projectGroupId: 'group-1',
+            executionHostId: 'ssh:box'
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ambiguous' })
+  })
+
+  it('matches a scope connection against such a repo instead of calling it ambiguous', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        folderWorkspaces: [workspace({ connectionId: 'box' })],
+        repos: [
+          repo({
+            id: 'repo-1',
+            path: '/work/app/a',
+            projectGroupId: 'group-1',
+            executionHostId: 'ssh:box'
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ssh', targetId: 'box' })
+  })
+
+  it('reads the target off the host, so a percent-encoded id decodes', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        repos: [
+          repo({
+            id: 'repo-1',
+            path: '/work/app/a',
+            projectGroupId: 'group-1',
+            executionHostId: `ssh:${encodeURIComponent('box 1')}`
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ssh', targetId: 'box 1' })
+  })
+
+  // Deliberately unchanged: a `runtime:` row's nested SSH target is not this client's to dial, but
+  // narrowing that here would be a second behaviour change riding on the SSH fix.
+  it('leaves a runtime row contributing its nested connection exactly as before', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        repos: [
+          repo({
+            id: 'repo-1',
+            path: '/work/app/a',
+            projectGroupId: 'group-1',
+            executionHostId: 'runtime:env-1',
+            connectionId: 'nested-box'
+          })
+        ]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'ssh', targetId: 'nested-box' })
+  })
+
+  it('still answers local for a runtime pin, which the type cannot express otherwise', () => {
+    const resolved = resolveFolderWorkspaceHost(
+      state({
+        folderWorkspaces: [workspace({ executionHostId: 'runtime:env-1' })]
+      }),
+      'fw-1'
+    )
+
+    expect(resolved).toEqual({ kind: 'local' })
+  })
+
+  // The candidate FILTER decides which rows reach the resolver, and it read `repo.connectionId` raw
+  // too — so an SSH-only repo outside the project-group subtree was dropped before any of the above
+  // could classify it. Every test before this one uses a repo inside the subtree, which is never
+  // filtered, so none of them could have caught it (found in review by CodeRabbit).
+  describe('a repo matched only by path, outside the project-group subtree', () => {
+    const sshOnlyPathRepo = repo({
+      id: 'repo-path',
+      path: '/work/app/nested',
+      executionHostId: 'ssh:box'
+    })
+
+    it('survives the scope-connection filter instead of being dropped as connectionless', () => {
+      const scoped = state({
+        folderWorkspaces: [workspace({ connectionId: 'box' })],
+        repos: [sshOnlyPathRepo]
+      })
+
+      expect(findFolderWorkspaceCandidateRepos(scoped, 'fw-1')).toEqual([sshOnlyPathRepo])
+      expect(resolveFolderWorkspaceHost(scoped, 'fw-1')).toEqual({ kind: 'ssh', targetId: 'box' })
+    })
+
+    // Pins the resolver, not the filter: under the old raw read BOTH rows came back connectionless,
+    // so they matched each other by accident and this case survived the filter either way. The
+    // legacy-vs-unified pairing below is the one that discriminates.
+    it('survives the group-connection filter when the group is on that same SSH host', () => {
+      const scoped = state({
+        repos: [
+          repo({
+            id: 'repo-group',
+            path: '/work/app/group',
+            projectGroupId: 'group-1',
+            executionHostId: 'ssh:box'
+          }),
+          sshOnlyPathRepo
+        ]
+      })
+
+      expect(findFolderWorkspaceCandidateRepos(scoped, 'fw-1')).toHaveLength(2)
+      expect(resolveFolderWorkspaceHost(scoped, 'fw-1')).toEqual({ kind: 'ssh', targetId: 'box' })
+    })
+
+    // Both sides of the group comparison are resolved, so the legacy spelling on one side and the
+    // unified spelling on the other still match.
+    it('matches a legacy-spelled group repo against a unified-spelled path repo', () => {
+      const scoped = state({
+        repos: [
+          repo({
+            id: 'repo-group',
+            path: '/work/app/group',
+            projectGroupId: 'group-1',
+            connectionId: 'box'
+          }),
+          sshOnlyPathRepo
+        ]
+      })
+
+      expect(findFolderWorkspaceCandidateRepos(scoped, 'fw-1')).toHaveLength(2)
+      expect(resolveFolderWorkspaceHost(scoped, 'fw-1')).toEqual({ kind: 'ssh', targetId: 'box' })
+    })
+
+    // A `runtime:` row's nested target is still read from the raw field, so it matches a scope
+    // connection exactly as it does today. Pinned so the carve-out stays a decision.
+    it('leaves a runtime row matching the scope connection through its nested target', () => {
+      const runtimePathRepo = repo({
+        id: 'repo-path',
+        path: '/work/app/nested',
+        executionHostId: 'runtime:env-1',
+        connectionId: 'box'
+      })
+      const scoped = state({
+        folderWorkspaces: [workspace({ connectionId: 'box' })],
+        repos: [runtimePathRepo]
+      })
+
+      expect(findFolderWorkspaceCandidateRepos(scoped, 'fw-1')).toEqual([runtimePathRepo])
+    })
+  })
+
   it('reads each repository membership once while collecting candidates', () => {
     let membershipReads = 0
     const repos = Array.from({ length: 32 }, (_, index) => {
diff --git a/src/shared/folder-workspace-execution-host.ts b/src/shared/folder-workspace-execution-host.ts
index dc4dc80c51f..0aee75de543 100644
--- a/src/shared/folder-workspace-execution-host.ts
+++ b/src/shared/folder-workspace-execution-host.ts
@@ -17,7 +17,7 @@ import type { ProjectGroup } from './project-group-types'
 import type { Repo } from './repo-types'
 import { isPathInsideOrEqual } from './cross-platform-path'
 import { getProjectGroupSubtreeIds } from './project-groups'
-import { parseExecutionHostId } from './execution-host'
+import { getRepoExecutionHostId, parseExecutionHostId } from './execution-host'
 
 export type FolderWorkspaceHostState = {
   folderWorkspaces: readonly FolderWorkspace[]
@@ -36,6 +36,24 @@ export function normalizeConnectionId(value: string | null | undefined): string
   return value?.trim() || null
 }
 
+/**
+ * The SSH target whose filesystem holds this repo's files, or `null` for anything else.
+ *
+ * SSH ownership has two spellings on a repo row — the legacy `connectionId` field and the unified
+ * `executionHostId` — so reading the raw field sees only one of them and a row carrying only
+ * `executionHostId: 'ssh:<target>'` reads as if it had no connection at all. Every comparison in
+ * this file goes through here: the candidate filters decide which rows reach the resolver, so
+ * reading raw in either place drops the row before the resolver can classify it.
+ *
+ * A non-SSH host falls back to the raw field so a `runtime:` row keeps contributing its nested
+ * target exactly as it does today. That target is not this client's to dial, but changing it is a
+ * separate defect with its own reasoning — see the note in `resolveFolderWorkspaceHost`.
+ */
+function getRepoScopeConnectionId(repo: Repo): string | null {
+  const host = parseExecutionHostId(getRepoExecutionHostId(repo))
+  return host?.kind === 'ssh' ? host.targetId : normalizeConnectionId(repo.connectionId)
+}
+
 function getFolderScopeCandidateRepos(args: {
   folderPath: string
   projectGroupId: string
@@ -59,18 +77,18 @@ function getFolderScopeCandidateRepos(args: {
   if (args.connectionId) {
     return [
       ...groupRepos,
-      ...pathRepos.filter((repo) => normalizeConnectionId(repo.connectionId) === args.connectionId)
+      ...pathRepos.filter((repo) => getRepoScopeConnectionId(repo) === args.connectionId)
     ]
   }
   if (groupRepos.length === 0) {
     return pathRepos
   }
-  const groupConnectionIds = new Set(
-    groupRepos.map((repo) => normalizeConnectionId(repo.connectionId))
-  )
+  // Both sides resolved: comparing a resolved path repo against a raw group read would reintroduce
+  // the same mismatch from the other direction.
+  const groupConnectionIds = new Set(groupRepos.map(getRepoScopeConnectionId))
   return [
     ...groupRepos,
-    ...pathRepos.filter((repo) => groupConnectionIds.has(normalizeConnectionId(repo.connectionId)))
+    ...pathRepos.filter((repo) => groupConnectionIds.has(getRepoScopeConnectionId(repo)))
   ]
 }
 
@@ -102,6 +120,12 @@ export function resolveFolderWorkspaceHost(
   }
   const explicitHost = parseExecutionHostId(workspace.executionHostId)
   if (explicitHost) {
+    // A `runtime:` workspace deliberately answers `local`, and `FolderWorkspaceHost` has no runtime
+    // variant to answer with instead. That omission is known: a runtime environment's own server
+    // normalizes its work to `local`, and the nested SSH target on such a row is addressable only as
+    // the pair (environmentId, targetId) — handing it to this client's SSH table would dial a
+    // same-named box in the wrong namespace. Widening the type is its own change, not an oversight
+    // here.
     return explicitHost.kind === 'ssh'
       ? { kind: 'ssh', targetId: explicitHost.targetId }
       : { kind: 'local' }
@@ -114,7 +138,7 @@ export function resolveFolderWorkspaceHost(
   let hasLocalRepo = false
   const connectionIds = new Set<string>()
   for (const repo of candidateRepos) {
-    const connectionId = normalizeConnectionId(repo.connectionId)
+    const connectionId = getRepoScopeConnectionId(repo)
     if (connectionId) {
       connectionIds.add(connectionId)
     } else {
diff --git a/src/shared/worktree-execution-host-resolution.test.ts b/src/shared/worktree-execution-host-resolution.test.ts
index b82cea476eb..b31281fe925 100644
--- a/src/shared/worktree-execution-host-resolution.test.ts
+++ b/src/shared/worktree-execution-host-resolution.test.ts
@@ -156,6 +156,40 @@ describe('resolveWorktreeExecutionHost', () => {
     it('reports an unknown owner distinctly from a conflicting one', () => {
       expect(resolve([], { repoId: 'r' })).toEqual({ kind: 'unresolved', reason: 'unknown' })
     })
+
+    // `unknown` is a verdict the launch path disposes of as a plain local folder, so a row that
+    // declared a host and named an unparseable one must not share the word — it has to fail closed.
+    it('reports a row naming an unparseable host distinctly from an unknown one', () => {
+      for (const executionHostId of ['ssh:', 'ssh:a|b', 'ssh:%zz', 'runtime:', 'quantum:box']) {
+        expect(resolve([{ id: 'r', executionHostId }], { repoId: 'r' })).toEqual({
+          kind: 'unresolved',
+          reason: 'malformed'
+        })
+      }
+    })
+
+    it('does not recover a host from the connectionId such a row overrode', () => {
+      expect(
+        resolve([{ id: 'r', executionHostId: 'ssh:a|b', connectionId: 'openclaw' }], {
+          repoId: 'r'
+        })
+      ).toEqual({ kind: 'unresolved', reason: 'malformed' })
+    })
+
+    it('still resolves every row that names a parseable host', () => {
+      expect(resolve([{ id: 'r', executionHostId: 'ssh:box' }], { repoId: 'r' })).toMatchObject({
+        kind: 'resolved',
+        hostId: 'ssh:box'
+      })
+      expect(resolve([{ id: 'r', connectionId: 'box' }], { repoId: 'r' })).toMatchObject({
+        kind: 'resolved',
+        hostId: 'ssh:box'
+      })
+      expect(resolve([{ id: 'r' }], { repoId: 'r' })).toMatchObject({
+        kind: 'resolved',
+        hostId: 'local'
+      })
+    })
   })
 
   it('ignores an unparseable host id rather than treating it as a host', () => {
diff --git a/src/shared/worktree-execution-host-resolution.ts b/src/shared/worktree-execution-host-resolution.ts
index 00b66b7f11c..0172106aee0 100644
--- a/src/shared/worktree-execution-host-resolution.ts
+++ b/src/shared/worktree-execution-host-resolution.ts
@@ -54,7 +54,29 @@ export type WorktreeExecutionHostResolution<T extends ExecutionHostOwnerRow> =
       /** Display metadata only. The decisions are `hostId` / `connectionId`. */
       owner: T | null
     }
-  | { kind: 'unresolved'; reason: 'ambiguous' | 'unknown' }
+  /**
+   * Three reasons, not two, and deliberately not collapsed. `unknown` (nothing carries the id) is a
+   * verdict the launch path may legitimately dispose of as a plain local folder; `malformed` (the
+   * row named a host that cannot be parsed) must fail closed. A vocabulary that cannot express the
+   * difference guarantees it is lost at the first caller that switches on it — the same shape as
+   * #18006, where one word had to stand for two liveness situations.
+   */
+  | { kind: 'unresolved'; reason: 'ambiguous' | 'unknown' | 'malformed' }
+
+/**
+ * The owner row's host, or `null` when the row names one that cannot be parsed.
+ *
+ * Module-private and deliberately not a second exported reading of a repo row: only this resolution
+ * needs the distinction, because only this resolution is routing. `getRepoExecutionHostId` stays the
+ * answer everywhere else — its fall-through to `local` is harmless for the grouping, label and index
+ * callers that make up nearly all of its ~340 call sites, and is wrong only when the value decides
+ * where work runs.
+ */
+function resolveOwnerRowHostId(row: ExecutionHostOwnerRow): ExecutionHostId | null {
+  return row.executionHostId?.trim()
+    ? normalizeExecutionHostId(row.executionHostId)
+    : getRepoExecutionHostId(row)
+}
 
 export function resolveWorktreeExecutionHost<T extends ExecutionHostOwnerRow>(
   lookup: ExecutionHostOwnerLookup<T>,
@@ -80,9 +102,13 @@ export function resolveWorktreeExecutionHost<T extends ExecutionHostOwnerRow>(
   if (match.kind !== 'resolved') {
     return { kind: 'unresolved', reason: match.kind === 'ambiguous' ? 'ambiguous' : 'unknown' }
   }
+  const hostId = resolveOwnerRowHostId(match.owner)
+  if (!hostId) {
+    return { kind: 'unresolved', reason: 'malformed' }
+  }
   return {
     kind: 'resolved',
-    hostId: getRepoExecutionHostId(match.owner),
+    hostId,
     connectionId: getRepoSshConnectionId(match.owner),
     owner: match.owner
   }
@@ -115,12 +141,14 @@ export function createRepoRowExecutionHostLookup<T extends ExecutionHostOwnerRow
       if (!owner) {
         return { kind: 'missing' }
       }
-      const ownerHostId = getRepoExecutionHostId(owner)
-      return rows.some((repo) => getRepoExecutionHostId(repo) !== ownerHostId)
+      const ownerHostId = resolveOwnerRowHostId(owner)
+      return rows.some((repo) => resolveOwnerRowHostId(repo) !== ownerHostId)
         ? { kind: 'ambiguous' }
         : { kind: 'resolved', owner }
     },
+    // A row naming an unparseable host matches no host, which is what stops a worktree on a real
+    // host from adopting it.
     byHost: (repoId, hostId) =>
-      rowsFor(repoId).find((repo) => getRepoExecutionHostId(repo) === hostId) ?? null
+      rowsFor(repoId).find((repo) => resolveOwnerRowHostId(repo) === hostId) ?? null
   }
 }

From 01d7228b7e971749b1f3da06f8e9a6be18e76b94 Mon Sep 17 00:00:00 2001
From: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Date: Fri, 4 Sep 2026 01:44:52 -0700
Subject: [PATCH 14/58] docs: add WeChat group 9 QR code

Adds group 9 QR fallback QR codes and capacity guidance to the README variants.
---
 README.md                        |   4 ++--
 docs/assets/wechat-qr-group9.jpg | Bin 0 -> 395815 bytes
 docs/readme/README.fr.md         |   4 ++--
 docs/readme/README.ko.md         |   4 ++--
 docs/readme/README.zh-CN.md      |   4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)
 create mode 100644 docs/assets/wechat-qr-group9.jpg

diff --git a/README.md b/README.md
index 7a3cbe2360c..2ae59035da8 100644
--- a/README.md
+++ b/README.md
@@ -238,9 +238,9 @@ Pair with your desktop app to monitor and steer your agents from your phone.
 
 - **Discord:** Join the community on **[Discord](https://discord.gg/fzjDKHxv8Q)**.
 - **Twitter / X:** Follow **[@orca_build](https://x.com/orca_build)** for updates and announcements.
-- **WeChat:** Scan to join the Orca community WeChat group 8.
+- **WeChat:** Scan to join the Orca community WeChat group 8. Group 8 may be full; if so, scan the Group 9 QR code instead.
 
-  <img src="docs/assets/wechat-qr-group8.jpg" alt="WeChat group 8 QR code for the Orca community" width="160" />
+  <img src="docs/assets/wechat-qr-group8.jpg" alt="WeChat group 8 QR code for the Orca community" width="160" />&nbsp;&nbsp;<img src="docs/assets/wechat-qr-group9.jpg" alt="WeChat group 9 QR code for the Orca community" width="160" />
 
 - **Feedback &amp; Ideas:** We ship fast. Missing something? [Request a new feature](https://github.com/stablyai/orca/issues).
 - **Privacy:** See the [privacy &amp; telemetry docs](https://www.onorca.dev/docs/telemetry) for what anonymous usage data Orca collects and how to opt out.
diff --git a/docs/assets/wechat-qr-group9.jpg b/docs/assets/wechat-qr-group9.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..2bf46a28c3d464682461ffe47a0bde9a797fd1e8
GIT binary patch
literal 395815
zcmce;2~<<r)-Jjc6%jEi2na${R8*SS(3CU@ihzn3MWq!YqC$uvMFA2ZBo;_7P--b9
z6a?v!P9OoLix8SBDFi|j2|`FHl~#5X!j?3=?K$V3`;YUQ@$P@$c*z)h?=i?;Yt6Oh
zn)93AoQu_Ws}sPMvkqq*00jjAcn5!hRRM6{o{YZ*0M5?9Apih20P7UC0gCXG0{jIO
zw1IX1cm{y83OfIOc2PL+uivZzfCN0S_Fup8gzw)!aLeD{{?}bGSK)uQn7ihG{918i
zuHwI+;dbEB%mY7M2q1-$LIOxX?mA|282I7j8Rxa%TZcdYc;5Gq$1Q`p_eau!nzhq+
zm4BOqPEuE216wyJu2I~msIV1SvsFQHtHNqKfP_b}PT?P)f4l}?6xJxNUAJCogYrfd
z_y^1_z#0Wb#Wiac*RA{BjY2g1cVO+-b=!6yIk8^tqOa1PVD+OvKX|r5|73ORc9(u|
z@3HGY#VBvo(A3(Yy>Gw4frE!k&CD%+IBsco%HF~8^qI4lE?;qVbNBG{yK(cDe*iu(
zBsA<!I5{FR_Fi0kLSj<#!$-e9ev<Lq)6Bg5g2JNWlG5ijwG3um{mWMkZS3}r&aOZH
ze8U+S92(}n8{r9rlYf8s_-Sf-M)c+D;*xk7`nK|2E_gowDHeSFr)2*j7d#0HYu2t+
zT&wh5E`>GW-v!^gcHQnH>$jb_sN@^0w&&>28`Muecvju2tbfb}+<yJ1{*4-YO$GZz
z-$na}WdH93i}`O!_HV)dr(C0e9juuDd!JRfk^j9G;I~)DV70uy$^$kjD!|I5xD~(v
z@*`7<%U|WnPgjBU^VE@50KAA&4WMa-Ma`>-Z^^RECQ0Zd(Iuhz)2K?Qsw?wy_j5;+
zDzHl6niXCch~CGU3z{o;^(J(p^`T%vg-@?*{MT0ADv+GRzQU{lWWTQhi749aUe>o_
zn*8!2Kx@}zEj`3Z2Ux4Xp-2EDRN=4uiIU^_tH5I$04Z9xAiI&V3Yade0&jBeBA}RM
zd5zO5kQu%Te8Ac&Nl!$r0v`KTfgY<>;7f6?qI_5LDp3A#75JFF3VgfNr?3ia@mU3i
z&(OY}Uj?M4Q^5by0I1hjfmS=r#5=^Olh_oz^GZaTs7hYMjA~A-0&%8sLsDGW1WRQc
zQkg`=l@pDFf|&C^EeqCtZl2u0<g4J<ScO^StQYZ9DCd1MXRi!Ob@Br|ee%m}6{LNA
z3bxwX4iBC~u~!C6b(PKynl*=b4H_|0bsRWGm0`wiZbM;)zm+e}A3HZtF3kMA3S3|{
zW$Jht8oJ+n)$r=cfn7--LLGo*EOdj;tCgpwi|?%h>?0!mRp4nPAc{6*>+R!G?C=6(
zH8$^Kt*}w%DADU;Te?1?m5}3?U61~@J_Dcc>4h!58n{0!fZCy2_Ws**zc2MM425|l
z_$P+xFViuYS6&6;{e+IIz%j*d^2-X7R1J`xObM=XCwsN}Xp5BYTVtOy+oq{I!MfBE
zDAs2%lf#LU6u#h?W)YfCiYm&9L8PE{&5R-)r-;utR5l&8yc_v}KUXTbh!<zLEw2K#
zq^@p59m9yq1yqn6K{-{&U@+=Zi(WP~yv$->WUp&(I`E~(wDLiRHshgX-jiH}0hkd>
z!A;KJ;kL=wg2hSJ1fkd8uby<XTekHrVYklKKN#`q4v*MZ`6!>~Goz`D$8X}gp;T+j
zHAGIPh5D&uwl;QdGFYqdG{m%JPIDFY?JA&a>Wnxwun-pQ?=d9b2CV|loX}JQ=ej3f
zFAgr*IDBRQ;_(hI*7&g}JSr;O+I+aK-^uz**EXvXrQacxU=>J5@0~@!_XMi4C_J4B
z%@qw6^hq@Z&Hf#hZTMl%3DpkCbi?+?vKbGr?hv9n*O~OU{l50Cf6NT*pFr4hS+~-8
zm^Pkyp%A4e@8#<>9T&*7hrMJtZ*Ge^^!0Q<qfBf4bd{Mg_5!$6@i?{I?rD%o<(~K>
z-7nP@gr>j+rHBb!99>O*;A)@-Ym<B@`K!=)_`xPk?TY%JDZ7P8&8zrdysaOMVoU4<
zG7Fc7Z*-pSdGf>FSMCq}lkHQVKIi~Ksm8J#Ihw3!_ez9GlPgJapj&)-L0$6KcC;}>
zn8a=lxbtxQsw2UF``e20DOXF%Ht#W~?aUgdA1iFyAF#LJb+_L=+@u6P64rNM=5dfK
zW)pQc#ZlfSL5TU%T~rm3LCPvn&0@$$WLdJZRbYcSqm<@P3s?pGXOO-U+ygP|#dtLR
zFNvuHFta9r29pVF;vUQvialf|@_KE#ss6=uHGygdMF>{`75uh9iz8T@7P?+x<y1rT
zqw!wViorgf(Z`7E^*N^}Z^S!XKpf0nb9W<fKyjF&1FB6Hw|i@m(*+Byq!hFjC~C-Q
zCyc8?VUtL;sZQ~rL(uKc;=F(i@&1|jPFr*M^Ln9sPXCqIIPl|o$8_{IiYw$Hdkpt$
zB}i{aC16HbLGt!h;NI6(>RvEG+$;8fw+b*=H7vpI0aN}wa&8rvSH;ZpZ>U8-ny;e;
zjEH};xEnDKr~?-iY}Wzm3ZHqnxmS{NvzfQDD*{-x#a%?4!_XYj%-O(|Bi|~u9W?E^
zbZ*divhl@W=&S^*+Czx)iz1l1nP=SLbdy3zMj>|kol}bnAAAmh>B&;%Djek2Dc2Gq
zVks93Wf>AIn|i1}422-@!bi*Jmvm6|Q!C9CPxA5N9`t99oI9`4FUxy7Gd`mWI`2$V
z=!J)cJV|5kl@HMuZ_^kC@*U|(NNIPUQpz~w*WM7G_}Lm+LXNunLKIf?VqC8QWPW}`
zBM7aC(I)cOE4rOYHcgSgTejh7&&;#-Js+>&uN=91&isNB<NvD7doz)@3iARz<5SD0
zmw67=1vu~N%*w~5ysPekp0^5pgZEX4=_T%Cj@ySGFFhV~8TIB}?a=LDw!7Gw;`dmV
ztkVYG^;z3gK~)|D@LnMz+(oFwu#{hGIHtOa=bDGZvR%KN`)%HI9(6wE<I2j1wuirX
zd376Jdu$hLtM`uf-DI-n{*;_lcu$W-Zu<eYLl3Uejx6a0D0W#J3Xt2OS)UhRRgCo!
zA#w*f|BA#->>n>R%$xDq&1IrqjJyxDU|s89O!4YD`E@QcI(tmU9honb*ko693^w}4
zxLrVaw8$Q_@Uo+CzPb#uZovk^lbT)3dym8M`IKEy0{*7oO}tufSVTk^CO$ugH_Y4c
zccxH?*H6}Z@b`nE?N4p3tJ=^TMH%g?Kk?aUMKB|&i6nG-S!uuom+yt@y0vG1_)Fu*
z=8pHnE9X=3(KJ)nx~Z@4&*(PpJ)GZt@UrVoU~vp5#>on$n1Y!|akIoq8q#lSqlRrB
zTFNH4K~9r0i!&V43Ui)UkK?7mB_00e(UI>a?w6jhsHm|2Vd4r-f6mp5n4l-LprOZQ
z-MN(GAm+X`t#b68^K)z-*?{fIO=glqyCW(pD$RC;j&1C^(3IAulG1GzQ8}(a+R1h8
zKeMN)-w+7T*(J+l1@tOUHKZq5UjY>-{o^TC`J-kZtE$Mc0$kc6QPYWWa{Fhd?xl;c
ziAznbId%a5IcQIk6L9s`UF-AT_c4%*umh28nB-MJJ^ndWOL`be5NQS6`h(#A`XA<{
zGc63o%>E&;n7!gtVEVO0MP;E{g{41_yWaT4y0^CHg`#68e~sLNV#@L5%Jro?p;B-a
zIQf#5aJGK9i3l!tjBn@o51H(G)lfg+I~X>mgROlck0Ka$C*J1VdHF=e>FLA$Y0A2Q
zA*3@=)rn0KTQtzwxO*%$^zP{fBIn(VWx~%*O2R4)_jfq!gFn`V*GH~@P|`{W?K}Ob
zqUnp{kvNWRmew%<(}i5ya!h(;pu#LY3A3TaKx)GwEjVQPJtt4TMjL`T*-<47HE-j%
zLNP0UdYG$O#N!DkJlRH%e%qDli_B1~xqD_J{b!aAdOzMmdznp(<*UngP2I`7&$Az{
zok&lR8;g7%5z9^x@e$~!!6j3c=K21c^HsBDsqcqf&SxAM_2Hct8Mz&9yz3(3x2^&y
zG?lyoe<%yA7h14O!k(Js^?wxcV<^r7EvCn9SEc53=SS_@u9@{5kHVf>?|r3DbG;Hb
zwXUsx0t|uSuTg3IEsK{$2JBTJhOQwE6O06z7)^4ey5M9ddVl|oM#i;z*V5+!nfqiZ
z@4b#4dT(35-reKw1N8^CS}j(PljxFwfG3Eo1oU=ff^nrvXTMt)b(08rPsiQ+2VSb}
zv|qdSt;{fmYozix0YgpYQbeG^h&VC)Zm7?8SvD&GsXJw^cL;QRU3H&&6l^IKSIzZq
zBfAMQQk(2@XE44^F9)iqt>t*_?VsrpVw;nk&uz1F%SWSgz6=Y8y=zY#+NESLNsp&(
zLu=tY@bqmhNHSmWv9N@vBg32*^~RYkDD!de%6o&jb*`E6?Bc85p2qDz*#_-OJAJCZ
z$$q))(B0sFS@x)wY>6>-AhVP1TQ-fX&FG4DJ2PZd5vF_W(m=~r%88bNC1do;hR?UF
z=1@e6g&Fh1;}4ALtDa+C-A0;Q&g^{ghp3?$h`=T{=?htFX1Vh1B38V$-2`79kGm-!
z0Qt!bZzncSoF$&MigxIpUqM$9{7XD!RoEs5iz%^Z-~wtJ>Kjr*kG0RiR$YkzeiC%0
zQ&HsEHr6JpCfTlC4-LglrUv%1$G3vvag6S4Kb&YilPdRS#%C3ebnX56hHv^1-M_uL
z>8JPa|J=?v`X(1S%%AIrgMuh3hqXnH^n&umIkFO|lEjQW;NqoIhK#3fhJJz_pk7(N
z$NQ0j`a3=rBD0KkR=l3tfc2ST+zz7;FF@B~ktVx-OWwFA)ZqPb#1@_SzXZqs|BnYM
zB4C-X`8fLDS)obQ@9<`1#>G)Ogx(QtFBPklj-(!jW_TZU!1LE(*MW1}j(-*mRDGyV
z$_bdO%+^o><bJEb#4|XEI-5R<kSjl!v^mD+GZJDJ8`G7@d4h^2MG;-_u{cCXx;Jk9
zD)u~c5Va`N_iP*pC5E5khW4U`!wYO53-D8%wcYUn64P7%+z{pHZKk9T@%B5aS?!aP
zSrZRfHN&xz09q>y(r+w`^maUSPgjC^h5N=?lTO|aYBrU%6IF54Z6bq?UM(`=%@>n=
zLb^Icc->H(V3gX^Bt97R+^boNy-}}Xi=5l;>+4(S?tzc=eq5AQgs*!ttbHfjm#CT@
z7Z>;YK@$GvO?=RUQ6A58v}>ovaG&GO!zYu}PnSG@t`PK33;hqk1^g3tDQsA~#dcTB
z2K`;Jt!wo*=$BxI?_%E6%QqjFr8gav=)utyR=y8E4x~5?SSv|v$rv_{Q6C38TKBGE
zFY=M5s4{XsTkmk6YGFlTS~h7Df2&k^60<cxoax;#f*;?>Wq2P885{Ao0;pRrC@tE-
ztM!T;Wy^)<y%M<z=iRp$jbB8@;k26Up4C+qjRZR96U68pr*AWR_EqireVW(tyG8g#
z&l%TSDx>7eO8xlIGlgz&jCf%Mke_1RK*X^&mD48Xk<fuTbKK@8Wq(90JjpU0A?{ut
z6HNPgEmadrpCql9xBGWeG2o1Su|tDFYLh2bpK=ntU*wu;95zOV7CId-vl?NnNWUuY
z1LTbXijWkxlUOMl)OfTCC~3j-fWy=@Z55~<lW#Rvx!MdCi)rx;0t#{<Sz{;Dfj@;_
zEQBnx6E#PmZ~2o(S^0Y<eB|a(&X?(h@jEZGdI0%r?`@|7{=O0#b|W-wQ`-H*Z{Cc!
zx~`3PIqax(JQwk|zFc({B7n2DaKDALR*H!!3V;mlUqVEQ%M2aSqKhqnyzB;wK*U`p
zhNmVjaCU0dQ+e{XO$n^O7q%93jNwSwkvi@HT)Y6e$w++E<mbW^Tg2>J;rRIH@hGR4
zyBnAd@m^6`gv5u0sFa8Y`I*Xs2cE}$pO^=HNVdQ6V8`RZ(%pA4zobLvDz95M^kD*M
zkP)#nZen5MR4sH#oZT-)2=I$^I3x=l*9Kk4{K-GD8v?d@jGSD-#Pv-z9QRhl61)$d
ze^m6~7Me}?0MM?kh-05Y#ixd($Ar;3XGO?(sa+8+paG7;mc}f5-TKX%k(cV8^ty1u
zq75&^3%gtf!c>kIF<YveVhCQ1_!}|g9D~qn2=L3`1HVC1|MrX9#M4{1th;<A$M*U2
z!`m+dFrT++Q?RXiiK0x8HqnPe1Zc3p^SD&K19g3iDKs?#rcNo1;f-s*fUmnqXsArh
zrR;?aBA($bpH%ELEWzP3jroaYqZRu*XM|qfmXlsXA8V6$m>F_^S6rscHy#(vD|R43
z?82!3X_0wC0Xg9;riR`%e`-4OW0rpz{?mniss@zr(Z7(IE!EUm1#WY~qEvL<oEyG0
z&8nV#%UKx`zKYqQuJ|Qfu6hGpNLWmV_GYk~{m%9=qK~<Wa2>s=mh@yZXUw^pnnB8$
zQoP)>vCqg%HFAZwp)xFGR#)XLXVJ^4;-pv7JR{qZeLntFEu;Qt0OLTLsPfSOdsA2w
z8Myk-*+SOlDIbG@#Z_SB*d#sqwh_gy0KYPnou1UB3oiSJu=gnT{=`zR_pQWA$g6$D
z;gJxtIS|YX)ZX7*IK9&HG?-B0;r0HMg52g`UXoT#l5V55$+f|BshW;ldASI>#BM;w
zht947??%NzBKxI;1V)ys_M7GQmZOl}cTCP|ce~R-Y-VU`FC;fzEDx0L73ozRwUNK7
znrV1aUHaZT(1Po>?Jo5qt(BXj*Jp--_JwsemP|!DJga~M*j1n{!uoi*&vae5XXVfP
z%Xwn@^Olqn?AnY-ubDfWhAm^=dxA(tf7ZSF>T7jCQQAHAFEge%Q}yl=y9Ftt%{NPS
zlCd3`dg(&iM%V{Fm*q5B3300AgmX2+48&G4%@cYhP_^*rTk1i&#C$qG#EAAf|LWC?
z!NqO~A;nN)m^2@h`$XAWOHr09Og^wDP0R1JZ``&6c}W^S<RzOa?+otDJ+$Y*#>Cu1
zB{1cwt{~k28;8H;J3$$}3;8ak!#q+Wl^`V21mPVreQ(kBx~DhSH&)=$IwEXLrL|4r
z46o^e$+MDao@!TO(+PCy&4^&Lx(xGI<!AiV5v4xN*Gi(FZIP82@WjGqh}MAt-LUV%
zPm9oT`B3^<r23NcReYxS>CLj~$t&O|_A0Q0oWkb)Rx`NkWu10>oKV&995<A}H=MWh
zsV;U8ymQnp%AaIyi=3s|BD;F$F(6;?o)3l_%<X(cR%v}$3?ubh**GCG*#)aI^$?Xr
zp$V|}Fw6;%l@_){(9rI>Z*6X^JVBd7ZkyRN>B+$eRKb#gg$kBHkAwb0K^A*K>6<S+
z1Aoc&`mB$y0_$RA&wN37LP5ZVnH&x1Sk+8$zzQ+vsa}5NEM}t=6;U?p)<0smW^9I6
zG1@#_Sn^&Og{t%@Zpid-Zw9FA`jnPXu#-rF{Mnf>A*lXI7?fWL(M}CB5lYlfx|-Bk
zpfm4v_QfE{+E{p;ijuAY87;fO4?Q262BtFK=V*y6lB|#KFDp7jpsr{pnl<mP)WHss
z<|_dV=hj_JdM~8UXD=uO@WCG~q#DkQ^tEKWv*^t)xdUwm&fswBb;_X}eduu!Ch-zG
zp7%!oS!KhgJ2egdBMv29Vaquow#auXd1upiCe}FasX3!l68d20_Rz3vS04ZR_~x|}
zYhyP202^~JxvCKI1-Wb*cnJxi-jC}-5fjAqq<AFrHz*h!_SS5R+?-*+<|ky*yQ+B8
zW+(+n&q)_O)?_fza{`|3&=#;I=C-L510=<1L}}{jan|K3Ep<is<4Zif-Eq88zB}Km
z*FWlJ#9Ekcc#?6%)WW>pb-<7vObS+My3~5e+NFJdXYwC^9Z>wHx(dX4Qq(4T5JHl4
zd#1!5OpiBB;UnY&EB-MIogUN)PPqvKyMC0g3TW)B2cJ9&#`|w-2#+WJU0wZ9bz{#2
zM;K-0me%h%z9$#SMI<&^!91Gglr}fc+T&S(+yG=HnU={^+I@6Ho1fmS2(XkVJ?C}%
zJr7tJPA@$XQaqFCT6oiXIAbMxi6PE-QtLzt-t^$~)N7=m|2xkDQ)4U1wARWT9q=<u
zKdrq7S(OK@Y)&bd8Am}6L|q=DTct(Qcg!u*la^8tN%Gy`P+FN#XViVqt6`=gW^+K~
z{-5#DrA}dCq`ZI?pU0a@{fc>BuN9U_QVlHIXQ#+bx{W0kzYw8+&LgLFVP(Iy7?Pi~
z_4;ti!=k)UTVb=N*`g1&u<)dk6T#c->IJMV)0sidxq&b8Z~-fC={HNKzrxX2t0h3G
zf>m=EqMhhxO{8LKeDd?BG94b5kc%cKi(Uz%<}I9Ss+&Z5Or`m)A{@JqpuN;negs=K
z^UIXBM$)s6l0ZaoxL$hxbmaB3b&=5pM}SZmdj?x1FjPb28$^=pS7#&j9+Y1thn$3h
ztH_a)mj`YyDKm_JLfyw87N?f7wY^^Mk3Qy_jvZv`Xf5gNj}aLyED)dgs{S=Kp$Fra
zwI^X8Bej4Za%6E8O;*pQR@Su?gF0-zJ%bgC-bcI7#$FI9C3?=fa+kWN%CE&(HTzv1
z3WCXO+@<Ur&4WuSNed|doR9tw@1osdwfP;UT2iCr8$L)*&w4H-nCcSTLC0kD8gfEw
zWL-u6^h#Q>K$Ug@S_1iP7Av3P78Z;@HuRaL@Hdh(+NoNNgN&y{R1n2Rs7kWW^dAWG
zlHgyXS73y5kxXK@!2UAE4>lcW#wxIB$`X}egrfOjMylE~o>*#R_!W4JK`9+9CFyP<
zZ99Q$&Wmnl9GmsoFEXim4kff}7nCgX-o7dg)UL}94xvSb1RqfP8za@thJE%0xMiPd
zy<IFA1dK(oS&Z~HNQ$W#gB^=yOM+f)KJ<3fE!}ajD8{Mhh?!RudDq~>H)M?!t?S93
zdQSJND=s&RPlDo~1=tZMaUi%H$FM=NBiCnu`T}e1TM4=NI!|<ZvF-S}zK;R7LwhWB
zq6|-GdffcAYwgx&56|p1Y<}0L^fd$qj`tupwk8I|R*fula?v~cf~@`Xs3Uq?!OB$O
z^kOO+r#7vpC30-Vq^;B^H61S^aJ<aRd~>0cD<JJ2(<b~hvoQrb#6+k-ca|^Iy?oVg
zIzqI?yruqwGld;7WWb82SWMzZKZ%hb={^OMN3LztGnT=6dW*gZDr;-m&nY+KZzgB4
zBbPgA>+q4E5~L@d%{*E5yj7b=u)H}moc(;-Gqs{8KHoRQrf{rj`0E*+yR_QS;I2)<
z>`i#}i+j4%FFr2_?o8gUpQ^s@l)b{0%j>Sdo^Q=vOz*55u?yC?Ia<KNyV3SKPrY=1
zA<PEvgi?xUd9uo<H%S$QJ9<b_S|U&NN!9a?HMl_6%-zFgeg&gGSFxLa4|6^>Qh*`8
z{A!CyjRfQ~n2BD}yXCg<7F}5ZD~Pq#E^iinpjvbvQ|rdoGN?|2U7kBfY9?SM;?$a8
z#(u1zjEG4wY9dUiDxGcQRL)mbl!xLp-|@?bJ^xm=MZUNHH=Fw}Quq4}xm!L?tARP8
zAk+wQGGnewI7);Oep@$aUR?}1c?{28Z()K7?N&~BRFmT5UR6SP*lqbvk#oyaT5xdD
zUeA2|pV5Sy!J9Iy1{I~(VGx2??U%xFLhNnY2Qy4{g6zGUyoT203CAg}XMt}~;=g2-
z=xuT~rZ%CS&Ld1-S?XZLP<8RYyw^oJXPnpDE%IqB^=21Av^F12=HNo8B-#$g4YT^q
zxWc%FlXH2^jGS2a#LeU`@{h_=SgUfT`vW8Id!nRjIpS5oAzA*}X8$U1Syt}LF|!&w
zVzSpurP=WeLzcDF=xrkZIB0J+o=q&D5sTdr`xurv&vu>(Kd=q~rLJR5>%bN_DTXgo
z`4vv}1sJaar{CkG=ir?=brnw5>7O92IKWiC@LD}g!hL}AecCECj)mqbptg>+qIm!o
zFtN`|{@^7G`VD@!?-iW!bBN(Drgp3X?X4tv+#5J!XbQJh5QLKNSD`JMTu@jAw&vE$
z^n+=l!(OYvv!Cu_o~J_wSgE?<1YN3LE51`Ldq&-8Ulvez1WIrP6H=tA!l+bjtR|${
z;b~j<^3fUY{Gzwr#ri}XK7)6sw(#n=2PV&oa3@04Z8bJ3EI$TlSzS`y<yGL|5ePPg
zx9q|0RlqHM9%+kw!vvzcVCy&~YiQX;Ydwx3AQNy*6q~O)MKx;xvv2_|hM)t>^od5!
zF;FQ<KbhT$)?sk3F<CFcy84poJr`lmx81&IR#_kmw9-8*u@&h(Rb5C}vPI1F{-0)x
zx|Om8HbhfY4n`R>QHoK6gWeMD`WOmg5~(324funoj`Vwd{;-c4Zb2B+?=Cj0z1Gta
z9hz<!E*226Z7cq5`~*Tid5keexYRgkeYien{|k|7U3KMjL$1>2h5wvu=|0(g+Qcgw
zauv8qgAO=$E{ra8;5JjXiU@A9LZN71RTm=OlK6fVP+hEW?Y@%3ztTs9$<SK^l#r;2
zD#$);-hlnZtEUu?KAPp)XGB^|z4B=&?3BnnM?v!RIj!|mLwQ3`z6Pu_Yd;OlnI+v0
zn&gm}SYGERw}IPCgZc-zgO+snbH${76Q-38Azz&v8CF+YaMfqD;7Q+1B;{e@ds}1z
z4Lpy8OlVzI?~vjuSrH4L9U|byp)K9z@5c9Yt-~cJq?qV4Xl<uTGOXV1<7T3|bRm5m
z)WBxvz*=_CcoC}xtpXi-LHEbCxuM2xY+jG}u?d}6+L}vFumxlc*yZa53$yr}$Z5T;
zI1uZt!frX**cTQ>QYOc?^BFRjPL&>iM$U{z3yqcBMN0P=y?1>!4pJ`W;WP6+$7fn}
z2c$OzhGRi(%8R2|wSZ&qi^>8Oz60I0-+jvq>Ikl;YhF>}jFaw`{nF$wA<rNg16L`R
zp)xREV4f<>Lh5-yU1vr6i)oteM3ZH~GMkia;prGR_t`qUYC3Z`#URG(bY^t;sl$N{
zr|PzzC<Ul8X*g^{5@0PU_Spd^)Q<VQfcsLH53T|Vs8H7W*$h{fcFTcLDUplTlbU4T
z{@Yzj680cnWslIvY0I<+0<ka6rl@ohgP5*iT&!3EnP2mMRfMb|M>x0kX&x!G@nf?9
zxw7;sG%IX|O;3B~r-YWx6f;qJdvo~Ne&;3T{f6<ve8|9lxN1?hE6_47J0;M<9P}{$
z@S(8uH|O9@K?*Y%SgEh2j}{9wW5Za9EDg+cKCfGlz+TwICI$<!x>7sY@AAWB!`2pL
zjCh6XR7>{~VUnzo#Q~X@Eh4j*o@5jE$(9<h(Gdi^npr#8Ie{$WgN{`YiklA0{wr-`
z%RUOCQI@la<*5nMQ=3Am`==~_gwj?4<t94;N+-~Ae~N&m=G`q+hoVJ#Fx$i%PZ7{m
zI@UixKPo;`;4>XE?iJ`#R2UMNi;SSY!+>{K?Fb%5902_ZstLO0yq`(6xbnjg%#wyg
zi8QZ5O9mZL(JE~%sM?H^qK6*jV{&ym`(5QyG`4NIq4IITjD?=QQ}ni#FS_1~vU4Ma
zzvd$M(pvXpCMI!7Nbnqe<kKbD(<VoW85Ax~gu;uV=aLSZYS27-e=iu`E?3QJ=en(=
zr-o*SxL^}#YDN@%L11Kgopx~oO?XAn<HfE=2sfaZxNXzCoCH6?VMHE_gn=x3h5qy5
z5+jPcER(8D{UZknDPub6sxTcyA&Qhdp}ti>>$4w35JsE8hFesXAhi+{LnpxTZYOS&
zW6@aZevCSQ#`Dco!{wFIfzVUj%Fy&JQvmYMEB|zh$oGivp}h)ht=DOS7IPk;p8yw6
zoA`y!K+H1*$XK+_KnsG5nq;-=Ad^>+aZAYc6iW_+uL@mi%VeN8%d)5@<U5iMAJx9w
zbEY<KZq=fFzpi9Ax6nhLPxTXwOJ+QCl{)yKHytuup0Ag9QWPM9#F|2Y^*UJU314ZH
zA4C?ZRZae--jpA!p(I+R)N`mwW%DChQZZTQiiq1viy6*5pFJ^6IT1{o)H3ZxY!B4_
zoyWg7v>-L}#|IOHzaT!KVLY_Le~o*AnCFY!+O##>QE_l0+i{*G(tnLUz<~SP1Wmri
z)zUgKS}?!vdN9~5e|*YkAGjP#S|ob*n^b%@&YZ+Hzlsamm8rJtp@BW{1qR(fixst3
zZ}&jcJ`t>$RUK77w-^pB1~l0hK>m{mcDk1Im}qmU;M)R;@h)u4%3f5Io;PFBV9HB-
zT8bA1-WleMoQW#tdlr0*@=6o}Up#?%`3|X_2-}8CLLyp>$l796t4{tVYmxw)NJR{q
z+^z^SBp}owL!TESgM@`3)7hz_8deO~b->u*$(t`bh(Y-dF+zj5F)c-j1Ncd*7bdhK
zAp%^-VY?VZ4#?yu&o2^>BGd>zJ7uLPsj*-l*S^)`gkEjwl+O;>j`%NV1)_EPtCqIE
zY8Wszw(Dp)(9AI^jKwyJH0o^{XWVR&y>O7omv0;r8OS&Gis-E{p1TP4vgzwv^rVNt
z4t_jZi(=l->`vDX<hekx5*T@OM)szlcX<c2XwkOMtcV*6+r@^y0-Q>~ie|!X22oFU
z&$357mvTjT4e{q$U`11WQC39VOYMZS5pHcHUWi~D`3^0Su0*+rOtwDmFO-=?6WVxL
z&8eRsl}?TC8o0f%n0<2c^e}_ybdgi_Hlu86rK7p|?+i<HRpHE!JlyDA+I7r-Kodof
z)rAB-dwD67;nMB(0t=}+y$vo7us#A`3<Tn5e&Fl`|FzBL-ispVTB*s<ZRyR4uV9h4
z&%n8qcJyIUdWtDFDd%WSgDAT)iBRG!WNoA2$^L9@y==c{WG^Q`UcnOXLO};<GQ(`i
zPqYbA*Mj`#20*TZnJ8EVm<gSzQ8zIM5{SM|*5Adp(GoMcN$GJ5E$Tf*GoC($VAol2
z?^ek1B#21dJ$&1=;?}1Qz3m)E3Q@m(<w-?B0GIcKMJyS2dNxHk8XyLcDi@TdxYBK-
z@{KkkHMw%I<dTP+gH`~8l0<r4mqFK8V3!cX9t*iZRJOheF0^~H60Ge@@Y=ZKJkC-#
zeZ%aJ<dil&t>Mt#Eu&Ms7coS`xp1COVIiD0dk@gC{&K_#%1&CV#f6<eV&`Mp72iF8
zcTL05W25@${0e}oPKC)P@M>>5y#_P?RWvG|5@Fft>nPV+WF<Q7y`lj@cHA6a^>)~;
zp~??jYxKCH=mMuHBy8f5fVPcYcsBN8zxDNo-uU??8?_5a-byMxdGQ+JeYBq(VLj~6
z2|FE%fDFz*Eh5z7x%~kRY1I<fvDwV?^s+O=L(}yQMJYEW$Dzot?gJI5O~?57JDKu?
zkP@%Gb-xg_Z`Tyg0mwu;=v)PvRKd7HMVv1y!36NPP^`eNt}?`^VfzXlb}j*^HD{iC
zNe{o|qV=7Gq@7UrDG}`+#j6PN>PVWH%!d+$nEUruHc_>PLUk{l;s%9&s)j2@`ogl+
z6~(n3EHI)zxk_p%Bp}z)TG6K1P0-tA_DWCjJ<1s&hDZI{sfPq%JpI{p_P0<~k~jD`
z9WFANm|aj0;GKUiu3w=i+?IL?2o*tZloz{cTc<*<78M66K!3upA`jlcvlI{bdP{0A
z%WJw)E=9r|JZ>YEv+`2JN^3G2H^Saq8LDcRMEhMBG?IGcLp9y4R7+-EKX0HNZBR2P
z-8-%xVDhn<Lozb+)(wqHalWc3R)I+$y-OmMb|j+7_nFjCc5e|A&)*srt$1NTstZ%D
zTdDmIDUSV8-AeDaz7Z&X;dTCmL9AMbl9RuM>xy$%5~I;7rDQ@9@_wYE<MC^yFN$D@
zI12hEIW_B970>ct_!%aH<d)==lbp_16;nthv^JdE3S#C@6@6AwD4S_;i(z;NNwA!r
zr5@%lgC>HQzOnZwg7zJA(*8lIlwvQ7VFl4*<(r1#Y`>=rhL!|m93NqArd!aWFZ$Gu
z8ySEDkQmAi0mM{2IdJ+#hL^}OiGnPe%Df!jz?8*54Om_to((DS;dz|w4GCH6ayMe3
zl|GUoejv*)<mSq9SpL1KtAL&XSbk?4l!uJPY_yILoy4hjJZEz7Kh5?-`X`1*9n)Q+
zbOv8U+j><@dW;#r`la>2h0T0n_}nqcZRs{J8pffh`~2!p^Uh%UYs<@GR~|hLZ9wg1
zX;2g=Wagh-UZwS(uV;xYlAHDw2GoV{$DOtp{_3V#Z8P-OgH|BId+S|H9u3;vCDp)*
zr(_wdTP$^I4^9bIk1W=9)<iC5Q;QC{g4w%ihOZdPPtqnOqSbmto8f-ZySNma$uY0j
z^z~HJ>CADu(EFBQGpRM!Wx)Di#q`4y!p4X&>~_4%v<4ahtXz_BtcLwLTpAjaAa#_b
zQ1?sqL^SC(x5?tUV-u`YcvrU-i;6oJ(s;Cv=#Uc`ZB#=J^B%WJMPM&VpIZV6>`Yv0
zlUFgXo8({4pQY}~>0%F$@00%la%O*;ZZQDgDZ%xdt=r+DGidecbCVLCX}CJ7jSlT&
zb@E3C1oSqPCY00N%HKj&8j(5==)?Q+J~P{{Yo#m3+83@>xl7-%SmE!cw^xL&t(xYB
zTQsaMBo)kV!GC=>?#UbR-nG70s^KPA@s>nMsj?KQJ*X%Qmu{<qV|66>X;KMx5`qOS
z=|yPLUu1XXg~%Z*Z=BY46F-63@Se<_P-@Lao)+zYRt}NQ4c{76yTYv+J=t$YF!a{m
z9cEH`O@Rv!e;;Pz6$`wO9*3!RgAH5EIJ^`w&Xk{I4HN|EvLX=_$D&Q8N-v<QynrWY
z?fyj>^1=W`0oFyxj^)o!)zcel3Ko!;?mV1zuN`hW9vmh}z0_76NY#)J)whTolWnaX
z<tlJ?dR?vzX6Ep;5r1b{Cfb<RYSx0HwPISdDDEQXIPQJx6QZv3P-^K6Yr7v5T}}?~
zj6~d%sy-(#Pb9QvTb)d>6PaWez)aXtysLaK*GxV3L`~W<n`cKb&oKb#VmR1~eSzLB
ze?zP3h4sEsh?)y|CJk<Zc2A@uq=&(-c4M8%M^b&lLc+K*=XR6Tgfq$=%!Q7KHjfiY
zw%~ZSU%t<*m^W54Tk5}VY53{pf@N-aE>fS?>J2Zk;CnRL>e8Y_wh%{hF#ft~Vlos_
z01adGpwV6^%b;Un3%T2?pQt_1`U0O>COr<};c%)#J<w<O%b|HLmRl*c3yCU-2wyR-
zOAjYj0#pvQ9RvQTDOJxyjbJ8%vhc9^bA<^Xf(mjo*#xOH&1axmQ?U0l5$vj@NL<X4
z3XJ@xGjq}lVR(&$%5vEy)0xy%qJY1>Cm))086Z(``Lo>NOj`W2S8x{NHSz%s^y!5R
zk@Fdn+vH0VU9S=8tQW=Yw0AlJeuDHQ44ZE^DT!j8MNRVK(4$Fbl(PsGvsk5xm+umN
zYD>Ro@gw;XI}(}P<d|=lKjpKtq5kF25@B|X;5E3fuHPv10-~d84LmIv8VQrEx2>;<
z1`de#$|_s-kkvXg>|nf<N>P!ROK*rs_nPdBcig;-oATM)XT5`#KO=SsxRvOQU(PtZ
z<NA{$2Sb0%)x(GqCXijYk;!(;@OxB@R0Cpy79E)_shWw4RhuZjP{<@Ap1ONbY7-nC
zU38)f&qJk}Mr*n>_ZJN^nz7iF%XM{6I-TY%SNaW(@vb^<QF;ma%awaz<x>_FCzv9&
z$X4R5vKpy}0JS|}g_PKIL`dHx{|l)T22+FSum}6yGA+Gw%5pqoBCFz<d;gL*S~xCo
z9$b`Ur5Mg07c?+4-ETTxLs-k(Wd#`Dg>?F63U(41&)*_fq=Z5C@UBpx_=5fk^21Vd
zE(IynMR|h7iAEH+3Dy=LvSAm`oE}0eKv(5^U2V%)x!rK9Y}2;aZDj4sxrhbSYd9BE
zFIDfo3cAHEm9i%IINn0%ml?SxC@)3bmu})C=d8C2r%{VpPQ@Zj?3|YvEqdfZ#^Lbi
z%LEb!5iL1$^h_h;9`xwyfiSCF#0QjI1$Ij7RAhxL5}lXfkR`q^%L?O<Y^24EZ>a`Z
zu{8fG9ej>K9h5#Xi`2lcSR{vK`*k(c--q)r#!+5_O}=n-@~da3tyKla``N7==+2w2
zbAv$xE+SkKfYCajDAT1)^j3XySni@pZ1{=Dm1i)vJ_N`srxZarZ!Cg)=RpTyy)GJp
zE3C#R1!)x`$z*YAlXVNK1`5uDJ~@CUj|IIO>*_MkS=OgYFYZsDG{)Ilws{e1pg`Ve
zt7RiWQ`_jppT?=b*UY%yMJBNR1K|FD!oB@>NWdt>YZ_#INnnsBKS0K{VRTjjKg1TP
z2DqM8>OSq6-cDDQMh&zaJR?YAsye*sF?057TY-H-+!V#emlPaEE1S{C(a(`{bnLx|
zdn9ke>j8Op=)5C#*i@p5JI$&cGOciV%e^>YW@9;{GLN}9u#oGNWhhY@^?%6w^7aeQ
zz0x?S;_rtliF?mnzvJk7P32bw`Hn?6jkL=7zh`0PFdaWJ-TUp7e>+xUL|=<pGR{SO
zS^ZZ6`QJCh;wjjkTG9UQV&NAgmM}6~x=1n4Ma<UR#q><dH%nH5Uw@OrBG>MLZmt4l
zUE*|D;XMDNvIf)0hmIY?z91=4`H^MrBXy;kNi_cowDIZDlcdQPbSLOlh|T@*ICS5W
zkgHx^y~Z_v?0!ff-wgFn+F^^S%aW+*x^#X$H#j#RrfYGL`SQh}sYF5!nj@7538JDJ
zt-77=Jsh7Io>AT#BODJU--;VQzV*S=0L5<y;K5@So6QmL2E;Fht_{rj4xuoFsCkpG
zF3Fs6D@ldL8ORM>`E+*RGimF(cCqEn&g!z>VxE)!=!o<48JE$$r0AbGcWIX~8m41b
z9*~C!b$V#dXvy2)3PhVUwzxE4rsIxc$Q;kNfS(JAQNFaBAv^21cfy~*70+RWVD(?F
zp3v_w3cCO1HByNDXLj!&#nkZXNc3o}hKtR|9AQTbPhG2xv1zttmlHEfd_b1LJVRv6
zIz<^qgxQ2lRK+Y+5H3E{37AY>SW5N3z#3vY)m;iM2@J2#SpLZ=EX1^2;Tr}f!oBcf
zO&oaE##Q{W^R4jfIhYj$BfZT(M+Mw^HSl*sR=Y<1QTN`xMC1JTo`3FRECh)dbziKH
zYNS5ZQk4Gjow#4t?hDN}Jkhu4t#Wd}RHk{VKQ!CwO#fo^{<ov&IgD(>^R@B4*a6cX
z^xGeZMy3*-)4t5wT4u5#!7Cs?W&>yMsa(Y5CpkiIU=AtvmZdMbRo4<-_>-SfU=sgK
z#WMnAgre&CTpf33lP|ot_YVv9^|R@zv1D5h->G?XU))y%(CFU(B}<|786nk)E`AqC
z13gji8b)2JYX^;mjnGnw<GLk=#gARI0(ti;puOaM=-Zy`y{DQ6%$%%joUpI1sCn>t
zp5tEDZd>g4+@+O81GFbJ>CWlmcX&SNj!T~{e#djK;K#_7W;6-@MAe!x+&E=FSe_Bi
zU86Or=Hq?lsY%cczUddrmp|s<G<UD;zl`ep8q)Gu(j6ZPr+<;Z<};{Fjch-S+7c>v
z<zoh|%n=`ynf>``zElgc3NL^m-K<u_t7^_?W>4U!^NdWl`s$a%W@jq$)0|Jv7XtEJ
zs`a#3yZ$x*KF_Dj&%bm!Goy{3c*im=yTr@xyHbS-bbVCHtVXT=q30i!$o}=&dI$6F
zq@B8PouMEV(pvL9qwm4gTRL*)!n+Z6312?UQZrtt64u3AjlMHN>rr-_ANC$Qr2N^p
z#v<bu=Xf^f-PqONPDXG@fUFMIz~As<ZMsyAE?!~|mfv2|xhT<*bCzRxD?FW->&CM{
zLZ@e1cIfVxXY@7Awc{!(WWP!%qh8&FsFEE9@fH^le=R^}%jXB?XcOr;MU&g*MsuIT
z(i3TVX1YGY;bE1CCFhf<6tn?n4{Pvd(l)2rcZ(IMa|7FEJ``q~$}HRdyz1pK+Ibgw
z2i^$2p<`B8;30X)`NIu`aZd_~nscS1beH6D`LN0#`h%gQ4S|*|>9n10TmRJdnf7F+
zrj-_r9ZH%D)3Ndz#qW7l7k>r#<|bFI8<;a<P29&-|1G{_{^ZdN3v4k{bs-P}u4TBe
zaJ);C>oe=QU+lGQJ_x6I(Qz^F-|x7k;c9*-54&erJyEgfJNs-ZfzcMEUp$|;JZv7G
zUQG5AynR;OJjSq4^`jv>(-SmAd=Ey+$6?W~S1*4y@f|tJ4z@ng=Cmsp0iWZFF@V<<
zt{aLKtHz$Mu6+?t8<}n8-Rm3ivLmQ-S2D)}wI455zkX1Vkr^lJ=~-Ipj?eu3C8E+l
zJk#wC@Qozje2c?qc9d`EmAH7%XcOa>#^b8wy$zK~VG;hMkl_5lM^u>gRAHP6Gd_gR
zk1(D67V7Qq#@XA%2&hCl4TTxo6qsjlFP>G9yIuZnb3CYTETiKeNlfH#wSzMJ{EMcC
zX=~8iPT+luNA3J?5;j6gwxg=diU!BETTQ6$!c!;SZGv;RFm6|ho%X!S2hWr4M*hts
z-fI}nmJlGFvja;JM)Um3)tn{z&osuq@#><H8P%<gbuWg37L7O0y41$ssBd}M&nT_T
zd*W@`GXcoU85M?3eT-&{Q~jo+s!03(Iitl2{nMQC`9&EDF7J|%=Z#Fq%-cAyfw^r&
z+?_o9_AT!~#e9YEd+kxb%U#SvI%LUr;GjY=(Ei6mA0HQujX6m?dh?w^Li~u<U+|iB
z)Ey6(&pyOo$0MB^A8HjeRNs=AE~pcY&i_$pi>Z)Ak&So73=eN0RuG@1jq`ZprtvD|
z-6wV)KC#KyFIg-9O4<*TS5Db)%sl{Sbsw^zA2Q&&uVLCmJ`N-?B3TIx8&`~)oXe|<
zlb+3d^2nExvl|@5>C*h{)7d=X`_VTIbqU(DD^tz}7c@0Cm^Hf_zm#*DzrMy)JO|`3
zP?`8bM7JS%O5#I9d#V{JE-es7bn@-;g*2XeOA}+D$zSj-RN_^}JYmz(d_Obo*}mV8
z{vjH*S(-dq!ab%5$d69_KOrt@KitDS?%P>^ICnBPDBnh#@e{e;#rzie{XoKhDR+hI
z^Lj@H<j!9wu(AiNc;w2xsZfQvf1`(i{|0(Mw9qCp=^&P$!~$Jb0bXMprdE?pyv}Xg
z%Aevbr=oXB9R?X$&EcoN7k9Rayi#!;k!cV7Li|HY&xDi*`XJ#V)nb)-Oa4U>DcRbl
zm_O5Co*foeHUiLYz=6^FVCtJFwZCLlm;i@If#2@uXhJ`h;1nb5i8fC!*PSgpw&k$O
zwxh3Mo*?lD)=k8U6^jRh6J>flTsu|q{kWx2_A6%UGfaJvr2DDxpT5+=r!-?z#1~e9
z{6^U`7Wfn*!DlylaH4iIYQ#>SwjhSzZSxnfRslm8Q8>Yyx|P;?&^ii6v(IF?O;#Y+
zRrEVXy+s4&g`2sl)Gg9;3HGl**?6&UaUiLX{HRrafOGT7%-i119M#50&KZ}9nl6Kj
zsn`=D&A2eAkW<A>wPR}oN`F_tKE*(~V{{eRZzI9dMuxGg!1ELV6QFs+i$X$z;e2U9
z*92eoRFjR8`Cu5ZPdhZI@LqZhx+zkcv`Cj4fVBc_Y|{ymq7aqF%)%ic$JQ2&fgm$t
z6mDoidCSPV5ik8lqWweRO!x@#rvJK*rMW(jQ7l{#mxlxYu7YDknU?>&BAiuZAf?&1
z$W4$H9N&I|TfYit>tp2V<k@zbp1%mqoalg@ipf+tc4wE6t_n{mt<65qI{>8~e#fn0
z&9vq34V-buHTVm7E?2W>t$FR~yT}k4`yp$hoVMr-CsgFy`e<Lm0P6Lb6^9Ce%<FPr
z*gWcDzuB1D#b%CKg{E80tAQ}0zUx5H&6>f`=1b?Bl68787hk}ouuh|fFR#C1zDjmC
zNZOa$Z+omnaTE>6;rLDu6G%f=wed%|0>@PJ5y}Zm_<*7XSoJd_Vkz}J-<G3V6X-cK
z(~)Ro+IVKch<Kx=Idl9S%=o(RO^t{qtj$H<nB{{GB<N5=e5f&@J(D|UAUWwdHIC$j
z>4vyAq_jT7ogo(C%|mefUfm~jn<3dGn?N#3BKQ%5BYu3dyDkR*RR0>H3f_VDFm(%3
zbw{x~lq#xfrN79S<6sCnv_z_AAH`mzFNh*Xxioq2$8F%hpO$Njs-$}})$1&C(r$Cx
z8#>cW|6D@N&HG6%^oVx^ExxPV1<2#5KhRozX%iEC6{#NdRA@+t_O{cM=0maT$O$g5
zpyw^RB6_lpV2D|iZOzp?riUC{N_BJ^!Y25-4WYZA<Cl4U(OGw%`G?)g*z$wYS1VY9
zYhZO2QU{Qrld6i4_H&Ca871iLpvAM)&8C`&(Gz^6Ck|f|fZL+cd%pj(^h!STh`nuk
zWuT}c7k@|FweVTsqd@JGx)$eI{eu3_Z!1^&l%^4#NXRN*JPf6Rja@!#;KMf9yZnt(
z$4SKIKs~*ImOc2N$W<MlRrhF2KMCwH3Ip^Gwlss|&z_&~+sBzMt9%#ed0De+-57k@
za<p|{+-s$;jS_QtJB?XCA7kypul;^hQDiuI)koPf5UTm~nzyOpaZc?1YH@zii4vbi
zHhz20%*fc8btO+LwGZt5wc~^8jKVBZi!}kCh6FESU@B0+Pox@CZpzYI%qeJyC^%3N
zWbHhu8{YP|!90!_5wV`WZn)U2U>QXS2>M(hc=-8rN0Z*Qs3iUS$4Zp4sXhD`SeQ$J
z%Om!Q4CcBe7I31wU%*$Ic@l|CGJ}I%a!}N~rqgg$g|=LEkGIRM`s%F98hflpE6~Fc
zpXZ1s3`y2hg<!B;Z$hyOT7cK#FByw=3zHDe*Jwdg|77i;YDi5vOkLF3Aqr7QQuz~+
zuvj)9G=1ANk?Az+5#%@EHyEb8YoNk}L`m^r8kQN`+_K0R{_(s*ti+1eYP|{&dwJZp
z$f`8B;DbN%NZ8ehS|5-(3Xv|sj6u`!eV>zvRd#q%H2R^L@`w8R9Pv2kGbidd<4o5&
zr?L<<+w}TfQ%nF7+7BNJ9hDq{G%!hghT~kVC`y20Pn(q?VGG-a6ZWdw)WvOPK6eZ=
z$@UG4CK~^B=O>>Or^NY!#xK`01%Avk&VPwTXB9-oaAmLzP3?jgAe1|wBsnO5i`j_r
zw_1pSXRGD#G<`i~cOJzO^uKR?fnqO6jYcCO$8(H6%2q-1`QFxL%b=8KgE-1@U*BA>
zS%*$zFV~tE%qH$<Gn?RrrD$8lj|<R2zI3OG<U9-@o#o18nmAgNz{bR}HlTGz$PJ^N
zIR|UNqqCO7#goQv4vDC^+=d~_mEh>$JokW0y`?@)mb;krD=!=BoJRBUw}?RiW*zJ-
z5esEve|U>@!mYlRABEs!jUARSp5tJ6n$BEnwS4|GYbU);eh^HdxD6EEOF`(;5l}ds
z+Bpt~bjsWF*d<96i+ntK=iplQr9RV9-92C4i~tzeUQRU8>l38vW#X(s^m@u+Sp)6n
z1IaG9KF&3=H{E(2D5D&M%hk+9YrlGvqppb3rTgT2vRs;*iOBO0b=4u#=|N*+Xe-6c
zCh+ZyH_k3+P;r8$OlyUSm=dZbSf4;42r%!WCO_8-Xc_^T{)tknGPXdYKH+k|S=J9s
z)ngapb-GicN`y_dFXM&#Ud9|eX}OSk-X5UPC3e(q7Q<pLd(se<0M`n(t^zxyJ489f
zd0ymn=RWI@eCLAkK+Ekz9X$owl{q~v<Kmvm^3N4HUic4NubwbE7V(owCjgf<I>0k`
znAUp5Os0R98_Ig;D2}6_8)l5^dY#W9t+%;9;2vmR?c>pH{8-k(T>AZ?SC39}#e9?I
zow-iK#OqIW)fFdcsr*{Uc?Fm|bjHTwbma(0BJl4xSib1((ED0$3@(Z3Re_PT#3bj<
z5(nm&-wCdfg>6`0d`Lm_-$w(VWboX6Gc!~fbqCOc_3&s8(pudr=O-Fs#hYchnJT|s
ze;Jq67Tn&W{zr{N&(8WJqZ|2aTuz<Yl3n@ybus{D2uX8%(ZU3`Q&EDEVj<YCwz722
z7v=`Qg*Yl<IMqNLm^q_eoE%4&>RVDDJo9V~j;Qd4eqNXp^!svLL`zm#iSxImvk$Ld
zK)l2V{=|W<n3co5JSA8;0x;h!?^;_;gm;j5B)PJe<Tm6ayzQgX43`8r$a}_(2Comn
z2d=ExMh{z&iBiK7h|muEiOne`?KMT&FvSRv>n~N;4KbFJr$a05aNz>eq1~^vT}$pF
z`&m+l;}UmTf1bP-3Asqm!vB2&MiEvlMn)GM?rdX+<Tin(hO$<(NTXUyBSaeMu=S!G
zgS-W=3<5%B$a4t}Ae_a+6non5TavL7;8M(!89Z^d>Hk69n@2T~e(j>6QKKTn5fmEI
z&f17+1*ByvT12!FqoSZ7q-_T#G3|gv2`K~t5izZ{(qcnYL`1}>5KyKFVQ96LnMhDF
zwK7YULMTa6oK63}-?#3%>wM>|``vZdy5}#KA~n3V-~I0W>}Nk)dNg1+E4*Ytx7G8Q
zGsWuZ7{vrG9`|UB(wN9=KnSlN#wgEQ46ypsNHBUqFpFnfr*$N#O5{SB58eb~2Ng4r
zsdi!->$y4_ok;`=rPVSUO~RsW?|P)2R*t?o`loY71Awn(?25^MpIDgf=K2A_)<a-2
zcY@%Jt>*Nzzk%sw1M9bREA@j_Zg%e}tDL*tkd2^OeU2{r&a}K9^X%+eL2l2fOu>=G
z*<{AuH-UA=t*QFd7TbXFrtCTY*_6F?;=fvS$H7XZ-B$CP{y`ZtpK#Cw6E^C>RM#a~
z+c{?sXd!r3vO;!0ea$)P!%$q_d+dXg*Y{oJPtO_c>Uy&2!5^C=Ze6i?VEzp)yKFot
z1g1sYbuI&AopW8l8PO~yaHVh}hp}Fa1Ay*+Qn}>nOZSH3cdh!iw+ek<t3D`K+_%|x
zsrS?VgtkuE^5C@nt3afoQI7pMNUTH#R>2kXu(WD^qQJy?4%VeAuBty<v4CH<8ertM
zV%aewN@W;Yvf=byBF7VFB<_DG%?V^nO2+x({#K8U-R+rSX#uD6PmP0%rHiB##Dlj6
zt%MM>D6IxLBc9H)Abb={pP>oqgBP4v<#K|gDw8XW6lb4%gs<^I#-lL*t5<Fiw?+pg
z#j+bs@5|!1IJRE6c}Et+oH)>S{cg?SHV2ATBs}C|c<nQ2<qkAhaE4_@8k5!XNB77#
z;;DypNA{^RetxcV%3tsLHK)18e6xAbEp;_%S<>{rg?8?^(5Sorc;NOA!-e(zd!zPR
z-aeID`GlgM3Ks+(yq{Q6VlM0t#?@6&SVa}ro@-ZgzlBcUNP3cBrt9jQB<G!~SxVsq
z&M=~!1udKxg<<{`7jtMcdmPK9iLXneejdz1!}KM!;VwT~J9Yd*tCJH;1iG(((C$Pl
z*N~LreyLKJh)#7~rL%3~dfp>ap8dj6*#!U4RyLjM6%&1*ld~~tCwAp^CizX%a0KsD
z%+YocA+!%%`SJ7C!g!xF&lrczO|dR%8X%O!gDoARcThDEM4EO@fX;$oV8`5v(p!NX
zhdS34*h8F_taFc2*!(P0)z?^=HQVU+M%@h=4Ir-8vinQRkE{r8EgWzRsBL)PY=82Q
zDAn1p9#v$pu%pxgz(gi|)~7o=XjgP2Q(R~0SOlu@W>u$&X@kxOBlXk(tmv}p73zbZ
z5Gg;DVA-$EpL+jCrj68Ie^jR3<(2CDruS1%6+ZOR+p+CWLr-!l97EJ)WUIJX-e0d8
zY(M4;WT|*1HI6r59)e<munH6QbRs?wrzI6y`bw+UbXp`b=e%PDgcN-y;=LLptuvV3
z3HH8xZ|yXP?>d44sTBPr_-c?#Rr(-`q9B_79M4?mtQWv5By0V3bBN$0c^pG!UCmQx
zh6<$#2v29%wnm9!xCGPO%<Ar3#+v-jI}+$3RbJr-rMAC0`W8gR2t!8m`xRCTAyOC*
zSAU1A|Kz%od?5>d1{tPY^9}3GONCzzViCF~bBWZaYP9W^>yofcTG=C9n#i5jxdivF
z6|t54hkZON5q>s)eazBo{}J87M45|+&M8<G!PrhAH;<q8z4Zz+o#jpK0l@7TShLdM
zEblAsR3bYUR0J~96iW5LL39qW&kwh{e#1jAxcRm>oslqjNQZ>p4G8%)bTsDg^qm<Q
z`NK7Tq{kMDqVE*D(PG7ldvq+2Aqys_W-Ea0HicY3EL7H4@e^DrcnEQpG{%fYn(U>?
z72n9ZM+XxNnX|_G#B5pNZMjNtubixEnXlkhi1gHnizj6IVX`<PFKBo7>h2r#+j0|B
zF(~g~S5<(nOrq`>MpZb}(9J?lExvk9MLSz^yYpMDC|B*hp=s6Z&IM2}Q+nk)NzAuo
z=OzTCXqmLol7r`q*|zXUMo2@uo57bPSmW<ujpbys0P~61r}%@k!*V3@Gp_Rp+Wk#x
zI+b8O^Yt??smEsq+(wDbBJbduc%PQT{!(UPbD@?&yXie;y_uh1+o>}nN3H`6*hrbA
zoAa48nIYv_aFI4OT-?nApJ<Ox<gk30R%;T}^(GFf+qLT-m$2p(Cn=>7dmHM{`fkg!
zTw)Q<IsQ3Hvr&;Se`AZ`7g&tAYWVgLRVePDvypJ5{d%of<X5>(`?YS1{>qjNoTZ5*
zPE|}x^uW53ML-)1uJ++>HRG)*l=1;1R3V8$Gtcy#YVIYc!+~|iU2A`QQThl_&~MNi
z>(9VtAE4MTMOjL=aTpEu+QF2-=mEnGWib(j?6WeXaO23FfX%YphL6r0R@&{mYvvIA
z;~!HB)eh~843v9;OfA=$_GxM$kPD~D;w5eJV&=0!;-J8kyAoR>$RTKo-?3NZ`4Vc9
zvu}~CC`)yqZMdkkjSHvUl*76E_d6!He6)-Bt|xe1bN-=WOQ${24{5bwfEIbO2-`k#
zTRAQ#>!Vau@-Eu`A{NOjfgjnSgp(h+{Ti%|)*d+{82w$h^9JpMRV<Q2Cl*q57NvJ#
z#k^dn_92CXwfyt`@=A8RS<o^m93{;gF*M0W#Q&NgL5FEcr@T7zJIBQG_eAstEGRAC
z>xeSY<)`>Pt;2)UyUB0Q^)jZlcbiAnopVFN(f=7X0*~|m7IRUMOVP?d=v4W$%tfGA
zWvkt*`>~ivPmg}7q!GJ2O@MB9dS&FU-3Km6ss-4&ngc2$8)WOw@TIMV^~G<y2ON7-
zvchjQ^qBobukz$O8>{4rR%>yAghdbW>omjVlKMH|-8=2E*SY33xkOY=#jMsrJKBtH
z|MNe-ek2byuN9okc~|?OH_i0ZvV#<J%6lkn79hdQFAfmUXf}{@(cW1%8>o-BQi)*D
z!=jJ1{C6<2-k0Pwpj`iUmHP`6&gKzmP&oUnIe3FM#QQfqM^lVZNSXtvyfl+jhQ}yB
ziwCU7C^_snXt4BbppGs;D>KBO_Q?xJ^cnldD5G~PEVfdI+ui6NaPa9s&v~(#2j0E?
zB6sx|rB$tk-}#j924=1^hnQ{oVGPk<WTXm4FUX+VEE;}zUAq{4AroUhU`eY46tve2
zb^s185lrpRJkki-IhG&Nmx}wJ^s+|xHQY7)bSV~j!X|8uNOwB64b@H}Um&A9wHq3!
zBRk#b&x3Uq5V|Y{Bx&M(c*&Y3ba;*ambe}etym=A5sbxnz>i#)o~B1T(Vq3c8LW#%
znmkEkBUqRHTwnN=W&+OAdu$E&2CWm=`&8ZUQ3J4T5AwAe(cbHL28B1C>pc*BI!lWe
zXnZOh$0)ro+R%U9!BecrLq44!XZ`E1p#wH>CA6l+0Ej;p`^G5CeD&v%k1Fx-eOLG`
z!5C#H<rGV2)<MF_r9A@6W`_-u_XofF=VyTw^islq)_x4g_waD|AXR@PWsKtH4=0CM
z(a-;~Pz<1_);R#td)$HY=oY|@>xu81NoE&m{AGLra8L39`X&qd=tsK^N1LH5vVb(Y
z4y$?*{2DA%yQD`vT24;<_dWfO8|bdU3%aB4L)gTk9R2lydh!o(Sp8>sPq+i%;IHCI
zlWtfq0oMiY;7Is^9eJt+aJ%8H)KBl+=uK%lbGZESpPIz|ojkAv1}rbUF1*s6VG6n&
zdCbt|=fEd&gWtEr800PJ&H53ToOca%XT%DT;1fJShm?H1v{o=`38crMf25#LE`lB8
z>n_ncgyaimC0)P4^_#6!jlhkr6pR<fvY9$_c%o&cxKN)VuR-;G=%f%s4KOu5;9o!L
z%f<aK#bHeSwob<zH2lWDY~D~GgDO%4pU$z~EF@o*KBJF%ET(YF!J2K*7hsIx0_|j8
zJu=#iQbP=N_qzWB$u?}|O@NexJ>J@Kz)#slX3JbCXwf?gx(rA)Il9}>X)c4eleHnk
z(L9N`Ym6dwqqoA_8vqt@(odI$yoo2DBQ^E<&Cbi+=rwu@nkCfDgFUyba~zrpF2&*N
z>_Gb8!>_?*)1jv>57u-uHb&8>3#yp<&Ae}+L_%|;_nriR`Z@Z-0y&6k&0P`rP&y*j
zjb8EFza_NDHUI3eFPnmOvz^HL>lzX4&M)dw3IV;i9k!a|W0cEWVirg?u$4*VO-D;g
z^kNE{7z60ZSnK~;t_D(}%2nht-W&N8Bm#)yOZD;Gwa3&f+4jMj>71xa($I0Ue{H<F
z90}wMID06OuO&xvLwrl3B<}(?Y1a`Q)y2HUSgIJZP|Lw{xAC+y=%cjiQ@f}ma5fu<
zgI$D;QJTI(_6l^2GO&;4=}>vj*$kWM8d~Xr?B^59gKLBxwza2j%NPUvD3v8zDX`R8
z;7(O(Ye>5E_;s}3X31xz*?FDWzUZ5Bf5Ljb2#Y#nr#JL&w9i-q@P!ByBr*yuj~b;q
z)^GiZ)*>X%8<A7tyk76FnFnWPC=Pq^*3YrXHSu}iP?3vx4T3pk(ReW==gAMa2XF@!
zJK3IQN;FqXPqeMs-aFcvvqYQRR<~L7xcQKcdgq1C*Aixd=+UFXL<=u3PJ}Xbw&7o}
zQ(lsjgK;T2H35s)q~SbpG!v?bz1cc8F1+AOTOpoZF^f>uz9MIayUxQ(dS`aKE+$S3
z!-5=%z#L*-UzO}mK@>e+^qjYl*sdB0Xp>i6Z3_2N1@LLm0n#F<hD}W)O&XhB&2{Tq
z?!c0<dCy7H6efnGFtTw(;?1nGawbxhe-7ALe31uY)YCWh#k_^D)QEYH(YzMug56kQ
z#redV5niNmTo1BG?wu=>P8sNudCyR67qi2ioRW{btC@UqRv@voR+dv|oqL#MaNN~t
zNn8&VgT_gzy(+7{nOmdwUMH_2zs2au{kj8pf_ljX#k-aGY}3^q!rsQP^qqg-dg1jA
ztx0&6j-9B}&F-tSnvApJ3qca=Ibu9m#=IHkzqpvsqXW&Zn5{;qY`WXADMDYW^n$SK
z1kO&1i0qj7>#IBO!a6P5A|ej^u6^~}r40#g$ZYXGF|m|CkPXgnqLh2!Ht#v|Rhb7K
z*Y~U>rs9!0Fv#UtWyKWiL0rid70@dDlTyir#N{e06V{BdPtGHbehFDpR<*1sBPZOy
zBIEYE&{L+OlRp^@`_;0EZ}_@7r3zZrpgH#dk)gFDl9)s^_SqAiPDp&PVp#suf|<iH
z3x9~?>=n16N)sX&M`}pB7Q1q*<*##u^3Wiw@*?QB4b24(R~i!|FW(FEjhzWQY7MF=
z78d~msjduiffAZ&osxQiXUWl4|4O{>t3=JqY*g|Y-JMo=k|y#hKbMmxnMo|I6PpZ2
z+js_neA+DUwp-$sVed5`<nB$KMn+zD_dj_;8ST)(Q51g*N}S@tG0HPRGK&%^oXYzP
zH7aw${UlKpCOGpPIg?|gI($uiQyF-`^|{K0=GDSw<7ssu6Iq;m{3OH9GU%A{`LF@>
z2PNML3Y7|t`zdrsw9*MtRM3kZbhEsaRwB$=@s3{!eL_ZTo%_;r&WMtK!O8?@pY?g>
zSaf4#JMk;wunmKbmBi8eYl5sxGQoTAZgzH$R$02rw>GQGG5v$2W4WBfz+Vj8A=zdS
zYg5Rn%e4o1^`w*j4`-j7<ZJm9?kwDinI`FUZsScM=qjreHDd;6^=RjZ=0MDOw2tq(
zLg(@5Atp~Acra0T7JY1&>f|qem^yT&4SGh6gCtui+Hi7migqhn`7Cpe{^DU!`=LOD
zGg%ypv<oULoN(iu1p9h^n)%X18}9u4KEGnu#duVr>({-b^#il8Nz54`KAaRkv2^&)
z{2O>oMT*KLXmsJ-P#?M1zGYOXWKO)I2X3FrC0b*Ro1GCyKm<Tl6a#zMju6*c&21p(
zbD9+sJL6RYe!I@wf6U3^Fl$H5kpTui+EqnTTZYTmRDDzjTz121%InV-f;a|`IcIs>
zWjDZhCLss-#6pH{wnWoH_^@$_=CJ<iu>5PCbw%4Sbi)NP+IZh^=Mx7)g{+Xq_M+@#
z%2N6{ke+p><q?<H6{Qb_*43Ds3hokNfnhIqH{57_-&SaRRKlcuK*9%!MX(cXHPf&S
z@wl}nZ=6b)$fMv^C0yGaPQ}Ywff2c|`@8Vkx9<W%PkqS3gteqYeAS5mZ&RE?UaEX<
zKX}rXhKCGBugo}gRbkoHF9r8D4kF$prGhDTv<qSia=_+TEq!X)PJ3O@T>PL2rz`3t
zAv$-{>uU>3T8?`!RPn3PN#Ub+5)WSu2xm>-9qJPjHDW6Lbyt|#>h{1DZdNQUgn5-K
zP`2O=RnlpKM-7B(o%&EC?o#zDAD>2N2URo+`gXv_^+e_`>3s1qX5p^3iaDJ6+R>;4
zkrNPjkKKI3xuxDvg0C=j1i^}w9ehd2=g=E;K_T!cMh3KtNg0AgqRGfXdAws+oOmy-
zU9M)uix`GIepa)I0=#PnCXIJp$%X#2Mc%V&tn3;@NXIP2$D5h~rngt<{oy=$lB?wt
ze8VL;^=JPWnb>AhelM114$sXIhXCnh1^<FB9HUAgPT4*f$D5;1KQ1;7E#}!1YoQnI
zgbYlksyw_J4=Zl-7oV@cV8=fvu*i>OCObx!`I;ZhQl2CicpOnO$4fO%c{y=I-|P0v
zy3RdwiLXSlC>m&qR0U1P>Jmf%q&=qc**d2iJ^qWkQp-ZI4%KHuT$5&g;I}nLL0jMx
zCqOMv&^atA&nsJ^-Fev^`;e6VJld{4IJ<q_^TV<9-v!0Nx;b6r2w2<&E}Nj^@v0Nq
zO6DX^slswVRQF71#GM8K(^+Sio1BHUevX>>{8uWuiHu08?p%v|NY4+KACtJwx~lp(
zSZ&tb#5v|()O_fWy66+Iqr?^Tf0`EW+*B|ou!Oo<`!pNzsdA2|Bq~Ly`=Paru0XB&
z;<`3G{yp5v0ox-krpGRZMrqM^PzJ-7Cj5;pjT5-F1(!Dos)8)S-LqsA6k=g)r(AZ7
zG@`0NENf|{a3(3En+Pim$rcv%0A})3YYTWdQ<)MjpTIe+>DtyHDxbw7R>fp<(p2Sw
zYQ1}PrhRk%0jX%0Gm6iQ#PbsdC0{-?p~~6(N}d&kyg4M0b&)2mX+JhE9w%nKxzq2J
z)BfkmVfI|Yc600DsE+mWkd~n~Sh3hp@0{LQ!GD!Katun3Sn0pZI6;u6;lv_W1s!6|
z4fr3G?*ItpPQ;zmb+ICO0v+2*Pb}tr)c}>F<-{gM9%|a-Xq+Jn^j5N`=@w$ciTQX~
zo$5rq+G30{lZcfE)TofNMdXrJox95AtKJXl{iF7=)M4-cGLlk7kyDHDV;VK_TpPjl
zk)n#5nR81qvjGd`7aQmKcXew6t!!oiB1_{g%zk+?2HH)zj&U73@QIn(7(T!Cfe1As
zZoRCrVie=4Mfr>rRQVmgS@u@;zMI-*N#VtUl`|@qli<N8qY=WmibeX<T!$z%U&h=f
zy)1E^i%}YXmO3NqcV_;V=IXqZOskH!VdjhPT*n5tHYqQ$%!xaL)fLl=v7n^zNR<Z9
ziSKY{&g}V#-T{4(!hb^ajnDLnC{}^7#weR1yS&0|ch^9&6ZZ^u)I=0dgJ$zgW1Lpa
zB$m}zTcR};lZaC6dR^!2q#qk~KV*eo4AGQ8lqX0&W!x!JgwrMh3V0wVj=R)2zq)e;
z7LgP`;5=WMobT+Jlb?F~qk(>>!@xgr=>US?r@smL<s{3BSn*JOmyTf{o?9liJy%n+
zDX2-1g<gO_KkIVpz-8Q`(w`xr)443Yu<Xcq3zkInAmzdC5R_&gNM|(}4~(2=J4Z*U
zr<Bc63?@Db9r1m2t0q(xE}z!^;OWYXih(8b?B989X#5!K`mzmCyk!wKlag-trne6E
z@4j0fd^=QHlKs{ZsYBY+svQf9+Dx0?F-_BMgdp>VZKC$H>_4|8z-FOGvv4@#$G>Y1
z<m?U%@}6d5KnT#iG1;u3o>SRZI<M#U6i2NwzmS1O*k=qU4F6Hjjyez>`pd<){_kXO
zJr|j+X|DUa!P}zdTWe621PXgMjhws~?;@vmU_zB&t#}$*$si{a?wSPVbOP~eBUccH
zsxto*0!-)?vvg<iBdjiErStB4y6uE@=xstZu|?!<?bhg{qRH&_rqJ?}=3Z6u*D1qZ
ze+qTTQoD)QF2*9INu+^pPg|KcoXfB1Q=J{|aAsATor3=@j+2QKbO&&sXR;N(TOy%3
z-a>MfUWC>Jbm*ftKK?vt^LHUAGUpBrT?pJ_^S#UOPl0j03f+f-?7}|*p+T$jzT4!V
z;;-zXFJ6d|RWG;VS97hz3ZWsvatr)X5fEBrmbsd^sA5xzjeVonX1xuqm=_;#z1lx9
zWADA*qEmZh2QS_Wl*Ptu!t=<<)?jbpAXRP3k*Ymw7;ipTJF+F>q;#fcjB-AbWyIY=
zSm3t4jYG>m=I09|v*1G`v&#0Wz4S{xz4!yj^j=3+k}$&AL8%S&sg~(VqLPls1o%9r
zG=ViAMk@iah@caT2V=|FSb@SjsZwqQZN$aNKjW7<h?<qa4OH3KLX;go*X~t7Aa<Xm
z5~s1godqShX~y0x|L|YJ(i4R_FVd~9*`#J9yy#?}G8kSu0M3Dmpp_fYu=-dOV$Wc~
zbdI0qAi+|C8nuOZyj1Uvr94At4v8(^a@+$F`ayfO)W)lhK35lWt38xl*7%{cL6qww
zsn1<=IVNgi!tnX#n450MAH5(2Ih3Z^2v5Im{04{lNe*%|<bb?AD}dl*G6|~$lW@da
zq4xw$9Q7ted#A0I%eoo3PhI9@LG`0hlKV@T8EKW|(|n&%_R8_&M++jmc&iah#MjMG
z1InPKaaSj)mkzAet`29>c=I+1-w+2;vz`is*o0eeX&R2%Vx4>ZZ>fs#Q;$(BSe&C(
z!}<GRcSLHvoi<$exmv%;+pRY}Q4oCG0EAinU?l*UTqoWOLE7gkdI2l$IHO&yDvsq@
zUB8Zi1c15DSUnJ2lQ{<~%rhv!JTBzJVW-NGgnJDdhe$U?M`c+?d$rkX=il2CD(Gkm
z@pUx4e4BEzOE-HdX)<BFAxe=2MzTPkSz+@=H;Xuc-Rlc{DAlo)gQqK|L(d9JwP<wl
zz=eEeDQ#Y_l@r0o7iiQQun)yK9euLHS8l$#A$uFX%D>nAMOZ<o|Egv;gm(Ae2#MDQ
zF|-iu`?1w-?Z^Dca)<4Y#El>C7sovA*ile&PR-104mqgZ;c!H<$YSU9S3909{VEn|
zNK=dqK;B8+A10r|o7<Zntecgk*^XCa<O28;Nea|RGBll+S>g+8iu`!=<}MM=;Fm3q
z)UvsbPqF&*!+$Q~``~L%A5qXIyt>`z;7~LZgrx=zLw#@1Ujb5nT{E6{miEd;Y0p>y
zcvSvSW{|`Ci*Dvh?Ku_27Y8$pbc+K(&_HSZK|17pxKG6Zw>`T@Fr8evJ3Q061ZSLa
zwq=|hysR>PdgOMPm3iaw=lAV)Jc_G{b-mw+C<ej7R$R#nH4hxA622*}E|wj>ws-GI
zl?z*m)_!lF!Rvk9W*wc%_KTMY3QbQdyCYqELpn*)hPtlNF63j*6}$3<-j4#JmqCLI
zssMJ}_WJP}P9%<c66M;BL4@lIbSmcr-H2oM3^5*pJ#M0N!B+n2D~kwpM)v0SWiH2U
zYPymmqfba9-+5JME|(5Z5#9-~u)a>C^~jbaXUFnT0AC&9-36>qse>2BD4J;TbY$3_
ze7(a!AJ{<s0ya@86My=x9w3kQT-~BEN=uyzSc2aT8IU;w>`<ESX2Cc=<xv)xF)6G+
z+hU;Y`FEEAT@8oPL;#_FyNXu2i~GNb!&!P(CUS$881lbCwcGyBf|~wIRQn6~u*&D+
zPw9dVgdBi8V>hDMN#V@{=pJCoU*y<9GhHI0xCJY3tp5!i%G0FYpnU{@x`wZL1yEe2
zK2O~L-qjK9ZNR-LTmTNcGXUa?0>JSs*(BGTkfo8i@&uqZ`RP2zD3?yE>$S6-w~bNm
zIQ3E>o%;4)gj=NbGHLt>K7=)|mOgTXHQGkE{1;B`0<BqnfHb1|r$~P~2QKUzbvnfG
z0c?$L&=*UPp8${kMrKC-Aqt~lY+|hwxiw!4AN(BzCVjiOP$Eaj5{mXZIps85W&Akc
zfTf%#pQEEUNO}YH??Ig<gg?u!;dFgkeH>uVfe*m0QpRf+A9u2WFo~hkx#A)CYn@PM
zwHBDC*R>1a64ji`fQmm5y3xDDZuGrCDHH!aMnU(Awa$!o0q6%Y<L(;juirKNvI1`U
z0qPC=QAMm=^UG)yDMU{nH_(SdQ2`w1L}QqYa#O6hglgEu$mmgh-ZI0{mK(Is@M`fT
z$or*o8ruK5Vh&)XjYJoT>US9Eia{9{fSF0R(HFbygjxr|dGSjKHM{<SZhOk1)W+;j
z1v)Nd(Un_~{yMJF809XgayI`5xLyR{x{#a#v9I-4@LwXteZ4IGZu3A2>JL2H{}lvV
zK__fI$xYM&h)WMFRq)9y`t%S(EfX%-OiqL2`nQv0gFth#VkO|V^RWd`XB(rWBA+~6
zVHw(OA?CRygZ+8--G2y*^eW*s<ghws=+E-e&jg^#`9I)~V;xcAdoOb9d+lKm550x~
z%<RXOd<!PC<lO&-qfOgMfM;AR2FC9dR+3;eEd=&`2h;^@;jOw^pHqd}GNyhwokGt0
z2M$LXrR20xct|!EEUDlf0Y-6;t~m--oR3f~phGqSKfJ?1$yZF}Qt}Qm2MEncH)zAa
z7mVL8es3%&K=i3}I@Aw%+zmHq@*n^GFyn{hc>kX6b^$rn5@LZ@TK{o$8`o2~wr=!+
zYg$M2c?EaM80E1827Y>LhDodo6o@3_N+e^_|Fhf)(BJ4HhuXn6b?US@Gz0~$ItN!H
z;))`meaXYJ8H+z&zTe|_@p?pfRVRcv3jk3PpIzbaWy$)nWG<)EsdVjqk(Za{x)#Hc
zS>yuP_HmCv3ak>Nf_y|dn2R0t3-7oAF&|f}g*7P1pHcZ0&blM`okuuTl~eud6l*%C
zw8sCPgc%hbsfms@cCBh!@x}aLf>Lkwatk(+XlLx|6thsmvuG+5(z=UI_;0y>Ae2JA
z^iORj=9Lz1RJj2OlM_p+)$AGEjrug_7<%FZUGNRy%CMD;>7nXs0ZkXWH+0d6`QrLy
z=fyBR!J$N&@bRPYFxN&kIlUvGA<ah$?T71Z7FP2XG>f*<S_V+k1e{--C_LR%bgNR$
zk0Y%Fen5*}X^FZKYj6MXp!;aA=`nxLyzYW9$IRRuNnWV%yYlAj3J@{2D~mII`ncqb
zvx&i%D_V1SKo=we5PB($p;_8Lpos8M<(%a@=BofW?{vob=k6a5{MLn4V}7N&QGB-S
zm`cCSD8jvlTwYGLw5SR*$u9rawwJqF{+^kg|JRVgNbm(jA!8BN;#eJB#WrV=_2k#m
zLtL9%z2*ZS_zL+sIZd})RlY&GxhOh!fa{{nun2h4D$@J!%G!J2cF)xjvytYA;=;J_
zq>X<Vst4cD$f+QI3y*2%Qzv8g*Q*B@Of08*_n|=``D^Pkt&(bkjI0(nulH>uS2h(o
zb)+0@;QAhalbD>_dunH^K=a{>sUTEk6tk5;CG0Fpj0le+O~7Bp<?DVT4yf4)QqYWZ
zwInRI;2%y$D>Hm*5SW4E&+)2D54v*io8nelqVx9j>|tq=z0=D{Pnw(eG^yePnzBl-
zYS*<K&;QxTW=o5qivA{?oU&XC_)(<?cdZ(k2gJ=O-{79{+$r}1I8l3WG`Y+NT#z9r
zj5Xt}zsFrK<pA9echLyK^ZOi6WJKoln%5+zkIV{PbL!4z7vi+N6Qht4GY{92#y#+`
zIpizxWaneJM78u;s`=+<0u#H?GEY?(hE($>5M8WhuFL+NqCgl5pnT=8-32=EUbZW9
z^Y_SPFG>zy4nKMKZNEsAxt^l)h8iETSNt=BSeXOLb{Yf1p8kw}nl;^dA&Nba1h$F*
ziQojQnDIC9>Y!-?Rw>xu@xjT=V|RBmZ+81v6d#LGS-&$ii};>M+R<kJ`%j5ulwB=d
zrIZf+V^mRrV%r2AX^KRV)>*d?hbJ#Y6N8qu6qXK}_K1z0XHetVy4?q|{*qqJw3H5i
zZ*S3ez24aMPLY59hs*PdFK9-*nk%G>+8%8R|DM{Pq?^gC7Gp=R6!$Z+QK`lmOOv3}
z$ycVM55#6w)`K!DrlCJ^0Wm(=R=+qWPEbQGY#7#x6MyNgzbi0e9$_Eb_x0et_HMtV
zA4E+95ftakq|shLnZ7?fqG3KR(2L7#l}uyu<uQ)ho&7b^Ke9A&DG*s7&3T_id@EP)
z>6{=Hl|Io~($9$tg0UKLa;osmO4s>y%9Gi%h?4rsI}}<y(jHBkKs*?Co%dW|s592O
z>Rh0E8=cKXi10g0lXNB!EOU*`E^s%&_n#`8$oIe!a?Tze_VVg+UZqTdp*>Y4I~$(>
zsA*izPb$nQf{rZ4mO={7?s!QWF|{Yhoe0m82v#}_(A4s2?wDG_n}4}xJI7O5e@2Oc
zV0O$&8+B0=n;UdhDlG`lQ&u}X?p||@X_=7GnG+RblifPx82LKg;ET(6uoXiuFiSxc
z0}J6v=aZEfQWY5dgB7*WXI(22YQ(2>a8Fb;&NNQ<sH<6~3sem-YH6yG=BpjrAG>OO
zS8=NFxOYTu4nAQtwOT<>0tqeXiZf!WjE^anT!SdX5gWL0MY-H&co#{7lKABL4J*kR
zVODmfrRnlr(e2K&a>GwViRUbCcC85yKky)^=q6ivDMw=ZoyT2HdU%5gqYA+eb?N5x
z)w-HugDEzy1{}W)B79}?o$w+V^Bixb&Ive0$2(%SzqWpJNTfI1F8vvR=pfnJHXHXJ
z#pkSF8f9N?`>^aoa-*B;T>V|KB12vbA<1<$yAqhSyNL)joub==*XDp|x?)W^RvLf;
zoS0JUh@7>%Yxl%;9!IDgZhc=<UyYa$S4SkNCRdc&o2m@DPivX|u?aK0?)A)kZJ<x%
zIMj%-r~tyfO6VXFx1adnhjk`4z2&@M$7x&{Pc9a|-2Rz!@5Ren|ClQ|$%}v9FSUtS
zu_8ZzcumPUBd?Gv^WA74pb(!0A!cP58)4VS`XNOJ1!@<X=63T3Y`Okop*();8^Oem
zaCcVI(xwl@Omb353n)z17F#(x?jwqn452Pa_Nn_6udqki$Dr==r=Xi1qo91C_!yt_
z#uOC#7dlxuZLh!E$+b$^di1BwBHa<9cbU3;->W9i*&&zHc7Sl|R@w)qrc(+egQM^y
ze&n29*4Kx)C`kRgAIia|lCRT)tFA{l_PG}|?u+?hXs+vwfY77871LUH^tZh;Ipt-M
zbN-U?6BxmQIta_AbKlvNxgWkkZ+?cebe8o{qHWf!)v?LxW0cQaRM6!{|FdhL9g8NX
z3bZ@mhMR@1Q^>Z8iFomOGy-txkx?X3H(wDD5WZK566<~f)zLx&?6;oFn-p3`y!n!A
z2UOlXbx;G_LZaE;&QVua*tB$1_o!Vq#kzw1oee@14_QMV;~iy64G{<f{){QyQtdZ7
zIE>?Nk$=)LAArD3^yy`WaK=sIy@dnGGb-zq(k!v6OJYXODiI|{oEWTgNGsq^?gfLk
zhkUZ0of|}?Y!wHZ#5k(GT8F&1NUK+cMEwH&U;^w4yv5rw%8)m*PoSd_?r=*WHGGFW
z?gTVp;(b18WQfyt5PqTfI>-&DZi~z%s*nr*!POhf$``0Bg_Gj!t!d{P!jH8R>!b>g
zA^}}eiD}k;TtU)%G^X+?G|AcsbrHb>O><Ylobj7MlVSw2??DoT=2c&lbet7A1Y9#F
zIi>s`V}fN=WXsJ5#Rv3A?J4O%9*;L4;L~kAf_d{F#aE@RkVdWUqhlq0)lz?EV&NAX
z?$)BCoay=R<7@JlT-&D%l+7Nw>PMkB<($>+2IL`<ku==KSJwAuPfN+_J#?9KRIO;0
zo}GW>z}nr%t-}QtfdPBMSN%%g92Xt%`+@RZ3$J$WKbZOqInQsGlT*HEW8j%RkPzYd
zPD3IJdszqK9FClTYS(Y^r2{k-?VMw3T@r(9qkiRHonFOB<*g)|>k4)o+o~AJ&Viw-
z^)U;p(_X6Hp#ja#-rpBIjj;&KY%u&dI0LPG41?wdO*rTte45yRYnkV9qkA;7V96Em
zwCBafk*U!>{LPQkhlljDHi~eXEYdp&|7p$W;SBb*LH43V+4TKaJU{@aa@u0Bjh7rx
z6{}7U(^dq^T`T=18=DKqC>JU$i1P5;Jp!X4{*2J{vZC|}j)ksk#0~e4%g^~vjMQ2i
z8Abmd`REpW2@k8A2Nsv#j|el+zQ?sS0_?;K0FZ7+B42T5HWk(r>zv)}T|5;Yb&?dp
z`6B<&hu7F2UFS)ZgJ!+F1+J^lHT)&BAdXh4t5*e0zSD3ea(`hYMF$B%oN*tD1w`0x
zCe)B8P5|lX!RfkXSH~!uuB$xKYScICu<cTnc}M$Vku+f?H}qcj=w|xtYz*|Na67Bn
zWsX<6&NNF_b6&Sa2ha>(h8SoqwR;I6X;KaY8ut>i3Mb67%F^taP~qawu;>*OR0~WP
zJll4{k@YPydy`@#$Ykg5t4_|foFY`0mSVLT4(C?brL{219BeY5vU55?<!%xXYpA`!
z{X5|S_roKfAtBc?9%iM;3;2~Gk!WK2iQ=V65zYtHh#4nXso|>v{hMC}`qC%AQk8qc
zd?<~~vYNHGEz)v{b?O?4&%vhKB@r8-=e@<S5eZ|A7xHHhYSt09DwHoU<4t(ujY%u5
zC)S^jWKxKcO7J@(`m~UylY$U@%_9)O+tFg5f=&zdm?L_1Bx2E{hJkGJ#5|~37`OgS
znWj$`D@svptNe|HLL}_hV-9tlCM~X}p^lxx2b_Hp`An`EHC3!MiQ#?pX8JejtRs)y
zZD-yNalBA`1XWELIv!jQ7`3x?`1^h5x^|SGe72I;4ppomA+byduFY!)Ak21<{#Tyz
zlhCI3%6xNF<#eSm?kCJ!nsTG@u&X>LBxq5~H!bW3_B4~4JkNdipWil|VCI;4<<6cx
z*S0q<_+=U-u>s^{2XG*E`bXq6B3eCIDLkFdA%az3V3R9nwCbYN^2uD+a@_TL$j?8h
zY-V}j8}jzv>*R!Kg0EUy@6j$g;aCi_wCujDykG6$6MKYJ1fXm<IhC$8<gO|pUTN3s
zW~Xc>_PQ2FDD})*7#YV-B<J_Inzq<aSy0?$QM;XhVz3Wt1mik%SdZfd;r+Vs?4Z75
zvXG0N#(vwHBUV0hangWI#-oVhu2|$*DV)eXMFe2hKgKJi)q$&BqAQ~+9El`_+#rmE
zQ3y@R$Az<YbI@v8exh)Eh@&_J?+vnSy)E+cKDH?n#3c7WZD!l7d_Zyb(|`fRA-qmG
z#$-(71gMY!dn~R)LVkrGe2OIA*99sOQ{q@%iD{Z}aY^9r9^Rq~Ohn$ww0he1jn=0d
zl?j6RJ0hI6o@??<Z&%--W$^%;s4QV&JIC?8sX7`C=saa8(7FnpKI8-)Fo&D#STl9T
z5V=((b3XySk=4tagPS}G&F}8JCtKv0amM@#<Txb<-e)vd&du27=DJP)RIK<-Tx<r2
z>=w+oT)SPjfIXGtQ#VrV@0r961-br^itn*-PGZ}XK~!nh>byxAUGBNL(b@at9T_XE
z#5XCA8H(NyJ#{!A&GtCS&g!k-Z}6qj&9t8}SXkO;!`xh6+AOkh{Mb20VYaMTxume-
zVMW2Ul{Sn+4+c7&QUXeMt1m=HpIvkz<ly>C4t_fiP{^}fYjD{=qLsVL7)rhg5n2|7
zq1E}y0osp^Fd@MQyDHg%uPHg6H+KbE<m{g7p7*BaZg_gyMa?VUQ75Mzr4{KXYswaQ
z|7P$dMH`J)ZW4#niRFw7W%JcS8NY4~@0-g?O+xeyj#(9NUK11uCt?{D!Xr@nvvl_W
z21HFwenqJ&xo}`9In(>-rll>zAYd!eIQZG@z0qS@6ic7<FU;@%pVYpF{}w>PB8_L_
zj3hhI+>}?BGxp$<lC#2icKTG;<(%+J*@?V+Z$hQy3fxjyBZ%!>RRSf6#E6w2=Rc7~
zma-=k%$lI(f*+gIrQ#$>ra3<8>Ee=}^flR$hYiTfcK;?U>SlxaesClcj^SP!BTQ5w
zx?Qh|pg%*bM0%Fw*IwVFeI>pLD%K3{cg<x^`C<O+Hp>z&To(3P&Bnbiq~rz$)C7Zb
z2xo~NrJo#%@vwP@obv~qYdw>&EhaZdYcc_-x-S5%(M%Eslcr#bO($UY;xC){m16B`
zMj~sp3=J8jkURff&iHp#L;D;&!0Iu|-vUxD*L+XD7LV>HYTW1@E<l*n<c(40dwY@M
zL1gIGkCdBk^qz$fb|nB3x7yVjZST=-1pv=M>$;UXhzyL418;QgA+$Y<Y(hrw=z`to
zYTCbWbn56wSb^!t`&smdsQ%Xo*v?!0MHG&M?rT6pfJj_0M)~*-1t#%CnEc}XkCn~-
zzmbH2vkjcYcKRnzR3Q*+I7R4ainklRErWtC7GOtmbb@-|B?79JqT=iK0G#guNF~60
zfZHEK->*h6H@5cs7$*P;#m_)cwXoap3+%QyNP%B8$gxd`)}ce7U(0L#%|IUp#NPm|
zH~IoXLu?D6$F>3swD*?&DR7RP0L3h>q<<<#YUx_r3;+>#npMf*dVu0?(qBa1M<B$v
zRQ>ORr_tdVaQ#!jD31UtH%m9uf%KgS|I&d<Tg0P}?cgCq%M8cSb@0LO$KOGq7uY93
z1)}3BbS8lCmlvXt%D*f_F~5J2qFuTB{>6&E3?IIO+}5RChqiwpAXMFv1f7<ofV2Zp
z{c8eNbANrEU^FGH(12Wc9FF(VG_>*|=rklD?So_;n~#o`l!d#|qd<-ieGh6!TNzqA
z^n!R)I9vjs(aI5Oi~moU#Di>N300Q`Q7n{D4%z|>zBeA5NZ~=yT=|Ce>D)oE&)*0a
zfb<8yZlDfE^#i)Oq*V(6QoAwX1-P@xX*c>SKt`=#ftEEB^l@+$Yliot4*)XSW%%!M
z%=iRd@&c4irMj$WwOF4ySWVM|6&75fpnk^<NMQV6Cxp6eTeyKH44r}uuOjl?=zoDZ
z=Q`*t420eO^-$eZxMtiA_urCt7aTsk?s3}eH$5d+GKRYnMIHQ<PHULTkRt2|@LmB^
z7Li1*m$H6_<WBGMh?6T5gxw`&zZ41Xy?MKbg8s1M-&>rtWntTdGl^rh0&FV~PHJ6E
zz>}!zCldvlm-@TTUP?9$-`n|6%3Z5snS_fi%8uL%;eCUVPqW_!hNizxzTcDPTXNyb
zy&kFG8uQeIn(}wq)oq_W7shf!|F_Wa|6)$Wf2mMrGN??ehMY@0$@!#Gc#b}0yhT0<
znZdQ-MKY%n(n?v)$9R?ZSNi-91(&)uw;uoUQ>p0W{f`e0eVlM~!jr-$Ped8}i_>@f
zM0*2Jf#Pp5VdETfQ8<wKexHZOYF<74@gEP?#oj1;tTPVXf0X)a(fQY1EBbd`dPakr
zUWSYn89E8W+8+oWqhplsOF$`P(I8>Ngo$fpcuqg~vezp?QzY4mH1dJw9r$~Ck9H~K
zp(&t0vH<pETnlu|cEQN^5+3+4ovItgp=o0ES+1~!ky(+#^MXQ8ct2Ba0FfrVy*13r
z8b5JU^YTf*O=jqd!kBMg&&@9^r@A$#e^7+-tRN>Cpm}Y|<})7_rM}ooJ@?=54)G%Y
zWIblq)_0_6VllJ+b}d4j>R=Jc>ORf6c_J@KHo>kMHNKQ0m`*g;jFwbJtxN+|>(ICe
zzuiv?9<_)<l?lfOsGe=Z+IO}a%PC~6ST%zNAg_M5{LM?qX9YF&<Sz@yr?TrlkPTq^
zBQ=8d05z+c)jp^eoEdbUf%_>BSCCdf+-1*OJpHw%s3h}RZjbcWf{w5f>e)gky=^tm
zysiIs8WS{N@Aag=7OW`pYy0#)_54=qTlzz~ZdQi|;;gt!IyUl^_@I8F<WqQ&)z_`g
zfhw^Xr(<VX19zf=W!#hd-t!(OZ&$Nj2I`w&AM<mBlcdDu4*y1<W9o-T_x!IuPV$Q1
z(K3Y5WUstPW5BE9ZoKJ{jucfmfuz~>>rU2rc`*yUiF|yujpxqHPU=;gHC5g$MdIb#
zb<r^kY(#mzr|w+Ox&0|CNZ#Ht<?wXFPtlqsaFxwG8B)w2m<Wd{8+cnTNENX8=C~H;
z=#I8ktdNHV!F<yy%P5c5VYUfcWvz~2ZfWFt-0L8Ucf!Q8`y6xw_WI(@aP!vpofjYU
z(hg9QbZb@K!9P;;KDdL<oC$%uX9JKMjibDACN%KdczQJ22l`8@tmY9y^&607&U@!r
zrTQe5@aWfT1k^GcWr(Q!D92}WQ#Q^>E_1r!i5@#Ft1Z3VQ>7x`8Uh2%U;jiLAtaW_
ztC?pVkb>YEbPf>FI&T;ACK3Qq$&EN()mJYE645)aE+49&Nz78Q61hIgLY$f;@``@B
zk@4~P1ZkmX+Kxws<%Nmbt#Jy&e)Mbbt`ZiuOMJG|7)N5uwrPXIJtdjnHQLin`tp?W
zcyWO^F7l~ezOT&7tGlq?lz<u6NubxM&5d|}$*u*47xkRVs8F>@e-+oe(Nn6gF8=-M
z!9@kLE^Yez(w0q&K5cT=Hhi^}3K8rhAgh8${iu(%6Pk4+kC_7#^L5KG7;w$FFJjH+
zoM27{^7v_G$AEv8Vfds+;Wu<l3{5?rYOyPt`R(h^zKtt}-g#~-D0*Dja`<rm{X<#B
zlo25~^1yoHTTsVXisjV8XyosBQpZj))?7Clr9sZySyGkkXX2!&Qy(rgd)U`r1Zo!?
z*VCLAtDY2=yREkoML0I^DK2QU8+p=fzl&|xmzT2J4O#dfL5_Z-{&!SS2q%J%@QqyQ
zdJS{ZMCtF@%O~or8|^LKeHzLZ=X0HiwfIWouL6Dk4DYZp^nuCHgS90el5UnY#5`sg
z_xNYzB<0&1Wq58YZ2m^v8tIgB!(^Z430Pq%G)Rn54hxfHQB?vNU-SF;Wa;mlBcE{B
zXPPwYW?{w3qNKZhruQbM%Fjmd=5Q=34Qm#9AJL?KE3MA)Eo>4VLvwxz=e&X`rfjG>
z(Hr^wgAiVoqm^E0NPQe?Os)+*mDE3oz1%?DRF<;MLaa=PM{vMec4s1wu#dTm9&^yG
z(jnAHw;a#Bc!xeCq^hp^RK&0N#M&(O?Xb2PeZHr*JT8`b#8PYFbOJK$Lh1l`(g|e^
zu5?blCZT|c1fMUTF`Oct7D}I9F`eMEV5sAea9%)rVDCeYLv^tgOu3I6cA;1M7bWL}
zrFSM7^=y9=?s%A=|2(JH%*=dAKKmyFy&L&L{8+5BOp4I1)qNdbg%$}bS!Y~lGY!WN
z<P@E){zf6&fRm<nh|_)FXx1>qJnJYpivrqk4!ZCIi<@Mv*FACCh2acTQpAr?4ji_j
z?`ZlsWV6B$>mrRLSQ2Su3!=k<ubkasce)U*x1dkA^~1G$yL9t$dDW&uV}{ZpNe3BO
zWVDcT6osflDXe@Mu~hXllwjINt2-C8I!`^U`$3so*kNo@Ba?BMeof9R43t6BA^u86
z6pw=@VZtQmc>q6kAij=f33lGL5*Y6>Qi-<L)j$E`AV1hR;cP3{M>QBf+I7y^oo937
zY+$(S{I*E%eOrIGZ@Y;`MlQPi9kq^L=rHh9dmOD?Pug==;*8qC6rM97$Fsb|4P|q%
z!!JQt;IuMaZyVG)+&BMbkDLbMG>avja~fAT@60Ds3vZ;2nkJi_jm+O}yl7A0yZQq^
zfpAe9*H{Ze&u<?RODi$4Znlvo0PFBjvT3!QmiTKvXsT4KY1nOd-NTV_-gzgjKSF(%
z>!r$A5x-AGo9>}T=hocsZ3ygLMdVaZIa(rmL;VE7^2FaU=q%<d%m$JaOjDqdxiZ3d
zYl&CXL>;1HpGGZQEyGX6@FmH1sIhm>U!QdJA`At7erTs*D~wRPvP<We?XF->AX3Y=
zEWoe4zmS&$qkAD;nmj4BSod`*+#$QLxLA~;X}FeElxWS7b!lSsR~akk&G$$(2cEJb
zq2^sn&5n7859eg6qHI<)J-2pxNbO3hrFTd)Vq#dkA(SO5u3_*ioTO-on6{_eA!sg<
zmA&T;hp`(wpE<8<9l!Fb74;$3d0NruHD#J~%3fv0(oK)jKYiX>{<J7_aGN+&VL0UX
zUjz-G1vS9B9yke{*$Xc<Ex2c$*s>QDO}eHsqR$Mao7S`@TzGVg75eBUd*8krJ?4=K
zf`lQ4k*uA0?2d;bf8n|U>}dB$RJwy^M$_QRh{Y8B-2Zueg9+Xg*FxVK(&0x=-KnTg
zMhjRq{JG&su_vF)I;QFqoIjPBo86PnO0s*o^DL27o#~PovEXyn8UeW0n+6g0i5c95
z_c@0F4Q})&%p?_GNxQ_2+~s$HPy(Cmr5uZ*>lYo<KsHxJR|09oErdiNES>{u)L_&T
z=jdZmHf%U_hAslPRRveocN9M(ZKa3EB}83NX>*ykFx;Pi)+U1SU{TvmY5(xxWJ3Ea
z)2890o%b=xukz56`qRU5qk3fqYh6*=#z52klu^i!fEk4O$4!Q;xZWAB>+jPpGbCnU
zE2hU(*56s>_H~_ZCUre{%X?&_pcn>$?$sJ__qXV*wI02h7I<1p#dqAJL|UG#&vkN=
zTbrtcY^WeAGFL#E_&Uw(rHVh}?e3mVi-+YHBV~A587uM*=iH0>ACrD4$JfLf=(lqO
zngH0pPZwd*v-?=YGQa+e`-SON_fu{I7AT%FM4Q>0-M?~nXoZz@zy2K8#wz6jYnCQr
zsqf|L3M+3%G9bE6YIo&~{F#Byn+syr;=@qzj~Xz-eQLy0$Q8Qv#C+`!8OLfmClXS&
z%EfjA?wXrRWHE7*n{3s<LKQo{VsUrpa*Qm8e7<H|n9!v@83L?*8>FxF?=o65Z`xEh
z#l{F!2=ToHT$oBo3$K{libmM@+Ayk5t;xO7yS*EoAU;?>weQHAFpW>o2tSJuNa$2M
zK(&tT@QO|jU`oqe@_J5vxOifIi(STs7i4GWhi_;}<K2zKGQq%2?G#QyZKi|%N`*6r
zuS`12TevHQZn<eqs$z^n4|QE`#Is)}GTtXaW;w4_GmHcK+C~lr7vk1EhSh5>2KAmO
zlHK+#d63OMVW9EjLnN<c5i2~a<r9b;<zNbO=v{<vmD*+|SY3$@WKMq2x^T?)T;J59
zhz{?z8#LosC>crIz#B}L(lSJ5KI!S5uvN7m9|eAM;s)&^0&L*r4g-*%P8g%4)f#IT
za$|66l^2t~_;>t7BFOfzEs20#Pn+9$HTT44c#DaE+90z+>A)@4V^5U}vawK__{XQ7
zq-~DJn>xOuwusFTg_w@{v7l^Rwhz0kf|f*;QT<nh*7LfAw0?+*tLkGRM2^hxT3>Q$
zNk#K~oG;-gRLsINFNfxO%zM<jud(chz52Y{Z&@KSzN|2R-RKL2A+7>`jowWEt5}hb
zU|R>@I8~a<C9L)U%@v#~VNp2oyIIpa2}dw?`Lv2f#Hr?hPq)u?ZO6zoJfJe@dl8oL
z`p)C!Z5>rTSr5t=m!Fq4$zSE{D!)sO(gK(l0b)`Dk-RG67)*1K%f!`IHpFh#$^Q4a
zLxLSWNkDa-Tc`T|kpHInO~d*CB}*cn7%r<%>hudpsW%Su&#q4zHo6{deO<r$gR1I9
zz%R64^l_*{&hG${t|bP8(Nc*G5I1lQvC`dAQHD{Kc}^{~M-)gLD%P@0I=yfArFSJ9
za$XLU3+6H9fGw-ArEKk*?A%S+Uu2z^@5y#cjutu0ygP9a8j+2=^<uCA2oek;Su%Ik
zAL5C;`CMD9?a}SfOxvf#s_`1Ybw6z9g{MdK895vvYXgtjl9=tO%(Z`7_-<18z)JPb
zr=phO4BLS<-@SQxB>J$yXd@WFW&Iyw#e3r@%`yU2(cWk^`2-82YC@$VZ}twtLm`xz
zN-M3t#pjG9J}^!fpL3o^O%{Xtk-t2Fv<P>+eJYM%OGbb%m6-p4VPnsq6KXXx#RFfH
zp<>RWa8RA;h=Qv7dWK@K9hFp!)9KETjTKY$w~&K@^g3T7m}nI1+iBWRwpJmS6}H+x
zl%%!sR)%CwCoC}6!JUmFmmuYFbV|5mO>v5yF}230BlHtfIRJCEtoT6`-8FrtSn(9W
zcGBDTDH#d8NnD!#{&4*?t_|i=c-3_}_WCLIQo*l|!Zg2snzyiVs2o+XCCs^;s~zr-
z7u98Vhu=r{_n5*2#FD^_jEB3r4WA>2n8de&0VuI?f~zWw^!L$_47Q4Y#(7>|P<RO~
z(WcA-t5>$grMLD^mlfsZg(61IW{MQX%rMidSfQi0Jb8ZWhX!?NOWKAA=dhAA*)t@M
z{)VlA!yx|dV*Mqa;al!PeE~TICTIFZDZH%Z5IY<5TzXhE-A+89s&i6#X;~?jUz|J~
z6Q%Jb%JWw^lq_oV7be+71k{aIWGjVJ<=vSU<&Us;udggk82X9!Cxnm;q!J-)_>xyN
z1slSq9JxiA3j`9%1F!S)LQoU#PAtxb>J8x+de+P|s`xVj6$9ECau#=9^MLDu-p;Qd
zwumgLeo|*^^kg0pzD0Uyh&FwX<R&L+OS79DZw^|Si()%i$*_%`=iw%r5zSG;4>><%
zM1w%Bs+`CJRZi1noL==X>`2V5=FNC!5}a;lT$eW=x8eGi*~+`ojwr`O{t9_}$zSHY
zf^hVXjKVvLR&GQT7X_j&X!`UaqG$v2_9<MVs({~di2XO5Hmn4z`EAbI6elC~3sgH>
zb#v~%Ba$RmCeq{eb9!W`hW8}mW0`BomMn;?KZT^%=AOJmoO|g`(N+GZ*u+pIth}rE
zy@lKo6k|tt-=Muo`akX(j+O#Z(-VFsLf<dXq(jE;Lu?wO<nn9$DdgU6!vXmlEjbm@
z9_Bq8v089h<E6i$+l^g%S@WO(bRr-2WX{3`al<J?iPj;*DfM4**8{bJJ9kvK=3z}R
z^{k(J;87zx?IH)f<8X4UD`XJ=-=HgJh-*-rFhnbVs`ww=y=hpJXS+2FMMOmm0)m1N
z6%~~sRT)}@q>74&7!d^tLR3VCh^aC~hzWvBB2cBmV<-e=QXxbn0cDEJRf^0(!jOT=
z9Jr$rZpqO1V((|~<NNXM_s@5H-;ei?w)7~;ecjh^UTdv$Eh~}{&{u$b!eCMn870aA
z7MsCjBQXC1n~~bsE4@22aXivWVhiwOA@#W=PM;a(?|vxKM2I!F+_0AMSr>dS`kYjS
zM^_{*Re^J$Lf`!zGE@G^Z$>DNgxjk~PXZ8f{W1U{|M@?e?~|#5$*#3<W-Aps!Fk{&
z>;&t}+hjAG1jV=JZIi9v?OzBJT_kB`xGZ+0#{N&A>cy|#{_BSwI;B<GhxTZEzww_q
z^S>dy6_gazPL26~x{}>VvLED85`AU?K6u$I4HKf}e+DWqiCCLH=vUDT{I@iY^v|;<
zcRtCl<XRA|rwdi~)Kq2d&rOWQl&t`$b{X)Y1?5?Ph^YK4RhX@0B6(=gI|Z=$bgE#W
z>$_{zT`)yb$k%}uJ+e0z(>E52`9M@|0Jzrg{VVNUOE);n@BdNx;kg?0F&6U*2x{p{
ztbw!~OrD@V>S8bn7*}*R#9}fz@HT|JNLRUG7x+*8Isd5OjHG`7kXYw`mS6uzI`+T)
z^Z)xVq}Wx4q`n6>@Kosy`YO&Mj&vm!lbZoMXe!-HAPlfs5SA#PV|c(~;bjLEUW!+~
zX$3(C>r|AERDq=HyET8vK>5+Mg}%&)hz3L8xU3@6RIdFD>`P=aEpP`DQvL$U=^C=`
zFUUFIs?ms%n}Drqmxpvc(7RG4;9h$clL$a9kN<ir|C4-q0Pqk%zWf;l=HpI)-Uoxm
z9mMjq%#k{~kF1rCXpUA<wowHi5#Q~J!y3vzHSSRtukZk%r`fFm^S~R%0wX^Fx1U*%
zp@}>oA@rKem{Jqc{!6C2=Re62@N)!g3sfIxYGq(z4bt10iV#E^9bk@wzZhfWTfvC$
zxuvM4&YgmzfM-ax@Ucqtl6+&B(%n_IiaJzHQUm#kh53kVaPBd`11MY^_Kyl^a0R~r
zM-+%vsE>g~zp8SOUx|?Cc+GtU6`h?BrOdYns{)Y65Xk@_>H?~QZr6-eoT0KhRj8g|
zd<ftP{-%Bj<y2%VvJoI9<Sq_~(PjTVYX8Sx2o|_NQo#HMYgv5{q>;MtjWCN}Pb!t-
zq1ANZ=#2{}r<d!O66*pa8zW|Ye*SVabK2Rf4?Sd}b{rMjwY^n^YSI7S>t$u~;8&d0
zFAi9b8aTgx(;pFfMcL&F+{aJ+RqeH${`BUiqQ{R}u35k-c_Ju3(PqnS<8xPOV0M6s
zf0u^_6=ob=1He#2*y34xB*>)&czemk=RP@F*i%s6!vJc)ulc`K@<tC^>pb7Nc4MsB
zmVCt7d<4|BqJ;eC|6r~CevoC1XvLYZg&De2HP{pf8<C@#dpFrhD2_P|03*j3C$7ar
z-(si%t~X-Mjq5<kckb1jHx>Qiv$MD77OqdycoSPLKkkXe?1{j_+dx8|(S`m+W88vt
zGwg0W_To;|^HJyG88o^ld}<zbW9Qo^7S?x=ty06|nO9$*>>w0Rd)nec@BMJd$H<is
z^ejPT4=A8P)t15k=1<k4LWM9Wu{sA-kdS~5n=UCfgL+fG7i|Ur?g$Wf{F9k-jRJUQ
z*g;@=uEVAPfO~W$<aoncP}pFoJ!x_qa2RHas9>u(r$YVz>Nl${7YPta4L<;LL$QW%
z671*dB&={SmTZ149Bk0A`MWWbUh-Zc7V(MoWz?}aO{mz=+kUby^zWKCZ)&p44_$cV
znv*iWQ_H&dkV+(&>;I$s_R^qS*Fb;=R?SB!!$@@pgiMe0w!xUv9Zji4rPiS&d)ZRx
zb9OW1VDl^MF;fYp^0uDApchXoF~hO5;jM7i*VHewW!YCem{bg+;w?|kwEc<@rz(vB
zsibiTSe*D$R)e}0T>(Vo?Y|(K0>$-^k2C>Pbp#ZEy4P|-W=lJ<(nNr0rZ2FG_w5x+
z$-1pxXv;w|kq|uILELJWoE2O+FfQR{h(Zsx=`Up`8oP)W-z1g>UVdRY@c50!hkn&%
zF(`Ds6**KQo`;e)Xj2=}6!RhZ8kix#sKS|e;7=j;_sw*HCKJe;UNqHgYRyizp1otx
zYDY1vl$bDLz_g)RQ1k``NuHsYi+P&*J;H(O!0E{{Ou4ohJc&csvsrDFd{e1lROVJR
zv(Yj=JEA;@mpkqfyie2Z(1ld#uYCc%%yP}!wzS`))9z*2A&h(dc&sDgDoSHCQhr^*
z1f!6PWN}(@_=$8Khd>A^O^2h(!9^D(v6cNY03vhFD0_R!ZXh}cd?5VbqYV>5df9~0
zC*3fA`)Ju1e>&5*$C{~q;cdV5=t1{bwHcsk*Q^Fp<CerWfk6s8r+7=TEPf)=GCSL2
zW6*0!))kJPzaHW9bD7ofDS&6!?Jb&J*3Y+`-)W2cnDk<r*Y+grv)^<!H|o{lUt_mm
zpi>xlr<oW`aCOf?%I;5cO)h0CY~GAtYpvJ-?lrR_N=50XAlv2kl+O(&#?WYPc49b2
z2TuHYZXh%~?S{fE!`aZ6QI%;whHt*<_=j#Rr5qktYJu`GE{WvTsN5~t9WRNO`oi&L
zQ#h-qFQ@Y~purUM&QEYsYgCqJFLp!1Ghdhv&|Be@jhjp692Z+QYk!R{O?q%~Y`6_~
zOhtKaSDNtAiK}N{A6?jb|JRc>`#sMdKfL|!)~z?&f>eK3mAQa<@E&}gfs)IC&e4-7
zhu~@`rWN>2ZYA3Re;80NgVlVGE-J4UnFrN5j~j)WodS0^U8g=Wuz%V#^Kw}~gGq{B
zI#WMj@ojePYId+zLg$>suRTarY9Kxcu6wU2WBf||JK}w$NeN7s{Y*a7tJEdAdP)Y9
z>$VF}+OU-08s(=CeJ-QXQx+}FmAXh3lK+u6p&Cxr9PWIm88>vkTx_vB9(#XAAr=R!
zD6a(p^F}@qHmjB!F=aqnca#%&2Pw^kG}4r7$d*98)JbTu$KDNqi<l&K1a%7z_PE$z
zXAXFhQ+@JH0$?n9C;sFsiC-#%M52av7UM_#rtLC^FT5|wAq>ZEh?mZTA~=*2%K2m`
zy$Q@Deii|QLaqV70FI7JI9Jm6Y1p3$|4B-1u3629rky3_`CyGm=1rc_iBEz{N2jCj
zj8;9l6IEIo^6N-*Nhd-5?`{>UBT!jre0w4Tl|UmCUriSW0QLHhiUJFeUf0E0TW2Ss
zHZ6Ol%R%UKvU0nGHD+E1p;E3}Mr5oZ70;tqk&vx5j%g+LLHmIt@l-{Qmm$mW&S<ri
zkxnNq1Zrz^VW6{AcpF|E58mkq_>gcR1F1*GLt!FnbErq_8TgPd7p*s&XGWWBq_vgk
zycc$fJMG%?^q{oSfs*8_sb|=%x80eZ`cby)YYHRXN4-0K(&(hGrV4-n(j#N&t1u&8
zsYTwdctzPwauSxrh7b1C84E8Hgj$gZ#MH$6#23rmZJ;5$VGB3nX7Pph5f+A?bgQSk
ziXWEjs(M`14BR8Uhu*0Q_-rrnwCoaPco4net>UH90qz^$4^vk&G~zAE$HP-C4>og#
zd%ay47lW5EN#8n=CtVdDGP~31va^pqx*eI|V=LH?rWs{oQL>tBuL4vp{{n`ofJ6$+
zh;P`mf;ba}?eB=|gG|)ASxhamzNG5y9T7)Y4*a8wUZpxgRwZSh$U2hwKlo7EG=Wg;
z9ZU;MUF<afrB5uj*0P!~*E%r9RY5e<VH9c(oLuS`U_>b}22BG0sIMqs5qUYyxVGGK
zV4k0yUbjnR^uz(U+=Ph_67se|boutdv5hcw_hXS(NYfyeYlF}kB6$iOoJxXgPG>)#
zUD9Yayq0@ORW3QB;RO(BQmH5~O>PA7-_;x)+b*eYL2iO$8cjBITTZa5-V6e}+j_sQ
z!;ti$daI(9@jy2O$5s^m?%_A;gFE^)>CKzOO}Dkx6l!E6@Y+Ygyv-}C+b;C^86zme
zuVr~#I{f@}7@YyK&;2BU$>G`Yr`Rd1(Wq9y?eUXuIJlO5`rWpMo@`~KxN+y2bnoI8
z_MPLdS#^J?eGdTJ!kDsy4!L88`oQ99V1UQp1h<CDoJf2TD)zdUu)WO^+46Okq7NW;
zp~ihJXJEL|y%0`ZH%8h$+!Q@g>-e!Kza6YM#566DEwXfO&EoTFGLk_<HUP5{V;z~&
zFa;eAJZY(0(MEuZS7*6WwSn_CL-Z5*pwQ83$)lpD%tXwXCoZ6Dj6K|Gny$unF1=;I
zzu>rV=x<je^Y~C=#H}k;zpE|(3NDlmR3dfxXT*>uI1%t$IN!SwpTD2c_&P0%Q8ofP
ziYoYn&pKW$vy)TVkc?E^ajeh5TgcxCb|d8{h?yqe$QYUN#M!0RVQyOM+cWAD#LBd?
z;4c>l%bpnwZ~k=DZ==B#EtZpisEL+U6zX7ve95a7<)CY9*k7;^kGX=_>;er-<9gWU
z%q;*uqRMv?g{i>XXm`RIV0~iAW#-2%FPwqohMrGtv&-R-KIcJxYqVc!gs_&OcA<~$
zI=uH644Vo^0l^WtA-hDt;I+msxBsK!WUNA6gRjbN#PT$yB*n{ypXEChFAE!L6;B-;
z$2(om!$ph`^!AL_>^utzB282!nIX*(b&6X5qD{)pc!4S3Kx|g)3%@^UjDGtsE@eL6
zGmMzP8>(M{`UQ+lqaNlOeRxTFU%@EvlIsqNM(OV`DGjQSMlu^%=Un2lhkzXo5Sr0O
zG@R|7lfz3xLD}KAuS$Y`#nrc`JaE{><PFXK7~Ei*=V*IpU7zP`73C|3V_;H(_aC2k
zgN!L3E|G645J(G`3~fu+P4gV3Z}Vpc#g@NMRpI>JBIYIwJ3)N-v3vUVEL?fc?%Z1v
zKj-J(4m*S@n65riRICF5DiC2owmC<Km6N6cI>hl?NtN$R(B1R%V&eQaU=ni3j{_~-
zXXTX68s&7D52qdS?PJbO)K=Eku-`n=r;SaJe0N>iU=oY*0@VfBHJq6|;Cxd0f_xgO
z7Qsmz(|}5v2)>(1rR^9!o3tzKPKHa#g}E&3`d}&Apt}w$GGd%vZfZW?-}%00yw{Qu
zK4ki~|4MCM@7S-1{sj{-jL$%C5@HREYBgCQom;zxl0@k0{GjUP@+Sg}CMi>7lab=!
z6BVF_HA#5tODYw%-4*^B;iJfNd&rGoST&X#TIWgCLuXXwFIK2lHXl00hqt4|H^Jg_
z0<C1&2h=rnUQnvAx|zC$^aj@9w@^1laCCe!^hhuJ++Gi`I}d`h*;tsNAL5>-h8_6!
zGjo11#@Dv@8rSk!Us3%dqXD+ca;>xoycGaa5<zQ`lnR%~4v)#*6uFc=LDV%4fW48m
zQuM$CMw%QJ6+=;p*FO)`c`<@J#!;#y{Lvcxh9KMO<<ZZX1Z}>r_opuXC&U=?rOMyc
zz89=qc$f%y2Y?L#x}@F#C&-L1$lVq9IibYW$_`{Drv+;SmwG`-_sCHUzYq@ec*fqO
z02S}xK5nUbyaK)~u|jR|b`>Gk^QR2l-EKbhoyq2{ul^ETIm|9nyj#tY>mQN=8Yga!
zgp}@=XtYp=k<wAf3*Z6{a<qh)Q0FvG{{cqe>U$=-^Cl#9z=NpWrw`QtGB)B{YCLnw
zXQL^3v|IRDJN@YN(ty(D0ss#*JiV$4tIK`{#yg<>AM@I|*&Gv(uWT24gX|Vgli1E{
zV6oG*(UTzTj5*f5usF^A>TS5n&%B#G9d3*{+kbSqm77t}8Bpj_9%9(`=K66aBV@2T
ze{1!Mv4*;t;w`xQQ`f=7cYHQdY&y<Q9a|4&CnH;F8VT%*r@_(cB`L$FYkEYW<;g2C
zJXELaEZ2fns=xyG3azu|9l1L?E^ryFx0YA9>~l3L3Zf#DDi{RKThekx9z~zh6HRT&
z7@8E~lhFG~SZB#noP57Tw*~!EPOF!RhQu+Us#1v18EY4Cet?<BUsp?x$H(}W2XhaE
zOrEQHRbTDv*@3M;;QdbZYoJ_@2|P?>eqb{1r|7^w<4LVV1F{L61M%^atCV#E5u613
z$&`}pCPRgybQF%(3Og;KC)AnVxk(i1u?GBK*Ys>3C}8KDdTfJvm6~JrM&<jYU_q{r
zSFVeJG=<sm4I9Y26%}YRk_VW@;+;Y0^-zZo$r+#8%+rg~9l-@v*=MB44>Aa9E`93F
z-c!8rng><UR*$vvQVW{{3WKGdo&qFVIe@Q@5=Y61c=(VzC?gJ$y2gP{4-sk;gHm?_
z#$&wT2E)`A-3wji9Ys^itDh81|A;4`il$v&hTyM+9#?9aon*hQ$r^TheSbtv_LG7J
z3JEH73jjtc@*N;j0|eP)v?#0LsAi>Fw>2F>-YO|(Q$<W&`H$UYWxZO+cf4}8KjhRN
zP3|QTPP>L$jdh%sMAjBhNh7(-=v<P;bxT348U*?QJ7mDY*F*UOoGI|i0P~B_@=KMu
zPt_<>%0VfW0h~0L7hQzZbs<^RUkT_Pfa=~6)c}eJt88Y7ej0!rl9EHo=GM_t`i9Kn
zF~ZV{^U5JN6=h72+ABClfHaVMN|x>_4an%8Kw!*4*$Fo{qg5g2q|lN|_FG^qGHx8w
z(L83@6FMJZl;emVyW{2Ef4%HV-ts*6<6bjws~eXR{LZT=i@(v~gI|^FG^j<v*}SB7
z{*d`mPF>&JJd@?a*+{-nThoiOvV2CHbbVXfN6`Z*4qp1Yhj?x`OGZb%-FCX|VzhKy
z-}+Gl<W=jHDA&fzj!_$}D3&lm7}(xHUj^UixBG2D1OLYiit(%gtt7$0tAyvsF0Lnr
zu4Wg5euX|81R^ARZOM#2?_<KHN`va!zH1GYxq)X8A8`PU`5(QpzjLJjQv8Owh8i|)
ztfKs&C;<jU8spB1;k8|2EggQFy?xh9(v9zv6>r|wLe(kP3tt0HtK0@TH+(4650400
zCd}H0o1GkRo5-=?K8jr_rv871F#g|zBN}CLz<$PoHPCo~6NpXbftY4+7pUMg;Wa^s
zI7{LO<68}~cuT2F2b-5ZzPPa=LW4<sTg_ndoHc&qbamvf7lZvw`z$RZM)w^HD+#e}
z2p@ijIk|G%`Zti(uRKq^isCu9Azy2V4*{9d6UcPG#H^8?Ow)KEeEpSq8FVd|%~QHW
z`1SZ)%$eTu&%I<XVGaY|jB72#rP27oIQHj1`U-X5zfn_=G5&~Qe`&O$zF{>9J3cu#
zJD!TtBl)*P?%}oF{k6k?9Gj%vk?@(#B^!aB)W4eDyKNLkXRB&hd<$$LDei+gUI)f{
z49d+)r)cwqs*8{R+qe0@p+AiWAVd8rWj&>XzK-lKsT}9Gpf<>@VS>O{_sk%BK^sn7
z+=g0BztN{<ceKy{s|{8M&ODd>p|1`D6e~kBe%mD`l~MlBrlLcYFYW{e|D^F92?qEq
z5LEdBe;6}hfD@o7x$&%@)wPzC>fR^c57C==nIjfJqvS3a-ps;k1ZxG@G8v5}A<=*Q
zI0}6Bs+I$wUMn)Vm+6JjB8n2K^0UsUP@=mvzJZc^b;ZSDA8MnIT&3DT`<FrdYKo1I
z&)TAN)0?-HMsY{0V-M}kicH^o^+Lhu_7kIV;^X^NmGpj9<ymkAGX7k&B-hWB_Rv1e
z@V@B1h1ITo;dO0lafvFSbl_K6D~=2lrsR4~v?+NLAHMu>6eQPv9X|EK+UmY4eES#V
z;GlfVKv<{&h`RC^cD=bO$^c(^EPLqEqYJ$Rx~YhI@9&&HQ~u>Jb}EqEfUC};9~5g?
zs45e|huiQW51&$>1$Zw~u4gFyFrnFD-Ze~>GHY11Y#L}GDfP+7K%=w9CU~SLqP(@D
z@T@J*qS8+c`EGgqd$&dla8wae8=pkkHa8-xKR<aB>&v;%2~7Q+eW1<CkLPGA`gZoB
zg;5<h?&pB}cE9gUyP9Qfv8De<4QbEKo5Vn(<LC&)<MEm;TRS^jUZ~gC*RAR8bohFr
zW9yI2hO9>&ru&ZH|2U_olaCa(ztoO!JQ}ygZt&{HKevsz#36n?rs58)*zbdK=*SHQ
zUAeYEa;wv7TTCr=_>kz-l76X0=*?9Ic#Q_tqO!hUHow>NLJ`7WotSxX(C1@C){pO5
zYD*yUdSh5<piG@Id~kH+FhND}h!gbYuR)!{{cFu&r|~u09=tc*r$M`YC2`ls>0J*^
zfBE=<rK;Qy0BVh8z?3wyvpolq&@twxnLSpQ@_e>{c)e7gPfuw-@2q?adW^<HXMB8j
z9JHwu2i^{jeDy)+cvVf+AA9cyjmEAx%6tzC4FzR3RZ-p0cT=6i11$G79>44Hj<53p
zaE`#=xbDypdFbyotvlR4HoBbuDFke!yP{Ww^FT+CHJFtRYRm=L><_M&=hAN_bH`-n
z-gQ-#tv7Xir-7G1oz`V)Nbk{)rD6VeLc;=XtM2e2)ZP{spQD)_Q;~yyj`*_q(5GPE
z!Olj089A)CL`61e6_p)uHFUiNjm-9)tddk94jx-){o3O4{o@SN%jZ^L_5CZRV2VG(
zONSj@UHc-8?dJjCf#tlatgmQzooBw1eOpQ@sj6kw+|AR>A^dBnOMadKsW^puV(8&r
z;QY)7nZs|ZR+JA%DhbKzBODgu{*5au^W|z)yzpaz-qOZ*SQ_MH*;;q&!%P2k7oqdM
z-uz35uM_!*a*lvr9a%#aPs()g{ENdw7ltT<_{z}H&!0znhH*UHFgXCaI%r^Lr+c7T
zy-vHJ!@Bo%yIxT5iAKH0;JXI`c5Dqs@MX3%5U!Q2^=7na-6lfg;|cxJREuj9Mg)#7
z`Oy7d(FL_F{&5pN=6{MmM_ibA)H`i@Eoj#oRk_z0jX49k_Kpc&AL!bZZE%gasm{Vm
z%v-WLcC}PA8(kceqa>rbxixhUUIy0I=4tu_-Ti9zmbPbySJu%L!VxzE{;&be-TnDq
zV7r$jNDiH6%<t|4ybLPAHe2Fked~Qd<UcAKmDc<s2G8`M&qc>Haqdj>k1mG2U$}z3
ziKN_jm~8MEkH9skf3}oBh0RUwWrGc8iK>D=z~k-gZP)d^_}#?#jm)v8b}x;(W9+v4
z`I5`ujn=i1M?e39=>v@)9}X!upzA9+;NAC7cwwJLhy5Cj7v9B~(RxYcS6n;oq?h2m
z;1tQ&X)#s3k|I2iHn;w0Rdv>qe&tK7UUEJ%87%x15CIWo+XG^0*aKzR+RkBNG7QO^
z!5F*1jY+76Q?3RE?YO3M^3__?gPRBL9qw)zow=Z<&;XY81gfAoDvOo`8Vr@|G^v*(
zh<E(&$cU7I!7Q(;u-35P+reRy@%Bn^(v38AX|>k3SUqZVI4yD2EqhpLx;Gz@47`58
zw2QaC5y}ysql`vUgW|=3B7;WrhlGiCY36kYyKy+}U3?VnlFq9K9n~E=+6mR#dw@Yu
zO-)rr)tmbIH*p_7eq38#K0jX!f@Qh9G25(|)RfOx?{D6gV(4A`xc8@V&!~ViZNM65
zB_#bHm6Isg`ql&w3-3mzi~Zl+oo8?e8TWNYe0El_Am=b>0mwrBrfIjGcoep($>8Dn
zfG+`GI&KqL|6!+pJ}fjCEc6*g{k7URaa>*57G>Y7wKsO9Z~kiuuTCZq2y1R{(d!5c
zv$lntYsq~bdixU}_JFMK;3;r~FM|I!{ziFdIY#gRSyA@u#lsF+H_5lFYSZ`nKNR1<
ziVsS%rhG=89kkZX@hK%d)O)(qc1in`p0mYu!3vAGKP;38K0Qpq&Ju~%7|u3PH!v7k
z!T!l37pvQtiM@<E)uB_BtedVoT1}?c9WzbX_u!nGJZI&jrA}au_>AJlsEq&-7UYHD
zE;dH!P+Bmr8KoVe)?sbco)|R;&44@CyL9att-0d**4+M`DVFp3w6Oq}XW?fMe}W=k
ze}adCcU`sZ9XV{=Iw%Gqd~>f{EP`#?9~QwPm%8L9@tuD^MWC`6pP#Om9qv$}K4GuW
zmVZmZBuOhOe_Ar?gTH|HIea_dPN0LAXLeS$`%dnlXZ4Q`zm51@JTh&e+q9rpVeew}
z`T$#nYJ`Dq@9KP|$mRHJ9=xeiOHIRQ&!6q@*!-3dB-irS%hp`IV3Y5%av+&yy>>Cw
zUq1u7*+7Soni%9Lia+P&f_vXaMO=i|k$GNIQ?s;3k+pzgGR;;3jz12LXWR{ZTU+}!
zcRX>7H@0~!c=Ac_o@dUFoX>f#?9TzqD#{<g9ut!j2rtQWc)MB<QA8+JRQB%!$<A*-
z)a&DBz5T(%W503-%~z%0f5fg69cbHY8%y2X51RO?jg@@pJY7ZEL^pPbk~vU%OsueL
zDP0`aSb<Qt5N^iNAd-(Tu<g#i;BP=SZ7&|4xf!I?fuhpG@8E!EJ3ue8YmP#}m87V5
z_8&Rrq$to<Fvy%zQ|$dFc0N5Y7aHNVTiJ20kNDIz$JqIFO`Npt%h=(6O|omN9{I#1
zU)@?*abl|Zu|G|v_W#ip^<RBRE3H%N09TJ=k@qTM!4r2Ofkvr1y=(zPV5a-6l{m*K
zH<3`y*#=P!+acpDcCnTz4rYr=8AfOOiXa<iVi`Lj=iQQFVo`7z91r-aFk!tx3(h&Q
zF3>6w1Ymyyr|Ulh%KcMneM&v~b+{ce1Fq@qf|6EzGG~q4Tdm!~&lDJSV6<T~AZfcl
zvl%aQZLUeojl^vxGEI|NX`gqEekks7$caURLpq5;Z9Gk#-j1oFDt9tl7nC7W;643c
z`%|?E4rokD5^Kng&U6#_Nc2x+9Nbqn>`c_EDv@AC2KVK+V~ECuVNM~xT_ok4?=QUP
z1ESE+e2<BAwtil8e&i>O)D-}W3d)-wF#*U7P8D9vgb0Gcxk1SWd^}$_u>zGQR_^y9
z(6a76m+$GW(@8Cx&2#LzVSPw!*J9AHy(jbv63Pf#-n95w`hqcX0q6E&D*7rdv9>6d
zO5j5xDr{k(uuzk^f-R+Md<k@!ZUO<xfbOLVKs8sTAqLEq`Z>52Y+9csQ4i{DE`vDJ
z-)jIv!A!>(vOA-cI%0jku>NnLquD^0MDL-Wua=<FY!Jy0$yhilqL6g;y+&%mK;7+N
zWcoI!42O9Tf!q*F834aw3rB}Dr6eN&=KP&W{mR31e9cGvNr%n6<T_E(8A-NWuS3M2
zdkR&LzfnA<SSvr+Ds3^F&}jJ~NqWs7TCex%kdWX)R>$01%vb}I?p)w5U}YoT$JKO-
z5x%`Hw|R;8g=t!c++Ptl_{LIQc?)vwD5d6F>NA4vUhrHCil-69^}TG(V?B$xL}@Im
zXYtw_7HwnkOtriG*1+FYeZ<sMpV@o8Y`a9R_f=o?;_pDoBnPx|qXSit42V@A=sQR0
z<yVICQ^{r!4nL%eA0%&=Il)W#N5k#zB%;VN`@a0VfN`*qV%!~W9Qk3kjh0t0!monc
zu;LC!&%q`dB}tg(<54G33yEsb>z1EZmHiByj}Cf_I~Lz9_a*sAKf{6Lq`YD0{t{>+
zwH#0}m_(K@-Z$|>uyq>BOR_0Dqt5+yesI)s+%S(n>j@f@wLWGCTU2)kMVGzWmG(|!
z0@w+7Dc9bX-B$J?0iYNhgNQ}4Q7N3ucl@QdJfQY*jTZVU5)+T!OK&p-)WV_76hqvQ
z+*U$QoVOA0otNv1j9t%ivs-S#kz>9HtjtVWSd&osPE{t9G%MGvV3bJ`1Au_1L~lhx
zIDR^E>$QHlfk^X$as#QW1%T!(tR@*7)mLo#jyJ|&$U{K8WXTYmO_X|EoW&iRcxW`z
z7GaavE;iVxLj4ISynyy_JH8FH3vuHm1kvgYiGL#qu-GKuH^^|%G)uKn=#01HChwz7
zy8;6kelWoqN_<#8b(R<GhlD;W(u>MTIo@20?SxKZ^KxJ!fbDe-!p~-#E+I>RFW<^s
z2QhfMLVgn}InNOemid5wri$^5)g&*_G!_qmi6qP_g{B=stx{C`i4KPX#$6Xo;LKCq
zi@*b;x-O}?cNQ0JsKu=dAI0Fg^8E$Ad{XvF6{QbFLpgu}p^Tko$-5M})F9LY{ttx`
z+=X^g)QXQTSVstKvd5|5;nThZ<;GB-Q_5a_%ZOW{=uf+4KflTOFf`F1KsdoG=bpNv
z7HtEYd%;8yO!23pgt7-9vnp)Eg*f1z-XU^Mb=X^$YV?LU*Y+Zxkhi0*55?t5d1LeH
zHC2!O-^A_xP2*UI%J<cvWKz~}1gT(9LDxG*jF2I5%5FMX*MdT-4(2lR9%d6cSd>y{
zB%miMcfuJzOTNJ77dQ|i*&%`%j8=mm3UUuRJ#p|5b`qO-WWz!)n)sUuGRHm3+-=7l
z{qZv@bHL^qM1X^LwwKe0|5VwAG@=}!He%6c%3-P|S{HD<lzo!wri>K7op5e||FdZ?
zue0zqgh@~&<tI3IJQRWBezWwzzpAvqGBmxMAwA7_i4R`t!(O$n|3wWR2XHw0HS8*j
zrVMjb$y<V<NkNAAw#)?}jH~HUcc_=aHwSY}xr21DsmhD@2S2#~hS(Z`n3Wm^uv-<4
zb_TbauV>smX#F}n67|d0l6C}dTw0<iW;h(WEIX#`;crFTe}a#XyVpW&dTZBxv^AU%
zEF7-)J9Hw#HCKPQ)xND{L(a|TPL~5V{VfgF%ihRq+*<Zt2aN0!>NPxUojT5G$HpSp
zQVx>FrInCI6INS(7V^v(Z-*l^nzgVZU6Q|x!~w}u8nWsnp-CBX$ICB5vQ3O?dYOx)
z>(+e%MIqTy(Z|Z4mNs9Zv4P)vwR}?-a21gNn^I>8u*Pkc{^N*yl%M7M;Dqs?(S~?9
z^C&c;1bsQClGT$=+&XumSVz`uNKbJ%7Ev19uoIe0bnu`CFoV4w4S%`_N6N5VG3z}l
zd~HNN;v*BBx{b#<f_&sUxsh-oi3(JCp>$s9JCh%vEV{`<A#pY75I}i=V-LQWcJB0-
zW5rW6lgA=gUpv=VDSt=a@BJ{g*>vQ{@q7_rl*Wl-r0g)Imp1=UMCBQcN3~MZ{Y<;9
zGxMi#ldW_lTq0UsS`fszjn3zJX5SIzVm;ox>Kj|05sAf?etY~Tymwy>-1S_o^|@LF
z93epHlfB@(0(?Tl550+R$C)XhOlyyIFnDGpKICfHp6cMw_yq7|ntT6ZYCXoKFY#$v
zh;3w|>>THHAH!jRh4&ryao+i-sxnpy9xHAg2!IdAYQP@Hvz3~SpndFYFxs%2^&TYh
zV6>IpIC=v4;I71MLWmLxaf>i*#P!(cplLKHJ+}bwCS-2th$`{%x#;pV7-1SL6(Bpj
z<oYt{4~lZmWjfEN>5&qgWGv4T8E#Y_039{t-$i3csVx)`8{i`{N3Lch-er<pTX9}#
z5gcuhEVG;uZ#B<?zfJjb*?g@TKO?TSxx(Dr?Xnyz%+OS!Se;R?)s!jrfts*);l{U7
ztXpjrr;lx<`J`-N4mCI7n(8`iUK^Dz;?8qLKTTG>jXN<Bch%)eM1<!VL>)&s3uFfL
z<rB^;oqs9jk{HlQU84eX+Vjwou2vLK%ZiXKoXs#@q><s^^TG`TwYE_X4n|;fNhK|~
zGNEUvv(F$qHK!iyQUB0=V>!wy;P+=cZhT7CQ+t$;=w`yZs^=cc4l8;1DrOTlo?nS+
z350DVRv)F4A`Q7!kd4@*c{!<xxB*7J@3&zZ2W1<oe@+5{P8+97E$f+y-$GZ<fBbrG
zkoZkT81-siHVPRt?N!0BG4M@{Twha}rK$j&8Wbpzft09qv6y=q!$c_o?viZ-ciXL)
zKs;}Qbl3|91Z7(oP>Q((GJ!G<8$7;URF7_MTh_=3Wxw4`Q+`1pN%)o;vj-x#i0g9q
zYqY5f$+hePIBW2HFGB_GosamG0q=;K+b{E^4F99TPJCLZ{6J@!RLJ(u@--ba%HdkD
zQzOX-nWQ8a5T5kS^4eN5Dxd(q(cEMY1d}f1V=%{~-?WD*zQp~OYt`{fsK0wZv6wb|
zx_c2=$9`?0LWh~K#qOdN1tJzk;l*mqhNlG~SuRfryh*WIz*B--gujDk;jGs~GLc)v
z>W$FdR@r~UzlR+d_c6H0?SSGp+y_-To7!lP5hUSRK#-v(r74Q3fiYcrBp(5R(!M-j
zBH-|h+8VYI5GJUEhTX?RbbZ*)1=3H*Cxx{{K7!lbxonVm4Nn}Gtj;cFf}Ad7Q*`cP
zS27@3-GSm#bO|v;1aNmFjc<6J{4;Y5_K*tUP!Up(7gWO-O#G(hFW@B04}zW&Mg4;>
zQ_JWVB3EiM+LYeB99i<bsQ&SMH6jU++NHro4H?e;W9qN}Q2QFDT$2gP#d<{@2i%r{
z`iWJ@spN}&Mf6X&S;4-NriJ^QjdhwLx(>AoL?$=MS`1u~%@=^iFv;W~RNq$d>=^1E
zI~RX$aF;}L>WuF+?r3zlA&VA&5k$$<Ax$`fyL9LR6<9yPxlh5{YYax)k?-WVLw>cZ
zsH@}z5&glkK|;g6A75u37WjhXS&cTjHi^=N*!Z0~RDoqq+Zk?t`{r&$%JpyK5qCmV
z<x|u~z_bbykcQyTQl$=DBym0p1Fr8beJ$D$P9J{vBdOM}`<jGXDdH!06$j^SA8@cM
zgq==GHr$OWna<k^eXM*o6Frz>Q-8dP7sJ$^iVjSit8>~%DyFVeq5Ml8y#kD4f{+RP
z)s$WG6L8qS3l5Yj?CdGI@emqYDL5FQ;J8LxrQtDPZI0S9Mp|g$MW!-Fr=+}C=xfOG
zRh+T3uI9#*a)RHMUKEk+Qlvsf;nn_830dGpNv{EgSuEuvhh^7Bzw6XWzXbmMDMg2T
z3N%FxNH+E=`xF2thpL#xR)yRj=I6ZGqQ630|7zM1=e1sSj0~{&xLC?4a;t;EOR^o@
zA-h89!*4<(3B=&tm4b|9%vQ81%xR)ke)2sQbA^|Fw;aCz^;ErW_HRxRL}^YiIVbrU
z?MLHH&(;104#;ZL%s74(T}+kP!7*o`j5(Riozjh5RcBrrl2#s)X9S;@gtdb(7PeM^
zSjf8L`Sm39vAX!vNC=8RRIeR#)x7BN<1wQXe<nXywQHje6Qpg50*C#<0%itSt<K`L
z5@w?mNVgWV6B_o)@sfpfxg&uwd^n5{T6(wu&i3sOhZl`v2({0**ZJJMspqA;^VYr(
z!gpx=N-0qVyUWPR5#aW=<uWKGO2F52CGUc%MI(Nr(|K#*2#`jHimx*-84Wqe=00^y
zznf2r0|9hd($8a}X+hP4u0wUNZ$t)O+F&=HBqqqtQu@x2q6ej^if2kYas(TCz)NdS
zU^G~fu@ZWVIdwx<X;E2p;j#sKFW2TL)_eAvx$6aWS)Ds#erMm^b?w4$K+^Vkg*7ig
znlu~)8maRVLOX|D(!6l5VGm$CJ5AdLsT)Emn?vY8)+p4iknF_pYBuED7RiuEQWSO|
zB1|Y_SWWu4*|~+<xpA#ftXz!8phelGL7Q!ej{ujX%e7<1fhSGsJL-Bgih$IY?~?Qh
z&04SqF3^~)H5!@p8QRSdfQwk)6t64g8{iN9^aemfvF51PX>i>j+lcPCo|0@xi;5rw
zgb8!K+$5W-Qf&B%yCm8gli7Dc1{xnagGn^ehL)Nal8{xCVjlta2iVmu$r<9r*O^L|
zMARhtLE-3be$>#nPTixuayMd0FpX^V>2P4+DqD$K^7!E|-5QVOr{T}ClaxU}d*~j=
zP<ept2`k1Y45RKkY<U4L&#5BB))21ea@8yGWufBW1xa27$vW45+`IpC?o*jBBktm;
zYs9bbvmgF~DZ{L#Hs;`sA}~NPa8{BeW<#@0d6xaw#ygf;lm>kiEyCE|zPg`9nx$*Z
zz$uK>r8c#8bA;Q$UcA=I!g8_V*|h1o`=i9;Iahb<OH?R!V5@PVu589pa$UYOS@EPn
z)tgk^1P+Rw3Q)#57=Z}3F_ZM>cLzY;5spL$QBea9YK$PtUWrY=$)?&0E@d0Mks&`;
zIxB%aWmt(LyGz<yw(OOB9kg4`9Bjfvhl#L-RfZ6|ej3!zx6zL96*pA#vTd$eV%>fw
zC{{8O>l~!G2zKQZ#iV~XJRlrmvK)6kvo&=4y8+o9Q1hy~I?v6>HOlr!6{<NM@}Yl1
zN!f}dOb7zeEb~-$FEhpdFXVoZO;WO4S0ZbnY?th2in?^CDF*3%%{83FI`?8y$3=-j
zinW$gV>LgpvJa@7s}}1u&Oo1~DbIsxWw-~tg(L@iRk#xXQg_^;OzDJzMNx$*__cCv
zMH!%77Vi1!(@yNpY^HBOACx;mHxhes!wg0xz^8&tw!MDsLA;(y-0;b(BjIS!CKa5@
zA|8$&1kqZ`N4hIU{i2g{pqrQ|2Zk{JSN(W9kgvqOpf;W&TFzTqfuklLUv<8d(SKn0
z;&7+Tg?#bR7V+fq`#}L|b)KFliqeL59#{9?{9={P9yOsj%x};E`*Mshwu>7<)SjiK
zw(ovgHcLyJV7%nJ=<WAuS)wJ#2MwZ7#&!D-8@V0)J#mld?8Z&!)ON2x=3Ic_{o4fW
zfA^OX*er5K3C=y>OO<1^b_}pX54vXJU{?wKSWiJeQGA{5$u)zX*T%c_=}cUp0k1(C
z_k(o8T+`jMKT8_rvGe#(yCT4y;>=4Gr86M6lPM~7;K*Zh1cg`n+R=y_^lrr?7Bwl)
zNM@J9@&=pOHVGIEhfOl=>NE$fXScn&6s6;cHK=Aj5~)YJ*4)KqsS2nDxt?u(%8d*H
z$V40jxYRa2bP}@##(={rJ`K3XR!oCTsR4Q3wr+NZqq+rq)M|RMma`uIDqO5iu?$a$
zn>pTJPR4`<M-a;oU)!C1GLJ`Ma)*Qu_0*QX17|OcQfm%KJ|Y(2eOS4{j25CTPnUa5
z!WX;00L}2wG}^RhaSJ&>;Cl$H_7@&!Bqa%^thy(1C*dIjNp-yb*OurbV?k1o%C>$j
zQ+t+orUuxt<#KHTBhMW@J3oKq<-P}%2e+!9S9#>}PR(p9NOv#*<a8t4-ekWZUJI`H
znHf$JY?4j31SvlD3~q0JUqql?d&XP3cTK`+Z$#V=4`9{&YbI~&?=v-*QZH8MPCqg}
z-m<Gl7QmsYDsIgzH)IMGX6FXk3Xjv>-z;@c*AFZ*2wwG7ec`#LE`6az_5BfU9`5y7
znvR&$eRBfZyi__*3T1>o&AR<Lea|RJh&Ka6iLp_vTacm^jJiX?j9@#zZM~qT_->=X
z9;xmxo8*RzHCyPKAVN+!8X`NDeytvCkhA>tq^z!E{pH(S9na1-^FG%<=yNON7pfo!
z4B8ySjzaBCsQY=lBvutga7=Ta34C)rEet=n*m<PSrN`P)*9B^OL47%E*j7rltWSSZ
zG@WJpb!^5kVGhE1;|^PP{#DVeTN6u72IRvE){UG2<ml=i0?i8OXIEWTWLj9)<6Zli
zb^BjZx@(Xr7A%>}wS$A0^+K|$TNiW=7ZM_+U*6k3e(5IUYfl+|^E8-NAE8-Q7tEyS
zUYPOp_@Fw?fqq4^3#Rzc3B>T3kmahJB4hkJrCv|?(-(N$r(EoXdiaT;q_Q_$5@vx9
z?Vs;m%j322|EkHo{ClhJy<7Rnzgzzkk=Fp}S}i=#DT4gOm!9R4F{Qz@iHtiyq`xV~
z(#x5{?*BI2k}B*<+V)UPEGx?63jOo;UXHx)wbtU+@e|=Ue?fi(IU*aGL6P9*a~kx{
z$(juextSU%5gEfyjXY_laGGuO6T8#H37UMjkP%G<Rw0L6Zf7Z%T)K(!^THTof;%7t
zyIkueCh?(ntaS;7w}4yOAN4C^r!hc(mB@KY@{kG?X=Ha%8o>qPCz9>J#it9DyUBIO
zm?5^&=mc<8$F%a-gxEK*86muTT&|&CX3?~C$$*z$aOb9a?&CjnFOGET?LYKfLw4kh
z1_a<!jmNV%Yk;O<E^{_CmIh~%;!ncfl2ly(H(;)M6-*l=yo4BU5pIbCVR9}wY1b((
zlWZq4cigQMtr15UG1PF?m07{8(!W8LnAP+DGAUfffGO!|!!QCEU|c19cKG}NtMkA(
z9^N9!KGvPzk78V(;IcDIrk0=ghX1R4SIVOCsp)9X7cVr8Y-qD{hM|j-kEJn(Qh=V@
z0i<5jsR9v4hZNI_hrH>-cn_$p{u!L%#vW`ykZw$#>5gzUzS72TL2ppx0=0>AD{uW$
zG<iwei9zyerLA<7ZJfS!qMC<H4!`4ZtY5(HXUS@VVljGv_FN6VsC@*(q)Yl%QOa_y
z_c_JpMlgpKexV=ly+IUT>R${BrzhjC(#m)N_g*sw<hZL*k<8~V1ics6vOUGO{B@54
z7Iq!55(EHhJW077Rs;7&4+Q*^4hjKJHZIT6wW)-wz?F5+H==G(O##e*XBgGKz>^T=
zVM6ta`rJBKflOaA80Y!5h4*89PiV#i^1j{mSonlBogGW{sdUp~9T>Ujx(TQ`&bk3H
z$3v&}`?uc?$nx6vu+`Aq;nAUeJN91N_Ct``cTiZy<LZ2bZbXr@d{a69xWq1r9lS{A
zWuBDW$XNY^5nTN>q(QH4u)%6qNeb%|<3>Qt0>am^^R*Abv(zf*(8VJaBNenC-ysKA
zS2Ly>w)8|$bx4_By>g6@kC={H9;;^(qNFs>)Mr68=L@Tsi<zY}*<Xf%6Q5s>KhaUF
zP^_$d9uOO>(Dz{N@5VrZ)MRTT`X^Uu7Q|?%F1$!8IIdu@QQ8C(qolKy*?zq&q%PSQ
z_9!6{efnA9PuQBqrY(j^_v+4Heiq{8De<1E&f6kUXWZ-SDhP48p{h8n?2ZQh*qm6p
zQJs^>*ymJtxE4Z)Y)Ql825m}ZzNiyD-x!A)d7WcVU(C=Re|zN}ynH9E?7+yF-)NT>
zn*m1Ax}q(8Mpd~B=uZB-o%TO^Y&B%(mG2F~Hh=<x3IfPsEDf%iPkkX*hn=H}XAK<}
z%S(!8^k0)S4u6@yPMj-#!>YXtMY^r(J^o3Ut_7Mv@em1{T!&eap?p=)9n8YYr=-e#
z0E)g2yjfC@Lw_yj{_eMJ01PNK4r%<2uS=-8mbP>DIe$uN+)u^}9WlQB;?SbkAYQ;-
zIP7~Q=JsN}ja4k><29gg5wOKsPb8^A+oI>Ayy;~MU4nX-UA?qay%Fc_?TsUqoXne<
zpPz|5VaW*1Pn&r21~92tjz2nn&eIy?=VV1?MW^K!1NL_q{|P^Q__qIlu)k4RQSLjX
zgOS<)$^JU+a9ah{wpyHibbRgsW5qsRzV)(1?HvW2dT|e^jjEG?8LBfCej=;NJVU73
z4!3P<MQ%nesf}ng`gqA)97Gy!?ZuDzlqAYc4*=JGu|bMWR%K5iejWT<k<iejIP@K+
z`~#>nFkP@i2CiqG8btrp{7dx!t0OJy1i+z8JqE%r5XAvt$FTE}lxM6?eI8;Ma&j=s
z6IZvqyK+NzRM`4oLv*I?|A@>mpI*AM4KaQa)JJ>%cSX^E{1Efc;J-^J;DR;;++(*$
z?Aqx=gM!I6PBOAengcbrfY@v`AwM}yfZae=$rPb;KwwClVK~@b6U9Dl2GlKb_1!O?
zy9j3$2PQq!9QFqgOJ>4Gr@4cMzw5tvJ_1y0)JA`h1f?_w!*pgPVp!7KE=}vDV91UV
zeoHc1H$;3B;t~_`c0&9IY|y}4(q>|!&pQGyh;|j%J`1roizA;R+MvXtR+DZVb_Lr$
zV#G@{F{1W;B43jh@nE_5sedtVPIkKBHo>1bVf&|C_V&@3<w88$;k`lFCGo{Swu0{O
zYSd~VAFGiT2vJ&m_^VV|0ad4=!hLOLTm1~7g*mPg)y*=Fj=50S|1Hg|)sAlBus1?v
zWQ-OURaFm6K-|Qo>CJEK1D@a1`Oie&0IJ}Dp9Od(XHu%*<%s-7FZvKkb38qFTvgbm
z+bVd{uoaGXlOSWSLJ|r3;Y--9&TBk1;FT-NfD}1-k{c>_Gso90Nxx24?QYyzqat_B
z2j=_+P!iyiSO#rf_mHY}y0%Y<<ES*eo`X7+(-dVm(2^DHV6qcV5#^dU*>B}BMt;25
z5n9~(Vn*6^$HBAjz1HiF9Zsfuj;knp#2CR}d&YVP7C_betcytILN;^y^w+U<tT=Ij
zN0=64gwKk2Fz6}itl#z~>%&Kv@$*@(K2iSQ@l2FpSwcsM52%$yxn7b0A=m9_#%u-&
z+Q>7CVwOVF2b_dhPhidW!>86~ej~G0CfjO(zT0vUxn*Q33a7r1;BdVA(==`}IlaO^
zv;@0KI*7ZMW%~>AEnc!(Jwvhc7Wh^hcOaE1cjcUYDso%68EgyNU_Ml>T=y0jq^*qz
zln~yHnGPuJr$89CaIkGJtKR8&-%i*yxQGn=Bv(RgGa8>QovZDUdlUd5Zmq)|L)d<>
z1;8ecmAOTY!6NMI*^Ohvv6R077rR*>`R!o`M}9P!y1aXjngr9thmPVi#*D!GYX!BE
z8%L8&>6TlLBQ<=3Ir`sFJf~(Uuqk>;q6$Bz1^AEW>WX&X73SLE*aP1<DK!B}pNQ67
zn%<;do+YOBOuH5*T~vA3W>G~+<A}DRhO?EK3$iQVB4D$EQ5S%1DrsTZPD+9Sptnk-
zs8;TiYl60f(iiB1<n@xQ)R#jb5F|#V72`ZWER^6A!;#5KZAsO`^46OKk)?rOzuZPN
zYH*(8PUfXQEW0@NDfh@1S5MG_1(>v?yOc5Nw-`KoP`NX^4XeC9r8bFDBgxwF>mAM)
zk!FP@X%0Tn*S2L%--e`dq#7yX0+fB9707u7=$YXakneWM%yO9Dbktx?=&<)_(~avW
ztFj4x=uPVzs^9dV%5GCeXzT>(<Cn@I4x0kD`N(X0N>T9)l7(%Z9o9P1BsHk2t7xcv
zBe|Eg6qz0Q<-K|*OY(j_^rz(HgY*yYOf&?DWWZf3b>V02?MO|B+vAwT2Af_{UD7ED
zHP*qM0o%12hTEqV@+eQWGLjt*-6;v--o$^pIO6T+OpG%0#bIq&LLum2cWiD!RvU;*
zMWY%%5c58V0C>)fmN5f~?ZX$q&K<aL0ZLzj$90nr=g-=PfqvW+#?*2~s#Unc>%>5~
zEGJdV)s0h~_i_27D8}b`K%Ccc6$w9)qu;PkzD2S=&kA+~c4CO8j7^=zBU61Ox{&!m
z?kvD-cNC1d5pLcta$%70XL}dT`fkiyluf>^AY>98xLL0|bn7-AP>JqZ>0lW)Z>MbK
zl8wiyyg?~Vl6{Ztd>NfB0<n;#<6W&lN)qPVXLTGj9(i{!5;yq;(~1(B<ds8wA1rat
z=0~<$&uEC9<=S8ksLM_$$CmBdFd6hUoKUPj1w1HZ`y8!}9mgcR0th{vF>Xnj=xatF
z9B|klQ3893%$k@L@NUp00x3%)ZpVl^_*Jv7re8G*ryH8Bims~44$IB}oQF-XMpw!(
z@^e*K*dnPN&olJFYIc=3Lill@4Rk#LIN2XS28m~bX;n|1)5{PHi`p`*<v311nQ^8E
zg>pbJhJE0~u9I0eOWGJOhg5()Od}}r1pEbHdE-f0FFyt^K3Db{dc8xcz=uRO?M<C)
zEgQCUN<3Qpc1k=mgbN#BdQ0f-A`TGw^MdTr^dh*nIj-q@gd=YJT-{sF-7<?SuUu1K
zA?p88A*?WvU{kCdoEwr9j914}L+kBCS@lqia4Dr>mzw~)k^DoZus*R~2=1K0QRp3#
zQ`&G%-#9A6ulZbjb4_GXMB(szVQuOiSNFu>({F0~p1mbZsbJD^0LtZ23@E*Lme)H4
z=3FmjotzB!LGdRCQQP|?7zc$>t(dK3Oy6SKkuhZD;X5zAVGrNl&_&HZEjc~Hn%Z>l
zf~2JrLNrdLQi74@DT*kzQ(1mn0HNbVz6HM(*4v#=^#w9<2}U%SLB8|s0^wJjUobRl
zi}Sh<qQ;u~&L=jz_gg&c-&XDVMvP)wJ_<;j2>%r^?XO%59%eNQE|m@`9x3&e{S-UJ
zD;6`ZU|cJqJq6^_+|dve@;6<LZ#?TJ^+lc?Bs)a_t6Wy3y|mya@wv;*{GnjO$K~{^
zSvtnICgx{mI<P8V>F~ZNxsmfY7B+L9dnzLGx|;Cp<7txFCj16AbDg)`6`E&4G~&G)
zZrU?=7&IQm);TgrH!e_il3mym2M&}C(~ngQgqLQ_t-bzjwtB#_oXF*hhEy=wHDD}d
zwV;JdFtRXA^aO$y4bmf!8>K0kl!jJF=y$^xkQYD<38qMn9RQ(<Ivwr37fByJcAV(9
zX7Vt?yxg#u=fi}D1d1sEqdxs3DkZ}5igot6PZ4*1QTtM&)C4nO6$vmzml1#r*Wd)v
zQ|Z;1bZRJnH5}hI3whfxQ?*I$rz9Zo&5bbyGF?8V7ENWD?1OV90YtKSS+Jj`#AbAH
zG>=ojPG=Gb>v@iU_UkOFU=E{!%V8sJ?7$%STFyAQR2DgHq5`M942twpT0vg-fSmUQ
zWjh?xwA|WHxxQ?bGfwDA%Uexvd2yxeH@6pnqT5^0Z1drx<)y5lD{uc$`{Jxz2hO)u
zMiRbUXOyyPw#KWyQ)7JcZo|){m)Imv`}(fCH_-Y(HUKuo-(7C6&bck@f?X-wz5U=@
zUr+ov(kR;O;H)(g_5O~3M1J#nPp?4%@|98t++hwZ=KQ0gNs5%U0YKUuqXjp8J=SLh
z3gQKX@~<ut1K~6{S$W^h#|4-k+?FgfE#Z{(k}(#yiq_hmWc_o*<}0q%y=AA0M}NU=
z0e)8;=m_RM2Et-^y3!M{v5=mI-U81C%dWvRY!Wc*aPYVz3|8uo4#|(amUzY1nZ1}A
zGl#xQkQtZytS=BLW+YotSBq`KwtlTq_Q#Tm>BvXHPr+eVgixn8vhmdhNp(g-%O5bX
zRW>L`K7GTipR#wLXhU8}Xe&-Uc^~asHsNZ65tPXUc=u!K`YD1+pS8Zp)^62aG2=u}
zc%32<lzDyNkj|$zZlMNqhK8lfiX6%hq-rS*%gbp)R+}X|>=L39ImYOnouV}J*5!;8
z15b$B>^(;@<IO5}z$vA{(uU317eE|X#&aCp+`8YFbXHR@&e1+*ueHxFh#_+-d~n_B
z>bpR|Cn(Tq4)1Qcaiv<3nKdzH9v9oW)j)^RYx^3z&gJbDnkymdu}V~&zQ18CWvj9u
z3?KCYzj6TxxddKvU1~Favjak+=A|h320CBy>(S;j%eF;=+yj_(ey*b7P^!BmBO#PY
z_P_nV*n0PPru+YYd@hwFMnVxQhg4!69E#a0MUvLxiV&+ya#-x@k}PH`a!xLF#TA!B
zIp?rsC}zWqtAm^gvD4MTVZ3&w^}5(z*YDZ;^Zk5&-|y}F{i9m9Zf*8_y<U&w{qRTt
z(<N;I)|UoYHRMh=?*`VOc|%K5oF_1cBSaF!Yc()SM?VM<)58R%uIfMZA5{S7k%+85
zB`X(kfySvQSg~#ZlU|@U8pXJ?L{eB5sKT$tPZXC<XF|E72jN@dxZuuaaBcvh5?xAV
z9_!~AP)7)`3-H9M^c94SfX1Gg=9yh(Qi@WWXDANdx(JxWn_57rbQE0p$Dm-=rGees
z3Rh*(H37WS1w0`RIIQg3K`1(dZg@VFYp|0MBK={)f6xw#rr`#zT*Geq&IL`v?Jt{=
z$M7>dTda)F9Bvs<><*R~ZCLDGUzCR3)E<1<ZU%+q5&l<=B>mrNBv49Y-`*trPK+mj
zW6i`EGK5tO&}9f8(znArVXp>UETkkeIolMc;GUI9<>F<l%%pE4T&<{ZH6UyU@q3U2
z1`|k)KBZlR8P>f?ppy;(B($Ng4>+SiNY@RUHp0(D#l~BK37PP=4`a@^l=n<gg^@r<
z&gSaZ_NDJl!mrpnTr}Pud|3jQj7}|FGe<X_DbR$6m!07Set;?vY3#u0Q<Hh#eF5#^
zH;QJw5q+8KgRQAzBMr~ULqoOI^QU~@-e6501It6VBy!68AHs?91?6+#v3;_?fjMC%
zuO42E3+P%nKFrD|%9G(2jIx=Sa3wpt3DiD;QR07UC|4-qLD}Q;10T0vc+qt4=;aK_
z^<yZgFj=sUV@9)(IhSW}^Z@d<OR$z5d~xN6n#^<#hFawh1*gu{G-yP#xJ|54#s0Xm
znZ`bnuZKm=U%MttqV4CQH%y~FyVM%t1i4t*K=Uh_1+FsQU^#dS&g($74uI<j6x!&U
zl|^`~SzmODt?}izaZcy@?OHLXWI=BWpG+Ip7DisZSQ*+R|1u`<c~2xqt$ljza~q}x
zpaB+O3zAd~<lhxCLKhgk6|Ul5A?hRiX15McGZ%>d0u=Ej_#Iq0Q4IXx4XmquU{`BU
zg=^ytj&pQ#M>_^*ntMJ7(l4ci<whj0jnVs3*E)EBz(DL6?JPzUC5^7DH~=XN75e4!
zB)C7e5)M3_^jhS`ceWJQ=0IP%zoi=FlL4c7#=DTUkQr{Pv^?`XZC?<(8H!E`mzM1A
zvCrROw&x~8t#B=<xi7+I)dFg!u$#|FC9MV}PG~0Ba4+!C#?)efWG*gtk0R5SJmr-l
z|1<8u`^H56>aA?f#`4~9ZH;xrTGtTMDAXdxg#L~I^n3|x!Z@mMK3J6YGj!PKT4nMw
zrJaL=CuLYZvVMe6Z)fEk=!pzN3n@6yicrI3Ih|SlF07G2uFspxeUOpAXyV_)T34j@
z_P76;x~P2xd1b{i2>IR$zvW>1OTiif=yHsace!ru(eUeH>>Zkgkb<VIFBDge!)7PX
z{fl~Pry1Mn&CsJ8xdn?gJ%Wb$Qwf13Vb^oR%ip<=Mlfx#JF8JRz(gtsrNuCH6jA3d
z1J|?$2FP$>{st1kZJZjD8te(*FA5W^xeR;MhU9u@;5;4!h;?pn5*QM4*VW)ocJsjq
zea<e<{v!$9dol1@^MmT<w1ZI;lv-b5owvg9s+c*RF86^k%Wl+VdH(>SGeg*f7*o%P
zyOM<jG;K|e_?n?xJe%?89JRdtm#}~x&2T&PjouO`>hUJF4llMa&<%}Q(N5FTl{09K
zo&%UIjP?M6a0&~GOB+ToNPtLxE)dlzrNu%1-!ga7RK!X==(VnJ*VqZP!U8tezi5UU
z<}<@Fo!C@;jzt|O+{!1x`wP=neK9%RGnN_^vQX>iiBjHH0tLJGq=}eMfQDjK1vqs-
z(Q)**`iLcTHYXz-QCAobAeJ)%G)`6Ru4S`~=6F4|Vw%BX@SGjzXO^79qY8CAf`$1e
z@8P`DBP%FRwjpCfD1rqDS}k12jWSM_qXAkDJ&qL%q&x|6BC?%sF1t-y>6U_6xkxnk
zb{DLaxz;>}o4OrM(n~_8cECBZ3nZ$W*8t5-oHv_3fz=6h<@q!nwd@Z<`tJU7lW-Wn
z>3gw4w;7?Si#+|rnNm?HRab0M{CF&Y%55*uQ|A8#c2CKQ-8JuB&0G4f^%@4yD9~}l
zBB}lN151@qZHDoi*V~&K$WduG4iJohatjx7>D32sYH<axMQtWz`U2VLWQGC7j;ZBR
z<8ZSa4ity0b>*(NuAB^wHUYz~+q`ah^tfJEvUUD&b}Kq{%L~wkHBEnWw5axy=ZxP}
z`-n+qM4%^#9fqq?MMQO=3fF*6R9K5@EQx)z{Qz{PV8G1BAtsnUR{GIu+Zuzz{fh#9
zztC~7`(@`Q+JnlcNA&xA#(WRzHL!N`)|uXnT>60)rDSnKuu1q;pl>FuSDc1>WaZt3
zXz(-p@ks`_NHKby;60hXM`rR+C|G@N77uKWMw*^Xgj|owt|uGqC#SF`>~oJ=|BlUW
z!%U9e2KK;$iS$DdkigytE*MCb4Vc@Kezx=DX?GE2H5I5>!$h8Y`E=t*dJ)w>2LK=c
zZc1idT|LP1GF+9Sl}EYanpO5`?j(w_A52TYT-yvQb%2bJH5-?m=x^~mlx4-r3L1Gi
zJdC5$$1$c+;fD@swp_g#-wqNrTJ&MKsdLspx|5(2mA;y`<4dS7Ju`|dURYlW1a23H
znmp~v(fvR#D`*P{0=vTRoC1_TVe#JX{TXZfdCObP`^`(;e$P4vhDCp%cZU7*V^&dO
z{(;MBd#-O&6EUUW9$aAw_d^cInpEfvqMk46O`lSeO}$t?1V_5cMtP)k$Fi&n*y$Ka
z<vpliW9*b9K4*RWGT%GKhFOG3MD_*sU7IA6kdeEu-R+xy`y~uH`>Wb~G$<7U|Bq7P
z0t5T%CSff*?mwT{3nbvI9BvYX*;f@L2wzjFI5Ef&0l(ZX#$4R7?h};TKZgYDlDU?O
z!%6Mdv5}x_<(=rqtrVx^wV$NkMY?8vS@rdeGSIr;j$wm=5f==MlK;1XQQCi;gdSn)
zD0c|LLQF$9pE*Y8n%dsarc}}FIQ<rNGI~Pz)$(_6CNE$oH2*-nux94(Y41Ig9>rk}
z1tuel(^3BG1!3-`VF040RawFNA>gfwEDqq98135#!dwIk%BFH;XaISOH-OWNY1;;A
z1W3}!(8onfdi-1p`FlSXtcB)Zh=^-mjT<Ch7`~<=c8*x+EZ7GP|7Lgv+1yui?^Uey
zkpGb*DNTO>(V6?m+IH6Jk63uyFz=|&9kS)zgH0j533UNSl%<z09eTHRc2nX(b2FWW
zn*=oBA_?At<u6QV$fcm!`H8tsaS5VyFyKq+3)-QD1|0LyW=&9~Srh;+<j4Zsu81dO
zsK0zdwP^VKwe@oUrRKu3GJ|A;qXYQ<>t0KUQ{0Zvs&dJX;2zp-o_>7jQa_LuaF46*
z4!pkPnO(VTWuH^#KNCtZJLfy&m|reMSNn&KI2at-R=Xf&Wt<kjo&4*0@`=`awm?1y
zZUnt?A)lc_->vY0H%i*eGB+tUzz-$d+sIx+JJHa!TVif<!1iI<7V(zSFip*RQfRSv
z|H8@)iC<ep4XyIcZi9D4Ccy_V;9-MY3t>|X@c*s(m3CRSS8-#2{sYY!CfFxDIzOAx
zc82CD+u9<*>J-oDJD%kxg7CfzT3MQ%x+*oeVp2dJfbWriUl=70N?9HiwY5wZgdSt2
zFrdph>9!12xauq%w0vV4z^`wWe{LEr(193fj9?#}8tAIm&HjA&Qhk2|aifpoXIW`?
zl5}B`{?_g+)X2&nV29fkCBJ!qBBXq0pZ?qT-{bMIDn$Jgpdzh-KgriAGiffuUY*aJ
z9esrWzG+=rRwq&(8}u5yTMphoxd7AG&_j@3Kiz|B?f=^9baEid>9m+^?fPow?T2+#
zV{O%cfbL5|2koNBgYiyP9tW*O%=)*;y6S)(CZWsF`}U=wxzWy;<V2hU<SiLVXTo;}
z-S#Lsak_59U?W<y_tcQ&<`^JDH2YT%RFD2@hGOJfpeXPOu?BHH95(auoUpNRbdd~b
zh8MD2RybySCpb6incW4ed&@ON_klIeatt+)Z?Z|&1kB<#PznA6xKkpc?zER70Kd2u
zh3Pjprq+fum$IUBuUD0Zfv*zExEM#?>8;=7HSlt6zau;1RpbE-Z$V)a`2AF-UN5V{
zhP|CJ)}wb6cmc~T<*Q)L#EjQ{@)G`*_#CqK9USX3v{>=Mq0up->4s=BX5v`Oi^MIQ
zJh!3Z#v6ujf4+&~MWNyzfgmE3xh3OtKq;xAysZe9Xht4`x^J^B0A#NRZy_V3+D**H
z?L7=mFnN)12iX69%_n;g)&7+PZU);{$8qrzBL8?!Dh<Do9hx8L8V2?$K~=FSHp2Ls
z5o$zu#KpVf@sCr7b2U=79yH(EZW~mby)iK8-hQ*oZmw%fDp%bk+-1T$9J;WHCKzy)
zej^AUd>dZ??&cwKk|uj)@n?cI(+;cqS?*P!25{+21u2g=PD;0luo=Lh1>{}S%manQ
z#$l5YkKgU`_fUuUH&mah$sG=0x(lV@G9aH?t}uQGzNT{62EgCe2#&+C%X?-8>bU5N
z9&wG{PMk4NRt#9BWLdNKgD=^clR<4<a!CK0SD1qQ(D<|u`yt_U!6!aqa_hpE29F<q
zQ(ayQ$j*5u0BX1bWbyZgJ)?@9loiTc%Gf`69T(8wsM}=8Z_u}QLroroB+&p-&fU%q
zY5q+&w48VGZH=<n=$-PuH0;7j^c>K`efb*EGLm&C&`rUc1rn|-tfy-59f3rG{djjf
z7hTpW%J+Kh+yB>y!eH4^u>}fFzgF?p7*9@j#{#g~q^ckEu`c5N-gjg}Pvvcqjdc)U
zfS(7j#Q#}C{fjz8f%n#TAzC?dS7im=s9T(`f^0rV@9&Ys_O8_QeT}TkW2l7zb$XK!
zUrO4gKDI!rQxrh<wW%uMRoz(i62QgN_ioESv`g(Pz(#^Mf+>)Pxce@BGqwBx<efmX
z1Lww%$w|ST5oh>zyY$(T*Z0>-9DMIqR`gJU$vW9bAKmHM^DsDjn<?71;*N^q4Wqq?
zj)iIj3f*1_>6SIk?eTl+=pg_ZA&WDDJAR(=$`l)8d31C53`Ft-1_^N`JG+)9j*diO
zGy!(fbI9VBb;SH)__3*t0e<`YQG^>HSC^V#A?7XcqL9>B`vQcr&jtGZrOF(<<L6Uh
zxk!0v>ABZ6)I3pPD$N-n2c4?ME~a_9oga;|Cb$h$XXS$D>U3*EedAr9kB2XyWl#R=
z5LJ~C3}He6kdOfR?>?q3SYcXV-luQ{#K<QT?Nb(pTPuSr?Qe;DbWd}UQE2K}<Goko
z5iiQp^MV0|W`*~!ZjqFoSv${kzE$}Glvp>7O1LZGKxFmo@^RR^lWqke$zn>XV|QC2
zT7d^s<SHLfO4*Gp62>h>mKk<6Ry@P-&i={S=w{+=_WoM<{^|IRjZ?2(2Pn+>71tpE
zp!g^7JETRra#<Z9YJojgIwJ_H3tM%@VAB*%vCGa1vj)~E&biVzZ2T+`L=uJ@92u^8
z%z2h8o}9Ps2_$j{zOG(T5MJ;oI4bz(toH{^x2b&r&5+t{c(g-b@Dw|@49zffLr%iq
ze3VSZ7Ky)A`?IiYvN+tO!^9BYE&JpmQ%kL}J+p0SYac5vm`^txXwW>hnd}tq;y-9@
z@gTS*ag*v&IebIXyOMSia=49bQS6fiC$po3#0{T)uX9B}>i&$^v+wS9)&?h=+^d0Q
zkoREui)Y;W=XXAAZOR|r@~booFpmG?AzH%#VYMhgA#EJ3A)LSHH9>!zJ|O8HrEh#b
zveR_5hK9cQn3HouJe#q-+@O#8i{SLta!%b&^^5X0dB^qK{W>T@ZKf6o8nWc%MWP;j
z2H5<%i!#@Reh<a$gO3D$VY&8A#bJ$g0n^R34=To9+Lg)+8KJfg_Bq!<D29&x_c|J@
z*z`z766GW@D82BOH}uW2Z?~_7;@8s$96xnZQtQGTkvuZ?CT?W~jimg|W{!4I441y}
zu|;c5`NEd`Z}!c#C5<DI?V_5nb001Z&Ksi$Pve|Uf#Em4+iQSQ{ngXz$NI*hYdyph
z%}L9|p=-<U0$<c~>RKCbSkKSROaJ;$V0GV8u+c2r@>0-c6oLacKO596dY>_n4-q!~
z(O1w(Ss8koW(xO;xO$2+9v~Y}>-R#Rc)q<|%-e?9_iL$RmzvLr^7oz|WLXEEde$<s
z@(*u)!>Hl8<0JhK0V-vEQb?_78r9-1)iPsiQi%Vhw2+dMve)ZVe9Z42zVP|;o9gO~
z?kfyY$bNv%V{AZlLkLi0w?fzG%m`vZH99&-H>PbKU}Gdox6?A$%%F=x=6bmJl=86=
zkAsn&{lI_kwX~|Hy8I5#$|CV@r8VnIx7gU^@aY`+oDlO)iehXcu)y#o^Y%$b`vl?X
zNV!9&;D_!qSXX`nP&TQ9rx@!)#Jr9|U78!zB!BU=kF6rs;8DXD3k|}W5NGIYV!^Fg
zbI0GBINSTAE1SmcjHp0a$^?Y)oHoG*jxI2sYLy+6fl#w~Y=&F^f!X1?XO3FvwrmYz
znh`dUi)PJole2ROVcPGhZ#CWAhZd)C`;9nHniCU;Gl5ElZbuR3-7tz_BB;yk#w5fD
z6viM3t<)Z2G13B5hHV)sq-P%=KviwI4asRNzZ$S#S_d>b3*S8%<l|RBJ&O(*<Qi(#
z!DhgFUXCLk9{li}+mP2jWtu7yl=|NWWO4Uy%bWYn<wa;2h_mr+RPdBLgBJzJd%O)q
zOkt7qVQ)X6`%j51re^Y*AC%QS4r}b6bPM}tc)k4MPI>fGkbBeLHsv0D-6`DNUWD!e
zwHA;7m<RggYe!^^#ETF~+AiGBc6-d1`2CC0qhVzJnYaHMs?qIqDA+h?%h)*WdzVWt
zv3<NGIr?<ytFvRrmy>A*jg2kb`lj5&_de<Yy<~?j6A&bM0-(v+jdzl5O%;Nv2TVN5
z8C4JgIb-H}jQy>mklah?sEV*=P8DOP{&ju(>oRuz`}dxkPCdTomj)^awB!GQo*<06
zAgci#d^J3XsJkq$a~ENBLjtxE*8+#M(FC09HS5!_&mir<tk9I~AIo!Wt1pNwn{7Tk
zmo;PPFN~LuzDfOXYhB30Har;DB;<pL!(9u~EQT9GTtiLg(=q)xqRgz5tGY-?Mofn7
z$VS%Wu3S!nOdu+}W7q1$a}4V2pCWt5xFudQ4(>Gk!<V+V;qLviNz(ZgVM_DOxPL%l
zks~X-&Atj=bSZCs#jJvJT!8Ox#xjQfHel`W{G##c-m^^u3O`}tZ9E#{rYr0!Jc4#s
z0S<0(XN*_zV{(jtcg~Hn882^rAb!xl3viZ!jEEZ_(Hr0jANr~#G=NOjXtGmAk?KJo
zmpc%{mZ6%>qd1o!QH>S<7a(2iHt^R2N|c7bmNW50oR@fHqv=xvIVqHi45NNVPxZd*
z?ZWHIzRf*Ywgb|P2uNQ3qKq@bXrA66`=F@jMDMx&1riZTx(_s=C&KjC^^kXFJLW(5
zm>+BC&KX%6_&5-CSF9d*68-TLf>xJ}CRlSXFoE=JX?Gf%fbMh-mb0PcyDa7k_bMN3
zS_66&HCWi&ouS%kvV+z4MlimY%5WRS`HAw)P7dFDKjs(aIR7x%yd$<E>n5QJs|t{5
zTwNSS#7!Y+Db5s81#MHi`{!r}MMMLt-`QuQI459nemXH?XOut43T4lqai29O4vPz>
zf?fZ*wC5>!kYf?FDH!yl+qv%s+f+Mqx5zpap0aOuFdeFA>hb289hoA(IDNu8_hNNV
zMT~hf`<LloXDC06^)S|s)Eygi*|S*<vO9n|5AF;C+eehCLZ2el0psg%<}_XpqQrxh
zXyI5Bzrb4N+8Rdzl4wRycQSqtb?-R<l_j5Urb@3#EkOw}-=OKb^zo=vx>Ne``NNTY
zlfS7d^LAqAqWp}ki5{)2p=*<_1Av-yV(5y^7Iq!Cj-B|w9KAhat30Z1m=#Qk)y<Qr
zm)rxdyLw$fOTaoWQN{oQf?Qz}AjIm_(vCo0zk<o^A<z!X2+J;=xt>gg)g&eWt{2w0
z92sJVe)2DZh6^go-%SeM^;YHWo4;})_RrUTKl!2%eqffx;cQEHvn>6ie`O?;qzLyo
zI^L_kQ?lpTy$#w2H-7|`IB{ZGLg;W-L$p9=5Fat?DCq3{VcOA+Cm8#iCjyR*cK&XB
zL+64#p<olW95L(%<0XQwfOtK7T%TKAXaZZ!8D1{6ZXJ^F9d*vtRr(pAknRdqSPaW#
zIij5;=(=F8yuuxz#a@;Jc3A8%UKcJ<z{Rf12FZvenV~@l0US)2QSGl}&MigXvD0+n
z19F9w?HpwuQ!JQWI$Jmfw5)dnohc{a;&2d@DW>169y{>UcF>1%nF$KF$8hoSx_a1I
zRMq2haHz)4&x)iC`w4q*0#`bJeRAIR%Sq0}gQK>~N;9u#!Mg9lyrS)+cX#9VnBJrt
z0K;X_g{;bec^w5{NEiQy!gY}CA@<Zgz>)RN#mcPOk+rN5J10*^2_J7oFhEq`M>K~b
ze$-CSCuE8UY)#VrJomiuxW05bwQ{n=)o4Fh{SCxT1_I5Q!$)l9|Jw1m;`QF$ZD&ua
zoBx5@bF~M>FeX4pzN>n#QGl(_%6H&H|IF7AJH$6c!Byg3?HSVAyc05;``5YJS8xQG
zlOJ~!i!<z-+$Xc(+`qVkBzRe3RNDA#>-=f!;lDsn;kdN)`uH>UP=nQLe*n{#Mqrr>
z3$>=KXLZk5sh^tJ?B;w)JkZ5i{a3D79DMXqs)@VtDIcKS6AUI5CN>ba6Af=ullDk@
zRpErAGD<v~@}0dEU;|ouHi1ET5`y0faZ~Yj)CnJuk5X(sPYk$++Zmhr3{b!y_Q<%8
z^}^2ii_eqX?jE^}g6D4%TEWJT3<4S{v9PiHre9~w4tR=^g3+Xr(6{qWvq(BUB0q}O
z%#vMiim3n1W5i#7!mGJq(8kXER?TKkb7MpHkGbOYKcnYfcX8~&u92Zm&FmIv<A_Bt
zw%tT~0LwlIxQf)`v-SNrXOUFb^HwePt3SzW$Rhq#N7ulL(5=s(=k6O?8}Zs2#Yq0H
zK=W_^cM+21AmuHBa40jekVTri1?kEY;e}-)?Ev&CgN_4Q>xEs;1Rh4+7RWtN{dhoj
z@_y0ulntbxb)ypQc0opl*j@#C!`EIj4cs+Lfr%zHetwy^WSjdjzt|71BBA~PN?;&U
zubNQ+5OO?){%VOKb%RLqcv)trv*khA$7GNrQv%k(g~cJ+F?Zwvdmmf_B8OxX%^}71
zi{vXdtkwWEpxy_};(>;S=g|F=Plx9suGtT;52+}cr#ber?2KUj!V+pz=hE5RTU|8o
z<}qg)?XPaU6dJVK&v)|3ip%c)fBpL8hrgYif*z*bJUOgzVZ!l8gGL*A0{yZl4V`X8
z#hv(e`rhivCfv`hbAz@=->B|+boTN_Gu+cv&ZvOFom+=Nd*sm=G9Wq4VLiR|@$xw@
z@=HlmYUw3+<3R6UH*Pe`iof(^x5{_@C%OrUpe2O0iwi%%hq}87O%&<&aETL1Yg!wA
zG9jAo+lkW%7q5Jlz8oOv(9dnHZmte6j$eM8eiZ579&2&$i1nLY#}`%{z$6f$bD*Sd
zEM8tq?<3W9^8ogdfceTuA9s^J5T}BeK{yM)`Z7+<>0oGI>s=39@&>u7b{O=u?*mrB
zir;C+q2bBWsfQP%YQ~(IDS>f@a~26xH|d{37*H^Ju2n0&<cOF!p(>erB;Lkq#XHl1
zmNNuwsf><rM(zz*3{z|~Op#uH&H$?=PlOw%=f&2{I$XEU)T?=0RpF^S`Bnus1JCOB
zDokq%=@c|_=K`1aC@f$>xP+;OyhnC{5}T0}U<Rj_d6d98Z3X*UWWBc#40%@aoMu<{
zKGZh{3}fH~QBADdh=Q<g=F7Ne?dNFD#-==;-0)L6itzX~8n!JKCbnk$W<Y9UN`D#M
zHSPy=h1OAzz2cYOUGJXp;E!MZ-9tkztqrd!nE4<~zT|mz@Aj-V!hI%e%~a^_2GXgR
zhKNL{i3m4T(E=exry!}B0DwJea2`Kv1MLR+(s)6Y$k^LmmKtv{FweC9%GD(GmQGFo
z!aDsq+K}d855Tws{}f>!V4!ClFrVmC0@mM-h6UtA5&8+}H3~@2+)^3BM})?2ZM|cc
zdEHr5pfAA}$I;^gyO(+=zB<(y9faHxXdW_$u9%vVpR2$57N$;gaI{7wP*3U5NOnwe
zYUw~tl)s<bU|Gv>4T{jz3*T-L5|x-jX)3UJ;h_IT{RNr}a1#m>n-{?t)6WAqA*a*(
zP88@rOGXS1a}C#ZK#GHmL^YR$?yG+Miyt)i(awk1T<pi3Aq!wv@i0!H&&*9J&<CSo
zEAY5^a8~?_>i-9MR|p${#}7GJg#KhDBq+2!ItA;&m#PC>KX7y$EIeEMjv6SZLal->
zEQaRO$C~{|;VvfK&MkWgHTgkT@Ophw&ih#~-C}k(EgX&x6<29qUPg478gC2iS_i%g
z47Vme8lyf{T>_PD%6`Tr;*t|_9E5@ujJ1q^3c%-nk%R40yrzIYfB`<k;|X$gfS!3f
zdH^b%%c6+Mz+Ikp5Zan<MNRIK@0!VtNE9x>hp%O7`}v198&5ro6l<EDmD&3Cbd_pl
zuB<IC4vn0>=NVqpsj~b9tOr(IMP3nusJRqr)bgQ;87%qd<~aVhB#zP4*uj{-=MA}k
zzZJMYEtntK{)TcjT=VO1gB{HE(bwP3?m^K3c-Mv?j9*HYwl4=F<J|f}z91u;{sY9A
zGn2$oL?k{&o3^hm@0<*K7r&)j!b}N3^{L%_EW>A#OUK|n9>94IJ8Bmf-MNcj!v_@I
z{yDalEdZ{3%~Zch|1t}%BzO{eHi<PyM2zu&QIekI)RKXyZ3?G2CQKB~*F5r>Wd`q=
zHi#K{P=4-nb5eQ9#LTLxa1UbL$hExJ6SleI6K9_09&S!ig|`AlMdLsbu@mr$HP}ZY
z%ciIaqNckzAEEItUykI?NZgu7aK=m$9DC-)Km@jWadvERY~kAUhq~M^#Jc9};m5J*
zPCgHX2Y?E>oo#-kZ=a2MOJ76AnIp~F`i<G2+=pxyCsM7)BoB)2k@r7(APO~2b4`8t
zEBopTqpUSI!@}_UWM#}?`}`^@mv2~5c=hS|b2IqO!^|t6{w}>6!k#7Py||F`I(Od(
z&(9MUclR4;r2#cCz{p%f5Z+#LP^`}rdh<!+d%L-;%uWK3*y^KO_JTC$i0&|N$m|@i
zeIfcT^Uj|#AEuqXQ9aR^Z<5v+un+nQ+@)>7K5DY(hW-n?WuGIO_XIcT_mK&3xMa6m
zh#vhV7lYpk43t?MCm=x}0Q7U<Y*1PbE{(D2mp0C3(40?u2Vh4R^JGOn87D?hwSozb
ztMMxNzWL3KqejHoKRq8lzlMS_$Z7xzTJ-@|Mb_+Hw&Y6B$g1RtfC?_f^6B<6bRuF5
z%q^}bKMo*`Pt(;oFZyvV)zm?6Sx`n#i(qEyZx5}E$Dgm0f`Q$;jq{0b=ZBcMLrV@x
zD0~sP{}UMPPY7%NMO|jT`zC1uU5=H!08S7SHqz7~gA}^;On?Dg|Css<dM${gh$<i?
zxJcr*cAtUhnfg_w)C%}|*V1xF{dwOoL)X$8A741u+tBWA12&C~Qvo$AbTkvTXNt<D
z|Du-lfj;>QcyReJ{HZNn7EF@8qN;UZG#2B2kg~WMuv*uYDICs-6fZC6O?#^}D2e<6
z9hqiN{@t`^)A9miL+3Z+x0kYuW6ML@jH4BLdlAhv_{_2{!Y>4&BP=ui`xV4)m?Z!%
z&r{k#F=GwwR6osO)x%n<)2Weawp~Sgk$_4(*4SJxv#Twxnf6W08d?`;GxK)vWZfU*
z#7GKoyqsjTTXTiu1a)MHR7dE*jC+WarE#+RqLF%8$Ez>hOW1g1O<7*Bs8y{ay51(Q
zXkykIzojv@#+(05Cp3~oj?T^=@eP0M?-O#JTv7Y$(#Hyw4}h*jgdK>k%H)4hfmmH+
zM4-V9D@^6;vp{1!WeUa6T%h2t!LTpysexk59o&9M;4y??NYt3FqiQLvg$-~yFZk?0
z)bnbV(uJoxvy{(iAwLPxcQi-^Fdjp&yQvstQzXtNZ;hSYWzlK2t$4wkzjt1fGQ8^Q
z6W%`fnDer+p(Sm#Vyxs|sJ-bzwp-S-xt;?X$GItX3)&uQm*h=VvypyXKgEZWPPYz~
z#%~RmZrT&jv$xyG;mxTvl@Ui@zD9+<qt14XpDl5uKa^nfLPzvpy`}_R6dMP;9hmeP
zcRd$gGcQT92sO^X9a7Y?cT-*90gbRJa{z&fQ#-~TS+MgD^c}M0YK4A7whS>B5?>5O
zt!!l7C08O7QF?d0y_vSDD}MQhe(7&F)j#KIf#Ay&$P@`j>H5=CYoPqhJKP9>e!h&+
zAE!pUHpy)9;9qaYo`8OIRCsCI)Sz$AMR|}jj*ar_Na~V)(U1k1|J0AclK$SjO-)Eq
z=z(0bI=l+$B!MHJ^MP_ijP6M{@qFGg1uh^a2B?f6dtOEciLt8{E(5qgz%F;-LcfOv
zm<&Xn!?fLdDI<3n0L)Tx=;+eq6F)dt{hE4i@9`XO6mpC9y~xZ0CYg(xT0AdhE4US3
zM)?_Ij@J);fEG>k`WDsgG|1a7vhTa}NBDU^?_Z35;qG^QVBRkLbU6M`UZ_oRjLhy$
z5vCVtgfAeg{cDkzg-yM4x0ZJ+oRvkT@Pi`y`zbSs8;@Xs&q!&;2ksr5uDB8ybr6%s
z7wOL7>ojJqV|nsOIPcI1OEd7WpT8?veL>+6D_VAgzUHLRPN*og#~JOVB-O_ajcJUD
zK{<ObpRzX6$enE#9u{<T_>%odZ}`u0`G@vhZG&(7-5Tw)54F5g{bxk^j3G=6FolnR
zf-4+&ZV3wl(8{90&T$8+_hUG+Yf2k_Awzp`hHz&^gw-t0?x(VJxZ8DLWMs6HZrR_>
zBk4_2Nhb#FJh8`Rn<A;?<HL5$H5&OIX9n8{#hCwRx$z6<dvs<Kg}|*8Jc01mh`i+k
z2dhIcCf7c|JP{_tkdt45y|Y-Dm>pmOXGw_bEz_>0n8t3WZx4M+Gn2i2@Cg5~k|+|a
zBRM46NnMvaLTkg8ER#@#V$%Qf1Fg8i^1`}^dQcmDQa(ql={><>bFMZ+w0ej}5Cfme
zCA(%Ytzm$0W*8y|x+eU$oZXl)T44Fu%ys$FhqrmSkuzZ<&t?p1GQOi<n~IF6*vU-c
zE)uAtptG!r{TFq=LUoagtnLLL@fR0F-6HxJ8QMck^Jb{y9E8lIDNA@%@-J%Rv`$Z?
z<dle^2`6;mwf&vi>NZ?@%2+=Wumj*+fGS!;Rh2Q}M4xxS@a^2Y#ewCY9iOXxoo5IK
z7H*x}r(^?u8BTI%ib}v_E}@U1kY5-VfCJK`Kni;Gl@`h;+=~loq)k$`oe1;ptAdEh
zR743iO?-fjRZfDhi6O*LY#FDd)NCEJJ;H8fvqoq~qsoU)<dMmdk3!R*ypA<U*?E%?
z*8mjl(&aziCvrS3<!oh<G|Ica*>lhADX5#5uEbBA3^CU~BRDq^nj79D{lj7FcAFaO
zuSV+g7ksv)$%iL{51@tLB%j(Bbb!H)G2T{zlF=VMo<VlPMzUbBL;J$|Fpg2~l7u&2
zn8Miz^Ugs54HY2{hWSYkDv6J$W_&Gr-sadpDhq8Ic=uX$@}19n+iV%?h8-$&+HtDB
z=zYU{a#dK2ouos)5M3ewlKj|+1tYem^B+%N^|kPI*+<eqT+_2yU$lz9kcqom>DwDv
z0r&Ew<=#hsdQsmh)31vnU)A}m+nN3Cp39zfdrlt?+V@rqe^Tr8|G(D*6I?BzCKR2v
zs1aQM-3P^3f53hGqldqx?+|Mu)Fxox<Jjc*w;wkYTu<8&80vF8W7DZEKh+f-Sly7R
z3*Yaw`e7E?GHS<f*kcEn(+x;jW6!RGRtK;Vmf8;wUrk+m(c|`kv2m74pa*bTU-UQ?
z_!wq(<{n9FdDR#b(DLM*Z}mOxOTYS!`yW|-WA)1STR(2rw_LB{eNJYX!afxKmdl*=
z6|ue?sT{HMlOCT?S8#EDd1Ie;{WEnOPswR|^LO!Ne)<6e)`Af{=vJS6Vt_^xXJCm<
zU+}$w<<tbPXWz5Nr<|7!jUa2V$3FZ|)|i(b*x1bB*23{2wRTdn*T|=M!q$yn<Bokf
zox8!qVD}O0xk233oXZUBjc2Y}-??{A^>lYP-C;nw`RO1nP+a5KHFnI;=Nz1Tj>T#^
z^yb6n#-^6L8-8oqtCz7}|1$2LC+gD7_{Rq3`_hjsRWrH6?|-&tMf)~Bimp80edV6V
z4!@Fb_j-05c-CW^zV0cIJ@;N?=w_pm1IXLgwP}ZBU#qnz{HT&HeffyYZDlLlWb241
ze)X1vn@;l9M^|k+b;R(Ao8gYfrimxls~p($vA8nKk^k5D-I|JkncT$g9C^Cbbv}0D
zrQ-K{tJ$+v4=oBvJ60DbInPg+W|*BfHSJS7!Ci;n@+6UD0{5RiaQ3Y1M6=$HYf&f;
z3bhNRiu!r?flUqbj~JB!o)uvZP0`=JX<0nyw7$rl`TGWHjd||J=zF2(cRWeX8oPON
z&(HQZqe%aEYsUm#P#&pn{snkqH9<65gS^qEDqyVzaS~T-9N38`u>F9!(ZC{h1xyM6
zA}UfBk0a||#))6I>hgU5z+)T+4+dMN*j%|Zv~YoCpj!k);Q{hKho%mwSznZO1jwNs
ztU?n2Q{62Al)#R?cfcpI06SUuyKi@QO9*X?P}820Ua%GB>Ssj7NsLJ%<Ar3JmBfD!
z??m5xar$venqevPF3lO36*(rt(A&(IrBA8S-W2iR6&kh{#W+BcsbS|p2k92N>;~RE
zQ<V8HYVVK=tg^h5(XOr_$}ABLT^ZOa)QGv6@+qSM#$}QQxloVoCrfCHp+5>2Q*;#j
zcGLDUR%WgS%#IenkOJJu7PwcqRff;2Bu#z}*bsudxaxrzZBYB5_&oKt>eB8UL~|#s
z-+#0cNDIE(GG=`8b(BcmbnTCcU(EDF{P$*jHrB8?5cH?5iUO!aGgjdImyPM5t~TTb
zPrC3&#+m8#6$%d-gO?7Bs*d>+-5Z9>Ao-){5`0bB4MFhGBK*~fP(XHwCSSd3m-W0Q
zk>0;gEsH2acYoW}6CNok+;HCS{SkBBc0y{yi;D#tPnJCGS)Wt0DeLH+(?=(Lj5k#M
zP?Cm{d`1;%dRqF8urzYmeGPzy-f~aB@!stBE@$?kb-wt4bSifL#RrdWTugFJsdJ@1
z{-rc)4T>zFE_5yBm&grs?y$Wp&b=?si42MpTmLjaAjTz)IXCd%|N1H~zHv+^=|_{*
zt8VT;_8reN@O{jtqyz6#f)QR<;Sci8PY5q2lgGeNDg4H%mC77srNUJ9`yizc%-F=F
zj^0GTSD<9#jF{*AHDaY$-#$C(9<gQo{FM2S?bu?kcIX}wmEkjBXVr&(gM}R@!~z}`
z&1m0U3I|rhpLo}S3g33cML5=h*SpHSvfVO8;TI}&zC7w9D=RJuJ^3)AY=CBckx|NN
zscJq_7MkNYl2|_J-(5j&cCPuX_Rpif?>y`XIADH?*Ewa(Y5CQK98^1P5WQFXjcHR8
zw<$MtO;PZLtm56PtGhRxJh2kEP;+nMw*ke^N@1qD!X1v1kTl`fZFENnc_3!4rdAyq
z4hI7z25)Kd5AUUb%8NhWqe1?@y_?dEPoH}kQkJ$oO9FP=28h-b<s-ZXHCX-<920)p
zvAdI^#e1Sa!(SP)Oz}t#`Ko<o1&kKeR?09!y|)j=H8I^D@$wlB&tn2m7~BaSl$s`m
zpZME&)x1aS_EXY3V1XK)#J(y7w^KCOcPA)FB8DF9!3VxQVv+{6oCko#Q35SEhu18<
zV_25T{A@Ut6CG7XHngcL^9KMmud4F%@6XNXJ81il6Ybdjf3{%&*j%wmZ`o6!0xc-?
z>XFqi!>efC5N$8=hJeAD$*}VHyP6)$E{Gl`!EPag1WKB8+kEe?-g39=xre_2Ys2d;
z;>7+^OaFA<)zI8UphHGX!4YmeK{0~lCZ+%Z5g7C&G-f`dV!HW3X)BUn@h&XeJKI6-
z@M|f*RQh0&Jpfe8{rz5Ul7G{7;^Fp~*R_~gomBhhH5fj=7p%vdzzfKll~8)el%^~R
zU@Np~JCuK1Bdt*!8MGx2aq`*`i(y5i1iN8+Nvjc>Pnz(04sla#oqvA!Pt8@$q?(Ji
zGQRwG9*`|wud-|e3TyC%e}to<KxEC=Wh3gcn3=vvQh|3&kl-p&I#AC`o1JsCzS|(v
z6<YF1$#kuTA?&*iws2J8M!1T%WGa}#8Ajb{z7y^HU^xG_g8{&=Rx{-VdH<pgYG4!^
z3BWY=q?#<boIWV1|D-rlS_O2Jo7g(ageWMVaCtV4I;&lqjO`9lsFcBn71o{?GUp`X
zL5W5v+t?&uUN{Bw-4e~R*oUUe!BXUgvb+q;=?--R`)@GZlKiHk2%&ca)aKk^H8`IU
zLR0je#ojxJ8XIDCamN<iVHK#DpEYxd8r)sD0cQl((#yw3aXKRD4YB`@zZEkKHM;3^
zv&F*r{iCuIkBW{2iNamZy#R0${U<8Q9MEWl7A|Uoky+bw0{j8R*g%4g_5#QISQ$gH
z33MeZaU+VoGDh3dNb2%|X%mY<{OVaR$2WUIz?PW;FxLe2*_cKAs^QgsXl-TQAqbQW
zz8>YhI~^MnN=W3G!#U$WqOZ4M#sK|<qWQTw;!!o(WOKhQkfV9lGW6Bo`^<3lPT(Z#
z`83|6O6qcw(_COhb^_MHrO#Vho@ei~7N)tEWtq7Kp%4eIaEdezeAQ$ag&qOX@D41Y
zc|m`CBQ>C<#!Q8evT(}_c8(_{JwOF)HM*GN!F<E6CZVLV{c`i|k$?^GEfHxQK4r=~
z#T-(8KpM2Nmng{!m&nqajGyq^WP*5bXiObyZ&$!Bs5=q2MP#huB_pIM&WN33J^BIS
zh^hHm-@vf;1#@=%ZE;k1`Lv^bM(MbJm}6Nv11O>-X0X0_pE<I^2B<+;a~sss6a)!(
z+)th?>%RSU+t<Q1@M}pSpQ{H4dnZ}_ZaNIw0-)BG;N9P_t%#j8KEGjsHT#-ek~TA?
z@%zZh`@Ho}J{Os61fdMb?E}hL2o~I%2AHReZsP6TaPNVCQHgn?%<)XXkF^u5c+FUE
zs7#J$2Scw#HVL9aUAy19?DLKeM=@8zg~!w8Cwh)jY#&}|{@a9n>SvW@5T8~$!wpcc
zhys}E@?IIX6T68T*%4#B0F=b<w~sg`)l{~xjh@;e`*bsEL5=FflkYCibN*N(Cg{$_
zc%_$)`5oE$%^;_4+sRvCKeiS4+B4Dt&p_b;x|8NU{D#kT9MttlrYpkov8f)w&1g43
zG{AZ7eSj7;KANI1U{rtpV(a}h)Wm8auodW_4!CU1syhD}**tiK88oDDsvUcWqJy_=
z4+ho!Hkb(Bw^i9>1NdpcOB=77-u<76=53C8=8r><4GMO`_hpuV-uk^0S_L%l5_-A7
zTaJ9DdCK}qcp1_=aOEpSdxjY(QtF-?n!Aa21cQM~cx#%i3=qRK<ToJ8WLmgLdZvq{
z2B`8GQwDIJ=y$u-_kEztFT|A0!u6aja7?dH-S2$d_8NFEKUeETS%B-kb5jRz?9_hW
zI$v1nH-0mQqS)jD5JgS5xWapw2Cpo!z=#@saG108GiN;<2Q43O9lB_kd<RF4mQc`e
z8U{H2U43YS{kjDRbdp9srfnFrzE*=dHDps@<mVoAK&uK_y-^k^%IqY<<_mMl;le^=
zD!DU<p@l<n*Ro@S%4V_`;)Dwr_?LNdYhXu!>9a`VsRuQ_(@UJps?yTGcH2#*)`W~t
zX1y4Q3b&UFRX;7j`v<{-m<xhpyD5UF?UOm&RXCMWzeyrmp+FvK4b9B@?;a*q;0;B0
z7bcQ)*k?^L%YAD)KfdO1G$Br1HQBIrU?Nn1<+Vxsk4w&e{(aRzRPgW5|BYDG;)&*q
zfimiH+Y+bLaeR8*`wq^oLNK|frKaJ*-G-pZC?|7w^XjMVx_^4vMqhY-`0|zzRpm1p
zT80&U>*NB(ZL#G|T#%^OfQsohF&V&li!kdy`!<xyGsGAz^2n~R7(B>rd@FOgZ(_z9
zgI!0pjvZB9dEx8<LM9j9?=4S*%|sNi09EM3jQYa&MSt1=Iw~{Mx3CM7;pKJzeb}f#
zi@u4>&}Uq>KI0~HNV&qwi=C)=G_)v4DsbS|4NAq&hv%;>Zj3M;9JlJRn{Ol3QP9-E
z_9^Q=TLQqF@qwVaL!!d7B$TrS5~SjsnV~Twx5S#NzR!|R_kZm{pBs#*y(aZLI?S5Q
zBP$(FKYd>C3VB71sJWc2e(Ig-cS(czuk^vf`fo{~vVF#Y+#ZbJt>GQ-kT(JYoTY>^
zzJg!XO)FfDa}X2K39A)nA5X!5d#FU2+=`49d9GRJ2OedIeEl6~ZJ#Cfs9JrEs2yUk
z^sAaYIF$L>Ti!T2;y7|YHZYc=Ihp^VtTZ^198Hci?4d-4UtQa~R{o`9dgoqXU0v7A
zzVc^VpPCF**(<TiN^UT5HMlF@aG?`i18SiJdy|D#SE$4OkEyB>hqMOg>*J$5f(Fnr
ze$CA^h_Qbl$)F#yE!09k{jTX(Toq>c;JqO!*|z5wO=72a^V!4(DZfHZp8S7jH2?2K
za|3Da16pC6zHCTsMfOk)5FPAou9{uu*f%jT?Y>VMQ4>f`JEY=`ks-ur5Gap2F2=Gd
zqW)xi$lTfxqmdQS_k4k@t#9WNI;ECX<L5eB&3cNK8Y~k%f%Rl!CbAOrDBZw5q>3v9
zW06z=8nI%up9dt&ND()kMKla)*2;%^+Z-EfM9U3aAQc@bBqT4PlfcdQ<%WLvM=m5t
zVJ$0l&-&fidUy29vzGc$aCjvLFo|IJzmL&gj?u>(DRzO2nGZ8Pfeg1by8RnNpBt2!
zLejt++q7QaxkcvP=_E*Fte}Nn6dB{^Pg?8x46*kM8M;%`+20~3GLA_+4bP^Z5BoMA
zmC>iRbT0qQaWLn3hg#+CkS#<x-aGy~Di&NJ5C>O;D$5DM3kHmKP>eru%uGUTsFvP?
zjF20OvzBc=$40%=mz~7Tuv?c7HJyZC#r@SSRIC~->aqG!X6|v(w)`aY@nI!-i85iE
zu2J>wCgE8ti63ClXIn$`AEmh!0X^^3@~N4nxAj%ChV;DBP(!c0aBI-s&ctMV=(Nu^
zj7u!p>mM*R>8aOH!#drIt6T@5t8hOeC?G%#K4YRuJ_46QU(Pqm2siN-^brAzk*UxW
z`)#XzR4+p(C<0~aT>+-h+ZUmlUt4SDyv7^TD}6}qdLL>UhOVABeecKHMeS4lEBF7v
zkNpn_`akMB|JUDC<xE6V0_TH-F9KD;to*o)(%Gy3nX?+=^B4G7H8&=lB)ww$03<kc
z0!bT(7EbPnomR^t+i=A_4A;K7(q?LS;(T#Leeb&6-xUkJ8B%8lBwn8Y8>sz@+Ej!V
zFM~2n>bdOLq%h8rE$}hW3*1V;+ND5gJo$AfC$((Ux<;{|sh|vSOcaJtO)t-r;QvQ=
z$xCsn!Uz0cAR>0G-r<&Aul`uOC|uv)g*0rNZ@;JtRI>*M8K1WVf-ULK4B0Cbf@NGN
z9B-0em3b?Sot9&%pLpDjIE^aUN)p`WBuHSaR`>^3yCNImbeUC$J>%K6nBF9uS?zEB
zdwm~fb`Vp-i^J@r_k<vpnY=Q}+8IZ-V?p}X5*20P>*`Q#H}k=;+-ti!GIu_E9T&do
zs+(c<4fE^2?J(W8bG~y&h54^4K-dXnMd(Lv3bGOgBj}YIlq_VcVvo%AzJ!#F*ef4%
zEM^fMSwsS1e37UVl2fpy**=Dob)#Y37thusU#gj=nw02>{`V8^JJ)qv-K6P!FJAuJ
zn&#iZ{{S|gfyV{RGTWbUpE-03-i^v{z{=&rv>0XaB{)?EyjE{<Y%}%>IjvA{JE8%N
zCL-IY-mX9@2e&62cNMxXHhJ-cyyTi*?aLP%hlI%uqedzQCqkPK+h<=DgrP9TjCKk^
zI0;nqc!>Jwve_6iR9MgGB4sqgkRX#r5MfNH1j+ScAyLmbth;OUWN5BdvB)?Optm_j
znyVIEhPJ#259sxIDqHXPq2Q6~n19HbkiU;GQE~q)ZvxLesgA^_jFE*7e9~PEfJ=l~
zaZ^EYU;w*_i7DP9?^ODFs#{xg4E)8lLFRS8_;a&EI%h5Xt#i$|eMVL2Qa~{yPVATU
z1W3Z<K4>U-5E`{AFHGehGC1yOa5NgUAHeSciXUJ%(1E@E7p0HvqBilSY~c1lh{Q*9
zU_eLWYR_)3hLhXrj<PPWWz(GHs6klXgpvQAk#5m^eOcJjiSm*#gERhNhCv?+N;mDE
z^gF5ccl!ZD!xIHdja6l#r~Z8UvT{b>m-fr^omtM(H`iaAJrSi9AKMuJ$FI9~d7>DP
z9pVYXUdlU@iFRZ|g4hjU(@A7JA>C#0OqVY+9!G+Ld3ZEewqyK=vJTWI=vnR$IKP@u
z!%aC;R|l^|k=D&dL*q9*qAJcGHy%<2d^(LSAcSp!1D97IeT+Ia9%XDog3iRb2n7>P
z-DebA2fMqHA$g0Kq6&`^Wh7oN+Mhg{J9<lDCCtEjK@EQqbg%iP$Jt{v{lZ4}d|rC|
zGOofxT0YiBU|d7Pdj&xLBm7ZFBeGpt#0b|6?CcA5yoNU&UPNzDprMh(C$n`v9l4z1
z$8hv1SX12Ua$tbcu=4qfL6#rjYux+dQJ-yOl+QSqt2PvYA`}wf9mzl<xvj7+Q`*0*
zf%GtbK<wZqUm(;S{T*GzL#xj)^sfN0d>5$0Jg!Ov$pmzR(yi06Fkz9R_Bp_&@2?gZ
zc+4&xn&ub-1CrL(R(awL<Du-vrTGdK<=Qbudm#z({5&VsJp~|35tCu+;Xjc4eP{<@
zor}Sd)Vggi3I@6uW4)(yUyX<IUal+|&rme>@8MZU2a8V#F}-MM3pmhCkarsewj#`Z
z-#aK_H(56y3k}Na`dQd@RB{(rhgD<QS>OoAmehPoWA*C!&K5#<-oaJ}Wc0^2IGyS+
z6U;rH2h>pSQaKHTMl0mrF*U$46BOIp08!I!%l-VE{$2q8f~fq9THM>G_N7TCKvskL
z3KTAoANnQ%I!;-mxF!ROG<6{K%UtCl%i}S$X$MO}M+>zT7SQXX{q)^%LML8-Wb{Pc
z0NbGkmTrbI;{3g?vXx1hr7->P@ZbZ(SeEsE-BSZUp^#L97%hOe<|qMnZvwQ~TBJ4t
zk`#kNb^ziV>1j5oRaQvANOL>#dTPC_u?l4NRWN;&2Y47>tzsjx2Se9Qgf*JpO<pp|
z6sOwG##&pQlIf=g|J)o=RXyz(ky$qDU@xr%g7&uFE*>nD;@y8LS0!kH<3Vz@<^c3y
z`;Uy!1tZ#S7|aB^@F+MCY7#y8)JfFKOeVc+<T%O9{KH1@2K~Ulm`t|-5M+^Zh2N}W
zLs``mL0G`XQO~yz1Fx3)jQdW8>CB8%)xIWH{O5X~*tioLIKaWtC$7i*k)5->Y%0tI
z59?OG^Chuu8lxSW!?|+{CGW%Ze?7n9!;89vvxApg5=~Y&Xjo=NXsarej8JTXH|Tq$
zy0Qg%>`+4sY26Ir2f8ib_S#iY?{<xlt*q(aM9Fuf1S=-V*RMyT&E?t6)k~XlM&$MG
z=6x=XN6hMr_oAr(kx^A!`~nUWh@`}?SAgYre2HQ&+%Mw-4BZQvM>|Iij+0a%demT0
zMy(2l3KGTOj??QF0r>~G<rLr=iZhL1x9;Xc)EL20*~;3SprTM@ga0u=!pWALEDRW|
zVLe||UQ(5}NSF#k-DREWLN&VC40k0Xgfd=y7_Ka#61_%nx)rojGE4_?qk>@Al@$?X
zQ4bVw+1sJOHoR%`V3bpA=wesP0PXC>s1nZ`TF<PbSc3u=z!~rT>AyB9=(#3j^#u44
zC+M#QO@(uNp)d01%3{zo#tzsq(w9DE_9iGSp)==TP&zyC0Q6U_6RW4#{XDZXC%_SC
z>zT}+AGHgQZf`EDSvwy1xl!NHb2zcMJ(e1=^``3gy8`@b2WjgWV=j1EQxTx7Bm^@u
zxGd*|bVQ@O2+r~SK5oc}6g8!@9mJG1q}goz#v$8$YZ@A2in_`l!%0rk=;K3k4Y92*
z-h-ZHg>hxQ#Sa^d;)uX(dRxeUX$>L>;ZiSb%adEeS<ALGEjUxwB>5!uhyzMUSRR=5
zErTb!zEhyiHWNDeutUoZio+d_frdn%W+3~NvL(~C|Enj#y|s0SMvNKflm^9CwUdj-
z1qX{k8+{UdgBXS|UI5(ha=1U>b&!5w8PD%cr`teH=^X2K3IiGAHr|#*b?P)!_yVjG
z&RD|S6oNO0rno|eDh)qa)Gr+5fExTVvv?-P?!$Cz>mc^Z*S#vutedL;1pVg``bxS*
zTJsfsmurM*Ds%>-{G2t;!ree)=~GARUcaG>1rlO^13D$ZW&mdv^h7W*@zcjxXU9+H
z(&lH3B0s%evB&(}_3wVv2mR5=+Hc_CuTOk#K5SwE8vf<buqo4IkEiLR;cJAA3N1*U
zUP(SRekix>QAr3O*rV9QxJT2`IUTX-nn2CHU~|i0xOvhm$@$^3#Dz~N#Gfl<Gaz?#
zG6_0H%pk0`B_wcl*<_gpu+T=U!3hD7G`aKnqElgtiOw)vC$cCsz`SmR?IH>{;+YuB
zYznLVXB)?BlVbx#B(3w)^1pi@lg3D|%gVUbH|gk;YVR;lE$50Ir2OTdXe*V!iDkc$
z&^Z$9of1g7kYPT6`Tyv8^Qb27|6Lr5ii!{g1qC50Dk=iCvQ&gbrHYCel?n<%YEjvQ
z)Cv+IW)Nf-^08L=R0?r}sECLVs0fJ=mbMhx34}tnR(6?Dh*L6|{$94fd+xdCe(&)d
zj`{~P^Il%-^Lid8ixM6Xol%VEo)8H;{66?t6x`L_xECxbI^q4WFOc!DB_h|qva;z!
zyS`Qg%TGrXx0%x?>Cr4=I|55GyK)2|*svrJ5!8K7KwWOGNLS%Z=^w6RE{Wx*!`uak
zQGbviW+Zit+*naoh2`8-GM7gd*tOde&T7N#4N^vjGqNOXmUq>89Y3fero{44@42Ef
zG0(F@a9i#D9AszzHH7i-m<>psbB!&;BnNcQ-;#4UANg^BqQJPu6ur?%wSdV>+{NAr
z?+S#YpXPo{0R#<7@j|HgMGNna$QsEi%+Ra)a>$7e=R7-mM@IM0ol_1&y=Ho39feq_
zg}3jjYi_0t{MWjHIDpUJNqc}uoEGao+cxIbZh&srhLW#csn5+PPk@;_U5$M~bIDcY
zHb8N10lQLu=<-_nl3n+IpA_~O=dN#6hrjz>_KV@~C$d^9k`R~A--c!%_1F9ByN}jE
ze->6M37k`%84YH@>yC+)cWOeg_bOh4d@io9kl=JlJogHkG+ZxpyyjfG9DnV>@D=v3
z+`ZKFh3u(4m8j-sAsaa&<nK?GcpdGIH9GL?8;=l1WmmL)>}tx0r^=jIIj&t8#HKd-
zL7N^4W6GqS_zj0Nu4q9IcMZE#@gcK@az?dF-^zipoQ+5jeE_mW#9N-cnnN1dG|2YM
z?woY4mHc8d@ar7>Jgm$|OHBDkbNoKX25*EFNX1`bj5=~5N^iKtU4r}9$>%$8*5AP&
zzi)JlOXaLldoUYBt1;JX!cslCj(ypQZ$2su&bvE0WW_u3vU|^@?zQkt)Twzn59erY
zwVtpJ_xNSDX(9uTFGj6n0F#xVL$nEJ)dk4YiIoYMcLQ@FCsZ-No1jO`Hr%qdML%36
z7Xufuzl(+N=FQ&kbF2L`pFDL6EFQQV^<?Jfn7^E?4(q>5CKv37_n-R_;ZcN?hc*Bu
zq$UgAJ+FQ?I1dZ-#r+lHg`DNxHA|Jn+JsU=SdD5p>&|V<B5B)EN<-k~1M(vb^HG=E
zF8PHJ(cdx>M7Ww)NmU?X_Ot%9w`Lq_cD_gm{fZof(wAcr1*4fK`_>Uo|2&!rdt9aY
zAsmZrKo-HMPIjaZ9<HqQZi3UCHZ|R5Kv<#kU(S15buUaR<MIH0lenvB?1t>*(CBQ+
zy;jyvYF+;S&Q)|n+*edIqI4n_(`uY_KXPfnayO;*7B?_+{?=PiqmSJiX5hP2)Rdv6
zC^N0XF_X5u(>)3*#C50C^sCe*u`PpvdpewpcX(Xzzi~1ZZta)eH%=9uka?NDo`aSW
z=B}jCv@V|xUE1f;6nZ$nzZq_Klh`EC6Wg{A1}*suIp?||d%iR?7rUH2)0QS=Es7YL
z2Q@^M$I6O~Y5N2A5iQ5dq<c%u3PbF(d;c>V)DZB{U{o+s3$E}xvO%<6mk*mZtPX`v
zf{cF@zpqBpM5{1CRwxc#x~rlk=wesymS<TFX7Q{vC+fd$Bx<tavfYtqz*g-{UnXyP
z5@F^a|C?X6bLCy*G(jTQ3(n3*KO)u_gCEfsnQ;H{Bl1kr5k;~{yFTzmamga5V74a{
z+hV<53d5!!-N<@$IK76V;HS-=j9(Scl;}ded#0lpyI+WN$l-&c@}8oqg0a`_`WlH+
z@bNww2e9?);XbVphas|;!FZu{#u<n(hf2_{M(To^^$J6=$!Dx?L}`M4$fPY`OB({X
z8FNcCk&csm(}=ha`zZsVTFaAphKDH<N8G`HSdyifB23ec>2Ad${ZbXw8BK9l%~foG
zu<5Q~W&46Sl=TL%W!Yw`p*K`hz!toMoi)CBUYSq=Gn~R3JAXod>3QO8<TCabpn(Sb
zvltzT^h-6HV6hWmQRw!Bqw;6>3)-FBzFBehsrHKh)&xDqp_)9;eY^6qcSA?t&gwru
z+DdvcF&8^jaxct3{=YBy`#WRlCU_DsQ#@naJ35yfQf+b!)guhS2K)rSb{<LPHZX-%
z6H5V6$%g)c{e?QDDz{+|PFKDxy*7R?vS1^0D<d6OL8$E~C>f6zUm=_ot#(XQ*v0v}
z-Pz94n_@I76Mi>p(U{*LEef;)YW2hz7$;Yg3w!2YFZ5JVKt!}iQ0gf--dHjg;F>L(
zKN7I_ZgF#zNrb=5FC#%q2VoztuBTITyZT1`xvQnoG1~C875wAff2K@@>X8XzMIjyC
z1!9c9Qqd!<KC$Ktd_7jxSe+|j4TJ=P>|BlgQ^L2a;&NOw)yUZ#J9I@MH)&HDPAv>C
zFly(7oLT?one*i0(IF~Yfd>2<V~9U3>S|7pJxm$l0!ZjRx$xPuhAJxHtfM!DE^V^?
zj+!o?b0>9w(iOW#eX_NRvN&3M`||?T#q521Zyz;$X7IjDdmO2o52N-FpxJ6ahlO+&
ztsuU|YzaGt49uKY1LPH)o!HRz!g10KbxZ~<qCsZN<!DEWjLq1I`Dc6$-IX1x{V|3u
zMy?XKAgQJ|ZT?+Ws3uaIsz+vmB+0)yiaF)~NKs<B;5X+JR)F!gAFdbU8;p5aOG6cX
z0oQ>Y&CHthYOwO&+c}`xn~YWhs%;4o@|f*;)TQznJLD)v_|c7G^FNU^-l|^DOJhY(
zRkSTViF+TqI*6auql^@jt95WH!jTS^?u8irlhFTLZzL4TQ?}%yJgw;{0-S^cdFs%K
z!aF#ao8}=49EpP|!TO=~J(KnmGc7zre5&5fJcmOMQOzyS9I96{JDp0G$VLNN$^7sT
zK}0~xj~_Gv7xSYoEWi1a!Emh}7eHopCLal2z;`A+Ap7IwdLkQ$#v0@lt`*x>X^=@e
zu?G&L2jc^9X<!FuhpO}w_6CYE+yAgMrZ&#ABi6f>rLw+$*`=g-B%r6T@@CQ4)}p-g
zaUPYgDC6%K|7`A)kpJw#S~TkY2R_aC1HX=%9q-&N2-$B!wtiEQUXs-Dq-@*MFZW$d
zyF*bhG_Q08Z;{heGM;*PqUVz8xO>QX)Kit4C0ga0S@L9E=Uwa*JoH#Wz5R)pU!olf
z>Ppw-Y=2PU>c4hqFS}E9`iM;;N4b;Q&LEa-BNt4fVsep0-6k_pt3w+=&eK4dHu2Xz
z&UTopMk^VV@F90N3bZZW>KRmh9Mq73EH^E!;<D-PG-Z>JR#}dR9u;>NiaRH_SU1w7
z33>+8Wh&l3wFvCIlD~8psIlp5egP;bEv48~>EYjKy$!cjIW8V8SpQwU(#hVlA(+}J
znuCL~nUkHzk&@`xD5?+Un8upfvEb>JCo_W^-ms@8U(x4@73p$xw_`FS-A53B{%#{X
z5Foa}BkRQFNKOd8KctYeoG-DaLN|kmT2J1YQU%r`&B04BO>UGjGRSdPw|&>HG)ah`
zNZhk!%J_vKFnn9z_-bl3eJOMx+L(P`kH6w>slxYYJ-NMZ<_)7x-bzK3zlxqITEZ@U
zb+KUG@vQI?RT~8lRm3H`?|L}$-Ea2{|L7om3gvanipB=tT2sn`fK=t5(X8%&Fe9hM
ziW~AO@kF4Cg>M+1@DT)%Q1zcXogJcVn`lONC@I+=t24XN;Y7kq*_O^+M4IEibu^du
zSPF&RtKHRmGiGW@*oW)K$IAMCxgR-uzM^;9$n(pNSVOzNUeR6XiV@0yjpi6M@J#*Q
zD-FPkhEcDQ?)Xj2QZ+1jDPIVMIBVy2BK9%!INRoURsgp5e!TnoxF@^rh0B7n8y_W1
zejDY|`)2HIZ~g1YyirxvR}?7)x0Oz+wdQPr#!7d?F=k4ZtJrhBiykUZv0m2WG-bkJ
zpb$b2+BF0lqJG&*N7HaOK^o`S<1pFV{Mf?rS(p1?k6#kh=YBFLHtc<WE9*R9howMZ
zq75W}6PqGmGZT?{qLoApWS%yvGsBY%B|p<n$x9R2ce=Ce1y?vWXs+7p>P&0Gv2ORR
z7aoVZxqmYbWAGw=I3!K|V{XOFlZ--HaA0`Alir=wS3Y`C_}O>zLzr#ajNvct#okt|
z12xs(+x+q;i2n|>x#!vVU)Ok9y8PTRSeD}VHK1LdPbJe?rF~h=pi3^#Cbnt=xUWA1
zTVZFjitywweiGxgilF&q(6(d3oOi8LF+K@_UBcS66Ozq3fltr0*8ae+Q5tFGvy*$V
zhX(K9Od42|GDwe$YPBbkx^?SNK{LqMy@A|B4GrKl^>Vpn(3dpTQs=StkKie&#cYdT
ztr(4o@5!H;Y2-`V%ufo^Vt$w+_O9u&iR-)>Yqe!C5jinSooofP|BXGJ?tAW$z4G!i
zZ+XyY;|d=PA@y%@7E4pR?aPYH+4|w1tFcw)hc9W$8y#<4m<vM~r#rmXKHq5Y?jzt>
zrK_f&&IahmT{wF&(i&Gx{z~*|JN=9!&)OX4gXER<0&!lGh>BlQ4En3-uUKXQ%;50?
zGY}Cd@jq;Bi8^LD=ZPsecgjyXt+k9?={WtfaoPRC5rdhoaBU>n^g(m0s+TWJo9MSM
z`Lo8{uM^0@Fg%o+$2xD(x;Sqg_Sw&Q>e#67HdhZD-@USE4v~S>`Ou@~{U&t$^GI@G
z9TqHCOA}{Usr2&U<QRq_@imN<P3~ryuwCmc+A@T^j1RNt%t@Q}s2TeWZ-?xt7VK}|
zAMbW5E}o=IG}0-D7Z(KfId`IV(qTg8Tw5Q&)N`sd=b%kKib_E5Gnx2X&rOfqgG7`L
zXf<wp(l}F>E^?7^I4G=8-Bc2NPArm$n2I)rmqYnVA8l)-n&F-rkh;lUTH_mX=KTGL
z+vno>O{}y^kXv<%to5p=S-<FEsim>4pW_!A`28Tq<WIPSP9T8S3)H$G%4z)6-+HZk
z^pGFoK59O+DQzd`!ESts_ox|3<c@amBc6K!>Wk<N;(UoY1-av+;?KqXq<b)r)E|l$
zeAgV1?A>$fcB9Z|Z6w&iurp?HQaj7f61gk?fp;Ok5TBb*nxn1?+sP8_r4QbPdBPkB
zUzPi6KgU@S3B8+$c6QwEUg4x+lN&X2#%fc|o=29K4Gz}$7#!$!oV?#7w4_#L?T?z^
zcEwc=Cep<(rv^ebE&xApwv@}7HRn=a*Y~P4Z&`RSeeoafqDoF(8qRIWYIuHtJbC2h
zM7H(bfvbDJHcO=c%+kEavla4dAek_kkFk`!&kJnu%b2&O6j~-WY}1CVGUn*$Q{1)b
zZ#{G3l!~=Da?`2D0sRpd_dgE1ouB<q270x*n)>rbgHOyCuG=@~UCKXFJs(mayu8Vk
zGRtl2+xqWozQ=7aFEv2#QW4WL_y~9N3H*YJnlUY(>+ne7<NHyp_j`+>>?iEoL5{n7
z4_dEoXH7WUZ#&riRv5L>g&+IqctHPHbyOo%c;9PxBXzsPr{t-8eUTjws=UJ7R|{e&
z6r9o!2L+Wr{xV{XYB1u$`J&d4(9j3$kowz2LRAp*r5MI}pLb2?Q}%Z|+l{{js?eyj
z*L$GNdj9`!(Sf)R4|g@tbn0$60c@dd;seTufUAO0Pnplzi+h%EBHC%Iae6a%2SnUg
zVoNATF#l#A6n2-^xPM)VMZL||l?leUOMsT{QC)Eu;K;n40j+KSM|@@8qdq`c&<XP{
zO`q=iQ(&5+3LURZ^JKs-mdQDTdF@8US85h2LH2VOD$jAAL>ju-Qi*7_+2K*{(r)Lx
z7H@V%l)k^Xx+iu)R7~E!C%+B`H?Hd)QBeO>{@blGn8nF@U}xk{oKQ_ce=4|VnlHPr
zu&-FkF~mdf4ED3LRJ^Oub_<tDQ`~KfAa!sHE>^ZJkEo`J3xh{*Yj_X)eCFRR8rb11
z&R=j#cHH)RePEe@+_jt@+18(>Voe-FDGEeF&*2-<))9wmbPoYyb(|fdoXV^aTMGG!
zHS1A6_<-2j1V7-Zrxo8DDW;}#E-CYA%?voU_P+kExp8hjHz$j(7q@*ihcE#CAkf}h
zqg@5f34T2yd#~}s1?oYc3Wh$%N%w$e0MTyI^GdhWBAM4!!V=pdv0jUr6;(&yh`juG
z%>LB<(W>0t%?HbBx*dLFhCUbm^y0gXCjs_3%^Kio9I*Mk!bq6hjnujX0X#l0q<AzA
zL0^)VyEG*`jtVp1{i^=?1-8od)4zJV8Xa$*U+mlb@^qO^>K;9ExmYoYfEp<me~<mG
zrvWmkI%XDkA^zwoXB{4gtt8h{=R~@Yn>skoj=UM>+%fL*vY#-Q|3uepk9*7<m08UY
zvwr-?gJW*T?jLU}4(Q+Ts7MI9X*+gO1ypn|FPm-%=ng)<Nj`A}OIFjbIZf#i+fZIZ
z)PBwpwbdy{OD~k5twFsqLB5kY*4ZBzwEs+Dc4%PNz3$i(_k!sA%D;>9J@%r!Ys-`a
zgjzkhq~$gZ9bnESx;#2M%lQ<P2k(JqjvZ;tf!n;0+W|q?(Gh3f6=W%~9S$5G1sRfo
z(kqLzM`<bOao--P9yDy?o7Q+e0oB*^wdrBxT8p!Js==j@QyULORDTh0O?umt39ZA?
z`274k2JcJ%!FcJ`BXv*26^uH^{w{KnmrCcU&TZf?CLB9y8@VmwCA4MuwqPt}O5>F#
zq*#wpm(dpCLz3NMY+k*Q<xbZjE0mh?*4~-2gc%+m)Hr!lbba}F#B4!sNIbyDLN%>A
zUgA2kM_hi^z?O6rNGN0k+}Z!q6_4p=Tx-rni14$>KDjy96u;fo1OTH1tgFdwDw#MY
zkX)M2FCFO&T3=(4pTryp2=chuGVoG%(tSa$9~t!9eD6#5uD_zq`KNkF_KOuAJlPG+
zMHnZ94vwudt+5m+qD3p%U5&Egdig3G=yH=)KJ>cY+mIT%3fT8OrH)R67aB}PXN_84
z=L1CHi*2Jv#=MTbD?R#l$A*giMZk$*+bl*8Gx{zl`ANhPOutbsES>lO?8OEnRpe@^
zZKr4p+p$3gab1kj`EQ&65gX|bqw-JXKNtVmKkBw27Z__&Bwmprq317bIr6!|yH>EQ
zxm+n|Bv9b8_wUeT;N}=z%?I1cU*@Yx>lSU1C`;418@h-k)x1Q`E_6W2N}kqT*xOsf
zaLBzAd9YwDdaE3`o#Xukm!5<vW3;t?O~1Arhw;>%z~(MXCKt`oE+O1?`7{??+#naG
zy_(li!B6En?(g!%1%L}Mi}ZJOE69$0Fj{HhmCCVuJZ^0xb@uS`6_r0L>vD>6m?hti
zz1euT>f7cpgZESL!bMyuQcjUf_1UV@>cr`YHO-u}1HY-9lF=K7ws&(JLD|^C^~&44
z`hw3;e@UyOMD{u_R+U#`$LNika;7Yd)RY%pk4vEC+kcmRz;bKcY3Wx~fFJqF2TC>D
z+F>w@UirY3?52M*vjaR8_cz2+WW^5M3ycylz|_K&f`v6#iZk5J6*^NNFy2>Zd_qoC
z=N-e$sstx$8!p<13Ou(|=R7)prbspzymJn@|9`7u8O*jKb(_S|z-n?54qG%=GRtAY
zAl<7;8$Z;1q6)QDGOxurnsN4_RY_2JpR(qBiZhkWx$Lgp-7ysN2sei^!*K4}4j6<>
zP@a~ZEepFfTbY&caMZOj?s+2D7pd#w3t=$tr5eF)(^5!qWomgns4|(jhhoEZ);8_#
zcJR(k@wPdv!uA@|BKB20?^ySGw6M1{^xlcl$<ooK>#BQR7dQ%P_c;MR$!FEiiPWFO
zW&BA@yNo@c@zMQQ<9V0tVa{1wmZy+PbXzBDc41!i)+W*|v2<h50+&<|<vqq(jRBQB
zmC;&oguN9do{Z{>?&+58y@6*>nSRmnGxTm<Kc)j;ku87gnIa*SMC23N$9y0PvsL8}
zPkJc%SqOTK<Brkt)mK8`jq90<xK8XHC#1scP>IP{wQ)Mo&bgz#e9+4k3C<LcGs8vI
z9TSe{rhUFvz0#jez%M|kWu!|X?bxREd=qzbZ2;N!A$U1fly#<b#5a-&zFld5x{vAg
zW{-7=5;2RoZJR-OJbD$k3xPa~_CxV#)sdEPBqZv>vg@l2-a$#xU=O!X{(LGs6t<3w
z+r8qi62W9UW}7H-7dKH>9w*$fd8NEH&>8Pz9_&P_oISkjy^eR;zbVij>|R^m5%58K
zapv4p+lsCYRT)K~h(7$$$EHmjQ9By3k;Wmau7n=Cqr{-m!XX#tpx%tD9VNQWZ`22R
z&)w~I`s=Avt3R{6$7%Er;ZGTVmUTawbevpwHtDU*@GAR1`hV>N=bB89=Jneif%m%#
zL9O|W*qDexy|QCi{cxT6YI<{RpmOHV<_4>6uc(w*R+hZnAbpFocOER&KxF0Z*M%<G
zXmPVeGCM@_d~9fAlH6P9YT*vT7$JxC$Z{wCK(gjjsZ+_e0Eq7+8U4@45B54~J$w(r
zj7^Fh?WI;6k1*>PlrjGJo&B9<dd>Ky`!`w&HWv8|oX%eL8Ne^#M$IeKRU@Yp+VCw>
z!i3f2=Gx4ggY)aD<&+!{RA%Og>`*Syl)G<(P2VSl{C-D6rD=r4ht#hi7ul@{vxt3N
zik!MPIOad=10*#NK^nH~0aApwX_^jQ&T!@?m97|uu$wc(I*-dqbG~HxAdDzjMzVkW
z^w<A<^Xk))ovVQic(<5EA866+s)R-RulOq@y9FD6Rh?D`u^4l1g*=72oZJwWTjd5T
z=}uMiOnI_Mt?MDslFW)sC>%PzQ*6drxS>jA<?u!;8M4aqtG*H3<Mc=SOjl7N!la}9
z{Ib9GbXKg1ekgZ#DbxPeb6z%wNG4di8sxMc4|j{yoWpy<v8h*aVgu5Wu<Yi3f_JI1
zvxyI)IUU@M<9uV%ogLk>lVuhdxc}}@Ut=lM2%dsk5uYJ?34cKn;*1}aoT%hI$<m{Y
ztN&+z{TmP<EyM>=fd&%Pq*AhrzErfBE#Hf0D7=`d)+SXzUwG!$xTjbOLSe;qA|vde
zMerTWYkqOKfX(}&dwOIhX#3Nc60eD(@q;zh<=@$5?4+-NhSDKewc|(_BS~D|Ml9ns
z#iun*WzfuV<^$rO?iOtg#{rFgskYzc#H5VT+-mW=sDG0tVEG&IMN_Z#q4$!4x!9h;
zlD97}3Bsl3eoMoT1XUJ49IcGoNgesYcJi*)x`Agy_Q=b>+SifaMmW+_Z5Jh$uX4<2
zS*3SKZ{4)s^c~8(!|+M@oG(#IGZ6hSCvRYJ%Fy)58YVidGM_X6I<%q1*q-mrZ)pO^
zD-R<-Fit)0Z+sXS5R~QpbK>p(H&yAahU<P_9DVH-b<tr1&35oCnOs0gwY@4`^^tnO
zShS4@M(Oo!%ZPvuB(xS${z0SlPS)5xVCORMAjjqvHPN?38+v^NsU<V^Hl!IP<!qLh
zsHY@0%CGm`yK%4Q;>wPhjB|SQO2mX56qhlsa(0yBrNJNXxLpuMV&U*eWp#E;u6C77
z9!iL^-BZRt+8qiLgv74cM-e8H@F=J2{o$G_f9aunhTh@BF&VGu-#g+i2AZFBxg4sB
zfp4rzaX*hWE2k2HaR^8@)_~qcBr82&rYdm~G<jyG2(O~bs-iKP1KHShrogcF!oHmG
zFCq)2B_`y`w=q9`<+wQ!Qkf-C{JP70)>bbE0%R3PSwu4XHBy*6>0k+U-(IGwN|S5+
zi=XmOExmQRvu2wz$o~Z9nC`sk*_yJBX)D{K5R2z#_SXOU=FOKdMBnsrw)5|ve~Mr8
z>53oa=sAQiol-SVcmlOd1g?F|34*r%4s}(XI1O19o9{0f`joHiO}-nz2}HRW>RM`@
zn}1pbR`OQ|dxy8wKE|$eNpQrsK{(&HLL_ZWOPiQ6WEg>dgeho&BZ@2HGTy`{ty!b?
zF!@^mzd^o;omR(R%CS=-rodH9ZeUr54LNtzT)Jd^{ai@3D9cBLz7{B7_L-5r?|{~A
z%%v(IH6IZ;wL$UsxB+$r;!vc}v91(%wj>wcE#z#*kuw<W0~AN)>F4pl{kcuS?$0q@
z^OY^`J}SePXI^&4T5YSVK5Zcsq{iHLpPYa5K5{P7-_I?^tX)1H-#YvI7@X@XV)Q(P
zSn96{gku{;e1;oh5)HGLToWF^;MK%E<ZQ-R61nC0CbeB)_8tzsg#Gd$&?2eAyBIxA
zkCc_2Pb+-<cmE{p+2Xw7&(6{b+xE9kll$F)K&j}k!DGNDpMkl9QZ-U1PG$}uXf{$m
zfET0hmAS+^q+dKhM`3WV{*r2vS}z_zpg6+n6bq5(pvxxL<>?+3>0bV<bsU%=<P~4c
zA^$T=B`j`0rKqqgCWv~dr-IKbSla{Q!nBs7*gScYVV+^hg~P&%RKwP<-!va+FNt|+
zmwiaJ-SKQiS5(v!`v>`V%d1icZL;;~KO(ptV92Bzj_!MSs2sP=od6&Mo$$n@soWLZ
zA-+kCD|-8b4|dv&bm^s;j!9Hr5=vUNG|MUK+rU8!*7D<Hm3)&)=PYD##Ixg!qKN7Z
zcaj^b;-g=l2~j?yjGA<jMj!p1PhEKAytY(why0``Yp(B53zl~@)%%zG*+&B(t*Pn&
zuBW%FoJyB1_)pVozja?Os+dE>f`>$)u+N8M`U79soJ3nid?Mu>yNpUzf_fu6RdlYh
zZN<qAC6DpXH1wtH<T_cw4Qhs`*ZI<Z<{*AXIB=<S%a*t2s7G^s24m+{m_9R52I+BA
zAix81inc|hoQ@u*^tWjkSX*W+V!+;}N`0ZW6fcjwJ?}^JYPrTh!b{~k<Hf~c)rVjF
zR8>_b#`ff1d4o1qR&A_dP`sZwRLA5;YMsK(6;!z^vAYDe<mTUccfHgC(z-U}Z@rr^
zg4urpK4USYf4_(oqFgz8Xg_x?K25&9NLxy^su8BPa?ZOZ%j<6yI5Dm^Lj@vYb7pza
z({$3!BD_bwCnIz8{P@xAuk|RSuH+g&SVurEwcp2}MokF@7xwFIJu(V@ITc?GK`PG*
zo^??i&c|)3+1$<eupd4TU^>n`b^ps}ofFf@D)xtZ(Yg-MuA*7uXD&T$eDr%D9zV4c
zk?9`*^4_?RqM;U50!yFi!dLPZ{>~N+u@)vG`>EKXD#FB{OrhrR@%R}Yd5kjr7tF#9
zlX7u6ji<GQgsLKRLZX~nHWuvMPFqZP_YgLBasG*}$(YuVV;$<8UWhYq9IJR<kl;9J
zmtZ%tW$I~^QEiE?r>07yu{h_yNf408LH^A#U68tJF}lyOznokYc}eSyw`qRpA<oAt
znMoPwd&zC{D>cg>!*$s*TU3QD<oG`1n?wX}Oq=vC1_YgA^of0icf#D%cRpvm2lD=O
zISiNu-4=YDG};Br$BYCoO3PMU!6dJ^Tf3({4z$&iPI;<h!&$3Q(MyktjKc9a+KTQi
z6I+N~k%FNWPaR?|O-+~|xw1|es5QUta8Hkz1Kt%n_KI}zbMUSJwrOt5L4@<gm_b07
z`#j7Y@YOshY0iykQ4~i;>gW<^$#9F+Q6UY_kno6riVwY{O?ih?DWxvFuy1r}|5()r
zDR=cxJuxFSE_1Z^u>sNu9C%XL?}R0Oi)J1~MB$N`vAj+;bXPI8YLM8;Z+5Y^l1{(e
z?rdjR%cz?zd72lh^4M@9YF<If12{q>AL8PpTDt+~azBE8rpI27-dX@wAL0weRRrBh
zhxVshmtjwjV972V!}%(?2~=K&v!<y=cu2kV21uC<JyBYk!s@J6;=5OBwl%_^wC$<!
zLKe$P-rSAX0Htbp5eQq{Sk_y8tE5ElGE`LOZG=@h3)&501Nx~pnXfwSl@&uZB`M7i
ze<Fg!M12T?qvWP-oG(Dc@eJA`i7(A^=FN*3qIQRL{I&!y_vvzQD)!+v`=-8^#6PHX
z>whkNa;}uK{YfGRgT;h%pB#^zni_B<7ybnlyrsHAXG$h$PLwv4Tu}K8<=umsmv3>(
z7pTh>1tmlD8Gej)PtX_AJ&dh?TO6mz5}OW=`-dJnZhE4!eX`<}(+{yhU+P16ne+;&
zdm(=oI#I5j!->`vBB6oeOmZQfh8~hi$WOn-T(1>jZ_`w@X5$U<p(!(thQXt=SKT7R
zea=I-f3ZdW(-&vlt6bs&zC2u8*i+KeaBvQ>7RtZW5eTN|j=^i6Mid2dGx68d{wy`4
zISVFL<x2pv9)sJXYBl%8;}L78pYY3fN7^|7=*0|mt7Ba?z%}rhE9<P6bj1!t&A<HZ
z_>u3%8*%~oI{LiBe#Y>!fwvycAPwd41an<B{j0XV0WX-mIBVslVy4W<jR*!hoJ9C4
zkrnKlMC=2+c|X?K7IntmHTRJqn9VwZ_Pn_z{nRHcS0gK|yq^%75ca$<W%7;zmj91?
z<=4w`C+KPCE9GfiqYl~zCMOcw5C(_Zx2(o;8w?$-2ib-UEHu65?gl~eXu+bcd%aN{
z`@*(w-#XPAYFQ_L>N;m4lYKbZ%Q~v|eW^!sK+hbQqCY0S@XCFt<Ae^&(tOohgA|3y
zmlA;`gcAtSxko*5yteu>gV8a?@dX8ueVEgD$fNMiyyHb3vG$7+ytS4UK06MV{nRNC
zc8B!tq~Cn}zveKsEOMblyJ>_8I|^K4ZroqVO;~h^g0+}nVhz>w^cu#U<0r=4CR0=H
z;Ya`$Tsl8%{{6M#XoT!3|IW#<*=WIK<NKlagPD>iCr4y|xH#UICn9$ss{g;Oy4PQ1
z%pBqnQg;E05!A(EK*3en%U`u6b2kAi1x!A)DC1ISpRv6e*tu^QrTE(B#sHX`<~W~M
z6xVVW?!-=80JOij)!Rq<rYj~=K2aOovbWpb*-&Ra+z_BJP~X(!mV+f<hJ00;Mn{j7
z4z#_38j!qEZh~h?#6~6Vn^bKX!4Apw87#9}Rf%KWe!(w*__<tA_RWOIGVA1v?x?QA
z(o@g7StS*H4wDt*34z*{%S-@rsu0z37QU`jw}=jWpflrC;?W(-n*j|(CrL{P1FV@a
z_t*Rg|2PjFbd?|nd~hN>+Dozlf14}2_(Ld^%PiUNB{Z8((Yy#~g`R&nemElTmTdWO
znpg9rgESax$`}0ZnwfT`^lTTvP3B|g_A9@ljIM+4c`QfwpQPdsL~i=yAETk;YI(lx
zDwrI44+;BR1w7S)+lE+!K%BU8Y9bC3sBC#K^L;_H?MB1(6MOFN30G1~Io__^HH^jV
zaAE7WuipR-9(Kozd%NgfwR2uR;`_X6k!<e|>tE-6Ge@^Nf{sSS5hmOzhFJK#o#sC3
z57*RBbNc~xrQ_S8uIQpG>MC)n47l4~s{*&5aIi^wyD6%O-Eg4^+g7ND{Kx|q%~SNV
zfJ}<iWa<iRFjKsqo+!2wIdE3+8cPd}<`IYahN9K%v{$1l+ji-ZUh}<|qhhu`s{FoM
z^w3Ei6E**S{2J}SJJzN<sa;cq<;SCRNq3vBC~|>TLv8~_#`4E{rcy<e-*IZawKeLP
zBt-B%MsI}bea`t`GnYkhZIdVCIvsvEqipV+bozYDn#!9(@2v6SUxE#fuhk>3yMyJO
z&xf`BbOwGmF4%(_5-dDH9mVkMws+s8PT-|Wxm$&3rP%(Zkz+s&T68zEs2|VywQ1_t
zTkrSe9_=!|AF*DT<=a(sYe%0R{kPeF@yZ{C9Y{6!xJ(3PIZkZTehtr{(@eQN%!=%(
zM*0f&u=-F5W_sj#Ct;@=<t)6%w%d&|Kuw3(Dr~=-Q*XaFiaSQC>*9iKs(VW<eimqc
z3;4n!zPT_@w^N@*8rr~nkCXNE=d6i2Se_<d_hTu|j_ueCj>NK_w(dJ=1NmuQ^KIL#
zX&<OTm?yCa*Vyofo<+ahKR|6Xo9%g8b;iD-z4d|NrgMTS(RCFR@d2YunO*~@C=RKE
zdLhFxi(h6wQHu%G`SK<Tl{kq1iFzwbn<kNC?KS7mE9}h=FtdV<A@vZjy}ePAZ~QoQ
zpgw^6GU^Vk{5<zV@apQa7rjH${W+wS#Vh^y(6KaxA9GiOyx3Rte#3fkMe{`6Lt;PL
zTUyBRZ>Lf5;(F0m%myDmh@H(-U#9!suAh}3uJxf!NvcT8YIM4U+J8@6*%LJr_+N)R
zsezF@{+me89s>xd&Ou}eb2|unu+*4sSRY{CkR{IMn-G@^M=rXEKE-DE4Thzk^x@?V
zo0hm0l?&M04rLt|qN2RmnA2_-Q>$MKUGl!RpL{x#AMkd&&<;2sS)?&I@+2qVOF(@X
zhU9Dca^$R4NON^`G6uLeR|!m%7&cWm6YH^T=B}=^^a&!UkX?Y3MVPV9hhB_{^4xv<
z*LSavgoivlF?jq?6&A6R+Tx>^z?$elFOU|tnj9URyU;0oA567Tpu9ASRVf*DAb5&A
zrz;^Ey&6cG#pO&>=OOi8x@6s>dk6%oUw`}&{<q#~Bq|K<74xi?swv_RUw*1bnZD48
zD7xG5^+q{2i%x(%d~*rwaCz6nBukjbyXJo@&Z73u+KMAV5f}PLXRT^eo=D%{AM}n2
zVa@xIVz(!1@!`j76Or|F^cy~5@{ew(x%xw0iKFHsW^gSUQU?}}l&~}D^Vz*`?c)xk
z!BvV@Z|`>D-e=fXT92XfLY$}FEBDQ5KH7C_YLA$AWS?-yq?@Km0{x-O|G?kr`{;`A
zm}RAaOK8J4ngd-xs0!Nd01-8Bt|GVgx}N}wzy<4j-%dNGArxo;SRQV7>VLXE$Nn>Q
zLp%Fe4bAypF6-XY2eJo#=3N1WPwr5M(*7s^0$GEU1HnVm3bKs^pPBT51G6qk-$a0{
zLJi_LF@-kQl@S*l!&#>y)g?%M0Pkwe9JRfx@}y{8WCkGM8_#3&yS%z<&Ku{Re>8U6
zB_mejVf#g|b9!v{3jJBg#?p_$=(l)!BM}4rcj*)4T~Q)Ek&17UPNac>@7n>|miNSG
zD4_Il43nlnx8?qBo`kku8Z!{&c=81l{<7UEN+ca1uutmFTsVIw_A#Dt2#c*si?ur2
zan7FOd8yF5G;pMVnswBN!qCHAK3Wz1*)Jd%0*|8jj$RJps(}AODqg?P?i(k!F+bt9
z1yJi>deedOVw!#NLu0{eyw0_OR~G4(cFn{)t9Ba$%`TN#{y{dBcdoy|tihHSc2_t3
z5Ovo_F#d|#%>#niZUkQ+{YVMiEd^Fx<PLUVgGElp<GwJiEi=pfb{G4?@t0*kRdqT4
z*&#HtKj(b5)A4ljVT&{G?eqVt(%S#>?#$&o)Hk4LS<gfhiCviV3cZ3Z6e|~Dxf#TI
zU9pA%;X9-q+e_ph&o1?p)@Qhn?AOpMF5j5UMMB?m_!VvCt=|~``?Y`f{!?RNh!x+{
z(PLA%?Op*Gk5OGt%{CQlz!H#>`_+uA{PN~Hc@oVXwQZWZMmOdzWlQ&ArS<ew(j29y
z7p6%>+cDbp%a7TSzM@V`UsRe=QSq|V`SRws^R#;^OCyU%-NFop8N{kqu$-%OX`;<w
zsNLzxUBn8VK(v?>17X`Xl_1GE+k7`}1>Z(BQ*=}?)2d6JmaFUon{HPn&SbL=pt0p%
zmqSAD)|C$SkI~lG7L2gD%}0bC?p|>Z^pJwukMs^ADkMINQs^uKFA_4Jv}DgVYu-Su
z%hVvlef@($`c)tSjlqM^auq$5Wv?)E%gInp%>lvbc(3#dt3aP_`{=0CfmvQ%Gb`?8
z`L{b8h3ph}#U`{<-k6fcLY){1X_MJ1#9&~|H3<-Zpk3<boC<oTx!9buKNe**R+~2f
zQ$%EaNPWR3G%8zEt`;wlkBOG00Uc^t!j@a4No9{ijb}*V39FExXPr)iOo_P#YJe@@
zY5k}6Q)srs?lEM(FwF^!=T%6(J=&tqt!Jgv)|0<g0@oC|6uc7q!%ob)T*p7#IZ)E`
zL31(hg2wx7!Mp;*!Dh>;tcM1(ayE-x1l@+Y4Hz>mhO#UiK@TH+uce@DmIctN*wPGo
zIOQs&nagW)%0lMf4WBPoQp|CICl;FG{4naR4ev`-p6TR6Z3wV>*H#o6AIyIg@Vo4b
zIYb`p9mJGH%rYcLta!*o_fJ`H96(e>evM|J%OstFcA&JGWyM+d@;RQY$ame<P1<vo
zV9GA{^{O`Gq2RD!H*Ee7N|s(k)od$2)iKu4!$tE>B6&aN+3=t7+j}$T=py@&I$tQL
zRA*=3y32w?vsjm5lSFn7X%<XD>c~oRJ2w5z;O-j@xz%R{>OdcFpO;@=_fts@R|rMr
z|MjRHtZ`lXi$x-$Pe)_?C*!m`NML($m25{s>6w64s=EU!FoySW{l;Jy)T~5+=e_dh
zZtQkvs!A;{16j`2j;EzD)a3(xBSRZHRoy~+W6gU;MGrY}-?<Ki3w95IFf?>tdO$_a
ze9{Wd)f@!NSIC9%)|$2*=aEY(DFw@*>kt;a3G*HBjty6KV0MbC240HHq5ScK?YE2!
z4`Jrlrn5?yFz@{uQ)^<U^Zw<>fWI8(kT3xb?)&4^-nt!{l>iVG;syZ!nbAXRE&?wy
ztFHu64A(L=-y_*HDo+z%gI^SvpQBn@A5W8*svFRtv@1>3q~rV7*QpW%Y|oQh-q;?2
z^+Jn4+pGsYH|q8f`x2>ATf#%1Tv!NFipIKB1hePDoq2zGC-oP{iF{aW#>cc<@uzse
zQFFhS`)Rmng%18ZjGq+1n!r%G+C1|f!<cQtSjqN=3c~Z=Yq3)%k?|Fpc6Q(^>owin
zxp=ibv`_nlT|~B*#8svmxy`+w5C_p}AQPRY{7)Zu69{B&)c|6WT_6{kYEKaH_^!u8
zk>bUo4V;s`u~YLRb7euAjPp-M&dd5nD`lmcLxSZZ!KwLo&RM_hlpn3E=r-#NGn&cI
z@3<vfO}X;$<0u%tOpH5y&?t4^i_h-h4;UzsNpq-l%U{(3pEPG9CP)&Bv$$K@fhNiF
zL>Dp7JbRkAG(1C%EFXj7v3-r#s-e$1p2q0rkC9fMe$RpqjQeE%=~UdIXE3A1DC8o@
z59T)DECtgH*B<@I_IO%s(uaf2f>6r`U1}h(G64(S`_t{Hid<?x%>-p!C76%!tOnVP
zcCBo*`q0e~kH*&D${xK_nH)%@wulLf7qI*bblD<3!bn%d)#o6(J6sE5KGrM5o(`+M
z(j2(k@RzXYiwR2=b3Pz@fKmKR+80=J){MPl{Riufoio|XYCl{p>Ykh#&vziLn0uc0
zOi%7;h_hH>FwNI`!Q~AGDHXaAO`kY{l}G^@=ztH#u=L08$?Kq0AllCP3@^bf8>(*=
zhRyE1agWV-6%0bLLY2=27~1jH?)Vx#Ui8C*!2PrrDtoWJ=$kwsIba+7wFH1O)DfsQ
z%!jUC9mHFw_^DL%P?Vj5(!`J@E5xtFnaCpAI<^LIf>d0MnbtEGD0`-P>0H}hcW-4$
zXkCDq=bUZ256iz^8TisFnnD>G8Y@`YZT~fMY544!f+}U+V3__C6Sw0L%R^x#Jrveo
ztt+iruVf9FgT1U$BU$24xV9WK)cgu<0l~yCVF^tERo6&coZ4V*-u~uAySstPBjUXm
z`Z~{JJR*24cIbIEH><EOpyrde!-3)sr^{dJ|LKUk29k^XwFWrcl2DYcU^Mb%<qH2g
zN1&e&PG!l=uhneA#H!pYT$7<eswF1^dJ&!yS#t^{XGXWw-T&@M;9|Xfrna~6zH|Mk
ztmo<dB4%SW7PvoV&Ilh3X5yQwCJX?}yMAiY1}#@MPhQZ{IcM-}jOT+kC%T&|#7RtZ
z8kIPSEvuHWtM*_%P4`Q}3qHZjUR+Sh7x#^jE4zn2G~DhyF}juMlK)`+Z`GA0MJE6?
z{KMc!C-@LS53umfQo^(d@_~h2K-C3}hf2o8FnYg<xriQ0Pe$f(VinA6=1STs(Di<r
zt!7>o8@q2+uuPUJ#j9|TMr09m<l#u?7zj05^OyJDcoOdF*XebBIT4VP|J9to?n5UV
z`dxK<=wH*b_$Z^*QsD{{P%K4rGc$v~gu9hZZ-_seh0;~@WRZPf*lmiW%Xv86nZ9yN
zG`Ck+>sr6`Ky2%0(w$Y(=q*!(_qQJ)rt^bRkG1%GVIsmm_VGhrAqx=2GckIQ4wZY(
zQq1<C4sOVqws`?;@y_QxQV0}iJBZCV6SI+Q+gD^)OKGC%W4x@GRzxBj`XO$aCin2k
z0grt7_qTJhFFzisx_wb_aSj3DL7kLZRXUNP-OF*%<%$f*HYSy8!C_<kRN`_e=NRVv
zp{~t5jA~M|92Pv79p{JU<V6;<$LlR}ij`qCM;=BzirvgUWOYEzeAZd=b+2==mEECU
z_wDC_aMARCNomiSg%z56O?Ovh#{HFvLQLE5sRrCcYxES*1AT1!i(X)*=@S*%-oZC^
zc0$w%as>6s0eM~>B~#8>TBFVHgM^}<HJw{xt-cI@7W7Ne=<Vz=&ybioWTE{3VM+4^
zAjPH)BtFqS0}(P4HV_eGZ}TuZ6lWHb3)yyx*TrhFadj}vr-DXR)is(8o)(-}=Qi!2
zDX>EuZ?o$qhk$P3*6H?{mVq5wF(o)cW*A=m`T_7of+Q{kJkjDwZ*+$Su6WW91P#BU
z-GvVy!Xp(FGn~>)U34F7s^PXO85DM2v(dde<$!p_xPxC;JqcaZmWhuARll^IsOqHG
zV?0N@zujJFAN)#R2mB98P-^pWoZS~Uu?;w8B2miUdU<1dBs?bsJmTiii38x2SOcz_
zqF&mkqXj1aI;ATbu^!EW!^ECMD(Q1if*_ci`NWGtB$~}T(K}q8Tpv6ivy#6mHAm__
zRQx5nq&~?*{Osj#t(H35-2&F*l5#M)JK<Zx^%#Wv4vmE(lqc&_tZ|Q@qn@}ivE2hY
zc{XBnKMUUkIL7-(T{Og(P@Lg}W5p8jV$y`$dxKrTNT!<7HnmYCeEqRV$WBZJnTeQJ
zIuS&>S%fbY4jKTE933V$n2xA@;V@Xur<z9G_T$CR(S?u6(PMOc0}z2l#J3I;%j`6p
zZg=hPnsVOpForKnP&A1jw?v(aTHlS0-Zo27TX_Zc0wdanKo485t|?*A-anc{1^t6T
zt;>w(kO!HSZH=sjM4S!)lDr)2Pi`E}eI;Irgv)uz@)~o8k~6ye$G<4)>HOs!e--qn
z_dgnabD}l%&Md9$th93PB~i<_XOdfQoYm<4m6=E{2iXmP8vd!f0a%Fq9hz#Kq5Xo0
z#m}R54ZxK~O(p3lw+u^Y9J0nQD6%i?LsR(aPDXKXfW%osds|7CDl$QAI_hs$U|B%g
z`+wPW=<dVtTOV%8_CC=7(3#r6$L+vMnJNJn7K9o4>T2j`D9exI^j+P~{e&|*ph?7i
zF!N>^UY1hmV^dEvKy$N%^d)$1aQFI!k%H0csPB2}I-lg41O}{c{B0*y-T$#W^Dj{f
z@_<EHHp1?1)+KWwh?@Hxr=VV{s>xHRr9#k1Ns?7HBF5~tdb%aFp-hz<1Wth8t%D1i
z5dc`8{}OR3BU92O`;&2rXj`Z1hF?cYYi&Up>ruFWfluq>zwTI>6XxUOq7aaueMv67
zp!Foy;-T6AVh-Mh*{L_PE$f08p{zQ`EZQ8r>Z#RUiOL{_h<q3k4*)`9*Ha&**!V;k
zcUd<vi39|CY!_~F8r-n5ushan2dJaB?uK*}h8=nMdM2^l7pyp#hq)uVYaE!2hf5HR
zpHNd%<mGX7{AAESa0Ol#s*%VPANT?j)U(oPD^c5wo5WT?orK8>U#G=A9*Hv_vX)M+
z=6m;6WMu^wC#3vje(_==HJ6IU7!b?oFfQM$oyYbBGft6(D5TA-j9@2x5Cka$!s&Cl
zHtZd$##<@MHofrbU&pJ{t~v8Q84noBQ+l4KXG|AI&2J0%Nhrn^i)BZ{G*uU68_GTY
zWANACAGd-!VUCuPh99>;f|sM?b#fD@wt-^JaWppfT7{iQG;m}2;xni~$!}m9)&7b+
z2rJl%I%Yww2Tzt%zsdWyJRlhUtXR($^%nsZ%dys5ccHj_52=&#tKuejS})vE<BM<8
zx<lL;iOCxaOt8=_ku6(r1mB^iP&oTh|1`qm$;hNKXhVxHun0QaGbLN`dmoN=v4&ZT
z8XvYi9hDt)sTP%i{`;&nP0+KGo;j;G>#cFZA1PT^5Fs=L1XxuwUB*OHI99p`qWPRJ
zu{4dxy)g?hu~tsu+Tx&LzMA~?*`<>2v`5KbIvq$!m~@GKYuimjpCy-p$*>~coLC-0
zF64oRn-?}OjaX)@aj1GGb*iNwf1VtqE22@@%)q2B--=9)%qm0@ydJxFLq(@VT$i|Q
zxO;be)-SJQ)HTvRwOG*49B7LM)nYHg%10Z<{Y@@JCY`k&>_`m@e*u*2pK?s`Gpftm
znuE9E7mEAX<w{v3&ArE+uJW+ihYsgV2j;aI;ni=Oy@WYIT*Qbu2Cn*H5RWnxVW{$O
z4eoSGr2LusPd#L&ja+a<yO&rCQMBR_v)rJGmm}I-h0-NfYqcuJ6ycP)d~fRm{Nk{R
zUSDcSxVOg!T~sWoW~G&Y=)>i$Gm~do(?RC@wZX+~zs}cjhbhy56;1nC4t5fcu8}`$
zBiEM#F$wFT{$FPJF}SYoy38$*<N&!q#oI#c{uf<HC@USPGR}!Z=|-Fgkyo;^g+1(p
zGU|ErimD#rxf@yz;E@k;{;TSeY<@#=6Jx<HK~T78bI**&wz}uRcoHD_M&X%vkpJtE
z1ax{7&!NtpR?m~k$wi@BKeC;wFKj6_B{oA;?Y<^l0R^p~@Z8&UVx1Y+0B0&#X;Rr>
zLH@&aZdWb#mK5XuhsEvk!<Em)FFFKe)wNyI+DC=YtMrJ*e__1Uh@xu>Aa4P>@5wbJ
zpeBrwaOySD0(?yZCfSXze9EC={*9ESVM7b>gn0Ra2l#L9$L@_4Y{%A<`AVH(&`-%K
zT2`D=Yw!2A*W=qA9>KELe~f*4q7Pa>Vb=EGxt;^#Z_P@O&}K`H=)~YIOZ*wAAZ><k
z!VKq{0A_s&yR9)kyCAIyP$VwaD^VncU_J)nBkr1-q@KxXmJtr58p6T2qu&j9cW!ZX
zHY`p63-oh{YB-~!&4Td9^VRm|lhi)a9;n$Ers4F+^j)#KA4=Ibj`nP!b?IH2>q<RS
zo%K3>|LPo{pRFoWzoK~j^YMR6|0yq7A&_yP(P@N<wwd`XZsG+Ns=0!@J|)<AG1jIi
zl`wJ&)?+zUSRgRvt?lHihOZDF>MX`wkQc-Qfzrfcae(<%``Gk~tSGO;72VF05%26K
zgSCf~hTgU8>C~e^NhJBISdsR(-ZO)VI4va*C;^|xNum-IylXY{Fq`_JmC_1tM!ML9
zy9Ne5%rda~q;%i0UKL)frdUR}Z4f8}^R`~TGlWAA%&YQ6+EEZF@f1X|9MUc+6%?iF
zpR3^O*(LSwt+>4D&oE!#9w(hg(J|u=`^n#3S~uU_yz;)u)S?rfOOy8QzeAa^LCpzE
zTQGQW0Kw&KQns0KTix0k+Du2{=jRr&lU1PQ;zo8@7+0x%&c5#47)v!7i?>Y@*#mQE
zz@DMfnD2)67vXW9T~5W0PJyz32S<`#QCr1?`2});L<?pHsTd|qtDrT}l&f+~rY+Vz
z=Wh6&vm8si%FA#+hMD`IC7N6{BPGC`uq~i=i`KGp8)%#ON4mFgH-9c}FD1U1{XADv
z`C0h*SFF-xJ;a-932O+lch_!H(_)NFztr7~EnOKAK+7r|jpt<%`+;MvqgS*RJEq}>
z%qx^<IBS^;fHb!B>ZGvbTh&TukE0YroGIa2WzLSVr+o~(y8H$X!H6`>E<UHCdzk&(
zG~d8k&4hdZIc*{NnxUqoP!}RBdM0-T&QO)k%TDmaIyqZ^N>efFnQ8IO8HAyVVl{Sq
zDiaDoRZdgs&4D-eV9~;-MSPXL+dFTgy;cTaK1a!<IXW5)DGNb4uw{p(oj0$KoI3WC
zu%fDp?<>~bqerZm5^lPaVsnescsQ!}<`*@`vB#nvOc`Ah=lsI0qP9#%)$fGt8;ZRk
z?Q>VVfpCTQl#)%%GFF|oZ583D<BKEtlrS2ED%%PprQD6ZT&ubwIa}(5nO#?~mf^F*
zjRAx8>`X_!%KK55)t3BaK6fK#XC|&o9)`PIwAieN91&wiJYs1ec}?=So{OXA+24A@
zqdTef&BQ8wI3=_A$Fri=)hL0i%wvD)3CL+~psafSDj>_HEQxTv{fFE*uYuf#XDJ5c
zbHfX4dZMR<@+BiK=1dCTw?jx>8Z^XCva}DjxAW^3=G8jSl<d^U7X5Q<KLCl020n>H
zEP<an<Pdz{LU9;xa?n%hFQFy{Z^4I4**kW1Pff3+t@VcV4@AuE(~@QwOGl)#i(;kD
z`0cRDZQSDNUFE=l$Hj!GWupPH<V}|cv5|U|w+ZB$GWflANXLJXH;rU3mC(UBgp97Z
zM=fWjfHjg2urxPyKh!LJIxbp|B6V#UGVxVnTM7Q-aVT|qCfxIyS4igTgd2W{IwSZ!
z!mn4_AqyHhal9`uxK)3!QP2l%*^qR7^=3Wt2f9Kwg|8P(fR&qPjhATm;XKWgkBQSN
zHbs+w$|YZRlFLV-3rb0jK~{{5&G;(k2X5jFj;{iQF0h+I{?*m!vZ{cK*Y8BSF*HRb
zkNSU)sJ>e5mm7C?{9|P-1N=dM8*W3ZRhBLpiT9c)En(Xo>y7aUJka%#N>yg4$*#pH
zS3%yiUe(#sAT#0vTLUhr_m6*_e8DN8C^t&QTa5E0<??`CW>s(uB7?#|=uul?P}&y=
z!a)kRS8Od-+_CVQJa(U*rgpt5KHZk_AI>tAl?*wMEfy-NwPV(Tf(vHAU{NDs_@8fr
zUug7x+}}rR-{+(=?rQM9TS~06_`dq8#rM6{k+MW&9~HJ%(NDo`q*?Apsy5*J)I|4+
z%<$5a?XmW*68_Sf9WWW5f*A`HB@u7>)m=4Sf)U#1c$tc^V0>G6?q0haV3oe;b{gpG
zgdr5h*0bsQgfLoRCXMr}%gRc~xMRH6aKVGqi@iQy=WxEj?ZVFGBmc53ZPeFx!}c#h
z>K4!y`E;QxVR~Q5nDo*f<!tOFT?sFIu$1G|Z4(G#HGjE?8b<1OxX;0SAya(f?s2D&
zumis6u45K_Vhu&*!vNEz$sQhXJ|#F_ax*`5yxn+;H1vVXu?QX#$!+7KhvYf@3fGA)
zG%gT&1zw8m|BtOVk80}d+Qv~-1jMKaC<swesUpNy21Q6zs)&ejMnH&)$dHEA3KAjY
zD9S8SrNSc=A|fC%i4Y=FB6C}+%pgI?Kphw&Cl$hx4E=5Teb2kT-&*f-E&ao_PR_Z{
zefGWgwXc0$+&CuPuQ-UZT1{ZgwYNn4pf>Mu+*-)kL+RpeQ|^_OrqlC$T_mUaMti6C
z&<MVjeW5<KCy%Ed&OFs)tDy(ArTKu;1W?ySujln-7tN^H#69XRK(c1wrwoX@7$M|@
z2!1?=ohUR?E~bi$oG$uZC}5a3)fhE`%#n82(EhGR-R_@2Ma+lNoDo}IMAd&6Jod!Y
z$hq^CBlM907+wV7HJYJrhn6osfzKgNmY^Lz*jkyU=yEOkK|a^oCb4h9#b@A}qjV(}
zE%=4XZ8e>oAxa|T0l(C&n_I`*nbcfEEEgAsel>F^emUG%JoAmMrCa@KP0aS+vljZZ
zF1(dU16WENVlQTXhmvD>8<`6Rc(#m*gPq%@Oixfy<r@>7Fz2%}Ud<l?y<vrQR_K(Z
zAlA`TJmG1*IWY7!{$SUr56Lb155b(mv$uQJldqv>04)Z=%mXGbC|15@{Vs&V_7Wew
zT}7X>WQgQP%wm+RfnS5QN$|1x55+YD#Y!Z9oU)4PB4HZ^sW+Up-qaQ5zLn`hh@}^A
z5A~c@nST%HWbM>S4a6mTDV#d~e9>KBV>CRb&PhTaOgRfK8czC6b4MSPF%->sGqAxm
zIw#96_w!p^l`DzzaDgTZG@!|D{Ql3Qna8Sol)E2|8C(6z)uR^#$@|OOR%syLP|%;I
zl&gB=$6?v8GA87wWG<5r#aUFb@HUV52{8&4u4LNP%P2{Xw8x(^1{&9@*VGX=b~)}F
zeI406V*SPOI8A2L@N6t1mUI1rzuisx)x4xjz1CKbHPq+7(HukGwux9tiX-X)e1-kw
zl*B3EBsvwR-o*^VywRd_1C@a#`F+z-7Hz)Ybt!j04R$!^QM5UC+%PTUc7>Pj)4#Z1
zx_8>p*IYV}n{KIuC4jD}DCt^%RsR=OTe#8R4fJK-34PREB+fP;-``gUr-c8MMlzn9
zyf1nG%j@q32L)cmcN<3pOZR_24;xG8ckNMC>b#J};@?$2BNx~)_G(8g2>Kp<>SbN5
z4HG<Y&YDPBMFmDC&1Q`E%~^<00E|#lHp|YGI7TQDo!7&$C8KK{PhNclt+kq;hsFih
zvI6pVY0Yc^1w+VM8w~iL{v>??iUk#?X8p1ND8UWPe>BdMqJb{T9+J$8K29nK@m4GY
z#*~;6!?MAyHnKMMmWH*b#O1c|w#eGz=#IF2Ea}9{nttWJM?v<!diN*x_c9M$jRfP-
z;e)~>{WCt1$9g^v%&f<?Z2Q-h{T&~(Z&Pc}qC3?(whG2Lq78kB-#D+m#grz}&5<3L
zxP-COxsOA@;p6RzW-@*gd0~(mbjJ?l2!paWc2@2#!0y`CADnH<h>7Jm1l}7<3!g*e
zw}jp|kgHm1y?+m`pIwySCag7eks2sG{))V#3^g}@=Qm)pKux7^rzR)F{6Pztz|G@d
z=4(+i1`-^%q5+bQMCdKQzS>N^WUF#M&|`gStb0Q1Xmo$0kE@k`qDgJi9=AP_4<ARy
z7fV+ihe~ZdaP0s{I>Sb31m&to`99c|F)fOt%EPJ>rFjWB;}KWAV;D8~uEwrt-Es66
zkpcY*!un19ylZ85b4!$aWcV0IpYUfv*GAT;f9tL+FKKzC%Jl5B=2(%A*QXrL1m09O
zYo5SV&PQFQj4-X1ku@lJa;yZn6Rhe-<HkrVZ!>mv6p=2L(5MX#@6hKxb>N#0!(m`k
zblbM-dG+7#GY=0`dbe9n&>h}pdip2+t%3U(sn!F8EZUCMLgDgXmEA=u1EgUh6(ael
zG)D|edD<|YSjn=1r3bduC(2v(a@6Q92fxlISg2P=7LyDnywo|6aNPFNi_N-P+$5F~
zj#l)BgaGCCM4!z>y@uv&>O7h2Rv>iyy;3H>%A!fJcn#3OJ}EIszrj(_8vssI5@flf
z>?97NGr=>hh+_Q#svrq$eORb^`jOsCJxDo6y61G~rRtZRVWzG&?&K!H*X}y!yc?|T
zup}=5wLCEO)(r@y_tjfi-6RgTsf0ReU2oqC5rGm@XGKU+Z&VV|*;|zzi-BGmq3SOW
zuy2IPJ#6RM{xAgI&0BAZ-ZeECmOroToILo@pLQh-x$@(JxqI-<8Nls_BBBR8ZB-ob
zRTC(Sh>IpDi&<Nt&1ecx5biefN{;e8CLHxVc^vZ;>-n`&(3EjAQ|zIP&;pUCtL~)X
z?YSj|mO+-!&JIyH@&}Q$>p#TYAg+R?Uw|~|A|f^k<}{6RV7i1u2VGF*6<J3MvKACx
zyF(*|@xoOsGX_=sCI+2o8QFkdy5_Z*-^gCWusq&BL(o5W)~%Rv>y+$FZc)Rk1GzyE
z4W<d@RF9D@8guPx9e~4^Kwh>(y@vIQU0DWNsUJlj<5`QCr?Iu5U_e>x=p-r8mB4hG
z*$}l|q^EVVpU%Wd$jg;yu$!YkhGZO;A+V42aX!fHs&joZUNv_#FR18szIU+NY~Yn6
zWYtjCF9L)&`X^Q|2|bG3CRI*JozYY;Y#3H2q+Dk1@m(-pA0|&V52FW@MP&)u-(r3R
z7=2$4&j9<<aAxj~eUgYPGf)>w7WIZ1^84Pu;G_u}|5*KtW~5s83S51Dp=jziaP_ie
zb|o^|jw0UJ2H76bo$TeZ(^a|o%oAAksFc)de5PX5N$VAe_sys*Bn2sT)C&RU$0Ses
zr87=T^a!4}PIMLLPzNj9lN2U5aQoo02Ve(5CmlVKa)*SH`GW(aDWH}R-i$Ye^x`Mf
zKc&To-kkBV1xXrN$U)!p6G}wJ2#7~Lf)?ZK&FL#*)sm6lj@I0*rj=lsC;M%|Cg`JQ
z(xKD?s62WBq#a753iVPFJj1l=0UQHtUnkWw#Gf2n17!IQGo`)^-}Kei^t*Nm0ft9-
zV6m6OJOCmI9kCT-#xvX&iV5S*#Qs`zdgPm=W``|hptEKFr`=rIgOZ@R%80vJk&iT@
zAhTQqZMj=vd{G*Yq`JlTCne#{h)bz3mb#5e!;Db=D3YiQC{g-g10s5bkMbOP@Yd*W
zN{c60xHztvy_E5j@OzL%n2a!uc{dl<TJbFEz7P2XFQC?Kj|T1yg6+yxFU?gfQn$==
zk05lB2MOXT4(icjtkv>b^A+fpsrb!=1k#E+(r5|3ErXS3Ti^ebwH0e`tw~EN#Li4K
z9hgq2v%L;_EJG6!l@9OI@-{^{wf?eTPOR8~G*ppL*N2EdFg@o|T2gK}d~8jLSAz($
zm~04{hetebr}7#K&M5BGR)<T(t<{=M6g>a{T^eeLnYnrwZ1k4*xOL`K`{=v%2*EYp
z_G9nNYp9U$>g9*w6@RC0<^#EU6g??VQ{7`4l`7Y>J+YxD%4Oi|+A8DTRj&uLh%1cT
zSMzkY0>&GwlM+f|osYyv|6CVE{H|u5+|anNlS9?JC=dnBL2-2DO3@8u-Tz2-&)83r
zP@{byc=`ijkS+fS8miB*t4)Xr(U$3iQOhQ3R(ZLW1bKl;ii=+!)O&}82b|L7ckI$v
zaWZ`xoa(NA{mFgNZ)N&7ki0+fD2=XMd3nu-MDp7a@4}6VyGA}B0t<Pe=V#LumgMh-
zm?7LM&&%t7U(e-6YfOHBtU2@eUQ#+?$VI(0Q}GQ(Q0ulUzF{@smxbX?m3vgb@`Fin
z4&)YTK+{|Z_o{@jg0ZCS2qig5LRbv`9KJR$WoG49sAYr(^3J0Jj-K}MGkQxtwxpkM
zHLRdL5qQ4SKu%Ep*ZQ^{Y2jlV>61BPKDNt4#8v8lX_|{mfu_PBGOBgUnnxVQi0(g0
zW_{6-xO@g#!cCsR-J0{b^ErUN(uZ;8?=RwnP8;E>;P7;!L$~tV(xqj#DtfcPn^AN^
zL;Zv#F~MUSxvI5s>K`c53;$?zbl)JQ<6?#A_fvy=d||`KsJFq_OX3s(HNzKX|CcdM
zX)^Ut!#yh3F5^ROju1O3?zp?1w>;R_CKkb5t(4}p>!UKU)VVn$O3F_O!|9A!>9OOd
z!SqpAB6ZZ9O95iq4~QsHIDHxawH)C9=0rLSKs|K&ux;s+>7uf?Ad#~`;mT^qFP~S<
z$kxO>B`M1Zw>jk1s$}K&HUwywH&Rwis|aVSd&E^0y@b%Ej$Sp(YAOw{=@uiGlaGxF
zB1dfJmBWTLkOO=)#7L=sQVzLW^c@y_#cOD!U>^%#8M}!cP138JTJ4N>xXBD_#d?I+
zIpG~!Q|Bf-D+yhn;c}`|84!?<T{54jIs;nDp?k7i&T+e23!k0~w42M1fmY?E3@Cjd
zz%4r8XG8NoQm(qsA?b~bJNVB)C#RAkFp;OTJv&3nto*s${>uM29*{*+P^BO{eS1Qb
zpJ8nd)ypyc*!LOPsZR%OTYeScKX@oSn8xKQIM9R10<t`^#}=T}F%Zfnf)<Z$0hTuR
z#?(R4Y)4u~+{j32FwA)Wflaq<HnjJuG&ZKZ^K81}XxDSj@!QwiHr8q|4F0E=^H1l$
zNa8L;1mj8PKnBYWV&x*G>Yk&f%tZbx3WI?0BrR}txXsp70wp8SZlHz`U*dQiy(I?d
z*HN=LcrIehwKOOrJ;u=`EQePscJdlJK~1XHQNOm$BJGzga^S~JKgV?lv0bBTok7Jy
zR+kVZf1K|!2Bf59XthECO94MMhPgNBm0b@)o(B1@>2lO8bSarIF1TY$J81Qt&^3A{
z#Hv!dTre1B>UOGk^UqBeYp$`MjT>s<8~$xfE#b$_EDg<y{JziH(1Y6(7G-}dYs1nW
zN4xN!-yJTutPAwNbSJ*4W&?9c*dh+NW3@%Ykx&nubjn(WOOx+*X#I!_ZnK*swqzFb
zW9kBJvrJk>OjD0lCVp@?YOXou6*cL=;^sRh2NZfWL`KpKdQX(pzwceR2ZnC{Gldam
zl?IV=OHkm1!U#~~eW<SFKpQ+7j`cff4S{9HJTss+3rYyf<;4{;CPX9UbaBcu3UxrR
z%!{9F1T(9p<f{eepdI*0&KEf7ye=~z@wK|4HKUaS*9+&1?#+EpdP4nK{f@G<@)IYE
zK<>NPGt+^&Rz?N4Ivwn`tgPspPLk?a4qKk$c-}US&Ah%k{EU5&6{k7K=IFBpN-oks
zMMNb?xkoDr+v=fQ)dT_!bbPSTh_{Z_j9<gtDWi{CB-iQXs0#M-yXma$puy7D7RS^i
zmPh5jW8}6Nlj2w=!B>O3oT@S(IY$)-)|}?X(``4&7U$nspgIc1yO65g_ee|QQWc>}
z!<!)`;_9>3pJ9+HT&KhMkBv1|ncsT?0S@;faP#T=TQv`kuRU}O_dZgsvlUXkA5{rT
zZ}@jm1urI;zJQ_d1R*Y*+ymv^5)%@HE9*?fgB+(Vk_q2F*81`AjPzU5%hi>AO!p_4
zS9@E{x$KSi2gr%o>w*b8hsAgKND!TNZGq|(P+b3p+hR{g2{rkse<|{J#tqWVGHlmJ
zxlqMMLZ+~9>>kQA<-xMeKx|c;DXlSWQCYNy@9tE0^&52d4k)MpqhZP<%UYo&u_3>j
zMm~Y&)$^O3NX|)T`YMN)N2=&9{eSfo6C8=~W!S#Ly_);C#uBnIAo|Nis%+rw;IVJa
zYDcF8-p#YTB_O=yA!o|C4JL$j$$O+~Q#2(ptRo(;!;H!c=Gieqj8610t-^v(;i*m`
zSYS$nBb~y}b|$NmOQYv_)wvo-BpX$-u}uXkeE6#=<ytCR3ADK{kS<4OvN{nQ65KH~
zC4UC|2>suSJ5Zs7-I7IZChFAyKTwriMEMj%_s{nV_HZ~!zG8bj;^!WL`i(&PxYzu}
zORjNpRt)wM`YhOq8>DAs%yvkvW2yK?-9%YU3hr0}dGZRr_~an-I@;0b2B89*_3rsA
z^OYS}sBKNOa4W$gn=?3fxW?JZ#nd$ZiXTGitfi0N1#(9Z^iOj1{0{fwoBEA0ExA2p
z#|`1|5#Be$cXCQ1U@%s^rN}Jd37CRpT)qjF&6e`g@vZrTuNiV<>w7^t^&^EvzT3A5
zkM@)t|4b;`6e}<Y^53@?|0hmqB7~jerAp*!Fr#1%?v1cIN&1_x4Nq9T_%&8UJ0@WO
zW_ceEe4o1i1-P#$+EetXg4nq5(gXR7E*fz|;K0hUdr=i`)py&^+SR<1`Wv6qK-_)d
z=!wSQE;rY$6bbdQdeRT<IJ2FpO<rcX#Vuljrgd2f*53T$t+(qH!#HvBmPk{g;2({1
zeVYzc^gOEVwNY%TPTP4M@ekfo4X9r_{jzsvd+qIIt0EtM*ehD1yS;RL&B9kZmVKwW
zqhtS%dKzc`58O0A$gl%`Sp#XfKmxs!g|J5dfrW-}NlC$1y2P?{n5Qs{Ql@uToy%k9
z_gr4j`GNDYwpLO+-oVBw5*)lky`C8JVnfO6&W_o?fS?i(Y{%NrV;kuj+Eq~cuyFj5
z8LaPOz<Q(qKpJ-Oz;nokAIOhpFF}IH+Dd;cOP2124%}o~fc5r@U}KK7<gF|uK@wRH
z5;(%4v1>Kt*lCr0Q+h)9(}y2^6`l*~x2y6vIr8`$Ef=`a%W&N;q`{75hBVkCm&v!;
zMj#)o&0L2)fUZ3oEmr!8rV=2NPJWi<y}vGdLP0%1)r~sS4&QoNP@&*mka4Bah2faK
zWK}-<+1Zh|LpK;ezR`kPz5|!OuKW@H4p923GI^S;PGh4sTq4`lwj(Bj6jxam+n?_B
zATHL5sVPImvn{mnX5U@Coa4Doxu1RtRBP9CPV*;$(&7-8U>mh@Y3P;QmePrcHCkUM
z{sj_%8ubFoZSXGvW(qrAxV&!dXl9CF;uUlktzn2PXs$$fgSBPfQw(WS<La_kSS$BP
zhAoc9d3Q_0>bJe$Tv<oMd-qSfr6)-vtSgFwt`3eH0Z7ePuFHelKdMUL2U}^%9Wc7W
zPU&5R37-Kg@He4x9h5LQa`tFrjYXW*4|$!m>D{&^KGP4XWw8Z6a*eKK*#2s?!fUKb
zNbRRj=R6G@E7U-aWUqvEm_ZsgI|6L8obgC4pe%FT!94Id2<Yzg7U56?DY0@%Z?U+R
zX3`vStj9X_X#aHoFJR_<W%yhR{ra-<maC2zHvfqGYo~fSFj1o8S-&GNL3ao7<1b;g
zQ}m@of(z<=U>*$m*lM<};-#7HU3$_^r8$rX3{#7IRT)z!25d0(+6klV^)WVYi)|FN
zll#4+_RszO@i+%k##CtabLFeC*U;-7?2-4Vejz$3_qqF$7b=Y*IIUzJktKdIJRa;d
zhz>+6!yZ%Ty1FaBexAI@<NFX>#U(Vezu%I-ISZ0sFrv_#C{*jRVSnAP=0=N=kh17|
zR?XiYDL>~sfu1|K`M{NRsO#hHKmU2Ns(p20nMth6u|M|TKrAWTHl;zk+(JfB8jZ@=
z0W4%N`ub`cQqeKlB+}Ctw>6g~5Lcq_=CU6WbIOL5l$!bhrn%qdzN&HweL3UIkR&^a
z5MNN)GuoF0G*&N+?jqBZmS)kO-9Szw|4SGaS*Vv=syJ#5)-a5i_rqj~9hRnO6)xwQ
zDh*I_Lm~6ZmjBF!+>${5n?Y?Ml4J+Vi!g$8ClWMHG>Bo+0&<5y6)P+E_d=jDm0Zam
z^ueMkqpo^tDA)fRAyg_zz(e@7j=>4}e8|6v#kKJ(xrv`aCj{p9(kG`zQ=+SgyP}-R
z>YT)M11brWxfuUwxb->)Y|@Y7A3=wQ)0?6^4yt>5CT*|N!iG;edk^jLF{6<^;ic6>
znYkE{^=Q`{WTk!hEA{Tt;{)1Cjjk7D_}@SE)jH0gj6&fUNyUoO>P|%0+cQ-xY)QGp
zvy#zo1<00U*hKkG?5(R=dDeF%=;8<Ir16~PmFs%NUvyuVd`zIPudLM<G%t`@{VO0i
zBLk2GaHNJqe7~u;d^c4Qpe4N&Lnvi#dB6(Ikm5jj9RZ)Jpr5jr^;tP?2#}cSp6z^7
zevz9x#Q51wvPXBqiTI)M8$#&YvX9*Q>p$dkkKx8^+W=XhP_Rwh8%li%du<!o9yrPV
z<gM+T(YuUaf-Q9NI49#K2E5>2Ki|o;dNMpXmgZ6Op>SJXHrqg5kRQ}2IhA^>w^Few
z`}2C-hYqzK<R#JhtY-EL{N%9gi=3e<AnrJ;Tm@gKjQ0g7#9>n=XWuo6QdUDnYo-ZW
zo#EX!w8$gst}N#1obhb!>bkzlWbdQhlJrCUp_#9BX1y7X&P$-nx>yax2kHy7Rf|}D
zfbdR6Rf^&qW+Wj#XD_cic_EjfFK*$LN$@6E(b@jcqGXf9U3E@*=RC)*ofz>MH;$=s
zy$W+azW4G4U+1#R3&#ZhS;LbW_*g#rgHUNemK&-bAQy!RNX19#R$03<ws};#XH=L#
z-2B#cw3gaV!ZFxQz}HWS4s|172WMzRCl_f(S}J6V2f~JQ+atBNOX|BXSJ{^jAMO|7
zi;;Q0<-B6~DzG90$b-t(V(7|?P?r|+IuMuvJ{owL1l&}c9w?*|H}};Y2QR#ushc*t
z57bLb(*tO^V;OhrmlR0!4oc<-&jZuK2kcOx?`BR+r`9VVGXQR50K><#3P5fe9GK>c
z-Ef%WD+zF7tp*AGkCIIprCBoLKmO5h?{OsO!M<(<XMw7OQq0n$=VBktHrYYf{di^6
zMcw?Kuq;cjp3eu~+^;zxk13kii$9Mvc=AOM<Ip1=tC5C1kZMlF@|Ph&9Xd=u;0dQf
zph^b1kU7-wv@k2W&r6w6GYL2DwK%P;Fl)c?P)}%z&ZmtMcS>_a%jZWaOR}h&OH+f2
zsk0de6P{`?XCXZ4!aiw)d*7pm6RY7{^%7{VnIeH5x=a`YLA_651z^as7fV>I{!dLE
z%Np3#WeFM9wPNqrMAM^s-us~$UlN;j#j&+@Zpf#HLv<}S?6<TWLYLoC>lVPLc^9sK
zRe2u%4q$as7OJ(?-5|WzA#)ye^wmb=VwgM854x%|k=m6)Jm%M06I(5Dof36RE7>@&
zAYVfs_x_B3b#>~g+MewtlL7YDs78c~a^-|t_cYvm4+?$86uA#}TIMa!MA^_(CM{8$
zjv+eAAQ3;|T1|FR@fNQ5P}<h8<PF6%jt}W9%Hz<l(2<;Rd3teo%cd%?2c-{7&W?Ne
zJkok2M1KrW8k(!MrSmrE<)Akjf@#SV&OlQqkA^3()&$KNK12m?rcU(K5&T3j(!UhT
zEM>&CIpjaHVc0|&({?sq4U9M(G<vq5Ls%JHbLm*%=)qf*{^=b!K+os%BGh{d+p;AF
z?p>)$0RaYmc^)+QDe-vdfCW$>mMw9li;#pB;|})mq2LY#qK;8wp$0X*Ult^v<0MbT
zh1IGS()^l?v+BRNMuD2s?@zsgyq@yAw`-7g!f(9CVcVuAO%+GgjcUXBWIh0YcMjJ&
z6%Qa=kC<%iioao1MyRALV<4|GLaJ&W3?y=V_FLJ8j&XJ?5BSj@3A~z~o*VzJ>FJ@1
z(Sk;aSc7y4{$SP}%2nJGs&t|T30PQE`a-6y%rFbhYydYGt((M+P0s>-cY+t8*hi<M
z$$<wPwW_p?y!#I04hR0M0tK4~GqHL3?E!^nhdYA8m)%)_xd6@C5w_eZ{zaT%6nJ~4
zie0Qf*=wd@PxI`mR5>=J<Qh3wl(hS^qk)*N%WxLAwNMrk(;)-8*Hh|}7$)_W5VOK_
z#=LwppX~$l7b-VmSe~$<(`rV9lN_8UJ<Ru}i9FbQh%yBAm>f{hS$|OQJoDu9m==6H
zZR}X~3df6~x=Ux=gGtL7^yWEMZjpQbShtU7$xN@|kL@<s9)H+s@zyUXv^f41e%t~#
zZ#1E8VRQTlDWoI%(B|Y#+P3og)lW^G7pK{G8I0cB*Oa^M#g1*SRwinwPxEPIm}SA_
z@iL?VKCyDTG+B&WH!)%lP}^mGj03r0DxSRxXhFZ*nmT;+kl~bssVZQ8U(@&X0(Tzx
zIP^z7;-1J1{xbZQ`ctxQ%W(#f7dE$)rYx^ppgQxv)`|~EcM#Nr^p@=jC(?b^0`*`9
z;qJ_^xBN2ZioTfwuV+F_BuVd$&7O`GRMujwMZA?6@M!Rz&%Tmi{Bj$gs}fe~@&d`)
z(01>!$x0e>wzJZQ?&5BAY(RtbtOH|_m8(vwQ))%w>Sde`^+}LnD@2>rI`0+wFk1E#
zrIkEHI4%3k%~$^ky$EA(R!0r4C6m4UXs9J+#Taoh=nt+@1{HhlyJE-jM~BV~u<+wM
zg4E_IN3#FcH9hIl&&k5Ob{#Ew8nhSRM^Tb2)Y?#Py9}cc`<8fp{6}N!Q%z+rU-TT$
z(P|V9K|k;Suq?ari!BBSL_-*}p~TRb_(Dd~VITeD{gwY{EL7ToaN|SeKC@p!N<VL(
zX0He)uB_`<I+;EBVJ5$mF#Wsju(@-;+3dmR8p?r3xG}a`FG<BiF5})t${%7fy5bmf
zFC`{Is}+gKu#OW`OsR(Y9in=YH+q>HC9y0aG|y$-ds*Lgx!>mNd-o;prw6Bp+7%u>
zA!Wt%(&?h8Lz;^7eI!vW9(6UfJklHHN(!Oe;@%spvJamM$ZMB4xt*+W+jHI8cnB)R
z(B0PbsgGy>Jd<|j)0g3MHb3r9Hh<Qs_4N{K5WmK8r((Z)fXyMdO)Y*qQ4?^Bw+o(p
z9cu@J>@GV{5|f?)0R!Z0uq;W6aiAS>Lq#{oiRxB4K(nb2?$`4gaPJSJE+ve<Ozb$x
z=N|f;r}35d-;ad!PZt1d|Ch?4@kkHBjiKWLc|zVh$9oNh!E+((J&mW1{5<08OgC@#
z@mZ93e^pFZ?~cU}K#~?I65b+-AbM}|xXs)w=Iai#+D34)2OV+KKK6%R$^z~<I*%qz
z88Gfg>YkOp?^im97ckhaJ)dopj~)_C9Rt6-o?^iVPhz`2RpZbp&94x~Zsq*z<YF;t
zRm}QrWVh-8&lq?6p3=Vx<BL1iVtWqu%?oO3!Lh1`h|dWFGvrzRrRRb(^6qk(Jg45`
znTH3<H^&T@vY%Wx4$J$~-oxk-{`c1!Q9Bie%=IW=s-?IHkzfInPAs8{I+BsfxCY$q
z5$ozs>yk;%5VB19J(ezJFP*3e97u<0l&XwkFW<7zxv1AI$$zczDL&Cobuj;4gdevG
zf=I3d0cM}T%S(VXtzg>JD6HxXq4iNaK-}mae&w&$@~^Wek;Y&it+|%@`+EWJ(w*0p
z0iasG2Wj|&@*J5QRxDKy!h<mF72h)KM#aKt)^?^|H*aI`$db6zwY|V=V8r&cjBG_O
z!TFI?nm^#hiHXhg6Bk(>oa<Jc?)_za)@Z=4jJ9Zkx<czq1qk^H(Swx10I`R3{sbnd
z(vizk$^C*B;8_VxCy*60bfcgM!^bu5pE*=?Ks4J-N=$QDB#0aQe3{#AE2T6zu#zR3
zm#jFuZFGl^npz(3=2&ogr5dEJkLq;*JS~EADt9e5A7YSrwsHvMl|CT=`(2_y)>%$a
zu1+1*0@dArG!FIxhpeTNv=Ey;h;rn4TZ(AnNVXYvO-SjT)>|_Eo;Z@duBR+yOUi-D
z-jFbpAxk?qPg~vph~pn=jn-?hAVF!Urab3QepN8l!kXEpGJ$u~9QzK-lxd}6*9FO{
zaErXgUj#XT#-nQvSUsK;S%DAYovJI=WntoY8o1+m_4XTE7vzi#PZ%G)lkV_qhQoNq
z8L)8u3uywX=+DTsA4Qjh(q;NEX5y#hJ7}mO<;oDEhsbY>+JvY#2^8Lav2;<#O6DO<
zU$JG3x4w@Eh)_%Rmg@U$CsREKnD#k?-V8{J55*nox1FHtoyD>zKV7tPAwMjgoSqoI
zNb~xjZ3am`QK4Q6KeOl-??oNd?Xep%T9CZmJBh-1JHcORHAQ1}>9)v|b_4&*2H7}n
zs;1Qq;oBb`msh=m75<4eh%Bw!sUWHcKuR^>6=m_e@mbz-%v|BhyowzVLqI<_<O{sS
zwIF;-YB5{Z84^}oYw6_hX2OGgxQpiBTS~K0m;_Ck1)Z<pB-~%5@wMs(sf3Q%LjGE)
zSkHP_rtoC$Q$1s?CA56N+$<V}+L(Q#!-ukGXE9<gV-9aTp3zz#?w50J%q#0d{SQpj
z3x0VWTgv3RZkEID6mo_{Vwv<KZhW*2kJ9PNRfJYw9N2nWkuDLmv5iyB4%RtOys)+g
z)<#)LN)q$iE0MHKD<-nn)%G#nii3Wn8eh7@y+$Yua>$Bfud;d{GhFMcc>_u9o3x}|
z4-bh++;`RS8*h`u7R!xkuQaddXur~Q(hwb69Q<EdoqtdJ`C*A8LTrl%I25V1qa@_F
zx?rD^BqPa#yVN`2vu;xmp&dUsN-<&XmuV$@>@Rh61w;7x=0Idokl{)O{Vdv_dO^&_
z4NtrX99jE3<p}jRn@G!(MZpfdGLUDASnw5gwiZ~|Zs4CM4^rj09#UY+V1+0uu7MQK
zS_aH}obDdRPVa#yT~JD4U!-RuV%Uk5!j<C=Fp58PIBLttm;Kc}AvQ&smI-BNf<j8@
zTfitoZ1~?`>@+I(#JnFVuYgKY03kYiYkl9ea2fMFCPU-I^!ORmh15M!5lvtrC(~*g
z(eIlIbxS_jcCts*Ck<8kN}}wjQu|{SiLwomMJ6u|r0+CUZeUQf9;aM|JJ>Z{Vy<43
zE0!0j9^}6r;|n4>;#nJoRO6Jlw2M^=RuLeQ+P_kM=q+<BtEBi`KdyQ_?t1y}9#)@*
z+6L(Oc+4VTvP_}H3|0Ngp$`VU;*xZy33p-KuKr`9a<PB$xN*U)&|z=!NUqpvOPdG!
zx{70+TRdj(FwBmps8{I*^p{SzC)MhDPw477eExVk9XfayztNn=tF_4r8>RjHyjl+B
z#m7mZj7cp+J0$d!vh8(#G;#g$P#?eJ-8MKKMp8@JlYK=|8RInKkSBX@+~MBRAMTqT
zb^7jabj(8#k|*~$*sH19P7;GU!XeV!x9k`;W{)Mn05$Ydw&U@TCa18=17g9(ylgOB
zz6qU*aXg+2$)_1>%{bmn>50DSY5wAr{Q#P?uV5;`C}|UF9~%}~L`{xp6056=m<FA#
zh4~}n5oxuHWBH)HeL%K6HDu2C(|LR^RD`?S)Y@7Q{dS@ikhXvfKj~}LBi#G+M&RV(
z-#(jFF9*ej$<vXdsg=X5KUu3W8cwQNpxmC?JZqUxE*fE2HkuJA3xvV<hVuFLO_}a~
z&0NbRDP|>x6<acc{PTvf*bl$?G=(lux&KcTBmGYl3x-d?o{w#(PZomq*cLdPQs;eQ
zDqI?lm$jg^uZ*W|a7arB8R;kD&i2_v5)$y*z{ET{(KJ!m;(u{Af*cn{GNA<en%$q<
zlYEYW9PQEf?z7GEA%sPuxIh2+e?B*y)IzQIGyK4DRx_z8U{Wj_mB*?IiK}tRW?Q?7
z_P)wBs4!M}ykxv8TL<mG`3T0VKHl9lVDs9tDcxa9u6<%yvP&!1&iHQ5vkBwmUmT7;
z$R7$a4#{+!d)*JFz8dOoko1|C_VvLuWpQM5YO+8)70X&riQ`%HR+7w=B$>q>$a>ab
z-X2|{?a2Y|ebC*cQU<24I@)J2w>ni7Js!^po5_6lc4UxDyRvPE)>p6pLZ`RkG~GwX
z%<(`~9i3I`?-7NA4Xi>Q)y=X2nn+in@;ETmN*F>PnZ>=FCNVAv+)V>=KlvJ#qo0e!
ziYU@SW0&Yj&YmarK5oZe_RpA}c+XjIS$@WDuL)fG9LNH+DfMrOQlM=+3dKg*O-e=U
zJz$N+HN@8$NQ8P=(ksDK!oEI}Q?jX8roq!dqIrePuuNj&?!2$Mhj}vmTBo<OUzAya
zU;ewMr!MPudcRrl39fvIfNc;e^><1LO8p}Fc`%o~C8u{2zhk;#uhB1VSl%dZ4T$97
z5-oa9o|c{3Y8mKd1#&0s<zo>6u{MD;F{f*K`uTmSM+fMQ>bV@Rt*QG(^J5COOADq7
z;Czy)*pPh*S3^?@C_p|14Y)-7Vn-MBk6G6`bW43{)dNX8XcV1*;UA}feX{(AlE|r5
zE=a!D*oY<DyW78ebLR}zD)MN#U*YQ~?nObyKWlwe!m8uPDGGBq(ZMtI7mzE^dbQip
zTd@rWF~SqW=rKec5G1R+K039M!2?N^P5sK#IRZxdDPG^@&KarZA)oY`N_mxG&9#&Z
zL4NrS0shPOST%u6CSAD>;_;$iRdI+PGUzQzk(w&3m76KiBZPX@qe@b=?|O7LhEsoL
zq9NM?6(+IPDNoCWs1Cez$)2pM$5Wc;%nDFRW7{EqHz(Qd_vw-VPj27z>l0yJrIp|Y
zmUv?iId;V41xU$(IE?d&jB#)V@<?{H64!p6^!;Y){EGqGcGK_1srK0>@vFvnSwD#k
z&lq8(op#>z-6J4&&Rj<M(3^xijDv5XjwBxB`%xA#(tLCebWdLgb}W4b2D9)H(;2j1
z?C8Z4vuW9uJ<^bwEcYDynylBHm<M$OsjoNLJwNz65L&;R-&keXCL?gX*dzY{pWX?k
zJ+uHz!bJr)`5}bl6x3ewF;=;<%x3P|y(d8w$TtFnOAC^iIy@_m%uztPL$^t}GdC_I
zKO>hiSkx^2Chkfs!YIkZ_&2TTi6`)SAbf~^jyUrmA1XR9CbK0>4in!rDO}FTw3@wN
zL)kfbt!qfdJy{33NpDD;U?X1&`})=QZ6DwLzNyye8XOb^MD&4=S(HsyE3|;Usu6<t
z^EJ;gzePW`@?%Ff_dB|aEUhjoPNK07iZT3|u24%Kw<g26COC%9)%2x3-aJ6d?=LI1
z;BoHGwGNQ8KOUok@JjH1&qq=SUnHcz<%(RSeURU-LO(Xr1v~fmLfr0Y<S$dwWWEy(
z{SlROL@<f)Ycx`?ebHS>TK#TtdqlB%&3zx1_plqeJ4|oO#IdwL`nw~)<hwof^tpi`
zd{j)pHsMukIvP8aCd%)@sX}mr^tw!~^F?9J+@VV1i*nf<+~fdyiQ1*yfrUxfIvpYf
zY1R0Z35U`L1&mQKH(I^1Jtyn9)%N%GJ(U2i84iD{SvT<em1kM2n#jg)@`}bEe>q*N
zp?vq>_Sw9A8Kf?_f4cvF6_}6iF?S2^t{G4Bpxho?AJQ?#&oS3e{PEc&EqU#WoUDu6
zp4?gZ)73<HStpQ1NW*Iq>Oxor?yF|tTPodM%yf_$R^*J;q*aSZE0|iU$D9&+!(7Sm
zlamxI{A8cf1Wj-DUEMonlbL@14HX*y)QtSpYhBmn;rAQI|6HIfK^od&A{jSmqSmn}
zRsX?TuDZ{plrY`U*#;9*V$EzKYl9DCPpjFI&N5qaLcuG;YuU!#q4aoTt(ZD*+YfPc
z(OQD7&;BSK;o)DXb~}Q&;V-;LzG~px4`@UgDez2x5W*%4I^-8rkC?7`;|?F=cuUls
z>?J(Hguwc4|5#D*oP84#pKU6;3-C7mnoLld6Xl=VLAx~Yor?x^Dt8t~4(=uO>~B{u
z2PiPwYS>e7u0wI*+*rlCp?!{mu&K!@#R=Ez7q)k8zwhb8%R;@t6f!c?!*9`)UsUAf
z?pzaU?SBp*5#d`1%5|Qwk8mom4}FYOkwDu~v17t`Ac<$p1e(+nr7hWPJlk}DY2iQW
z<csKIDXrnN0$g03NB*bm?cglYBnh0}4H7wK_rk-TjtvYLR^1;<_KyUK0T_JM8Y3uI
z>C3CIFa>OfhJ(muM35vIPOFXt2aMM0(GpTC3BBvBEA>0trQXEcD*M=2%~AM}HoChy
z?zBjj$P7L_q-9DEwz*Z8KR;8SJ$zPE1*~Anrm1<(lNq9>7R+;=-dKYy79DI7r8#Jl
zd<Iq|f$5`qL|kmg4M$&mJdDzBGPjmdYiMth!X!f^jZeoI*Ofj&kH>ciCX5fJNVb*;
zk9Ae5B07!^h<p629QxDqf(cjh1vglSk7<1lP@2FIwpbH0fI#+MRcA{{B2|V8<f$N_
z6!5CUNQvuH`sD-}$Hk}IuvR*cmc{xyJeOT77fV-lfLT1}Q3IhVwrj?O4BnY{xf=bC
zdw-ag?)7x@-=#JCEhI=5$UL$93+T`Ikbqcz1;%=z-`lW@F9Hnbg;8S}w!KZ-uAnge
zQ(FP#ATCf3)FAPpd>xE?5+t}KS<bK8^CujZ^B)Z}h8ooiDrMyOEJs(Zm^Z(cGrZkp
z>oN|O6`jqKIh^vkTOPPT<uHy%f8r}w{`96%{`ZiaU)xt|Wn~?5z8ijSP$<s<)cRz`
zQs1+cimkSkTgD*|O@~JxajT+Sjz53ynRl?Rp2NjCfX+sM^r|fBkm@lKJO!RSH&OM2
zr-5F$HnPBEl-z2i@7(u<n|`{hG9`h(%F%7q$Nq5dd(LG}>am_;&dcpnm#QvvBmd(c
zc((P}bFB`W1*((q%#{@MG%~2A))t2;PGI_SFrMb3ZQo<RLDiYt$X`K&S3xihTp3Kl
zrM3wCKgP^B;l&^0>P}0BXf7VNT3w$8MMMXl3~V<{dFnlG)bFt~XbdvNLyRx#<v+l-
z0IjhG5dSm+liVn(gpyF{gFD_Eii=a5LV4@_$xC=AERq^<zo|(O!WpICRvV*f53Uxz
zi<hP!lP#&uA4^M=I=%kwY~wDiuYtZttV2GR8XQhaO8B62ecR>-ziu^;-uuJ4V~ZpH
zpEPkk!a;Qmia*d7heupgiE2&a6<d`Sm{iu}1Lme=QTnU082%zh57F>dF|M`DMD=V|
zY;iLbw-9GAX0`#lfR48Mu6x;8=V1l{f?3onh2B)J!0L2z?=+Sz*i-a>2wN~?69AV7
zw}cAhqLsOvs!COVLq&}1{DG;@Gm^ztKNG-l`4IY!dr|8o5y@ffXoY<XS&Omp%Nd@`
zwzW)7GaP6#%=q)#Sl&3-SlXYOywUWWCU*0`!5T+XWe~T$W$LJM`S4T8bET=*%Yr~)
z%nnBNiV6cGn5aNFVTZ>#hCjk;zPOfGSL@N~*PjlJt@0cq|5&o@<dOS_bu8!C<ERr(
zy&TAi(L2Tk*7u%K)cp|!u>_8lb<?qWbfjA0#Omf655$#DS#5Y(-8pkzX%8k$MAOVu
z-IpIs65e;(s;(Zm|9K<;vX;XwkLrKb#1!+8FJDxE2XH~TI$*Tml?gIP_LhMehBj*P
zN=@joB_%|Z#XxXa5;$T#K-}Pqd7n*dZ!$BJ-ObFwx-ALIoFC<96$TT{QT6QsLGwWQ
zn4L$2Q&u(?XsmXj3uYmg)tBeOK!K+sLj4+FIoq6!Z+4iyq1MO7Kb{69N%5}YQpbY=
zGp-n9<I@K+obq$87kE;9$Bt9mPNy7w*}Gl;m||_YQGd#h=`i_|%T|7$1+NUUirfyU
z&q7tjq_1G7_V*XrN42iE!W<+OmK&%t5z!-}VO*ORf0B>tid9puvcL%#y*u)j>btck
zY)Xp>tlyk@v$BvpI!!`FmW_GvjW6_BRa#NV<+8hlkFk&sE}hd-$_Z{4?G@=M9ZT4w
zURnasGPLM3#=ze8OA=IQ0Fbd!FZLkrC@f_hGe{97WUm`ixBFV5HWZCVG6@!NJoD7^
zZYkiLl*J9QpQaj)d*h8rw+iaf9_rP=GjreboVe)l_#fGZ)v{%J;_AJmr?~(1x4u-t
ztFKZI_%2Y@&JRge7D&k`_t3yJ1<;Qf;bKp0|3I^BAH8%qkiVQ~#4r)lN~@oG4*kA8
z;wqM|UXdnS?cnWh+xmd^%(=klwQXNz_b#oEoBzv{1j@0N9H6=-kQ+DnftV%vt+@!-
zMu6Z}Evw?AiKETP8f$Qyb(So|OxlPfw5oo2g^0g^VWw#49s@Yi(N;3Gddygzp<ZU(
zYm^Se;w8BSly{ASQufm^xjf^k)|7=5z<Dhzq`~|Lu(bCj!4O>_WE&S{(y1Fvms|!}
zTo$9&hIhj&mt@f?&(odDIZ4f=RRB@hH$*r+__gLn?@W@)ui37Ho;ye(J_snDFei7}
zYT&+T|DP{TQvvTJ+GrkJ6lKCmFa_;Ck#O>N1(|uFpQodA$1I;I4|fMt^|B0=Ub4^W
zqox+E$ZE$RnZ3Kr@MfWMJ8F?!@<T~Uj_gq<y;2(CzVoEJi);3Wkr7GbhmkOiVYobS
z0V5#i%@9_?_RbwmpL`EMgnvKJR(TBT1FholnBvfSg4m;FYT;Ri_t7pTO*~~1O#Ehm
zgCw#Rpa-+A6u97G_%GJ?OuJ=~J=rJvivLpR03XiR`v!<Tta4E=Uj{#OK?!AHbQJ3i
zUK7@do(yOZR95UoOuYi770eXR8@M%%{>Qcw{qtKZ_8q2E8FL$oyBq4#Y5UfCzq5bQ
zNRXNN^WGmgd%Ww{1c3|;@5KTU9`#MZtYHYeR{jjG9>F}IO5^*dBpO4(iHoNgGY_Dj
zO^Vuav3z|sJ`j%sIYs^|=33dd2~XMLk1h1Yj4d=@pC2$!CMh>4dkwcQ-}Cclj-GFn
zwcw9_t5ceo1H1@QPq_T>d~ktPx_?brVeu+?rzAzHUCP8`apI{M^$N5gNxcqB5f!wh
z7zAgV^efGucrz|bO`0joiEA)^Lk;I{e(1fDAft$*{4n!RbIH-;RW%^GbvNbw0t~p+
zTAN@o{P~c_40Xr@F)M|g`nM5>0Ukm4NoZ<=+%>b736<-4PN-Ha(>?%11DWoqY5MJ$
zl;#fId4;Lg+7b|mQTRzCLQ<_0^2g>#sn)qykf)i{^|;aC8+&kZyv?^7vWY0^jx{Z>
zz6xdEf&J~Bw9C{y`?H>|*NeW*Rk5x+*ZtICT6DnV<=awm<~BVI<Y`$9N%Vn?nfum@
zk>%8kDXIH23>Z^3Ru-rF9oLqEywVd}D|(|>mg=^VhuXMr2CuC&mubaJ%{VO|_Y57H
z=vY1>=#LA#O4}|tQ}py~ozV#hqzLLw#;nMbQ3^NK5Cvqd5``7;ttPU*Q#z?`vk2^D
zwY}_nUt<{gn4qj9KLh01V03HUO0g9|Vh!3W`rg3~zFFwS4}vML{z?<4ZQfHW2lL_t
z(qe0CFc41zv~M>k1T++m8K23ERCovbn%4E&OqfjYaTBD94(U!}S<boPp#zR{#3E9h
z8aI)#Opx|)dy0RQbpo)Mzfa$BSP)Y9)bl^q?={p8i0Cgewl#dR4H7^jRgPM#U13Sh
z_($We;{w!KJi>oOVY-5;Vi{(CNXFuh(%cRXe6~{Bil^3$Wf<KNy+Gex)6NSvf`+C#
zepc{`XM8$qB$?({68s4N#`M4OiUnR~fRu&sqxmSA4wAL8L_2jS4Ve8gtc_Td1Vnqy
zHp*P$LNnPb$RY$gGF7)bj5=yX-rJK4&<h*)>C30XwnL=lp5wmeJ`NIUz5c-gg7kbB
zh>Fye{qGStA3m58RzGo(3K%`2N5aZ7sVmwBA(#{=T<v&VoGUgVtZt#wCEB6n#Y`d^
z*VOLreX^n=8>(kEg`#a57TQu%oq8nhcoI4L!*%JC2d_v@{}+Y+??0OV^!&?MKLVHs
z%&q`@x@G>n8&{<;PfGZMx+41)P$^gX!m#lQFjW7T!m?*tqDC!r&_~;e@zIGUv)uzy
z8b@e|T~kL{Gzx6{%T>u@%Ca%Hfc&utr<h9ax8r8(>jrFxFKK=$Q!l>=4@Cv~t2U4^
z6BK)yt07@osnh}6q&ARNt)!WIVVgyiWz6lB1C^xsjI638i50$e&i+<qiREEgR3-I7
zf$)>P*X!arZY*6|dhjL$d*j)J$uJPQ?7%EKl&i>UZBCB5new8#pL9_;*d{s3mym8E
zdUfFv$~xvbY!CWH5}v|5AOW#bgC0kChr{5VV~u{uEB1M1n;h}Cp7~M5{vd%_ia~7B
z6M-P8-?0DF0t|{!trHLh9Ql5P!6~^jrVCmV9m0x%M)1+XugFzBu_4{^Vk@_HEMd^a
z{Mb4-QO8>5w^+p}6^P~FCFEr3*3F5!dbnS`?vwCs#N_kRoPY~R@z@u)Fxu6?w7vMQ
z^j8$j92|tS!~qTL*lZ1sDjvDqVP+8v;Y!dkN=br54!F};s-#E}zgS&RhBdXBS)n62
z#S>nwMTI`YzK40Vs(X1Y+r8{#!LYR{<67$DF%kZ?k<t`mI|%09Q7>dVs8WeGN)1d;
zgugLDkcGFNRWHSA+C;**P$VvUnauuHSt!ibyy%`ijgsQFZ&wlka=(`H%-hE~K%%g+
z>+tCfEpe?xR{2l`*W$z`h~5q4I14hyXd)~RL2bq`Z)7d*fuUQdRlJ+id{;u*A%?ad
z2D{j!iC~He&!rr$NbC$A*$#5Rb>AXop!#8aGk$oyrnNBKwom%ki$7XUJzlRRgPKmu
zSKWkvQ7{RNt+!JW%A^pbyb@~85R$Hu*3?;yvh|eK=;vfn%7Wl)kQCsWqMVz&n$2`k
zX)HTuOl|HrDh=-O=$kCb$vj)Z?KbCm`uE(27)1J{IZk+cOKg9e<-`);Uyxo+;oF|N
zi^z9Cco=g1Y@0aOdYb*I^u}xw#ug(wj94rC<7eMT>W<kYdr7SbCoHI*g53|+JX*Fu
zT`tF?hY8pg>nuP2f+1K0BFS&-`sbD07twC81{J`>jsk@2$x5fs1%=p&sS~}WgXU*m
z@_Vg6mz8ZHTnWEo+kF4fD-bqSuC7pPhbdOSg^NTX=aE5Sqj0IsRGd(g6r7?9zIl8j
zo`KTtS4^{ko6a-s<!uO@H6*U?R$3XRIcnuG*hkRi$#jVuqV;=jhwbbBisB#-ucP&a
zuc1pn(+;%TGI&k?|7dhOAr}$l0b#UI*$Ny9XT@=(VH<LhMo=&Jfyr$DD4h6+nd$s|
zOdxXGD^6-6(}Ml+In@QVVG+=>SW-~g3Rf7p2(mj<jx^e$!sd*&SNvt?CV0zw-g|#z
z#VK12>W`UCHKzT^`JdL~`)8F7e6@Bulvy(>XmrSoSh~oUwR`a&y5JQrVEsv24CDG`
z*w(4mju@eaas%k}#d&3?i0JY1Y@O~uKn_)pN?B3oM3<0OjAiThoY*DmbhI)nxq1~y
z4@H~ZEt{%-%1?Rh{Wh>Ff|V7#0OR~uVGZ9;Q5t6|bbx}(X=~vNnk3+wgJw42jr}oQ
zF>*U1ya^5t=J(x|!qrOKyI&-K@eOEzd*W7L__Hr+yP!P~RD;~yUR?LBifj7e!DC{{
zvvJwj2`m<eqZ%*Ok{3!+uub5NFxxU>3}ve=3A31;Oz_Xg*!%nHoSyoE7L!pEvV@V=
z-RAZDWlzZGIuQF>iXjJNl-n~y4C_njt};TbZI(r|gTb8lc!qVsg+i|(AJ8x^gk4Zg
zLEYJJha~AzeYnjXAePgBK+4KdW$<=*DRG!bjxw;b5*MFs)Z<8a%4m|r)PLqY#ZLNk
zTc95bMt9SArk@Nu8TV<n0X-$}`!{qyDtGsqgn@Z0nUQ+wJnqZKQbi;q#zL5`&{w6^
zSp|U<**FWI*$f=pB|v|}-Bl88Ej_IUJkgXp%AMjQy{k>E^*uiQQ%Cx26u;cped_nc
zFZ<nV`Zro%H7NVjX1Uj7pZ^xsyo|A5SM^(7s86$o?uCPgG%cQw?VUFkfPAg9Lahf6
z7ahoI<Qsq<hZkMCSe7gI$6RCsFkQh;Fxyi;z?n)O(Lx7W+<b5c0m}5DG!acYmAJ=P
zyIWr<qUE{9SaEzHq|)0mDxi7p!6bs-3$Dq|dW4bPQB-RLSVqA3;4AgBC)C=%D||3M
zs1O;wLT;NmU?c#cJz6^!FlI$5jZ>OT3)$UtP^shT3@A_Mdihd)ai}`Wnk)9X=(g1+
zMW5mA<)*SY(L=vfTNT^X96^tpQLWKbzMMxzr{@#&jYz|GIL-vnPO+3<0F_luxeK;Z
zmLf4~C2Mh8NT!U@QA!hTG1EilB#h@M(w|3>ASI#Z1XnP^8#8>fa)bIKNHL+L=Ydr(
z^5o^VB^~jcdc?DDuOo2DE#Vh@)eQ&^!smZTYxsfW+oTGkM%+!rfVXf$sKeneh0GR#
zU96?tt`^*qXtk2!NIFVaXd15@WVkr@lsI}n`aK70{dlV9LhnU&XBX2sZ;YF9v>?F$
zO4(SANbBn#^X-ob6NL`cN<c3dF;*q>FMB(=$+y8+fH~DTy@9U5sPL8XTllw-<zTq8
z4{Y(6SHud!TI|*da0O6$i|gIId+%iQ*D^Ewe@(Y62y}1=np+YVRPYHN@IuG}%pPuV
z{s7&BzyUfTcg6G+2Us2airFUe4G?b_kSBHWbc4H?>rf<Cy^e9RS-nga*F;Y8-TgAP
znP-5OKFA+)V8@3hUlou1QezSC_@A&fHp6abd+2$+R+(<@+cmK>kCx{)7&{fjGlRr>
z3zdIXIebjC(KDMV8TNZ=n2}u+<p0z8d-o6Ay|C=_#cOvDcnDh7EG%B2u4ie%8t+3I
z2+GBx4jpVulU!Hzi>-p7&4@gNN=vIpQ*J<m`^u=(Wj(W2VB?Vu7;VkGwY?x6hpZ45
zFP!igu+5w(0Vm(I$lAhe&$ECK6v5+a!6*pHj~<6`p}CDT@wHeu##IrNI6si@*b5i&
zb~3_6t*JSXyY&sk*$@)g6;p9PgiYyT6ql}nrff6WFBvY7f9ZQuCa%q$dp_>&_vjqu
z?YVPj&$+@hmM<d`xPI^jgUjE|9E=X2Ky;M4ZPo#an@+ZOe*RL1n^d7aEj6l^v{Zk+
zm|_96z)y>%0WD@*`Zq_9?6xJWz*5ilg-L^F@_PZMQ5>(XuK7h1i-uaN5V?pOMC2~2
z9RB60HLTYZ?Yf<)7wIk=r=(vQom#9UKCc2Hqqsh`iIB0!xeM-^Vd5UGr`0eQo0~fU
z;J~$!wcH*X_uwx_s$>SOKl8TsIYLY4w&qul|3RzXfp2`I{1j%QpdbxLSZ4ET)J&rw
z@Eo4KU8grnPn;0ZF8rBoC?g~=bwaNzcV8HFvJ6UU=B-Xtf2DKiI+V07$HP_k0@a%;
z`|9kk7k#SvS!>P#X@bQUJw&EcC~pBjSs5<k{-g0Nh=JT^{RSsB{p~|O@KA@$<tO@i
z2F{Xyrzx&rmReE>H)5k?>s*=3t&=UjJ33*2(CQ39kCA({uOtB4Nwu%cR@Y!Nk{ofF
z9<|%I?&rXf)wi1G;u21@om2}n)Kw|URkdpEU-seADaza2dv{6xQ_-)~ix@U5q8fga
z&UZt$fkG?&6+ez&VK4mxgqB4Z+3#r(qQ^1>sn+lqra|6#MqWQRDi4e39`o;+9^^#+
zJv)~;CL_xaS<h&fhH00G6Us`btpA)naf7*MFTP)>G`^=;3Uj<1esh^XAqkLfMbjIF
z#-*%<pGb>s$Z;dOSaR+d=x0%(%wID!x(Z_hCKhd5t2=Db93jsNK!@DQ(PqJmcR_-U
z<AVNNvxmf&HD)D`K)KI%KKdMlFQe}NqwCG1nmF6IVH7bcU_=xYgj7+{BG6Wr%93bN
z5fS5#1|hYmY=+bV5+!61WD_A(D?CCWq6jLR?23>8VQHnx4ibbcRApyUA&exMzL$NL
z?|aYrzJEZ^;mjm6_kG>h@>|YGk(Dg>!|Eu(S%y7Te(-7m>!-gp4x@Q>)^S<7@;$Lx
zRe7gJ(>(dcazITx=CF7T>FNSQDwzus41v|>YqJBlGM@O)$EIcnF+)}mKCM;#h+evl
zP7iy+5|5wP9CFKM8OpegM1p^5;C9!GkI1*BT!TQ-=3nRf^jsLL=92w<wNJlVU8C3f
z_07&TckZmxY<=|4aZ(GsIw2@+D_5&7sT28Ma@t9zpu!kSH-XqCAl0~{y^h5<a01%W
z_{vb2wF<Sr=A>6RdTB_%-N`#=EZr}Dx_Fjk9QfC`sPKmNqd<B6L)zQ7#@^qER%xi&
z@BknWs^1Jt>Q_%5NGl9zd!gb9kgWm#Z9k#7Un~Pvg~iwhDWQQB58Zz!W;RP8^}A|2
zZORIEr|V-b!s_$6qT{{!_XbV{&D(Uj<&D!Uo2GbSOFtet8AW;dADAO?W*Y9b4Kgt}
zObo@S$7fd*LJGjvu9DVpzEGXTB68VY^63=59q1<cHSt!{u?J0+?UA`~BC;9x$NmCY
zzI2Z}v5@*=RN;8;$fX~KKAg;Y{jpK>Az>B@u=j1)w}2c+l#5kPaI16dL+We}5&r{O
z!q;M-z*ftUI3pk)yP%GBJ}WU#(<(o?wyY|OZ^XJS#2ve8%<hj?np$^|_Q|)8RqyMb
z95~)?J8AXu!=9cCHscVd0yyhoi90y_ySYy3o0d{x)C)K#G)>wPLpDCi5emv&lP7D|
z-g`6R+e}#vEixPIrkvEYot8I$LNH7*W@R+=UEvFg1N%H|CubYEOyA&-k@2owGlizT
z!UN?RI2<98apoJ6VvjnVy;}JtJ3yVuhj0X+z8EM0O=4}8XO7AYZH|XFdL6zV#glWY
zuFoX99zm&bHo&uMX}aW)^6-(D{dLBKq&LiYLxi_Et-5<6l(O6f$e@P*Q$v_P4zV=?
z4#3r%J_>pSdeva1A<hwFF;Y(u<d7|O@{>+Fo~UWhl`qebz#1O<O8(YCtGO_@#-R{|
zEyhgOly%PjZj)4Nf0AJ|HScVGqSMx}@-tAe+Z{CT;p(k_Yvf$P8-W3mB+wFkx&gG)
zM-Y5dkh9z<K}nx#RR$fkpBR-yP~-RuuoyJ2p1x+<iSS_G?@|a$Rm~0`Zp=*U(O70~
z-ydzjSG{<K{^?K{f34uGgJIm1t@fZrgCgBLws3|@4A3CO9Q(K8@c+J`It!_X+dZXE
z+*BT5(G?|tKHJ0A0YYtGBVW5ur3a+cE0iVy2<EJCBHr`&S>IK}K3Xt#$#j`~Z|36>
z&8G0Q`OSBO46ko4PdnLVlQ3OgX!?O#+UK;(;K>5@88*DDXnP1Ad<&TOrU{ckJDsUG
zhk6&^DA!gm1^?nI2~S9kr|3C-z3J_4ukj&Wc~u<S+OL3x&^wEE+gBR?*lJl&DpYtJ
zX+7Lo#0*t}8S;Y98RXyH|FkW%q3y~;LkJ);DMcm#pvpE<-wWn!W^ctFq81XdP<%Cg
zD)u2pqGQST$1e$%s5SusXpg)(Sw<(0rampqOSXwz*-Ec&XHHm#5w!#7(s}XZE}6Ej
z6&TH-gho0_Ct=q16Yk0%@g_Uy@B+Nxxp||tDVEVJUg=~ZLsnw98_6rXRhkgJzC(3I
zK`Y8{vZ4o+Ak9#f7^a;NI_V%h5UuTK?C4ED+7lLZs<1rS;<Sc(EwC3QAE0VXixHgV
z_V?BC*4h?dr|Xh8vmG!O2|W(CMDJ7yxhq*iFZ+%F%R)&aB)cD!Q{pG!*$0T!{N%;8
zKRD$_yl`afbu?D`GcEJ>Yp9Z8`M`xM#U*p9RW6Dk>}%z>cq^fWY?-zT8_r`h<nbv$
z!p?NBHwumgu_i4!p)TDuc3Y@-aCac>-CTmP%wwuJ<jI~*nJI}(>2H>Hfo0<<qAi3e
z`+7R&z{8hbEo5)P!XLA#J)CW-tym)E+Kj&{2%W}P3lg0|2-j3@0sg61D%0|?R-uSZ
zqhGfPdr_4dsqdZAy6;8zOyWe*tcRvhlv7o0nzaCf^MwEa<@yWAIU=@&6b;OSYe;Er
zd`b;H7a$Co=FQwS*j!V(Nng~=GiISpCROM_xf;qKo~Y!V?y;W!qT6~llj)r$_UH`t
zV$E1Mf5l4wc)VA?p^ntfjiyM(K$-fWKr*d8&iPtSZGxn~?09?m3*f?Go0+ku7IF)y
zm7bSf_ddE44)~-!r49$H)4j(%0t|}3H>>LYA<?Q+n`u8WvOv{<)Wd8SJt6LYfG?xV
zi2X?oNSRjE4O?W1O1lf+JbvW^SnNIU#tw&NhRY(b4PCh2D{COalm?bGNe8So>LbDm
zy$}2xs2|ko7vTTkK>C<O^V6MsL<ESOHX_a|aRq5YtaK5N7@As?K>aW*B{e&?X^ZGB
z552LJE-8;&PF(xe|3r08Z`IS$KBIC6i#INjmYLm`N)ML(&iH11avi19s0&{XJf7%1
zr)jjeRPZaBy!LUR-lo@{w8)8J+4M_kbMdB}zxoH>irj3=O5#pg2Afxgf7kA@ZI4M5
zB^?>)!?lx@JJ>Y1#2=g%N)@Srx)4(~BTycmjU>Y1*_~HyFk~qAYxL4}IU-NVm%Z{6
zl1+LiW%x^;uo8EEUfxk&tVch|)rTU|zbMRFH=sJlq3{`DrXEr;H-M!gBl#*%V27-Q
z_71)aJQKN!Sh(F7-j=lkek-8YiXNsfQSFew&Qm(zuLQ&a2`MuyZ1LS;rU^!E^fAGt
zP}}IUkC&iLuYVQpid^_%c&Iqy9?S4hw-r-$G?!&|@b-~Dr}d98{_p`bfiUy@|L4|H
zBChSIWU^t_5gh}oa3|jq@8B(&@d$Ut7)T!GUWXH($+x&eiCImF3bjCpdt~F8TYqq~
zS;BU;tf@|pOANDoo$Z_F7NpMG#Lu>T%{#l`llT964;^zV;|EZ;`+kP3-6gFO_}3aM
zQahczV81A?p)JDZDlA!Qytc;uqNHu5YV&h>PxIZJz#;9j3cR~}hP$R;wX1s=AL=X~
z8W)NxV{=5*dx12+gfQI@Sl~Uc0fay}1fP3TXrVT($A)LZJ}W0bhC1mEo*^yVE)iTW
z2(w->W^gIw^r?|6k%|}UwEL%q#`^SH&IE)Nj9s~Ohw0oH5@^_aDZsWt1KEL~-@#dA
z*)q|hT%%&DYuGNzLnC0oU>*y^#Dq$LkrSmDJJI=3wvMy1cY;kF9z00Z7)uXM%L$mT
zyl-`ZzoB(g+V#STNrtz|*(p4IPg0=WfCeR7YziN;2mC(7M3zMp?L)MayPPQ_-3Tot
z9Oa{etG*bxF)ia61obLP`FHO9E@K2Yj{1;dj?}IgI6ZD(a=IyZpr-1Fm-G8>z5bE-
z(Y%^BY42(8cq#I}EI<)FSoZ2>&cF-p7r_(3qUYmRfBnyVpEwzTFM;l**0ef7@B{M=
zXF%blev~0Ik8(N=O<=+e+qUH_u5d`Ny9R*;Wr{_}7MEO>oygjVsx%Lyy=Btc{a&@^
z$2u$APZbnR(0BLRWCqVisD1aMZwPM?^e7420ZQqE@*rS^KE#)C+WP4Fpj34P8wUpy
zo>r){;StpC1v<UEok2Edg&##zD~2PPjhqc#9})|osXOL*rM4(G@1)O|&n9Ti%n<Fr
z>#8tuZK5q9e40K4CApaSna{M`29{?8-bQ&!sw4J)R3r!hBhV#d)<Hwh106n8(y3Zn
z#QIxfkKFEV&XD`%99FAqZ_SQ?cOucaUHZ>)A9nXxPKG&~op{<^=&DHhm(3van8sg3
z%*tN1&RD6->4UIF1;HRV-oig?)@p0Z>~G-TvSOrzS<j2G_=fZrVJ%VG7soec??aKM
zfUw^e3-Ua|WUr2%?gsZ3>?jq*v#LW46wttxIlFjQMQT&qoxr^J+s}Q4kvXLay#6+r
zB#CwLR#F)RTE2A<vKkCA_Wz@gj_Eg>>cmK^64{J^+(4Yr!C;$jdKG`2P5Hs*72Tuv
zeuu2jrvH|O*P{zz77^b2U$!2Jp6b*fwt%8n2CjWkxgM^+8^Gu>q_XgdVp59J$!cQr
zE6Ol(qb3qmjmF4?uJY|t`a<?D)HGS5cHG%pASj<5A7r!Lx^43(&-ir}gsyRNJa=vt
z?On6rN8CgMciEzeG*p9pAbAT4^xjs57;~LflTIrQc?xC)M8h$IIWT!qQtw<;Amx#~
zmmgJ$szTiF&gQ`z3-G%>%Rd*<U|5&_;hM^}0LyO@8?yC47xcT%3TQ1lAlI_C$rlY7
z^cGEIXB<V9<JFcq=?6<gGy2jS1JgqyQ&c;x?k!#S1gcixu3QjEs(5A0$uK1isdvD?
z<ow}dC`Y(8Yn3|e-8EQS{#e$wlyPaBY8!J!kf}4~Ec>0U_3+IY%?cddFAaE<V%q~4
z7iG#<l%sA_H78|#!qO(`$IYeS>^dSwLjjMm(&b2}O`+={=m<7biF7d#z^bYj=b_Z5
zG+JtWcv#S?IfuR3A@?&q_dcubI)8Jb=tHNihx>t4*2Y^6_+LHQ&wkPTwB>X1L6JP6
zltJ>*HJnygrnDXP`RW-KhLY;|=AGx@>NjlOquoQczy!8*5zh1T0`6mb-;qvqh0>P|
zU<mc8Lvz)|fXJdC&-6bGM7mkr2LZI{#5zi5^?wmN>R{Ln8#zN1a0||)SG8TG_!DoW
z8zzKt<LvQOa;DIFO`z%OlT)+Bgi*fT^@eX%ev9KqHp(|;#YW`O_{I18y=j5BMm~zg
z0VL6thq0+K03Hc}p7g3T)k;JBx}XVBeVs-5TjNh74LkrjPr|GO6H18yvnEbDLohMG
zuA;*&rfbzaB!C-Nrdk|D8?2WR*J8v5+^CbkIKWg7yIa7zBJ@ZOODfhU0>WWmwVZUd
zJgGOMeth`FNV#|=t6xRZW<AxMr-Aj`=i3r+tE#4-A}P|nn35NK;bL2@29jw%DOT<s
z0XB_zlB?Xu=>k{V-iH#k<}kGhS;hL`0ud@A=uwc-LGI(h;R7+ppO>aMnmu;@<tu8W
zR(4iz=h!KR<+SzvtJc99WOv{WTHv~`;MtW!BtZ`VGpf8Q9tnsvZ%Rdo0)H-1_0@}V
zj4QP;=7Nx<W21m@9=i?`o+p@9^Y0bT)cx|zw8lX=Z5npvj*$^S;V%zJJvu_mj8C)<
z<LPK1$9>G;{XY^&ZW~eKD<(bnfQpLs>L7>n$xi}}Tw^E5x~$>@eEH_QbH2{6;;x>1
z9CY!GzbJC3By62SWUZn&5>#|Ne!MLn9H6;w`)vUpKv`XL5u%YJGzEBxlz!w54}Dq_
zIZRrI{GhH<x+~4_m2JR8o>R~j+<u6Wlf<Wyf(af&sg)+GDW*)M4*A`RTBrMuGJ?Vq
zz$PH?aS`#QW6(64cq}(lTu?vewQzL1sm<QLvf^tsbZN16AjhGzhI($;S_kvm*<F5W
zW^h^en9<^F>F=u5TEAyayzL)Ti2g+UZiyIV+15IW2Ssv^j)o9b`b?SU#8E(gY{51a
zun%E(<c`CJ_0$A0p~hO;+7{2*fZAnfwKZ8U3*>7(mm55WQO3!NJGJq#1!3d76&~kS
zZ66xf&2!D6sqapEsP7Rzi6DA{9M=Lhj?{0ZNQS}ql2^xkV+JN-T1pom)j{l>oFZYy
zFgS*R)t53Q&Ot5n=85nibfVHJ$u`d6!b>mKm-bCq{a_D)Ai(#@NcyXy{JaHEMh^w}
zZ0OzTWQ=RWw3o05%JNF{3F0uX-$mg=TEX7{Ko8eMl?F`F6P#S69$wP-F)-?-6P+TY
z%tUU%zH0T2sw|71S@qF|^zb;FLCu5L8$_bEBfU-_Q=ljvxpMxh>_?*Xum50&XS%R+
za39dWx2ib`2;HIe*v$g=N$`eI179xe!wtR(F>Yv!ywP;IeB;ksdTlJM*ZR}WRo<0l
ze)D?vyoUunPUx0)yvw6-aw;)f>~S&Ylm_BJLND@E2HO>oOGf{U`6_+_-=A&5Vfspc
zo=({GDixSSHWF9++w*nGJUqR-`h-`InDXM~fePWtZmaLh%hP~1@|@Ospz`|k{-;lk
z3cE$w9pHohzd)m`!k6Ar(y$OX-Cqd&h@#?V@~U1ZhLm(|=<DvHn&VRO@}d4WSoE-v
zV}Yh6)DVgSjr0STT(GXl)I1>f=u5D9wQ~N0dzoB!Ds6F0NHOb@iQDX;lcstJMYa`?
z+}7&V$aToKd_P-H|7Np5<%HBjPfc=<0-8BFlqzll*#SgOK+!D}iN)7q5pZXYUJsl0
zbAM2leJL6VucyLYVDw6g-4Qn^j4B_?g2uh|_tf$QJ@nmO<&%D=jI0Xt0Y$e{Lv{JT
zUDy8ty2qHf?n`)dLQX3M^?0SPxQWq~N1BEy%SR}yX6Z{<a}9h7S`-s8Y(bwybovKb
zSLW*H^WtWb&i8IBvYMDZ)>}Rpyt%sTY>Mzm3E$h{&w#w+8h8r+87l+0B-9<zVG)|}
zFR<`J)hR4{xYm4UcQKoUe#BSjU3Xe-c*Dtc^$X;zzbEIbJ|M?HsT4Uo8t3fp^Q^R6
zy#J}vW3q@_FeqGn2aLqd*#Kbd@1B2(ejmUp(9wg)8&4Pb_)wSA8U>|D9dk7n0|VkV
z)ODDc;&fO}lya|;&9J;iQ!<v1wlrkfL$wkvqpS;{O+8IbGkRYV4%u-1WrO7Gfc&6`
z{=If53_83X5#CR$){QHd<G=Z6!sQu*s`CJi{#Ip*`O2-OeNDyj)kqxsI4Z0I*N+f(
zIy1#Kp`5vL6x1hlo<icX=S-v@^Fq65ymJ1=mB_)G@bvJ0E1hB(j&=WgJOAHJnE&g4
z2%UlkP{Aq4p3?yWVHc1DiU|(-88SsJ$`n!-l^4ff66o2ugPN%CF0L%OrD;UvdxgEe
z@ZpCzTT9ws;<|a=in#nI;La}Erp-y;-RpOx_VP|jl?j3`6)P99GQR7ru`l2>2}&EQ
zsR=fjuDg58%CM!VVE>ET)Se6PN^0G`kGi3+QXl8Ot*B^B(!w)9LeOukSCZo+s|_i~
zpu6`4QRG?ACt)FAO2>gEX|V$W&N57YnBGKPjGb@r%Fh_Rz@|vKCPAXj$$pzAC#nq7
zZh3*IReNpE+mCPGezVpu)y;b_%IV1e2ooI-aNRUD6oJ0eVBKxwv_sC58N#SPT;|s(
zP892tHwtB90~HlDj3=7~>YrknHC-u=Q*F;3T{`Tp8#o}W4(8?VeedqPP}jj&*_xCz
zxy!2P?SXqF1gSrbNHTd(oAaUD)~_xDt@?iOj)Eoy+6G~?Ode7<v=zGy%Y(F>eHe-W
z6Y%pQB{&_IdLQX)^jXqbZt3H`FU)<(?V}yR!S6dNYRO*7jwecL%J0g)C*Fe1`nLFu
ztHNIH2?HJl2NMi)`+1V$Mo?E?V=K5ZKgV@C^Lg2T$o;s{oe$S=2fzd}rPwwrC%@bv
z`WxE$OeuxnpBj)e@`LbT>Xc*ciHOT#7RrIUJDnjq_kY%^ori0`P-H{f5$TVRFr!o#
z(P9_0C55dk6UUQuRO?Y7uTm0x<$3WnPMwwcl3MfKwcVjgfW8_PJ{(GZ>=B+bcv;@&
zeEY3PMAaaCius(Ck9~qC@)=@uiPJFes?v{FnD?5iZ$q0gzmcRTI8V7MHgpP-AqgaH
zwy~Vp1jLOGO_VtDYPsM>Sddr`8`#%p%PSiU61^G^5FPNmIqI-E%d)(7!^_tVq9rRd
zKN{o9W1#Lji^L1igGt020$qV0^%_YV-w2C^dew$b#2!fFqX0KNHmxMJ=ti8Ad2Bx!
zUteito0o85dIM-zSxWmDvkP+H4yf}y>_R+#{1}B~zJmi1{|$l8-(5ON<;BvMt4x4l
zBPgkwkY1Ed6GrTeHm8Ni+G6lU^1j5W$;ltyPt)b`H$t6*noKwL6uk?uvaVo+9IF+)
zc$Vt6IkR+O6k^3gLwV5S+X8*{s);>vV=1$a9w%N_b86U{t0^U1pTZ3>-vij?Gcw{r
z@6oQHJRtH>mUxXCZ5mWp=6r1RD|Y{0^sc~uyU3MOdE@6Tgjp(3b<9Z<OC>yQR(QS0
zaKcylRi<Hs$m;IB0N0b4G1}KiD+`$S`1OQc^5gM&=pNhZGHC+;@Atmwv5im;?wt?W
z^y*#r$CrOSCCHg@c>ajLB$aU|lrXM(6VoElB<r#%m<yOdb^u7jS+k`C9^}wn$tyym
z0Y&FMwkbq1nuoT;7fv`iGarw>0&<j`nokRO8t9N&+mmB-r>C37hz5aqlmE7Z|M5Vp
zrK5~Ca7Cvpeu1UI!}RN6OF$ooq+hdMN{th&;BN}Z(w84E>8`Q8D4SktmB4n6C>;5z
zO2JIHQ2wc6>6D<PB0pl%bWCdbXKl&z6&t|i*&PvT;X(>X(Uu~(Ssq*xKf6Wq(*`vc
zGI*rq2Bc5CNgzJIRT0ojC8&$Ub3*Ma?~}$i@Ky-JWTb_xaOf4(P?VbkX%7c5ChZx&
z%QkY^>yN{J+&|lEwieV!N^7;4<<H7%zv;CmjywhiMKI}&g<|a&G0HWZ-!U@+{&gR8
z=v`*eIOIzRV&**TOFB$zc<^t@eM+TaecLtMB));Ji<8(t$y2UMrga8R4|$75Xxr@F
zocVVH?6NP0Ut(B#2%Cb|^{u>YFurcdiElerX-fX#cM~VQaNSMnn=mlsrlb=mfzUk+
zMy&A^Lnm*^AX5rL+m@6@fp!3SN2iT75zC;;$<K@SfOdFeZ*^L{1e%yc;^?;d-@1^B
z`&E@ejuF2VT3KcPsyVNc1E$y$U#gay)pNF>hKYzTr9ao1&?K_NW1h51+oFLS#a>@5
z^n0|k-JP5y<7xXlP!q~^53U$uq!!*EyX263r@_^>;*TR6fL&|_2aI^)xN<A|j2hms
zKawIg1WedBScUv6PJ4P<gS&H(EdJUIH^IQc75EMDByE+i-@_4@MW3t8mrj~aMIuer
zwL=dJM(580U2I87$qRmJ3$>yuL34huIu9Oa2K}iySK!A?=B(}&_!jp!HwcelL9)?<
z*-~rRlqe;!eEgNQYjscgD|blIVrD)o!kRwJ8@ptemfBZ+0vPr+rl)V9Zri?zLb!$h
zMqrXgAw^m|jyKRts;<NNPbw2MagFdl1dH$u?7i6Y$6&2VN>S0}7Sfhj@`fN<ZnhM3
zGxYc*{}Pcm*5=+z-_vygSdk_xUs{^)wW9@{b_sdxc40nN{jO1BLIOcV<zl><MpCWJ
zQ>0;cq}KiM5+uqg620G7$N6mY$2W$PAx&5tv9GrXLYPZ~=Xr*Eefo){kS76sG-6^!
zgkv)4c*LtO{j!X!%I#Axh14w=1GgtCX5Kfkn<Duauhc#%4C(ijxZbGol2fGT6XoE1
zw+&1DeE8@&c>tQP>CndNikbQ8<nqFhqm^aa3<e`_q}S6xM7|ruTxVxsC;6>2irog$
zU_D+>DanHqQ<6$q%dusV6oJ?dkS2|<=dDz2?5WX$FcD|E5d9!z9DE5{0={s@eQd0}
zQl(mNXSC6DQ)d`S2TMD04eEfTBPHeC2Cbf@apEJTRnK=4Kc4+}s;H^Hg|CBLZaYQ7
zqiZ`Y1^G%J19dXx{Ai7{WYC~>SErwxS}$I}8fdJttNi*?P*@T6qDf>>B181X`Yfv>
zCh5?juh1Sy+?XB_fBw@>N-7V74zI!t8r~+SIdx#%cn&2=TN(xt8L7n&a~?iLHpGHF
zu<$&LTlW+H?vtX-$Nqd`jB7`3H)Gn?c~>EO=LJgD_tB%1hKCIvFWRy|?a89!OFNXB
zEQ-*Fgk~kdes2}O!Pj(z3W%e05pN-X?RYg$afy3wG4E`c3DXPhQIr+XjU!mEKmnER
z6X^NzQ<`U$r{OoP+oO=Jbo58_2`%Lp{vb98U`%R!jWKFbPg)*I1TNsU42hs6nJ7(3
z7c38@uf_D;u;<EeuuCudLqWUD*rUDTmky2v*4e;ZIbt9Rt_@o~nRI$=<?jzhnSn44
z3!tD><c&Qb&0ZNER3{<l_LZy6sAZiKW;_Lg9Y>rlK>|vn<@EL8hR^x6cfN?Ty)~tH
zFPoCqr@y~^KKzmfz8{g4iJuxyMCKs%XW`}l;<E^Ct3xzd7IoqZ>l7zjDKEuG8#RTh
zZi(wPRnWr`WTg{HnsJ=D96JTl3cIVpdBP%j`?1<~OPhg0+Uhuuy<SQGN`*^5%T`|%
zoblgqeGRZN01~m&RVQH88G#>i?Z{XAx;JQU%+d>37pq}-$<McSWn(%7P8cC$4ql)^
zW~{VB>i5(TbJ+yU4~!}tNR4g%F?Brs8ZW6}(df_q<TcOag>8++N%)fLo|(4gCzpgW
zG`umS4qq2H*0Q_wY1jLj3f_^3qex`L#cv58{dST{=;+S2tMsK1qo%PhKTJGFi--N9
zXNnW(%crNvTUb0`=hob!-VdDT38CwNJITdyM?Fj3e3OoLF>2hUgPZ^QxUW_}pt`_d
z8bV9e2}AvXmtb5kM(dHMZJ@<I!Gr2)6os&IcbNvh8wYq@JpfpJGm0?>%5ZUAL|fF*
zl3L7MLb+x@CplT8>57-`#qsG#W1*LHx`7DZNkr+^hYW+c?_wHF?fYiENQ9yOHmT#*
z_vI<#z3$!)FNZXU<7N07YsFfi4}GP+4Lv3kG7(6G>vxjgWkV~e0@FqF6zAcj%>j!Z
zE&dX0e^(t(2gZtRT7l%XXdLfi#KqhZ%VFdizCf;c?)y;9e?J!Cu>~Y1jB2WV?yeL6
z(7A16WoP*tM)|m-7fXX;@kn#N93IFa$~ghFim$65Q~cXjurFcm5<yZpX(?Y13ptFM
zrpXC=%H^JMHp%YIreAcI>xLZ3Xh{DfoU^W{_|MMucB%HDk#=RCp6T42&M4x&K17^S
z9)r)x=G2Q`-+eSPA3p)yc(*f8-VBabb<~3~_|}pvclYtjmcd7i2T0mpKK(D-Uyhsf
zWHuU}nA%<WanCnqj|iWPID;e|wlPXoh}0!y9hF1Z`3^pbZKeh^pg$y+i#lLxt)@j<
z)bkf&6|(7Nn6F31u^ua{S?B#hCi-qAz)kE9o+_R;-TeH;vvk?1jo%Yf{~s)S@8|kZ
zSqGmp5~=To0XlR`+7zJ}LAg`4T>Ze3ya86Ihr~L%RLtJc&RNH5s~<8$=RiqjWM~=M
zcHK-Mk8dKz&%e$r2udd>Gs27f84tWqjfyf(YwP+bdQaYZt2xZYEaz0~b||+a&~iSz
z=JRtFN)4MQO%Z+Q!3#Ot<i$z+?EzU!&>WfpPm=Mh!o#Rl=->&Gta9C&T@gj}RvX%l
z`Al)Vw4-3+=Yf_2k4L<TcH*B#|E-7qAzc5bO#grX(wzTXk!rz0{hkb*qb>Z6st6z+
z^rLMpApPJA%~j#h!kA;d9N5BV=-7t_nBp~jVlyEvehQh!yg0VpGJIcOJlEFU`&^!U
z@6F2(ZL@e0XVb5%b6*}Jjtc3paOwb$X(uwM0PC8og37(cGWSUH!x`Xn1+)4XA5uq!
z$4?eJKpv|i@=EJ4H(@%|;~RyVF<CqtK_v!NIWP)Jhju*(yw#9;Gz!T=n#2kA6a)S?
zK&|IT<kmm%VS8Zl!}J9EE6#<DX_rLD+is}b9%Ctyc0*$)rK#_=*M^x_#L4#EzvVAG
zWomPN>rT_l|C^@0F<0q<9PB3bT||;4F8PC0S~W>Rkzr0@h@{OJDt*o}d3=4QV;#ON
zrqO|(5*9JNBCt1Wb7xJ!aB=)C)|J0CzU$64Q0NDwWv#F3EeNh^GfgIE?R~Uh7Hn>*
z`0`)XDX<QyZv={1HBaCtz6#<h=lUA0Q^YzoXVA-G#H4DHkhl2rS!04FN(ZS8xS8D1
z2cyWs8!dg0_1Z*kKb*=i{LaYvPNrJfI463QSz87=C=wpJw+-8&uQ;Z@hMb|siA%x8
z35^);%`Q@z_VU-8$EuE_A$w6`l1=d{R(K0cD*@<3c2E9E+)UTwki176Uf(WYwH@g=
z(%E2n{^guUX^Fr-weOp^v@Zz0pXZD4;{F9Q2|9q<z~fA5g}2cc!&f=!bWVO>ybCDE
zMJjqb-<0Jd<g7(sr3ms^X@`2ZJw%a4K>{tctjM@fo7#0@=JL#>Rnxt0tLgW>dNbGs
z=1xi?O=F9u5)dlUP)m37N{Z{~u%#|yOXVLW@snmja(#(wgS7_R;CU_PA%&!4=xa1Q
zA(R@+*Y8m20~ZL?ovUPNQMMT-N4+~{yu2oZ_T1i`)#uTjC9^O&G2ipxtOmxzwYiYg
zEW!VPw$Wj3zqzaWUx**+n!q^plr54lPfS(?$;3BA^k}Cq(`|V%2B*rMDMAN&v?^S_
zWW3K|aOeTccE_w^?LteV0cw@fhSpdO(e`{4vLO`uM)T(EuRgDA!5IkPLo0ZY8`W8h
z9taVAo=d6ew;f~?aA@(o!PfPatr`An`gX(6MmedOq%~fhn{1IMvfS9i{`#R$-R;O*
z{vTMn@9GHB7L}n3u3dpr@MZ44N*ipuA`BeBU4-Cly<WbQZ#AB^0c$agRqZGqH{H7L
zTxX$^<wGpIp1(!j%QKBNNY9T9kr@~3xgr-M!WC=EE&M}2Mn2ZypqM*OTma8HVvyw}
ztRg#LhDx6iz720r*CzS-n^NXtHc3v3D{s?t{?()4<cJaeSpGujkX80zfPPojRpIO+
z6m5F<?tYW=>oi{*Zg3Ro6<1|AhienjaD3T|VPZeOOF{+Nf}y1tqNMnX^&cAbHJx<Y
z@sRbRacBcpOc72`2Kh?G%UIlIBe10LHxTH~6i+C{m|Jjhn0vC<A*Dz1wM#&?@YldE
z{{!a!Pq3mKhI9mW4|<5GgVft1jA<=SCuaw0_gt=7mn1FL2mj#8o6?~CHBO#+m|wFC
z75=!9yr#0pue38PnYo8SHqQ6fKGtL7WqF1@ur{oA{X=(5gHmpdB>{pv<8O`K5enc|
z2>no(zcucE8AZt=_P5~LVhJ-2?n)DjKy1-(7`Qn6t@Kz*Ik?7R)`cwn23m7kKBlba
zXmymgMOS;q)*Q_(Dh|2FLK=N6(ygzOji2?+SY-O{?mR)&3%VH~Y91svO~J?-E=7P-
zWc$;LDBRe5ohI5QiTZt}O=aWO^6pbR0ku{JaXMZpeehli3H0>Jq!%R*v3~jXMvhZV
zgYOZ%kFl`N^ZBdXOshOa(ASX{wF-Vr%D7e$ZU5`b9}<0+tkQfp|BtZ7s4>0-(j2WE
zY!h^33IGg&G9d!QA^J6Ez!<m-vu_mnCGc0$FyGU1P(olXcF7O;anx{Vojm+HTmRv!
z`+@1q1nb~GdnEF;{F2(P!a_sWnwUekrl}fuEE`S;!d1LZ!O@oQ=@XKo#1+t1UN5{a
z7R1;v*8vCCI+jg(geB}09;gCPce(Wq+_E<`b8XRnTlLUgY3&cQ-=FY`u)BGuTNCZV
zm%vxmdW-47C#}VH$de?7lX~a_S@CtY`7kr_Hk*zD&~o_zptnuGh-swpVr$k*YUx5F
z_&#i4xi1_=M@DloM`};#U^rE-+anuli^v=FZ_}xqtGq`lBb5VHsa2^HBwhr1u!v;3
zjw#CU#xi8qi^hjcP)>&2ScoiBt(C<0gpC6>zk<bW<QRixR^d-A)GkJGu&tRvhLo{?
z_(=L|%WZDCh2vwDJ4qjk|9ylIKI2Rlg+VB|g+TWFhOStNol$P)bdU&q3LQZ7iu~aL
z$dq{!MIv<Fo6_wQRXc{638q`HTUN6PHNJ9^bapDfU{nOCA4}s2yB~uLJRKqd(W)2;
zwlW8o2blFmKL=?NN-1^nu~M7urM@HZ<HhjGR~ILdw*$oA!>^ID#)cBl*Ml3xv2C+i
z#e3wLy?MDj0^1FXeH27{JBJ&0fiS1l`xdtnFYoU@9=d(}<Av;!7aEhW!yw3`p+sP2
zTH=k!Lgf6kh$zXMT$Sa7k)-bQ_^$%ROG2sf<n1Ug5v;vhj7B(Sw>~rh+6gxq6WLW<
zUe)C_R=sTW%ELPal^2IZK~+m18Jjq1LVSn90=)=xF`@D@-srPkeG7rSGzM80s&<jJ
zBsl5WCqs!1{382n1uDyXEX@`m&L(}&-kyh9w1`){mm8E6j&lr3JEv|ROWRe}S^n5+
z>VD+@DgX80u59<8NC6N9K>MLA^NIBl66!K<_9;lsj)TI|X_4h^mUuUYNSU!@YjA3m
ztv4OqYpo5~I?5W=+M>Yf?FV!!kB;%zbXp(Tx=6p?tf6mZ6vq%!p^G41N?!!ZHxAs1
z{0I1J-cr7~KUp6Li(k0O!##WX-?&J*y5sY6Nji$krz|f3CajeqrU59%F|j{T^&+Fu
z-gLdkce1%dslVG8`-k?_c1KaJI9bECi9+g~irBVNC3me#NBuMuF>Jd(8p6tRL&edc
zY#1YieVJ2wbv9pD+ozlVEh_{hT_c=#zlHf|6;5iOw$-+Y8~d=YEBDUi1`QRU+@hbu
z2foZ-!x;duwn|?)oHy|iHoK8u4CVW_L=yUJCW(1tyFX{0+`N%%C<cp4!{jjH@-YW`
zOhub<0N(_CcMscff3!Efu(I|^plAH)?y20a3A`m>k%ZK407o7H>Y4g){W{BkuV{;=
zR0d}hdgS%D=8uZ}u9CIKjTmu{H`P#)b9rNPbdwpc%p)&*CthjgKDhW`bUS_L&9|+&
zCu<5nt8|KCn{R~=jIwRj`4q_mN{RJk2uhU{Co{-KoW>#0tV%5RFqQ>p-^U`F1uKjD
zn$ih3*sej3M{&b$C*S+5y|0HNO+vj5+!+y#A>Pf#Cu<G%z6(v-NgVl!ggH**OLIDQ
zcd3lkl^Zf2xY%3--HS~&7hfJ*yK;w@A};pfZuXOX9lKxO`#O2))}5r^C@MoDzU;V!
zf_>>a$$g*#15*iQHAay3T_rDPc}c|A3TrNj4sgEdo3Np*27`q@ka1j|c5m#;`{eAw
zw}CjNJ9L0yaj>uA+3ka!6GiX3bzl9d=)FfuIksS47otL`y1X30%v&b=Q1HE$o5xgG
zo3i|*uyvBQIeAD64W>kGUe8g0`02{%@uGK%xVhrh$;}nOO5gIl*QSt+zi)0m!Y_%T
zf>jA-<)Z-4X(GM>8oSZ3k2*}%pr?TLfA+Q>xqgrM!LN>j`dG(jL8cxpW4pr7%s`;p
zpRup!CURDDC9`u^C&Cye{7wD>-HDp7B?w^@x2>qm8l&ipnc67rqsj+=nyc@`qTBY|
z@={K&B(B+A;x+!u0<}KUNdFA9nKu(xig9B~G)b*@Y=H`p8TGD6(3`(CnA8Ek;ps^~
zhNK0HJR^^2thRiAQ}U@|SHa-Oyx}#Ku~eWjqWx&hjTxldTp0O)b)w}+PgA+J-{QQ>
z;mq@$BB4&v0{JEl&KO*hK#}D00EcmhN5Z$l(AZvBY>bUd(}01bAnWxp`NqhZA(ps7
z6dyOMT^qiuwiC>Ay?uoaq=ap=j-#*B@^^*Fl9w|aMCW=K8@o4_F}|G8oX-V8;%U$!
zS2>)2V3&-#E84nk6AFUgb(X7L>kzH-OtSJw%Fy1DGC>amcN#Y|I+yvX{kn1Cce-ZB
z(q9rH{#8ESm&|wwEedj*$aUCqZgQ=1H#<U|ZR@<eOK6nVf+Ukx@xK`}HF{c;ai|2H
zorCzdZk%ubqJ5%xYJJr+etD-~-^Qm^HCaPTi_TQJ<;0m^+M^-A@?Qwb-+liKBEfR_
zXHr>Sogh{Kwu^6mg4%sqjp4n#6v25SOi$Q;KUP~-W<O><kO5#L&UCfBh0FFX8WWWU
z8s$EGJkHtB8~i7C(({&=zvuvs9v8aBrcGxgee=z{D9%}=zK5<!UOq-b4<zDSPJ>SE
z74~k7E>Dtn`z(-WW+nRNvEqexS>N^yx2w+Nz8Sm1K9NSuVWl0ceCqADw>l{K%lVJ{
z+ADTUh>y0HN3?1X-@x)F)ls7bx)5yo2}0Awn74#W^k*s^!F+X_;sl@c^k0Ll_-4+s
z4)6@D4W6G;482z<kAVznMWH9H$GX_c?|C&}kacRK<1bqXA3s63VXIbQkO30`QnD6!
zs#&YM$Xoo83comfZ2;f4b0&kaoyM*6`3Bn~&u=1cK+8X#+*Ix<@}5p$Ye~InTZ*OC
zkq*-ycV?bnNITZkIisnX@z)Fy8l(cLhV6XjGAT14qA0*F?NDmyN5&L$Qkvx~FWr|h
ze960`+Tp{OFYAopEeEwNP%Xi%QQ>D}+As+)`4*v7(QM*95a>tq;zQeXMh^qhWO<_B
z>bSdk14}J8-R&LfUDA>FEIlYAp6J}&b=qxX$^z9sq<)yR7&l<Kc&X!HJ$u%H-?O-p
zxK0GFjp5*3l|A}&G#okx;;R(tu|Up>uCUOu6*M2+g&&)<%p<g)GdyN426oXZx<q>z
zi!?}$6&jI{el40u2{C*Ne288`ZJ18D0@H8s(;+EJ)tNO*hY=ldMFW^gH~3hBG^+`r
z@ruc~$b%7DnO=DlxqRj)#?%+Tx;TD1(u{?{SM?pYj)UgofTM@wL6i^;9x>Yf+X^mR
zsIkbV_4l6=HU3NkrRVxQSFMVQa=o0db}id@s4;P!|D$YwO-uw~<{{^IUYTDa0@9+`
z=BjIOO5mE^z<`{tA2N}9HY3^|5BBocf^7gsftmf8>>*a`&V;6%@ry+nl49*qT1E0;
z#^}(-PMd^K?n+u<^@S?CvMA)77`@6e#IFe;k(KUv@VCZaOK~Jq14-wpOkheUb*<-N
zTYD2j(EPe|LKL@Yy8i*xicM_^seGdfhNFj^)R=r!MrkH34#ce@H*BSp&I}%<wb$rM
zvkNngx~NsXVM$)o`hh<~F6iA?0jlMn^8RU3<Np#!x{+wXGXB>PjyzP<aJhS3H8Djj
zB~H}J2>^6^<m7fi6vvYa5)>qTT$@GmkYAu3gX|{IA?voZ&6IWDgrxN8I#kse<~UB*
z3wTOnard^*G61HrMIc>>TC10Gpf}hM0zvvuJryvxKxr1zrCUg8{DfEv-e<n}vIuFd
zzNGK!1@;alWz^KX8()frg<i|piJgfUChD`?-THFT;H00r0@A;H^?-HTyTb-!FplVI
zf7fGe<FVM%e*Z81j|d8vM=*$C=AWbo(29lAivq9s<OPJ}jnRU$r5=kF!b4AMV<(HZ
zF$<<bM=hr&ttS7xrJWJbA<bHAy7lnQet5y-kg-Kj&VuN{UU=0x@I(UMmt!u{wF8P%
z>if3S*GOfuvEC|&8Tv9l3I5oa5<t=o6j5R&eO47q*4I`8qmQ`+3uUE_SqN5njo4ku
zO%5s$0+qSRpt_x)(3MfHk(Sn+kxqs;z~tf#s%+#N$PXqzVTCvH*Y(vHO9#DN`et;4
zUq;%W?6A$WQXWWeJ<?g>?eJdKa`<UYT##3*+xx0#*H4}c{hla~Rp&Wvl1^)IIuURr
zaWc!Z;z~iu;v!Ziwblu+2)WFvrpMRV4-X=)9ii`DbX!>!Po=hclvP$5+V^?d-%h9*
z$VklfyIJSt@ZZ)MrE?C~^~Lnip#AU!d{~GqHcx21n3NzeAb-g|kR~%v4xX_vac$&(
z$*niF=wWY{s40hgDwY&Y_3c5MQ_}SOudFUeowv%koF6n_TX=&eNSIYl?$exc$F;XY
zq}0Lg!j7&}SFM+~G!!oyFO*pKx5)q&vS{%4?EW`npq9&pmOSSRIX$|@TdJlXxZVN)
zVsA6gF4-yC>!~ea$p+(|X!CP}2hzfDuTBsX;v$lM!BslJ1|UK96CdT89$1ic3CKjo
zG?I+L@Wr~x-pDdHyO8yQ2Aw`$BA|ZR&LNNKfqH{~RDv=FH2Bqq2fG+XeFrMsy)xbu
z^d0H34H`g+2VgnG;##V8ayr0>6;FUt9hbG7-$!2S4~>ee65TVQjuy^G8#rH=%LVbF
zODfa`c!RN5zE^X*%B9GE?#s<~bLr>vBYnel6n!gq*O`E7wU-1^ltr+zwg}DwcSBqC
z6?!7=k!ml-A#cJy9`#<>Fn&xP&UJD_!WNgvl940)xH09C9;<ETuPpXQyJy6M7;&df
zGVx$a*S^m3apOZo9&D!f#r;YN4*<xLn}EZ{HwTJ!*z3(3iP7Zs*w->{Y?gI-=l7kn
z(}XeH8o<>;Y2I}s;i1mh8+{HSw%KMle&s}dcHmy6OU<vNv_C{4L0P7#;^9M$$lu{*
z#j3OT1QqPr=(8N50cQzzN>aFtVuZIM3vmmq`fU58HB;p-H<a;&#AVoUOV+mD3g?54
zldgw*Y{e^sJo_Arg8z&;(A6v4*&*qg(KU1HoPb6<A{pmJla>G)Rgzxq*|e0r4%=^?
zfavmfu$Bw!@UKcc3T-AMgd%1Ne=v{L;$Fson$mm9rdV$vz`-%F+PnSP)9M!;<&5w4
zk;OTqRR;G+mAt2hb(CnH4&?`GzkB_VCM3CBUF@emiMi0k$Jwq;IM2@CTr4YII-2#R
z+^#S@BwVX!Qt`MLOQZEv4Ei3feg3SbJIs6UUy88+zbx19i60Pr`6tW-jcZYCQfHCv
zM#al(EFP*(w1ZU-vYfrGOLZ}4^vBUFohoN}S_3_qYzg8()*HK;3XHM<L_uAE(LKvN
z4i5drFr9jdj+6zA76m<i1V*~NC6x2xD4r&N4a-n!*ucBSS%mrt1@S}1T~IJlKt@q3
zv(e#F+8K>w_J;Gnc#0}Zp7{LH6=>8eC>%3Nsg>#eFsAhC3$t|f?6zhWMNw{&FeeKM
zuffAm(l^1CXY2+?XJ>ucFJgU=QhGVvJa2b1C}+Hy8-++$ch?+eLh>+7P3gCdH209N
zq~?!29lPjl7kl~fc=7$(1o`r6*jJK<&rv~h5`Y*)VVf4)3syiBrwIWB3hPQs6JG<1
zQ65$;N0DSF>&KtO{rnARO9I)96>*@q+<T{2tIqVf#{qNtB5&7qkIqJ)GTWy4IobH(
z1wEcZ1j(+62^B%o>h8F2Lq&Oc1<H^A=g2KM<TX%lkX7Qc=<5wFs}4VDSr_=|`s$sB
zh{K-vvct-a_$%^8*p~l-F1ydtKF%_h=26tMg&OBTXtch;(S6>rp1BkjV|dIo$6;Wk
zns=kd4kQ$QT3n8WNLqD6_SKevqmd7oMQ?9%xKwfmdF(Y9g`B7Se;>bh=Ts)nC|&AV
zFTlQBgT%s1nv3$q9xKTzXRKs++*-R|*TNm3A&j7Ax<1>sh*j;eVKB|TYnBn=fu_dW
z)o#8M;A>D-*z}0SJAQq-vHJb<{J@>0R{+BKH*gK1(NTYH12K-YLT~}(;|a}t2h={E
z?IlBE=?f=qN%6Ge1RHGD73DmXiC68Ba`gh!Ei3vm&ILUg;}}1$X+PVI|Ivqz%%|k%
z(cZcQJQ+JQsDWf}&O-&#tg75GBfBzmx~`hf&4)=-deQC2n7eRpJ~%H|Jn(x^WZoE9
z@?NN{s<f{xb7zDHgse)Pv-`_Ur=uo#td2Asu8dGQfq#+pK%SxlqoU)x<AoF=)Ze}I
zazA0)LRRq5`*{VC2y$=qHBP=#fsX&rK7nbTqRh7rClYf{zHtqCG&Dp%m@4ynk)ITI
z>x9N9yZ@au9e%j(7uZ(x7WIv$tgYz<H$H1sEp`W*%OcMvzK-1RMuo|Sfg`=Mq-8Ag
zItbdc0QqLW6}S9k8Cq+0NFJVOeWtwBo%OD|r^w3c+Fu1$QKSk4J<g00XyNN2!rBWM
zYHP^IRQg4yMo6V|%`mVuGHSbbau=C9OpT}Os@#U@TCCd#YD=Sg6)nf0qm($~y!}|&
zv&!d55ndIAzhyPQ9}^uS%9Woflih&#d<4Lwi0@z@xZtnJ-*%CWS!6J)rS;(7U}Z8&
zqF=|h=?b2~_&lkFm}sieQC#6Zjs@qP>r}0m0<I?2;E<D@!PArF?V^Y8Ce@&W=m90b
z8eoh%%9z+jWRfCF4w4qf6xFz)m15~!3fXkLWF++xt?F9Mar4GD0(Ow$yHD^muJ=7?
zv)RiS;d@`iK8$d0H906V&cD3##ytYS^y;-a3)rhrKw{)89G(M}y-jmuPM}9#4ee@G
z_@gH2BpIX};~R;F4P{tN6UVHFd9S)VEYjyM#~@w1rPIOZytnV_45cq0bvt)&B>iB<
z*#&>~eTH;W*!tjMw9;>w(x^TvjgR>gi${+(Aq21&u4+D!?hK0CB*GZ^8&D~qmWr=;
z3XgQAHp_<h%MGuwJ-`UA`Rb#JsTd^0Ai3~#KyeWkB)pRP^MbiHu#%7v>*0lbE&>m>
z)$_D#R^Q(P>j2cgU7JX&em96c7k*hrN+7KwuVHz%kR9bGiXR287@~{E(&3#|)b3TB
zva&jR{bhe)X!17}CdLQ5LY0SzzguIDBuQGs4uRxX{t7G)V3yMj(0bQnFHr7enY*CK
zjcuV3-j1i+XQ=B&eKv5LM9#JEu3aj$OOp{X*O{#qy5xz|H21Iv0clAq2m8I+Gzim#
ziCs#HN)J1(Bys-0wXg_C$@zw8?rrp_^xa_U%`?)$9m9tB7wBMo!mRq>*!!uW_j8AO
zfbg<nOjJ}`6ex;)1uD_wz%YCKXz;Yy`|aud3sf?sUQAhlFF(m?;+3_uc-sRCr@S~R
z-F$M7wC!4@sY9pDo0-hBK<VQ)Ajzg*_0^a^GI5-!OmDtxomitK&Ghv!sx6#sz8c1S
z48l>=+!h&S<>n^~@QBa_Bb23~-rE~_t2t}2a9V|-$W9<9)Tdh&pFNkg;BszYmRZ*Y
z=H!9i()y4k&nmL~Z&ZF1Iz`M0xBaB`xnc?=Em0W&p%!+bU)_)n<}0D-VlMU7i(#Ci
z&5GEMRwgrY!A+puMj2_bx6?)$R<gm^((zzLRe5ECe(9RSKmF*Tfq-%X%4(@cV#x&T
zs&bj?7|M)d+e?`w)j`;HlX_Al!E|GLC^qwgXD}kr2_`Q-jje>#y6yL_siK;1#VgpS
zv~nLY7U$c>Jy@I(5fPR*YGhlPzCcB5C%lDgAK=ED5-<UD-E`GSWJA>fbSQI}6puTq
zbMTcczh=`_J)Ng)czP`4s66iO;)f5$er(!ieKAiwQ06t{wbsBfBRq9!jEfl%*q{DE
zAv!H!=$ugCi&3@#>bmZ$UBtN1li6`=e%^R^&&rdFQoijtZkDWZY|pZL8d@5N5eYp+
z?Kf8V$<0+J+DZ*Jr59g@5f7o}&C}88_DyX`S<BM)?Lm2s)CBT!Xj^CCO?~WB(%;f8
zNuDXYVW7SwOl|bOV}@uT8u18_)mopb?3w*7Y$tJ|4PRls@NbRwG$}=8ZiC>vC~Y6_
z5r-Xzs{rI|W3MuaQQELJ!fw|gFT;{hj#6<=UKPVAKM5RT8Rf<h3A-r&(0Ia>B0yi2
z?YVDq9$Bd(qj}eDbK;sEi7Q$68$LGjH<b0*4u<%2+kQcuXn`AQBLBW$DBKTjMv)RG
zZYyoLm?LqxFUD9>9Chxqq2dY}r+r8t4Qo!+?YlNZNp|QHa$|<fUSKhP()<{!1l!-7
zsKazUEPvm}3qGwv+~P&Kd~a+}UeG)_=@E#k^~bBe@X`8PBip(G!4CQZg({lDd$*JH
zC$tQ;IxuInMPjd7jVM~6ObV~RVh+hsI^~ASuyBO0gZ8}WXN9}e%Eb-zc$_TX=3sF5
zy&L2Hs3G}FIk^hS8!@8M{K=&9>ZCoWBIDu6C8J9j{tG^R{l8K8V7O}SAnGRtYBO`d
zS~gWHA?gJ2R+hIJu${1rxh&zyPD%GH!@6!hi~ER`aU31`*Ietx#k@Rl%}UD|yHeU;
zuT%Z-HTOZrCqEB!k9``H5&;wzWyN*HHvmxRbPk3(NCR^rCX~)Kf*usvP|l2-B@y53
zVLtH}<>+et;TG--jpN**rsu(-gY^A1CA~I`z1rTM`}if@1(U%t*n0Yajnw?R{U1;U
z8x9@dE7bSWH4#7Vn{f#dOp|uuuRwv`7BN*V22eCL=7f(KW^W!d<+NUgXsT@6L#LOr
zw7s5}$*Yn>3;o>Wr}?Wp%UdaiqNdFcaso}iDCNryk~Syj1zp1R(GkLLVw48;cm^!C
zRpE+bUC22>)ZZEl@b#FPhn&C-g;ByD0C=<tbcK=U&PX1EJc00vee?`>F&0m+s(t}Y
zhIroTUfTiX$<SnbHxCEl-kzeG??hE`8kC(BUkc_h48v}5zc2i3yFo9_YZ;`<3>&87
z_<&j~3<Q}xhRWm#Mm$x88r&ts+IaZ6@|sM)>X?0TdDcVQt&15J=`huMtgGVgthR;w
z`1rSssb4k!0yM1l3s^G}l&D(u5frJ2{lijX9WMcZKqM*Y`p+sqIXwZlLVUeg4-U(%
zu1c*9StOy6d7RC(PEdMpnn6@GovZRdWZHxKWnRkKz0Qku$tL8X*29tDR>r=kEjpiV
zcl&X`{KM+zIU~kwZuY_hCfSz@rp%rto;${R+uXKh<)YA^?k*eK7YJ|dJ0f^xi|J(y
z@m1BP5V^6!Mg34BpBXakq&Hv07WUO$sfs2fCjUYi@Q_-%o|YHgDR_%rahE%#y9ZXT
zpg+95$3&d*jnnG|s!62&vOrS8H-LAa&nlBF=AvTBbP~QwwFA@3VaeuSGZU@z%(*pt
zWP-$_tn-$vw{QGuMTOZXSwRQ7YKZq-A3$AhYw=>d@O;GYXQEDd?OuSbHjOWIH*z=N
zK5<|5sMK}imB@jXjltPBJ9<|ZrR025daEF3#lA1v2~R+r(XeKZ(uUK{Tf`yzSFcVf
zlyR?;3^_)s?>pE#WH$V&&e=%1v?XbVX%ukf#8b<2<=tjoVHTODLn8U)=IB3ZRI`DX
zr5CPf;IrGH%9B&yWKLSr52@2AfnHv7l~;=y1#JyM<L(iaiMoFnRCTF#cIDPoUjIQ}
zA7;n%wQSsf+s!X<s{ISX$6;j<JPV2xFcilH=MiiRr9pfZ=^t9EzC9z>Wku9MdZ<DQ
zBjcOM&h2Kka)bQgqcWJARyhpamPYy>$!N~n(5bQx%W;ueST1w)Fr@Vquy?;#e)l7B
zgpQl(spBal(Ay83hK=O%w?^Ani1o`T%Fh7M+eTNdg5UK=kqb#Y5pf@Qo9VK3rQCSF
z5dcQ3gr0pQraZDGn!UXc05tL-AIBG!wKW~@<>#wp+;yyUw4Zg!f??*;p3`3QZ7CLW
zsMA{IC0jxK12T-+>G_4Q>M_gOzcq$eEyz?{hW1$LC;k7!*PDk!x&Qy;qzs8sLJ`wq
zsVsBKR<@~>B{7u~S?83BF%72^nHV!7gpfLM(qWXOvP_nt7&9@JQ;zH-BW7_<+1*o2
z_c6=+_v(B<pU>~Qe!uVc>kn7g)n%6Ze%-I<^YwT>mZZw}Qp^~$>8nhxz~%oXc>DP}
zt>uekiT_2=v{@OTgK7%!7l(XsVAVIVW#^MIr`UoVHgx(XSSV)|AKpq2&Eb$H@O=SR
zpKLG2w9&GRw++>-E4*#R+$svCw!2y@c#u`^#7b@+Dl3+%OVZ%zs}6N&xZbadM2)W^
zA3UCQEYHYX)<(`%{O_*Lf0WSg0fB)2!B3&lMXN8A=^`bM<*lwD*Dfiz4aFE?XIVPO
z3D6luZ(76w$(JvV*iIz2QK8IPSCf{3*gTzy4<T@(=KvFH_R<-nRlV+0Ieq4b>A~P&
z(lvp~>UvPeQ#&!|pUuZy7z7$&HZS+<>D)o#@|^cSt~xVZhkzapMtSSvqnN1)e^L8j
z;*D(q`Y-WCzj9yJ_Zg*4JqAognH=0S3$}ncC*4RHV>fm$=!)rrT5-h<Fv39^&e3#T
z%_7+v(Z?#XWGZ4!K!ibx5E*RYy1dS!`5^a7L1zn06D_C&4%o?$7+t9@hd#B0i{c77
zypmLr0LiCngVzT=YV8E;Mh#Yo9rKeEj4=JQ@}7GOThSd3d<`ZBSPjUo`MKtut0C}W
z0Q~)Iy2#~IX`^JdfPPNM)()F#JneIx@Hnczy}&^Uj21eUP+&Re0$SP;xJ;xGYTpwE
z-<!(QBT0kn1|B!3dNzO*209MTKFt^`ZEaz<X81I<4o75lfhT<Y*@C~xtCrWlf{lao
zuTUzO@sh=|ZuF0j&)K4SjL}piD2?9yDs9`d^J?po5!)g*E8BJDR|Xv&n!qRIH0=G+
zc2qCmhmP{x5lxf)oooI)QiC-S09V-AZwfUqb_K^2bFjMNC~xm7-m#5YYshY5;FQC>
zB0_B@9}v^p4f&eA*Pr2C53pW?2*}6q_)&2QyYz6xv+0Dd-u5{)kwNz-8W~Rr8)pi^
zB;mTSfJ+WhUNM(##wfI&!&{}E3UEF%#ze%7NhL9G?Gw`66gwFlExyxSXj?u*NfkF`
zXaUuD#(`xl?rMs-D4=g4ICe2a4bZ~ELPnb9rF+K*E$u3$xJ^;t92vQ3=$lMW<*Dzv
zDewWQ5I1is-2__z+q_X=&k-yhC+`sJ=jPpT4u>vbv~ZkC60TeET~*yOj@ueYs_)?K
z0bxz|MQnXiI(Kl%Jz|K?bc~I>R9inBJ2$>?L8TU4jhA2z^sv={(CkB=h&JB>c$raf
zk3fEP>SzfH>dSNv78hYQ;G2za2sJT*p#LemT6$QB(U~husK~0JHyGLYzGSeaT7|^$
z>(8U^^~T%fG(JdBj!~$mf-8PRrXdGg&v|+(yB^ie9vc<CZx!{W1YP8(*rIi0J6=Oc
zOBqZb!NcGJHYBO63?lV)Qc%MUF`K*4OSZ*P?S0Y!uNK9hjiXgDRqV!cXfZ|kZ#Hxm
zkjUMHn1yfBEu<#k0!33OlaE4|QF_c{g0~bixO-|d%g`&9rVi4#3Nt9XX7r5L4v}?5
ztrtxJNnr}To|NF?9UxxY?K4ES!B@>RHk*~bn3DwY(~?~uf{OwsHf=*}Rn{6s7r%b#
z4LTQ7_qnT2o5UAjI9PS^7Qm8eOQf!!HQpdb-vm&qK|F91tLo9uW}Yjb<way!1FjeT
zXSlIfbMe7d`Z%8ubhIeC_{BIJ@1_I;#u9jageut{yi+!%r^G=18%2ZC$JS98;e(nw
ze1IgtRUFfWn>RE%vfEi-1Czc?T{}bBJi5|D04i(`|CU!`)#ufr<4^Bjd^+~w13ux`
z)%oV!WaV$)=E0{&T>jotZNOZjr=T_{>=b|U4WGgfA-=FXoq~dkz6vk1REC|^Ux2O$
zX4;h#3^ubY#lT}(<4P3}?LK@F<rw`a!d&888J|=>9_7d=E@nLkiGtx^ryc^I_#4>?
z{4OW!!5&f<F#59qIK+44uTzb(A7*#3H&^t70g%-&Gx!ng*U3_Y8Z(3~NOd?hc%a((
zpjOUQ-)0<~^7Y48uZLHxPE2dh^iNBgeIKvFhy`TZ672L@aICL=X^j^!19gWLu9oQZ
z<qxjgd!VeLHeMmeg0CCYZWTwwzWD;vyY*a68o;u-q7mh9VBct`>A?|CP|t<TO`0Yh
zfHQtnl7Wd($`@)|v<wA4y=T9xDsY851-W(c*DH)=R$M#Ut)TY|aS+iOV?<Ew2bxx<
zLqz$EqeJ?NOTf_~viXzgl*HF7PSw~`BXRO@zu>b~WGB3^;+5DF@%5ozW>v3&k5)eD
zLSE3f)t(Jy{<3RBWm%PFO_kc-cb>cQdC7Z1coTtd|C$)b672gY&-}Unuo+icU3bQv
zccrZh8J(WIy%ZTEFLFIFhpR^e8kG}Z9ev6!hwp{KhGN_sobGZSa_)2}=Lw+*$mD#U
z!UdyV!xgo6E&i}vQIGwbQIZ&-<F@UoCujf7Qsk2RxB{so&or2vpaa)I-eZl%bhGA^
z4`h?(rgXvM2co9tLXpw$O+R$+xR7<-a>4k*nf!&)OZz}`GAac@?$?8-s4`u;<QH(!
za%48}=0=K!yr2P`mC<du4YIfzBd1PdCnz@F*oG;7F7|B^{=-->Z=W<B85enE17*!K
zynTtupv>Ni?DS%m=aKcNK|vlxSq=ye9bvfIQMrM~LN<79Y#LuC2BWGa@b3<4n>z{&
z&!iCqT7z94=Ygvp$%Zqj4lT7~GK_Uctb4zKKM`s`xfLR-OGXjhO(*-z?t?Zvx`__c
zI}FmgiXXXY-4`yH5mB5yaU!P)17O0tLrGRwis;^U_mBLed6sp}-P^8II^Xr2*WI}B
za76rh-7|+TomX0WXSa%<Vxv4!kzB-9Xv9$APNfTX4sTCUGtqWe+m)i`oPs<_Ems0O
zhe2waHdXL~hmdWeN%F*f9Wlma8!oWv`T?dxi_|rw!J&2sfB#A6{!4>PLmiZ@TxYaa
z{WCnvcw}c`Aj8KZY;YyG_aHc2+3Afe%TI((Pq~A%>gS<=>!~ZxK0ieNdjK>EG+w&Y
zKlk0Nk9E)KheG%J6=6|(*5+I!P+tVWbAhjiF4tHeJr#-@pI)t!{Onw)J<~LJw6QLk
z3T81zEK5?E<SzV8Trt&mtAS|W-GwruSOG#=x5x+C-pI?7m_48aR5_h7MU27r6X`W8
zp{HHI1ch5eT>h}Mq9OfIb^c~3KlFsjtDlkk@40aw=loshF|squ1aETJ$8}*>uI=gf
ziwkN$9z7ZO;MSRwUfb71t|?}ePt2!VI0a|FK2o?Z*v<0G+O=!`-s$mEX<f>PH<rq~
zw*Rp1bwlX+Nr$2&bH9`=T{EUdU5f{%a7)g4>tE#lUb`mQW;gKAoy98Du7a&giEIrP
z#d$zo-iQII@Tj%qq$%L(9mUsKa@`9gzo_*U(A-@9EXAxp)=H(*0G-vaq)*B|{8Fmf
z5VonGZmS{RDXcN@?hPA1*<fK*+@nNEp?u^+ar}9)__M@aUJ6_ewdD_8ZSerja<wO0
z0W``YG(uE0iKvCHr9L8i_S2a=M6JIFNFH4YlT9FSl?5^ryksunMohh5=2F^yj!&O;
zyF&a~S!R0@XlOq)$u`a@wA^4H=>|#%MFlvk+fm+Q^qE($K-5q%6J!Qvv^|qKJPRTi
z>xsK>GnQ@*b&AHZdZdR(?{;@2L}ZeK>49$6cZX(1o7YGFU0sb{pkHDufmS}H36!CC
zR5dmc18Q@?d^O}JA;O)4UO&KRNo&CA!Yxy_l&wRt#mM#`#H|MY){kDomKb%I7W`_M
ziA}78V?2fg*{7vu5Afw5XAAEdRz4$Ig{S~+NXmKe(tR`pnA(4+6tL&V#T<~*2$D>7
zWgEV4-yt)umarA*(phvN@ELJ%|MEBVz7j0MmX0E=@={WrlSShoLvGCrB^+ly^vUjM
zPEtHX-a@949hF6FD3Asp_$=&R_$)Of@awQ|_+vw&_+%^By)dmkfVPPlA+C+J@LFEl
z02sl(X;TZR6Od}55V>h~;3HwRJ6nc%L?sY{R^ARR(=^ATiZ0fqzKEij)QysNDlb##
zHNZj%r1XKOsc$}B>a6Hv8?i4f-43eAb5)U9K{0LRqpVFmg33N%irh}yu&n9SHo1P(
z0JR0~bLYk`X-@)g-NEiG%Z~V<%gxIHs|ELg1maonH18w=nEeF<_`n00R&H*RL_it9
zO8_m1??A7K%n|SMfiuBs)FlVfI9H<bn{HO2iDauX62=Fjf(fx#;i=c7ao)w$)7+Y$
z>`&qw^%AbpNUP<Yi@z$bdP&jLwvV)WDhFV~e8Ffk1r%ng;kYOxS%D&5ZF9AH4F_YA
zSJ28)0b!eJ^Ei^AzKl!ah@4oA_IU7If^YG;$_c#V{a*(o6LJ<lWouQ}jN_rXqC1Gc
z0PLiXRcK5I(D2@XHvUaqJ--bLq9uXj&Qcq7lL+paLT)0Te&`-!5XG_`AX|z0){+8_
zLL+%MWp1G4Q_~h~F-D{pV3*cUc=Bzvkx_{i!m%HiE)k_sSkWEiC--DWq&n#?Fzwh2
z^<^*rL5#LTuZL6J#b&g1Uwlk|{RXs~#OFNDbt5KssI}@Iud7g9vqQ($Qgra~FEyp8
zX*&TZ>~oTzTA;$TMJ7SIT`}y>+V>ig<Y2NEm_{+sw?ODuV-rAJN{U8n%&s=wUMBka
zLCXpELTYlTKn+TiPyTLI(NfEJ6@Nns^Dqxaqhxv-;95dw*tclPRtl7CyBO1+myQGW
z$z+l(VBpWQh3854Ix)I6<gMuJnw7**{U1l1F%_hE-+K7EkbvDV7T9<7S!)k)uO436
zdVV-|!s3{cY(ptBQC>iCCE)717j{4nk~`31>Qho#FpLrd3X4tyUvtiHB4{RIrTeB`
zkIzqd{ibUsp**)|R+T{yU#-oH8mxYka%E%6N#v3-m}g=oJ0c&0z2*{<_hQeVk(Y9}
zC^q(O{^h>v(X0qKC;F><-hHpIN!9#A*V1<$2ZX9V=^5~3UN?imcUwmV3KT&(U&~eX
z*hRt8*h7$l1rr7AbYpvNNngjL9h^`hvLSJCn+XZJ@2ks6SGyA4$wI}Q>@@oF!=%Kc
zP#Xg(pR6u}U!9$m0F-$dRG^Kw6dc;}Whx_Hp+W{Drq2%!q58}_=rG!{#0G2(Loz$?
z`!OD~<}OFbZzq~zZYm7nz-NSXssT9JA*{)EQ!%Q9)laXh$Fas4F=89PIyhUz-ZZ_M
zbkj;0qcuTo#|VSR*}9!&v#w~dHe%V~|M0F@@Eu|FhDk&4hFtiwVm<XbWW+#c@O5H`
zpzJ{SR0Y8Ym3!G0=^<pR!{%<><<PLehyiQL?z247E>4NraBStXfOf@preX|ADh8;u
zXvC5n@hF*kj4jqLoR0(f#`#jP(+Tbg<AGK&NJ(M9j-m5LJ1|Y73-`rCl4`EAZUu}w
z4flw8tlWGd`?RY`RpuE?Ct&V84b)rd`B$HZ?)^weSZTT`+xIwc)7;6kGxm;sx2TLb
z9~+LsXefHY*2P)nuc=Z(*}cb60xd5`;u7i~P}NGCN@jmd;i}g}+`IP2PdT6NOP*gF
z+ZOeH{8Zrh`k!B%6@cm~oeugKIp|du_3T#F;!?%r-krO9Y-|qco;hUt+waP6yLPMW
z1*1j<Kw|}|D1d7sz|yc3!rvf}tys|(V@URc6U7NQO;R^@n5Ac5=#blh+DZyE8Sn?^
zP;ZdaTQ*(D(iw^M3Ho#$Eo3uBVspZM8k+QqTA#i);cY=IMRZ~T4_891hp$Wp=iS8A
zp%(zSzgdUVd>2+{?F}MXoPe*yh#nAmM#kT|nq0StS&u|pot@6bo5VL4(8`X*Je%c8
z7RrNWi%gm-tIjG>Y2VF?{xbmZ-hXYG#|jndV*;8Q*;Sqjm}>y%GUNoIZ!WI|mb#h*
z6_0+~Iid|#!4;#EZBZLZ8GZ!9*~d9cE3Jt?4#(x3UKpuh4byAr))%gSiU(8%jsmF;
zd895<K`h3S$XT&<z*H>Bmf}brZ3Y3ialVbNyIw-nOvMIr{3!FV@F6j{M|vT_th$=y
z!3io~{M}S)+q7z$_V%{7S^|JM9gCFsP&rc{i0UWGhrL`FTz1*`$HO}pb0f`$iDd<Q
zHbZYsF8}c^;rXssC2AA(CV7{Tss!UWlWGt)V>xd<3Dch7N)s+^fFlmQY#dznLAVVP
z%j$+=tI@s<xrPKMLyNQLQzj?341igS5>*@VMISsucH~{~IT3CggfH}f;1gs!uN)BJ
z&^(79fti!R>XJwO-LGAI<UGqn@qQo>cI#+5VoLMxC+-yIWra7sY`K2!hMoM>PPL|A
zDwU`|HM{0L0Uq_hIS@IMa4n;BIw7tg?{Q?23pj^AiCp!4K-4XGSU!_L{Pkqu%<45-
z#0L8UfB!pfL;`X1$-|qkxZf&8wIOB3$H1z3v#Q?}^Px;+oGrv4XIu}8ftE&LH$yof
zzEoV!3!GzFzl7Y&p%-Yi!y+qpwX#<upjX%igm%3(`KDj{?CuvY7u@-y@%e^*z(jfY
zUpI*c6cmHG;k;G6OQE4F-2w-6EA;zi7llu`lzpUhAHa1aHda6Ju7=Ge@t~i<sYm&p
z4fC*T7!5;-V=@}B+W0)nXsZ<;>vw-2Ciz7oR{uDO5I0qjH^GN60^scN2iX?Fekg@E
z(F`8d0awBJ6ZTigA@_tO52`U8zcQo_cUZQ>sOt<i?70>wa>nu*=YF<Z6Ac7yCcsGe
zGC=8WDp2q)VTMc(CHWJ|<FMC9x~fABL49pY+8l6eX9}8Kb5t2q)UnS(RE{hd1SN7$
zaR@P2L`cwihKN<4oXgZp!v4s7#jCbZRg#_m|C%f<gY7@{5K~8}fdM`MT}!vFu?z-?
zvUm}a*WDGikt@UL6<=oU7?z=h)HJFp1BWD0zMk1AuOsgA7?$~otd6v|l}qhfKh-}A
zF*)y@k)S0140g;yl6gBy8|d;;jZbe(Q8go376a$xzquYDWoe?rhN>A(yX}_NlO4q7
znPi(P&br}WOo9OJr)lBCwXOWn9&&cp-hb5pi%G4;ZUj8~uN@57Fje2dhHaBu!RsGX
z{K?u4eM`6XG3=mjT%qMEc8Db{6?iVUnSR@@RbP?`GX$+DKe6WWsp_uhapk~oJV8HW
z-lRES@wR;CTI0*LM|UK<I4HEXLfD(m0O(zNOJ1`?_7hg?cj$x7wL6U*E|9hc`!=#(
zL)}@`<Rl@{jNjq7?Q7Q;d=WD!toFrBWm4pT?`1oSxg(!6p69>8ycK~B5hz>Put`j^
z^G4t}te!1hJHuKFJxvu_pf*z8qU!tdR-~aSCm2IJxy+a;up~;5VqA`MzzdDYDTmc>
znM{utvj(i%=N}(L)2$Z+pWHj&m8JZT2Y4{g!Moa4`7#|<q+t};TkOzVNQP5vP9haS
zD*5W$NDGB}o3i+)YsGer+0U7mmavWDb=7G%9XlD!=c=X6Ntw-F#_vY%sL1-ipJ^m8
zj0e0GnmSooh)kz#0GkJxM9DCae`>|Fu?|E{i){%t<gBXZg{yfJG;Mt9vVbK)fYq-1
z*!|ZhgC9%=XO`zDWA1_?=@cyNPL9K@rL-A4vZ444Yi2}})DxMZKe@NitKM~cE2O!Y
zZ(VyuFxPtaC_0+#$g7dNyX?hJzSkIAtobQxPt9V<N#tB*`=mb5tvK72k{sH2diRBS
z>TrO^5ECP0Yeo9ouU^W26q#`BiN9mmy>dJ^zmstB+_{Lg_S}M(?)h#TybN}q*{m%4
zf!g+oq7J1Oir61ix_L3_4Z$cw65C7ul<Xp+>jvSu{RGy|ewnVr8x6WTKH+`YHt(y?
z0^wh#Iu+*kJhDD{t;-y>(@l*EX?}(fZ~Z>bR9*$>?AikmDurc6Z3_T+AzKyTdEb|{
zS`<~sj?jzc81EUZT4_a`rX7M1x1Eob6?=FM?|fCu%H;$P#!ejHZ7nELxe}p%*Zj=x
zH>kPiAXexcxT9fURP1mABY18Q_c=vo3U0vqkFp~mILA<SSlrR9T8J;Fwx5~G@#x0s
z*#g(qX5LumdK@YB)FAob<De+VC+|k%dn$r^;w^_VKy=!JStSJ+kqSo9Yhasha3@hJ
zpy1+;hz~*W?bu9(BUCrXyZH3E@r@~~b+)?wvQy>V*SFR32+ez1Ul)1}i%!K?guInh
z9^Cmlch7mSkWYR$Q82^72hc+P4Od-I-+y9XW~<8Vp}Y*4rf|0%|7OYdCWxQ543^5#
zMlLx9P*}{x-Pv&fT7P$-+Un`3EL3E5wZkAe#UwY>`^T2wcmDJ0B(kgMUtQtCL&b&x
z__`o8rW@7N)X^H=9;Eslh%pTu=0}A~Yf0_@Q98kB79(yh<8EzI^lyU4eIZ4;ZOoPO
z!=iL3CT%oGYS{5@AhPl26TR!34<Nn~=#fF@S+Op_@7Z+Fmak2^+7aYm_K2{mRezEA
ze0p^<yOQT~?!}BjP4V?@+``r9^6)Dz#VhxRPmhNN`&jC9iJi)osN2~P!J&OA!x7O*
zhxc~hvW-~_6MRR>Tcz$}G8?F*p7?}kRw3-m=<dMjMC00cF5e2GFFU(fb)`PWx;}{6
z8{B7||CIU1LPYdQmDNw;?i(^AfXFILVX7FxaWuaz+c;%pAmvQ%fhsaVhY@^ablJxj
z(a0XM^KtxgkXW-|eeRk^?vDqA!<8>wl&Be<|IK9szEaOo5D}F^-XY9`chTotMJObR
za13Od+yd*;(AjGW@Kk`j(hjXR$BXD*$_m>!#E8)j>ooWn72jyA4}D529qWz#V%Jz$
zKE`uv+?~>oz=DOi6*g}-1{1`TLkg}VJ(Fqoc#cQAVav}bv4p}Ny_n&SHhs@Hky*v4
zOd~@3qc7!@57{~Nuk=QE-d!A+D)4dgV>MihjK1Kmw8DmWWZZDp7hqvi{rMkDHb9N3
zLSV#{>bgzL&&tgx=i%uh>{hq{i3t<?zBX;Zn^n@I=$g%d)>dux@g-0PJXpslZ#bny
z1_J<u3)vY$XR!r$Xee@o2n$lFg2gfIOFCqoQCA~U;pxEzYX-2QV41)(P+waK*lQ*$
zOfG#relHlRX{n41dck{_kDK|HqdDmH_jsKWwcvk<feDzl2^%bzWi7KDU=Td*G%fsr
zz%t3k?`89CAPKAB!w*j|m<_KoS%KSMHx+nZx($h2_RJkZEdZ*%R-`c!lB5aI>m!>Z
zGMv%E9Fz~}P%@ld9tQ@`G`nUzisb%0v+A4wzjmtd3VfqI6gU<*e)LXou-oQ+J0I^p
zi4+DakifY*)i!S{<qb}I8N?VQ#OIQUWt1UTV=*<`a(SEpv}ru^8<*s?8fT-Yb49m7
zF)JqspOeEy=>vBc{<62I!F8*j{rf{Hs^k9uEEAw8Uj`t)Dji0)g@IF5N>$`(xUank
zkwt4mselQ@*LE<3JX2CtvQ1nAxbfCK9%BD|qj^7%i}V@oC|-ud|M~jrPsMg`U)L2F
z{+jjORS)Y3RFar;sAO>RW4eGl6F_Zqles)1TS8{}rDPlV@6oR2GUoxnV%Ef8YsLa%
zG^wUf;sUY<et;T_b?bn=_u^Ba^CXilv4$R{90jG19;khta7~nqsS7xoZ+vj$h1_Eo
zV&gXC=GxaeHlDfv>z#M*Y6lMXDp3vj&@p5RRgG*1-hC8&A&&J8Xs9jd2rz!b-CFLu
zIRjW>_7kp#A4u6E|CVw>0c-uyWHdN&**;OcYcV)IzSXv=(D$Fq6-5XoMdyl<6P9Z$
zm7Dv&tRJzhKK*{qcX+wiovX2cIW@HO(_NmVUGeS{coOHAtjY@}XSt$1+h3)4?JRI`
zzX((TV2Y8FMzU#VYf)p^<JrQc8@8G@?Ij2ZwQxh~4coM_^aiX>_qao&X&`{5tgG2P
zqd{}$duI>))5z6hIVHvC2wTS1RWnbS>8?{EQxBmg3uRjw;2eVCV8*>gPB7sZ6%|aH
z6S7l?%%4`{>fu~|yFLpwVmHp$44&=X%1k}R<X*P4^X_%sbDB51+ST=m^jE?A36YZG
zPjaFFy^eeu!exRaMh~baZ3+OuL+&i-Tb9gJM6@3b=qDe39Cflmzd8DOMVN<G>qvvR
zc3r5thq~p(i#bM07|wT7)c*{AC&i4()=3Xg0OY1?YbN&KAd~r96(%HnOpR@qSU(wr
zDo=G8Y?}4Y+)x;l7&U3!&oFYv1$$hLG3|WxN?*IY!^$M8t}8^vP=sm2+~y;wwQOND
zI9?P(^@>gC1r!Y08eurB(HW+um{9y7MM|0^4l)y-Z=t+GUMPPKmP@2Oqfe?Y$;so9
z>5TCuCB+y9RL<{C6-5wzo(7@Ykf1o1gB<h~V3L411{3jOf?x%Nt6Gu~BDs@r9tCCK
z3xndyo7(b>$J?Iq@I1R3nrL%sr{hg?T*GkDfrjOC730Yi5by*tl0lOW4*W5FX($9c
zf@(zRV7bWioKdA@H(bspH!-O9I8t{P@L&IyF7p#48DNpvYFI}&!l0*vh~w^(U7=yS
z8*;)Ddrwatzw+#Z#|6n~DJpq#qr8BM=if3m8X}(qdW@c_?i`tE)srugiak(XJL;CJ
z3A9*kR6fy}He3|lR7Se??F7r4Fc)08hsT{glfK9k@s89VnNHpof7{g<9ISVUs!>?r
zu|5Zm(i>!Fwi!^f8d_CE4yiIX!GizS6F%;<8b(1z<{kb9q4M|nSDwu{NKWzHHZqDn
zwXgCH{>iO>atOtvr(y(O<`OaLr0Ah;{>!vaEmH)dzE5gr!f2YpWt<exX>MfeR^h?W
z%`EkqY_E8oBIoI3Xcai4Uz~hhiM^;%%`8eAz#e>q*#b<paZng?8)y=avK)YhOV@cT
z<aPwMctYt0eW1vJGocbH1~q0Q!zw~#^f}X6Ut~BA6jPEST*^W;+2Iq}1*&G$q=lD%
zm~_vsd~097kJS{s9Xb8E4Fg?mT0o0Xsw59w47^K!!A10R)OlYi0nur!KI%+0Pj&W;
zbJ;t%JU6-Vj-oGU;2y`In<jr$dXO7OTs_lS2Cn_*h11E@eK;rt)O7RCK6nqR8=GNI
z+eD2p@{<G&0<L|8|DdxCRNsZJnIL;NvfylF+6sRo!PS;MYKug)9Iib42);JO(bH3G
z96UYb2{4SiOa4TkXrP=1y3gC}%ZAcm!W?SML-K2DU29YN;`=W{0$iuz!{C<S-?)Ut
zhlE>Tv+Rp;_Pxuo^%eIRT6Fz+TT_Wd&1M>jmNFDOhh;ma`qsnu0NgroA;l`ZU18n7
z0_I!UUUz4?8gr2=E;@mXy5ac?uWFkcnK!Jf&*O>F+h5(bwb}Iw!K89@6l1hy!1HVP
ztk{CfV$0s0L_Ah-a1FFh8f+f0&<&+dDbk?9qzF-A8+z*;&-D>R>nien{UoY6UmTzA
zd<^RDGS*@ac4!lt9Wobz5O#rp9XwH>Gl6&Ak*M)}x%e3I$xyTsrl}9kOq3LWXrLX6
z4{YGF@E=eh+(4^h&;6eMo(DFJwx~s5J3S@Ar{jz!XE_3AcHNh}O-KWp>OWwxtQ8K&
z>%xN%gHT)7jJuta3<<cIvJitFg?4#n`tPNvL9Fa(tJIr1sQn+M%Q)FK`1>0?DoMtq
z<Hn_uMlpY3MEaBLXZZ_PQ&PZj$RS&?hm`FljYy4+q?gr0jfDb$eo%#dY0F!EpDZL@
zeKAAPgVM7jYWN>b%c6ol2BnuaUn?|vhvy1V#wQWp0#H`KC<=9JnU5f;v{OvQec6nH
z*P*-GCz1UOtPUyf48g*p__#QB0(p$lI=oag<Xhjuey!J7_nT#PbaeUH+D(qhiNqxk
zx`mr*3`oc=lkQOr22p4gypLgg{v=RkJtADZc#)ukjf;<u!=#m^@VGp+NkZnQ*sLx2
zPx41}i;|tg+rm`D-5vCe09Fx>raA|J^PyhUzKPxn7}pkNG$K1AvY4*2y4cDp=sVh9
zwY1{&+x&cK$>M^55!b{>56;YTGi**ykTgkmP`F`R2N=|iaGoSg{usF3E+J<MS0`KP
z1nN3hQ+$wpW*Of9E}(a_=r3^arAfdwupKwNzJy*{ibxrJKd2sUZJN8Kcv$5#ph*4;
zmX(1g58Mjn7a;yiv7YP>tBBBJgZ!z&8{|;2*_@~;V-c7#qM#a?M=4wu1TCe@tVB*p
z$G<GKv-a0=V+pM`ZIj#XooLFy4p}!y|5({$*22n?Y#}NEQ!{xDRj}}Yg;DgP3>2!e
zgYs;?ke^BULFNR?j=h+cO|juj<(MDtXI^<SK_YZ~BY^M_K-{*DS;4>_46EZ-M&qH4
zjrGHSF<P5bB$J4`S4s+Z*KK4SxL2GljZo;K+A*2@&7j^GDc*zDBUPc>oy<HlMV&`4
z0PO4nSZ6>&Y4c>3Hb&#o#u5r8@#D<A#{Vcq;F2EpN=>`oXi`y>_tXaS_F^rJ4*3*_
zzbO<prGFaUK6nmLH-XHE-^Sb4Ts`cduh)Dbq3KqGi+$UQ#&4F3pHq6H4L(H@qfK(n
zJTG2QQj`NO8Hk<7@Q@N8d5*J-)C!JQs0+n@k|wCIjlKzP2J?$KLF;IC!#}n@P9j9M
z^I@^YDbQc$j2;IdoLSdgAa)a68QL<qwDVQ}hiSjSz_(BPOz+L=D;ed<bXyb}-=s$=
z1N_>6Jn#iVBNXaQ;zSAXHScQmJ`AQoEHhaYQ=Fr?Z=Zh=^oi=1fp0^VV_`czUE(F0
zaR1D?)};4MXSVq+r|j&UZ?o;9-fX|hKX!1E)R|0$o616f34g#FKrq!IyIg#MeH=#M
zBY`A$v@5~xX+05tk$UAx$ZW~B0XvH=cAl1TR*qj1)gyvmRio!?Oft_kH(fupTXqcA
z6}JfFtipIuuRnKU)3`-{joS09MmumBENjSzMZa<(-}}01p+jbD(tfKW1kc6ocRyLU
z-xqj^uAlKgYO5^254M?uKqrjiMF=bAiI9U}8gynjS%kd2ilPb|azMZdIvcYN?M!?M
zV*?>J$4ccmL{GD17&@VE;x-a>I-7Cn%W~_{j{0#@=DA^Xq4c<m#qr?2+ENfv3Wb1-
z`O)sYah&95C}4g_wDiG7<T0NJ=tZO%=PQ+SxUDthGt?Rqm#S3$5MLC3!?zabGOEj~
z3_ytLy6$ZAFV4p-JgBAPk7vRXy%UsWLXr)58lM6MSB$SX4+Qg#PgUf~c2qvBeF9gu
z(bS!(qCCyn3@od82;Eg&6G<^<4WWH<D=uEI2$dJj;_7ih6G1+8BK7b?T23PKc62sM
zEv7+kBkJZLZ&5W?tilGp<rY{tQvepxUa4PgdU%Z0A`LGJwK?&swIS>0pYDoy2X}bg
z$oc)i-cl6LoC9V+1>ZbDc9$kv)He^>dUa|?j+0wmowyJ<_lO%o$qnc*m}sD!;nE+&
zerJG9>Vz9dQaFBEFcV;G%B8%u>Dd-A*#2y@$`^fw1_JD(e~SUDTnm%TG6pJB9~(jZ
z4TUP)h|TnuBy`^{2g4YgHu<oHX->n}SxGZ8HFgfQA#i5R?({t1boS^f)o$d^=JrF4
zl4r{D4P-F#NiAkap|r_Pkn8Jb)V6IHJQjtEQf%&z)8HG*oJYt>$Q#a~@o`VbeXfWw
zh;~<H(ywm9)=U10a)TWrqnMtTC2JKUtZ~VMLzv$&u=O{Yu8rukY%>)ILNpN~?0l05
zH|F34s|)E{J_1$iQir;olzuBA_mMb^x*l^&cDOo>P@)GNbTk@abNE`paP;74yF`R&
z;+jA78}|9@%9s-6Bv^N~-xdfWBXjT3W#m|lBzx4>>Z)%Y*EW>k0h@v;6mXC-_iN1h
z<~w5B>fXcA37j>!_9(*H;aWiBJ)jFCTKctFbWG1HPf_+m*xL#t(!EnqOb1F0roAaa
z4=B3jbRiBfx#;Q6Uggxtvq7^3D4wHn6NpR*OlmpNT0eYQF+|YkT}E3)3;8k5rw<_Z
z9YXn1x~L5E+tl+kUaFvP!CPRYb4ZNNVrjxJN%yeOQYLqKI^l1|B(O^a_H9XK#a9T4
z1c@9OFifnbSC`{$rEjg4Zt5SIs0M-L5LINl#0ys3$@q6@^|>4D+8dUYWml<fXaA!V
zP0t1ig#7V{5RfNNOASD&IeR?DJEGt4Rb^XJMuUez6k#=B<7^kN>&#1+osHAbbo!CY
z+U_HwZl1d`OF(4UYBuTcrX{@1$crq2%HLG@Jaybgk%N-_4oL7CVt{WvIIi@K4V(2X
z^nsuWQ`$mtDW(4hvQ27dGwtRMP$%*-F&oH1tA%NH&zYF25Vr~v+pVefE;pF1PU<<)
zJfv$CZ5OKVm+d=DG;J7O_Wl+B_z-foQnAY(!pe6obz<PVMF0&s2=wzush9J3I1$J<
zERzhv<<etO7~}xUoSY!GPczO3Y_*cS>bZKia3NJa5}4RVWY~r}q8F@U!bYl{cL-fJ
z@lP{Tl&u++ZqyfU6?kaEH0>2an+m>><r?gKzSLLgpowf9T$${Gm7Pwl82wU;To1*h
zkRt#+vM45%f+BfzD4fKUT1nr0-g?;K&<GhT@(GZ-w$GhmD|-8vy}cJsOXnRg<}8+7
zmk<Iez2_q0uG{w{UcYb%i66#<Q+Z!KU$RExaAN_IJ43du``>>)In1zf17rcIg{Eu!
zJN?&87K`~BVqTLJTq_WJx%BpS<a5^UW7ai4uHTKA2HA?)3JpUM6{zO&DEnvkKvZvd
z1maJzvIXNfL*Qw<$&0Kns`QB$*2669+9-vQI2cdaHMC$UzyZqwK5mfCw4=nGU5x#Q
z7}M}NmMe`!ECGEWTkzFtXAE-g4jdp+9bN|WJnypED{%CGl)~hXtn5Oyy2BFpjC!<i
zV_T3ngM5HSIyg#olIY&vb7m-d$#Rg8NIdcme_E)7F~tb7QBWW@4^^Adna9f~J4j7P
z8Io712G&cyzU-WUc9RO-#Zzn{es=6a;>qjG!xi@VLfoxCOAuJtCuVtW+^|=pH)Zwf
zkzKgkOO0$L`3MYFHNu55Vr&4SKYHWcK|MJ{>E~<2B{^||e&yjha9Krpd31^q$>vlf
zxe~2SV*Mf0fPQ8U#7ZCREc(>T^efG-ey%*ca5HUM1>OtPYZaor&R+koM_@l_yqmAX
zXm!F8gHH~yjA5saFx!#Ku}@w%)hGFW#R5Uq^HAQ*Onf{cYP9}HLC@8=80BBRZ9N4>
z?Az>%d{E^^(^t@2$%o~|6h~O6-2ek<I1JgDDfCUMw(~w=tA+H4V)Xb+#o(wN8+mr-
z8YX&psj6WP(=c&N@=)3nd?5Z~$T7oY(wYCVtp4C2+sIL9^hys?-cf5a(ts-r5~Me=
zEGgU)UD!s1(LW1^gDawHEyMj(<X=2R-Aur3Tq3(n*$%SwWuCRKMoUL!fmIWMp>Eg9
z^!jUT$FJLV-yK=1Nd`cTfKG*Q7@nb|NS^H+BekESLB6PLT3tpu%XZG#5c-_yx=V&<
z0+R(We|{7tVL9Nm;Nw<UVFV{}H}h2Db5c0=we;v}!LwZhmMd{SJ0=Dt{VKWOmLyQy
zh5!mw+dZET-IJV$^Q1ev#pjm<UFjw2P*V<hml#hmKK6{X%LnXCLR4x<za0>Ye|#&l
z(7pR<{N%{xxZq$-_stDOE@tnpT=|rI9WB$1S7`mnWeXnj>nLogIZ0oFW5DLZyjzaI
zzm$Q@bTtv9JM!Q_$6iIAfVMd@>;NRWC-jU3BqWmY(4p7&Iw?kjHE~IPCqv^G3__XB
z7t8NIDa=b!LVOwjUz#WcixeR7lRsm|3FYWcmb&~Q#g)|E-uzKBt_)<#vJtGEz%OUD
zwa&-1B?Js6@`XLEj*4|9TTAiP))#O4Y|by3yuDfFAs09-UX@&fZwQ@0yRAizfQGu7
zt+;7Zy(%1_XmU0bq1ADdycymwy?mDcfwiN4V8w7^(`Wwyv?Xgax{`RsE=~R<;7B6A
z10YWo9B_UclF&wF%7UC<zADs4r6=IYrL$0BMw~Z&E36S9mQfJmi@l0`{8db*GcY0t
zMfnz)tugn@J6=HwZG3fd!urz)mBHASRCf~jX$ZJZf-c|$+zNj00J$c(Bk+Cc4{(MA
zta&9;Oy?jeT-cq53u}gRKt^W(RShd5Qac=YpVOT;^_5MIlT<kSNSEG?w>M@--H9sP
zG#m7QeXLGNRyoKHXY-~)2bU*ejsiF(aw7Z~*V1wY7*`Ck)MP%xwygo)!&Xx*FNYh(
zrPvKV_@r}5c-sK~_=3Tnn5!|CSKW4X%`PiXx&C*BJ^g>Lu#G5Q(7zS-ti0s}tM31;
zurWLMF;_O{DlhJ%bkZ7~#U9S6x`>5+wl?nIV2@kly65fYTF*yQcMs~cSLJQH)s{c<
zAkcHK=fP5>n%LncIZ!~~IO~cO7p8;cBDCK0H?ND8aBv6Dy1W$5^KQL+pgecz)PP+u
z!N>RAjHqPmX^n@G<&l49w(G`PDlbu?j{hh%M#v2?3jo<o*B8<MqqP55WkF%sMsa9i
z)@R5FTu3+kR5niAOXx&b4UKI6)!3p@{G(&$pegjH!l+;@jzm7JS5;m9w#@5N^WCVu
zmy14xq;5)1<jeM979IdvN}kl0Dolfc)cH@~P@xV0wqAMbcb~?!ba|aEjkl&xSX_~V
z2B;_aEE`-+Wj5lF=Df7Hhk2R=2ku6=!n1Zbh?_`LhkLw-V=ep$S6@UnH|PZv#Opa0
zWIKBAeWNTt2?$-6Cf5TDAqlPku&|#OVEdRJLfz!oSIG3^MQmWmvzOfkfSSHcg(mFK
z`3(RY=4lLE25O_LP9%?2E^P6}WMEMo67ygM3EQcEg;4i_bnhtkW|)e8k)q;BRAbR-
zK3(VW%;&RB24@kA4K(O_Q|dJgI5w=6iGR2ke*F@b=Y9MFGWBIMz3tegLmw<(yz~5H
zgZjH<iUl}YIA8<}6pEz+{^?EyunI5RM_!~Oxg|y~R8m2*pa{{1N>}M9aJ7&ogv}W{
z4?Tg2SI<2mO`Y^~wx79vrRFeI*cv-Y`h}~Q?kRtJIcBGlB1;Au41|MXa21ozbgM+d
zJNp*=N{i8MBaDqTFfBy93dTA1{`&g6{KbGs$Z^C!v~@YqDd`PlH#Eo_wLhYog2ETn
zlx4=G@j$pwdg)(qR$)4$P~kGKi>Xtz4r(T9EAx~Pn+BGcYRfKy!cpv6Jw?^)0prCD
z_&s!j{i<eeSyh<xMlY+c_|=4t!hrhC_>XJ2|BV{N{Wogh{QpA@tiPiMb^NIR4QgPX
z&VA3_3Qz;j^YJH<V{~{sAF#Ej%w;;=C*jY)5aru^wg_BADTlv#emTZC3WU(%9Bx$s
z?ISJ_`kl){<#qh>ahjq9C*LFOtBMmpjXD`Z`eo!1cPZ9OC+OA*uEQZzE6xDamCt=V
zItQgLORSm3L7q4sLg>mkC+ry=bTyF$vBfLkx>487UR~D+@~Lq@@l^m>a@8m2&jIHG
zD-lTHF#BQL$bF-Aq>4-iXh6vS4E<}BmW>hIW9dQNso)KMqe9qfi}tW>{Y-TEBn4os
z^@Uk6wtTG_14`z(I1$xQW)5sbWq6U(Lzn%Nyvd~aPQ?$Sj6PkM7EoY642s_-f@5RL
zi;tnRMLB;Dm!b**$=5&i(JT$}>eG$lmE@F1IaZ{z9At)U=u>%8Mc@Po)%~_Qv6!8d
z_&6-Y&9v)&{PnU~$Mk#gSHn$oLhwza1vXB+39L>srAzT9NGn4~{}3)YIKVsz;s;gp
ziP9fr>x=lu2W;njEPPUkZbDjmoZ&y`YHPDJ&OT`!wqB&y{FQ4;cnG409%T30v?x)*
zVGkm?r#=dywmAWm05oDDk<BL*rh^zFQgzxf;MS#~s=r2Udo?<6DlAu^WgUo>2MP&N
zEAtRG#7>W4<T&y~PA<M*InBDg^EN(DKDfL>tn2`hu@oba1x3x6+z6$oK86F@!SM;3
zMs^a?HjrYxYx`v`LOyaDs2z*TrW5qCpB^SWoiT8|S1~^R0pEOyMvS=_4#xV8FFV(I
zW+}^l1&`lUf>s7*{=U=%E=e*x{;;DNx1d`y?HF<E;=dnp0T~A4=}`usa>6T}t*H2N
zf`h^kT98y%1b_61cs3d7XxIDE#;1G?e87Je`w@fe+T7GfaD}8@{;Tso5qL?le!9#<
zdR(@?pX?@-$NM&nEW5<JjVN{lH_nj;VuaW5j#n>-m#cl-MZhL%h)(?6&{|(YApCYQ
zJ-{76lX$?Yd9mh2vhJZbN<S;9C@CFK(sFsG@-J+edV{Pi@JUpx9|HT%7Fr0Pn=l?Q
zuS?zGm^Z8gK=}MA?^(|jW-Xr9fSZR`V^Wy`rW3c9M5y&MOH-IFc6k|$tBFs79I|A`
zxsofz@jrs+;Dg#0!OsXKtzl(ZGPpjzz~?2&TcH&KdLu7ZnSj5Z-*k(q@@S5=9UwD!
zeV>{+%0}Rw7ED`DFnC+i`@Z4@>HOzo12xVr&%z!oE(b0b?+>*n1X>b<Kp?>Czq(A`
zkg$nUnFl)otrRcXSw--=4+KIGgGE3%F{#)8x2qX|8S*lyjkjGlh(F)b_)yCwM+mo2
zw#i(wImWw(DMK}p`#?I+^Kx7eJ>AysrILaPB6XC9$m)VPaI9}$c@9##bT@TN_tSHy
z?f{M$5|#4_Mn4Vgoid53UBv2oM>tFBNNJuUlRW%6LRXfDyOM(aOhs0T5r_b%?P@y}
z3Z#z*14Jid8LNqpcN_)LA|ZGdYOpGnppmBy_W&1g7qI8(&kY66^aqdkRFf(@ixz=w
zbW_w__fg*GTZ|mPpyAKW!wij<2X8PsAemqud^G0<BjibWBL<%YD5dU$bOsGc>GkBP
zR$s3O3YksV6-C=bHoy2BxZl}g<DS}=U0PQzt}D>Fe%U!YZ~u1PLzn^W<il$(7^}Ic
zExRPhF<^3fgesV%16Lk0c<R=HN|&-45^1~^iq6Dv*t~l`g6tDT(k_mH*+YjLOy%ba
z0H8BK=C7vUAItf3)D1A^r0Y89Fbm>laUHG3p!l>ClKp_l`XuR&%Iep<2R`L`mgkse
z{TTUo*0F$G&xzwe>azxDjVmqIR6PNLk&_7c1%+D#%**<C6_VeeZyB-04u>H{s`N1V
z(m<>W@>nfna5+ieV^Fb+l-qq`Ft&JqmqntLlh069Y0CSquJ>wIM5}XIlasrJIU5hT
zCjB>w47mape`=tu5%T+Y@*p1^UT!r!J`@MUb2xas5-vPBv^?kJ#MhqXme|lZ+@g}#
zaWNaN&hpY~ZakjmnYJ#-3iW@OG4Orxw0m#h2VR>tV!BVJJH-k6*AWbmZk3;sDmWlB
zGIks@W-&#}B-+ZU$6s<SiDVA}Ux^TA4Q1T2TCg)r{A~wUW+7_TaTjCKSI(As%aI+9
z?hmT*@p^y?O1P?x=%PYIM8>iaFthHKn$HHgXFiz;%F9}b;pv2leH6t&t2PN2hBN{{
z3u{u?c;M(_^`oq$aQ`M~G#zYNAMA{dcxV67;DT@;48MQbw#9;^^qoGozQ4icszO~^
z8rcY}R)aW^EOn@)rOf_$1uqKW#hquF!q!e!5home{u3NKJQt%kjh<wDsS$X6I{Wn4
zeU4HbA39R3;nt4<etj=L8ffK|N8XvmsV>A#xEt;AZ5TSw9<^&t3?8;Cz9exvaL&6r
zAb?#$Siqk8-DN`lSKY@6AIm|fmxw+-bQPHN+ktMdZ7Vw}CpZ+6WK>77)VN@8=j)Jc
z{6-ocYI>Z6Kp+Ch+ei!3Y!M^U(J@w^UiaIz(A7xwongAKM`E8_p({X|aGYE#IDN=2
z$DJ!sSp)&~$aLmGAr>}6%XB`UfEsT+hGTqMz9;Q0ZJL-_RlOfx_TeL(*M(DeHWw}F
z&wbM?0=^zT-=DXHNrnid?bQAIyu~G9|Lb|H1kc-UP-^FT5pKi4o;5z`eOVbkV3nPL
ziA3GJ2Pd8ZHsRI`tMy5qaE8zDr2%?Hx_9;dP&eNqg2tF-`HjV@^1Iw$Ag5hQlu1Pg
zC=f#0hf&F?ewjlV9)v(#rbb{=dcw=5i{eV|m5)_{nG@6L>VDpgM0=bUoLO_JNOWq$
zZj+)w)5|R_KOnw72W{C+_$ucc2Et;-zIHYl=;d4yRqIQ7p^OY$s*caoKyQ(zIY(gz
z{PREiiOtfU&Y@MJ>>V9$*`d@)ekVt5dxC$fVg&OyzzMSojm%}D-NGTv`>13mTzX?c
z6PSB4mBW*WG1o6%pTe!@g#}J<j5@1Fs=HdkH9Hx-%y$D=Fc}p4Y<MxyW4Pb({`oB`
z@|M_M8=nE&35@$dgVe~}bMSJt?S#egA*<~#hhlpjyVf#lhnA&=XN8RVy86Z}i$oyr
zew;F?HkGw|VB=}9je|%Bw>QQrV$8xEC_ZKx9VP2Q4Cp!Ww}pKoj1s(Pb(K@(T8+vf
zYaqLDV|#W$xa`x4cS5p<@W8!Jg{7zLV3o#%v8~wS*8R)FgoHa_sPaZ>{hDV=;O8e$
z<dl<@wkaY0&QemWWedJkBitHcz7$C+8b3BjlzCOjEa0}sQHmX@zV+E5Bf#(oZfYBy
zL=D<m1?~Wz!002bVuwt$EkUCaJl8#RZ9<{mzQgvF&zuFQ&IKh(Gqp_>Y{eZ^C?M}c
zgs&Jp8w4I1qsy?0HZ+Rxtsk)zae+M|Y76NeCxLmbslRVc6a^*LyH`H9YP!0;WiYPV
z0c1v+rmVi7Bqd|GUy?C-OFXLZTQWFsq&8!I>U!8_to<8YCW#nv-A?+gN7!oMCIYU?
zZi1zSIOI(kv8JFlypq(?4#9{wwZKBMD1&F0qlZ}s`?}am#>fYsXdFV$t0rT5K$Kuq
zf2@lNfWW0kx*tXI{IiXp3$ZD@#ivESG<=0wSxppwJ=yB&i#dlL{Dw74XNDKOUJcu6
z+%TQ^>#v@xwl(qn2*EKWsvicpl>r)24YkdeVjdO5O)HC91>E;=be8Kb2v{0D4a7~t
zxDE%DK1G>ydMXrJ7#Y^VKAy9IgFB5)p^v<hho;r@MTlE*y+)sjPX6r1S749!N>EZ9
zq6+d#)<W+2V5xsU)Lb$dBpV7ttz=eLL~9|=4Dipeq;WDu*i7D;?pyZ`69}FUJwqu%
z|0FzsIqGvx|76Pg`nzf=a&8%vw>4^Qh&zX8)fUxCkzxSRrsR@hIFo>%pOU7SG~Nj1
zrk0U{+bO#8dQ22b6AtGXZyTJC#UM#nIXo2TsJG1&S*MmxH(vlbRQY9i17dX}4e-E|
z7_GUq@R)VwPc|Oj5Lt@a+K>1Kj-;yiNJn6<B#niCpXQwsn^0_Fi$~_Sw2C9+8v6h4
zmnA;)F0-!wOa40cIa-*tvMjzLac{|Wx~Kl&%(RNs7dU=ubSCIAfLbiF8Jp>BBl590
z^}W}dp!(KxZLJdBMi$I~r<`HnVBD7ISh?Tv;dx+}KWsZUcYS_|XkNhkv}ectfn>}*
zBy7V5)u~aQ#>P{(1V<WJv9sgYyuOnl>RR-hZRHlGM<r-Yz$Iqs&X#QLw{wX;pzp^X
zAUiz=>1oZmY2~3IJ>gGqq_U2H1hRGrA>r3TCDgF_0<v_PvIkZXgI6~jXrOO|<8i=}
zc$dd$tR|2IjVy-}yoSj}RY9``Vb$eP+8@u(I>xP3)s2S*h8+gkd7FTxoOAT_8<gnW
zf5A<w)!-g8cv=}{-%A3BUddiCcOPtM;p>FRu8lf-U9Z4P3If8mb4BvU6bqPQ6(0Pm
zG3#I)&|M;q^e=m^Xh=#HY;!<4_dgX;!E@98mnpbu8cZF)UJ@^_{mhLeTKGRa)K4*-
zYu?N&p+!)wv#UAcJmJbs$F6&(!~0pqFFM1Y&FWp5)w^Waz-Vo03cTrHvn!c;Z{dHq
zYRU=`Yb(^3F4GnEs<cgNL5fTvMh*5mHYfw`RT`v-<1hO`?V)Q;U;6=HWPPJFvM5Ba
z`BL8F=~W`*-z5|GKTAftZS$39h%eud*f<ily_xm>sLvf<iP->Ce;lr1M+NiMC!!p4
zb1K64A#i|yBh=beDSWWFNWAz81PB!aru1rhjtThh-nIKb^4^Kv-zm#u&z?Oy<8PmE
z>A^*O1-?11x;33v@gbNK5q>Tlzdo23IK~Tpa!u0M_|p9ja8}&*GiL)H*crcgp)9)%
zu6!3&%hi}fSFGO$K8t2*r?CnYk+}mvmOn<}v?x0`bQpJ(yHos`Gai#mtuwg>LP38|
zNXuy_m9@R}n4%h(xNhNgDl#{L{FB*&?S$1Az<e<5`~C}l!1gNus#N8E<P312*O%!@
z-;^LmF@jep=;$6hx+)wHa1WS0X)|3);W{5b4$nslm$~(`>`2EyA01#G{pNqwo>3n8
z&463$T39jbK0Abc=s)~dL%KPu8Gi^v2Yg}-I|dj)selqahl0&^M!Bws?yr(kCD#U>
z<LFjP8McY#Tp3aD97A{rOp3Y#bjJR$LvMzUQ`eHLLF1YN`BX;Q0Da3QeEhY(QoQ>g
zDpKWA<X<XNqsdIoE8s=}zl%*FBy{^#R;zUXB<X9&b*9r3&(*$M@;)d+lEr{VZ?E_#
z?vF$1!U>~oicO9EvSXx6Bg+q|8l-E68h`8>upME5gTb_ltdc7DI~3st=HxOx2g#Gh
zey~1|HnE2&>*t!dtL`-XQ%+*_9D6MV6;(7@8?XEO58YrtHYo0WU-n{F$6{hue^h5;
zqSvmY&hriGrtQB1kq@6`TRTgq<7o}w7H)_PL3i6cx{SFosa`t}*Hi5HJ}KOzcGUT*
z6Tu&NAzPvoD|mC7PiBZOf_c~tjyHxbYw}K9UXUnJOCKnusIAoo#{zBA_SCkuafsD^
z#22t8R2RuM@D(8%-s2(Dm!Q@I20k|ZJdBr~ZG%RI9bte_kyhpbzLRidw42UbbfPPP
z9D+HGix54fCLBViY@%vJdY^mrXNeY6_x2|aXZ28nlA>wJa(>0osTy;V(a3tqYAkub
z+Vw@PrfSJ@@o}UzF}k`UAYH^0>60Q-E|AJIc?Wg#e>;izVh%n}1xSueuv?Pps+=4E
zqK}2Wfcq(bwhVx7{5M{7_R|j&{|{ep9@W$pwGTtlq98^bKtYIAaYBeyh88eUQBf(z
zsUV4vsznGiq!y6~fr}!8B2cwJ#X?X<Wrz#`Ws1yIMCK_78E{~VBnsh5lIyqWyMF8U
zt#7^S`zN>-l6&vD=j^l3v!DGu{V4gT<mP~}8pD!jJl;(|8jk*Xm&^Hwbz|9rmp}bU
zX?hDjp47ArvJcT!=jWA}iI(k`m@7eV!HAe6hGf*cA=o3STs#G0ag^fwM|;5t{$RK0
zSr?CickTM<zunqmCnk`*#9m)1@J~-#?6F!)WjEim@U?p$s!;+KckMh<dzmlFCN5Cl
zBI4L!ZmwD$Fv5{mi}(?gRXKG8EijbZE#}5jT(1U+IMD)s4!~cF(OvGq{m>N|Hni#b
zhHa8rMuL}6OY4Q^(_LJig-zRGPJ_{z;SF{*e69vN7LIB!;8J{S7~y$O%0;Ask&ztL
ziabg5q^_*F5wlKiw1ef<M8>I{?^4jBN9d|cE!DXFvI`}0T`{39#AGvB#v9HR@MG6?
zZg)74Hy$vIx|2#(_SsZlSK?L;<p;%LxB!eT9N|gI@7RlFNs$mHnCf)UjHlsH!{-W9
z4cUCD_4=?W+L6UFZ%$h)+kTgIa_=1|L(@vQ4It<H=)suX0Zue~Z%8KVG1NEuE~V~6
z`$s>uZA$jl{Bi{z<1JhzKWq>w<J3=G<9x&S;r~ZvFqTankS7Wo3rO{d!6ibBK8WHl
z<E(bCpvW#K7t)PBG~gqJx|?J7%Ce(JNc#O}=ysd#BCC2INETG}%ov7PY!Y;9DRdQ3
zWr?^B$^7Gr4`3IPgpFW}%9V~`-6s+j4V=acaAHyv(PosWg+58yUoxi8s&wjPTPST+
zdt{ASJ=3mR@i8Q^k^Degbhdo05wGb+HY?z#l)?JoJ=zkm)wql4Br1Kv28%(?!&d2p
zHHKNKuUD-Sv8KW{`H+^>Y+)hIz(rfez9LCIz)R4@o0Nlp5KBv(^)^kf%PO%_hDBze
zNZk&qQ^5<#{h^=+&y7hg+Agx+wcj>JB4F?f>VhUH(^1a3MmkFy#5Z~3<iup}0@SY&
z@|V9cYc#q(?7NP@)h9lX=YgTavY&_V<<WzBKi(Y}H!yTFNIq8Kyrl3}!5-6qLZ}?w
zhB>(dDkor^S|ULJQIJPJ7YMIo+gRoY(Rx`+15sP9SN$P6aFmy@gq7&9S+2dW>s|MB
zWbgE`b0MiV6NmXB_Ob5!M@t&g@qL@4Nutl>n9D$~EvWKPYO;1w<sLP0*?T1nzj{vT
z!DnJ74sz_9FBi?ElJ|j;nha?&N{GJXr#|5CU)rjBOwPPXxD>nfm#&Yh0|jmVbBXQR
zl4#Y+U6^j9(h(cx^ZF+Hl*j0vnzHEH0Ok7mhqX|rg_(|hM(XOZ26@vx3DltbPRa?l
z99$la3YHApR`pf6i9m&KVdu#`?WKCQ^%XYB8H4l{<DF=1Lm1%P+0)Q9Vu<NH2+5$^
zCO}mAg7w+842>ljTIBmwxJeDajeA_GC^{lYx~r+aYaOuk9-Ah0)i<G@`d-ko+~nXa
z{n=kyUy@<kg2jyopMgLEQ+uq&FsvVQKo{_fg-yu7iNQKMT0LQ4LXva6%6ZcRv7XK%
zCVOvarplQoKNv0h3`!d`lNS<c*qr2x6-S#!L7ARiV%e*?z;}^3F=iU`1frPNRR_Lm
z9GdDt<Xf3vHRkX>TC&O!ZI$5$#os6#3Kt$i>F~K1m|0g<yG97t6urZGC;-;`D%v7T
z2@%KuX44VKiMH#D+1NE{4akz|)(*@}<!JXI{sQkwkCc~Sa7KuFw$)QECx}y59MDjA
z{I6G)gRGa#9TD_3<7KD8SzTwVh!hb_j<4Cy5;oY7^w{=FYt-4PN97a%a^sW&UU|eN
zZiMGre#a$0;VR!@QngGX7@()wb+La8%mqu6m%VpugY4FFMech@xj>mlKB!iautX6g
z<T5P<1h-N9bex!=_@K@q60iY0FQ*wVa2)AP0D;__Lj9^U5e?YN;*JZlnevGBvaq-;
z6jxuf$Ys;VEj;re8Q7E&9<p5NyxW`jp*FY8;F&Ce?{HsvZx4~2j_byuX4<M%y0Cu1
zt~j~}))3*j9j=k4hj!K4C5MNtSK0N>xXHlNt^Hk^$@znv{qn?`1c@$3cO1B<(`xe*
zew;}Q->ws#lI~K!*hTMaN_$Gvaih)0A=b32yev70!EFeYUu2E(1!jre!CoITl+NQ7
zg&gnPs^u1mJ=i^l%--o)cYeXgpH2*&rjE~@n*DQQlHAvou>MVh<`+ZwW5AZL@xtEV
zOZucG%7ZF5)LCgafiFvr<1_TAjilv7dzCI4C^liUDjU;wBtR#FT;;i2<~T3e95*9e
zoD*p+G+~v6sO|ddU^@6a?Bb5Q+C|-CAapTz8G1=;&IY{!InH7b)w9AyV|INEh?3Vx
zrL*-frfJ%&`>qiX+Lu`o1m-7Y_^a7nrPRTHRcA*S_Sl+)T0B#h9F?}Jx9YGLY+X6m
z!+J6XJomysi4lCIYr7VDSk_k06*z)`XVFN3qd2(^xk<xg+tHF!a@&R}BOjr5*c#T|
z=3u1@*N>YEEAuW&6)PfhTeC)`1rtY#U6!W$Wx2bA_|frynw3XB-;HnN%Z|cS*`gip
zu&WU5Yet?lOMy)GElP8#=&f>=2o11Te4{E`F=y$h;`@8tKt_-!G^u-Mfd)e65ihV_
zskqiVY)#nyI6V>Ih5u2a#*NNmi(!$0z!~hm*SvtB&6#Wi^+VGYAb4WZkCq&hd)LP%
z$<@L-&I;B}+KMwCLbT;z56_&u0R7kkK7Uzx)rH*jdzV@bPq$lskT0x$&xKaeW9_9=
zIvSz6%FEzI!(Yw!;}7^rnkTy;SyG&mB|pE6c8RN<#Itc#NQm5ZMAAA3{iYU?!^tDi
z#2QlH$6r#VpF>Y+yJ?k|)B&Aj<&=`qirw$?=ZMJ+$<|V){-}nDw@Tj|(}g^3;X?I&
z(s?C$piKlln1m5+saTdLCf#x%8%D61vVeLhpfK9P*UM|lAF1~ARq0C#$j|W$Ys~4v
zJ#UA%$~TouJhp`%48^;b6!&I!y`xHZ3Xd4<F-cY#0BQgOvv4^&p)^4GBDY2YY8KtZ
z?e`X!HwyJxL3K4&Xo);|4_b63Yog*n=4bRFL4$Q+q8ZT&TjfJ>x)E4Su2&evbRT?_
zKfYmKM_{GBiHTVy*54WKpoJ|K!q6XJpH@fny-3kW@rPT87ox)sDn^eaSKz{{pkd;~
zl$iK{DKflc--@5#=@_7?@Tra3Yvrtr^W35$(}NzW`TLWdiufH~J=3ku4R)w@Dg@*c
zi0JK9tWb7*Y9RWQI?)O@&{dBw5r(swTr}tunwQIM_>pKnF>KWdtOPxL6VX8SI{6|Z
zQ`RnH5$k|1x-?D#a+Sr=$9e<ZI!ar&4S&@*(vjIW87RYbkkCy`m7zDLb5=y^=Znhg
zgp1&k8!`JZL5(hIFV4eX57S1aGNhhkSju1O>#2iYISUHuIxM%7kS`gFv>V!%_yTC+
z8tHXj-0FC`sBim6p1Ge1@dLGsR1T)Syx(zfLK8iMLYNzKuu@TiYRX0wVW=EJgA_<#
zT5Kz@Z1-24%^gymZzpc7DUy4;%UsIRF1ZkD1<eik>zu_>peZeSQFvzDb6a`Gq{{J;
z?@8a`)yrw41_sHO(>7`-@B<;((syVPn0B#ICz-bdKY3A1jvd|t-bMu*p5Ijg=x#Nn
z0v4N*Q`CAprzp!p2SZ#PZS^3XlEsa(xD-mFq;z?vw7K<234wXedIp2X5)M4kP)T7e
zfsA8qaLrcubi+(kJ5XEFb7;R(X@QEEvMER6pCwij*1V7tJmt&=^WD1OeHc9xo3L^S
z<m6BI2%Mr-wi5n|0YEXr{(h0`=~qsPFF@E(VyO8`6J4{%$nM~ykO$*}3+35Iz=1jR
zV9Tkl4?ZLJ&Q^DQJXgv4tA1zIiI@*jw%@-@Fpd<AzdV$VlN!P<cEznhx&fM?I;%pI
zI;e9~jZGJulzAF0Z!#h@tDS0t$u}Ji(9bV0;>TFQv7#JwOYnM>@!1!<Rd%c8ON&#^
zkrn&9{qJnN9ZoVrL^*ib8BRP$cAPBGQk+M{SwIFAKG#JCaIWy4n?*U1(^861^7H#d
z`TD7b8l2pfJF**T2o^><kQfrP%I+FdmZ?2KZwU3Wav^r@Wxb6!mh9TI`Kg9F7hw0#
zWc;8H#e#nm`30vvVY(^eaMuG6r$`U$2o^?7Tb%T``Fdr~jEP}=MM5oq)wt2OcSCb6
z8egYA6at2moZ|7%lm0goa}Djp3=myXBehhRQUEuv<csn-YuNg7-6q;n)%UXK=ZH>~
zMW7goqUlwU9=~BdRvtF`JXR5Xi`TZ2HLi4SFRVJAk496v3Tj@KrQv16Hy)rNfd1xr
z7=&IRfVz5v2!Ho4&1w8(j?!6mSRIe}aIOnWKh!}Rl~A&|R=CPh!dWU{l^nTCku~Ku
zbxt|=Sdo{FmCaUo%{0YveJbL!GJIXKd@G3MOgduG8=XHoS7k#<%+;Qm1$a7@6^q>#
zJ_PZO6A&?`iS62Aw?;f_X(%<5Z^m>|WuGyf_!>RgrU>Ahg}Fr%joD`Lo4czlGT6p;
z<Xh}rkJ)xTRR=6m3yUOr=NrP-f{ij*!YKTlckjb5Lz6zZ%7$-?TQ~m%ty87Pa6>fo
z)<gqsI$jMs@p8!Dp}|8DPWp>G_*v17MngROR-H%O8rDNwKFwHBZ}*|WTusy?)TNnz
z>$0mZ3@01D&wwMHHj5s(=DV_|eFQ56M^_kBaAN!m^56GaZ>;QYjJmJ)%8mhC?rzOF
zINB}%N)kxN{RE$$VcnN$r3v*3IzFDH@@}?aAt=htTWU5KIvpvKbL-pm0ZQ(hn)V|s
zZ_M%St6AA2tvW0w=uT8z;GfT-IT%uQ4$w~f23sp~vOU5P7bgs7CpTRRrWteVeh_g4
zNviOW<s>oZ;K7hzy}Lo>v!2#}A54VdSoH5#jq;pk<{+m5n4?aOt!@eqa|OSd5G6kX
zDRpV}*_qfe>mg0pL4L3j8hD~R(31_v#^N+8yBtnbG)Mo^eJS*3ub!z%)$vTIefaW$
z)e@K8IkV*w2snU&w$zuZ`|ot9<In2MnNV-%q8`)X15c{DOGC)lD659^&N42aOZn_l
z)@S7xJ8|ibz{Kt7ou8}1wa^Z<T<+LJGRC&4T+j~ra!mL$dQ~1G!QH~PuqIBGJ}K!e
z2qdhAns!5Q@=Z{4W@OW4P_i$ZO&Kl-y{H!%S7mVd;=g5z_QoYXH#I+WYpTD2zyt<-
zSsdQ%<o6@YxS9p(6#jXRG4>`H*N9s>3fm%52hJk+IDcTpRa0wcTe3!nNzv{y!}_Tk
z!MvO(X}-!S*T?R4YA$-VbfVSKwY_j12t?esE$iJwN+%^Cvfs;9tGt2fk8PT`Op@&<
z2u>>4Rb484ek()Hm$*d}?fjq@z|EX$b$A5PAM;$NzQ<mXPIDjqmRxRDQz?lvKj@cR
z@cQwr%{P*lqgr1EV0Mt;zJtQH!{=tUncP|Il~bFrL=}QMg6ri)7AC9<j*c}$nG)cj
z9Kv1!wwsGaAC;$qV%531q&P0?{61*<r`8*lMgRWi@TkBhFWt97pJ-Mh|3Q09DAj~n
zi>S_`88SBstv(@ASj34SE=NB!d#>!R+MK~Y+!tm=Q;~~hmx4d(*`DtGMYfB*Rd%54
zS$^$<H@?o|jz_GkRt)=w<@A)A@(eWN(35IeQ=z8nk!p?lZ$6zYu;#s0r}4eH@g!4x
zUCX)Q&EyEu;;In&-l`ue9y~KT@7E%V)27<ljc<BAc{+6uHMYd>4+~Y>dY5z)enVS7
zRq+Nj7pa{jhE3%D4~kqAc;oA-hXR>v**~e%Fbfv0cJ7QI^3~<b`o2UnIr(~Nfx%1a
z#EWyKrSb0-o1Z;P`r$jA`NJLBW&q%wQs*K*gD%04k_CgR&TbW}NXBc7<J_1ETcR>W
zqviX$>XU;r-FDHFDrVZQIoKD}XP)uhF)-9}{@ZlLr=do_0JDlie;#_NSuOWgn5&D4
zn&>Ik6!?-RD}PcM$Q*qy2d@W#q_*df{4Qm06TD7OUfxgF`mgIaA=BjOoW1k2?UTd-
zMc!Y$r>wKL&)$Bhp@yR9wO`=%w$LC<ry|AND883okitvW+{|ChCiXcT50MFJv>SaS
zotXq23u!V10Ti!%G~o2jL9sACU2fw*<FX>$x@K-{>>^kc1d=Bo-T5eZ`9h=tERSmt
z&1zebm9P<{(~3EeZ;_XVwP1#*E(EL_l;r3>3I3)Tnh_v(JJsv3S*)h?HT;P(_ZK|_
z3ms=<>5wNY`EWbaf9CVW$8YpV<cdydetPI(uJk!+0k%A>QCLQ3p3-$5;atTR2T3jD
z+}a(!eZfnHcfg5Yvm~Jb(RD2B-%Ae&eb^$wX|t%OJJ0vz7jP#nEvMgC878%R3Y@LB
zB=0B*|CQ~fz6+w<%z@YS`+E={@<84Q$n3-s8p@L?NVGNK7XMppJ$uI!`9k%r@81mf
zk0z(t$ll*zJ|1=-Y+cpZ!@FM6%3M;^vfU@1yT?=$Di5Jvvd@Y|>WVN+)OJ4@CU6uM
z>in9`Dx%!V*4ETmF05}GXdBUvV;f5rZRZx2R=$`fuRxi#bMZGG*V7;M50CZjJWV^Z
z(Xcnj^-l4dy;eS&?~yemZ-T&3ajCnMVXTON&a3;Pqg;u-c^tW3;MPQr#B9;CkNgCT
zOiAy=v5tH;<H2aMT~;Em!=TUb^7m~EcHLeQf5)U$Q~fgRHBI(AFbw<}_*z6mzu;(<
zzLO$eoyBFcH)N|bMyBd<dTf8N^^^Nj1N{!lYa%mI8u(5$M{Rebd?I#$xeI^!@F-r;
z^ktgL*z6L*FeYoLY~Y=bz!?u=a0C<0{F0m~q65~1*{UNTzlosMn8TarHj<XITCf$I
zRjj5dP|Iv?xZDH$XFHS;7%J91ZDs7CeXzr7YBBMiDfg@-B+l(j->((LUF@Bj$|-1<
zUaAk*cs#*hQe*1pMw0EF5=2ONueqWGU0*l+3YB&`)(&p-#PzMA4^O{o8R2M;mC=f4
zZ*4CH(jQvzjuGToTq5_r!C+i!nebuENGU6wzdR?Uk<sm&RjU#d5_JaOk24T0AvAIa
zGJw_jr1=&oVpX>8k_0_Rt|R(Yo4L*-yS1Atl5eOsNG1|)cz(yc!N;jqgi7w4Fx^o<
zQDbN6{i$yo#nezz{ia@fk9{M@`j~;xzuQ*Jm;KIEts<Y6MMnmL-hMd3bGl{L<6!$>
zd?!?dD+tmx=f${{FG8{@Z}>4)=D!Myg|U>j`ryGMffh@9s(zNZmUme)&e>s4j*Wwk
zcWb$7<rMI#luVT$j7qd>F{%c)%7AM1?XWG_zqV<MdTVsT+7Nv<UUH+#O&ofBs+6#{
zra-=&V9fG+KD<f(Tbf<(x{~TAQ6yc!vLkAn_jQ%}tqHX52Ics5xUoBJ*iy(xuI03P
z)8XhB5sdt1UvE*m+_-YLts>Uh{-Jz>@%{azVv`PM`isxMoD2*o+q744qv-t)+Ml(Q
zKpLv`{Hnol3BYvtBK%-U6JHCG^$Sz+oDvhL?XCiAjwy-vb=BSv=&t9zuGrS<?y42?
z^=%Cm!2Y2XxQv{Jw$@<=mCD#vXD2PZFUciGUT8P#EOl1?juYVj*StwTkdImzO3%wV
zn2s21&~->+Qe>KOH_@CG;M!HQR<%XVsj|rQP20q)L_Hq4v!ZKnvo`>mRfnuZxlNwt
z?Nv+(mC84wj2(V_hSl7#6RfOdP0<;YQO~8F;iSj7{{STW|1W?fp(@^@AC!mTnH>=(
z`6kSi5LrY+innyJ+^tz*x~L2LhUHuvwxL3v6Ac|9bU4jvtISJfH|dKdYG#v>Y2w4N
zFcW@!=yDT;+GkN%c%d`@qrb~7jWsmcBo5umRBvcjyoaRY2>J#1$cr&rss{ToayB%J
z<~i>YK79YtSb30*QG6=Guuh$cocX7X8RQj0|NZtG%8=lV(?&y^uI9DvF2;@9%=5N|
zpGwCKkkR!{Qniwd)e3nw+}yBNP~A?dR8oa1PubBN=(EDwYV<%I=Mg&FI7f@NV5-Pj
zex6IZ9af2%#;m&sx*hO{|J-Y?9m}~P*kvm6Apd;sSXt1{v9wL#@i9Y_OrbyQ!gR7S
zA#t0_r^)6!?dwjArJ45f7C{TI)L3z=T9y-)S<>b2zoNl(a|vz0yRJ1zEM4=^D4zFQ
z%_i9dIeYL;gZ0qHr+hFczX%)2pNPygVK7;7S^Wf>*>6B=8c=VrH)%HNVxHc4Npv$m
zVxHn+R?s*?Sk4-5ZW!Jn|A(}kZ6#b%r8(l_SeI0>v|PTqDf(3BC4gh!u#SLjlvUE*
z(_^!CNc4=!7OlDOP&m_TFM>FBi4-MV7MRCG*Y!yc$ZAHMWKOZxhlpnA)IN3k3~2$|
z;Xb*Y`B5ToyHz^K9|)=Kt%#0fZ;};OON`Aq2B_!o#GxmZ*O>Y~xBs0>e5x%nR4r3t
zI(f?9uouX3KHbDn<Te>Nf(*VEj{K2uQ@9K>f)dV$TiT%OJYsGUY<^sB7Ko362O@6t
zpkw;?9GsE#2_v(q>km3JdwAp}ZP|X5jY&av%$RV}C6W*GKZ{eIn0pPsVx|&E)imjM
z${##WvmAd8K@#xb8z-+nBeSi$av^qdVk8tfEGJC1ia2^g#|QUndg!<qwsX#?({ZXz
z@A~f2ch5Sf_K@bGE3L0R|51a%{xZqPKQ$BP_)d5gX-O5H9Ixy_XXT2pmWsd1=0fug
zem|T$L0agrD&NoO`k#Z%E14mAzO#LT?5s;Ky=%IemfXV3r1uiKmxc<^hKStB{Evv}
zPS_96o|cw9eb!ZD&0h7i>*J<tTfK|Yn9Ezet$P3XH_oiIQ*h=C<;BJ&@rtfit?zHT
zIcccl)YpH@pPuTERXCJ(NiFgj8`Q})-&kEP`~3ieX-t-t)Rnw?v1HrrJQs)J)~!E(
zd-&HY#+I*NX{z9eS1T%WJ%QBPVp`*5y6;?Mj`W!fd)cd&O8f@>pf}7(x@NaJtGeT)
zgH3tKSjwfo%kqlG085V7#+Orm^IArCWtN<?nds(PfotM<dNw`SJF;qb&RB&%hoP4k
z#X0MhDWJOd_YVwigs!rrBsqBemg+YzS=MxW|IL`k>G+pql}SfVKN&1f8V$Sp2U<gL
z(f~$IeUL@zPLBg;b5X5^lfDMupRuzl8W1|?&_4}R%@_G+7L{DNEf9PYj_++ODB#8M
zc!`On2A41Y?&wFS`z^Vw=q>A&gR3ER@ACX(dlwu6F|Z>=%|?&cNB*p%soDe2{lUQ1
zZ=MCQJ8)HLna93Rvf_Smn);U*PZw`LKiQ@b>S6zDi{F-&rG5J7vo6TzLDKm9Lmi%1
z);uRg9??+V1r;|h??*`OVUV+{xST;}AUVP?fv~tIbtZ07-@|>Faz@3JIoR5iU+&8M
z^9=ROzNwY6BMB>uDmTWwZ1e%q<t<vONkk-TF}Fts^AwDVYn=k!JdoOTed#>$_b)f?
zV+SlSbCpxs)sOG@yIXo1vpN@1E(EOIa{IeQ^E`t1|Li7^gLs*rSz;>S`1Rt?9s;U|
zb#g5~&aI3Qu;3&w>uuPYsMQ~(Kjpq3ez!i2b%#}Uq^Nb9_TmjUVJkZ}uS>TDpxqy}
zj&@D|w^d{@vik?ddOr=b7k2+zUQ`y<x!78drl6sl^L+c-R#jbWnoY^h3jx~%+wIwY
zL;F6y|MdQ_zju<WhKlqb{}W0_qE`%ia&jZsa}80PjeoSJT4*b1UHLp)-qjgh7t*P2
zBJs@lWt;N2HP5cK9e>s_eLr^Mbk-ru51rFv{u^#j7No4hee4c@o~QBhdDMxWiyW5i
z{dZmbq759ND;<QT)<0x?=*fIBR8%58pG7Zo$;NtviE%mBS#br=o^-Bg5|*xU+4gV!
za$^r`y@E&7)jAaJK!JSOr}F|$wZEskz}F_3686B40j)rc-Ko;VxB4CwPs*8w_BVnd
z>Q7u?-Zfat$qRDj&MQj)FyF8v9VdI=qv7Fv{AUf#(96K&*1Wjx|FYaN{)bwlxd%Va
zgCN@7KR`ih4N2!GVyX62`iwnSV5&Tk0)m=e-OTgqT+EtYG)y~eWIi;sDK%$oF8ItD
z!+XEw|0Z>eu}I&qG2Mm|)bp<sQai<<ZBkO-g)Z?_6oH}lN}sHt{u{OlH91>Z{`t5n
z_V4TQ8`3O_(}Na`1RT@;vVC3;aWWJTjpD9Jt2T6#w`xV_pi5Cnm-L<b2I5t{&pE`{
zhw<H=uNrQsnJCrGwT4yD`NQz%lRX5cwZ*=7f3=1nL4jBP`1Gc2`z_5cP*l*S47k5R
zYPST&R>nHhKjsrjDw8{P?|s(ak-T({jSCwND!tc{S$0J_B)a$D*PZ*OR@}Mu@;Uzf
z-v2WsAe1*xnD}3R;D?)4YqGq&LEo-KG0`3Nf}u_)u46ARHXPnh`^|tM7UEy`UYqbv
zv$!>0vfB2`!Jn6}9M(Fftw;?$@AYWFlU|XSTKFKx*PtAD9frMfj{%yyM}usB<-NYM
zH^47o!5zno%$*J=_fM^j`S(?+CT0xm4ehyONNvVt*NaH)_f;Xts;pACJ`RuHFv=us
zxVEvfGOA51to`i0s<kdXg(Y=qeNh(g<`p4b@%ObaZBMlngP0E0%Nu&m?MO^&h|<|_
z@S@TP>vG$t`*i)Y>u37etL0fUanEo5dV7H)s7x`NbeHkj;$wQ0WYgh?aot*<Z81Hh
zs2K9^YYwW#PkALkRyqlQ%KQI2L(pfE0vr35u?+`8Dl@xE)g-cW?6uDpiE*j97Z;W;
z3ddiDnDtBk_CP#pmIE0iGuNF$8*El?WnbXO>$b4`A2>@1wJB*i*`ApvGh@nwFK2nv
zb5Ebyb|ZhPfbmf}Y#wv|_8wAm#eb@lo^9y*xWv?G)$(Y?lABGPf|pzQ-U;7&wyet3
zr#73te_+xmRlm8R^RT){`mSL%DB#J?H!wXu?`kox)L@sx6xm4^gifjSlNGtos*6f0
zpLNW%4SYV{>2F!^OIj%5Sh6A(b<2Dan&Z5kX_ojl#r4snu{$1AtCKaHT%mhul;ERe
z>mJg};s5T&k34YVWs8gYZ<4pUiCt%JT~nWkTz9A-e=_}MZ||^~Z0XgqEf%6f;;8Qj
zHXJzqS_4~$dq0cezU?agf{6Y>Gz00|x4-TAjnCj}j`dRR3!cwKW^*317posy2HNXV
zdvCoN92mE?Bi_D<_^o`j@XefOszt*eyAw<HYpUJpg3FwYF@@dHyXV1BgW{1|n3_#b
z3CuU3gr(*T>^0#f#>J(UUZhgo1=ItpstZ7?t9F4txaB@v|2P~mqsamble0ab`^d#O
zw!p6Gy@V_n_OLws(Zb?=ip$QAZS{n}9EakAuX}9?E6EpqUNPRYM(7*PJwBy1Hx#v+
z@nD`wFDk$GgZSE_^N0SA?cu^hBXKJ?UVQj?{g$6KAp7`Y38_L1m>faZ&~Ywm+q9d!
zztei9Tw5BQ$3i@vr8cjnfz{uV;`v1^mlbZ*m|u;O{)}+%{f1s%6POZ5J)yfu8Q7Pi
zsrCh?(JlZ~OFFFlgs273qn1^3tx|VNd9)i9F7erYHU=eS8D8h*8MVs?+=chf1zho?
zTS(s~mCc&|dTjSlS3^wK%QGNln2!5=74C_jpD#s3nZkws76ldsAG-PHxY5Zew`6-)
z?i3C+%S#jyT_Y9McdXnhp2pWTy?n7bHSK3GATC?--L;i_aPMrwNkJr$Al4k(j?nGR
zlc}p_vUqQg^|P;3N7+AJ|1{pb1vfAvNqrahhQ6~Rt0(o%jv>m?2VP~*Zf+HOCF<vD
zsegviS%Z=uj&{Hb86uTVG-r;*C^*Ibi3OD6)08}_pIvk<KYRymymxZ_E4$Q5qogdo
zA*dP`p6e!Lq_{cfMgH~Q^Lz?`=ZT(H>H!;KvywptnZDrAs<bU2DSmiiT&c~UFOWR8
z7JBmWczN5(#YWcea~^wo`cfiWwx%dB*b(2odz$9HT1)N^8g>cjuFEf9(*#b67JgEv
zz<Gjn4Z)?CR^M5a_OVx2xK_w}Yty$R%4dD0O<DH)A5u>QF#Nsr-e$Msrh!BIwhPmf
z%BG^Hx#(6m)mobr&&Uk=Be8H0Otow9&U!mvwq7FOUdTTyI+y!U>;`LBcUjTDz40)*
zYx{MBqgHV{thANHzJE2aqIWm9O71KkiTAk>CrMdz{MVbOGf&)c+UT!y*!aP=(dT(v
zw>^&l#`YmZ)RSuNTyh`NN!Xoz|E!+_p2sUoT+pkyEOTC({2OK$!m!!8A<olYH^@v>
zvd=<tj`BnI9UrZ^zHTd}9;I&fNY8Ht*1LC|EPd7mih9S&qCV9hdr}oCo!ZX*?c)jO
zkUZzgD;ux97qH$&u{<P+Yt|%&lj?ovmw)ekUOjhC4a^YH=+qz+bZ}CMhS=*r*xSKb
zCU!qix8gQG_gp0Rj)&9AN}u6Pr6?kfv+Ft_qeT+#*4n{1G4>G_``Fk7FXiMpXIqva
zIqsAfg~Prnxs^SZ&!O(A1BDoEEv%O&I{`7+jyyR#!q))tITu+cY2^S~-bg{}Q%SVy
zZZ<vFCu(ceE=KNn%?|KZOf@IBbHloFV=jG{)0R8r>|fq@!hO)#IUF}A?B9Ut0ChrJ
zgFAUuW=uwp!yeo(o0YDT)z@PSyHw_~*%8z7^a;!e1TREwI)`ne*+2e17nVH2(HSdW
zHdf(!&o6^AVL&m-H+ol=YEZbbGNh>rJQim$-DV{`YppA2-VtDhqK?X7>_titw79<{
ztoB9pRo|tL&V8HNOIlVHByKf4CVNGx!nXBVgE-&OWY6VLyNKiEZBdbOe1k9Tbd&^j
z2Ra*nh&}SOSYw78iI)Z0N=N2dg#2qNeek$~BX3(Hc^T@qr>K2~5R<n4i99=ki`KaO
zNNihLQa~r_%QwY|V_jS&J?o%A(;s{=Ifwkmoi~GHio;vV_uyKE=+-Hf!IUB!1~-Gk
z-X@!En9^h0pfnNbdP;ZAj`k{J*`RZGR`hZC^lgvRjS}g3s@(HI;lzp7vl(wdf?2RT
zwI}V?jos2AY3j_I-cEr=7>BhBTdG!9RP7cM^hSvr(S=G|bb{6~?P2TE%cegbRPE`s
zCav<daV??_`OU>A1D?97-{-QSAhU?~uBY(!d9R!U4uxfxliC+VYLLEz+4YDdbK?rk
zF`aS=GqQrygy^AK&pi#%-C1Z<U#;i2P&3ZWPV~z|YZzwp@>)aG217x441qfni{Mz7
zTPE*}lLjs?^O5h4`^(TU`SXy*$#(eK7>>-9pzl-R6l2BjKRI%*%X-MN{&ZIymXPVw
z*VKHnG)mDvJZAK|<ZRxU+l66PYt#M5rw4p(b}`FpN+FOPI;Qm=w_0VThEss(A6jWn
zeGC5v4d>t?(^XtYohA5ap)q^m`4I#sux{jGSGlzk(gGHrTvqMkv`20ki;r<2%GaC?
zB_Fzfq7y_jl(s2hSzi8{>UEHjN=Ri@Hc3y0!d{U|^rYRcvI7Aunk4mEW!eut7oP2K
z967sk(-o~FXJf8h{Mi5Zu`ODFFX})N3KcgvCCwKvOSw_RO{zn(?0ARM0zx!#xoRuO
zS3o0H>ZGepxm|u|Kgz5xyA{YZVC8toZDV;Y6HnJyR&>u8r#k)|eWX(imh-%H9Hj8k
z21xB0WV8XZLWBvrUo}1--h*GrDghTarHGjT2WZR!bs8yvr;cu{AY3Ka8Mo?8VJmJ_
zxl8uukbuSJV!A5HZ>(zXx7@5@pMU}5SQjd}JKx%bD0yG^X;^X$SB;1pIWjl=-1nq7
z{Okx&?^T`0v~OasIHe>h&`uWIQS%sK>&J*V)5RbXOQ!a!3<2eiBCV(*zSmXn{9@43
z=&37Tb<f9I*LgSd==ar0)nfI&&WRUyn!%g!@MN}Ag@$^*J{i+E?;t;CjSK+R^38mY
z_-Do*{OhSkyeZbh0blgNlMR>yqU%drO``J!qz1W*w+MzHZEackopHhv7N`bxSm|jy
zJ&9k$C?#pBcFU4DIjPPkQa`S5XWLtrOG3|mlKG}oiSRIT_0W-ANSZ!}7?Gx$Bfn~V
z$xO$+lrs1CvaR#Sv9)s3+mA*~ziYR)SFiAF53JNJFo(NM-8N1&IeDmOx^lE&s&t6#
zQgbcDUa9-<x{8vDYt)dKj1=1g8n4oEgJkqOz7)7g3w6}Vd>;hQ^1~Jb58?z~K&GL2
zA|K#ZvX@uOhMEepeL*K`jGGW$buqMXEU02riTHa_t5cI(uR&jZ1Lbn`<1;AF%HwF;
z$?hpO(L#fiBQ%9Lb_%#57KG<DR^5HrVtp}liA}1Qq)+4CxYUYkN;B`Sa`<gJw&iLe
z9WyLP?>{0-oQF0xE0iAJn%H5CbF2+rBgGXVkyoFS5}D{`Ta`h*q5vYzMb%+2k;2v5
z(Za!dO}h2*=9@L<tRM;T_U?kHqLF^<Q18<`c|q!jh#Z+BBa7Au=G`t!QhvTJL&JOm
zlV2w#c%4&-@Q+M?fPKG)?=M`Ak{X8bvgYT=Kr=*>n7{(VV_jCvwLXfP-MxX##p8xa
zoqHMFu@tu$)z6Q7phx@Hc*_C{UMf-Pa)&iym=v^w8Tp)a_eZZQS$F8vOLzYL^l!gb
zz`u>DPtv!vEQe-b2hGm#4e7W7(gi}lvx2WKNp8Fo*1{<PNE07tfGuQv@8A(4HX#m7
zt92N^de|iUh2)OArG$o8S2>$MI#+yCLglYFOnq?Z_esqOp%L^63S}oCK@ykWAnss$
ztN#qMWZ}d)5$R<Wa&qj9g{^Z{mzA-7WlJd0c<3jexx$P<#yQK6>G6^oY0V3t;wyat
zj*G6W)cRZoJ23`uln9iYjuTJ|JQxRmgO3mv2`B9{!+O7JXb{)1gpEet*Q?wLeT-`U
zuF>gsAV2nC%{CHsiux|mR-y-S%MY@hBn3_lpLw6g=d$nG#?;i!wvXjF7x6SE`JyLy
z;0B=<!UW`8n;}HI$NXR73>C*vJvqK1ZMCdCA#8&W1-2XK#{%_Z55J#eUhfno66n|+
zKz)IKbSadGNE1t*R3?2Omv>05f4I=&IxN!q(yvZKM1KS7fD=@TyGaJn;>a0rlW-ex
zQRQ~8AEmpq+8jG4EiUbLKGi{4J>zpJufY3w=j*(soB&e4KezO4#gl{+<u#qHeTw+|
zxl~GcfUvY#wSub{R>wOK(piIwf7B_M8QVmL+_Zi#tBI5_SB~|1@2`=sep1nMzWsGp
z7H!<M4D6}zpGQKyyh6-MXB8Efv#e8Irv!?_wG?g&N0?ukP!Ae#R0N`K${)+?60RbK
zm&g%mD?7l^!MrierbzCYAfX}}sM}Fqhr=52eN?rE>tkpAiRD(Wu(4Z}l(*@hin0f1
zz5Hx=L63Yne%=1zL`V^?-9u^-zAtRR<+TV-^^N?iMmR+1%_t)W1!8R2hOV%+{S&jv
z*v_8PzY`sHnPxp^@!k6TOIs|yq4SKNirQauHf01{S>3%kWw_HmNJF*p|Mc^I15@HZ
zwa5SE2M%TgYQ~*!t$?)c+KF-e$_&WUkZ8^_m9hMf!2`(+*djFc>?3#^%@UGcbwe=z
z#<cW&ee&EvKJ$uqj;~SKJ<GJY>lH3<Y$XyZnJ3u0Gd!#ioyC@->Pppd5q~8sppLIa
z@+L(SH}p<Z)w>SL-`}8*6fjTA;?!?(ON_9@OqA0w$Bkyrm{@b9Hpl#eFJxp}*BxYT
z_Xn#&a434D1W^_m&s&<B$Krxa47QLpJL363<YDj9<8aQwIJ<E-Cn|sD{{8zdtD*H{
zrZxVaS3thY`P{fob<{?F_ruN^zgTm+bh_Xm^%ySwKOvBHh$tJ;!q%dd5@92$zYX{=
zAke0JD7nFOr+mNQ;QdDfXwcrWI~!|yXUs!!KX=b8x)f*mW7uH6@4nXjQii2*EA3QD
zn{!b$@GQn)6gS~ih6#!+7)1}Tc;nVGqiPnSZa_3Bk99bQ5sTWxHk_VF`V1X?L351w
z+Y&v;BRy4{ACIQQy|q(tGJN#U4ETN)4!Xa{Y_?1(D+mnUtT8vJcnni62kK6UAV?8{
za+O3vtuUOgGu?KJsMm{`q8W|YvJ!bbSF#0)uX&57X@<~s$B$(nDDWx!1kyu&De*Tf
zA8bkm#Xx4L#qd3g!i-hCHyWmp?=IL2_Zo%N{#vsfd^fhDKPnBd#yM{(BHI8#GyWr(
zDhH+p)f?5M`pHHb(#(}^H`y*CwS8j+{)PkIPvUNETzv$;ibkhguNW>DbENm(H$5%x
z;7N5l_7MMs?*@W$tqWgNnet)sBru^lrM9XSpAV@2!n9QfqMF6RMqF%#b`-Bozl|X#
zt+AQ|S-L4p9@h|UJ}k?Mj>~#hE_;=>xw2FGAu9CXpi>9W!@j|&_by1%?xd9jsaAL^
zCe>W_s$BL#U~yg`+z=Y57H3VAn;KQgK>>1N_4HmYg-RJ3rYFq`${u7lh6Z>uLwsk?
zHN44sl=j01pDe~-n&%a9aHrnT4N^?HYJqLW;P6>I+lY(A;|c>?2zoiORgO8QT^=4N
z7(X^d&gu8`7&D5`t_T?}NUfu^guzMq=_y|Pg=a~NyfoCms6h$s{a1}al43jXBJfzN
z0Z9kbW_!rW>soBv9dspxwf(HTLvqtZ(ZB4H4AgZJwWYOBx1KOr9M|n?SJ2B*b9evq
z#PN}bko+6dOye^X-SR=T)<sE!p*+a<hPn)=u|^YhltqAw)y$BgI~w69`*5_6r$=qR
zjIHjOZd=ascI>t$8Tk&cONP!s?#eME@0e5|iFoGZ(%>Xq9vn*t3Xe;-22mS@L%@Rh
zT>oZR7hdlY`4$O&^D8Hoq#w2#P4YNMz_Hp6bzK_tz*Fs9rspnXSSDI>AJa={f<a%K
za#unKV@VPt$S-g~K-Hf=<!XK)l}=4ARC-}e6lSC~2NdUnfPUqDP~ND>%4WH_$vso)
z>cqV9;GYco+yuW-l9EGm2lnPV`30JE+t}V69P*?(1@8XGP5<<8HK>lvC|AH!pX7_g
zy21e`k@LLF!ZjaOh$2F!mlIw(w7HhFW`>VLqw6Y?8}N%q|9ImwY}&V})2hvc<>vC~
z_1&{{Z+aeG@NH@i8uhwY*kEwjy6ln3D-r$<h+2~d`Irt@xtDcbgw%2eg$j=+>f1GI
z4{&|?E7*pj)(!Q28As6saJd<q#a0nFCpT6=(|g_+lWmxe4xZ@bi%mLaQtdj2afXFi
zg=5KGXVBn}|7t1jD*WL#ArYu;#J)%MWcM5GNU9Yp>NzIUp&`%bOmi~XKD}%bmv!<a
znw8~2*_gtNFD$j#(41z_QDEGVbWrc;kEJx6&zxn3UPExw?ej}hul!c3i9#R4!WZgF
zzUUFns47VLBO0O@QU3#}>#wV8Oq#FAZN-MyrW5qeq=Eq5*67nVw!`+c6|9I;az9@|
z)SqRP3yGwtUwT~YkAw?o;}yG7gX`WO!wET&LP&AZAEu~a95d@4fi3=C%rvdd1EU|o
zU&J4}r{OT*cU=CLo4_pYRoGU(Y!X>s8Z&L)wrpeG<2Q8uF^Vs}%VYP$)9(4s{^9u7
zA7CfJbl^y^a3312bjMo5cBr{EI7j6=)hTuINLSc4>~+mIomHE)``NZ!A(~TPG0k7O
zovCuOjg7vQ)2(urwbiw^dV@H5Thwn}vS50|f%2r#i`E*ric${hV5=A^=`3y8O;*s=
zfAivw^pQ)-x~+p~Hx#(X!o7^OZozj?3s~J0ci!}vSr>(>$@KU7boLvo<9qOT@jRi*
z;H2V}`YGrFbHFeAQCfYSsV;g~N%ZqHU=EBtN0vHl-2}@rpg~cgNY1}f<US!BocpSA
zi^p7rroDW5crwtrvVVymJ<CU7;Qjgzz#U!lSnxx5+y4^$e*1te8WBB<9jt4jZ;(e;
zzM@!faw})XE^2qUH{4$QT};uw$8KO}a|5Y$53|FDK=O+teGfY@Pgn~IdCgLj^BF8%
zQS(*Ao4<r*e<Joodnr^cs(Pyo#dux%qfJE;+!{}?pso3_$C_dJWk&DvSB=x%?1L5l
z_kQpFojw<uz5tO)+EDWZ^=eL2f>JI<F!~m)7Lu0<O)&sB%0_DU6O9~YZDRaQD`b!$
zrZpTF4M7F$rfN+<u3yE+yb%`zL~op^QzM&<vGlhRt_4BE*&Y4BP;YRyyjmb&<<+OW
zxy(JA*RHL&2h7HOus{7t8q-Sy9(Rq(<Eus+pk{x0_yJ2o$;R4fvY*@FKvM43fY)Oo
zbsU~aP30r@Zm_V8Zp3u4R#_`Q!m4FAzU~uyeYX{7ryg>&sPhsD<QCdo<Q7q-X=Z7R
z_05#zGu;oWs$C9g%}}uo25MMcqdoHmhd>hHe${A&&P039ALN^*beMQ2)x~V;$Z3bo
zc`9Eu1UDbjvNwJwSTyl$)a0Z9yj9TP;g`)WomR06%1gkANHnz&4I+0+YPt)Je(fyv
z;quhylqZvBPgH8m*}#bk{E2I}3_Gc>W7faLtr=vLM|qT`zZpF4u>Z9*{P*1aN!HIB
z!=JB3R4Win$6a{{sohj#$Lee5>!_^71+G&K!DdtSQ#TP^;+E0iTQ-yopT1=BS!Qna
zKLS#$gEbfU2J78lxdun3eKDB*sdu~o&wo<F!-jl0GFFiESx~mG4d6u`%J1oRkv(xk
z)lrWlB%u@Z<Pz!&lfv|}AWv(Xa)y_^(;pW8d#?rH6L)-HsiUF#OMMj)K{*RJnm9-$
z6*txCRXaiZ*Uv+pAK1cO!$#VP8+>*Md@wsSVslItRZ>YX**Ls}rbk18TEc5HMFkQI
z+xoloG@~@!3L)jq=!vYfn}R*s<G^-<swZvmuAA&5Kg$OxDWB{Td-$E~2y`JGlJEY9
zraxm3%>CrDU4y6ndMo@3Ms(u{$DVasX2l-6)^ei!>6412p<k-5`32pv(NH~sS?P<^
zGWfm;=%(lx%+_~Uqn&7?a_a~qj^75qZO_%{?X2NJifzLpX3jIR(O5-7#77nBvHP&I
zACgC(rP#eGi`eMa(Y7>|dC`02EzLQm9EUBPQCC&Di+~2>T}N7gcr&9s&H64;rGx`$
zMEU?r=+UdfhhEW-vOo@XvfU&MTD=?ex<73@zqB&TmqHV`Zmt5*({%V4?(Ki}UwwdW
z{wJ6&uvM6R)wsKD9_5_uBSG~`eF|Hi{+~}EY@UD7RX9N5-p}`!J;o{S&4cUz<>7OA
z3fRr=4yz&Em>lPObJWzdW$8FYR5}jO1Po{URpWLSws>aVh)N0|L=N*BL<*;N?TKX7
zGA4FHu7sdEK&k$!(QVi`t%;R`O4P%!9^t35KGh0a>{V<te-66p_5$Uj5=`bk&!1Gj
zYP=(mRw0vjReJDeI!)oE)CvtOpD$_?emTr+#wow&+(72|qzg>=?-S{`=`i@qZSX?g
ze${wMCHYS&E$x!Azo)lpr~sz;XpAkX`>OG0vuY&`tK}CbV2NQJK)>q&A)+E|fd7d_
z;svSy$!R95DW+S~aVh^ZV4Y5w9^Cq0zp`CnV7kx;FfdF7I~_NSKueP9?;vRrtmFh(
zH{<u^sT#<w-C)jz<#S|=1l0qoV#imF%9~#`dY_;Z7@|I<IR^5h%r9^dlQzTF*HzD-
zE2+|j-(1q{1H)|6yA}8+i26?kT=6J{r@^vStxbg*x$At$_&9{j<P#SnoUa-l8pvNm
z|39_O|8Kz)$snlKNa2e<s~?aiKeHjuJ$9T|_8@=NFhbtO&-XwTdyllK5AY~}Dd|^0
zrAO_|7xg1w966J-K)Ne$=Bqu3fa{X5#~R8?OlJbVtpdjSDl(9v3jC_kgA}xDzXUlW
zfVv(8DJ;Hfa7hWYxo*5MsSU0cZik>hIAh1&DIvY+zbAt?=Ekfi{LhQ~<O6dIq?EA5
zSK(Vb;agcSS#AL@XD%JXw`;#8s7wHC+LBFD{K3)YPY;fyXsAD`|3=;lU?wWR<1a>L
zG~1#4!iQ<|od3=U(Slj}rN#&uk5FeraiADV89-MofJq9nNHC(_H#u{A#R3hi6a;Z$
z5k$1}KN!<ySsdkrm8NP}yY}dmYPlA6B2lS<4D_iCVE*+v!*pLU|3wNoE+qmWDN5uk
z=*a-S;iUC@@V)Tz%{V5ccm7C!8}@3V5kHrU`2No&R8JtUZu|06j&v6+kmlz&^)cE~
zfH-%Clky1Yu378^RbG$1@|MsrZri|p6@2HYmKqPbVqtKZV$!EX!r&D4Izp0zW!hS4
ze#!ZNm9#a#w$B$XX2=RZ7&tSe_BhFpf4u_NOosALe6?gM(i7@J0Q7Ospm8#9ac0>1
zX!2isFFqO#c4{QV4D0sIFcuct4hmQ|>yL2uc3WC}6m`uQ-^(xTT!*t!Lx2<g1t8op
ze7|vBje)#PdRF<PpKytT;fRIj?4Aw>ckdBg6klIuXI;6)qVVY5f(g7%mG?*-sjebU
zU0r*BU#Z-sDUK8~Qq*f)KlUh2*BxuqP+O@}NTN}I3$!O&WCU^fa}V=6VF{tp11I*5
zW>jqu^VhIxGJJ#7t$EgTO{d@x+dgB$j&m(+7fW|9Kf2y-N3rbv?MrD!W!=AaOjqKh
zv8`^W41=MK7(C`qa8QeAX(DW<&Y-U^)MSU1p=4;dN0tUE6AZ^{zCkU-oK=7prwHRV
zc5$Jf!Vvu%?P{hi<E1)LJFIroC>^Eb5?_VU1<u)m3FAwB72TGWr?ozrhOdq3-1*Sl
zzH-6-J?^Q0i+?`#YsvTPG`>Cj!y0gm@>VSd2F7Qk_FT<Iuwoh}fg6xlK0m6;JAEw8
ztbL;#*F+i+)>7V794w-*QgAGD!~`R@N4tZ&c;Xr3!p*~%xXVT>Jo9|0EtSRBj{TdC
zHx29H7uiZ{;hggxZI<=zL1$#iO*Adcl6J-?%mF1MnG<QNAxAdKzFk;%Db%?(Z3oEV
z;|x$(W(^cVj77djY3nXZvPUQ3*Dg~<Q@`-E70^Gu>zRVj*wVfVG)QEg1oP(iuouJI
z{WuFz%4IpZA=T|Uwh+A`alP+Y^ydV&TehE8_5n0aO-5XPDe4A4%F{I_s16A?k!&kC
z0y-HJ7b;A`wLewDh&Q9H@VOT)Q62*WA514y_OeZs6Q?p4#eOg2ipde%e>)Ed4Rnl7
z{66;CFSxHhH0ZFL+t6y;v;w{F-Zk=6URV>hk=1gdM7}Utwca);*ep4+l&>?o4u5l6
z6PDgWY!}-_okrY-t{4fb<roNAhLVJO(y{?Gr<S<At6*B$l4?vTdb9qYeqTj!{Ov~+
zmnC;8zDBMEIl?hYR%Bx@=h5k*firCY%}hfS*1w9>IwPYoVf7@GK_nv6KONJ4_YkQC
zxLcHg@TOEN`@~MtXwh!UEO3y^B3LC(U?RZRX4}aoi$Py#&f!KOy^OQS!9=8-kRCl$
zv({sDcr)0)O6*Mn-1*OXtUx%Ygenh;nX=Y%qxNNi*%#Ej3cy^1Hg`~a5<)`c>@`^O
z=U~VDHLQ=g1m4G=VQ=P<@2MD?9%irFC_h@R3}o*^Z?TPoWB~`ewp$h0*9p%eMJQ75
zX;69pbdBuweK2hznmS+T2wOLvwyVcs8@8x4p&4%4;#}RxF}YX2b~|6Lm!LAp!EV)m
z)vzHbAo_n8+k;;f24xAMG!!OTf||?2nX*<KeTJTukBB3is%3)`?|RY=$|_Zb4gX<l
z$a&HYa4<O}dt*39e2|L<9OrjhF@B~x_gYo<bD^`pA<ejVlAB-JdUPFbkdNNd{jcV^
z-%+s!st0sA1pJ5R!byuEMKV+K5Yb}}k91Q4byQ?!SSP-;xv{{pfuql+husBl)bBl<
zmn`=+>Wgu3<oel$>4Pm}s?o-qAOT2KJJt(~Je)Jo^Lwv*deV(fiSU=kNiu(Jl|ig?
z7nsm+`pXnlhTZFNOk!a_(l%L}@4I}jx7HhHlc?L7DqoPHckYX~p?cW=R9w|f$l1#9
z^1B$Y{rC>;7NLv`afu|o2;;#4CwPt_TL*hy+O68_MY=|`VB^thadprM8Tm$G)sGh+
z503qgHrEGxR*I%p($hA}40xfB$r&`d=XdRasoOq{xOGfrK5L(eLk@I@lRVfbp->Ck
zC1`6niWBrljcD~qzp&OQ?b!q0Ib!MvS(j~zmRyt|i-hCBp^b?-H&j0|NAL-z7P4D&
zimMkLf(visZnDiK%%#q`6l(S}vD*75zf>EMmK>*`sc!((#zeP5r*(`0sRXIxu25Y;
zqkU7N8wfY--nHFu*dPvBZE3AOn_1bzb{a{D8Qvhvi989Gyxh=$0Ke=ve*D3d!R(x%
zoc<xl9N%4(@X#A_Elh6`rer;Phs^0Fww_g~*wy<`R(`G2!nvX5yZiP0)rdD|t=}>5
zkt<D3iEK(06Be+ka>LlbFW@$OhdDWg8x79R+P2~E?eDf7&|qItu7v^kk<XwFe$_ZB
zk4jc<P%V_>8p~u06APwp1^(Ix00vWM6z~5uez@MHO3rEEtN`EW%?)-}>6QRC>kdu?
zu<j_27I)83JuDf!4tEzy_Ym_?*!~yjz@0vWbCvf9Ar^Z0Nas1r23WdcERGPvrshJ)
zG2uDqhTZGr2ZPSbY2zKJE%Y;kD{<G!C!G)e8n<h0x-FhSr#+ydwJ-3b_rtN2ICZY}
z5MQ<zCxDh{1~hq+*3O&2gZgx87(T3%v<P>z6j{a^Jb(^bCV;7t%)7zD>8GeVhI8%k
zhTbq6)wk3Hg9!}Zd5Maw@JaIAApg!~!y(y>dN?-6zpMtzc#tDrix2C?%K||4!b3hn
zR;MH9aN#sfOxqV*mb@SOtZhY0^Tb?3_Q7_QX8xPnZ1kZ(c(jY;M~>@Lq^<3p&byy#
z*ksgG9_}wZC~L$XvFB>8E;%u-NXOUBKt8I3qwWI8Dk38IOdPtI@ceJY8-HB@b~!f?
zU8_{&bYGQ8rs{WDbbOWL6%h_S#M7<zYp}Du&Q<9GGV|(BACQvZ={Yqd2VZ`Y(ssAd
zmy-CNV{vEP@b*zn{(P%@6TbX|RH=m2qr|Nt6erRKuTr9A&!s$}@!|i6vo{TE>Wtcj
zgNP`I5kXK8;*1tCRi=uNU{O&KP*Fh;Qj5wYrWTM0F&jk)Lm_p73YCBgs7%VJ5Q)rH
zs?0<{$$-i%I|^Z!?8I+j&-<SDI`8#;-#O=pUYA66p8X8#S!><vz8C6H!(D6vbjy}K
zZSSwigf%lCa|c=yxY`8+D6h9RAnn7L!DjBgK!N*=@vXUOHSHv~_NkSc!pG|PifFL+
zYKkj-zm|o{S3at3R6ilO(?p)u1q4{SW)qF@IXH{nQrBqQnpxhyOB8H!6eTve#>y&K
zOWUV(J3*u0a@_iuApdmtL}`~Gy{?-@Y70HE2#O}O;VjNk!Zm$x;_^9V3so;)sma`e
zxm_q6o|*m)TECgrX8eG5Fdb7JsvmdZ);SD`yot1gwZ^-D$Y+J1bktQlpptTRec~y~
zv)~gC1EnLWHde7S{s8p82DK|H_MPK+5Sm)YH=@i@zBHIfq%6gr6}H6i+zJ3PG(+Do
z5_(_KOPU}0_mUfk@x}|Ki|%GM|G>y+?g+Zqd?%2u^}M6#Q}wG~Rueu8q4)WMV{(@A
zdB$>-n?wyF_XxZ&Z!z>;?v0Is`&8ExYZB+y2dk77*z|XgIGcEMDVH)j8f6syPI_=5
zu2|C1pfmIZOE5J%F*$!~RaTG*u!R2k-$Gd)^L_c42?Q;d<SfSB24kY)8fC#Kq94Xp
z^S{c7ZuqsP2s%u%NUfoxiGQ8h)NxSCuBR<wIMyB*sf?+AKOCVh>kI15F3ZV{%pI<<
z@^pD{&R<2AT2IHUn?aor&3&F>hTR-+ebeE^uJuuGEh8?$t_=W(9@gDx^k}bDs_O9(
z{qvyUXVSn~g7Lj0y-r?}IDsZy=L9b<`&O{$54V3;9YL^_;c%g2o8YQ(#e94g!@>HQ
zse$H>8=)hka&s^vw%XFG7SF83#298!h$1~Fp!&Nu{8$0*iLIjNF!ywY+S%BxrY{<<
zwyjJDH1M&qy~}pZ!`v&AxBcoeNhQ>B;dmtMnge~Tm(&&Sv8!?oTm@T&j`Os`=>x(9
zVM*6?3@=O?S(Bkz$ty0Cx@3#(=G4iaV8Z)rL;OQ%!^$;MJucb-y=Rt-onD1B9yQ=x
zDV&_o^vxt7b0?udbex0hR46qE<+HbhB}+RHV0{X)k7)p%6>~;usr8^t2SMt5tg8NZ
z+@{NNIsGhizb)}TrXwNNUHn<#A`P4BG{`8s8`R5=3r!3@+AMdgOYu}wLiU%lI4YuL
z9O55!Q^=$t!AOt15uk{~QclkovHm5>n%!wMPMPba{`pcRdw{6NuoG1#9zmDN$_6G9
z_}b%;EY!eaK9(bki9~29`|LrV$NKp7mDPq_whnhj?N>OCLExpX$?B(}F8ru+q$Ird
zHc8}I&ySfguF4-}X>};AF=`WQWhZlieq7Nf%iAG4(DE#iYrJrgEuT2zv%0zy-)oj!
zGOxtKpu6Bf%c<}nwSm3^YJf=q{b{|T8v6GM36}JpBFWiAlqhD`(R4-)c4rTGDCaY*
zn|kL}3<Ogho+{fqpwF9;QxjLWdd*H-i?sI!r}>tJiGFuS^ldT{bIclZH~(1?aq*41
z2t@x>6xA@*WF!!jN!hN7IOT#NehF#p7-}xNq{!ewiv%sEA&BGc2xP5*qxY$r<ZtYA
zQ~ZkP#6GHcsGJvQ&~%As?HgpABzpEMUG1$SB{4uNDK#$4OUtIyGm2>mHtK^S3*5=4
zAgn@J$Rwc%uFHXP6S~}zsmYU;KYr*h`$|w5Y~wkIiALCjQ^(luYkY0qjyw2y4DY2p
z5Wk~*Ig(yuVA)?J`pdGb%l6<!W3J=^kCJL^NKkB1T%iVWFq^&nljNueC`YER;Ie*T
znwF!sdelXf@0duJ?G{l>qA?kzK-udX%yXi?()h02hq<&<s~|a%?st#jb-Ws*-|@zZ
zY7JP?lDzZ@-B<bi#4-`_FFHo%jKjLB-N$a;!xy4-Tz61Jj^_IjW6%+s-1urE231ry
zoK{rJ)yHJDeFxeLZJi|KB}3e0)!V$@;Xi`7dVZjRPioc(WoyT2P>0V8)SvN-4Zcq6
zvh+Tnnl)RnrhXEsaiuK7e?a}}-nrKDiv<l;E$aS9Jr{D909{O7Qk^R$HMG51729`M
zn({zQN;Y2D8WtSd8y7rb8A;a~7I^0EP-Nv<%8Eje`|k)W=m53rTkKp;1qZ&KuMyUg
zY|SO|)bBBuX(1x&99*ZBxl2r+Kdju6ru1s&$A#0-6pY`Lv4JPO`RZYSr_J%b68f04
z`To{1<gtYr`5<4amsLn$rD0GIHUOsOPt3K}SP!kfi%!TW(vMl<mPJFoODB?WKU5(3
z!r(XRN4VS$J^{|0ZbeMB9p+VMCNVqjVd&QFRi`vSl?lB`T`xK;ytn>ccZ#6?9^|js
zN{w4`s0^$*#9GBLY2uc~v|P4GC&yMUx|@kpu`rasvl|L@rfVI1Qk}UCo{hJ18Q1Ik
zw+cQAc;1wxJJdK!JGc6@=(oG>_{)x7?FpC(&c0_)`qM(?Exr{DY*92#+g3;FE9S(L
zc_gWhxGBMc27R_0Z2T)C6{_|9#(cJ0+mx5bC(+Z=6tC@lj8luf`;Pa%)~ySnTWpp-
zQlA`F$Bh)Q8NQF5|MPVbf6Ojy?LkMwcdlsjz{8ebhc0<uND;`cm6sno{nN===}E%*
z)ysb71a43tm}uf-rmo`!a(m@l<0UYEmq)paL-})+t%z15+Yc?KvuBn)hV`cs{WbG0
zrq?K!p@M|XxTk=n+qq7vpKw|_@2cdTWBsVaO6ne$DOgus(zOmMy51oFZ(#-*Ujsv3
z1mAU))dlg?VGz0~*RL}j=7q?EMk&@ErO=o|1NDo|;?&F_>|D;__JV4yA(sA=>b_HG
z4pn2+bDE9su;NRsx=umuj)bI(H8;5%ud3>1`fgC4jcK$X>!J=ey8V0V2`*0N0VLT0
ziBU0Csi8kG(OV_)8^0+X1$y+y>kqJSSsG7T(3M)xT^ML{#&f^1?vu80fc1&B{l>)=
zPpiv7J7jyE(g-l3qIvzEft4Q$bH(Z2WH&ZVaBVDbI+L`lRegknYk!e&#=iiM`7L@B
zerK*2-3K9YmSvF^cD*hf(V7a{?!{HbgyIh^GFG0%+fZ@@qVjmAPVSI$LG;14Nv*(v
z<2-566&)u*>FqfZA+5ApFa8I0SwNWF3#sX??S-Un-DB#{^UuxAeN`rHxjgtZQM+Qo
zOhiQwq+hidp1u>;cl^RNHP_YNeISI0QMO}w5&+#P7R*CZWL))}#H%PtxmpUM-L!-+
zSo3}xlLW7(3eW6j?55?oZco5n$Id&Quj<_mJOgA~0>-!}V_)}fIHXJX96^{Vk?mHn
zfdO9B$Cu2@MeAfP*!DuEk2IN`^-AJ=zPs)Sw0f}cR^6GfLqiy(Bug8s#2odZpFfKf
z*PWt|2!c14MgHA0e4zh$UV}X;lVS>vZ`iCY$k0S9;+ejMP$p2~pP|!g$<YbY%mkPv
z9rr4<x|tOqu*u1^pldK(2Nsn{xH^G3?cFDG8AzR{Re?n7^u&vf(%`LM2?w86l-*F3
zP<uefNDSRh`l~leQ=^fSUkR6dR$>ndaJ%+Y4{3?jQ;|?*h-FxD{b00HMR6zY4&9nE
zw4kY_;=|jqGq#&6n?Z}d^l`VPq1pP2+a0>k=0{O#F>uxA;YbZlxfrKP!y)6aLfP2+
zfgjD&%n~wE>jgfBScRO5$vvTR{x4kdqpYRYSOqJR(3b`M{PL|`*Q@H7tU&hzy$<Kj
zqnbe%-p8p*i)YK5+h((bifeqRQTm)j#!NVhKU&5hd-;$kRuEX8V01dTpW|BMxUyrE
z`N)WuJ?X<&!fc*Vr5y~OBT)l+)0~A2w|7TT-)@egUK3*5wkur#GK7fMFRAb=VdRzK
z2IN}X|9=pHSvn5uBT`dN{hY>qQ>Xj{%X5r6P(VQP)<Fg}4Z#aq;AuU#9bjzHyFuC6
zC5rlzu3Y2-S@=$6&sW0qS^mrm@QUuMqOYT<k4Ts~SLv!RgI_A~??9#k7>A;$t<_P~
zMuAcTqJ)j$4qj#>JzrSe{29J2v^HM|`pws2nooTtyr3%h{IPS2+sNb#X+jjW97tYH
zR8gzzKU-<NTxE;C52Uu8(DGTbaoktJXII+`kiqp!piVYjv?u+|#SP%VZ}<y?)Usc$
z6o!0QIQEY{i3gY=B*Ond{sSF=>G@B1;D1n(RFp4h=ziiqySdPg29m$BeehN4B0#^u
zL5t1<^h1XN=BxN0lm=~`%X%R(za`>7DxqfTWCs;&Dx48|V|PDDm{1mCb&{jmYpcjp
zNmQ4Vjv6H?=Imti_C)>?MlJ4zMeZsuN%iPBS!JC%YGEZX{q@B6rj-Q5gH)W0FaIJb
zaC2$HcgcTNwp;n=Ro=$!?)T%?n0fa4r$|81+F<B8X_toyygf>vSngTT;OqBb$l!cM
zPKwUk{Og%9D^z7{Fc`SOG}xka%y)gRNdjvb(*YBaYc>6=H!=@Ockv?j>>nIc73V|r
zb}KQO4ba-_)+6p$?TyF5DS|&W2FTD0-Zm&r4U$DeVyckJ{a{Zr#KE>kAEb)XNZPql
zt6WqvI6!_r?s~ZW6P&Xg%)PN$LQ}`+M;Yt9%=QdZEFTLj#}D=Qi|?ikxN;i~DjxoT
zXIGY!KW<PLnT)5yqNlS2a3@TH>rE>baCnw-7tGgriMNBOXQk_0rn^CKO8mMhMSaBC
zyP?c&h5gMBysB^C8=BE8pyV;n=06Tx(ei<SZ00WkX9Xw$5{1`u(o$P(35Q*6**bVl
zcm!=qgeo!hV<n7_X>Y4~0>9s3+Q)me|B-iXvFF<>eidnl{~1z^`Cq~=BDC6G*!Goh
zZ3hI?J$o@&_xnxt1_WgXsJ~di4A}8M7$c=7iVS)pe`*gCxEYWM9dO03wj@$z`*GNm
z_sjF_NfPV-f($?~AqPC*dny1Ts4EHJvK}~Vhe=TzX8WQp0x;}`n>8R_HA00IHVEkf
z03D{QWG4XU3xs0Eu~>W^;2!GsnZ%E?5Z|2t4|s6HEV%fsK9AT>!>l5eZr1XR0Q4Bn
zE@k&G*kfQPrh-L@fy>egd3lN&z?JKLLm&TFAmrG80YcKEsBJS*)TRlgCX8g`p;<qD
zY>4t5GU9N~o|G1<qWBxBN#%dJMw6HD6*GYZ<wpR4;J8P705nzOMjexaaSBiS2J_(N
z0O%3Fw$GYDIlSZLpTUNx+i~8Mh*}kC5>!Xo;;?fE>dX(|Vh&9ls`%IiD{vX&IE$bM
z^M&si`S?Zy*WW3+ic;hxaW4E(yDr)xj>;shg|9mI9v-OR_6VK_!RFHA)SgqmYHGS7
zL~3K<O5cy|;Q5=4Q^mTF>g6%@CPK}2#>$n8&lN63{}EJod)drj5mD5e`v7*Et`hs<
zhLD+6^M@*fi5kdZg$ghGEJc&k2fUYb)Ek6D9U|_CPF%JP$qASqIrW%R-%sp%XUWkD
z4C(!&FuN@*E;ua7Zu6S*t}|!C=6~9hNx<@CqcA=XWgmh%2XP1^v{FIcVGvRn5Iiwn
zES-+#Ip$(@wOSG*vkw`F)^RL#$4yC_t(V%Lngz#(J)=sVc80dVWbBUo&_2Z(dqm{%
zmc!g_hZpz4^???F?WQIQiMX?VY^k%gLt;I}9CH^JX)`L0arT!bwA(q>rzzSC`YQ^&
z?>TMGe)ujr?7p`}sylh@=c-oqTBNK9*DaArVTc_31ZF8If<AHhE(r$=?xHC>>phr`
zm~$n~QV??zok*HWiroL?aTl~B4XR0}cSv^gi#)Ki%PeoNqSdEPM_5CZM7A(zSemIW
zGZS4vM4$NBkGxfbJLFrI^Tqn;S3(-|9E7nRjLsK|>j6BB=ka&>ng+EJKqLqyN6HK;
zdK;cBz5=Ou@R({&esdr%V~KKa=1P=^>pIm{uaeRlS`49$>=op+Z~<=pxTI6L6uaiS
zBruI~H8K-7=wKR@Fv1T?8y`#ZUTL~YU)?Tl9`GtSge>SA-50t>6q-qNgRhJBLPUiX
z=Tj>D#NoA(4q<e)nlc{NCwfvi{#)Co*#41qX}gjoM*YX7d6oAbzBG!`f;~?)=8JAo
z%lTu2ayN#f%mTZFI@RmbNUYVj)v66JTCJIS{3Mi&cUP|t__?GLiYhhrlz%}U&alec
zrJ2@c@KKYr$n|c})}WGMSz7R`zwJpmLa8PhUn)?>SHNz=DaKl0S#GFE)h{6@sn|yL
z7}#XB^&k^S6oXQ89F@pF`%I_7lU0PC7uI@Btd_c@J{Yci>)yW^9gGXEz#<#?^DW65
zJ&X=l>{6j&A{X>myiFx~(F4%|!FL!H&cy^}y=@D&ovQ@M!MCVIO#Dh9fsr{125`3M
z1D)wfd&?MA8vDVTRB7Hr9>WQQLCrULbNA)jiI&TV_!a;t8lUIx;^1o#H2LDKg1@A$
zJ+BCevyUHc1b8zA8gU8+QSc%;t?KAq`LEpG$NV6Aa;{7W=TWFM_yg;vVO|LOh}CK-
zegFtQnA10N>YdULiXOvNhB-Rc(Z|TxJ-*l*sRgS!|Fo@%;<pW|A2bMx2-v8m*0}Ct
zB<KN%&1j#ZCnD%2><VK%OgJ`y9WfDqC8SjG#Q{baQtR%_T7(|QT0Z>*yzK)2j(Mqn
z_Ct+($<zzjo7^#H-;<=`^I+GWIrzzzV^(3$geOz!vLBxO@jPt*fSmez9;xgfpPx29
zIiN1hmD?gUwg?@@x1nf!i?m8CxTG{>^fhvg@Kq9I8A#w?m697G<$SFdqKP>7jP>0T
z=_aZ^&sQ?e?cr+koClo9OZt+C$DYuaj?VO_OM>ndKVk2XYJE&onSRZO+wmD}dhb#r
zO;3ToSijEu%uuh(-G@nr_E@thPZ92J6ZWUTcYoWNla=Mk(?|K=E3UhgM#e3XeD*jI
zaL0XfCMiSs*b&zal6Auzd1Dh24@Cy<9fE#2CbfY@G?7xp0uFOiT4UVIV2q{dA1klZ
zP}jISiE{HsmTuKW+TMgu{$^ppo9!Gt+CS-<)wgD<3t6+Yh(BR#6!dRH!{d2|){Ue&
z3{R4-e_ArzIu0kIRdpHq(&WTN*}?1bE7`Hky+3Qoq6_*Q*HCWfd)%n*DBKx-{@1z?
z-9wq`wfsj=5QWIz!uWnEN*+T_lM@#E_b<aZmW5dojw;sl<0C2m@}P8SX6!N^E!W?s
z^_mu`;nx6k{nh)UP>$PD5OC0=XVl@KGs(fmU%i*42Lk^HW@^$f5!-K$`96f`pMAxm
zXvI)CYeg4x7djwrV)K>*9=^YGPQ!hU7FOco_K*>BfLHQmY~JI0FM{&kIE0xsUcZ<d
zxG@-7v%a9tj_`|Y5Jq^8;oF!oPjQR2E+E4F5-+Tv4|@5bwBK;^Tt;7=m5)inOD(Ix
z`m{x<d7lz@c9&h;+Oof+thrCs5Rgx+#HDDe{JX#ERVItZ)xcis!P*`|0?5(TwwU1n
zH!)*zE51}}>hKg?ma`ON+_sgsR1!3yHL@(xvo%X<oSO7wv$J$whF@FRU%@`>J1v6x
z#%=b_)ps)`u$KQzt5=b4k;BzoqYBHDjg+%%T#2k!ntHW17SSxuP5e}J7mdx95}P9Q
zqozo@!zo(2j`h9klL~AC^?jB-s|-r?Ha*5TQPJhoI3lSV*CY8ot0cVV1BA8O1lOg?
z=3=h;O(c$R{$v|kY<9M3hk!>zryC+@^+wh;;Spu^dN%8XNv|&r?iB|cdUbs&u+SoV
zcdcPNK9w3NZ;EBl5<R*@gUswz!7)`XNH@V(%us)Bx$G+oP82sQTYT%z4~VX_+No#^
z#~7)7^cmcOD;EA-H2r0U33cJ_B-uf<YW%L;T)CJ70;yY>%WQ3QRR`$UW;oL|OxH05
z`WC5i^hIwVB}KT2U@mO&1bD<@Y#Z;_O$CS;ZpoNp=CX;EtI6Z8n0@1u-M@#qjz=%E
zdD5OlKukOTjRX)E&<F%BbyFh^Jz(ffl_e>1PDyFCEj|0T$E4O;rC71|OW94^#y9^R
z?pT-Vd4($7h|b;G_tt~PC^ig=FLSz?(Ny=@wC{M}Q4wkA8A=AdSTngf)26Ljhp7e)
z<f$=SVklHn&FXGB?u*`E{N=;Sw=^H#Pj3Op=^#vdrexW5jn}DtIlJt;@1i2L{-d;r
z1u_K=R8b029FFUzizlH0^SJ2ACOjzDYb(Qaz$B(%Y;q#rNAu4G3lH`Lo$hydI2640
zw`rDP_t7tVpT70}>9WZ2mrT+}ZMZ?qVLzY70js%ug2}ipHfd-^#wX@O^{Url&@c?z
z-|^`Tk1VCu&YbF8{MN@~?W<qX=y9c?{PvE9jAcQ6&0ONUK&x$)&pM{G%nw!(@PYsE
zIKMfbsx#o8US3pz>lrbF!G$zBljb|rRF_7=H>+W(v*`qlGl4WZ6^*;aN$9aSAvGN1
z_xbJu(5E-Ij@u`MD8pfKtNNsh^b-x+9-`C*RIs8BJrWAG_Q$e`@p+gAYXvt+^Mq_U
ztCzJ5soiGExUSUM5d^OB38WVC1FJ56Fq(@5T}=E%{j;5X9yFlm2Me+FQ@P0&v>vE=
ztWFdY<J_$(bK`jG16qrk8~dT;^vbn%)5u-Y^H;_1{QfR&<++FCczO=?7M9&pqzoQ!
z-&C4sM3?_)rny7;iXdMD67VasU@B=?3)<8u)F|WsR!u~6;s@SojMjO+euj>U`D~uy
zfS2={gFVI%h-~~w?%hBiQdQ>}rozhG%_%bYXnXr-iSuT;D_?KATtwQ)szp#oVIOcU
z&BY{r++J}@xeQXdQMi8L4snuWqmQ|Ccd7_kG(uS$xo2X+f=mpw>2NfzdN9;&ZE&&w
zsan+U0S88U_f~~QV%kxZ7{wjF=-mYN9eJz)^=sl9DOW+ZySzw5jZHIaiszlAknq`F
zC`q`(J<QjYw%t=|2wfJ>cb>HX&}EqNSfbg-$aXf_Rr0LsY}c9m!qai8P1K*s*y>zd
zm!#BKfHu2f&2l^D`i}M3iBpBnVyGLTP^D)%A}y1K%Ix?wyHm_%y<=BfBwj{yK9R=W
z`MGz9F0L1NnESU0T^|ltKFdf`8G^!6=yIxnsk8>Fng&)h@RiU&jZRxsfDSyr+7LP5
z)Do+-Y2_jL44VCFw@Aq=FZ(v5shwzfoc22DqB1)D96i(HWmuBeSejWz_Jd=DUy;X9
z=m-gijdBLQq8$4N)fc;55o%gG`yFXxZj;cAF~M$ht&dsik5#G8-IgSczR@$+M<dp!
z=l9WutZiQ1v5XQxv*>-ve!LFy&rx%PvqZ?bCa|fKS#`8|mQ)U8f>=63M3ldy%i@`N
z{mgWfE&UGTldFbfev8bEdQ7@5IiV#yo52b`<Yc#M>Xxt7fxxtsTLI_RI!9_}Y60s@
zIbR1}`Flk%OM^j|T>@ps=(?HkI+}sgd8Jk-Wi>Xj1J!#VxozB8e-*pCyLIZ8{-N~R
znH#TcJvWzF=%GPddYzD*#M|F_naUq6TJx<W8v;xR<R?<hdA{Lnle~yuap>gIVc*R=
zfyx^^!BCTHDtiBH_4F^n-j%9afB<vYJC~2bo$X<-4s8gH<SzCO=vAfd0*xxmluQ-H
zJTR=5_u#_kHUR+hJ?phLa|_Zl$=LT7a|yk7jdJmcffnpY|9%=8qeWKgEO)E-6SuZj
zH&T`>N-wf!?esx$G4nf%?=wl@Rn~;Uqb`5pUP3h8l^VM<bT~35#kR@{LGMB=K$%Y`
zCE1WMN50q}EVscY%G*sY;F!-}CeV0e7%kBW0v*y;^<mesBPO^JBw-fjqNd8FH>mSz
z;zy`n8iiy%z5omh%KV8kf5}^p22$$_E}q2$iL1F>eN1&HW#z#FE;z2fx81E9&;LYx
zLB`0i0yV#+*K+5An>1xHq+E#9I^5@~kZUH!T(LvB5=3@3_dUsgt5!9{mc*gC_*#b=
z8hVp7zC&z2z`-20_%qKvQT^x9H|y62Z6JA$1FqT_@~ul%g``EFQR3Ckvz+Zx6||2p
z03sw!d$a-#h#;|XYS!>C-hmOXEAmIekM^FwnH|tA(4R?C{H>SryYo4VbCBLwg$b)E
z1nP3I`@Rm#-Iy!NcM5iLE#U{7AH_OEdBN^3)+uer4Ygc)P4nUkrZmk>dL~vTOF|Pq
zZu8xnePq#dQaZFH!gUN~0>xDz@v11B`TEf8h>KQGOsk`bwch46#SQ~@Ya~g6xU=J-
z&0eHAqm`>N>byGh%krL-0^!n~eW0!AH`n`K4ksdWeE`czZ2-@-6b9yfDq$lcKE_-V
z_rhTB2PbJ&P2#4=PV3a~;ypISgBs5t^XAU^MT@{X$^04C-H+A#m7vNGLKZ6P`nO^v
z;H>s;Z*tCh0S2fhLtmSbAZY4!;mgE+5@bOT$USf#GWNAWF~{a-lIW0m@nR0P+xDPI
zTv6y>%x(G2{wg!!kg6)49S1U$&LlyKTr3hQx7m~Q@RhTgrJ@|}V?dia#Np40S6C{b
z*bKO3NuBZLib^cVH;boV=@%F3?6AKJDYbP!RkZUnMz0sDTXNNRNKQ$UOU(YRUP06J
z#ESMw$!`in3qo8VQhJX6_eklz<^XLh7mo4|iZZGw=PN;nLSXu$`oH0bJPa#oC~+N7
zP(31p%t$+0H(89^l}_kZSFOFu@B>3);i}%8X?>;akIla5G`_|h3wLf+`yk7{Hw@^)
zX{3G=A9bhAtQV?79ELHhA*X*p{S_5;Ax0zU5n<1OQp4#1Q%{l1)Rs)Jx#g*K1ttys
z#@H>9P`AhH7=z}7UC{A&w;AK=rFu}&-+XY>F8U{1&3p{;>OB1vB1FsE4&v9(#HOR8
z<BqkdB~gfn+Y4|`Loew3Ond{8+u=Vx6Cn<zZYR#%?il}q3}$??9<YVzCmYR^!IcTA
z+?pSO0fQuw=8sjAW}~07MH~rvImVU6bt%6KRIO`gIM&N%ZjX#sAWL{|g{4OgTpr{z
zE&)5j$>_6Fp7&o@hsrtGp2v^(5H1crL~05V*ze~1JHyt2MtzlAFs1R+KcVl)1MZg#
zE$!@ky<YtAxTE01(~5*hc?s!iz{2a#uf5%CVEZ^v|G*-Waz0e%V4M6dLGQifYE2m6
zuZ$2MG`F6*z`v;$WD8oZRBsB{n8`Fp8*{~qAn$e_6#~S>8B(&Oq;1kQ!N4TW%r+<o
zGu_u!FwP9gbqba)X?DJBwv}YCGn3S=Uw;b%MH=SrLlLTv_3J1X7wLYYYVpN~xN%v?
zqlpR<A?{QFCyDR^eH8EMP<WBuY$$!AimEH;L!gR!Eya@Ldy%@Q+WihjeB5F_HmKl&
z(Hdh+%fl6OM{*^q_tp$-o){O}{)kk(W-FeAp$7sQ?5QC@Jqdss#UkvWa4EGk3$v-D
z<EuOeW!G6iiz(tXsddb%hSRB<>M=R=rATdn%yqk5N2$F7Y~Y^CUZ!=@8IPp|rON&P
z+0Xocpbwx4{tbP&Ig36#*H!rk+-Y?e<mDR5YNY2Rw(2Y4K`;SHRRH#&l=v)#s%_so
zu1p2e1Cv6!J?RA*H#Yl9Snn<0g!Ht!!b9#h!T)4Ts!X|$!HsG1Ol}A<cNeRLI#Xf0
z%APb1nUfcOxPG1T5Nx%1GWf7>m^9NyEq+EoJVRCR6sQ2@e>hcytq~}$z2Hx+!M^-k
z(7l0M7LFG{PGaugfG(_-PAD^h;k}QbEQGx5rVhx_pS>8a{Ck9?IBa0~?O94U1pPG}
z&&idwK<R%NWItW8rS_y)NLEIH<$yT$GlLIAgY?~yjLvhay`iFvnN*og`PUGT4;#4X
zIkF<-o^YmBSbhr9^YHN|q@0dt5XZd%V%R8!?>x#*@K^l^HTwUVbe(m9p$JNdtyahH
z_{!ksE7k(6ruk?l5iZo|>--NI!g55>SEMXsKZpAL^nWYu;aUGtX-}KU#6iF9Iv))~
z@H>9>h>S*oy*zxr%AWL*{0#=0oz%Iz;8*;e!Ss+7k3(s57&+cv`!Id9y1xUIxnG6s
ztEjm4@#4JKQ%EsW=agMv!L!1wfr203l^%>(&FAjxpq5VE=pd)MFg#QhCzxb0hlrWh
zrRiU>HM!?8WV{@GeLZ)`W?p=bR}-`~w4vM#TABjdS6(~wR_Jx7JZf0D<xbT7=)w?t
z!+SAvGYHGqP7=cH2&zv_R39`DkRSM^LVU%zoWOcTDrF}iev$9iNRav*loTgMQ<Euc
zaodhbZ>O3F{kY(=1r|^;70}%{ak#XzY!LmeZLeP5W)A(_Lct?%50AYeA!kOOllWYX
z>J1oiz^@LO%RG+JB+k@E5)m9F`aUT=8h6g#`|-`Fjb2HR(YvI#Yh$iiZF%vbg}!x{
zU0JOY-FB~qOM;3J5}ZP)p2s%O$Hrj--(uhK4G@2Czk{)LN4nNR9v5FFZuXdh67<pf
z+Q!JKwn-z)?D(DM90<Wq?!0SSCXP;tKvllK>u;6klsz#0K}byq|0Jl;RwO}sp+tNt
zl|wORy0?b*2^ZIhT;nQ(lb&_+#TU1oQTtey6=bkWmUXv(Z;;(+Q^?))?5?beQtkn(
zocar$D)JrnB*N_0|A`tagd(^ew?^3IEgX#i&sQ%=+RUv|p4HLth}27z)d492)2yHr
zeqj8qF_Qr9eyQ3O^PcMLJN@2$*&niN``+2BD1YSZD|HzIBG(3L9Ccpxx?$2AA1Zc2
zqClQ2$?ZGQcMWjD=!c%Pmu)DZ7xavWX_|)xuYqo5oORh#dAq`cHl=*o{Yhm|_rGZN
zksz(S{O(u6+GrU>uf^9<N5Ee>aTY3y+*WnWZ&q_~*bUA!2YI;}4}cRAE(J&Jh_EJs
zpeTpQx{AEq&ZpDmTPJ$21NIS~d|&m;cBK{@u#9cW7DTq4840Lc*MR5$A*p49YAzhC
zEBp_OXyp@%crJhhQ|IxmnMA+~FK<R(ZbW|K$gL&_$gu7WmCw`o3a}v?Xo^B)Y?a&=
z*h<d0Q6}-(zhLZtGly{S)K9=O(v`2>MAOQ2UWh&EnXrV2r@N1R0ostYn5@jSQ6nI5
zJ);bL{I07AQE;v6Tonh9Qpke-`7MA~@1vp4#DDfo;5v}~XbF-XhBqA-*?^@u1yBi~
zoMp7n=|XIky5eReRdJk4oaKZ5H-bwV`?KN+;JV*F8OQ~6Rt{;6p4$vql_ToofD`}A
ze3{P&=1XrXFkk9~Gxw=}Hs4T}f3_$RkPm0**mqRLt-_?QgnOh%b_C>D=QpEk00wkB
z6+QlyAU8gXOr05>R8a(gFdUf1c}nCZ3~_)8>{g<J#;q_TAV&{>`>lL$MD&0wV>|!@
z3vUYsT)BL<a_;N5PK;A-vS3()J}{^Uk(2Z*mFmx1K-`=4OiYep>842WEn??zaZ3$1
zK0y42oUPN6;~&w~KxR`cr1NfO-jffOpySDT^P+Q|?K*o|w}aMw=zFd5QCLm_fp(>a
znw-gSt5wdO)kyLmkCY&nd8EAlpc(R&F`NXwG5KsSFW%+;KDpQNHYmR|e=ehZ2g+oT
zA$l=kl0PhO@oZ8npR^h}E8li&Vd}%2F}Nk>J%zFE0d<~B&^OU;*k^;{R<-UBqKj{*
zOD421YY8}EN|OKzwE}&8|Fbis3XZkoIuKr0YF#llX@g3$$;czpb&Yq8lOB2?XO0Ef
zWL0*U5h&YW8g9U&b*X2HK&&yAVvKzmm};u!7&5nG9H0X^I!mW(kR`y#%`j}U4KU_j
z%<o}P>xF0<Ltp%<BsVCnn|*K8vpZgP(fBK2f9EC(XW!<|?opSgWe14E0vSc|J5@BQ
zN$TN<3W_cxXIrAEb9u}4FI!At4oY2RYo&V(&riyEu3UP-<a%8tIce&Zlgt5YerWbS
zVtY?ZuD@qdeQ@{@G$WpJOYH3;096jlrdW#uMDUw2GW$6P+f-C%79<LfhlV@C6+CnK
zF2<Sz9hPQ9v3s&|@$sRV@ESgmao;;IT)7gxIe5908Ut6;nl|P7;{l6%M)g@6I+ZJ`
zpr-9rc7UgQ63@O`vul#99);N4P-$ma?~&5tm^87o>hqL{*LMe!Lh93uuL7UA?#>6^
zj*F6KPKV2i(eaEc<!37Vj#YMjEQ#K)mtV1dO0@X<8(9a4lhAHMz8WUDPfxfAS33)b
z5p3x8T37YUxS1xyU9$VS$aMw26K&p=_2w=#gsirTmaWIGs{dviaCfQlwbV7?1QtK=
zhPR{8OBmRObu=spwQNR-AD|}o7z$FK6(~{m6g5fUi|+E5oyO9oo`ZFsn=8=m1DrbV
z)0(7McLVn;_u30L-^CnHiCffhas{eaA}Z23?#W#m@H^8Mb*bz(Nh2+PMbGPHr0$lU
z=BZe6@D;O@bhl$He{7|q^z6OMP(bi{Ik{Se)tq*Fv>|wjgJFN5XKKy%0>=ZDC+!9L
zf@yc_ieFPRMkE36FRW1gQZW!d-XcHFYC}qmx$+~p4{R&0wzAc8lalll71lr7{ITiz
zOvROTXz@-9BKG4ZTQy(tZOt0(fZ}@k&(XD>N0a8JWjDx*&aJ4-xr>DVqA~+pRoeuq
z2}Fj#zJ2kgo&<|^E>z{8rvvmp1bSd4%3ZvaJ-}_67$|U;{aGwEPM6#!OWuZ;ryZ@j
z6PWh>=gB;1wKHRv!4(UkH-<|&IkyLM+S!(GyOEylOu25HV9}SJc+8#(H>hMS$p5%1
zj1gr}?il#OuQx~8YRZ0)vLVMQ1K0d=DyA+0X+9~v!KPxoO{yx<WVA9*cLPD#shwx4
zmjB?Kgr>`A@3QcMoInr05-q$m=vau`b>RB>*y+(406)-6j7V`mU+v>9ksKwCRVkN~
zm5bo#_qdSF!R#5PUkTaok<>wZQq#IrTn7sO%x6LA8YfT~XsWhpD>Dn1y@uLWP<@<`
z2osFgJWc%(?Y<7$Ow$q}R2ZJ{E!f9077q7sKyOaOmU*l1>+(9@!8<6{GOsnT#Ah1g
zvtO#rz{@RW%{~<ws!+oB{;C9e6R;b_<T`F5QeJ^CDU#(#Px6VpgA#5}l`Iu=z7M(C
zmZVZKNSf$425oxu;zR)>vfguENf4MJc7|2k`(vv*Ltl{dZ5^|ob$U7`SS)z;F6ZjQ
zdX;GxxDnJ>A~pVH&J_9nr;5^|)fJs*KINZX+fhA7**vp5YlZ$V&v-??c>z?lGiBbJ
zrE9LH2@ZD9%`7!HUOwLQZbyjjubHY4N5>-zsiHi-F*Q&a$NCOd<ShOZJ%+EdiMQoJ
zpm0UCHSW~4s*|D*M2PBvBb6NmEYlv0T|--HW=oe44X}h}$Xi8RYyvx?KYEu|(rN2`
zHqAMgUB=f5fX3$f^%FfhupCdZV5x>sX>2Xuz^EHHR+pZnqVY_NHe5>t%$SW|LJcP&
zMH~Ly*di6qEnWW#Gq~Urkp7F}-(&HjwXK$Y=|)HJ0C8BE%?F^r8OrCtTtoB{Oa|Dr
zf&N?n9PHpJv8#HZP;KxDX&H|$6?#jpV{xju#o*njdvB=E!tS$7s+b1-8b_NV8kFgh
z?N?7%uXu8K18!H~oF5p$tZgIPQ}<P`fd^+Js2iWa&}>jzcQAwGCb)Aon#-QDix7&Z
z>o{?UUXg92WV*xbUZsuxl})^3z+RvjS4-7C?`{i7vEjytGU#XbpMP-PBxUU{#E;r-
z1L4WLHm*JM*HGQULUxd;>R;dOm}?vxWoS<-5~9u=Y&CVZUPf&X%H}}76}3uexkG2u
zh`b%aVne<WGf+xRWLjr35*vvpg7N~Pjb1Tk`kc0S>Y~GuR*NL3-CdS~XYG^ktX>Md
z+x6^zl#C4Z?Nphn7<YghuNq(z<P<kbxCHSx3aSUM)3t#PopR8rmPFnWF*Um1220Pw
zP=?#ShNd`tN6s+I8nYG|EtzSq?X~g7*j_QrUB>q;f^BBJw>BNBir)mRx?g7tJl+CP
zL5Ld;$Qi)kt5(|uEi~76vF1T1tz!>IXR4!tbT`0Ggw9TVd=ht&@ST74s&3|*6CzqH
zP5a)H)=-*uzziq$)0EkX(i2usb4Jd4hPn%T1jSxabk;jAdX_!@j~u+I-obHGDai{{
z1A(NLD`mm!n;KuB4vn<MmT=@S@}BOsDX;q)4L;o(Xo*1<1;0mmHq8NPOUD}%k^I2&
z)R|AWY%6~pUhrTf&0l>a71x%_egc0o8F!E`!N~R8$Nce2Xo&2bB8|68LR}1$T3l1U
zvxgDVpj_EG>2;;Uw@Mm*d387SG>6m6j)7+Pp7l1r8Iakhq$aVe)4e))dnM`Qd3|pf
zX?^wm8wsDGXBug&3(ltswq54lI_oN{sVMHVKs=gM0$Va9$4L@N>iG;}rk~g%*To|h
zdNwA}xP#PpXDi|-j0zd`w8}0FT<lL-+C?9bCg04&GG_YQcZkQ`>OGxCSCTkL2~Z2C
zl^WOO>zV7&!RLGkcgtd{#I7+Ji{*zH?zO#xb@a=^C64Ui%^$wJZ!Zm|OW1YDaxBrc
zHS0#z8wRV-owKuJVF`foZ#*x2SzvElA%mT9`JqxMtPsZ9ZiEhIO|pb;<pzve<5?zq
zmWg=^YWNG4D~41(J6D#KU35Rz&RU9*YxF1^IyXTs<@S<^dNfFf5wZQ1cc^~H?x*<|
zd8%J#1rdPW4p)vyK<#m@Mc~wm(j(LxJxV*N+WbJ$($S3VK)4Laevu0VG50!afzM);
z8e@EHo$tlF!?d32mC%Vf?0tQUbyC=3&D!#Dds4eI;dGE^;HZsN!QHa@?!<?~sWU;|
zUea@CD!Pk%)8iJ1oad+h&7n5tK@n7dd_Pjdr=o7Iv9wZll5!cQDm#xQf#%k<&kurv
zY9rjMZLsxIDR%`UV8UQxzjWTy2k%D8uMSm~rk#3K+P{W<)N5yX*RIL)U%YEpgfEFg
z?tp-Hu5722I<`eV4_8s7gBjEW)@fgj&k7!2n$%gDU->GTD?ye9PWP|tF4dYN^T;%*
zOH=#wVDrs8yC2nG?eT0}dSP7@)#1MCKM*%X--J2&Q&{Q<yL~H@)JZ*Eu!OV%VmlHi
z3@Va*nC6%Fm@yp&oDCZ*&nIObr^eFBg=3Q~<3!?%6M9)8CoWpdnRZDTaf-Z|_O}<L
zaJPT~d%{H>C;B2qspD;Tf$mmnUF#hwqSZkYYE9|u+c_TCi0K~7i8zA^4sIzStFDWU
z&OIjdb`1*1G;8QC$P<n@olSRht|(0ykndd=r7C~FmauoFN@oUP+HSU1&^U5nA`xUt
zmJVx5i1ASEK!iN6!-bg2AW%fxohW{0IrwwtkExYqAF`|VrXGAuJAZ8VHkByqt32hR
z%c%A9c<Nd5d}SMrpfqKgV2O8>twLfFG!vPK%`ofW9lLM`n-IU38EnojWMmBN?<(8w
zWhFh$$s0O1e4w#Bzyx1YdE>I)xiyc}zqtOFB0Lotbu9ebVS5B&whortAS|XfzN3rv
ziUxx9%v2kGugPSP8#9arrSizX==twEZC6S4>sXu78<mAz+qD5{Sew3ghgsp&b|dP+
z^5U*Cr^rXd(&|~ivj+SO57&fhHE30fENAsZysg%eR<jW?Uwa2wC2GmwCCjSYhKFMc
z$~3)z<fsEZ&v~@W7hz{7=<7aR0@WwU@^$fNZ>|md1?X@K3LrgkN>NM|JxD<oGaclV
z22@xhBvu=G@3=F{*HM}?5@!VxcTN9RxVmHF`g0a3wU(kKoro*rF5Ph_@OwtITe7e&
z@6J%f{uHyqQO_{hGjY1nN!1Bg4hane0Iyj@gCWO}^arFSV-3>FR5pvmZ7^Wh!B`iw
z){T&~r^XFkQkGl3V4CJICPV_bzZV4xDvf`m^BgD~lZ5=KB+t5iRUJ&T6B45CJAb8d
zmpyd@-<N}ZM;sT*3B#1{Va>;`%Xf?-8ce%^=20zBKQ&6Nr7i+OMZ}jQ9Vb%yg-459
zA*(}etaORV+Z(*0jNdtFXlDh{Y#DT%==?-q*^%#CMvw`6)s>o%ms2~UxL>Wqs1VT`
zTY5V@rR3VL1f$+vxfs7Lf>cMm1Y^t*O#U^PAf8MFH<oFEof4CDDVzxDTF;!T#>Hu8
zAN%_>9Vz1#r+9@E6yP&n)@K1fkmhQrd`;OV1^2I6mWEw`GJ{vW!lZ7yt<>K6{*-lS
zE{Ervt>xq@J)MW9gZX^U=S=$;J1>!#I-538R+Y5dYGpHujs%<TXCIKpW{Y0=2y0i8
z_QJ;Sq@Lnn+Z^{O;;Yw=f*EFyvrz=f3exdyAvy4aWh|2NwO)oH8lDi$G|C2Lxey6|
zS<PMLD-t2hRi9~rj`#Mw1$C>V)$6320L#y2RJozS-5jyEL%q*(f-;PMvIX0ukLyOt
z46)#I@bI4$IbnP@vT#s9W;&9hr-&-db)b9$?EvpRhETaB6RGV$iAjY_Yx;dBQtw3R
z_?!Xf4!Wg!`k|*K*AF~-^7O`>mT{OIwPcu}>#RO-0mb`S9i&oOg;Z61CG8zMj&8du
zhe^eDp}loSJ4?&{3=sBx!A&tl1f+4Bi+`4+|7GF*>z4y<*AHE8KCGvDuw(3O!E=jQ
zp(V@=>a|8?R+wupbCCiTHLz$g!(8l>_yCj>qQyobVwg2xNObobryl;SHO^sMk`jbO
zCcS`x*k6kbK}fL{!TXx(&R1rC%**o}J}?sTx+pwC<u8_ij~*?;HiVChMHh9%x#Mo~
zeL-L$t4Tu!LVWFcAL1;dg%sPX)?fa3lT~jrKNq|l$IC0FM;g;Ey@n05z-DAPtNC0c
zB{{`S==0(i6(FBg;QB<RMmjWASO+SwkQXRRt`O5=GBlDUeYGt8Zsl@Z2TNw!ojAAU
z&taRRRnqO^qTiT%1MYb38CTrSYRK0j?Q>*=Hk<x%>uQwkby)*UX)a4htr%qU)`>~I
zEi!huawEg-`OIx)g;=<-j{y&;E0|;Eckps=x3~L|Hl-fJyv7EJw=@k3qOaNWOlnqL
z5R&B(_R#Up-rStWd77=nQA3&bET3T5T)v7qH&sj;Z<AA*MC@3YC@6A*P12<LYnjwS
zO;m}Pq$(USh?$5fU^*8DQj4t{Z`*qchf?)C`7x#2!6MAOn}}hqy6;cXt9*>|X3R0C
z9RwV5beAz)1^({DE!$c17<{Ehh;+1;R2p9U&y<mS9kK{O<`WjrOvThI%!`r1_XER?
z4Wy*lQfjnNwV;5qYShQLJxt4OufUS3KH@e?F>IeQ)iSLYEXWKpIGUouN4ZKZC@#C4
z!90M`MJ;g=+yvxQ%a!nqEv;v!rZKvd)+E%k;Kv(lCmwLKEKD7+GpVJi;(l2H2Gc$J
z^{vzF`0*ejxvp^D?Yx5I$H7Pr=!J*CPTB>xXEF(xXF8_!LXA>#vXu`(+J9Ag+q3C8
zYddCAh;bTx7I!jz7iF2<7S>g9F(+G+$W`|k<8^OWX~7AzY_z5gRP2vGR@MnDoqq&L
zV^*xnOpu6=S%kwZNQCN`dxH(99yln^J=yWL+wY84^h1GQeNkfG08#zjNN-q~qAAw)
zaP?A5Q&O}rH?DM}-$ipzS0W?5-sU?{KQzq=ipc)svg{XP^F$w_Two?Yi`4vp_!BQ9
z^Qu=vALc~caB0N>&<W(iEbAPTTE|V&;wYAhKCPu;Xw#*lDVi2WZfL{gb^Yt4#F#Um
zEFR$7bA&Y)Bt)Xm@UOsLO3^QlLQYWT0S+u0kAoI-m=~aj@>STmER@fd(20yedz75W
z49YBxaK2+?*l7G6TV^P&_gOD>NpXa<h-5x5NP<n>_SAf~%l4o|?TJCz8}-lNAgcX=
zLdB}9jG-t6o+lsM;MeHIkE5<okA;8IqDe;8%Y#~n`NYkoWG%<sWjWaP0O-NZ+>$6(
z2%~YAb*0kHH|gk?=MnW8TN9=m-8@G1`b|1)eI@o<e^5p5IhdIx@B13kc$Vo}ZAT5T
zASJ@Ff)Mky{@VKm)>PFGPoCU}nYVW^Wp6g~#ir!3zn_!-MD+M)NxdBdspCd|^5gh^
zOgiw4F5|RMX=%E(vP=UiQZg0`cxEBuDE^xTqEXtsV;Hg%4NksM^P#jICujT5{OlSM
z`Ae`t<Y<o{L9q%>#dW@@j5>J%RJIGb#mHB}50wO5C?$?J$-Njwvb$_qr&PU(YaB=|
z)2c`)VEXz>!zO}Pc2B<YtiSQNxIMJWYmcq@J?v29i}c;asB!uoPlj<v-EaNNE6_0?
zl3$01>SVNXwae@Q`$}jV{7U#($$9}5z>*==TIgj5*-mdcXq)ZD*GP3_zzmg)PV})G
z`^h}1EKgeEA;=HCZC+=y->o+{5vNI4eX@AxSl1-p9CP=rBP9CgP!})~cM5E`$!Kio
zyBsdL5N2jr)BC&ntnA3bR0u_akak!8i6VTZtq$<#zGM<5rVXU!aCEYuC=}`IkkIN$
zOPPDHt7xul5YTPrjsU57!;BJo*a_-At4kza{^YW4wvOwc=_fE@jI~O$_KDC}bQhbO
zMRB$!MMKjDdL=p8uhNFY=c~vTa?xMialH(W_woE-b<NclXMBO=aO#JX8Y74Q_?RdP
zbkd1(=~*3m)o|f&`MRy@gOF>NpJxeZ#YIhaG}#U4@F{GBChvU`OX(b}q{;eP0Lzlw
zm?z<uQl8j`XJK+@sbefNMAqCK+ciMh+!l7-x2VQfVn!XS{B%2a#43}NIn#u%0Q;cE
z6<8#>?R=&vvs|`mD#>QrsVdzOTP`<eguBP~9Vky}zYzKivB$RLi~>z}#i5d8K?a-e
zp2!PGHC_5CJu>LRLi0@Z!RfIg`30qb``EF8sEwb3D$#9>Tyar7eYpp1xO%I=r=zal
zvP_y(o_&5Mrh`#c$6Z_sa+tmi`gaeec<<{tBnS;sIJ$P`q#t-xRnAL0_7*&~rASQ!
z6+H%|P+ENkQ9upWIuc4-I%LxnTNc||t)YCSTq4kS5`@Y@6EE1X!ABRfy90iL&Hd8K
zKZYR*+x__7=#1qX_Q5vrS9kaJj;x%eO#xc9fjxd(u7=%hWNlI0pnz(h*r!ZNbaFOn
z9GM|S+eY4Dq%13&ALbM}4(wkYTk8R`W^+-`yIM(8gXUe6_)TWyvWt|KqtUM2Q;A-!
z#7EWZW*uNE>OoA*P?3h$kqwnSp6``J>1*~yXouRzpo>iaF%lUCPVDNu``J>{6c9Fb
zv12UnM3$oX?X!Z0*D-~|6~Fd6+vOd<m~mm?7h>bA?Af>WdjEG)c_VJM{Lh;hA<E}A
zRAu@&AjB}n=m!4#X8tLT+-3nlM28t56V+lIMR};W@|Ey@n(vFqZHju}>>VAv0zqlk
zeN~JKzw`<|426Sv5qVQ2-v>BspD2caXamaet(%pKVg<Z?9`|#~geqV$ORyf`|BPo7
zkX!(?H}Z?!@q#?qX7Hqv<xmKaHB0~b0u;1N;>gP=>R)+E&FjFYIRkR6V^2nCGrq0&
zRX<;gqCTNx=9)?e&__q)^OP^CGe_jRfhu?88+vXCA)E<(n_50RwV@rEvQpgn7cfHm
zyO8%AA0Pt7pz_9EdtG>swTP&d|Icp62D;pinn0R?8Wq2n1jV3&4=)B@eK1FEf%H1g
z(&c^|QpHcqW^Se+=^K3p0jT;hTk+N%pz0<X3>t*}oM0wqK+})(m2lQozCObUfUMgh
zPr@i)6i50T&v`>t{$&*dqJw6hQMQKvG6hXpFekH2!EO=|1@RpChJOo170FQ0dZ0la
z*GZJEOI~(2hAK{{=u%UcZ1OjD)d-ka6MSIa;MH4i|4cc*$;Fv)QTjiFIfN>#7{v9b
zMdY#Ofm4b<si*jJuxQyE#bZlX?LKU~Gv<Ug1`uO#s$_3jqTP~<rj5qmcbu^t{c8$4
zdp6sPw1^Q2g0U6WGPi(U;EOXpBp&>Un8aKsUyal}hiR`P!(j=c^=W`ei)+ohowWWT
zp++^~n9y0eT4Lw4zx|BxN2xQL9VXPg(60};QqqnA<BiyDiI$sF_o2z-*zPx)ewjpn
z)D<@XcXlqA)v`az$nipLY5+Z{_tzS7FVk`WiH~jCUDavg|33B5?^uXS`_wM(tG#PI
z8t)zW=k>a+mG=@<Mlx2yVw|9gu2xnj-4Cdw*Ay8s0+pY7J%YpDktKu4pXie>Zfi7!
z1<xyZC>(Bov0!`m_Nr~-wI|v-Z)Or-bCN*^hch;j&+xARGkOp|02h6JX6N7@)_N>x
zhZLHJyj3J6U(Io%u){>@6APaUMiMXPJF3SUZ$IXJr)}`s(!KW7n@C@-a(=EHfz3{J
za}%(>$G=N#5H1XTeEJK13fmR(fFTf<?v1cuNR(~-CvBz9k#&Dprj*d{_|{h&x2238
zu6X8cSv0mLR{0C@Melzpm>^D`g7^DBA=M!d!f`_=tk@8u$bb;@JT?vG8@Y{qIJyFR
zQaA!NVITCNewz#%JDERIG*t;WtFg_0ey6IUh<}>&j};tt<zMt#n!-L5SRiz;P$>DI
z-Q4E@fl}zP+?mX;ga9C{<wG836AUpAc@OC5Wj~|`wEuo*oR6Xw0I+%h5s6)AkzK<w
zI9O$HB1dEjHh{F%K)$6aiI6hCHYkVD_LyK#p_+z$1!NBS{~iE1X~TI+ElWVaAM_(V
zk8m0=)~D<E|JsMiM$piN`HoIRKA6+W`3g2g3(lYob7dy6e&#>l=HJ8gt!2_TTM1wC
zhNN5oXHb1Ew?|b3Pp_q68};D_e)O1LU`B&A)5UGE?GmF9FX`r7k#HWPa4&C{xcLHk
zQpnEuzGJ*#%FNWQtoux9kR9ujkw(Ws_8#qHmg&d5qF6Mf1`5YdfHE-gIf;N1v8VEj
z%B~sr@c{IttNsXg5z`2o6im$w&q@P@OYHOyNG&3EwZw$cwHTD}XHq&FUs~YPB+;Vo
z>%6na_WPOhx%WMIY2MF<)JI`4!B)=AhIjsrX)52wG(@LkL0sQh4^tBtm_DzxtYA|#
z80>n_!Ne&fMoH2(AF9@<6oj_0eZFr$<*m8@TK7wVOB>HA-@j7p&+{|$IH4A=wsx;2
z;D=%5#sGIgkGNj)<UA+G(JCs&$*1JU8NT(`0ue3caz@Ke>8{bCehumQEZg4xY>`y-
zj=mF(42Z~$pHxr;N1jTLrf0p~QQ$e0;(4?xe>c-E%kzMGN5(=J?hY!Qq|I=ui<pk9
zwq?CysR_z%>pOQ&A@c&K`HRE6A>|q~o*(kg-zFtn3@a08V>B*HH7&dS?)6pBQg3h3
zO$rD<r?MA>4V#o2;Bn49tN?Y@+gv>sfw@6iHW5{A>dop%18==XxR`0#eJXmtl*C!t
z4ZSw|vGtO^Mk}RZr^Q8=-suLV&WQ(sDY9x(hEari;*s?&hrH~GBLdjgs1q04Ms-Hr
zuUHI2^O*jH=wynqe(R=tt(F%<8jUw~g*ukC2d@lX<0k!oxO&gHrqZtM8wV8?F;WBt
zAu1|57#NkJw5X_v8H}A0Au1|_2&l9GAyJSnGU^B;3<N})5D-X$(jxs*L`tXuQb(n;
zBM|nGay_Rr_x-%@@A(E_c6K?-I@emq|F|^R<av3jg&UXAlWEJ}cx5u;(Q@af1Cs~w
zp3e6ML7vl$4P8MG>nYc1%l0dK9n=S@f*hLuRmCeiti<vClV)f{e1;~%rFfs}m)i;m
zsO<xFTMB$V(r7u84I8m)lMN<uvva>1>Gv*po>^*{hhwns`WEe7@xbx3^|XpKb$C#q
z*3!kLiK)%l;VHq_XFhZg$ybOXv49DH1?E-udS{4J318m5tp)%5ZCqW+VT?I&=g&7}
zE)61YFkalA2{hN|^$Jv%lR*G)^JAl1wm}aQm4Cxkz$ki+68~I<YR`twrVgorUJ76V
zkkrTaF;683N9svGx{A6U+FcSFp0mWRC(XUL`J$|NMey3!^RUFfl<*sdP6}$VL4AHM
zvOnlN;2&bBB}w_c=5|d$9%Tizs1hXuU$E&%bDv)-7b_hCfGI#uJ}7wt6D41pJ<{8}
zjNokY5v4&j9GFkKg=CWA+pGug>}r+f781A@s~U?)kys8hQSM9#H;c7;Qsjo`HRT{j
z)a156E&MB}UAD>X{;R^K>;>v<)DdJ0zkLKdf>W;Tkx}Is5Yjyp(N_M@=dWql0Z2X)
zwN~l|xIUz7qu=sUi;ITc1(54#aWHWX_*~^9F>mBq$6RTs9>}wHU3N+`v!LlrSPee)
zi@2y_BnGn>EE&-?)SgB8b-?BR(Q5mtUWIaTDgrR<{fVv;lSIp?3oS-FB&&;yh!N6y
z`lMb2i%FmIV2)NV7nGMwrhgyB`*{@PN8Pob%`NikvLE|0+B-Um+1XqBX0@kEBzt;7
zhNW~PE1g=7O1!1F!AAx&ioNl3Y%zSDs!g&{pv>m#4wu%y;-<yE#$9m?DxBoH^bgPq
zCRaCKVAQZuFLEq8&u<p@1&<hH-a%A@v^b1fl5a|F;p#Gl^?2zx%w5JNSY%<2_iHtu
z?G7e><1mSbOU*BLxb+01&~Ci}T(0O`U@^g3>hb(ht66ElOxeq%8!GUe)K^hXCD4Y%
ztu=#>!KU$uX8|7+(KN?>nmv?-LiM2?p2XwUzxl1b_Sy|U;x&<8yy^?XRrlEycTCU?
zW!UiU`&UNS9&sp>0Gd50ET>BVnrkl{4y>*5zz0q+r$6qI9!EZx7gcqX<LcTSlIgxL
z#Pa}d%=p-wzT9edRR$49tMtNs*i~2Agun5)bj9B>AO?yGl$iro8VfOfr2&;J#VK;^
zqM+*|?f&^6M4&$9HJoMbNjs^B$p?lNHT1OntLC@G^)+#(<Nhz}zVG%m3XQ)VykZ)u
z&lb>uR}h+OA}ma#AjsfZ8}^argtSLFEQSR8(0tB<sA26@#i+0D+g{N}JKnR<(UG~j
zmKlvn)_W)0C2Id`tl4foK+z0?DkTj7#H2M~tUM=cG$>x$trfE$BG)!-=@5ZTqB`t&
z76#On=(+O}CNI{$Gd*!Gc+9ksi%c-Hpj#jB-|k}CIhc9oU0<L>pVaE!FfRYgd$qU9
zAwERp&(zCyP(ITDr^feh2NU@^xKTLwkb-1O${&+a0()$$hihV~om$TD=%m*^iD$Ze
zcY`4$O)Y8^`u{xOk3ZL&(-&6}Uf39-NbxE5(`+srRiQX4K_~Tj>`0;14hp41OHv<2
z0cEFr2joy)juAyUH8pIl<M{OKlB|@5vh-{ix;CFPUpsn-hY@c2tokcW-Cx?uU|ApY
zi8eW+f#e=kt_uU(AZRK;JQKRkY>}OppMi^^FCm?_El){k&-&gO3tYXAGv*b?Y*F1`
z``6ybuUM!s%T{_>&XUy~9;$vB7sdMAD;oWYI?PwDO9Zh!u!UA`Z3YA>lHxVsHkiW%
zV(DatA~nW>ICDUDoMY+YpZn}`rgQaRaHl&XGwRq^MD-Y9naCyd`lahF7c-PSeN2Or
zoDGrEOz>46QAUw0&;*1Q{P2JI9Zr?RH}Z4`fv1FCoSjQ}VQcO%3D_4*old>tZ|lTa
z=)iTJA9QKx+jl$A{N+0umf6QVblYpp(m;4;g>1`@D7g#`s#7y~nJsyrB2Q05d!PC+
z0@-H1&R2<sTx0D(L|A=EV%dJb?n0pl;EhS_=Sc^FWV@&Iy5#bMsGDVO6Zic5OWcOM
za3@NKCu*L&<Is;dfVms}2elCdY(yly8{3$Qkdxtfao0oIrUnB)hkY@P4Lkaj;ID10
zdMJQia=cua-fz*RH=d2G>ATJRJGak&2hCAGd1A@RS&_GXqh~7+y~Y01#)zC$fO7W&
zrQ3?nK+3gf(t8c*E!?m~I}G%C@Cv+Fyk;8piUIUh*()0^cazaY$0cp4RJHq-U=u%Z
z<;cxAk>MF$;K9#?b4Sp(i~bF}5Xc`vr~KVg4&sZ6a$OAgZlIL=qa~hO4bF<u7;58Q
zGS29k80Lnv{jglyBLn5PZ!5J4R+X(AN&r5-+$mv{M1~1I?&J%lzW2u9X#ZO{>{{P*
zj>Y*?MQT%Ba_vavT6>upwb8OpQ=_`6TmzUVJp%JAK3HKYN^hrX9Ur7vOJ?Ljm?FPG
zo$3poAl|di;rR_}jkf0y&X?ZWZ1GpW855Ve88k{SNdHActV@^b+R#(Jz9=5%`q>2J
z5$;|qA}j$<LU+6y@0fHcG%PKB?XLPx`lk)hD6VVkZ=Kq8_l%7XyitQ@z%%xP1^TXh
z7l>q5!G+QW@Su_Ke#S|NSx_yaJ>plDC2p+(7%&|TD|#`hLx_sLxiD;D8_4V|C2bhR
z5bx$6t9CHZt#WI47O_HpVB^K-S1<kk+sBh@jHA~a+7{Ee^6t!$wf{6aFM~a7Wi`0|
zVP!9f-Lf1-$-qp?yqO)(L%`1dFWW__Tggs+AtyNa7BAy)z9ZC@^$HF=Gr*K3k968%
z`xg(JkDN(%X2xK@@2;15_SdanvCI_nVGC2K6e^FFpA%u#<$;Pn9gIowjy-{kF39&0
z8*;^+NE~4I{fV%!S^cCKrZstB<8L!j&d;W$7l<AOSp~ph#FOvQ<Q1&)_lR<hwM>KB
zc!}++VJ%K?of}e<W^zEHrCf!}Cm=QC;o_{ImaxQEWJgIH;Jb+;(Q6B17NXQzm%=hq
zV;1n6j+UMfdE$?~VR2A(m+t0|d(?lbsZO|^qoPRphxwg`hVEK1WxtREICTW@%FUtn
zcK+%P0m_4_C*J~nO9UbQ5AKzg9m@L)o|N1)u>1uGV%TaEFAbfXSap~g<R!`O^jD;e
z_nsu;<up&*%kQdxSN$6tGor77^PC#nj|OCdO>_EkUl@2w#-i053`m$Z4S^|&D!QCo
z)?uDRzT{mnG`Xy#y_)dS?pd5U*^5%e4g_xrC=W^4hbrT{CZR0LG6oh}RxHwHKzOmb
zf-=IcLQMZH!AWD#dJQYc7kV2Iu&oCiBT8KZTc4GrrHh=&214AHMVcN_|29Atw8g$0
zwT`c|_bDO<4LKK|h>Y^TX32V?@iliB^G|^h$WyL73T`=y+IWj%s{F+J8E%y6P=;%q
zreh%kky@(R=jVAa*z^nXd?W@f4V&~FbS2i0EXvpV@-|88tK(jAW*I|vrbUy3-M$__
zyhJMYz06iu7&mh__1=#Hfz7IO;PSrUjf7j^hw?<#kEp)oBj8PfvK`>F#y@eBJHmNT
zYO~kQ0lULNL7<(;g4@qenxltMSCWtziC3oJ#SFd9#X8Q6Ni5C>3z{X}7>v#t#OahH
z=>2FxHt1S$n)$IxtOo@^d)ZmoQG{)z#v(V!{Yy!ySZFJH<03+vH|1r@A)A)@8EqP<
zJGzP%v!D@WL3coG@~!zAtI<$}N-Ml;_3SPw4L{6r_Z(BfE7(-QNa~25bfqGb>?*^;
zG?7muI@w4S(vT)(+rELLibw_RUJx(7Y%-LqQJ$#JZ*xFGiiTouU3Ss<vS({{dQiyg
z+&*zFW-kg=21r$T3XuO044aQ!koJLlT_M9v@O2zklXpPnt)|YFb3eh6?KQNdMZntN
zY5acNB6ZW1!Wg^5zzNZ_;Vqw#){d#|TV1a4=PzBw?!%aStnn3J!2#qPh!TSSX(hR*
z>>9)~*pJ8|5LGnSjMy+$W0fM7vE#S}Y@gR8Erj;ua$ubNAbrxqCj}@{T}mcAs*^0E
z4mOwC*@SqWY?7U;cvr{aoVKn>xv$2ed_Y6Qz?pZl%aqUTbyVN~DE9%mH8xj%1By$Q
zs5ds~NLYCy#f6qil3r^>NLjUjujz*n%xMt0mKktf^WcE~Om+tM*<`4$D+?m()=*wm
zTj>gr2dRxNXu$&@69LXkLbX_>joe8x*o04_X)Jc>oe-oDU19$sBIHSO^y;JEsD=KD
zC`%X37&I?cOB=S~P#$~C7#I6aJX{VPJ8A1XJM-l#g4Z=fQ?3mHb5_Hh@)7yd1>vAv
zryNwWtCpH&<th_3<qwn^B!HPCUn(IxK#!TI&lSS44PsXgAicBCY)sj)+&kOu%#oic
z8X|=@O%67*ZgEF2NuNhmzhi#b1gldUT^&?lZ$Vfac4S^k<4}o#@d)5XwO+0*wpVY_
z^TEJD;y^9J5^pbcy^GM^`v?>@ZLPHEuG21>ENt;O6JNv~9f9pFI)g4%rE!i_fojJW
z*ar;TCt!lm<VFAzj)<j!Y{YHgXauw(i2K2Y=q4W6D_k>l^ZdcSuz~PPvZu-MigyDR
zE{<pQ1D@Y{;x>`?bgV;{R@mrY$lYfZ%7Tusn0K17mEEHB(O6*#b(SJFHx;zPIam<0
zHF^T<?1ea*9{z}whwLpkr=4$zIo-Q3h11ymIqKw$_}O`OTx*Di^S*_V$f=S{e^ZyZ
zZdDNcg4yd28WsUcusxn^C}fYsi0y$l>E7H4udUss1$B_J&@wyqrCVdcL|Wyf2P-z}
zHNL+7Ib*-&*SyHEsCySa*SyQ{3E!;xm70jxXA?m|8LYPPR{Twr9VCu49u$+tTpOu?
z@KT<{O!-;8wgW7@q!bIP8f<&&>7<KZvxi1mo+xmmxbr!q{t$lBRsV5uXy&Y0pQ<bg
zqRF-9KvJ{<s*WqADc3CtvbIbwXz2GZL}4xgD*dA2F8achZ>9^N!?!n~j)^_%EB5#Y
zFkj5g74(}VVJ6JYyh5{p=P4CNbxr5WC;%7F-2EUNoces?rO6U@3vC4<J^LrP(_4h2
z`<xmi?-gF#kQE7%C&&933iWdk*-LxC{40*WjTGeEyJ(>Bm}*H2EW#5#>ibnF7Ts!f
zlu!67YAcpIFXlI!57!E^pWLK_V75Y}4ZiC7VZR7^T4H{SKSMS~bn6fCJg;=iVe~E-
zs$%*>I-T?M^m^SU1~*Qm**wli<;T8PTL8JajUmbr<U%mDa!?_WfKl{^zKSx88dyGr
z5eLe(^Q4a@$mv1J7}+*R<Zq7Qkk1L{v`Cmsp03Same9#s%LRSCq=nElThGf)>Jtl{
zr$38N4>HEg-QKV{v!aYnx=a4dkXmcsie+Q4LzF490DzV2BOQb<2xvpk+UB4tadrGH
zwq!O-a+Q=FxDF>j01d=$z3i}Caw|9dR<(Y1aY0nPyC--%4KMPi?!m9SaOp?-ERyNk
zXZug9fa4!DjfW2(R6a9+=9LP#@V_d50-Go`JPX^1NJUqr&p1igg1H%c%g(v>u66L-
z`5HKr?nQcT=N%-XQ(K>mz&&Jt>!elve=Uni;xm#>smX1*MV~VIrsy$c+@Yx*%O6Ko
zzefDO8NL6{C`enXRae!AzK$M}&NfYQr32XENP&KP5W&vXYPMUx4=UCE*+t#%c8`nB
zZ~xhp=zLCm+orNeZ616vwP@aOJ9sU8ShKKxtkO>pXk?mYBSgLIU3G7(-oOai$)izW
zt19kV3=CYD^a!>NYD?KvS1mpFX?*Fd>3!;Xuhr~|e)1-P;sU0g(Z}e-H1UvZ4%0yW
zkHCF_(}5P5m}Ja|X>Hh3-em72@6<Qey9c~2!r(OP8$XmS=h=eUNZDr48#(myW8}!G
zz}<>6dZ3Vz_I2~@%?gfuh3HWEocDv#)6%p9le(H-S6*9K^?Gr4eohHexr3PU8URnr
z<$eDwQm?gryQ79t%S<~wQ|4coax+@QBfWT;vG!%i)4kre9-kWa++6b0d*lZ_pzkRi
zU#8B01$N~j>*cb{8x}M!$7>)2%jA22-Tc<L7_ekPmQ)*@OKmR7j53uEqLf*8zj*vt
zCD&8Aq|o=jj~v{kLS4;<!t)n@r)^|kMIEs1aP6bp8OV<FJtrpas(X#N``PdtWl;{_
zMcs$94R8|+^=Axh6E&~ZWS(hwtQS`G_M(b%x3B6V$eO!E`dkBR=RHO2ta;f?DZQ(0
zE$ZP?P^<sixAmay=XR-J{?-kw&FpuPI>xO!F#9VhC&8lf<u7W>;%>FSSwK(j@t76~
zu5bu;_xFkN3A_7>(#lt7%y{s)U$=bgU0h4~McJ*-2(@{1?$md8FXw!}jDS}_C8pB_
zYMs`}TUfQ#X=f2%08=p!0b4%({u!8o@S(p0X6bZ~c>%wz#Mbg{_8yN(iQIC1G4b}!
z;De)eXFGpBs{6Ocq5M0s=YX=OXch1|ikEMFP~_%Eg*?zBr@y&?@qiN7!fOjZ*gyYd
zeW#uJO4-3*xj?`C;md=+j@NQ5ZEZVk&$4c5yYsnMhDTqyZp7%{ry&2WoBjWUW#H09
zfpYzkNFQ+eTNwvm2=ov0zw3}C!HH7}a@T9O?qgY>Cm-nx6tn75wq$cf7=sQ>OWf6`
z_Vj*cQ*oT{*n6}ST2RW3jmrcVXasvy^r)XTD<i6oRxvn(C~UW%`DFFm2Wkn~Ok$Rv
zKfJT5#&~SfBkM~+R^iCrgI@SCocl=LC|2u`8a(wsWj!UBH4w)BSo3*sxm(mmdozov
z5tm~;^w2Y@2j{Qsk6#Vmdb4{eYhYtc|GsQD!ydDRu`{3N&h(-FNGzS33AjD0X}0b8
zM%C|B<pyS574SoJEcNIL^Va}}CvfeUL~s9n5+{4{$S841JO7p0)UM{{fK<B@t#^-g
z2wPX4|F}YV<KJ^@znWZs4t)N-(9(3V%o$FWUIKv0-@7SVls@Zajq;d9Pp>GK1-v?$
zP<e2IhfLVHnrOHKnQ+!?1Ze#F1L)o?WjCkp0QYhJO>e(BAk*8nA^d+zaNhyYZ_5uO
zsOFz2?`itVL%vIwE69#@y)#Or+?4rLI>7yoHzIuv=?<<x)5IlCsnd_v?bqlZOq|=!
zF~W@y4R=S*?aE>O*{${;J``v@t$I_oo6_c?2jq(h`dce094eE^K<fe*?kdlee93j-
zNuKTL15yulb!n4uW^iS_gGsIL&4<8Aa(XHK&aUn~_mOPI3i(-TV-pg(f*47b?om`S
zsKcpJ4~c6W$kP*>Y3t>NV)jNjZobiIi-ht{G=^`T_Y2eHo>H3iGLt=RPxYb}hOVVp
z6ru7PG9nobX{6^nau6e3@OBfqj-v=K*NKrDSHQ&*8c@l?6#~TONwm5=NaS+RiPg<8
zH}dnadXYbAr8MUR*Y2o^O8H#qT@03vfZ>VI0h<%7YQu$y%QWw+R~f*|`SE@90|dN}
zCg18LBat-~bq=P=E_7vkLNGoCzX23oKqDfxNu6RD2+USnm-#K`IujTT0HpIjGuIk%
zvUI>>>!5c1<M@2S?$2ED=_Jz`$F7EVm#bBjOb~!Sqp`3_K-$e7(gV;;7jZd)08EBx
zsS9(PCcO4?EZhwjUVvE>uLPcj&10@^9Pty!VJ;j!-!xBrLTG*EX=%CQ`qPiU?R&gp
z*>opiU!YD=rPI$A_fAe48XBIiv9Y@J{P*WKuf?gUZ3Al!5kyaINa#$KwNy*-*4z#Y
z@sGM71?U-*f-7Vf$gqHRUCK3yC1a(3m)1oIY~Al|J3!#RJ}QdD;e7L=+Z{m{?yb!1
zwW0T^=!-vQIFi>c-;y5*-od(Z=@dsf=r5g@s0yBsSImoK*Q)RvNJ`aERCRdU(61e9
z|1|l1*R?HI{{qE0&RpQ_g%R6&r*pNeH=JoyVSPhGeYPpi*3{N5JF=v<wwQMaMW^Sa
ze9aEe+7Y)id}qiBkO%*eF5mKvdd&n_$DSnI<#C;hhm}KK+t{_7r(bp1%r|`v>g3JU
zobmwwO`R>e=}Y>Ti&s7WRPoCC0-;)R<hy-VQ_Bj)5qW4`6{lg1+`G?Gy_RU8ZXQeB
zST+|JXp+S3?H%AZdDK<wS-T#ryE8J<sAW;*Vp@9lWa(_9BM58mq6Iy*BZq<ec!PaK
z(kvG<g68r?!Goc9yR^qVn!}+v0Sq?3F}Kc@VJEo)oLx}~didM-<ZvuQRSINgxbPoa
z#maF-eSmoxy;Oj%D4(&sZBm<UN^<E00zrLucU<DF8;<s0W?Jj>OWn=y2HE{`ynJ86
zqZNOHwQn_>Hw^MWjYgD}M~Pv?Acq$cRdHup-g-Sv7c*L<Nh^Po-(EuG*4tf#;AKkg
zHA>q2!{?=Q{$|mCm|Y9|p}SRAjk;L~u7E-Z%93RrxXn8izf%qlwOf8^x!hwvTPWzf
z;KI4x>zt)o#?&}DJJ8fNs*M_(>8~$cGvBFyNbMsH@^Af;H7M7NmmZ1(+qcNm-oehD
z-?~!bvMWVQ>E&;pOB;|F-y#yzD(kE2HvX!0ff(k0N2l5DjKB~r-)b4|19BWIgB48O
z*-7qjIoTBY`nfZ}BuTfnj+%nj_=>?@Gv1s1B{!OIc}>j6o@Ue7y#|#k5leE-)89YK
zz$z<Sjky`(AFhM1Vn<JZc{)HUGk*NN$u`q=%H7B$1e0m|9}`CHgM>8R*DY6HXt|B)
zsD5F?hf~kK0XUK91Im7@!SsR9bbZ!4nFC?@qMr3HjaG$J<jfYR<kHi2Y?7-}eO)RB
zC?B0?=xOdxo3RabH*}@dTHDn4NC<<OLOBAw8F+&E?56Jn%WD9l7(INw^=sAJq^~>c
zIlw6y>C#uqJLTCEz)+m*oorejeS*rLVYZfzKWpBxP3<phxnXL!kD6Sof%lnM>l-k~
zCSV`Zt~1j}d2efFR?o$W0hA8)w`t;O$&;NR!2126UFOBF_tBB;o45{pN6`KIXE{Sw
zOPn&LJwUJB#j2~yHqFE(WWKjqJ-qF0>|aT4BY)Zje2mnVZ$ox|lN)IixjBK`6~P+$
z&QU%_#gQ_9lKR;yj@MTmcI_LE!%Ah375DifGxN~f>@Muv{)Hm*vg;{AM&<>M=q-sS
z9li;YwTJ$x=p(Awf<J9y<G?9#m4+fF#NT7N>(}0et`S?QXP+esbM{@_$7bxCN?0f$
zW_C<Xb)-M$^?vT<?KOG#?(Ne<SL3YHTrZydalKnV16l=J@SWIk*a1yxk!p^OI7bnn
zcu`ho|5L2C=LpUV?r1LdxqCOD>{gsXb!8pK{l*DrUhl;9TfdyvQHB4LgBVVQts9m*
zel*p!DFNO*_6z-y7KtO;^eBjT<%GXBZxYnVb`vsgW;h>gO9?5ObPWYd{af#Uhx6Kf
z^G*gT)Y4WJ>Wd}0Vdg)<$*OalZOmHMJDQ6k-9gjc@0Uiq3z%!+CW#Ka{+U++UBr9K
zQHt2*qlcV5K1+MYw?}_f0}8KW_t6DN*y6kN^PqBF#b2XiBe>2YWhZ{~Z3bMJz2`<l
zoy&#y=`#eMt&iv-_gGf0)%2Cyzv!lgx$Zjt%dg`rlrI)mD9->O#VW;PP#s_OyMk2)
z!VwGrTw$TICg<t0Yc+AUGo}K)rWEswmEl*zH3R;QM%e#^Uml~}D?9%Uzfk{A_@(x*
zXW??2BAzPf>q<d0)2C~pWa(4*f$Re8B(P)a%T4m+r$FoU6g9Sre3_jrEKg>1pn~3e
z?HDAVC<OaLT;{bBQdRR3t6>LT!^30p;CRI4yaF6COq#vZrYoND3nBw-Wu-_cpsSSz
z?>2w0fsj6}P~_U}l^r45VK=*ztVJt-fj3ME0~6}Dgo%vTJ81M<j9JaMH5_6ABHQap
z%}E<C)>Tm8zR<knlI!B1Ppk>ZFZDCptRjzu@5;g{qck<L;VU4fc9Pvv_Vd*pkZ@E$
z`ccTdIhAW7T8g$ae2H58(v}xd;}mCiP^36`oO5~pY)wr=jqc^M$;lm=$;B~Pi^l?^
zNJ+XhO_4|S?a11&Bz*|~S4C1KuKyNywU!Bu@!Rl84K^?>NH|6Odq>(b-;vhFovk)|
zwrcu~BWl!2V`bO@N9|9Bd5%YnUI@%V$RLFPepf>s$N~`~-oSh2uE1QKYYD)ZngVmK
zqZk<jkP{=TvvCEL-GCG|w|QdO>Y4ALwVs}aKY(pC`DD8%ZP^)i2eAuol^rEVDqe=v
zo44>82oPQ+^9}8sb0_daz+2E^KlwE9<{Arh>TwvnOI4)iPx34Wn6(P@X<5iv|C}`H
z6~v7yn-qQfFkkR|RFz9cfnl`iN2Cnv0qsN#Sz8uD8B%V5;^Qnj?6sQ#<+ysr7GRTj
z29PwR@K_p`@+5aW0-NG*(P{E)MRm%ysyA<#)eKgw)}HIfFL|iUXN9#>8R;`LNz8i>
zrxt7yRR=)G9yuHukne@68g1I!5Q%`-+nx|$PCik7;uXoe`5as&(ygWLe(|cIx->S?
zjA`q+y9v{g{4Qe+H~gZi><ys&8t}n=;=0M|g8B_q*ql0ZP;hu5a4j5kI`h49g+y;=
zdl9VHSUJJ9fBq_42lC3{Gs>fZLcWP&L^|_C*f9v<A9_qVRaIuy?axWKxs;>!{cmtZ
zkZp?&qku^KjqA)NK`ombDSbM~CVqj31%F$jS17wF2PBB3kU&E?$^54idA__|P<rwL
zdn;Vh*0860&Q8yvBCquo0zPdAWOtZm4_0zezTa<ti6Z2B_=c+F<b4xn&AW<stoq7#
z*`L3ECI!&VW^O&@eI5A9JCUZINf6ykTPt|3<#sDE?bKhFg0FteKjHwMG@b^wUJP|&
zJHOgmxvRXrOBt9tFCSO^3vB>Tflsb&=Uz^diJTshFM)nzub=yN_LH$<tN|SFD#0h)
zIlcb%b(NpTQo`a?r=#0|<=RV{H-Mv_nVI1^$J57>RKEDCf^!7C8!`Pv!jTRrm=q1U
zwjxVu+zAmydj|~K*GistcmU%iZ=pksAV{~m47B<*hv~1*&jYb`D+S3)^nuEr=T34@
zNb^N{9RF8?Wc#a24cmL~qd~9=-vOQAIAxl?qJj<i%bchSUT1$0e}h1lYBSXvoWjMa
z(_+b-8%qMbqvE~HFNjh%4FmtUIDXq*65FX)9xmi>-CZ8GkNdotG}6S|(_`nl&!Z=`
zMfbpzmK!OK+jWK2hq|irx5IrjmM!=l4`JpK(a<G4*T5CtD@Zl+MXK8!7Idwg^m2fc
zC3>E{e30)Ab4(&xMCof7G!87YVnRefn<%l$&7Yv(wyZbexNvs%g(PP#rL_&7?pHy-
zoN-dF{~+n}h+4?N%5~J6!fHxG!>|SJe(0*u^8AUVi0Grn?jC%<P`*AhIm_m==&uu-
z`WG9Xyv7n#Kit*LijdG5Imou^R(>q+7uZnZEdmA-370Q(!%~$%$t5Xon%hc{x(;yj
zv*I6tRqELVh?ZDNx3t~6tE$hR9zx$OU1Lt)^^`li6O*u$l(pr)-S>Y~l1reyV+Gi#
z_rahZw#pltYsDulQ`@lX<f{P?y4`~b9g*BB7DlEfWbXjJp~PfEbFa71Y`UNpp-nn9
zG+tvK7h>y)@sOM>FXvJV{c1Km&+%1mpC@A?g+~y5U5}{%W6=h5Lu(v%kmiLxGfxDx
zWG{OtEOrs81rokxOz0j!JwGo@xzUrSx3s*{=x`<|_T64EyuNfgT485zR+5{gwS?CX
z$Sj*O+R{^QPIh^vLIF~S?QFpVybfDXf?lWGNe+k?SI1F)A|HUTkEucr-<qtsXcPE(
z8L7IhhLV^EKWiCqJi?HqM}LmV_qDN3tTR6_IhYaK(;u)H&#0^zDd3H6QyZf)2j%+L
zBw^A!icHFWawKFv6DdSKieQ7&|4JfNGXxP|%~vaT&^HWhYS64ozan{<X0-1uoG(_#
z0iGVznpRvwsEHbQyd8Lbc=yIGKB~Sux<_q(JLDsMtpLmv1J8(dX@ugHgS}j>QgW#^
zb}(t5a=rX291ArJwxoMp3_Cj!X0ynS26kH~O0N(q@LsLgta8#1xVMJ~r_E?}?YXld
zUc{cMklmDrLz%ETkRt@j&X8|G2Pdr}YGHE`yS*G3@7e8MW@UlWh|grIkgo@qyY`Hn
zdo%x4W;jtr%*5N^ceu&hM_0@n{>y;{cCm78v~mq7RIRd-e4EBYI8i#NCkg0i(1v`S
zy^4Gd>Q8NDtCH8kPNLLD`swk(T`T3sDk>!=v38e=5kHa1@Lge)b&HpEclm8HhMG6z
zTOAhRPgl|c%lw>0tNMeZwyBD-uvws7%Un9Icm{ZOhZH#u_F!c??yyJ6N3NIKic8AX
zCUt3>?M_HcWq6@gl^93V%ms~IJq_FCZg7cz@eqmSvf<mW5|_^@;X(!GR~iQTkk*Xn
z%$d#E9ateR|0fD@W7gDE)coH?vh4pZl52I{%ut1iX>KNQm)x&q>~`Pr<Wf(}s-FR%
ziv}G5E6pL(6N+4m)D6mZK4?NnVWe)5hjufjGz^5;HiYIC$NUNWmW8P`4xPF&qWaSp
zK+!>tsbI$K#>n2G=yg8pIu89tEVc_1AP0LZYfAD~pIq_$_vq4BHx4}c?NZ#DZGy)q
zPpH^{X{WSe3nsgeE@g6Ouw(d8I`!M06#99oO4#idlBI;+uhx;t6Su+Iw*gj@ZC756
zKU3RNhc8txlFo(sHeA)yS)oW6kFWv`WqPL|Y3w!sd|yC_E*u9odN()6b-DC1YEP90
z%hXS$t8Zdvz1ld^xOwxbyc3&SRs7DX{l%8+;FN3XWxC+q|GGG*29Jo#K>1VyL}MY(
z##ww#<rY6_wt>WpDa`8aREr~HP_r*eCThOEC>-nD#e0sL&D@=zZ&$6m9JQe98kWYn
zA0?DoC_jP019<W=l#TFO8Je`a>pgxwS<_d_wTdT(6!{(eVE>7Jw`j7aj9%i2_p52B
zc+GQ0N%M>S^wRaLtuLJV(scW{%2JYwJU{`kNwKsyfYyN)eU6u~#ppP>k8mzAO;>6Y
zm}ut=iCeYc06cO$!^2S*6rfqXBL4Y`-w9I52Y>(96IL~6YW!!7wlLlE;yO`B&}SXi
z$#r4ekB$<^sSzK|Th{|v*!$rS&?phqMA3#6MXU<Wf^3hJ!8z4B%S7SNzdh*ZF<V<a
z>P7V0HV`n!r28p>dbFXg?oZV|U)8@sgcI|=PFtAbC<QFHI%;^nqjhrKL5ZZ!_9egx
zX%7K=V2Dx?RyOo<U$kD5QVcAFE4S<jbFED6xUs7FJ~gZJ$HY@xPy@>f2rHufC`0&a
z>lBJL>6`SHqJr!%L-?ZC1JM_ZYeVWP^@&QWN(qpn1?urNE}Vo`dRX7Lqe3H>>!2^4
zh4CSVk#2n<NUefQAL^^|P>5iY-!C2|r~qU2c0ipjSFURmna3ctgK_3CYH((|?5O9Y
z(T0KCYIr-aTtgc&0#}kRKKJ*!1fdf`@EeuA4F@4b3N2wh^{VsYoQ7Y-&tsSX%S+5R
z)_N=fG9Fl^&cVCzGqp0}1X7=JNZAQYli82i*AVeM-9Ea5&Lm&6K@Wb`ewk+pr;7LZ
z2V?bkq@VE!vJLPjA2|m=61>FH@tWEEQczdd9JZpD`d)U}+Os&pX-RL;RZ%=ryg>{2
zZ20G_uIUa*hBI4GMMJXvh*9Q^>Dk-s6f_D70DaRE1?Z&94x8UHCE$C+Te@Ickql%D
zRl~7Jk&2<6h3dR^Kv`|E;i6iUR)<@^+`RD06;jCw6?qwW<J#0l6LtV~L{Erp<)<R6
zx<CVp#9XQl2iW=hKx2!DhuPcVWTScsrqy9{FMYAo3%PNejd0j2N6B_S6PkjmdAoC;
zWxeC&r_wpkzFf}qZBf<Rx4`UG9b7$$+PD@FjU3h~QYg0M;}X0a+@g4J=0|~(x2~^Y
z52;;X-I}UR_Tki-h-hob4$;_6FzuYHBz<Ou1ljBw(G|M@AkHlrRxgT4cR<Iu7a`H-
zCe^2?<JRXD@(A)4MG4x^eE4IRCkHI@<y?&T+xtj_&gc-2l+iBeYC|Sa)u-i7;RPq|
zuFecA8zC9Dc<i*P|4h>u>$5sIsX2-vfLzrbJAy^hdjq~M6*%>pi1|P%u@at;c_=w}
zeY*{ow)Vc@2-VdNM3b82J(eklO)wfbrRLmbQi)qHnlXKT^2@$CWxKTG#=ER*Y5Nbx
zt0>daf=5*7BozquW(;LpC#VeTMmD^6unjqML5Odq>cIu`jWmQ30jG*edq^PdrQbSt
zf3bWkOml(M+EQa{&ZHKj6UmmPa6}t-nRB^+mNBD+Iu@CXGsv>q``!|4N)>46L>IiL
z@I7LvqlImx1ZR%MbCd(hQBX;wXu+Ay9!n_>dh)9v988WxuAks`LQrgas-2~`crJye
z6YS#c$q6afBxD?C{W7t9ve+n<4$}G&4?Bo=3&-wL_oLUM{mn=81c=yI02)B!b^vOQ
zso(_@S09R3BkzRgBu>Ki*jIy=YyAD^7GKz*fiLv<GG?-xCAB*1If?R-cKmUB=6VJ}
zi?=C36)85K@s?ds_GC~JUn#q3jOunk`&xF5D>q{zHxOuBC<n+VU|Qk0e(dyG|48af
zchX3U#~AB*c$mLV=#uMYO<b3q=BxAn8GrqH1<(;H-u`fajyBp@1xG<R>3c=7!$w#g
z`>w9;4det4AY3(3`+d9Z-r+@`0xZ=_&>Ex*tr=%h{DY$I{JQk4`PS31Uw^HtdN+1t
zYkFHCH(i>k$a~qnO_9s?Wj_XbhV9Uw8IKxt<Hgpk`~;-Vb*QhVX1IX9`vEdVew1F2
zvb&%rDtgkqP(8FBXS)C14c+co6=e_mdO5reE8k=`2Z{)WuP6ABdn#8=dWmD_B#1QE
zoj_O3HPLj)f&Fp~sOyv@s*|6%kcGqmyv>XTG}r7xjV$yVsNpC2FQC_X5JDaH^jl^c
zpqyIH;!F}2&mumcVRM9B3$U9MNpceiCvFFWD-f{E>nK}^${p`ur$W-ah?XD^xhvww
zd0Bx|eps80&%@imU`<ct)6#jO?y#s+y{W-?z<)7y199!m4TZv)V;wCXx6<vq;sclv
z;%m))OMp+Fr0f}FU^RT-sMCFb0x>gp!isKTH5F7mIr!U<8$e|pI1#9lF)7;fiPN!l
z|7!legrrY7$l;|Q!BQtS$%gh&z8`2-q|;E~!#eLG64j|*f{$fT@7ok6GiVy{<0))4
z4c8sqwaHl$-+Ygh)_kh()jQ6N<yS}=7vhT&vu#dheN#N$hG?V0d-3v(9O(nFo<u5p
z_*HuEHH_Q6w!lg@OSd{uK)bK}xp(@u(qI(i*R`ItfKzrHT@XcW=53RlVFn5b`z&b*
zl+{GMCLewxKU_pm?sz=GRJTnrzf#%z9$h%6Mr~}ML6_*pO%A%fx4^H+m3@?r=@{s1
zVj)I|Rs&`uzcoOqv42%^Q2w-Lo^E|0H>}A&T-dqkrA<I$Fi#iaTp^?lRI(oAr7J%(
zRg|t&K{XP>c7b7~p(tE12;>GyQwGt*<gP~!>nbGX(QIGy%|zwT{XoLeX$u<4!r~UQ
zRNEq`DRLJv@Dl}%Yvr-57q5<yT}7U{vZg8$Wyz)AKal1IwZ|PnZz=kzKV@+?J<_Lm
zB0b$BG{4Xj$0sburnC&Cv#eRqcD2&KWR2Cfg908y(r#JbV)o4Oz|JQ%H6>@&MrhDH
zi179XDt6jRL15g%gu#iuQ=+71sgR?@=K7>|k$DmmfFH<5B|eGdFfn!0WO~H6B=Su$
zD(s>Jom7XR<DI|Z{gy!qDx|h{2JhByzRMfM%Przv85=zn)?r$)`~KnADhh4zDqSgU
zd?Y&nKY|fb8`;CnA{<#;qI|Ziy``ipC3IO@l><8K*2v8TC7Ej%Qw`x;f$RCeTfUEc
zt)MgV8bN4?JkrO=qys<h<r^OH33jGADfm_oU`Pqt)i$gGKTtyLZN{^#l^Sf{Ic0LQ
zoDD=nmmE~VQm9P@9ic!$kt_kl!A7yU5pZe7Yd0Wpq;wIYtt)xZddbMHXB)KBTxigN
zOvu>uXGUCd89XrG{tP7DR`Gy~t6l^mak~TRAgRF|G3L80w;`#`>d>HD=;Vj@Hd6(;
z4qKm|eRSO!eaq$a9^R3{>&`#R!(QZ_yuJF#wdYTquWA3Lc^|z2$azxX?Oik4GH>N5
z9!b4UC$@X7f$fVZ9eNJCE5I_U*(0Zdpf&EvYd(qSSP5a{rbCb#W29cZHvE)_+>N8V
zHtR+>#c?hUSeoV!_*-<T6YnEgTu}T;m#o$>zLePvT=<q^nD!Bd028I{GJy8+Bp&Ov
z)bO$;;9V;ELu$<*QFhezEKJoluGizz0ZeNo%Yo}0Am~{<d=0brJvt>YiNC(i2Ld^R
z78>wQWxQR$Cg9iFMTwDdUba2g`YaS4hQ@7_pMY_<5U)eH>sRB_Kl{A6y>Kex(&DR#
zxEJAJg}l;ZUq4Pp5{#d}KcxS^{TBcI*N!onDtHDEZe7V>f%pTcG_!C`lpWo5=kmE=
zgjA)+&Mum7m|UhXuMtIos`5Qhbu_?@jU;zkiN5j-!<vltcU$t;!g;6CPV`wIw8m>#
zv9CwCei<P%rALtIfaMF|cmyis%-%%sNUO>xEYlJl4w3aaa@#_@pKe<EvO@8=I+E@+
zG|mdscDnnT=RVF2$Sd*0xwYF3EZ>Zsk^d)+RrT>c^6TFJRY4+8E8A?O@xs6nb?I3N
zI&m?}w7J0m0yr$l)JuX$upB$dIn}*@LY#tgh5nA02ST!NXES)szxFaZ)FYE;oX*w1
zjqd&Ud2Lz1t)$IaeX5Fr#xCRE!dHd?=^9Om_(iheL68J1)qwI@@A5`Tg~uVacG^aw
zgMQ3~%5;3M1wtE67Cz1r(t|Gah_jdm8pbU)@ek`RUCRZz^d5J=!R##(4f?|+?eUtY
z9`~s_3;$O$t3_?3FV7~v1he1@Wy^`uDgDb&%xWQ;*edp=Q}Lv3nikP!tUZ=89GExZ
z9Abeg@~h&y;XNG-xoc;?u&QdZ4|$k|XB|QJ9RP-uYRU~}67zUFS8%S$P%xQTbpQcP
z4DRqG3cBKELkv|fy&1TTlAjRphuZ~95AE<d*swzE-M|e@AzpVpf*&h)&UfCy_x0M*
zv*@XPF?#R<XLcq>MeYI&FRPU6zYhjuek5=I0PVpkKX<qdg7U;4Z85LLz-@A~S;6c?
z2kpAPwkOvtK7<q-+H@zE2z_*b(*SEnWU85Q12E3h0tT2=<+`Kg<6fp<MTl4OviCwP
z<|{b8*<qK0f%dbfHa8e|TbkPY92;Cf`H15mhZq`r^n^s&5VO#idP6)NL_8TN8wHqD
zHB@CAl(^?dUkp`&8~(*-X@C*?nYPi_8eKu1!3uFvfv0FK%jg+&phyGXd}s3Vy(#YH
z7!fwsL5)*q3mPhIe&xnKeo{VZq$6>OOD?`L((3b?M<U{x6&c|RQ72IE(XT;YA8%VX
z*#tCaRwt1!&?k)a!OE^QAbs<a=p`&FPIsN`W@xB8L2boFe%t|O$>c#CVfpg2{2?4r
z``Dx`w&;dlzT*-UWO24-HV65sT&}NPHlB`$&X_+^Ze<Nv00Z=KKyrP|^v55KIm<|Q
z?_~g&9=%3ePxT9ZjJIEjBZg>?cYx~`wfp<mHT1<T3oc%!hi^sMNVWm-GI)!RrfN*$
zz>|ZNDT_xJp?pqv2Qw7EqkYv)`k3@%91N#--W7HiWf`Al5IZJvs&QG^OAVDA3wZrY
z+}N@210RQPyvyD^3LqkT{zs4u^qA6Lz@>pyrMcl}@W*v9J{>I4>Qi7mS&ZO^x}*Wn
z*g$U1WSUKDN_9e=0radXTT?=LV9%r3w``p9+9bIZPY061h$~M~(s+@f@x`8yL#Pmx
z!z5P)@zET%nfL4gNY-7Kc&SB1n@e$YkvUggxQiXXP&;<4cktYx4+opTL><#GY75VM
z*Z1`eCx>>n{_)4Xyn&Bf0tzoiTR%C1{`A8{7ToiOW}t&1JBdLs2<Wyv1mmf!m9k%Q
zCPqlp7(Q```E<^6U=ibKd%F7ZmlwKYUmD&%&<zdI+^?l&)vX57Qr6vba&v&*XxQ3c
zzNmq@&~1kl)+5jLg+xAl*Kc0V7&H3ZJ3DpmU5b`%@`u7Wr?)RIuD!8OF|H~!-wa-i
z7kK%ZMk?@3kjxtHkT$?ag`g;*tIx>TP@eCnKYv0vrh28C_(yqgpe8Jv2DlZ&{@{^h
zOtL)=J0N%R4$H?M2d;?pvX4#gk-=m;&|2Lknv3(76Cj$%`~k%TwwV=u1)f7}gq<h2
zv_5=ma`r<@SQ=}2DQ-~%dpbkZd(8M<oN4t_we2@AUI%SN#(XG*cHh6wS_H~W-)3-h
z;u9{(N!ZmsL{=4HbilFiT^#qnD(8D0j2l=_o9llKjR<@Y;_LE9Vwu@a;O%rL1!S_z
z`RiZ+Xr;y39Tp=tc$wu1=KyuVDKXgasMe`o*$F^gh`NBObNg~J%@U-qqVGI?dFp|*
zrew9wiu(Uuntyop${$i21^kV5`}0ATsw%zNpyS=MR-PIBElgCe)$0Ej$)|^m6xyF`
z_k5Q&PMOrLekVDZy7lgUzBSkI*$$H&#C+R7O*+bXw4f6eb{q*d>HymMEbr4sJE{6)
zoxuyu-_A1hM|_`*Q|#Y7bMrL)EDItKqV`?J7O7J!QKN~sZ)qRM2Mvr|X?-s2>Nr5g
zilT_l(6_j{!})$TO9^DhazCpGhxnZFh!cNu<LISRHmqFB`ndFbLa6SN9`|ux)ZJBC
z&;QiEGTN!L-?m8Yhb!0WFfco+@o#|ZolxCB^2A#(<Yn%YMmq=U%vTqCTPJ{I99$w;
zYU(`LtS>Eo>16BYK}iOZ`9_`@XTk9NEZ5Y~OV-3QW^lf}ecQcg0m9K-w6A~Iaftoi
z{IStaiCI-XDXh6htqGZE(^gwPRTEqA<mGtH$xOk_t+{jkA^zu;#7IM1mp6<!V#&zV
z2O*1Do#b5j+}J7P-wq6LtvWD!2_R3VD5%KyByvq=yd@iC?mehQb?3#X9UVA09LfzQ
zc4A!~U#@$@>>oMZH~8z@nz%jXpR*_^FMP%5n)_&fwxBR#Hc`ljO%O8^#iV$*UIywg
zSlQ>e*3KA(&sj$Abmm2gS`$`x+-5^YwQJQ;RX=@RZ83ps_T<)1*~$D8KV6TIKZCqH
zaZLiGm<UD(^)(=3;>*S}*mBKG>8Z-z5KyqKhx)tP{Shsp8KJp^$Pl3-01t|m>;$kM
z)kYHX(@*#B><$^z#<@8By{$IN*u8gg``W6$ec%36E&S0)W;v#P0z9rQWq9M1e%td`
zo#no0jRpG+DC}9rn`iC=-{5vgx@?Gaemv=$d9MFfC1-AK2WPrv@Sex8*Oi^S4G38(
z=nwy+3_?hY6;HsAweTwor~3gU-o3ZZG1rg1f}%M#5iyWh1gy}{<P%KpGYr$M^iv)V
z>V~Dw9#yxj>peMgX0xDMZ5}jUs>PBrn?u<UHgI^VanNg952_AdrW~f|NURct?u)oJ
zWam;i5IFBpYzUOS0QQ~x;Z99<-b)hkf`k^snA_;bN~?179aQdv`U~>z`rj>^xC;*a
ze|}MkaBWPM8Jdd`O;Okj^$ei-wH3KO2wc=SrW6@q4Ac$KIs{j}u<GhCgke2Bzf|*s
zeQV2ir}e+&eK3A)df+~l^(AF7t@x%-F~9)T#AOw6NB%vSSckd}xZcVCaWLtx{jdrs
zpR}BQ98922^;b`7jZM$0eculrY>WIP94W+trf~Vj15_P&zA;-rM%XoTu9$ohjs@=Y
zDcUEK-%}9*4u_ThDGwC0w|pq#;|gQt1~w$)wp2utW%JFKr?WRoY<JC@J$RjY7BSTZ
zFeFn-#10T<lyeVC4?thas`9VE@h9Q^5`&8a7JDq!otarCzYf+BU*X0h9_Qz`o8sMu
zhzG|#Mr~Za^zFw@9`s!<4ZZj4a+K)(3c26^R`}HxO2Bl@Bi8Ir1(A^_XF9~+`*iOd
z84D7u-raT9K1CpcarN3hAj)iV*pcqkJu`drF(8g5H!rWQE&EV7v~!7&2LjoG9#mRZ
zq#fuRtUiMLkKXiQiQ0RQbh#l=(5(99*%=A@q2)@6+VqDavO~95M@x-mFOgyo*_TiI
zsHKp#Us>pt)uboaA<_5AA&4Y9YoBjZ4#@OI%D&Xgps#O(pXfiT%L>4{M<~}+h-oXQ
z@Q`O0jCvS>endu<IE&bu;Fyb0B_VrTZy>)V!zW((i(hDsG%p85|Et}tqQ@)*Wy5!^
z<tRCU1zpse8h`!vA>^k+YKwm#L5dH8JKPLVKy`uO4>d(CnIK?q90x$hFc9V6F6TzJ
z8fi;>Vi$=T)MhUeXn-xLZr3l16(JGCnoF$%>2%+Sf%Gt9F~NqF84`4@*zL*)&wbRz
z-{RgOwKm58MzjAK8FPU~<}{^;wsv7RRNd5-%GX!w!#C&3ES;cl_Z@yFeQT`I_6sAd
zboEFk7#R)*E9}e5@>tc6MbjfuFK<*o*!g5YXU&RaiHSJAt^5&xhz-4UFqfbEVQ0RE
zF9q(ZY^ah<6|oJeSHZnU#mjIqJ*8F@?xM0o*{AFPejb#jZL%<FNGg}iuNawD`9294
zI<hd>2@Ha}lU}>vn}SqL@+HOFJjkcTKB&2dLKm^u!sdbqU|?xv*tfW*p)WYav^Ap~
zpkCGZM2Y*+eZO=TV}x`=lN$F=x&@;r_T?a-AR%|qN9mLRj!W6v@Ck{nGb}442Lok0
zy2Z6&<-2!m=s0_W+*3HW)nlS2Jz?8@-#et#HV;sn>`<tk$v)oy%!|Qh_04>#qMfpu
z$MFEA6S&(O4uX_eJm?c??E)4KN*&U<QteixHlPC|<FgH-E{ibsD3DXsCoWUt7DD^V
zMA4Ht+^W71Q}6J*o0u)X;SzV9+I`b)NL40>&~k(Avh#3QBV{85atF~I3Wuj<qZhlN
zu@!cGzl?0T2;t+XRTd=};5a7VMuU1Hbi35Yc}~($fCS618vB{oO}$BgWjj@n0Oh{P
z=|>UfnDP^~+IqSiLSIo7U}r4LC}Upxpz`LfIOJyK?hl}Mv<(gYfz%?Y3$xm2lAkp|
znfc3NS!#|asjDe5Z<1xSOQMPu_WNpMIbVBQf6qZyv8d23Y#g_@zZ`^8IT?Ssw((RW
zH_@ht3%dx0!-+1RLaRC@HCzI{*MDkd<w)bcC#%A@Ck}%Ua6Qn+vf=HZCNSKrTz5g{
z0L*CRCX&o1BZo|BHirS=W~r@)VaNOIj5XroLqf_Yl*Vr*>9Nygb=cimk-0n)rsbYH
zuqXKZCZqFD4{vq4gGfq3sh~s9qV?1@)ZSxupx~9z37U=O7jh6yU5{wc(H}=+b+(|C
zuSON5M^M|4t4PsP;`aFX7Ir*)vl)Yqajs4kqSBsAOs_~bREYxDIGN>{y$~DjZWgMg
z<}xAr<9DwK%k-IoxC;2`0N?#-l!fXNR=KSmidXD3ZlS@CxOiYUby`J!3>uVgl!-5c
zl-jB%72p%zCIw0F_taUJ!)H9vqS+Lgqi?7OFP%P4(+H+JbhPU`Jz79-81lQkv>euI
z=<t3Rb1jEUs^orbZ>caIf!l0PT{sVDD^%t7B1JKJ;t(HXWY$u4P#4Z3zWoil6xxB7
z=7X2LB9?s{@fcaz-qNKr;dMxo+BBz0zz0auQcw#l%3h9Lpb(3YpM=`j+xmXT<0d1j
zW9vNgyrx3+v^*U$=`KYC@!7to!<Onfh*V$ILMSi=q%5Yus`W^TB-OSkS4!fN2C;c?
zd1H;VM3|~YKt<jRD&VnRfU{AkO@53QVK6-+s)t#V&~-B`h-e0zWLT>#8O)7frS1Lu
z$}Pq)(kexPrH1WU=GzMPn+A}ZIX(Mv`Qxlf^yKI715}+lJ*(<pP65sCr&OID+x8tc
z2T>~Iu7AT)wFR&btlS3Pri~mhV4@$8sA6P0_;xIGGS$0$Ev)B`TtgM^f?W}b<w|3?
zw&mb3$)_!%EI!IV2j&R-E_<zIasq?Z|2CnuWIW7>tKIY`G56&}f#L|-mrY>9RyZke
z179IOAAbg1{;fO=78bd~Uf-@%z*tE}vuIUnGv0tl3WyBcI6^Sm#m*GRr{=!F+hQ>E
zpO^7#h<DwIY22Hi(x6u-XMvavt6YNtH+&10$im4+FcVl#s7XbjFU<gUbb+HO8;?^o
z8%3FOx-cIPeU8Z?)w&t&jz0#+KwK`TdD$g3W#QmUyP9mKB`-ImB<5ye{%dULisf@Z
zc;p~A&oqfa-w1rn-}o1}S-Lz}kvl`tBdL1Ag~j9@aJ#p-7NH7PIl*^*%pZmPQ5G=g
zU@1Ssh<B^#Wkhy5HPd_{=JbK7G}guscMJCwo~>5-VN)J`3Y?7I*6@L%PwGwOCbyv(
zGe3wzYo{8_2JOrR8mb@@rhyY(u6^AqG?mpOTe#(k9<nyCRh8Wvi5pR6$v)mzwWt|}
zt95$i#NVvyKUF6Xz!OyC<N)<1ei$QmnlXmDq>U`NycpOmpJ9Vlm$F7eZQ2e^j$DLH
zq8E~9sBPzcmBt*0?W8ZM3Dd#EEprx8KhK|xZU^GLiu6mIY`21|2=PB%CE&#C4<TmE
zWlr+F-D<HEJxVvyfMNh&@wzf;+)P;k)5Ya#<Em%tG}UW`d2pl`XF(DkyglK{Skxcb
zLrLaVPD7bTeo^j}-+}ujnP5ZGQ)~UNN)mb#TWFx{`9bVg>S9ynuHy1(<V@-tuxe4k
znYsyE;zt{%a%sa6KGM{o<H!Kz=L#7%Q)(M^-^lZS2J8Q!>&xSz+W-GYDwP;g6frGI
zCFWL^n`NewB%#$BbGs_WH0E}Zi7_KWh`Ft9T!xUukZfg}7|SimK9dn+MvL7!#W)|%
zOuu*c^Zk4tzsGOs4?P|p9&^r|^M1eHujRS)l1hm!9T>$sTm>7{1wgaNMhV}HRYG?m
zx3lRTO}@*k>V2%fcvW>9UZeVUkM&7)s$H_E<~2WW?_c&wkiPD(ul&_tk4NE3aL{QY
z@-t7?D6iFXL&BhLDXl+UcD1&W;|eT2qURioZO9`|PBllTXhg{`bZA>e->1KF#i~?Q
z{sShi`_4N=G@&^$Zy~6@bpY3K=37UojnHzR)0N;WyYGHD=eo7s=G)uPj+fFrRULOf
z|NHINqm%EZoBw=Z*r{TdNAGE|T37Nugs4pi%8%+_lWdKB`^+XzZvCs4<6mB#Xfk~*
ztp6q3@UIg}MToG)cWY&0TNA+qwy5)8TF=l<6VyBne9-xBZC2V2eDRmW{fG7${h5gK
z+xvxVrlbHZW{3*ZbZL(AV&1QE+%Pu9##vw7+R=aYO;5u@MP@$BY+)vmsjG93Zq(dW
znOz_jkDq++6(h-T8(Y&YdNbl&UKRJwIPCf-jN;Ddf4d+nf=oA+S7nZm2XMLE><3b*
z^xB&Bo1)k5bvEn%+wJE^iRS)y94;QV-`%uhJLtdpDOATmoZbZN*np-usSY~Ay%G#5
z4_~~Cnjpl>)H!Dh6Q7X9wj|C5`sYQb`d(A&yF#g})(4VT|M&x$?(umhwhJ|)L|ibv
z?Cbf8i2bJ@V_g!@Tg%+e*eV28<&B)10C(vpb;_`a)E#LeVi`Uq2>#rQZqs5D)9H|c
zIhuN)E)}h&w)e#*zm@HE5tN<t^l~<I-d1iJWpH205{YG8m=`}sT8Z?4Nm@4OC{V9<
zO`7x6=$sLUCNPXyXulQf<z(W1q>teknjfg0@}>yrAoMggpZW7Orc-5_g=)krR*2yd
z8F=dPEm+YHLgZAc6v%B&0LM?*7}a%VNzV8h@qm#GPU~PEa=Jw%U_bR5C0HQAYV7FA
z^13j7Sm_5>smU=Phjab9qtCXd%D!OaiSnns;r<y><ri5PQf1CT*VT+vwK{QejqXgN
zD#Qs+cZKDte41XnWakum5_}!weuX8XP&G;}zaIH$$XTLx$=FrHi)^{Z{_^egi4#~!
zjf4l1NY3)leZ@=-)C+kCJst5)>{h$Vic{FYuGb$6vU`T4PAfvmj6F}u>?h3^w+;4)
z9OymU%07HB+q}B_0cH#hUUXG-i`Uv%2TQOCta4&2@g`HNHd8P@)2P^w02Kvo<m&k6
zmWwZ+zj)adDrbJjIA=y!-vAzI7b~xse71j}?V$8TnGfD3c2WmCIuOhC<vGMa&ihtA
zu6#a@IGjV$1|fJQ;}VQZqSfvJB1yx|`L{xs_0596rE@%y;0WL*S$`WoEy+l(tRwIw
z&X>Adx{YngsfQ|iiZAqOPAA7cS<V9{?TQs!7af3Tb}22HMaF4>C=AFzOhNs6!~~R@
zO-w_eA^f<fB|I`YCAD~5P`|=;4gH9Zx3smXW<#y(#V1H+WAA|TW3q2hLPX(S$_iN3
z_?bFhv2p@r&(8uml@614p;TE0lCbF80Nt4wA>7O~2Lcj|ozN|YeG0!p_YRmAuaLj1
zDH&&J*r<L)6908-9E`6VOS?;Uhm0D$GwhoQ(*0!e$|e=K34sso1D_1Ju=*W*<wZ8w
z#S{IEAgGEjXEiQ_HF4DGY)Jt^=8~(4$+fQ8$X0$eFZSXyn3FPPbMUuJV^}+tQaF}6
zm90nJD|L41o}Qb!`1}{_r<Na>rEf$(FhH~5$)48B9}-k4r&$eNOdE7LC|9?-!dXDH
z`zpUxC{{-`amk-vz?ZFpVj`$8@0Hv9=?`|??fE6=4oXb6>|{7Z7S>Y2i_G=1u&-H&
z=?towGa{Z`39PNLQyW0nalomCQ%Q_wIE{EPS2-7=9_%KW0RbW<h9(1N6syjVDeVp)
zxTEPNzIJl~nV=3kx6i%RmEAVYDB@E!yJoabTUHL^-VS1d5E5UgFoiAS8Af?}p?x;4
z#bX8rJzmpC;`(TF+(TmLGRwWWzt_4+rJuK&C9S=6d-`JX-=bHzQ5^I|p>|tdXhQ^R
z=hebGF{&LbdkC2bk|lWcu`t3aNc}FXPEw{HlJbw1SETa^>i1azH1*w?I-R)*<?YJ>
ze0K#Ql@iE5+EXU`8AIfV5n~Rj86!)Q-~Vx1^{YsNN*7NKDf&b+Q>{`8{)TuJ!HD7U
z0^Xi1ZNqOIV;UpZh9A!2H?k-|+QLM@kvLn;ORHiY10tF}%l%R*$AdKKz2B@iaaMU@
z9Uy?~884n1&D4ej$v`cLD=$EQ4#`kH(u0k!HOfZqT~z~)@Leh^tSsa1Ds=4}2eQa<
z_|kwj`TfU!F46B<{vIQfe=DKmEMOHloJ1<eO@7CK*sCT_XI%nHSAV*Sh)ul8&s>R#
zibUKZPH30<5SvSiO!Fk-cwr}cyt21~y>a}f0eX;Avgv?*O(_tQRuhBPANP*f`9a5|
zCWhH<2Uh0=`k7`;z))9{F8iw`?qa-*+;bt}qR6H>K|FFR2#){Tfj)BSoVLB;(<tUT
zMK=#R<eG$A3j7Lq%3u>e9MVBv4~sX9<H{Z4%4s;pex#Heu#g(JdlFS4qDCW4Uhzo`
z6My2(OFb1+t5IW^?-h{dTUyvql&ibR*{ylbQ|OA3zXv7A9&|I<L@Qt;#a0V&-gSTm
z?J5FrHd>)DMu6gu1Ok*FvPuhS`FI)QL^rz$zY@I=sdwsmEJ1T%l&}|e$uF89s4dzz
zJz!cq>#9|fCS8EIRX6b=HB-K7RzIUB)l#yA53+F809CY{c!M~$*}xDCoiB9*t>=Xk
zDw26nmLlL5S^-R`G#nWC`5izOv+0(=E!c$vhm%BF2P=eBbE=+XFfLt!+lbIw2wI(&
z@kQpww1hwUkrMtIkI~!o9GCJg)IpZ81rF;k@9ho35FZnfxEvWMuyRM3?}0l#0@^8E
z!~-}!YbtEf_J`P7^zRB0ZXI(;AWQQCTiWr8t>fw75A@|9*OUaLx}QXn_~EWe=zb|x
z$0K33opq$Qf~ZQ*IsT%TDi}UDmOAgg;6G4uO8MGvN`E^p1}Q{qa+>krvt3_ryxH}7
zBL~OaRedyNRkf96;+yAt?-UjN^y-h_fnzhMxf(Qh!)ZKi)^HB1yect-7e_2VQn+Z^
z47oN0Bdtv&V6vR{siTRygZ{|GwK3e~;c$|PYLkJ+i#yanr=%(CCd+;FD*MC%e%ZL@
z<vxQ+^4BQVX~hoEth@*$@qGOGge~1f$sEYRU2m!vW(SIX>tvjK#IR?rp134yl)fh$
zY#||J{nJ-t3pOxY3-Pi`dFd;QRo>%+Wnmaa5OMe+h@A&%;E7e`PZ1aWm>uAZ?U1lz
zv`NqAlTDdAs2}Vbo9)AJsO@EL<=p}{p~g-<Hkyw<j2o<~>Z`TAQh@G)Gx~r9vaPp6
zrl3V_Q*+LsYeB6W23KLQ4czCx%T#oK$p^ZF>|gbL4EN<pPunFK`$+OkYKV{ODR{Np
zzWSu|T#7bveQ4pJkz;MIn@D`Jw`exfYrOHDV=;HOZR}Sk&jUm-C>g#DaCjX$tcK&L
z!{SkIdf`a@UC6qTQ^rp8L#}WG(=1~?A-9XcaiF=azSi#I`J6$DV&(HHsJT8PXS`|+
z<t}JXZ5tsAN&}MD&Re=g;hu58`8M3{J!Sc7XczF_`T?kd9x&{lchQP#aT3mY#;W)R
z#d_h~`z?Dt#;k;iAsvaC#`T@MOL9qN^@TJ^`^BREZuinOb0Chz=Ym<q_a4Qb|Kxwl
z@)rtK^Z-O`cD*51XKrCw!2a=Q=rBo#PCO_8<QcJQ;Da<l40o*T{h@-;{BgIv?NqDX
zx7(J!Df#UEfe##4?XRrv+NARJH0UGUqR%vt7xyvW5Lc%+d#Rwio!BYWsVR@31AUhV
znpGMekg%wG);W4Xx&6Iy%>dP6l4xw_Q>P`K9ZzZ>{NZFMm|v-(@-I-LcZo}d2_e|!
zKV-mLZ`rsPzNfPqhqUB5^(sheQ?;z%w+CsL60!nFS|FvNSk>o*Zq^*|AXkTS+owJ?
z-7vI(UT@WS>WpEPr`#?aBW&spX^%MAXEsH%6U;7}kd6pKk_M<wj(xM-V<O{r>(f2v
zdi(v$cs(;y+vCRH$hxm_i@AA;^lf*H96<HNQ>d#TeLxEcJb5?J51T8lfQ=f`s2vSB
zkx`?<25DF(zG?RU6KJ{(l16xwaM2iZE8Mu@H8hmU%0W&yh1YRgo|@dK_PrbW1i!G}
z5j3s<<*>4@vZ}W1Mf7y{^on9?5H~L+f|5=i@%-gQRp$19$I$^97ZN@CbM9EUAKCTl
znF<Vwt!0kL0L0?|V|Bbnd<s@+5-X2Zhc$LA2^hj5_n!nZ4ZDjb8OmIGjt}xOSR&uo
zJRkfaj~72Z=S>2JOw$6BQ{JZpY40*Z227?O-G4=Vehj0qVo_LZ&Qfr?3{P_2V?C<D
zNXI&ItE6PIzZl(!TrYHzQg@nlEJx44?$N}{HFzw82<!jrC4gK?>rTx}Nl}-xx@NW~
zPWsZz?8_f+c~Nr|2%u<ZVMoGT5FwPL*di9-iIR(m(PS{H;u;MNu^Jun<abC(SI|8@
zW?@KBDk<P6%VZtTXsVt<Q(`3J$eO5mH`Ny88BxUNyTGBhU5xzf-a51r0c^`<H|1qE
z-q5$^aG>Fg-(Chq@Vn^oe5;J&(i~?lvQ<V0R5p(G*t0;3Qymn5BtyL=Q^9;un!Rxn
z6)0O&_|*ffHp2gR?fGwEZ^aEDob1nLXyGRxE}lT~Y(Rja-INi_o#?WOS7K46U-KTi
z(OHB7ed7xZj1^6Lljb{3%?I^PbrUPLUZ0fqQtMxvmA0EyA5)UMD>?y}!WA4Q*Tvek
zELabG7zA>sA2}~@kGRP=D@}Imu<tBSB2FefSwopRvfyEo{cZYEbhp5QWdXDyhPp-j
zi~Zw_Fp5h+(HpOe9QmeL`3<g;%#|dBc(XT-;wn;ap`Kj&5tAeRs9hf72imx+6l!E&
z1L2I>ZKHur-R8+ojfySLdS-_3W#<M*MX}XKFII+RVTS;Mjh4*VI*db%TBiz10Isnb
zA8Y2x1JOE#U=V*sSON0PH`K6Zl3J~!gr^n&b%Yw8Y%7=$DGKrf7S7(gEYuMtPgQWM
zZJs{@!1WGP_vJ{*a(cXCr4x`B4q)!=45jHXY>`6vlDL(y;aQ)FX{dOmla!_#SUn$4
zteSoDi88p?Hp1avpstPZw^sEWnm*slac9L#k0|01-f$_%sj<+EV&%2Pt0ekNb3G19
z&IjTD;!H9Ni|!}hH1~Ek37y$U{~{6IME4JahRdjQ+#?-qhnsUX6I9}{?kR0bO~GG(
zO20lzI}BD2?&*K<KmSyl{|wasQ6&e}3RC_kk1S3mmd>>BmZB_V*@zx*8R`ISFHq0U
z_icGJ;nY`zHd(RbZJcxeZX7rVy{oyLe4b0z`K39OvU!gqEp%PoTMTY|1E^xM!8tAf
zR8Q!X7(=Jn>najJ`zEidC+Ku5X^A;S7_FcTZvWXCWI6=g;E*OR0X1fAd>s++;9DD)
zoFGfLb$OdXpa?PY$NyGrP%3(p_-^v)le~w2#-2U9VfS15S<HpIuQsNE??fy?el}95
z{)+|2eFN3VGtMNX*msPmYSw-PG+l`LguUdRL61P5CT+H+ps0cuuTT#OxKs+6={$4v
zm#Y0D{nAWZT4^!l67z-dR0*a0XOIMV{G(Km6w(<7AR8c?#-1{Qp5wLYkqSeA8wQ2-
z5|Di7oGCZhSqUAfgYqRt@gZz&!p)01tq1CbwU*pbI50ug%QPq7nQU0F?{JEe{Gg(j
zU<Ej(uKjHzsVU6O^!x*mdrU16Dr=dy5+~HUJ_Y!v?GM+r#?KT{lZUcdyS2MsUyBT-
zoWHp859bJ0DCJ_{oxyW_y(m_q`TuZZ#_xiA1m3NUgzey=TQS=*anO8%nUB8@!it2e
z_?bU<%?=(B&76WVYYG@FBwspceM~qhxj$`IGcmK8o@6JaZmLN!deJ@SWc<R8zqbwp
z+N98x)MT5jVB}}0GUcE5<ESx>Eueonj$D(tE+;P(=TI+RlXBL82P}jv>O*Xoi>{sW
zaXsUsby#5TUsmpT$(eY(t|mld;OMB*1Pijm>C^YMlAvSw_t~hPG()9XxskLSu-0g6
z)v&+-ox`u+3-#jsfk6qkm9m?iHz7KH=M^oarY~-KM-Vk=^^u`*k>>$|2S`#fnVS&3
zMjmvO$Oa7vqa+6L5xq>xN?@)GV5y^)1z?Jr_9Z!#rjCXp{v)=`R(|+}=iDK#X_CZ8
z#a&oIdTzJHgDg1Z`a8V*<}oFOcL<<5EIKip>n$Nx6RBTMMuyo@wa(cHzp=Wc0ULLF
ztbQ}}Ige6E*0}?80J~=+Pp!uneM(#Yq9-(x@EzmSyGi`TGtk2Qs=MR5_S(`-D&MYv
z9N-4XChV(#-L@^do70@Ol(fdYL?mt`X_%ELTjU4WoQxc1uV!pSrX+)`=05_4$n{j^
zW5QY=3D;oa^iSMJ<5uk%Pwqdy`eWZ(ufoi-V$w1>k5C`Py(m!l2YJEwE{uD%keSB{
z-NL8%<-ezMoT_VUU*50x$f^X$fXBD%&m?bPgC@>m06nb93!4P+!@!BS`rSh*el<P)
zXb(V>sv|M>K<BnRGT2VATheRBB^~Rf8a@y#y7XQS+Enwrw(|b)%gVI<kFGkLdWHMj
zAKgfS^CkEj;DF2li{wx)Y}7<r5zx)hlIIuK?_l^OE}kn*B*lRu&zzV{eD0f*Pj78G
zd9B4+<zRgex@^RH!f9eIdjFJ-dEvPhFFp5gjDj~i=;R^@nNag{;63jP$#8okJk<@l
zXXC0<)~9+(vQj?3Q8dZ~j?|LfB_?@^Qo;C;=cX6YM?b|mB=`NPjDQp}TFM|J0P*re
z09iAaB3{E-mkXBWU%=#}E=<}`4{JZfAhcY1jI=5`)CY*Omqz?yV@WL-b91-i=8QiU
zw)bcRVj@$H=KqGB4BzRO_Vees!w+_z+?ME(aUsRy<B8XXLAixF1*=nX3wJJEv%*XX
zrLr0hF#pkNNA;~i#QP|$m`OBP)-_9v<CG~l(1g^W><N;7th~EcbA$tsaeNOf7I-Fk
z-4O01XH&fL(cQSEdJ!haDAx|ra~!T6+9ox}ur2}s&1IC1j6lER5o>>$d!HeaJ$$ws
zSbM9UL2RX5SH&8t;n<J?QosdR`$uM6ykxqBVOrmIUb<N4-a^pnzI*7!L-VCTmyGEA
zV8zTOjT0&|=L5JFVZ#h4y;UxN4OGbsNOmR|A?wHLjS!W5bR#qkUgk=RduDQ)wDK;*
zAC9~Ggkjx-PktjBqBjn>LA;x0ah>Py&*}7)r?>CjVW1$EJyVf69l(7AfqvOH7`y?3
z5h$R1c$dFp)}vNGQfHdPnx}&jy0|uulE_m%UY#@M#1*IxLX}|Gh&;!yuIca(1>J;5
zRgW%w+7Q_f^txTDZ&<H?orP^3$0!<!!|%Rh^bqTVKd2<^<rJn-XE{fk{%yGR22ZjI
z+;V})bHZRZO%=&M)yJ^M#TWTMuuk@(>Nq_#w>_q6m`U;3f3fa?c||n&5!gWo+wD#~
z>)ws8_#b(OHtP(#Q@s_ce_k#!TU6cQ`}ym_!q-nDRpn)%_H&#L3NlPtzd8BS{XWfy
z2Z(>L5KGEPSR)qHGfrUb*SwaLBoNdExyYx*Gr(64*}pEX#&0)Ii=a<t>G3F3*OP$C
z`RLo>%uSt_L&P{b{zP?sPZP|)DD~Mj?)>aSVW-O6fK-iT2R)AABKb`V_308YAwg(I
zd%>>Mm=Lv3)o0`eq#3aNEwT#(7mBk(4c#iOg3`~^Y(LF?dRsam8aTMS=jiR6=TWT9
z94L_1R1&{1!~<``463|4f>#d&kRt4qzDg5U^<ZTm*RXGn9shL*DRXh%K(40W8}z0B
zMjB7M_*YtyW?inORq~B}$L{!g1MM^KA#3<cv_b~~#l9veA@dJGuGbkGa!B;}W+rIS
z=TmY<4RBp%@4X@hozC{oT!<5N3x>9B%XHWKvxr>nVE+piS_G#y@q6$8R$X}wkc5{d
zP83^;TSXO{a86s4{6VAj<-_-eC*MA)dH67;bMM=xug;h=wY>V?i=K0;12tp!mpTCf
z7U8L)V{hAZU+=3~x_Y`nNwnd8l<JyS>vkx260{gU3lw|MGYA<<;#-EFjZYx#0*5t?
z&&G-=WrG6&55mPMHV%&wf5#eu>E+#_))SGthJfcwH1$w~iRFo!#IEgkL@m=7ox;Eh
zIq*Zbs3DtJwk$q=)>@w>>yQ_Qs$K1H=rIW`1fepY-?18DF1l4ck25*)%?|oBeO*fF
zz>dyaCYXsXC4@<d8t2B`T-9zZ3>EIivVK!STUiaEJm6pwhOWsO!8hvRm!ZE138p9>
z`6j_>Oc-ca!-KUNjAIZmnKt-<u$<tO+fvWjbYmKp5^nMa0A;I7Vk-vshYU!os(JCD
zB=rHTng>0#`4#Twgp{^s%TuG9=FNwd&bqtRpFMjr_UuUl2K*aVS2>1x^Wx>p+BB#1
znuO`%ZJXL`n@ViDHL?%h@!XK{_t{mddm5vbW0pjj^CUZ9OZjTA8HL&mX!*!77aXr#
z**z7y`<vtMU$1psF)aR8K2UXyyKm1QuWLRJd0(CWU44f#NwJ2l#p-M>273WK&+iy^
zr^+Z1UBi~G0VBrfJBk6Yn0c4lW^TIU)I&^u#cI%JT7CDHU!TLSwUgkNiIOQk70|t4
z2a|_z+;c{TwPSBZoK+Cp{6qEJr^-@!TAKD#CHY^VBejL|++A*fn@R$4iyg;88v)cR
z4+5Z>%|(n8;8JajtKjFa^wyD#*wkpiH6yL|W&8?@n@Q?pLZjx)9mv4~GE23hWT}Ym
zZU>N<$=lnczGc`JalD(aak;=WA8Nhv*;S7;rprqf9_pO5@lcYlU^VHpN{!_D*r}8M
zLJfi2KqMG}(I!nmoZt8z69+<7be5u*^vu1PmO^^3SSi2FMNhIuN^lH9m!e(DF?etH
zbSw=E?nj~pI7XmpP1sP=YieVcOCjt?^0@00e>AS+WT)A~xz?AJ@VXZ&vzn10iwjY-
z?DZIOc+Bi0md`!Tl~t|G9~65rcJ*GSmZa%ur|P6d@?y+h&T!BFm7A*l8xSrOo+#w&
z&*fADa`?AJaCgtZovkJU>G(@bfcPvcY2hS04YQXj8VxLjgmtKkK%pZ7h2uK<ymSkF
zMydk}c`SR0W#TMxGGku@Eeztf=qk#Jk?7{RrYg{BTbCN^OVS(<pNV-zjAR@H_ZZCl
z`}C;Q2ZMF;A|hGexak{N_nz;@KAVGij6K3xeQV!4?=E!X=jv2l0CKuQjdHZCSFNrk
zFZVq?=|FAo<&m^^La*-phxjavLb=|EuHu25hK-~;jWZe_#;QO&l26-6F9XICpOZ~`
z7i@=0ho{29FRL@&-M5{3%!#l_x1G+gsoXpG-qXi15Vmd3D=&hwRItDS`3tHMp;+NB
zp&`3eq7-K66`*uB(!yJ*FhFhK(ELV@dH`u<R!?dx_`q8!$&Zj4pT0RcKrK@h3Au>V
zu`crr^^Rjbmv@^}-J8-{ateHWeGs>v#>zjCx5~13Srk};4uq8+=vpMB0L96lF^O$3
z@d$JkJg+T1(h<6o7eWQa;kvRwS(@c7lUlqa*{I1P{799|qWhw-{2^_|W{=6FuOXX1
zv`g`Zu%Yi2F>2Ao>12=Bk)8_Gf#vshy%D$vi^>yo@2^?!qZ(^?f3?d>L%;1&yL~9t
zpJq*{5k-Mj52nx5>Ubp&HtjwcvpFE|eplkN)w%5ZQCt7mu|(D6^ywakcoLM+{CE9d
zA`_=0NS1BlPyebvobdTtg!t0r)X?IUmrs^>w^KZOw`h>YMH#c3o1*pF7SsQ{k+{NL
zv)%Yf=;~KL=|%mjg!$vuhI=40mc@g01=dN7FLMPj8!aU@h(%$5;id<>gYSV1JoZ7v
zb`Y=88oxq>MDTrAR#!)0)yKjszTB!c=LUMUCSLSbt@8$Uc|Lf@GOLXG7(aie8JXcw
zg1JURwe=Kg#fayk60?P{TV4zlvsuXX5hvD-p)J5^MT?;iGY9yOsHYp5M3^0~*htom
zziy6SPWL~47}jQw5Z580bNaX@jn>EGg!MIo3TtYxYafH?myP5qk9NFQRj3^YzIJws
zR#w^klnOi}yNi_OATuMaeEbUZVih#gs7F)bOYmxdN$MK|EOlR18w#0wp%kFA!`xm4
zf$mp_v@O@$#I&PH$8uqNO4{R$+yUgSF9sP<sGbKK0!DX(O?O$*R&OBBuV2o%3huwo
z$OQpwN=K@5L$TWv39Zn(Y2&xLK$7g=Pz`jg^|eJS%efBDwN=9Mx*&nX+}PxlV9~XA
zc5K!$WQwl*FQ<Q3z5g9egFqc(8|DSQ<NB2Vi@x4+6PnYDlo^-4@}z-eB9MemsB*C7
zekyv_vGi%U&F{+ZKVCV2>x!TJk?|b@huRUMzqP&&AGg+=xLVPhxw>1_C^`tA#BV~P
z7tUGTnoqlN1-0+~sOYNe!<!WAHV&MIEjZH6eyg?rtjO5B=Y`4)yMc(<Y?U2?4H8&a
z77sAnIUAX4>2bzFwoA7{H_%rLd7bC$@yptmF9o4(B{$qH+zqF(0cj>5D7TWTUW=5b
z{1xgS!E-tvbrjN>3OTy;I%w0>NM603+{@fMd;z{I-=X}?e?*8H?3eEU+*@AKUnsNf
z4*45+d|wv1Cli2tPIcc$0b`FUQ6#N_RAN!<+~Vtn;++SV!pOXD<uj3&Q^cTTt@6Bs
zVkLl1sVrqSbD$G?ICaFhNw>LVa%S=H_&WhuP)KaCmvjDv=w8}A-N@J~e#gc(O3v8O
zp42l=1N*mhU+O7$)yQp8tnCWATn<Lv#!=XBufdI1pi5o*3l*#OFZwWcm8UJtI6Oz1
zr8KQk9idE<TyiakE(?V#3MwnFXJViA6Y4Bd{ml*=LLRvTCtd<h_t?MRsPY2njzj|<
z(Apo2>t(*25pfb>H|h(!@?AmEv`pCOYY^jtgpqUGM<Q7*%ze5KaxR9N%p`<lcprQQ
zwcO32vreasuPuAo7pm`ivh=66d@u4mPILfQ&(h=pK1_cGx=acK|BNTd7!|ewf6Y>I
zgms0lbn2C9>l`SCY34x63hIcSw6Vj*PtUj+`?!2NlIiT=T9M|o=%nxBeX%F#6;Ycv
zd;<p^Dp}2HaAoQ;E+RnDexx;-xt3uA;Zyto=^;`@vWq-1QWw^8HBBX+;V*S2HHC8$
z%#!Wwx@))P2QYU)gP93_`QGEzB{xHp1}{k!G}V6O*9Mzkl@`}69%VJ;ikF5EK~UAU
zIS9qecnIj^Gy!13)^jj1rl{V8vtoj!ZthItyRnNOCrR5#tLc=Z!YQ+<AbkRLbLgOH
z!~kdYAQ1b!MQ1hd%p=By0wS&$+5837lS6GktVwJche4m*g7F(H=FhAi!)eVhwdq^=
zI8_rHqP)g5U&2*6Bt%bg>4hiYpxC1Ks;W0@y|X<>wXKfh0@ip1&RfNH7xoW;)CM=z
z26lQjvqP-Jy1){tj#Pn$xA%xa{s?%RELDad{QH1Cl1~{<FHxCT(BUVmFE%TTyNp;X
z>8_4~qEM;>-|I*LHonB~f%Khi@T6v-g|v~9RC56P2gsmqiJ>5)MnD-4n@pfAdN8hm
zM*%)~sRvL$@-^yY>d}oQ+8jw=O;0&~2?d~ygrS^`6z1M8^P54T)Ziw8*9|Y1n5?m9
zo}<;;cl`@}=}BHZ`0#>GOcdc3xWQyrL!o#n>k{sL&j@D<RFWVF7I5jpVfUC&*F<2&
zL%_dBj!iTwc0sN;sHW!l4WpG-@i8|0a>hkEiE#<*S_&jd{~8vAWZ0eU*$lN5l5@T2
z*U|HmKd{p3Hut{rkM!B8(<h&$91(Bv^!*^pd7&3p&EH~d(Yai@662SM!J8+OPA31_
zYwmnRVaVFEwYL6cb+VzzJv_I&x^U`}&#NF&(}g8=7*-$-I_`>C;3N)H2N%~d*2{C5
z=FDF426U&ClM;?YcSjmE5|^d&!`)-iJ;PJ}7kt-)t`$!^!0KI22~z2;XZI9%z*oi}
z=`PCe{S^{${0i(qU4<O0J*p(-L7qTu!sr$08EcYOtPqHo0^I^!0#9?dVl6PcaAU2p
z(Se_hR=Mj8tp`Kx4AoawM+%13PB(fj&seLgxGe>RS%9)zm-)n*o;jKtDKHI8RL$B?
z^WD5ulA;JnauCvndwEg3a^mE*MO$VkNuNk|O{#WCQP?m{AX>{AP_c**3vr|GMkv3j
zUD*|8N0%SrG%MEhnI}6mSunK)W|gr0dy0>RKGR#i?^w#bOAlx-pHY?)5tCL_Zvd)M
ztjt+7qua^;1R_fvtwXk5I#QQ(Xr^^&9l|9`MxNHt%UtWLq53k3nnR<NdJ<W8Y~D({
zfKoD6-Cq0ntJ<-~Z?3$G$i33GQy7K!RK?WQH%lwa1fdkCfca}zWk0GihdPl%|JqYe
zO}|{aD#|f^+qx|wYgJWRO7@d#$0sCT(revGN4)8!>X74KezkcwS$H=i>w4z3cFbuI
z;w*lJaW{WS{CSfw^w0A^B<+0CnYxr6IrgI4t-5d5X|7#%_{6$1zhJ=ZZIrZ}u%6D7
zrGQ=sYZy36CR^ZiQ7WKA%>xmNInH|0I62#c9xufwnX#9TT4rwIJ$ojopitG@P6@dF
zy<d9Dxu+I}8cYq#dT2q~#^eLUdbyTDO;!G2a+bQi$3tF5q!<tS3Xeal>cg8k06CRW
zVfZbJQisUk+|e*!U13lNb#KJ|2i|JCM$QTRd#1dM9V>i}9QFG88}?J1LKURROS5~3
z!}rBFg&yM9Al5M#Cvnu6=5+0e=FGJ`xS3nWYa(F-nd@qvciNnOgglx!R$0{<+O{F6
z*i7!tPa8_7<$h2FdiH!#O6=N9{g@`-ofy>DzzE)f!D>uIVKB;WJdDyS%rz8ag@v-P
z1wf;u-=T>EO!|_ceKNOh8|wMt4EGV&Tid%svHBCTDv^{PcA#@spVU0GTaev7m6td|
z5=^4TlEL$+b$0ucQ9<}nZS|$QfVRUA4;_5>GCztH%z{_sPu~BIafo016)e#a2_O&t
z1jL4cuvLREYdEtE{J)1sC21)-v~g?lksJvHNLA2-rB!_1dU1dKU9j?z!;JHxg$?99
zWJsVP`VD5ra7V2K>7j)I?t8~Fx0Y7)*qmLL8dp45!&5;*z)}8xSBT3Gym;Y#{c71;
z(;JP$=Mv7HQ;kvt{B>OKt=38+eVZDO)lu_XI|f|3@uZZtu)ae4j|?8XfZ-e7aWuU1
zyW__@;ddhL1SsuT5<w|U-`V~7oixJf&#G%-+C7d-;Tb!<$p_oro&TOpu82FC_*dMP
zD6@|+{^qA-X(~yOn`j^KF~!+!Zshhx>V**Uo9EAe%>EBH{B5R`LAe&@_tT5g>X&6N
zPP{1-b(qvPc$~lIq_s7Q9|wHY)i420pt$c?`-f`@WuM(%o6~lt1rdg)nz!7)vwtf&
zvD)fR@vT+Q@2uE#`@q`EGc)C5UXcXZbju|>Eoc8L=0#ksy=6zb4~;gfZrO9_>H~Yj
zHCa!VwXroQ!r$uZ1XYC}2Hse-Eo;fUX13QfxI%j8lEVg!<obp$6_^WP7J>V(A@F~v
zH4CaTCpbTjsi){8m030sbpw+g(Jfz*%5@qzy7Vfq2+BZjx6MAFD><YmG@m*-IXggU
zKQeXMtWd9}vhrDZb=_a~pS%WKtqqSWDc%_vAcas(vuHUG?pnoggs?z-OiJDA3<EQB
zM<C8fkMQcWIhaMU_-)*ZP?bHQ8<Z2AA1FG)&Hvyn9;?0|+XRH&g888ovuDRrUf~*O
zsKGk8L}JNiS}|LBsz6vknGdj?^NqA6=(#@THUy9`?s?U9M4KqKk<h(0ph<qS_%cII
zbOGg<b)%@Vl$Pau)x3?mayAl_YAzLB;5OO@Pbeee|D?rOF&nV}tPnoy1_yE@-q4M2
z>ew*q3y8k{!zIAMMXlDnfSv+}Oj(|R#kXeZyBXUgH+r`(c{gwdHqBe#9dfk9sM6WV
z^F?Xblws-_P+yy3h`mk<Ez<Jun9czSF#8x|p{by4Ix`sxfEI6c^HF{G#jD6Pe}r`X
z3j`p#{fjO@=w~gxWARWxt<eZ4Nde&WlktxyhSWMy2itNlo1V%Xh$KCdkrnuL$R3<R
z>q(<-l}ydPiZ;#~x{o=42PXYLE*Oulagr6u|6;g;Bz85}nXU}`Y{mr$5HiIg<)bj+
zA>`VmNzr^910R`hG}sP3C@HZUuDcYH<Sf(%Iexh8<$3eGo`b~!UOu0zvK<S^C-tf^
ziofTuH+k6dB-JTzH&`4K(vCk~_VOQfT9}Y<@qGS!&qMQ;sX}3@W!HenQ{>%jIB#jW
z#$mNa%hxyKH{WLAT3t~+;i5b9U78qOXRJ^?NxKLKH=caGcuLXb1*W+({ofW{#zzjb
zLDY~dkN8g+NvR}HsHnQHn6s|=Q+{0iR>Y}^1*M#;D@pj$i8r?m95|Bh3<(paLw><d
z0v?1mK^w8=SI;Nadc#Jqm>Zyy*btx7P0a1^cAj)f`DkY?Q6g7wiFEZ8nsdP=PeivK
z?+(eZ5`F%TIoXT%j{~IsAxe6JUz|}WXi2Tdio%-f4dD5yor{N%iAJl$3Bdd=X~iWG
zOrVzH2lH1Gp3)<ln6|>XWSx^vK8J<`ihf%8KpW+LRb548%?+nd9|rh)YXg)dy-IR9
ztAWGXNYEG)msw67govk+WQnbjbTGg5EK<Z!E*uvuxZey?=m#n=kj@QiEh*1yT<vnT
zAekbiuKH##m^QmcOXsInd97w{W;+?|fZ76waede+<HbV^b!5*X5&ae6zz$O0b%xF`
zaRtK`h&7fVNgl9vW~JbE`{VZWeq<_*X5K6-1bo%JPbo=~DP_lsdZCR&NubrG>)GUm
zxUvEd&vO`7(zbt327j<|6`&ym9R!ktDvaPC=b8MEqFQ6%eOX-xnkt<55lKGVY_y_n
zhdF))GS3ea?gLFpczMP(lZxqwPX|24)7%PITmG~~Jet<RE+&8VA?sFVMEs`o?K=kD
z*bjqVJTR)gEj9oOV8k`GMl_JMCJ${w_DI;VOpU6(Exi>p8v=ot(iBu9bx(A60m91t
zX1ZbV=mv=i#jUTR{jg`i)zhZ;b2^@wzLeszWYHfgA2`raSGIT=(}>lu2Z(e;h?k%)
z&{dvJH18tsI%}1U&swYYioBUP#TIloLXx;HrGIM-7o<O_$jk=%j@X;Cl!;4D>1X0k
zJ)@|F9Zg$2*jJu$Y*zVel|sD+fL9*0DpnTeG4LEIE>=&9YvQE%D)-u`4Nv&^iWYrg
zgY;p$YftE{XG))yMkD~u#KHQKoMh7Jml_^kJ`^vL8>w5qW88YU#Zkoew0|?w|7U>y
zzyGK7_mrM-&R(mZLPEBAZg4q!KW^3YKUQq|sCheOhcc_#*93M*36<M5`<lVpRniWv
zz{i6XL=8IobS;ppILI|InKW^p&U@l~<=XGmA}Y0Lc;B(1vlX>JJ$^rO_=I}+zpsm(
z_EW4LL-<e)A5eV@pi~n4C9a%!Q?W_FTu1+oIRvGY6xe}h(h*Z@eO{WO>?@otul>m`
z(*Mzf!KTil(1R4SviEI8WNz^4lfK@6599j3G;!FRWlRnF4?@FQ<~H;sC<$zohw<2P
z-yJY5A=H`4pY%GCkUL=8_o=6uYSIigiPoDkAWuiBb2?RfM~&!GR#X47suDP@?FUUG
zqQZ)SE0x~`nJ{o5ZlbLkW9fu+h>T7kWmkqxyiX?`6XqjVq{KLIP~aXTyyNjF7R{^#
zw*ewxXW^)*Da~g7D{>W{Jqxe)Iz{L3@kLQA7l5GSOesMQ!}CCYO)Mogi4*IWL9}Rw
zIaJkhYC>00Dz&w+4lwLBqj0x6_Dp5RU7IntrT7Rc)T|Fe(=mAiKsaxUaL#1kp|0Kd
zxyU1L-u#CB;;m3KKsult#d>9FN24cm6WvQFb-h6(leCeJCg$q;KI)`-yJcgh1w`Zn
zd7z<96mLP*;*nIK$gBx(yQg!NdSz``xP5!w>$uaaepZ>Hq3irc@*6thiIB5+AjS<Y
zY2qyh)#dzT9n62FYnbZw>0Vi&!VF1*#7&v2fWFLZo0Fp{4PQahKseq#W;MnUlxwT%
z_&(?Uyv!{w-h@Hlf=7CeV9n42#>4lAmLlgLqfSr=Pm_Q}4<iNV!OnKq9n6SNU~E!Y
zAhA;RdW7)pbT|HEMIF!-MTwEJ3{_G^;)or{h-WkcWZ}1}JK}(v_1G`C5LN?)No1@=
z0OVn5mArhQ1uOu@x-2KKr?2BQ>enK=Z$^Bczvx9tu$~lT=sws+Uk&K<eLs_T`9&0~
zj1SKTotDMsHI8{{XK?B19+5<TxOzpQ2ZnV=?MEak<3NXaY}|4N3tXT;p29_Ouyupi
z;1@nG)(hVV<Q&Mdg}GZ+`7w%3$f33IO@O3okQ!!EpPft5zTz{saL;1CvNPG~P+vJo
zlT3@qnh1Bx3s?FoL^sa-6Nx}-dzZLDv3?xLO`%&=n()a0rECih-q?Dzs=i-(83#x7
z9U3?r>h)1O*l$b}ltwe%+>P#+;MB%}I88~Qs(-e}xwf1Dp>852(-4|Ye~O8m12>z1
zz(6UOh-%?vT6K_nQ-=zr6S0%IA({}cc_)qQIWUMsNLBdQSj9Ssn1UJ?zW04ijXeJp
zVKs@iXZx9jS#-5t3#zQHOyBmI{bZ~<_Pxr-cvSyBoFlQVLbdKT;#6_qkzPa+U}aep
z<nnTOM#U?zQYf0Pd4%X3gI8zb1tym#GbJP4C=pC*)nl~tp7>nT{$r40<@4wL;u&uC
zJ!MoJ@IU=R<#E<~KdDYky{2M-R4Q(!-3)(24+al{j}viZ3?z1hqtOOv(0fJ+>JX{9
zWCc*46}?Sk-X=c@6u!<It)@<W1D+o`)yZ#Ooqt~b@+Cd{H>~Vr7t@Gg4jZs@k$ApX
z1I3mE=*rUl09p8RlC)jrOxIin?o37E;&BjeU0P3Mww>$=)!R8-TMD#WDBd-mk6u(g
zIC=q~2*1g}BCZE>yWL=JJmtFh6KVrFuo(bhxdGjQIQ=L#Jgs!%Lw^pXu$Oj>aKjD=
zP@{Z$B4w+2W(HVk>uw9Py0*X6t+iS=oy_%lKQI=qh!1;$VQn^3S^yk_rPfFt)G-X?
z-uz^iNCq6=Qmq55Gt-RNHm-S;dNbHwEDMX9)nji!_re{~W~vzxZXpzBEr;}`%&pzK
z=k!@;?{pmMq?&FMn9CiUx-Qe^^iE*sN&v4**ua~$K>R^wR!#bj*#^8r?ywrV#Os+l
zj9);b<uL_JA5zf$BclXeh87T8C~4IhTGzWpU{<Fh#m9%v=m*wsg>Hx{@*h6-nef$%
zZ_=f*Z*t2gYIu|S5sOZI-5O7XeONGCh{1k2^#49wi2wDx2jzgWTwQ?$Ibs&;Suanu
zcI6c~UKTBX3P#8Y^Gw|yJcIfawSX-fX)5$JUwrDKd_Dk9{(dPf#=uHAJGH&@_=Bro
z++eqYYZ0=my@rcAqPX-6O2`$^i2Mq^jxIwD{PaR?fet5I7LJs{?#&8yAem`B6UW>N
zv0L_|+e+wn_)X77!&?(C*E&3+=QIGlQtdxOfQp+_>hYRReC-|+c^<ka@TUpkgM}FK
zf``gCo&UfMapx2boaYjG1?w^npc`MqVd$pcP=9!k7dyl7HRDaa4AHkR0RS7%K0Gy~
zq~d+v+`Q~+YOvakHACLs6_d~O5>6>?&ce<ZD>j3KFFJtLMV7x{L7y2bzhg!N0qT;k
zQ1t-|LIhQzYer;m*~2PP%uN$wO{M|xXC=ik_tCK@;m}Hs&aHByIsiE-ETJf<HHlUp
zVS+ylvP?@iNWJii{3Xx>(0`DfPa2z&v-3aXHLXzkm(BrPJ`OrcdT$IssHgA)NfO~?
z+XzW-!WRP(fO2?x3y`9(-9z=WOf0U&57+FdFmXQwHMbN{S-E3YvI;$Ja@@<OV_rj?
z9Gm1P=K{R`jv@;&I1vdwqy%oc^E>8I&*E=jfcO^C0yRk=7(g0L{uuG8g9yYyOjuLk
z*Gu2P`K_*6`Hi%Go@9X$C}c!PGPXMP0AyLKWV$LBT_<3eOMJFfIN4J8X)3pVWsmUU
zF3)vn_y(l4B;xoBQ+;u<n`(Qee#Iz2`&p`iMYhMwwK)S|=A-Wailc~oiczd02D$b>
z<oVG=Uq<F9>ltn~!Jx>y8D0`Yt@V-r8R9Q2qUKc9_RM_gR`f9{Er0hI^5%Z34GYuA
z>vsP5rgPFv>1)Qn^<>H5mO+ITy$4+neio6KT?U58JZvfTkFH$_9U?9Xs0_z8I&lCi
zeYX%WY+$L=fbFp_P0XL5k`%KDXYA1)bnBCb;KvS<hxj=?V2T$|;k5p;e;i<$Y=?pF
z+PB3egLGn(0F;0VB2#FEV?XW+T?$<-838~{1K8n42*8``k%`ZX8IF=E>@e*{Xa>pN
zi3if~w&SpAQlv@MLm6c>PxS!qi)XM><;xe9yVnnN>|Pf2%5Uwh*r@%R*1W`I?i-5Q
z^iL_OctspeU_n8=$u6*GROKmI@~5l-Fka+r4Dm!SjsWgaa03C07(YR@8h;zrC0(D3
zn8A+EXYS~$y)ukVz)JPx!Kb5K^AF~EBEO66ODhI~O{)lb-~`LU7J>uq5%Bj^nPe^6
zC|YpkMpMfc323N1CmYCd8%a`=6hE;pq34B6U3y0Y(CP;#Dd<M+fQ{muIWdH_=zc*t
zm*U=IHuk8?Ts)P&sHZoZVl3Al9~zscVu-On;>RNBzek?~5#$-~Ic~~-5sPZb!PNtZ
z$-MG&%>BqfR@+F8t={l-4K&a&v=-`!!x!uJ9O(?AqW(~slu%MMQTe%L`rB#Y*1nLM
zm5M>yd2;qadB*mfr<iLbR2$?}RRC5Bg5&$(R*<%JOiJMVk>Y{^hJm1V1%oWXCVQ1c
z)q49$ftK|F0N29DSvX3PW|YzW$Q5Gz99Pd5PRS@d_xfpZjbFi-_PpS>eg4q4TA=A{
z1lH1bu<c{c0&N;Ln^T$(RQA7(d}$?#Tv#_b`U*|D@`!VDd?Q{1sIG^_*w|(>PC}2_
zBQ!PSl0LD8xRSY<5+*8+&zW$m^cpJL{&LyloPs?5d$OBF!G?RvQZ{0WNA>y_%~=im
zi5KehWSR26n0N+FnC^(MvyiPVLu-(pr@&a%sjweuzZh@VYlDAE-wI4GVzSSTR;7hX
z`lxdhR}K53fk5q+ZmO=2seRu8;_d&_^6>vc;{GTk6h8(7QDVrR6Ad&lJ-{n*-N0ai
z5|P-Dse<gYjA58RrbkHBgs~y6>nH>x_?}mBzB)HjN?eb)wt5}6(oTI$XD)O*ZxQoJ
zG=Qn02BmsDk8yp_a{{BdfkuFF27}oU##Dvvd3>x$Sys_mzq$R9I6uamrH_<JR1$0T
z&P(x|Qyvl%YHhO^Scq9w81U%h7O`lIxxK68*6JDBRl@@*N{Uc3FeILf0dHd~SWC*x
zcO2+6u0Kbr0)(9H0SU81QmAh&eOCyTG=K*N)JKi@mTqNqZ~l<3aBh&+RNb0fy9{1q
za?0d5op-#vyIj7{rAzE;MV*}w1E+aVRdlEFtgCDkyy-K<UwPNRW1g!_Z2;brtX87v
zD)uI*6g7Z5gzPRA=>LN%!e_Yd*EUIhoH=pBMELTYJi6=fcT801i{j8aoPBLiNS(_-
z(@yP&1?Rkmd_2aryPQBFzLC|ijyU{5+z+^4DvRsEwJO4<aB%ua%I#2C1;|%*p<2T;
z(beoIbQ|E2;9g}K_Muy!o}=fSg<JXHv|U3_IxRG(?)7e4QC{e(E*h;4+0%Muds*-k
zqRc}D5XDXb3&KL#0YF&$mB;>$DR-D$1ZET|Y_KVoC~!!;v}}yDK9m=ixetm@KrM&4
z+vh!DY}|vM297FWBLy_x3Ookx=1^MQdy6hl4{Hmn^?NPbBl4r@VpMZLp;jip2c8uV
zs2H=S$cu*=m*iPy9h!{ueT;}Jk`7f=SD-MUyB>i$;%&4>eq{ERi>4JIL*BqRQU?w?
z2RDeBR}@*<GI9j8a!V#J6Zltxmo<OP(!)XSIK+Z2J1$Qoo@XVIDqJVO!8x+ndYIHu
zU}Mak@YP3Jiy8Z2P}Kv`l(6P-%NW!0!F>u1UK~z6RA1{{6%RJecseki>Mp8_5s~Ms
z8EGDAGS!I#>SD#p+h8HqDgGu^SWY@Z#<Dx|EXB{vu9#NNMw^`!SXb<T*m6;G$RFs|
zN;0ngJYWaS3WoL}-tblrFlhc+lKJJV@b1~}BGU`Ci7g$6u7`Z-4LyKe3s&Mg5Y?)9
zW%x<0#WnOcS*1K3U_yfX@IYiGra=Q4XaKS*b3`SivZrZ5g^ga3u;at8L6teftaz6C
zc1TwGh?2RZw0HVlp*HX0(=o>|P`id*g<fA(n!`@2fZHx&wy<zSKiB>m5Oi26tnwdt
zIcp%<5D7n$wMvLLfylUBL)!A&uv25WLo!N~)c9C8i&rQ%O@xJ~fUtA*f$qB!(>ndi
zyaM}R+XoNNQ$FQj7{=fv0rwsg$-4yjabG42B`o0U`aALxE^FGU(ln(bnMr0C!8vCj
z%S7)}NzF2=*p}F*bicEZLlj|Sang1+A@+$wA*dg`#>YFyE!gBMx%KJ00uSIG^U8Ek
zUDrh{eMEK***C(z#WUaqMxK_^lIsnC<OS2@B|?_6ZYZ#jSy;Vs&v|%RU3`2kQOb((
zwGnbnLNcsRmUVxA(OY}=N&8b@&%wag+No-@UiMKcAHz_c62%HUq^DRJ32l`a0a;aR
z)Eijc@Kli+=@19<Zmw5D+OA2!;G=6ou^9?WL4&h_7<T;@$URzt8<UCb>ocHv_wEWG
zol~79G=s16F7@SoO-rP2HvKU1{GaAG7_;3bVA>YX0QeP#c<DXE0e8a?8G-#@fsqAI
zvhzVh#bIaxsqroAHtge-os#y7&2NR7Sb51Ge>gr`THaN-?}^I%7#0O{co4GsG!Gjg
z1B*ege@<T7Z4Yl9KDWnl#|cBagw@|DktTC?-!}VJ9(btyxn^Ay@edwis)A~re#L{F
zXajl<h!(_a9Wq9)Lldn)dD{fO+o;2|_SxdPVbluPGXl}@?KAwLt-Z5q_=8>MZEcZ$
zuXG>e(VmXg<2r#E#hKFbyDr{^PDx2o*w$khIXKOty_n6_4(M8(Y#g9gjOa-%UI2-1
z4uh6cbJ);!*dm!sjo^w9+ACibfV|ef+GdwBx4ksRTVTdh9VF{I%jFeQDe0_;W%41;
z6Yl}rd&9T^(5w6ZrIhc!M6rfrGBGd_)lvOX;cA^mBvOQ_20AI_to3*_?0jy(7>xHs
zC=n92GQxL-E@m`0=PGob!7nS|&kwVQkVYETcl1PuUu1E^@V~l-JO5N(00+U%1H|Dp
z+^iQX2#4<HEMYC^K2b*8z&A`*{Oz>3Od$eX6xM|oj7wsTqIwM^)xNBoaen)spkd>G
z2=<SuwHz5#n$tJ;f0;PoR@TKhdp@7CL=;w*dZw%<vyGbjY)cfw=>V>p1RVtB;x-*V
z3E5QwVrinUI`SIEwJ4S#7op%++5}VK6hW7D-V^!KY^gBpHJvqC(s~reCd|679VOtv
z=y2HTamkfy5}$DDp>Czzetv#?cxa@J^1`D&;&4X?Vzg0oDMvjC7Rq{h<`OOkjdauI
zhz1OezS#kN$ElCrdhK?O6>?69cZSOw(P*=|AcIy!-Z%8>j<;RG``5b$4=X8{tn&B<
zkj(XW03YqSMceV}!Tf{@*XuZ4!VXlox7IOV<b3|TR22XV4Sp6fG_P^rzyHu?-hBTt
z_e%C_7L{z%-A-FQw)%NZjx~l}hhZIKK?hjK7FGim*_Cn|n28;bXVvduoPxrl>oo&?
zb)c(B5?;(ab1k5kKBeb03Cbv>fwcSt8-EGTfb5htw&0Q;c3z%9mOPnL9XzA}SDtD!
zrdl|uol%}&l;Y40@Zt&|1lQ~)2A=XbQR@NZu4xjZex-o0iC!qtNn&XENjGa!El6vT
zFg|Z7V?*(HwXut~@u*pe*64hj>cgxTVK=>jm1}4($PK>#$I|(qf;E{5inE4etY7d6
zAQbA;=lQrwqscE|_{3TPxLL7PiA+2l*I-~+PI~S@vwct_!L6r+8zrE&Py2li+H$8;
zxnws>L6yeecMd4I0rG#DLj9e*6p*5Lw>TKyC4974MPbd@hm^ruu1LcZ#)-ZVR-CVK
zH{;sH9J;Bv0RU4TjeEW0Nhn<R1Kral=IzIfz10l9ol5ekO;l}rf7$Dez#E9h>-@K!
zG7E&NRRQgRGdTld^Dg-xguQ@iYhM!0+<<JA=DLG!?nQasr+1tzkHAa=VaR%O6Z_pJ
z)5X8`4D<S^YVzUh+0V-Nk$lYDDtmyG@pv1kP6if1-QM+4@rHwdOm79CU6%mqOD>4}
zSpb#5xlSsdN7p7D5HOV(M}g@P5sRA0(?N|C-#lalCAS4;>abg@Et^<Liamfbq1ALE
zCqQ9T38>z|l9_S}LBF=Q{QQ&lh`hXS;;~f7JBqdcp3-6oIJG_kfSvW?&)^-LBCMnL
z04<^rd|bUcjEx4ISL^36DbZA&BWWY8qjwyQ=JOw<y(`<2Og#9!7oW4ZSrD3@WMc4+
zyk#+T?)lN;SGX}yUW4zV!TLYH%15@$3GDU+X3I%%sSZ+=PHRmEo1oTRzY<h1obr+=
z&T4`&<<#J4{Sp}4#8IJBWR5-N-YacfpL&VNUWC|SphhiSR+%83y7ZafD4KXrPR^s~
zoJ8X7?x4yGAHZ&zlE;HO|10aFD|(c5gY~~Cd-I^C?zVj#ii(OD5rqmu+_6QZR+h?=
zsHnJMTq;NqQblEnA+>-+2#JESh>%(;JcS1$A|SFvgh1I6+1pxV2MI#9M`e|B6v8Pv
zNxwIJ-`~tT?|kPw^ZN&wVdgBK^I7iuy081X@BzSM+~98Bq+K|e_dp-Fw35(DzD?Rz
ziKaKvEO7sRA!RA+=^rB>C2fA)Q<F2A-Rh&Q&gv+7epz+(v#iMvmWz(nGQa$wx3#Y8
z@C#!0xBs}gN{G1GKD9TeUHqB9rd(^zrei(GC%M(#x~NbjqSca+q;OB15ic4uQzgn?
zGKpiP&2-{wR?7Pmh<e;C`aQ5~v7bqgYf9Sdd(*F{r4D(I91GFa+{2WRTdO|<_=}rZ
z7p|ZTZB_+25pGxby3zX5_rpEZElxeJ$I`le&$~aym`#z|5`|&Jsr#FE4USPAGNYeJ
z&)Z#BrImYZ+N#4%4#x{!XD88rx7iQ>S@zS?KaT9KS-;-s!FS&ua(7D!{4DRE41C^!
z+wfdmMVyS4iLq_mc+v_C-1<^5GBTuKHW3r~t1qJww?*4npPHmAXU(I)flY8063TE3
zo4U)~M?<W5kKVA~iQyk&Nx96+H<+OpII61qpP&23Va+-nU*o7+-%XZfk}Em!`cvM>
z<`(E6NLRbCy|E)Q<_b0$%aq$DWLu$x6zx_Pq1kdRlK&t`E?qR9p(;%qFe}Y52&T5T
z{M*bSzMw6%aKcpO>G_eem-u!;{+nA!#8=I!{?gn9j4;Mm`@3jmzc`q3i(`m#n+WkJ
zz6b5N!`XlzN79?5s{{RZbTUJB+D_(mxdc2NjZE&#q>g(!dOEc{sDE|;NyGO7|L8p_
zmlO0F#WJN}=%va5HN{tFDmxl@OE}$pebOfO39P4tZPCdgvdD5ikL`>S&-RwW?g%~i
z&EnPP$Ae@gZs&PTktZ_c<fRji?&r`I86laWoJuFxyg#8w?sCv}eF+yi%EY!aCmoAn
zYJNk$$k;}c)XKn?Y&xC>o(a>pK~ZIZ$Jx$ulh45}r|h^RUct7O@zw>Ij#!}iB{>tD
z%w3}n)_ai8-hJg^<@3xzQp$^pF7O?C^OgQPE8N0BeHBF902hu4eGTnoq3Q$pCM*-R
zYU7*LEi1;N8l@}n2)Q&NBKa}PLcpv$Ryf|na{60`T7hUDK-!qK-k6?l_QSZN<1t3Q
zrZlj0^#;PH>i@6Q{y(c)|AUYEPdG*ZR;S@+O$qmk;Fd%mI4ey`_tuVh+A=mxX~UF9
zq`25HQ0o>muUj)E5ltiOdT>h4L~78;Ce-Ft=0ghi!V^~Pkt25Dy<*|xsv5^1y^jSk
zui5Dk2j+NO*<=1QViR*QmfJS6P4k?5r4<1H*3L&0<wYT|FC+R%!ojN*qh>d9x^P>0
zbd(orA};*X_>bq^VZL9hPm6wK$%H~MR{f5EK7n^3cRFhg&uYryoUn}}K4Uh+a6uX*
z4kX?Nc|XpUQE~+{sV?G%ydzQM*hwP(9xA7;V?lG(gNNf1*SRD?MYQwz6oy-))0FUy
z*}>trul}X#%sOOnss8zm7i51h(;*`#xvwLRz;z=z5|dNfescL-LO63B=TE6QX+7k-
z+GUtPCa_?o`=U??izjVHylz({J2qvn>bI{C`HvKf_34@Vu(P{ul6twQ{mFQQ!*!DZ
zQ-B(Ohi$u?GfXU-z6}=3oX@abO0firUroG3>2jAS^boj1xG4g7F0RPL>GGsj=_<B|
zlCVNL#zlUSj;3ihb<f%upGt(RlTCKW1Fhu6Bbm`QLQQenxUNc!n{3uDH&U-U$8E49
zU*)bG1X9UoE?x>|B43ZRk^LoNdq+gXJ&^QfvN0Cl22wYo!W=C0SOt6!Xr_xen<DY4
z#)sX{)l|f~cNK5^RourcvB?SAuJ=xiIeMu^H7RxW5Nh)^St6iIESS|GYK3E?#{$wH
z?-C&=BmgE?XM@a9yM;s}{3@1=>K}~qp?p3bX+2>U4)vQl-$%5AMS)Ug&w)>G#=3o>
zrV>RD(d~i-^@3l;oTQg<8@?n5@#3^=HTl}5*mRqCZHbFM<o%yv$K(Ue{N?QZ1H$Bx
zg>s&Y&-I^zMhyGHi?Vi8gq`5z1EO#9kG#iD*%?vmU)R=_$9zwKGb`o`trVJmcf&ot
z`djA`ZP~b3NPZz$$|{$~H?|wg`6*CH*H<uai!8D9y(sU_cZY=xlF|*$2W5{4lgtoC
z=~eqAXL>U6OvSHvqe=5)jz8=C#n-MpsHx-nbD?v#!CJeUZHjn7TXBTK7AE99(N+vL
zdVR=DSAZ$xbi#aoj$@4IYY+*KSNPPQWPPbVAKygv%#`yCgT087kxiM$dOir+(|7@{
zuL`+z05U>hAjGm9;xknt47p5`Q1J^$k4)bLx|@i|c`5x2sE!>?94D+mCe?xLOY4Nu
zkhaDVeKdu~l}kULFx&R*{%b7ufcWmq(>{(p_L)YEr$LVCHPL<bO*c6JwKa5eD+?ww
zQBx3!l5=CZhU7rnZN9N~3$)<0#nc_kWd+F7Q|esN<!{4?i^j4yk~a6*NAdK>&Dzs$
z(F5nTsfM-m2ou9XO4!97&#|cww{?gB^OOnjH9o3UC~uOlcB0oXr*5d7gMJh@bm#<m
znFS<?c4FoYmRo!5!8`qjrly*a%wp)Jl)Ot;*jTD5{b5DwJ&ai!hr$1RJlJf>DDMCC
zhc2#yhkZ?hhs{HoDm%;oF_+u6b;Oa^ingEE_GFu3wL4>xHpsVlQxzS$tYdOoD|5-X
zL{wFZotW_K3_CK^Omao0(lQ?hM?NSO6uH}I-eviR2IK`hnmi;nKvDC*q;R8!Fx0QH
zLK)?j6y9X=8XBvJt2Mo&wZI)Uk3?%(;@0fV*^-YR4GB#dz-An(KXW!)(l|1%I=7?5
z|0l%-2GcHP%k`z-N9b@%TxeD4lY3lFc@U=_sK5NzyX39+s-_H(2g{DEar%j;=nLC=
zc&qQ(UgVFZ8~2hsc57GuOOvbB=X4X1Q%t>J+Gjwo@=}y0LAN~(v1+n4!IB!N|2CV8
zW3cHA)K;mVTv`D(h@OTH$%5$ArV&TvKXYD^ty7xYrV*iI&(A0CZ&i)F(fh0HA>nlg
zw!y27e1}-h$Ja)ve6T!J(3(MMlE$Yw64$r@kSF%Lv7yT@>kQ;w`goL#w!%RWSyo5A
zk`<v~8U;CcMGDc_<J~#G(lsZ>yBkLoavgHdd#!nuYQx_;xxZ^3kkO4=Bam99fxdEj
zBY1M@PewrXS^qFJZcjv@6E9TU#dT2#=cSBzN4vw%?<F0XJBj`B7z$GR<Vnf9a38x}
zqiK;lMm8Ys33f$9(~%J$?8N*#^Fx*We$rFVvt@eoQ~$(?3FQA3CSHNL!O%M6Uo4>A
zvO=1$qm>s!+F6diZz8P0z_>Reu8x*JG%_@n@rh+62RpmPpeb-jE9sA_x7MyE8;m1k
z8IP}-TU>0kj`lg8J>gL=tp2y&$LBZ6MNG_YPL-qKiv##zG?a|YwULuZ2AD@E3i($&
z6d-iR$*b&(C<ZL1cW<4A!qA;IU^nP;w%D~GKCBk2Nc4F7ptPj$^~=J9fOrp6uU&R)
zbTzVZ{=(e)A~z@_rR)i3kpH}y%6Z@)QAj&RXq&#1{!?3kKXYr}pZBTWtbE1C@dI&I
zmnuQc@ZI&#wr@=HJn$Xi<5!v*&Nj?ZNt>!tU&JqCp@lC?U?{89-*P(n#_VOq9R<>{
z-N9Nzbh<@siWN1^|6Af&#0YpA^b_!Zgvq@boV*}9_tM8q`pdwb{y%Ni`OEJnxf1ek
zyG+%unqRcbS;ne*>@1q9jA-KB9<f7hlh}Hwep5efHGUSlVLbYA+uYH)k@bB$D>_zT
z*%QY*ZEcIgea}$tMw?k25#Cz-$4Fk%;Nt-!9q##m#D4O~&!DWXhZQMI?{cql2kUWH
z*_4UeuTP0cTWxi*m(9lBuMb@Q$<VkldkwJSS7Y(t{<^`<A3A4!wRzFsqYaF!AD!+3
z(qr}qR6G95^jouBEX$N4SKs5tO$y%R9`!C9(9+F-ty2`dHfAiBK-xpEd6%kWFy*fj
zA5ro1NJ_G@-n7At95-XF9?c$T$T(CT@X(h&C%FSOnY-b1*JI7J%bh#It!)hgHxOY?
zHvqscg8-w94A)=NpgzfYS)j1GRd-CrPlTAaEwRpCK`{xoBy}#JV5%uQmYzqchXqX5
z1!j2z2yRHnK+91&I2<gwQkZwXos{}C@H=8Iv5btHuU!DHQ2u19+L`r9X_=1tDBPRH
z3F4)7hUn%N(T)l%S%6u#PMm^zikkSjq2mdp^-lOsenHUuVv%skol9(WQtiuVds{*2
z*1GDfCwd>9wJW#4k+)g<8yPtv9W0l1fPvW#aSCp;tsZSVfo)a7M<{4c*E;qHn^CWu
zq7B&e5!5$DSoCIRZqCT4zFhd>erR5c;Z$0ce!|1rPhr(Fjvklv{#yS33?rd;R%_S;
zH}=qWh><h=yW|SLGWAh9X(wO)esT^FSvnIsv`n9~Lf*G>wqWI<%G&7NUVZE!dRVxP
zE%<>JG)<jwdpMTy!y7FA>_Avi_3RY9twxok_?|F605$qpPq8c&#LY{BA}O&XJAg@h
zfeqFKwZ1Gg6Wpuf<Anw<_moTuUz%Hl*c>}pU)LRS>8`fF$E!y$Q~OIvx4GK7$UQ?}
zM;j`Z#gUN%%)xY3Cni<1SP?2dYI?8knw&XkuCNz0a0#O%<C<!Wm2J~MT}M$)?ZTs<
z22(?d3dd`H7#d_dr8$$A`wR~cZN_4PLS~ctdrEFUBz6w)$g(~nww0IQvQ|+-XfPwR
zOvj5LtG77O28xrkyM9~Hb4a%M8huj`bw;$VKg7SsWgjzt<X<5nVf5dp{Ci8fefC9N
z`dBjjtNubO{t|=>CR>*Y*!K9wg<69JIhf(r#@XJ3FGKfnR$z|u_qTzAsu$GnRl|*U
zaaI}zw3&4zRMdi%(v`WBv9Pfu<_4ZDP0bJd(VOlixt+bWra$aH*d-71c{C&#)ZkXD
zW#VQ`WIFb@j;Y85KM>y#2^(#Ub^|fdY&v-g->tCO`G+s%czrLMs4z&F5w9NYek0kM
zU6t$lF7*cY@p<XKJo<=bU-rxMJuk>>xv~*5wuvx#<DVkxzc@Rz-9(`^>r+cQHKMis
zjBNV0i>aJzOv8vC$c&{C5)k9!`;?V3?bY?c{Nw<$&dsXXz}LxoowB^Vt7K+L26<}P
zY=9F>f4pF70LJ5YZi53`Pi>*?=C0-#jPci!%yAFQ2Vug&wFb9VL`f4e=2Gn5)`K=d
ziF@nw(VFx);n0&}ChXO#se$Qci~pQ(t$&x1!Bb`ZJNep`9~Y3V|33Wx|Nqj}KqTH!
zFGk#Wucg}Mi`8GU-8GLPN;{*JnvNTwspqh>a@(aW{}yO<tPrml1X3(%Es)iMm1nw2
z&HmP*iP801yQ)gHYqvxaWHP`0%J9xBy&+p}>dka$m+Qd`w{sgDMeDRJw2J8#UJRAl
zLXIaIb5=s*YBIR`S#A_#@dD6t`Sn-KNABU(=C#nj>s&f~FyNZMBGY2|`=*c5gD#F4
z&f`YoDrr#EX8-HpIghX6X_qcj8*wDuXQKE80RC&XJ35y{+KvsiN+ROx_Q*R-XgC?t
zf}1YRh`L$Q7Nc!34h;2pg7LjklY%@cJtMok@Qq}U`ugRg(MZob0i^VziR^7U^O@S^
zTzKvQ&~q0VXdB5D@onTm74a@@1!+6m0Ana9_naJxp0eJ1VX-+_+{+hEXWvy9W7g;4
zW(hktoSOv0vY|JxCG-qmO$t~i($&_~FG|L)Q~7cBGQuZhApsQgu&s``c{FUEDr`=@
zNZUasasz$1cgd@@R_tpCL(pPz=43Y>Uc}OKLq_<DlY(4q_km8_b$78U(lEJh|AbE;
z(>C0Ld9J2+R#)>NuN^9|2Xzn-2@Sx_C)5OO8~K@g3O5*_UJf&XPhis!|K<^$Xf6~1
z&=YwmVLz5A7bk#AL{*bxx5aGjOM1t$amkWGMZI(L{Pp^R-=7TmdXFu1`dchf_|iQF
z@UL}e3vlCHts$U-F`;ZvO*|QJPO-&R&UXALoLFr#UK2BUWb=TXlsJ+7S$9|m=EGUl
zg+~>z+>e0ua)j&iL68j}C}EQ%!uH+)(T3V*H3OHyj_73U0dQF)iDfb}w$W>n2AF)C
z)>xBIzFY?N!Nn6)a!Zz;98NcA24JoY_Hzb&J`Yo#=-XCSf2=)3&Sbkj!GfooUa6)p
zsFHk74|&#CiG`nXp4Ec0jUCjq2{RqoW%#HNU^UpXZ4q??)H&}Lupy9CYOMD56yujs
zBhnUD(u;oWSLl}Szv!ENNnA2oH4qtb2Uyts4=U<EvvBuHKiYGrB<o#O$w<?+BHx=_
zG9RHau}!qea`m!c@^g^ry<AUg9a+(-b;S?!WmR|a&5HKZ6K$$Ar^4)3ZBv`Xv+OBt
za2$QJ6>LI(Da1m&`5xkwrsFlwYPv$soQXcKH*bM}Q5S%tiyn1BnQ_>v87v-Jl!R4d
zk(Lh%CPZMMUaw%R<{D3!T>r{voU<YGP}his^^w$b^(l;fGs6zsCwEX~L)1+Tt8H|+
zPF%zr+7PQI->bK42f_M_7|Snryob|dwt5^X5m-C&!@*Q$QZ8TN0-P<keB2G&Evw}d
zLAz4&F0qi6-*&nj>+_GciUl{SP$;}u-)AZwRKgIk!t~~yyScKyX>3bY+=KjcQkJoj
zR2_Y}U{K;mkANr#r!b<6eSLh~4O<JN7>`>Df;{IUZ~rzIu_`DdI)%TcyY9N@^~#s)
zm+Im}+=kN-qyPw&J~;tj{2NUS_ww{j?KjXKKr-SCX*VGqcfvh(`+kKDP%&B*LrEcE
zyPK(kIN{XM53eTtgacQF3HEdk>*i%UYPQvyJf3(uZf2v+dKCDO*j-FR=#Kd6o!>l4
zp~Q(z--jg|y-!ufC$D`Me$veATwco78%uY-T)pMHvZZ%(Ja3XSh(r3?rF69m?gBF%
zaB(R@p~dl6)kVq4H~B)s%`kFO)lcW!fQPvb)7#&}m0u&6V4L?2%=!pyJ!{ZK+(om-
z4_Siq&#Fl#zoI{{rePqe#0r#5$cR0r_<o2o76H!i=mHwLAbF4sQL9FWOW-2s`IyyQ
z<201&rsM*A8D^s(uAZP70Ihbek!<R+IiDrWsT*J$Usghy#3(4jZ#lnt)pN(YJ1Vj$
zO{P`UomDq36pSZ<TGMr2G50F?FHR@U$_Q;W3qoszAzN%i1a4dfPz1iFT&3)T(i*D|
zKXMsqk`KK2TW1}cfiAft_leC97CAEXT8S%hy#m%rEN;(F6HT5TPw*p^sG+LRpBWW(
zjVXWMwIStqA#W;rho1UOs@5<7hU%b8NFg|g%^d&jkLQ9mf?4^Y=I;(a{q*(jjm|g2
zFKxMSYaMWJ;hig|C+G4xzXP*jdWxvFAI;t(MmfpI0tl1Lu^6-5)_0XLGfbiOxa=uD
zKX{H7?CF_$p6bTk`gFgoVR=bimBEhACdT?C<|_S{-|A|%!Kwz&lOx>0A?@;O%4rFc
z1`Z7rQ$H3#71>EL@qW!FAt|}!xGN|vLHkt)N}Qy=D^MC(3#M$y6!1H4ve;+3|JgIC
zfQF^~@lkoMXUcBbOg&p~9w;ujSs8pTejo0ru&{2@uEN^nHc@9fXBp%J=vhH4!Fa+H
z)Dxz!?zE|puJRc(tED_1PaPe2-t?rUAoxd0fnWXeA-^V@is!jHTxXCWC1RVrCact;
ztaR1OK5npwf2+v8lN`WJ0El2Q+gc9bju)3OC3N)_%tj?iiQ^ff^d}?1BiEiIAIBuj
zIRC7Q3A;Xf^UR5M>f5jZ2w5KT63Iw#0KR&nc|;eS@Q~?aST)kt7Fl`g$sk5n7_g6`
z#N-P|e8OA6r;>m8)G*&SRhp@YCjBwvwk<b@!p##EUQlH^GyL6aGYn66>ftY;-bDCs
zS56PE>}Mk4$-}H13ScD0H9WShf<L4uGi@Z8vo~t^q*ZK4({75sVV}dIkW9$SlS!-a
zJxJRvp*k~KztwMB&(3hB0o^omPrr+eB6`b6P-N--Xy%%aujwl4yZAgEPB^#WPd;**
z@;X$}h8uU0bl4`Ee9kI%IF^Hw6$LTEEaCxdqjGvV+q0sxf*eoHD-|ki{9ETcV#1UC
zk09X{iBE!5W{XR!A{bAx?0Ln6)=1-gs;tw65}k9CQwkG=L<ZXw#G^e*wQ)gLS}0~v
z2FvA@^>XPgzG2-m1w{|{!@7_mIhR-GtYCsYdyk8;!rI2aLHjj&=t0Tgi}0)^9~qlZ
zIg}L8YwRk``tOI|$fpgR|5aZO4OtZUddoETfEz^|G?3X&{-q{sI|0olIpc1rs{5Uy
zugCpm9m)7Eba#`V84?gH`W*K`Jme@);fY1#^M`n)!5QzHea+Rz`?6)@UX><JtvNd!
z`YS61k-GS{&VK|k|J&~9fB({-&009yw8P}*(#Z#CsOlLOu08^nuWIlXxw8D_COL?@
zm2V`B-rdMGyj+L5+qTffMx&M+(N|Sb0gqTT?_LNmExi3$m+0l^#v*~moPU31p=m;h
z3;8kq1yLft%axUIk>iA=tbk^}9Z-&bNGqHD@QXa!0I=@d%W|fKAm=8tJtF)cjm?=o
z7#75{&0(KeJt49|Lu#)v8C$6CactX1bjwWxLj9`l3Xh#&0$5Wi{I}j;Cm}QXfh>DW
zD-$<@C%3hBxxaoZFWHZP8PnBA*%vA?IZ|{U11B^tc!`Ho41z|!!g8)f<&InKKuyZ%
z@{--H*L>J+ojbondglwPdl`!Ut=)Mdk8L2vG7An~S_55}xD6OxMmA+Zf0m|Je3`ap
zkVS5q=O<Vp15JD$*#OGPpJ=`gl4Eze@Xa!T0jvDf0Deqic(99M*KU2H;wPV^U;IB=
z8eFq)-b;KrfSZZoi?7loa|5Ph$Q5lbY$f{2_e~u)N1Xb#cIVkwk-q6xit#9ICEHlR
z)eq(vA(WU8Her<YSnjDF_HMx5qWur7ma>k1I{AFSHZ1Fe^c*sqUwz>*R>~ykaF6gS
z(s2_2Hj|N;GTRn``5Vp~V!3+?r15OS(j>}ad^7ZiC=~_Gyfxz)S-GS0q&srk&sf&Y
z5|OxgoSI$q#9Q*qof1*<BkJ$h1X!+TC)gm4&kx_!{{$?ICC^|<xRL#dH~D2C%rmG~
zzMoo)6v*70J;<s=aDDS`LHTXa1b6u%E49(m9^)cCjWukM2}-;d9!)$lVDIbfg)DiN
z@gXVbdr3+rJ^V4vZnZ?Z4y-|+z)1k9UIP#XW&bvFpCqcO-lN<~-lP=W-JHD(TMVA?
z;yWNF8mn|{;@u@VqxyG6TQJ9Sh-17>m~<H^d(W4a+5Aiu)dz)^j0629D`&Km7A$%2
zr%7eXpSs%9KmYF)@c&vJ|MP#knn|#|6(gqzughftlOE_9nSL8j;w*Q3!Ap<;cx8ki
zO&L&9pl<>ZA4E;>xP;3IivlywcHFMpr?l~R@5T>CUwDF9olEiqo)_^{mx6z^rl!)Q
zCa>ay?z|eNgfqOo09cwkxH3Mi(lSXd9dcA%!*ak(kX9~k>9}KQh&VP(-{Y?2e8E!s
zqTCkHQ5exf-gtr{eL$j+aW<@o;o~Q)ADAsHQTBv+n2pSxtjjv^#hQo2EIz_0z}LJ~
z8Dl{(qel?I<Q%Z!v!G;Zt*B}cSg`kVSF@s&JRaK`$u^`P#gdeKW2~piY5JCsZyr2P
z;wfG2z;Q6Brq^uiY-_nZ*@yCl!p7=&k5Ifk*l(i_>{<o{cnc_{$6U9<jYCz>K@=2Z
z_#u(vn&LOmBv{qSq7|6_3+^J)7oaNhK53R>io1avOzv2^*SzB`q2>w`#08JsdowQD
zhz2AOk9E$dkJ<N>Oxv<Oih!gs52f*lg=XTh_wW*)aHm4ZwV)y?%OF4RX!=`cJ!e3y
zOCqrMVvfk%G3<yEy6!@-JQ?q{-<Li3DY^AI!}fRSk6F`xT~|=6JN7;{`<qU7x%kMH
zg`<w5=zgC4+k(Ujve9VdSNiRI<XRQJW?Hopy9Iaq1Iqy^j*TFWLx97j1RZFWuCSY4
zhDFE%nu+@Ca~>u=^63_?4t^BfDOQ#oYsmOeRDd}j^dL5!4vIX|S8Dn#x}>(ydk8?i
z**Lz!<JdkOHCMar42+o{yh-RVx50_)Pg#NGs@gQ!B&cx6X_Ie}P?<P|ZGdJ%gwq6d
zVf(JS03=l|jjLO%a3HNm`H5jA`#<f49@v#2&%xR7JVoizA4ab|(tVEUsir*B!K-1D
z<cnpGVEsF`GG9A4NOeR2wR4w>oY_YJ43`?P{uuDUtRP=n#y-<i=PK`rmxMg4d6%Pf
zr8iLf%kr_ar5{{Q<xw$Cn`gG6d-K=8?fCt%#1~}$+h1kt;(808WKs`$&I|zigYB{k
zkv8yGS4<D3sxBf21@~smZ5W_|L{r8$PREH?yV%<QadBcV%D;u5RSX%@o90yy!cqtQ
zhF-2vc@dV1x@HZ}xYs=EEqy`$7XjNN&@Q)Co8y=J$QNvN@D<pYjLb6=H}db<pfB5M
z_zg^B7FXeQJB*;OdDL;Jq9+6xLdjHh6G7>$&LW)smDgw#%qtF>zhpu!tzDUVp%lBW
z^wQDhFOcUJUxT5)fGHcHVKkesj^_L(v5!w;yXLaeUb>_FDSf1%!Oyn4B)r{e=yX+2
z9iTYInBW-99rnS?YyTJmj>^EyFxk6H_<3pA)X`UxkCMQXdVhJrRbfdtoDloluIETW
z<rUP*@GY45Av+WiPo71a@lb47!HtnX1GGV-N^90H`a=6kv_shGVx`D3KgTu1a$CO-
z<m%TQ3x6`IihN29N)0w!oUAG|oE_GPGITZP1IdV|Ew+uAFym_8?8L>_n5!JBo(+VR
zID0>@8W0D<eql1Op`v$cV|``3H`0-apUK5in=*<|zDj&D>IWL?^~}Sy-W3`zO1Ze|
z*Qx})zrKRU{sSJH!oAo5<kN=lU}gP6Uc<4#FLsG`uy<>c+5U3o8a5M)M;<pRrxyWM
zkqx|$WV3&m`?D?Y9-w-#o_2p{%ib$mRoz!yF}(jjEdQw<R{3#sN&I6St`ER^Fy&>x
zq<`ghjfk(YRc$*5)=2jQG*3j!sjmvZ)IVikGLW28UHP-M?iN#{gD$pEKHB05vgQZH
zA=B8G?vrP%@bygfT260<Y0D77oYO%or!+FGWWX;<^3$ngnqy8w&6XQ!lC`C?VuN5y
zv-DFWM<o4@0#;Na+pU;&!p84n*z{^27N@D%w1y$9e5k95;5I=@`ipet$Bx(W5PlTM
zn1Aayy8XrZR#zJaJArhHj+m;Tycv^9*M6hPatXbR+JfDYXbqS!zMW2)IS}NsRY5Uj
zIr^gcISOmRqKQQbb!X(qj^GDZrWatf6v`xVHO2qNQ;a(2g9uxb6c*?8kc$h9P`&w$
zutqO|YWq#%a{^Qlo55K;m$Y$|zr4;IrKy<c`-T#OHoqNp;6t(Y5!P`QOGJ2W&}6gC
zZ)@*D`d|<kA)z&uFeyC0-gikJRsA6qNj_sG48fNADjiS_9pr+!2Xg$ki$4Xx8{E-0
z=WR;<&jr(|Bgml}M<1nKSpOAk<VgOHH}@Z0@x!sr7d9XI;pq$FTPs)}>##wYt;9_=
zttlaa{!6{MSF|4Y!lqFDR?+g_a1V#~hs3=uj>Qw{j%L1^R}WYwb0_F8Pp4Z4MgBOl
zZ+)S~n^otRZP-gl3e=m2Ei4v7wh-=Mfa(O6q`t^@)I1h_#ad7&Y4gyR#Z?1WNV<A<
znAjj*S^5|wTea>|BpaMV+Y;;z$p<>aCtflWom}6?+t_<gO$mRUnYz+FGHZVh7T{SO
zZATpd<%>h${Vrg(jnF`nk^{bgzeNh;Z{yA-tTgpeBpzyz1+APNy^}LG4in#2_u#g0
zC>bn}gKY2O2cry&h5|)qh${WbM8=1_t)=OYUk^)%eTJY6D}d!tE=5iO+9}sh5;Ldu
z+23PtWwe`f(4#N<${pA=sv@+gdBg&v%WWbWmle{fz9Z?T_gpAob`VT9^Y&0gTfVK^
zyzOyKWlsL@PsTHLQ1jwq1s!=exhEHtbwMW`IZnJoTv>M+C7#m2whg$`Itj~hpJ;&C
z2w~<P_D<|RYTDdQb<d18Xb|Zmf~0UmX0sF6Cv*<JmiRQRt@y!1RexgcMEBHmxWP#R
z`d<pB-JoEqr?C{n^hQGX&_mY72l1dXG(ahBU_>eTEtC}UBGTvVA5iyu;nF19I(%tO
zbX$w~Gc2m@6wCPl6fdL+BZkNf(7JN^QxBJk>YvpQgnM5A1ku9%a-S%(;3j)BlsuPm
z7tBZa{IY>bd*ak?^>+4G1EOWvzzhCrkgg~RI9d)bV5<PToTx_-PM?f*-$nnCeHM*R
zo(@X_3LYicw!&FzAPww#RW&cnuMa3rv`b1}p@)SoK%c!786P+Q0#2BCWT252Ut`-$
z9Gq(=u5)1q$Qd?uXHn-CqB+S0^P!?CRS`P%;=T}<J;-}S{O!7Rk9__bFr?>?W$e5Y
zQW@!6|Fh#jq$t0trUldgGzO0jh;)Pb-#Qohul-+$%dMawHfYrVK8pKHoB4NtM|@g2
zx+F)G-%K<ZHwe$2;8;CJ>j8dg7OcX`TWV+tQ~iH<m_d7!(Ghu(#?`L6B#dEoro4Ar
zC?kw^ya4%vs{-7p11yY?w)i@V`s)ech`2u*rC!M_#njD2OLAbAsSlb`5)`z?Q43^i
z?h>{)BE3CR3%UBGx^xPlpm{+KakNdZUTr^hP={+xLw=aXSBq8dFyXJ$rO&JGi7yG3
zPS6a2;3ayg$d6U<;?w=ULgQ2HtZmN7?<0n91&LuG<e;D6az^o5U_Znqx@H#@oTsOb
zolG_XJ2_$bPw!@q>f#lh`dwUrE*eVARrfT-Kt_d8jx5d10n5pBI1%acCAB4E%b43r
z9tXls$=Sq;Xpm$V<hx%N1kc~OlUC;1m+>a|#lWru+dO$JKu|lM!@>^+%cJX+*VD?i
zZB^8tRsEg&9CD-72ROagMrbcr99f@Ub!|*)cGYgCrY3y%t274(PrCK5!ivh9Tej=s
zkli)xBg^iJpW6aQ+J-lIR&9!JBJIHf)Fe)S_WI5`F9kF<Z~zT*D3P6;X?JTgJ0X6I
zS+)4NRHG-vTl_XBz1aWPPTcE;!a3Re%z$n7>+?aC{buKNh`mJI&Hul`$y_)9+mkfK
z<iEf@=#!rM5Zu-XhE<>2&_H|seo{}S?y$hPDt{1UTj$5-^szTu*54?c$X?mQ-Xouu
z7&JQx8m9@YwsSRN)Iu6BEaKlpUrT@zCF*tY&K=|Is7V&Oo;lskn00<e7*lIE!Z62J
zbG!b<eb=JxC*mL<_!kF8E5=&;+YfN_X0!N7gD<f`@#Re7VnN$12K9wy+w$$d2#ZIu
z(v#C=pRhN6yw7<{Y~D&$2CQ5553rb#&v}1Xeo0$hh8~5Tg^U{Va3de>J&2ASY*moF
zy&r?FKtNd+hiUGMh}uRja*87HQBkq8g%dS`CVrgc{jF)7=$Lrr?u5_tF3x8BOT?<>
z7-NY_wUsipSq^n^<gKXi%dP!|L3#V0__d}-?B1lqVRq`zz%jPu9fYyu04Uq>r>>z3
z4e`R2NhQ$7S=C6qZR$rN62dx+CPs{&q1ok6>GJ`%ci7AVBFS?9wzH0QxgfB>J34ZN
zxN@TAV9UFr3l|JEz4Pv>xJ-_&=5a6)VYuT)*Hw-4uZC3n>biICoczFe*arZFgs6I$
z_P5UQ43^(^p~2^~w0n~5^sR4GYu*fP%gY}(A=n+RN^`va?jMEZuRA14**hpZbNZwe
z?<X}6gC%kGIcx(>4#$qYzAJo~>dXrFpdZ2f(ap`G<vrnyqvj_o%Yx04vl9*9{^$B1
zm1CiHMN5rtuhIR~r^EeLiZF;EjjY-a-z|O^gehG#C3VCS{6weLkPtUw3O>U_+;yzB
z7d49{>CJ1<kh};*7R4Ky?TO2=%J(O`Hz2`562C0V+LiZEy4jsp;Dv>*%vL=l_VR#1
zI7r4ei|?}6D!^Edq6+F4tz+@2owF9s3yp@-6mbQqz62O*HI*z7L(Cr)IbdZ9+OpsQ
zr^~;mybS|=gvhjCSWi07`%FcT>T0Q`KPJ&@i^4AglZEAGX|Oc!(u%#Z)uvW!bb$s@
z-hnx&wM)Cy%Q?gR=lqrq@HDRipCk6g0S3uwf~F4|T>)4uYWl*`0x3<0440+XQswlv
zPP)RyN7nA|)$g(|T&XIn^`M`s@40$)=9t?B|F!LX!@#<#)Jlm+2!M^Ljoh;MsXfY$
zSgwvx5X(0PX~s2J66)S)=?rKW9*RcyrIa8;jWq?y7kYLA3Cl_mkc5BnB*<^0+2%m%
zv+Ayl`H`lR+3%0mmGxeztWMDT)TA~13x<C^tQiuSKK*)sn<`6F#Q7YHRWegJn}HtO
z8oBd9-UxmKdw{5$vUNJOMEX2GF1NCivA}I=FqH_Q0d5=ka1B8@RXTC1*`}h%W=Y!t
zlll7AI$c#dzE)pr2>*-m#rJ4p#KA;3uyi;EklyN%zGM?HSID1|{nnw^@1RVjRZ4E(
zR?J`S8qgAoIr<@UEnvTB*SQS@)|O;TqK7~5{R`;xz8$ZH=7uNX49*LFNVJD%UkYKs
zZ7y<xCgE$B{SNw<IS>{bO>oUgTiI6!NZW%K3kit}sf6BR)@FBv(89G~Tle7Phmh1S
z2b-rS!p~=y;zqDZnB*0*ZU;xaQ-2#}?O0w`e&AP~4{-4c8nU+o+m=2Fi*C^b_6eM^
z+xbiE1u?WWqUGMKh}N1AVIJEPYf#owR==hwe61TLyxZYZ=86Iy4wab4BL@|`p6<-a
zr3PipmKHn?Qn((e7z7u0T<;-_4H@1+%twwdR3;D#Wl*ZDnleRvKwB3*qh#J0Qk<w#
zxCSUXT8W<xjhf82G!34^9Gm7%8wClLOS`zwW&*>+6>Z#N@8IlBqTX4X)AW+_V+BXL
z?QRm_aE?LX^59>c#eY5k)d)p8$S&-_cMgd3*#|I-65K(QEooACwb&+5O`9!1wzh@x
z8QZ$9vu<Ai>eZ^XXKbwCVjiZ=ktd4eg<-X6)jjz=!f%A;KG@@)y(HKgV_+B?YM?KQ
zM$|Syhh{+w4`8!J_R?hO8m%LgaD7p6i{IA^;^#pKdC-<*gPAvJohi#kwH6o+B{qmG
zsygeeOe$*}_z~9%d?%><!FRpkuKO~^&8;^OI>7XZsa=|`*5S0$%C;qg<^1nbgIRHm
zXcv;+LRrBg`*t%(oAKk=t%t1XgXnbTRq@a+_P1#If5k^D&Ib{Lx<cx9MdY^pkda@+
zER~E8c5mytNj?L4Cgw1wUADW3^9QlKBZ0Gn(@`UBB_?QXfwInD&uUUwC6Mg!2qZgK
zK==EmbIQdh^mAky$hTS}g!7<aw8`7oz`d%+&icly`}yZy7WoF({FxC~6se2VLU^>5
z+W-;Lg^t&|RhKYpwY&DW5uE|js^G}Bw&=~W^d$Bgmm8>Fo7Nn);oV&z+M>h!yVOq#
z=3V@P!jO2r^8;yp@>ZLQ`V)r4Q_uSSe3F(5!e)L2NiX{+dXJE}MAJmJx177u!zJz6
zgmzPx-I0)sXKyeRec{$V>#UN^mw!A^wd8=Ov-i(>H^Bz%$#g7ij67^}d^`k}S$fUf
z=UM@(N9(Gvu|3|8hYIjWO|D%svt_>I0SK;WxAcVx^a0kMz7sa2xiY?o`Qa+tIVZ@>
z{&9JQ8HY~~zTf<i*dC9YT4|TIsDWZCt~AAs-Q`u2;yhNSY~beKI*jSNUi>BCAsz<6
zyLQ7MMtXk;+^XFgOO#xLajsFF8@S?n6b6I0`msdYFvc0$uicw#khk~JmR+`({SOqI
zY)5GbgMb^wAL#;5XJ}aP=wqMa<_AS`_)!Yq2-O`;9%EL#YIu<9#t1E?n`q6jYWeia
zeNV@G4$RHpc3N^PXY~H?o8uXty!>-JOit=>iC`Q?SrByj4(4tsz*735>MsLD8xitN
ztuu?*BFWA}I?ke`dZnv*quKkWAxIQ^{8+SRzpr|Q9cCW>3YPFcy+Rx3<_v9(%Ir_C
z?jXnh8vD0t@lbMd_*r)@9yc~u`2e}MP#wu>CztCtGXk2O^ly=NVB_zPqE`y!d%$b&
za0Y;tSy3$!s!02hynrXKUrU339MwM>f2z7?cInJ?W#;s=5xdVMCkZofRwrEL%I->M
zt`Pq!;|k;dUa*YU`f8zG+OURui4QwqL!-DHs*Q7vbCynB|71bD5#4%hx)5{Lt~MWb
z^MR8mhvlpk+_NX%$spbnnkVsBzrpBd>oFUX2Xw*s+?;4v_Y7rq$NG%^g5sd>CnCNh
z_PYPyqrAW1*k}N*gFo{Q`B?<M#!JbaoI(x?pNLEYJ6X1%YT9i-wLjW#uE~tsOk5U3
zvL&sFKUe=#G{v*W#nGW;XX@i%r}p*_RiXJqR8iTJU?-l0394FOjOxviwT4shVYqC4
z_?e^~0nmyo**|c;Uu(j)$BdQ4WQia)%p>3o@)~`sx~1gD`RVoGHpQ&?ef6NXpF7I5
zYL4g^KwEO*Sk0f)j~WVw#!aq`bX;4dKewGL8-jvh^&)Q5=lAdTa=K_jj{C12ZTr7=
zZFLRZOZ-zG=7n}?nR??tnl2*F2<<t)6~pN$Mdmfhv`yTE6x_Ba7zc}1*MOclFCo2A
zV!%=Yz(JU1+b95mmz!1g9xC}9$uE?5Oo1MGS?a0bM_F$Bdv(YKHfOYk`S4P<w6U7x
z<buh>=tsVOuZJZ*bSiC%pg!@kFv!%@;iKEi!h(Y(Z2!KQ8@9z;!fPvdp55Ud_8&GS
zGb<*B&e&8uB);=jQ*ra|1<M18K$QVKh^`kQt#Yz`A&?N1<c4}8t#3oj(3t@{aU9tQ
zKO)N_pX+6mgwmPZLP_9{Bf||>*$JgqKYbHwR-(iHYcH`66lRaWru|R@jI<n2aRpqB
zD^WINNLy^I<o54x)|tx5@ts&tYxW}KBMo~s<kK%;`#ga;u(Ix;oNVG3ToYz#=4*Yt
z=T)ucZ5tuur~=H9#r3{lD=9kKY!L*x4bO>)yTAkkBRDf8Vp3WHB0!#1Ipb#Bc+O^4
zC}c^?6c)^ejArEP*Q{7dCp#RaHH(b;xAuH+sit`h%s8tJemn5Y>A;6{Ac>|i{)>Z6
z9QMLj8EcnbfTy3)l!(7$uH^KRg|sH(Dx3*yR+<^>UE7Hsrf4hs7#6*N(h{4brW4u~
zF-?0buro@+qLJXa?2YLsqG`Upb!WK6PuKSBu(P&UyJOZlnWZ;ji+!1no43K$MVPPp
zGfod}oft|`TJWKQY6iD)+62FVNbk<rCUHNn3tjnaM5i;{CggoX_C`2&TWATEj-7Ae
zufz>^rapkDm8*3#l`%sN*QAtQmGy=tU(&-zM;8b)ZZI)G7+XXG736zdgd!MhQ^rpb
z5E>1WLl_WoYX<l@RJf3^BZ>C8iy<?|T@iTE!EXg<njr;kBTKr@?CpFgB&=1H1r%Yt
zlaNFoE2<ArJ9$_i>bgmS6etF+(6Cf2gW~1$D%^NLL7ehXTjO61X!Y6qfcrp>|7m#e
z9Qz1RiwyQ+cOJ3buvA$`Tosj^U_<&6tlG;1KLs)r56~saPgxh0M<2YasO=F(F;0)n
zcQZEVO%kzfV%!{ZvqfcCtXg0D2hoJI2R9gi1N00SAQI&PtsS7Ib{=a$%Nsma=AiT!
z5(1A9XD1-AcVYKsQbWmT_F9kdFb@ZX$IfWl$-7;GS?9mrRi9(LAny^&6hQqcm^1_o
zv(?gA^H_YTBhG1{fol>-Hm!4(*{&L`lp2Y);(I$?n7OP8O5fJI(PyD#($qRIe<)X;
z$zRFr-i8c+NM%N>EPLu!LLEPm@vS6KA6;lKTcbOGyCS`$-RRscoEREz^FW;BLX!&&
z&-=Yd+|mEzL``2>x=rt{>SbFh(P6u?+#gd$*Cs4lu%J6dTL$A=&P5Kj>oty;cg{`^
z2AoA-Rp$m$Pox*KdVDdp+I=iTnj}1Cu+)Z$dlZd{jNyy|2yJXWyE=SLP1bCByq$%q
zo3Oe%&BFR<&*W(X@BmEZVS6I9%joLuaQQv#2=$k&OqB=nsv7y!NF&aW@0oEEMCMXf
zd5fPzmz_<3e38^(g_-t_0GmD!?CUw~kyJr%11pl0>Zr??ujMq5(rhk@GP-pL@0Q;r
zJ=MgC^sp$^BTbq33T3dTrKYmvA?Bm>0&^6;A?{WjNV}|+^i(j{vQpZP_Lf%UMy+jm
zG;Sn0f0SYQZkarV!Q1ln(|^6z)7azyPC*BpVwc+*irW0x4`|zZ<~2tU0XVy(=lKTD
zjI&jkbn&lgrwxAF5c9cPnNf?`;)6O`sNP(i#x|u-rpox3t^4GC^<sQCzl}x^2M{Dt
z^3n%r1P$rWR9JVcqKlSSb+@(Y3NYse?GE&3?WTb(&jto$#S}&nFv*+E@)OB-nZKBy
zjP-b4^&Me+^ZyMYz+7Pk%q|3|i^;NVT9v9A@li!tZY+bI331$r5mqaoHem5QtI<W;
zMWnC#aIgGfZ1*vAN$%FxsuEVzVSbaxwmVS@=k{aGK?Qzp{v~v$x0-)T+A)2_)Ia@|
z9|~~uF0~G>2RFLQ8F7*}@+4;{{rEnlN-lmuF=Nwv!AgmqQ5AQl%`6Rs*y8*?>#1`r
z21&K5c`s1;U**`G82+*vcYZonQ~YT(Ep3<7XUKQh=_dEub8Z7<TFAlplmoQaee!@q
zXEVqWYgO^r2mXA#Z1ZaT+E1HC4_{v0w&n88mG|-<+$8^tjBSm_jr>*nF-X4_FN8Wb
zwSS5&a#2AGC5BdZrApyp+~`NBLw6R*{t|64pEeoS61sNc;R=e56j%o+ai#Z*n!1xL
ziWeg5vmf1Ysdr220p7{Z@C}5qS}4`T29ae+^J%GtWBuIcq+GfBrG}*XqsOnC9LSUe
zNBbP8uBl90Y9IZzMU--7RnE&NW6yu9N;@?{br3wR|8v*Q-27mZEA%6K$r;ekUWFTx
zRr@r#fOFHZFF*#GEV(k&LR-gKuWcZ%3&2ceVuK?J*wRUrsHQa+wN_TeFzP}T8ZY^~
zdik`mw{(me(ZI5`v2!(`mG@ZnvfaO*`{?IA);ahFiu)Y6WNZLgmQ0<Fb8&wZ$bT*>
zl9dE_cM7Ae52I;!P_^oQZ@73_aAX|+TF?argGd3rGw4(BQ=jb&$xk}lGl?I0NY5~A
zA1?lC!i<zx;MxxI3hh$d{4MNv3=O2USNUr=LsaRMubj4ueYuMp0Q>bWd=26rdkN*;
z(-H%dH;<du54Z8`UESpTM7EV8NxaH{wlY8ca-OIj`oM?l^Gk|6BJzTrZgty+-6V_(
z6rj5c8QdZc8V@>2a`5tbmGQojW=fB=n2nEvCR!#O5qb(=W&`!lF5)w~iew2V9@7{j
z`#5;%nnm0Cb=h8>W*k?^Bqvb6p_|;a2e8xqz2JPTr`au*{fm$I3b1WUV$~oL3@5qP
ziqoCp*dR#YFIjl}+x$f?bQv$v$x<9p>ZYLGrV;A)$ZWi*J(rNTyo8x7_eRm?nog+?
zD5sd@+Xi$A7-y(Gb{-)X?(WZYFn#SxTbOnt&I@8i$E3d1<e2&!Jgi6LfV*S2K+DK!
z@+6CRsQ(pD?rZvj`fqA~;S;RtEV?)?(IO_;`r1l<&QK6KUNwK`({Yc-CMFS8mC$(=
zy&xx9N?t;i$)wm8L9%EKn}mW>_c<0_URqd$c^%F?gAkg1^;?{1$)Fe35}Y<5Atvsq
z@U`;oN<Cdx6Laoyru%?>*0w1V=lb1eL}l3{@)zVRTWn8&c6qtlNIO6_gz%Yvn^;b4
z;bOj#1Gh+D7qoIeXT>%;Z7a~fZD&h(9q9BvZbN6OJ$F^hqc`WV@-wx)R8`M$P(mF#
z#`yY`PZsS|kKd=mRS@;%(Ux!<UPzI{9j4f^Ce9bXYRX)UWn;M8qp_N1?HV*CQEB1a
z!ZFX#_FE^0QH;*P#j}!2%ky25gPyouE(|sa3SAQ;ng2lC3D5Zxa2K73+T{n;n>cT3
z+9s1_v_YEU64%sAHe3bpyAecaW|j}0cw<i6um=EdylZpoteDVTv>~4s4eW@&DRgeX
zvbOtl<Ew#_U3k|1afRaD$ZvXoIXoofgE~=?)<nZ6U!@JYD?3s)^nGBjMb4=1g9Kne
zOaJ`hl6qAwIgVrj{K$?Z;b<7$x~QGh|LJV%vF@Fz6ydMp=P^;0cfSaEcqr&wJ&ikq
zEUV`thv_em`G~O)+dGww<0A&V^5L;;mzWRIj^s-pLmraWY%@=&x)IuZWY=%Sx3eC1
z>VNEk?P?Xwn|f^v$qs&xF6`ODh$g8SD@j3oVLRy4IB#`Zv<3E6eq6}T9pMI9%x|&S
z!jW-~Vb82}mg6~eNxD3fVi{E68(J_(bD6(h7L@aP!plKbHVmfhQbbF}wvaVM_eL77
zi%S32`PzS>V2M{~yZOjD@$1}XF>;Lu2NInX(BiiP)t~GFJ(~@^<baNK`0*b0E^Tbl
zgx{A)+muz#5hZ`wm>2a<WpyFM4<B++Wm6NiR}eOA-E8c`3T=tt5Rv{`rfK|t(53pb
zHjpO(;1vV0Ue^qJD_F=9q4fW08#(<gaGbXC@U=?S7d-9CL%rgwf4MLei!{I3a@GUs
z#Iz+;4yCQKbSkgGle7|+=0^|L5OZHzoS;~;$M^dnMv<YtvhP2g#uTaDUSh8lC-bz+
zfLP+*g`@-G#s=j2&tJ5(EFEs<d)$PkD#XsJ>ELI`4JJy?$nHtrzHjWXq|*pt{H5c5
z8+$ebnczx~TmT~<&tEPOVikS0b!kKH=n{b}*^P?GM08&&g+Ln%r91g0Km9%Gv9}KA
z;z|9PaKN&=I3wJ0%H$Vn8v9(IIB44Z7@(3wQ;q>e7ENgL%DCL0BWD=Xx^T*4R{aI^
zfP^Ut_i&P)E$jMF99CQFyHmT)K0sJeL$|L^xuT;T5r}2=uzu(U)-RRn@7cDsCfBP>
z5B0YlMc=khbqp$Qa5@66iq;rj3wP+)IkIXWbi6H&xN?*HGD`I)oa#J@zUl>_ny##E
zL+8qofYxaVMOgq^OoLdQMDmg*MB1QOWw{+qi)EC05BiOJUe9PY^ArY|6flCGNQd@C
zrXE~8)q6PgSN-;%bu|obgMf^j<__wqEV+^n`THpfO0vDZnoUiW2PC<eE2g+ddqZ%G
z>mpqcAN4DLI6Q7<M@`8M5WFFNJ~mh5TUX=tnz^HR*1_qvqe<70uMXFX^9>wNG2j*`
zGFXs<@MfsLV>z}CkSw~w4gI7I+GSlXzE7~)=1;GOT#!+Yd0B6TtM!TM{_s6(89O$E
zwTeU2)asl%ae3wH^B_8NBBI=;{q1n$l4Y)ce%f#~#9&A9xcQ>w7hmZwx;JALyLasq
zJ#{495nQ#4_|L?Xv1%gQPm?VM185WCVm6fU4fPd-Br3GNS0rBqZcSzrX%|9h;x6|Y
z3XIH;r5C-L@8=b=^iHQz%X)W&VT$tJiW`$5;d=Jt=X5xY5U+v)P%R%h=0Q<y(-h)1
zPz=v(BCo-jF#B&2*O1Iu?k}{uU2IB}!qvZ-YlNE@v#i|%Q>on*u3sBEQbYqAd&6so
zN{$lCMpab<U$upYt~W`&$$>{}fa{*4U{>!ZA+A~U7eE~WM2W4kl#jS8XiemVY?t2B
zlDhCm^w`6wCr>$TH122B9Zp*sJVGpktJ+Ln{AH#+c<7|B_30kr_OGvA?h)7xADYqo
z0D?LJxG6=u4Af{aE9ul_WI)cGvU&vFlF4YMjN8nQ(HbC>res31W5%D^8^N1(nAzxb
zUHJ5v!iL-=0U-z)p}o+M)?D**&HcLg<H9r>qDOyt;mp*g8NGJ|Yy$;1@zO3ELiDxE
zet~`U8sO{dy<^11oG<V-{n{O4X4?D8dZO<!$|@h$d!=bJ;cn!%dbu@h8m}jQ9CvaW
z9r>oLn+YJX$}cYnOkGN<don3z*YgT>BBY297qbBorwAoL7&KKP2D!E>d7&^s!P@gc
zG)ilNwA~D2uIjkv|9$oj82ShSE9SjlPldCMb5kYc;5&1w>rxcssGxLa!iR2<UcGI@
zO6dAoh#n#Ij0wWOhM(6se*&&4+NJGwGHnni@|V<oPJ(9YM)ImKnvoB!y)ZC6)OTm?
zBMS88y~`@Z0z8GiC2zZD7uVe#t?{MOUZ3+DeB<*(KZ)DG0bm_;p-+H;Bp30Z+yg$!
zqy|+qDS@Gv5;@S=Ztd2C>pq&W%?BgC7v#@LME2Q!U<ERcHD4DIc_+HwgY$4i&KUi1
zX;sk(G=Fw0%#Ks{2hX?utUEh^8*kPcl)wxTBXg5_>W#Py_KW&>AWdJp5x3A}Ygggm
z2M|NrG@8A!e88s81L4W%;{Va|C&)F<%}!^b9Wz|rzT7vU$?P^YUGgE!XNWSza6Z%r
zsLSE!I`||kAb`1LrQBz>Q*P=dW8(6*$zim^0~<n(Te+q#L`5nw#x9z!Hf^jS-qiNp
zDD=YwX9gx`_Fa->j#u_auC3&+EDYy{S}2b!7UunX?y&Cs?`klajRa-~4f&l`p2k-a
zB?6G}0FYM-N?k}qV%;+3lyQrRr8T0emkCy$!ziAWy$`!8qQS$bK-5)G-?Otg+-E3i
z_{(>#vs-B{%{Pe&G$fRZuVt#%Ys$!%;2V<51(RYlZV0SpfCLyAZJ<0+UyM->_iaSt
z<Ji09#5n2NI>T+h6pz=;n7NLj+p3=8hkHUQ806#Kv({(wgUtF~6+H?1A$il#w>sKw
zfqMCfpO7K%0P)FY$FdIl>{taupIUpj&p+xHMn(PU{(06^n)ijo0@lOuJC`%I|9Qvl
zkGtNzdKzDRGfXC3Zo?-0tem+L%U}*!y%4R*Y&L_NACvP;0!6z)Hbg!aZvIW_<1V(F
ze}G)Gzq`k~$I`RBw`7Vr&3IHBcQ)q3yH%;*=zk)@Oa;&>rc&F&wd7uvLR)2uRtK9q
z3uK(>*R{$eIcSk$Afe9ikqg*9-Y>=vL+TdjVlDffeI{Jq*6(tGk;nc&biH|0Q)k;Z
zibX|4h=LLYA+?A&L26~F2t-9hix@``5b`KhhKQ*TAQ3`>D3b_Otx&NL6#)?;C<GKk
zLI}gtQe*}RLZ+&WvQr^!NwWK0_?~y2b=LWwKf3x)OZMLPeP8!A{058uzv{RGZ^E9$
zh+t7g26P8|7yrCKOB#{PQ;*g=Ru+u<*K4c!=A*$Uy3a?iD;jquW<_a($@sp`Q|T5y
zLe0jY)}vL%pYeT}er4ss*{0_<`X`WXNYEYK*wS_CE!dF6f)!$6rSen$1v9fK@|9s-
zWm9oFBd&O4R!mEru?UcFD3H1Oh&+*|_Z8L7)z4xc`q3}9r(QUeK`rzj3OCI*b<Qk|
zqm>Ga5?J8nGY6Bag+<yzzB#i+f*fuipsBLZdhrBh84Nw={+?}iVw!g~*OZRd?i0vJ
zE9f3vdeqHGs@nr<0a?DpA@HcUsodd!{i~gli44+-o~H79Q46r_|C%P1V;!Ii`H#+<
z(ndgdeVBNuK99zLGF2bz93?@r%mJ6cv_tbkWNAL4<9#lkQh=&A+@dQ)W+&R-ntcR|
zr#-!Vhfs>Rw($MEqVdR+BW@ddAg87}-VCL2U@%Pi|L14FEWj>7^?M3N*6mWsWGO84
zX7q!yTWZO9jHb(yCUX*aYwn{k%l3}gOf+tTew#4X=^EENZXY+-mq){e$7be4UVJb_
z5uT2VE4If+hV?Q3-Li{t(|&<^5>gf!_LfyCnOLJ{&F7etL^*Y8At-OK)h_6ul*`E|
z=z7;{Pg+X9=MTe+f)=1<%V#QYa=l1~Z~YkG_u5|q_jD(}+Uh>8_sUam+zStsgx7}Z
z&1SNsJT|ibCuk5QkDv#C+I}Ti@%+%v1yJl2Z%80zQ&8&`%_@m%6AF3LB1qH{Q<<F-
zKnil8A!efv@|N##!_(ExmgX-~4t6JJ$WwV<p)L{Bg12LHoRoWwvFF&|c2u9Fl!81$
z@mSfTp|@b_qxBpkAru_!)qBN~a6Q#9dX}+u>qm}ZcHSdYHFfxvX$Mbo_8FJ5bn#0b
zJLC@a!lN}sQ8!lE&Ns7crv`1{3?&OfN#a>mDf(IZ%9Tn+Vp?!wPel$C82WGMnc~;&
zjgAoZ?<h%4mfJg?&WyV{|D$uFdosE-g6PjpIbQv&*I~=|#9Q<-&eXc&FMiQ|Kc<7d
zVoCc2=%$#781;%#7B@r$If48al3qFACY)u&qe)>xi>5=XiD&V6w^U79J`!7fbwj~J
zVab>&|C=xu&$F!Hu#1H)Au+{+l0R}2@_WmE)150&PHEQ8*T|U&DN%DoVL%ptYH)L@
zMc${gO2sI#K9`UVrgrqA_pcXc8ybiloy#){Kvv{+@y39FRXsED#6y0Mj49!cJ|(t)
zf~UFUe+0_)W@WG~rdh&ZXcmE)Zn4G$F1gB>$rVbmNSf6+b#2%QO>uk>rf4%c6=>7s
z?+b%oIl*jXuKj8>4d+L#2zR`6skT_PuafpS!{!9^Nq5AAJr9eC^(lU=6CV%DJ>Qan
z=7DgVCKw)nTKfdU&r4F+Q*N-0-L^BnR?cVNi%_EMb&`DNkRNv{)y=Y}${b9z?@_uL
zq{1+!X@|EcJm~A5q8{%apTp+yTgbgL>18{;Uco{-m;pjkyIvsunScZU!wu>u)W&l{
zh}@RXPFg?En4>vJh-^3qscg11LQ@`~ncYVtC=C^l$mOBkBhKeu6@}-o?mPV=d3;~b
z8G%=}yF*do>7p^8oJ)sw7)l7+U$KPe;M<TO>PqhkRtnB>20kgcSuMEhBy$%}<d0U*
zXNXbSQ~n*97eR+{3?VhPQG=A#CGwpVTvO4guQM&lrqlk{=|_Dtaaz{ViW^}^!j_NC
zU*4(^jmdV*pcuXiAL)n7`)fFgIqE}boXn<?2z9vtK1?F!2wq4QCXLy#@7QUWvBnLV
zN{G(e2eZuWK_Gs=vz!uY5{{YmeADCI)|Y<yocK=W?I#99b{)E(j$uZg^Y;W(Na1=;
zIDp>g2UR#KD+2kUD{|TmD9X7)B<SYT3|xa)?@H8U81aMBt(Y?~QbxV_q+PycXZ+G`
za!t?sy10ma2X4JKaLP*{B{|P?{*3x%HECOU76A2dBlbL~ebLR^qM#ViZy!!<T6aqo
zXNx-ps<IC%Gv(A!%d!2oKYB&w%9r?`+r7SXT?qILoJRy2{69LF{wg`mkj`rSH*<i$
z0O`q9r5BEWM~`WobIOPU@K`9Z#BVo!&P@<ZlMS}UxrQ7J%g8ULE_(O&+aQtskyEcz
zpTE%i8%~8DRGLCh!H<H$nr6v!+*QF@T57SpsklB5ueemEpqY<4drxL1zI%zja%xyT
zZK3DR@9k^x>EY&mLrnHB>rWMpREy94=Fd-Bm04U8$S<J*?sD_W1v8R~MM{y7T}cK#
zk<H8w!iwNNYlI+_Kt^Q9{~E1hkj|PGmSq{C)JBzA_LI4DY}ejjVrnk>iMBoqFn{cS
zCjZp=z&mSowIn!aiJ#yp*A-pg#FD*au55YVeCu*#*sx3H$=Sydw;muxNB6$&cb`4E
zLJT33Fc^R>)v8y~p-eW?-e8@dKO>^X;T_uFK#45Li~@TDplRSgz2QX-R7P|LQ%y_b
zSr<}<M#ZmR%18#q&1DN_T9cnw_Pxi1N*5-fgF6s0O`o}s8%xIsEwJlSK%!;@^#Tfp
z+s=P<-XCNU|41Muu+Z<xs$SGU4Y6A2KEt}su1pqy5RR+{^wvQqW^K^+S6$~ir#YtM
z`6hjg)1~3!{%g{@o6!LrgKVXXS$uL~X_(mIbwTv$_{gx+c0bRZD=E=ouKhwaV}i$2
z4G=X!=H-)m2~#p`ji#s%(#yx|Svckf>~;PQbbE+`Hqn|vhIhN}kd;c(*Tfe|(2A3H
z9d;6MZ{IL>^j5Jap?2ymPVw)l3jMfM)_soOGmYS;7L!pT@Nvz)A10$0Xi2zdYgC@a
z=;WjLf}KZLvX!6no+SnSrKr<k*%FWg&|umkm^g+Au%%P*ZNG*hMM-U*gO;r1s-W6Y
zAa{+F`DSWP%U*W>(0#g#M}0~!@9J;)HZ;fib)jrfusqC3SH03B__06tZ&pZnjDN&m
zs-Isk(0Yuq5egA*r8`C8&UdvnOtWy^L(g9E9nFGnDh7uRP5TG@eo^J^+{V~w_7VHg
z`gerwFQw$4l#Oe=lJDc*6R{;Mc$_QR>uv^2kQDYIrLin{A)p+E5GH$-eUwazo`$Tb
zTSV~gtP0!?C>MPN0o}`E4zKKS@wQ7*cunFJ`x5(>haDLoUYkATuC#uXZ=Jk<nmk#L
z8=Y_YP@tbkPI1}6L6b-kxD@Q0cs-Ba=wBe0NS>ydOVIRF5#Ke(^>$91ui-gS4L@>A
zeqEHE6K306<?GZfT$Z!ks_MxC4ahIlvXB!~Z|<qiC~YPO0pI8@X9yM+pbBLoF@ufM
z>{bMtDK$G;543{7=WLO0%&@t$rjNO;hO*o*s5)0w?493iKKhiKUQ?NCt%KeEGCFM_
z&66P(06M{Kd!@Eavqfq2Nfc|VDhrd+Qs(g2xg>M?^Rd2fRC9XCTe%rl?w#-Z9ClRu
z4*->j8tay`@|Hf=@KAG`4ZyxMzs(OE|LOVC1$F{eIRfHNMmKEWz}DAlZ@RFQRw^id
zo5`t^HKdTKYaqu>Q?Re&Ycrq84cIFgLBI=aw}dWuepDF98+#+gDHmp1Iy5$g0i%gy
z{d+1ZBdACEqd#*4<BscSv`{ByKx^Y4oeIJPG}{*bqr(#0sA5oqhm7R_E1Q*PCED+d
z6QuNu?_}SWXW(1JzxZ$96wyTodM`N89rmC18I~OG_!wdC-BZ<yzFQ%2W5<_-&E6+G
zW>@5BmJ2ZbFycg*dK=a4JMAwns~{%<^v*hDuw{6Yvc1u(EZ9#OR3|4A=*PU2nU%Ja
z?~+tmXR5PnlWQ&pKk^$Gt*$s3X4>cY!}DJ)FYh9O6#NGkYMnFT3LVzp3A*#*`vbS7
zMYoY-&9kJc3n>WoRJUeTTs$s`;Vq-!HQUiL1vpH#5su{?%O)=m6$?ZWn=MR^RtPFG
zZFipNkBBz+KJdPKLstUnz9dnC>>{J<C0CdxV5Xc0r#(w5NHa?YKRHXu5#>~4X<KlR
z5=Mpk5ytPqkZfN`u_Uzi6v#=&xb&NNJPNIK%sBTn+u!YW(P*`*8o(@$0wfBjF@~PN
zW^E>a8S^#Cf^-)8gQk>43~$i!n@ee+tsJp5>f!VYgTCo_gcPUpPKP`VH!~`=D_-xm
zscXh?)6=r(d1TEYueuGGyxqU5*T2>M-aZ}dyN$YH!MXMnGeR>-Oa%Th(Ihau+RYp-
zQI^U=L|Mxzp~nUWsoAlFOqb{f^bnug&hlsji=z#a6EzjRb{o2j`CtR|J;!*B-T4bL
z-<qFrGe<ihUAPKe;UNQ$&gt(3r{PiOev5U?DIPsC=KmLeOYcnCZhQ6qGSk_Uz2%y{
z{jvEaQ59)3hI`)S%2gi^TsRlJzWk)_=bzx#=!H1Eo^^(Om4X~)L$TK&N#yJHxvc<x
zL=E;W8X_Y$lNO>@LEnZtU%DNl43<i+TySxhF5$ki2p<<&ZtQabjO4NO6WIZEzPqy3
z2Rfs@$hd)U9Oo@nO6VD4YnB&a`h<`$>N!D$K-ikZtw|mT;bk?>`bI9XI@ws``yG0%
z_2R{^13!`1Nw(hTa`em4VJ(v&|NbzsP3^=Kv8rKYsHgf7*$qtCsdUm;)9ln($(5(X
z_pcC;w%rNj*ka+o1xXP^Q|jdAmZRMohtsUbe&olJ#<|A+{%pb7%y(ryx}Q4$#{Wff
z^MAY{0Kz4BLso@rU%<?XknT*I+##i)elSz^KztO<b9z^zw|p++SwE#;^;5dtlr6X@
zzqe)EB30R9(6hkD<eqrsf9DR*`MFqfs^wB&^+*EYt?jI4`8{}7*4fKv;GDJy2T$<0
zFSyiuE0wN!leKU6D%VVWlqr{I_l<pxovmx!dtlj<TkDqHhi?7+i3Y%Tq6gMQSOaSd
zrX?phDFkz#K^fyT8mC^yp!M;WYRnNzCb#k4?q2&qPkBpA)<O?CEA`t@|4S*6ateOb
zS+60`%yx5}SDCr!=V2;y9aI4hml+IKQpzsUV{aC=!~uRM6XX)gLce1+l9opO(g)+G
z1M$AQa+>`2y(%g%3~{&@Ze~{&AzyK^D7^1X@WtZr<pk$H{@!>YSkzdx06R{q(o2Y9
zC6O$djv6~;=5=A*eTE|_>)X^jTfFBwlr=w#DL{8N`?se=wdVQ9nY+6E5&uJ+t+PI@
zsIuZ2_txmUxVW96e!$AHx{sSAV1`%VwF5A~{#4`ZNn#Vl>?8?EY*$dOPZQF|5thhV
z4?tG^;Oxe8Ev9c5^6g*DdqEwz?UhSeMK#Mw3u-;wI}_o4^!ng|u8FPFUasptaz8^F
zGQv^7dJr*vR|PJSy^`lz#QYDo6s0|((5)JAh4fFdx{o#Y=^q+m3zM$ZX5K5O(~j5m
zIK(^K?rBza>F+hGzF9ibkEB6Y;s*$srLQ*ClNQ3RA)?kX6Ao&Btc49ZW++)4BF(<3
ztZeZHi_EJsyW3$3>foqmyNqpsI@J>lH76q6t~?669d>JX8P$y4Xz1<GwrB2d%_&f+
zv8~JCvsH2ZFyA^Oklts{Um(_PSreY><7iGj;7g!aYKnH(Qx@<+s|Lx+WLmr(HzQrQ
z2Q|3wkqgfh5%~YS>>+aF)>Ms8y1QQ`_f1@=`V5`5eYO0mjLG8cEw6sUwY3948`Gcf
zZeZGnENOl%X%esAqtWeja{>*gJSD!RHhN~Zaf|j4u#}p!q=Xe?ZurhB*5XmK6R)$V
zkHkZwWwk}z$QW&LX?Sj7=ck!<g>OdY&gCwc#cNi1VoPG+Pq)AYuQ8FRs=$e_8}7Y!
zp#a980FFI?c1p9>GPXeu6(1`BcM+aN87lDZoFPt9%VNBGUAD;equM8ECZkUNRPx0~
z!>7CpKr2sMeWyH3N+3dT(h*1@A4bTyObK$3oye-9w6F&hB7qsUnQ^`kv!z;E_3_sQ
zj`^zQR$A(zElOQkP|AIDPs<N4JEdJ!<O#CwoACZ;LqHr2_sw6|Gm~E8K%7u@N40I$
z6~N{jhToV!bH9=F1=3trm2Y!<BGjrON&ID+L#P9EeOugCDt$$zb;l0!UcGYL+Uc?_
z<^h^$acKM`x0m7cIBeL8cWa9Lx9!J8GvMt>jgN51-LAv>4IG;mV84;({n*#FXiRVb
zJ4$3?|8XOs8R~E8z6!lY!VOYoe*+;S-$~ih*xE)usa*8oI@4~x3d`c=efN9Sy*vZ&
zZq2s)LE~K`eABMU>8UEekxP#5Cwd&p!e(r#hjla~kQw|83T=c6&xv;RqEU90)5Hga
z;Eq};&4qyJA;^;0_4wSR{4AiewFttW_il9wC>+Z%tBTE0MUFb=)Ef3as*V15FRDM>
z?p&pyuIe{k)Zt689ObQgC`PlIgN%`x>6{gQ)Zq;sQ31b4nAz86_8;$!*m_}o_2q~8
z>tF0IzLZp$7}~e1P=0gwKB${dW-WoQx{xHj1^+K6#l=qYj3uJ1tVyZz-tNINMr$d{
z!-qHZOS~(SJGtx?V>ic5FNT{9KkB&GcIe|4ul*ss+^}!BH5s>7>0s^x=_moU37N=I
z8=);K7iG>wCDJ@7TS+mWre&HrWx80%)Z-;Crk@xa*s`@4$j4_84^v+aIR*3tqj#VB
zp@}DYH&h5}x~4Z&cTZfHoH5ATulsoq*h7&{gQDGX?L$D=5(hk`HjQ|YMI<&;#CREA
zL|RQsnL6DaEtGN0=pXiWIB+KN_QZLi=efGYlDD>HZ?k>(=wJ8x>*Zl+5qOpfq)8NH
zKTJDqb5y42_HS#FH}0+Z7R`-I+q?hq`uxi-dxOG$Gwk}~uc}PHwDq@l5&rlv38lfp
zbZweu8|36FZ3^p0)<P5?gb<*5A=7m|U}9n;Yq`era=TX?KpAnOthS{^5tm5XA}&7#
zF?0Ur8r1J$i+pv&%$n#Q<0*~4ZfoH-z8qcjHtb)7Ub5zU@M&EK(ZCuZL)Pm8)q0zu
z4r?>J3RJoYs*MQrd{Wf5Sktg2;+q;p8Mvot7a71H0fZ|2PRl*b4&{}@$U{(Nb6p|~
zS}n-`BZBIMMsvmqi=y-$@{B(m>4`pheg@jFVW8PRZR-~Cl|)oe=%xIZAI>9d@W)h#
zQ3o{yPN5gmS%X9M9s){6mQ)C>$FK+JnW@7OhXzHygyjr;0lmhjqiV;y<SmaGJBq_&
z3wxYbW&G7&<IMbRU1i+(FIUVGNb5p%XFp+vJZ-8VgfmzPQgCvj4zmkeRSPPlQ%RCa
zK?Y|32K{=Bcv=RJi5AbJrVHww&*drB*Q5emHhJ<q(`u~t_ip<k_x-saPIXN?^6Fl6
zebZBwaadQ~O+wtE19$~+uKJ9XYgYfKO1av~RS3ye%2ilDpulxw`c~?dbm%o0?0_{i
z(dJ<rP`#6A9^$Loo6~rcu^Ek5P?meK3Ia2zP2ZvydU;gqr1HCu(YrjS!f=z~6wTnE
zN2by?+Vyz&T*gy;=mM=5G#>XrdV8s`SQ6H*He`HV<)z+Py5UuK%5@mipRG-jI+;3E
z(9=RHdDnK_>Killi+F!L`#X!3kVvRuN4Y_q*~5ezbq$LqLATh5rZO#;^t)|GajKQ*
zR5Y?h+JDU@zHG4l!I;?cnUbtZLTDOm_VW7(mLvPj^H2nCcSpC~Zz?=B`e`J{EO|Ug
z={nPr^s!tb>ZYI9ox3!zWETvH4%iKk^9i&!IkI!tYd>a{j7&a7FOf|~-M;SHSA5p>
zX3w;(kL~4m-O=d_oWxaad+cK>>#iFl`GnR(DY^wSgsdm=7}i9pqBIfEjo$r$(-iWZ
z2C&yaYqbTJ1E&rKtHfn)QTbKJIt8nWe*1WL)kgbmkLj;N8RmuJjKf~E;(&lt;TH!&
zRn4D=03|X-fSt7f!VWOQ$=4a?xQRF^@vAm@pvmD*sgj*w7hQ&L=9}iL^sXDmHOv)$
zEGRwcHy(THY0V|$aA%*A;x+R9Glq^>+k1$Dnw-b~AG!8_bbi30R$vz8j_DUF1gH%W
zTxbL2EfZ}r)(y}_{7$p83)_UYH?xd6-1uOh2x`;C_0LDd&S5pRZh4RB6pzH=;nuxf
z5$75IksqK%Z-Ibc*Au<vJ`PG4sg#3Su{9>$QcsOZ2o&Ddh=J5J3)v}W3yH>zZv`DQ
z#1#B&pBe4?c?L^K77~_m+i|GEtIxVm+B;2;YBwd9jS`D3%>BE0?uB8`o1R*j#YgV#
zOCYu9|4-tJo5@9K(2s@EQE1J#KyeLBy%$iankbDwG|X9pQI|rHhL7dHRJ7v*{Tod`
zG`el=wI3Y9{ZQLC<ELqTH8qi8vaf4h_Ay#vnArvPs=7PSAA_!w-d>h)JHXf}Z`$hx
z&!?cjJrF0e&JxClw7A(SV?-=dl-A(XpDwMV9qgRGD35mvc+nZX!(ok7>B{YW*LF2L
z+dt!}Q|>YMFxJ^9l`}(?Kxhg4f(GmtROktDivUvs>RW|~u6!reKuWkluw<HPNXjgY
z)okZzY&RO&$hYa9p7ghMI+EQtv-QIJ%G{F$wd$=LqfhHk|9CtKuB5{#OPU07TT9Md
zU#DKm!2j%Fw$GBvGH%^+?eMF2H+k;02h7*R(C)s;c9{>(Et8dSlv1_V?Q!V$$5eLO
z3?4z6wVZCHx~MI5TNy@K&0NR$9^s^|uXt9~t8sH9X)8r;COvi$#Ap@{b#FR=_=-Bw
z<gP8FGcN=+jAJ&*5Gjq`28Mnb`TD=d$jy?~P~}sexuwHrwPNUMZ`f0GsdK&)ZAz*v
zPcpecPEK;nxBhjcFBVIa(rz&AZVUYlC)=LR4W)=OLITj!j}DZe%!osujwH99?61nh
z1$IUicRsB;j2kP)*3S3He}=xCF=_*SxqK_=%Oxj}?y!;x$bP{a_6f)(Zn=HOZ1(3|
ziJtUSokJs#u0hq64*tqh=&g$n1F3VIE8xjhOIk$5R|E*lh8a#>-1bzn8`YMU>BnmX
zxh-Cu)A7Ony-`WM=cC~_3;x@0wm}0D2KPjb-Msvi^bv_`GckntSX}CsL6dzI>hnQ3
z7n3@3qHo65oUH5z8w18Z_AYPViR|0Mqd|lom%z&pQKt9aAga}_if*fZhxo{oUPI?J
zx}VM@kcud%qmyc(HV1%^WO493vw*9YK$3;Q9uPDP;RBJHD-IF+-VX|MGiwyK;c8Kh
zKRa!Dd_e@O%&XwduD?SaTTXDh%ZMK-M_xS_@VMR96*^eI10-_LCD?hQ+ra`rNT&tY
zd^VMw9D3vW5q?Pj5W7Td`;M1A8C^^nMAI&8rQJ7P6JaMkn=6)C<vJQ&Kd$>363Z_<
zLAaIAux=1)YBa0v$pkG#T`I+#VW>7>MBkQ@go0(7y?qhI;NxX*3@w4W!j%`OguB(B
zlH4p%q}!TE1u2S(SKX`%hSQ?HSMs=Oq_NWb0Y71Z_Ior3TLRCv@Mk441*$zGmS`oz
zu7gxF?d|J<4Iw@G>$|{Z7PL~|v<GX;?uTDJ#a257bn~G83iHMGN`m>x23ecQTY`01
zzj!v$48kz*k5JkOoe%csnE77i#VZH~VL4_ue)fJ$E=J=ToilHrb<kAzsj|C<y&}R)
zh7QoesJgGa?0t|2Cwp|Sd`Tq#>HX3rvj7zU3UV<<WBjRpUIm~Axu*bfWMGWcvx#y=
zu*hwV#z5(Gl`BXhtl`C5me@3qbWv7)A4tvdJOTdOl0K~;MZ^z=D#ui{(b{*(bp?T5
zafOtyzl9+orDOLA`Yd4s1qp!WD{Sw{G_}zn_9y!}tFbOl5px4%fUFw$8~Q;vJcVS;
zv_vCisx)K{8}!AMwJLo99|TFYSCbR|Ov|3<2sil|jb?i9=`cOzaOX0A>te9u@?xEa
z_Vp)B-vhFVH?yh>NJ=v?E4N?BPRn0_?v#>J+`dKQISey&RAD}}#TP~`<AlXt@p`G?
zc=H{&!f<VgjrtF5Qte}&_dNn^OV4BkH{I3ACt1~?gKHt7JGNj3Hfkf_%T(fp<bhVz
zKJ-eN=3hP2Sy^V}=5{>&Pr88|CxT_ApAj{%aeQmKajOUy2L8lMBd}+n1-(FTYD+C%
z--Z;>EFv>$tFLeS<;U(c9la@H{S>;R2GhsOv#ybhX4+FF1m12Wpd}~YwA-XfV89?F
z0g9IN=&Z%#)rYmPQN42D*cid&lq1ZYx!r!gKX+eg!T3>!k2j-(-HMAxVqZx{Vng*l
zK@Fw1i6#7(;LJZdgK8OTLXB9dJd`P^{H-wKBLryzlqrpO872y%4xQ|Ei;SbE3&k;4
zCZYtX7y&815lvhEe9U-UT&4-Ks6k${i&_f;M(6roKA}(@-OP2cy&HA=Ss_ztmjsJ2
z7mYF66km9XnoZKj>@<#O&gF;xr#wTVpZcRF&HlvecJ`&zmj$`z0U3KNHchU3k-aH6
z@j$kpRn$?Ke&-DXNB8Ql0_lz14=Gg^)MMHwGaS8ee||>cSZ>NSh9?mEJ7<H|Azami
z;6+1{6o+y463s>>Imr&v-OG=<9S&%=fiOQB8!+zo7m&3n-qeUaQr*wD;aLBNB@Ac%
z$PtsUrCZ?q4Wk3<9a*axzNnXavE~@KBxIS=JEIIK^_`l7`Lr~OKJ%M!Yz;z8(OfPH
zb=&mZ*)k82Rry7;O+#~6#$fAuE)-N$+}qQAen$I~?p)k6c=9_y56HRX7!yONUeuT4
z+FMrFICpk-VoH7FKzy;c{igNVPPf9?i)IX+y-GcUX+O=yYiDkIn{x}_{kh2IC!9PT
zGXexRI7+pH*8yc7CE}p{b;g_81Q-Wnjair58lgh#3tr({!W0=kpvjfqT$@>VAB}AC
zKL-ZoPCs->8pmZS+KLge_ssi(LXao%v#|3r7_7k6Z=N6A{XZQx+=vrq2uWPx4eT`#
ziaFwOIVlZ7j$uFmk|HACAS@}z2!cj$qG)a^eXGlgr(ymd^Ar|t<BgW)NcNp_RB*W4
zp}Nytgm}s7Onhsf_i`<q<J8|r(I#!lz=P`I0?s%XTk<Nnm@+KJ`fF<2+Vbx7_VRBQ
zVeNz}jelmTD-XBTKjK=gKv=frK&EPLZ$N;bgE!f``_|<n9NNU>wHhElLD_}uBcZl2
z6L-{(Ovpx&qwO~cRjEo^10{)7)83?wRFJM|&PCbMT7K4Se_08$`cgT-VsU08ZeMkB
zr&f*`Q)6jOHy?@0(crzk5fjlvrmLqW)^*MVWKf~?`zy~I4hQ^<a7`7_5TqEoSmAjg
z&AH`S55sHA?@FhPnC*h9=$urB9|%F>@t2rp9UPZHq@V#a;r2xjrUrLSw}KQ}j)-rW
zs2bCcE{i$Pee^x{R#zj$zGv*NM!E1nK#&Tsb&NM_m(!XEsf6Vb_Hm`DA3sKw($=7r
zKFYOb5luZuM63Q(Z3{m@b!fckv9@b(*ZR<>#tAO92_()G>L|htR;f*y^#VONS7y6}
z+keBw9l6N}RDR0{Mq(OM0Z~gPpvO*9L155b=%1BHwC5yaYn7DrY1Z;V9IlBIR(oyE
zuqAoM)?p@q+D6&iGd;Pv6(k2c2$KNY(A&-uT2&DeNh_lX$pQkyU0K>964th5U1Q?u
z0n(ZliayoSu0J~NT-W)n#~LNZ0J(7&#+tGtY)5*yb!4A@tL*N*&wF4l2s{>Q5z0EM
zqj7>0L1RfPNr1hy0R~o}_BRqWD>b%XICO4Yk^M}W(!jI>O*D7(icGR<beM>c6L?ma
zWvDH-n(o!?-<S0ija5J-AN+W>uWH<NJ181P_%wh1__VxiM0ch}rGX#F02xtivo>82
zCRm`sqcdfi5NMfgm)10rlK9IJ(<B5KcUSFb(d4use2>OBmn%udtidfgD`~4e+i1g!
zIqa#OLz1AjqPwW7>--dV&E(`;-A@9{a2C$TUo0Vs^ds@j(S8+0TZ&oJuS!!g_~vwV
z)7<-vr^AfzL9)g`L|HyfN{v;O$UWG5*fQ|niFiCB&Pn=cFj|YT<z+kf)#UDMGgXUf
zvuiIzw~`DK;tQb`^?;{O6G$O5S;6`jM;s@GF^O84LqVsMzKWa%q9wxwG+wGm*Pz(a
zEHcWJnDA`M=sr`;!(S_byq>}|>`-*LY>8mb&YCfEVoJ~yU%oT*?%5)bkmwR>?#6kI
zx;+HcZWhF~Reta?ks2Fq4k?_RZYB{DQXvFJOVY%#kb{Vb*CosCSr#LF5?Z3jx?XL$
zu7ifHLh;SdMyW+v<~6Wwh>eti8o~K4R@GMKz*)wk`+70(4)7j{Ff$c8utEW=8qz`=
z7zc>K?_~@c<RsPoBEEh_XB8)jh1V<s6&`2YiqZVdJ&e=Pp;+ZcK(~0k=z6L^#G@-l
zbFKS|If3E1uYdc!cteh9aS8MmKg@$vSOpS|2?;ZTkezsnZlE&K-r<`t;?Vwbh9O#l
zxJy|g!j<8T$b}jtN8y>-hbd%)E7Q2I+!coSMv4JujtWHGp-j7)&fvcDPcKYOI@E0l
zNYC4TxME8f?eW+y0$YImG^H^eROxCfNoV45s!;81rZuQ4xCF|lt~1vvvr?l=DJd*t
zz9pnO&cp=Ww~e(T%?X5-NSi71Y>IJiAE@%87z~W5R6mc*wY8@bqb^~M)%^*i)bKB0
ziIfKCw@fo-2vBmi;-c{>z=;_Dw}12a+MI2p{&%>a>Ti8}HsgIjq}i)2n=2Q8o!|i!
z_790H>3cS6m6OIG$XLtKd#b!XHw!d9paaZk0ug+wn=Z36_H~VPC}^(PJi}AuT+We7
zuJNsq{1Vo~z~AlIk&o$-LA}$^4HPR5LDlnPCdk?yhD`pQ1l{aA!G_gaqimTdmSqiW
zZ!(iKQuH;t9T;&e$O^p~2TWJGjYnTJJH1l#?S7Y?4?`_oIvCsK3Sx2uf6d*Qz@z`@
zcvM#K?giD<bcx?>y<i6;T*_nJ(X2NjMRJ;YJJ3riiIXejfrMj9Tnb-La|!&6eFHnH
z{A?fgImBDl^S5_uJRgsWPvvkda>wwOa-%8+?v<RW`82$3Yid&7E>bu2Zj6q@s@uNx
zA3Wu)K6C1%mn(0(S8$AaC)UG>KD+)|X<cFK8_i1I^SJa&!OPl0Vxq&ltjy!?$~JA$
zVG&6+AsSPW%3C?B!EXUuYQS6!&_Bs36O-zVDA5DG%%P_r=&)n#;AnPndqU8HcsbFS
zPH4z?NpGm-tq5JAIj*+OzN1*eBSw~wS(@>(+Pm$w`&y6g!j0|3zBvSs2I4#)phBx<
zf;x|UME5fdg<^ZrbC}NtLQK_XzNR3DL01-Y?)^vS9AN;65THQG(FADIB8$htahuz|
zL=%ZzC{_l$BNqy25pr{q;b;!aY+q$DN;_HgT$#zaPe1$D%g$-<7+(tRjSlN5L1`Q_
zFWHkt0`OD!7s(zxNcKRKTvV)m&Nl^80&;|u0Y+%P!u`<#^u*ksOd}-bnnNJ7IbyTA
z$t*<FzBG)9qu@Or1vV`%cofFBxqTo$ct7}HQC<JteXzDF%fF(VyDhp{tiwEUSnneU
z|Ihz*T@()?<Gq#_O-?6Nofp5qiE!j0_3f(}xIRY6gHh+4RI*6TSx#5TinD;w0z5m5
zj)`c}3Tp1!W18=sH#`WDwL$00KY@C23~ZqjDsDAPb=5f}<lpc@r@mszD%0vmNWk<K
z*t`jmo?PSh!Scm@+`Dm1A4=^-Pqep~%UQx8C>YztHHz!>ei^x*Gx#0F#7o9D9kaCT
z;ZZIl<LaFh01eNf<02Anf_F^5GYdUXHr?B~8%e$gOV3&!?*DI!?tMdYqjRX<^kgYZ
z*h)b>v^%|exCSKghr|8l6X%IU+bCBX)n#pwtk>aQdcb9ys|UKz^}893h}Zik7i_l8
z`z^Qm8JNsnw2yck?&Fw9eVjnLD?z{M*O>OJe$d_{ffV5;PE(fnBv{Gni3o$U3hSvB
zqCVQ9HVHzn(2%}QUTBuGyTzZC=o0(@)!p6CJ5u6ZHY!<@oJW)6j7D-)+5RmlK0DQ`
z?b}Yz1b(eMcU(!<to<EUAgqJ24ZtZL+LD<p^Kmn~q|z}l`KpU6NUV0M%>L0y2gL^R
z3*IxNIW1le_&qbEFq^{}ayPvLM9+JTK-8J3d-rxb)qnU-QDM^z_^F(QzxoyI=2onQ
z@LaEnG{|LzOP149fD{cQ8BW?W1{I;)$VzgdC{6ZtmzPCPnY!?G`s^ji!)8j-^@6?+
zmC7fS(YZf^ENM6|qm(BiR(#=5Yhl1x0-=-B2>jj_Y>8TiTR^XA1W;3fgCO0~u4CHP
z{V-@GgOD*!d!Oe}Mj!M~TpY1e)aSNN36xSpy8GVvJs(=H2ObORn|KOB5}+5F7M$7j
z6YlTM|IK5+q_etO97MI7Y~&{vpy8!(-HofFPz$vO<42`lJ?FYWmxm7qrDvq?CBl}^
zX4x`4^pYc_YP}4N6GyWV!DZS<-lta2Ca&zBY0bko)?VNgQ%!T6?Q;*tItn;CjCmLB
zMdR>+rr@S?fi#(o+O%f@d5$&UD-RMV+gl`N8c$@-*8RvcG*Y=!CP~58hEk09R_J#5
ziRNdVQ*c}OUbTyE<t+D-(Rr>9!`xPLd;W}wd>o$JtGaEPS3EE-B{Tp%TW4M@b<7*7
z!HfV2oVW*ex#X(m1ZdCW0>RcQFw*@wUrBD5G6qc~t-LNoXr?F{^4$GW=>*;MARFXT
zokdy0j_18q-sj{7YCZ1D7d73qvoE^0g8KkxJ|$l|qz1g4aJLIl?a25>dy{vzoZ-`r
znU7;OXci=@sa@#y=KQaa-n@^3Vp8%}ut6?>cavP>1wJ0n?l@@?bG+waM*;HI)GRwI
zqIgVPUc8|)<Us<<y64NYAHzfv%PJgTvqjpwATzouRLn``ZAZuoib#^?jHNtqeM0pw
z%94>+ycw&_$p3{_nE0PDV{yPAw#H+0+rQX9{=0qYwmUkcE;$a};e{=!+`7EgX7Z-(
z(_2kzvm!_kypLC@K8~!pf47Xk<ZVFJGvnZ&2j7zQqc?0S^ai)y*5b(ruw2iyw>4q#
z@Aul<0vavZ(b5@BQ-6=O3XJU8*Zd`^QA0)_L}D1FY~?zj;4-KzzRK97@M0NJO;x!|
zHR1ZFAJWSSMq|!1?MZf>?EN*pWp-utq!JvOwi8=Y28=VfKyydcCt07;AxO2z;q14-
zT?6W)TM%EEbAT(AWjNvatPma|kfF;{-T+o@_A9w7{us#luog-*L0t@d<Wlt3U_*8c
z+eA<Uh)1LFOFsM^J-qD?FZVMoJ9!66pqB$6jTp^d=s?eF8W*&~j3{begsusO3Ga|W
z%;2<oLnsCLsild6ZZzVCC|XGaG4hzJwtSsIdY9|s_fr8K(*ZbrP|o+rX}0hZ{sfPt
zzZF|i%R}^3+SwF)wLzBUC}!GwqmOUit05O>=?^EcjtKtm7mYi-&oOP8i-|gtCEUdd
zBZ=8EK9KPv>nSUFM`X=N_FehS5JGCe9)yzMVvYPQI?+4%bi>Q4?kNY9vA%XX_qbDx
zXusL5(TvC8xO20W2}}lv!@+&I7!qLN4{%X(0Kq$HtGxb6Rn$8(wMgTP4k7*CNF%{`
zT3|#S{<ceFQihU_0^aRMzBST+&Au+CIVP8u=FU$!8z(C>2zb#w^Kx4B<YYkTv9Z|q
z*B5ASQ9%&#gJ#85ug;mkLoF(956?5MIIO0>556)hge^W}7#vhv#m$yW_H`92aSetB
zyHbw!T4$U;f41MD&D=9{jLtsR8#Qj7`#0zcq+?4;;WIqf-XfiY>f|1{LxBC_Z!8nd
z8nC8~XPkb4j>?FuSf|0$(wZYG9deR;wvgBQ)A3EYzVpqY@%)WF7osC}D)zkbM^pA7
z+O{Nqv8*O=Pghr~kJpfk?i^Ve@;~983MoG5|LoD0aA|ADV~Hs<c>(*7Lst<4RaUoy
zWOaD$g}lhi#b|&>4<i7{67g46^zwGcEOS1T7bmAJ4-F!4dA#KKkdxi^f4!(n(ADsm
z*64GBB?HLGihI-@QRA#N=wK6b>s508@qFrPhDW(%OzGG5-RAXOgVu7<`p2oaobe|P
z@49ca;foyYKYd?Xh2$^x4KQ!9*#{NO!clFe25?w!rc{^FmkM$^yRuyfQ!N+ehZfvb
zcw^v7^!oxQUy@>p2gTOYDUEL5Bh6)Th4c`wy52!x+9ul<Rdz+?ZGOEt)NbZpUGT|X
z9g;Ii`ksc`;3r&>QcPbiATXCP|D-HtE@B);&nk}zogLH5HAZNR40kPit}jiAJHhSb
zc|M}|dm<Y$9)<;dSG|8?D=}(IUToK=V@TTs-c!^sj?RB25AZ&vI|KUKN_g~#5NK&5
zq-VH^GHt2a1pAY<g4@1=u@t2$I4jUW`BeQ>GI09h<pdMPE~MzLg0g}_1qBU35;r4O
zW%6{q=2@6?+%PL-#NXwT^M;$$kfM|RgL@auI|J#RfC7>gOi7?Xd#Iiw)|28U#*uqc
zQX{||!(8>G?+a{%v<38IvX~Txr&O?-@hyD5fWMSZ$u6rveBY5<7AF26s#{SN7(4c6
z?2@CCKR>^_of`d>zYc33%#2x5xQLL0v?SJIC`-R;QJHCTco%WW8tX#;-xY*(%2ybk
zaU8uVj~h%~gcX+41ufvkTvR5vhynPs!K>1eWwRGY#XlZxDnMC>IyI!?(O8e4^*+t_
z1pJxxq-P&M@F-Xn25wTWngu8oA+-2^XjDtCxvj4Rmo--d87Gn9B_p98F2@u*&GSO)
zgH}{@@iq~!N7bEq9eQ6GU7iyrw{Sne$C~@6W-^@iAzWyKYdpTdf#VOTjToDdlor+?
zSp`lU%EiN~sd~z4DCVya40sXLqT%0*!kyfVm9tGa1Jt+CM`d<nT@lnB`+F}as_WAH
z1N`pV+`#XG0spxPk~Euz9BgxJZaq{3YkC=LycO^U{)^q#P+4;kuM_-R<|mIX$)7#m
z>#{1QWX$(`YFQ-f@z4+@=wOiiqnw)d<IM!pEdr1?01Tqq1oNdt4OY*t{E*CCHp0eX
zdRWi!$_|E~k|pyMk<l9FQUM=P6(~(Sv%4GSh*uSzQe?wjxvf*Z|9Z=BxJZm@%iFi@
zrQ@dCN9W#`Tr8>3o9TwLAb`Ic#_Domon~wHauQgYdI;q^)kh%wZH2KzgcD|TMw`Vt
zJA{`l&XY|I463f7t|eF}WjSU@k3G@J_=*uCV=ZHLV_&-wkm01_L7`qU--0?PsGnN;
zc06cF*A3@`m&EKe`wTrbZf{+8)et0*aJi@a3;d4-qn4zKcI+G9dJ^`pP~FdKD&TQ~
zu_hX<xNA78@|b3I2SpY89E}xJJt8d}{ys}YM9BnUwdD>oUDWe;vx97dV@*!vSb>4R
zt~9&rjtgPKO=6-h8j(OMr_D2bG$vla@Ki7RM@MeW(1rSFF??0xfD@)4s5Tygw`^rq
zlP7A*80#vOBxsI0GgfvBLbD**)MK3Zj-FMYrXZMtkZM4mXNt!A;aFe)VYC!zi_wHk
z%r<8?!mPS*-rtZYGBwlGeq^6!QJ;WvxB!6+4YUijRxK(33pM_L>H!xV&=gh##0y}*
zqzT{0@Y69M`^5eV#NL8;qZvqu>PVNy^9eYL2P$`)$ej}HKWp3pXC^AaUymZ-n@R`J
zzXwHgr0ZPB3_KL8`urP|_CuHCUXm4IK4x_<^kync=2wj*y&GG7?{Szf1#}JH<ZlT)
z)I3FgnR8H^!(2L2`^!&3LhGuou({V6(pC$~0sj7X=c;<9OUGS*Xt-$6o6%d>v+d6W
z!e1hF1gNRz)UyY7s$Qb&q^mhngeVk<;}jnnIE!{a392qE5y^-t>{Se38NtZo@tEDs
zI;|$wE$duPOxfCq=%3c--SnC~jQcfIR}GcGRd64d40x%2tJPL8H!(X|x|k&+vJYF$
zPO>yWe3F#ZhFrZy;#VVctgJK2YL49Y2xEo3&glg5u03u2Jz=hEbslGEz?=2xq+2ny
z==bxvWuFc$&@wf9VaLEf!fkHWbdx5&PLJSU?E~9Ij&8&b2iva{jT9qbE4N=0;21Fv
zHWWr!zv$&zD`@(t`#~i>Ia=$QccE%1z>A+K7r)=wdim$O>weMIFgOpq;s#skpWX?h
zFD|{XBjV-{BQL*S^S!Q(uFY>ozbx?iUu-C;6TlpXP*5j^VL}Y5;6#4_SWhZLRL4=g
z@|B$3tc{ba>J)@k(1Z$*Qqp6pS;#d;C@l9Yk=W^4OXjp;IB999BW8gF-HVJa4sE^Q
zU~ysUXwQs(c~HQ~^9imdm_Zv{4FAz4XrMc`uul8PZIkAE?M-+q_^Ol@e8bV<)#w!|
z+l;XS1Qc=CnBSzIwA|Xsv%OeMjb$hBTpzqevqbngQX1F34(Y3!%{`biS~R|55FEbe
z&Q3nogRb+!-SFs8&I;YQusuD2s%p~0evX^?tW1&XH4_&D6QN7lpXuhrutM~jfHW3_
zW>H?m>7TEv3uzg)=(p3j$|81>JFCV6tr}uY!sZNrD~T_?w~4Ebr1Z`l#u>n)ro%iB
zgzK)bq&b2$EbxJsJeLT`SJ<ogy5oYS(HuQ`j+7!IFJxH7A0-kr=TI6_)0j)hD04Bq
zAFASi+wrc0LAlH-8l<l9ig`F*ZHgCr%=}_P_3?k9Hy}WM05qhH#-x}GZxY399=29G
zP0-*tpH#A&vIe@PADRUg^eF{JD1ftVssRc`zg!~9T1Fpl4CSv^wj?`b>;a?eOAns5
z7Q>;-Wn|a-WIYlOelytqxUD4IS4zkwA(6!zlTwux>It7r+sSlgtkm9RF4HVU?;^7b
z{52P+A}UE2TZ`_L*_OY&uW{e*hhFtk7TuP5<M(zmPOr3a@3zyBBFhH@$1K;p^xhTf
zn;T#KN^THwTvuhTGJ!`YgLkH8yV?x<Guv14j4&aDJferc6xD5t{gA=51yc!%(o2p@
z)wnBIxRYSWYnGD=Q~}!3am#hR%X0f(F=`_o%{GhnbeWJ5EQJb_x1hXYaRPH0OV|q$
zA?r;yT>BY_xhe(KRl6{@pg83UQs|_vlwSm<$>t3L0}WA5Sp*^uIZcwafox;+m@wB3
zMi62wr<~#1MS8|_w|yR-Esp+JR`j<0a+qx*R0R!Zb)wz$IwxJ+6%@S@vy^)(!^kE#
zLgy4CWktKn+smiw`OCk5+$`V0xGQP>cjhXjDPZAYy*Uk?fa%-7$819IR~cKR89P;r
zv_EqPar$)Deq=JAtH>JYm*F#cXG;f1RNubwC_zh`nVXT!QaO1gn)vx&cxQfHdAL(;
zeo6e+{+JwN@9mX3EHeUf$!5Y!ZOd%6bk^Qru4BF?EMhD|od3~LxTPq&MVK2RX%H+M
z$=5|p9|`o|qpqZ+=r|Z32a~&9TnnjFgvN~6{!_j7>YbMzUd6?)mF$~!w2k~8_+9@)
zRs7<&vp{_h3WW)*m82`6W}%zdVAU<DvY8i+OLNmfa;~^UDE&#gRJi0;D)DK&Wnzbx
zl=GV40%tDgx{K|qnGs$u!{*6Wv0mCyv8z>MwlgQCoa<_J7)pFk$$!1P2yf=eYNyq}
zKWO|xP)(V5_LQ-%TN4PK$k*(J5v)*LGJA;&bu+zExSal~Nlch{^`!hNG(Q6pKN9eC
z6Ok{)f_KVgr;N42Vh_#+Y8mI5W?pXel<H@_nOZoVki&U@1BlENIwm@G<D%MHvrvz{
z$3^$&_!g_j_i=y!2HW&k$aF8O?J)_PTU^h&CXV=+1=0;M%^aA}2>tgxC>f^u#`>mA
z+GPhAI(i2jxfSnu*lWoL^;W!pQd8S>g~tkBZSBiXc58KIx&J#0#NI*c1e|$oYT)4R
zX0}nP2$QSSyD+FS4c%Ncd#cfQj~S+&w*2iVNyIV%i`uNkBg_S8nBq1GWVhtnEhmsk
zcG^q?t*K_)SkUI|KR)=U|Iqz3D$jEKhi5$HGJmPwbeI~l;BVlE?h2L*&Vdke{>t0H
z($CQtSkH>sCX|!(R+&vb@Q+wa-K^*#z8z7Y8M_}+gG`kluDEP_h~C~;SJ7u*y5>Vo
z^5^NYOHCIvuJQ;cf8=#3;J>AWM6h9`XiNrGcBo9fLURmND+g5<(A`Rj+^tT%i+)>H
zI}DV^I2qx3EhH41q_ib;bN{XghRuDtWM5wt$0%rc%*~;1Lq8Z+h;2RnGHva|e~*?$
zz1qKAcLo-IDdaQ@pTG)4QdmMa!FlgssNtT`Cc0r}Ou@~IQ>IH+F)S2WS0xKEGsb4+
z>#LA#B@KVouZfYBOlbV1Sq4CuRsA@}ze=T+gH7=7MdP_Hv$YX3uUed)!KMywfoclk
zO?h)n4&X9c1FH(xj2noPwzQD13s!5Qm4+_fa$+V6=VGP2WNUR0y{zDvpxZ^xHi`CG
z79--mo6@=+TWvQ8`hM)#IvGtd9;+#$tO$?I%g&Oe8!ptH#GzYB8e<NoKLqibrm9l1
zud#yL2d3bh^KlvrWlJ+z2b}_$N3srspiI7_fS&#8-kFTe21AkcZk8P%x&P=GjD_3T
zLtl^_gmra9n^OyWjQ<#H^e3mxw5`_Fy!?Nmc(|EzZ8}SOYkpJH^q9Z1E34B<6T1OY
zjm?p-F_-qw(9FOhbqyi{n=z6xm2cM>!SLgR!<7I|cD7H^EZ=;EU*A+l2DfQe1;Awk
z0*=mX`2oT16ps2N5ZY%o7AIgy{?=x=>0rML76?M85(t%GYo8!l;j2pPaMKU((BKi@
zBy2V64lPF|O+-oO@60C~qa>l&?e>E)=K8K^Ny^-rkzs4Ky>nIUxq>I7vDfA@e(kdA
z(jg^%nU&)nu|W5giATrP6y_i7g^Zt~*GV}ySXEi|k|gH0&JN<Rxq3v<NKC`<NLH%R
z9oBmMk%4gc1HB(HQH(XWAt3PbF?*BEt3f<4%pO<?BoJK{)o#d;X-Sy=q#A$fWT?Ln
zyTI=hRZ!_EoLV^^DGtm2c_6_1DfDTFjln`wZtJuEU!FY<lI7vG`8B0ORpR8*$3c>}
zr%r+C$adH@J%VR36K!f6teaK&A#MI}UE>?0wtCG|$w3=>K=WIY;_RJr4YP2pl-iO-
zn0Z%pmLZDssIG*Tp50Vc+~bG+U}YT)I>UVrLS5W17uTdYkd}wf{YUTbrd@<W3F65b
zXqAyCsnGA(qWwh>GL<oBD@k)(MW1cXx4PXNw6?OBRt17dY#A<vxlP&2Pl<dI_V2;5
z?A)NT68gDTa$kVgtBRh#y6lJ#x@T-1|K3l8K3Y#CX2F6b1S-TM2zewljRFz)^OgI!
zzq}OWFFdb}-2&+c!hl*u>EauPf#2J>k|Kk~+az8tNfe*wP!R-`>_<GC1!e~xgkl!Q
z9c!ILfxe9r!z!;qh@_^Ll%$Ah^$?|D&LT5Qrhndr1UeFd0%QXBe=8HdVFB7r`YY*~
z2NW=CKPZb;XL|U{M#OBWe-*O2oJk9rAhD*)MPlTc8BJWo*r<FOYg#O;D+zg`+1||n
zN~X_TyR1xlyTQphqUfH?I|KxrSLX~{0(Ydm{lDETt*<ZxTeTBo<9u={EuwH~6Ix{F
z-dA8@!q%l%HsF~!Waxd#<)>_%AF7b0T;Z<^8o894U9eu9(R}mK*zo2ad+oAtCtvXm
zGl#k)E>=(y<nB6CulL^J3p#TK0{LP#CK5dFpA1l%sG89%^?uD-gxowXxl)U-pTx;#
zliY03I1i;j^vV&fvuQpiFQc76h^f<B&t3i8K`JYG&bBy(6CDunYt{Et(Q&0-l*t`W
zX-{=XRYXv6*#Po-!}bUp>?R*$^@L}`cZ$(Uk+?sZ!zC}lUK5tM;N@+O?SUYy@(S+m
zW%QN?Y<U;YTSi(wAdH$dBc?HSf`IYIq!Lf+lQ6t0HVHs8U$EQe0N7smQJd*zN3X$_
zE>Pey1YdzTPK*F0Dbw8a7;asdBkC(+t#pAv?mA;jJ6_xKH4+0_PF^CSV#`b3_JTn+
zp8sn!Xofi$5<OpZpLZCFm4KGZ1O7%hI|O)g)+&J6w#b@`!PDT6Vcc`jNQ{5bDi<V4
zbg-2m!<-^(ewDSH8f2twzs3Nc+^eG8kN19h7Wig(An-GJJ>^`FEvIT=YU>3ZQp+Du
zq5RYTr8%ZYlK#d<B54{Eh0GHo-**~QR2vKcQBETWLy;C^78=98sysbmKYK-#Eg&jw
zu1=G`3LSRrVt5p7$owXy+21FHT0Vp_XT7g~YM9F#noVh%P2D;@PBNkHB0w4<ybSw=
zPk6?f>{gq)tBK4%9SO#oKsnKju@9-a4%Y?C6g@*(Fv8dGWGuRD$%&{QJVG6xG6~OL
z&(E`0d+oG-R@Gf*8*SlvxF<WbYRKt?j&_yyI{eiUI3Kf#q#q>%ih9Cof$So~75J<3
zV|Bhc$`Lt-BoKKQi`-d2C=#jMaDdrSI_3ao{y{KjFtmf3{kYGk-*H>G6`7Yl>G=GW
z4)Xv!u81{{`WpaAzinzqjXAK`&rXu$ro3Uo7eNALOs30O*=GhmxFBmOY9J?EvF9ue
zn_D#{p5neLqiYWEdOt>=t*xl)JdI47o{^lm7jW4=0XH~xm4rmsXiS`Z&|?UumNQ6Z
z%+(C{+YRD_LEj;U9FbaL@dgcUbj)rID+v>a+^EXwKF{-hl%8r9Z{u&~lOD|~Y6pp!
z2P3&x1H&8>2v<Psg`hDlP@RPP{wCu)R39O!f;zFUsb;<jyqL!fA7xA<(QHJ3B>N49
z8_KlQ24~7udzxXO!^hInQ*9AXhN!XCFE6^?DIR_1@#syMl3L@O{TQ><!H$N`<F8!R
zsv~H31P~{CNR=Rb94Gs%@e4t$6oLlwjTojWw<oyEj&UFYX>Y03yYZnTV#Y6mDDMvG
zec0*WVE*|$&8q5_EF{ja&oQl@)X9e#`Fv(_kQ_#JZNHA~c=Ohqwy<)*3!(Vs2JCp0
z5ftFJp}MEAI@>GeT-skX+50Vit~%<x3iRe8STr2Cx<kFm!VK1_EwCYiK7TE$hS`MR
z#|(pANSS;r(vKbhrRR#Lv>Du*@cd1E_O=Fxt8;CQ<G&(W2KtAY1=T#>sI<VYR)08(
z%w(2WJ^*^eCRXEdHgbSCXTf&@q43-N5ZIj)NcRY01I&Pn;9FQo5ODywAWkx3(y+5Y
z%VwRMN~vTlI!XIKbbWbLQ|H$%77;CCR3-%>Dk@sU)XJa?i4!7Hj6($lAyujn5K{|C
zl#n2!fS9TkDiq?tqzEVwP=v$~hE}S~Q;<wlWs00Agi~^o-c5hsz3W@w`tBdqx>k$H
zIq$oNXFvOSq72-&wOF|zoU3&tWvfuT27M4F8;u;ji)fltoLWkcsP`i4-xsl><X*V>
z{keM@1C4pgsHUtW9a8=zns!UOX#GDrduo~?gnx5+Zfs`*PCcifY1ezD$vXwlNeva;
zzB6ddaEE%kgzlv^_Q<OcIc3O@c>2LE!3E5pXr}%uCAFwB;5_+@vir4vUS3sNb0o|E
zYRJtv7Mx?Hi4C^gOPfN=0I=zYX($d4!lp!@>H_@iNyY+%fSE<8vf&RIFu4o99?6a)
zRq=)2p^H>8mIt~{DEV=9wz7IN>A`f6M(wLzY<{NBYV`}{d`_kIc61rKTzI%Lr=eH8
zgJ;f4#R4wK7OqzQs6TZZUcnKTU>$$tA}WD8nN0ad=P!_&fut<u;E|K%Fg`2-3Ye;0
z!{vRAxhiK8wFb<7$3W|@%{iW#T}^pkp)|eBr}x9eD_-<f*%3tpQGI=K<WF<v!?63}
z8?qq}pKI<BWuv{(=C^cM`}-tF6a`xzDth(leOD97(!ru6#y?e2g)$e1BHpYE#)Nf_
zhsn_oh1A70N4^rQs@djFvv_u?V1EzrHr{Mg6`^hVV8DG)+rh7Ls7Wb6Zr8MM*myJE
zwn5Y<*3;o3woM<1a4_g?47AEQe!b;ewojHj`(%Klx2OG(8$sMZWS4ROm0i28U_^KJ
zJOCLm8<UoEDxu8(W=55TP!tXYba86~-@HrqA=RE>N#Ev4GjYr+#oQ>yqpxN4UJWX_
z7;7mVK%2wV;pfGw{pbGb$gilacs*VJ=T3a*hwFUlI3HavPLN8B!-xwx!!&kXP+`dB
z+mlI{iH*?Bqv1!iC?H<s(K+S9HX1uR)Q>U;54~9C|90HT)OWmS=cggNq|c3+x8hiL
z6y1R3*FJwfSg9~GB3E8i<ekgdFw`F~7#(!6r|slod7SOPXg5rE^=FnrQUmNiA&GQ~
z-#@5b^fywYIt<<pkc782OZ1}JQXMa!e=4IbdW+8NRld1044o}+D_TM;ZH}CLLYBQ4
z`f9SpEN{h&4%&jdHs0ogC#$;$qNw)ut93zDBVND~G)bQLDm+1;nWll07`&ee8d7qb
z=2i-h?&jafTwIHorpnyR`x-A((i{lJl2G#;O70;b3GONw47vFA`kr^<lErONR4O&%
zn>ZRvU_+Arh3_{|{iKN}&SSQbsy5?IU3HZ<(v;+PXw)VB6wD-ISb=Mt^|>8o_x{$f
z;WppS{3mK-zk1&N?`zw+277s(TnmH#y|Wotp7ao2x~6LlAbaUAW;SxFNfY`?8<n@_
zj(uAy&q>K@Rz%C*mA#PTP3fV-vX80AjF68bf{U-bWPGjNZnq=jO|^N?i_s0j22hqO
zQtdU(tmQqB+rGX)aj$4+?4CD`1G<}b30#f%%Zv@0tE98|c!^awz&JZ#>5Cw(5wfq$
ze!Ovy{?%tW==KPZEWs=xZmN7G_y={7Dthd&Q-vWHYo}%{#T*k!^5i7J-YB|skg5`|
z?$II6!A0m?_619o!4{Qc2mdT-Aih;jPIs7Gj**cM*RaEKmKpst?F*`vVW;btm2U@x
zmU;JSG*{1JH1qQ@$LjVIIkw?j1`qP;dG(+D8d?tNXtrs7W=Tgl=!Ui=))`40a|v3@
z+={t@EIliUX^7aQ*Vz;?h<qh4_tYc0wL2HN_oA!raDit~@T1XLAk{9Y`2pqzmCviI
zyH8j0xbd@M`8pkp38xHjH|aA{MKER@r1}YUQafo|YkeCHFOzWCxh|#?OoPPRK)3%`
z-gVGTBs3D{jan`3a&@6+Wr^OsspT&xa7%{56r%9L6tfh?=F{BXvwguidvvt>LUdUT
zwI48R;zk6zfmW3S^_bS+PpZv0DjM{PKa82q06{`czI{Q(s*2^j`i!MwrP|=z8-}id
z=vv-V_-s(iOEdl2k{C`U^vXl1MA~K?>SvV&EGz&*8XkAo?RDK&I&?zlSafd-zi_Cj
zXq;LgcI~A;8W0-R&+guGKiT+~eR23!3APHR$9iF!T#~eixlNNbMH(pbROX8pYdBNn
zbTd)Wb=TlRydhcc79&@*2orPmfLxLD>)2qbER3A&Q`uS?5W3hQhqLStDy?v!>3+@-
zEP_1w?;H~i72f+s&|@)#&-|ODrsxVRmXp%O7D^!EnTzR1n>dE9lnB|r_}J)%Y)Zy0
zGFxk8;cXtN+xYWHv|rSVF=vzd_qnVKg=AR%Y>NgD?NRf)`ZF-7_+JD2IhcY|&@C_u
zo6izlBvISYjS@C&ntu>V=CP>kWE!$&^OR;^SEH2!f=_1b$j1yi8FotRBOP{CgU1~P
z+m^B8%maG)(paZMN!SM7j{0;m*f&}<Y$c_=B;^Bqp??HU@wz80ITsa^i?B^@EY5k_
z(>4&t$^D=hP<v1*+z+syu}|COY?kbRTM)uA=Y558TKt@n9m01H!Yn-2_Pg3<PWVId
zfPhBbaJTnop~J+*hwHiAKPyCns2Jl-m$vKwQ8h;jnX?_xgs=p4B*edb09M^w5Ylk)
z94kJAM`{P?&II!T?q-74noihHGZ&5d)<U(tQW_g1@M}p@1U>DJ^vc+R(>oqk>%%uu
zm7ghXfj#%AcSR{5+Nb`m+doeotA?&k&<*;Ui<t8<ze@B3zL}FsSr$c^ho<jAqT{#l
zti*JymcYI!1u@+8l^wZB)Hst##CL{U!H$!MPdC4E+Us}wL6--GA+ybe;r6X}aV_Pj
zQ=ir#SB+;0+~6?NuJS8`6}y6zX2R$SMo=%rRdTZx4*5&$)K%vZHjFo<`|j+n@~Zzz
zH~~A`laTiU>R%0cJ1EM^7gU#+^}p|W=M{(RoE-eDT|$Ec6@eZ4m$wZ1<1J8S;W00?
z1@V=Gi??COWqw>a!!Td;TItnrx#mh)od@uHzl%ZFR3i16FD{hxI3~Z<__dBIM@>JS
z;EwXEbkH2_LSJ~X^R!Krr%n?N_n5EvRUdPdE`q#`=&50n`54hs>6D0VwP8;YtVZxl
zUCEE>9UrmW9aU-ocS5z6-BDhp&{}x%lC^JCZ`^GBy138h462M^XZSEY--9gaJ6Nie
zG)wyZRo77?HE94l2`kV}!$m^catz-YsfmUG8?Fk!q#vEx&ugD%n}?aJ9?#y$lL(!o
z8fU7rf$DUUf+qMlU;Mexd_!(@F+F{58=W-ve*sAt<XXbBrl8KCP+NMR`C2mH)kPVs
zH6sYiQ>{!;s*JRdE)=LpI9eU8Xw<nSv8se+_<BQ*9B923c46K<)}8WR`|%s6PDN(=
zC7RAzPTn&ddaQ%b0FI0VGsCIitHfVpw&54RC2Jdq-lx>oQ)QFaW@#<>71&;7A=@Ut
zv?_*efa2w5aaA<E(ZCfi(p3NG1aeNY<-~hsq0XPjoV^PZ@F`OoqPUfk(`XifM(X};
z`ESHfNd_Ja<FRcu3QJ(*wUdzRtOlq&za$LPz?7PWq_QA2HNe<v5gD_^TaFMN0JDiu
z$EXRQv7sG=fBw|=X`6aUmCP<x+eH1IKh*1__z`73ynr4+)I7%(w%^uwySgg}_jVHi
zEiX}+k4wcxmm=~5Px^b<y}5HCx+t{9IksD6<RW@~;Z($hVAmV=)s?Nf)=%_5dBX_-
zphIw!2$AI=k%X;;;w3o1pm{4}2dD|D{g5$wUvnn)E`{FZuPiJm46D6As$ITTKI73@
z=V(73zLhZTwnuTf_rZqz_E8__@QmbpWjZWk<h&VQ%*aJm4PD`ctvZVNhQkG!XzLQt
z@8B<D1Uw1=b!EQ=_o#*AHGz1gZz3pWdY@IhXKPoUJI@U_IH+`gQ(rhTQ!(0`t$BZE
zNlHZN$kH*woW#V4+5aa>hVs5*2_gWJGKMb{qlKZPz@v(gEGBY5c8MhYgSkMj?%C4{
zC74^=JVHI>G>|Mz`;mUm|Ky$mL*fT{lB&FbzIOO17}e%l2s6*Bk0ILf^0xdC9eigw
z<__il{G0#i+#4KbX;-=dT6L>f_ir$ohg|bo!(q6<?+D6)UoCry7O0jmFbJ%x2dF9Y
z54WVg>yfxcqvB-<E+Milt&&bHRmi)Ks6NQ13o9R@YYmS`j&)Xf|1>f%mi?alVAuWe
zIDBW(|Nd9Pk^@Ux#NtX)_%z%gUzM&Ysar3z^all5v|OJ1CFoYu0=vVb+<uY>#RiB+
z63=p^HnY;<Hn;xv9M8k4!BM=nJJR2y+m7LOsl@xP|9IZ&bZ_s7BRc3e|1x@J_dzy}
zB1ud6l@iQIzlBrvCQ0o%68MdkuI64OAu0M|pc@jv#@0nMjg&aS-@J9P>A*I^8y^yn
z`LWVVi8d6z>Ro2>%@8M^WhFPqqq{Wf?`b<7-PvE11k4h0=ln;VbvxvSM};C-r8Ehf
zJ)inWGQwQJmTf7x|A*ZB^qU6x@VD(pk9U_h=jQXC#;h{GJm&jh!e_y-!uNQ*&0X9F
z2ySpu^j>IwWt}1|*AAEmE5M50l0HYLs`7256Yc3iO;(GavaAYkJ+{-9)1swzM?JXQ
z&M4DUXXH4A0nVsVFSosOvh@7a&^Od`%-(q#9md=jFNc)=Yu+lTvK%BSLBqa{9Lv$m
zmKsSSL+=7Ic?fYYN_XA0%0^9a=P8p5MY&nYk?PjU<)P+(W&4zG$O-;1<R3Cy`sbn1
zzMc5@v2z;>|Fr)L0tK<8w<J%@CXUMZ=!VG&@<V@ZD}R1eX|S9$@dvDp!yp7Eij)*s
z4VX!F^-$`|iy9zM&<C4q-vJS`E-a{Q{M+ng{^LN;Q~6CXRvC9k8@k-v&)E;HZFu!+
zHSRSB-Jw>27+BpJc*1>ks6fgFMBgcnxE}6u4f3hAfoX@vNOKKdUcQ~j8IC<|XVEwt
zHG{2n%y#3wC;~Q->h1t2c>46#_*D1xZuJxIt^q-mh<{nA7R;5EHQfwPnTGgrn_Ypb
zrr^ZTUd!Qc{6SoHen+bHnHvVp6E8Y$_wDdmJns-rbsP!CjMOSi1eaLnBxNtw{w}F3
z;HT8t+#luPJ5F`;aC8Gow{=%!$??YuJ?-=I5ism|9C&H#Cb)jFyJwE@a$;Y<>z-Ne
zX|2QB$U-hiCOp-f=rO7q2-lt-bLf*UV!~J8l*5NmH)UFzO#BNU2gQRqUH>4OgjhAV
ze*2;eTQ%#Dk)f&QG?GmR30JFr-CVc3eeAIH*fo2FJy51j)Z!=BtBueI_fA*02h86&
zmF|V?yQ7zx=>>lHD-y%=8D%*IBKM%6^XF-<E*GMIJjIRQcx}el=xuAwpLx_X!54M3
z7JR9KKM)2)H+^M}Y7f}2lM(|Lp+`YVUTlEYoKYIn_4m~v)hY5_2)txjZc!p(15$n6
zj<M~`BdUt|RnNr7sBotPmEGJJpQj1OpYyzJy-n}pe?RjtWIJAiEscgrOu1;A_RAJf
z^j?SdNr$$<R%vX6KU!2i&cyY;{-cAN0~j~!3+6^_Kk_KFT2(oiyXRn~l9gCxxqD{+
z3u<J2sHoH1=0qjGlSVjKrbFsZ*RH5k0jB!kTg@FvBti_xM(@Ga_0LxAk}aqS_=(2A
zqkhN;MSKO6FMz-7ihoQGlJVJPbp+Y3RxLXdnyefVZW&h|rm*$&b#%6?E_&qUFxpvl
zb#qnDiGr+&i;lm)+o+3l{wJ#3hRb!B6%3FXo*z!jsAV_vleA0Ge2D?`3okiEcT~K+
zGaU1{8#1eUK5U3<s7)@hNpWy^)*j_m-5%w=yIJH-A=j(*MfuO4n)aRAvQ$_7H&2rS
zG6seRUVT1TKgYgIeLSf+zqw3?|3bTB@0n^)-pJd!nP`4Jq_xSKaK|V=HMgVonIY)i
zlGK+#41gw(0E_%J>Vb@VP;d+)dP42X>>w?1U37Q-(DdvGG+U&m$rW@ELwA;hW;tcw
z9vjWxkQMa9mT8057vnedbE6~Ngmq=}K7j-pm5+q9OmNjMjL>vdCwfZ>SOP?&w7@OM
z`aVIMKDv8GZkA#{xngv7Ny4x#?W%cA>gp%$uDeXMS1jKb#mE8{agI3$g+3Af5FTEB
ziu=4a`4Da*y#<euIsIXBLIUP3B^zsh2dN`&ONwj2{V^+i@BL2RQq)YCoii%RtrWe5
z+&za$J7$%S)U>WjDs}L-IP$dnaq#hv=RQjF>~HKO-R7hApH;4!ES}ArYzG(D%ubbj
z0qf4+qHL;CJ1%p~g<OX;=MMim#hypC(nknsiYjl5eadhB%2M)OMXDFEF(C8I%ng4W
z`Y6-1Hbc{scjuJeGySPP^=_8Hm4AwzO3~%nqWC6Ch3~|y2zS+0U+xmq*UmJdJ2jZU
zd*MG?NjV`NfhDcHtovxz&YsPL((v+g4gp5To^)?6E0t%9-#eXrqL2RdADCpG77TmN
z<0lTQ*NsaM&+>sud0QGQn3Moo#B3$YAMJvT9c2o;PG2Um3UdaV4f6GWbd0pC=&|2F
zSH@m{5(yISNJ_$#owKF&-T;ypRq>H~A{>9Ln`<$67Y9U=_`kJ{lnRq_Y<ZC?U)h@u
zTzE5tb4_a&5@@DuyW)Bj)F$&*AY1q#wv9JOW8k%hvA;u-IS&E@{a!yn6MUc6c5)Y;
zugZD$vF7c7m%Ztyo%6JTzW~593-3#?k^eobzj7!1Md!7Rmw%yDOukfvoj{Y+Uo#e?
zmBZwvF!63l0uL&XDObzc|Au`@bN2gta{Nl_?EA{q-Hct2CEme>1!Gj__3VMF*ySw;
zJI|e)xT}K+;95N(1+fPx0$AO3!KZ8IYdA2hAcD0VA%m&gfjP+eDZDS+>-3BLM~U0R
z2JuFtwej==Z64Kqo1<3Pm+r_MJehDf?UnqE?Th)`=eTWgtla;^9)GFjmX?!BNqkkn
zL8A+W<5qUa`>bOB)b)vNLB(OFK3PAe-lf04+B&~;_05&mx1G*s^fXk&u_}BM`QMZJ
zS##zKlL?F+YHQ{jpIQB+$bfCaS$ino7HIL~(H+!m_uqURJuf{Tzigs?`e?|2zVu|M
zbHVicdohmc^wx(T*IhcP`!_H~5>i=EG7pgUYHA@lU%%{|#9Tl(ds$0SxF{vZVEiNe
z7L6|Cq=;zO8F~+}?=;zw;V$0KpCIRI?ecCH500{o8R0=tVq2vw$dT{(zQ?XN+-Fbz
z$orSNv)vv1Q<VN9;q1QKcSrFRgo%!@f{^U+>o*GhIFJCgcvo`@MNPqH<~@6X{MC2#
z*YJC3+Z_JveCt*7XSVN++<x7^A=}2wm<^N)$1JEwBH>SaQGaO6u|+bR0Taq;Q`fCh
z3OjHGvhO#o0rH^{za&IrN;E<JUWsRRAyu;nZx>RWQW)NkM*2j}Nnr(JqTKWoEya?P
zxlRXTe#DJGlBm{ct|{!K+#1bI{#m-TI@y-K6c|r|>NQEG+q)QfE2;R<jTX6g23MZl
z?D;+JFIZ`}Q7>TrJ~tR@;UHv6!Xa!vvLOprA}58G_?CZk%$OD-jz;uo0T7o-$uy#~
z|LBY_&!YWfq~@zPujCR?u?n9qwK!1yv;*6<B=>^V^Pu7_r6uX@xbeaNPu}>MB_gZz
zHEab*I!f;UERD^22|<1CWq*yW?BTg!@K}ll-uBZ$M$L%ffJ~}5O3-V7?#GrIWtveq
zdUKq!s1ElilxNZzzPZk}bcotF35<^P^6@{4byyTU(!_b%rZEqmfFWiw*eZg9(bPO`
z5DWUamy$$DWglh|q`HFO1T@_c&XPK#=mLhlvK(8>vq+klvVg1g;iWlnfXGn=)Vwg!
zs3{a2#etM9w+lU}1t(l5O_FX`&0D(@*9bntH%Zc7_CTAIt$^-RZ>^G<qimDaBr`XT
zKx+*Bs05GsBImCRTM!g%aHE(ZqxTShfjRSeF`fDDO@<uz1dVB7Ziw$X2)<rL1%jAM
z;Uz6UI0S6_w!Q-TTX$WxiMD0_Qq~V`104MXI3m{n^>r}FX98=|Dbj#B06qZX8_C`m
zAo!QeH3)8Ekd$hTZj!Q1Mmu2^9H>WGPH&d%>gF}cCYO6ZqB>vkwm4MR6<PUMG^W3o
z`|O8~*QpDCpQrgLl=S4oL_i63X4dDP+FJYCs6X^#v|sFmt~6M<;@jS=pFL?2OS5r?
z9<KZL{}B0k&CMN0T^>aJ`1tNzo{YvEkzhgjV2Y|0-GzME5A7*SHrc=tRRVo2T<WH;
z5G5CBQl)LWuzsGBgc0&t)X+X(QQ19B&VA}dN6Pu`$#Mq+zD-+w?X%}MPyD9)?qAJt
z+$33R__c;jIs-Y9Rlx#@`7Sy8B|lkW#N0?y;2ttIB!EQ@V{0M$-p%P{AReS`UNoDU
z1CgJ8-|pznjzIEKwB`iAn;Ss*wyM`5DxBDLl>efl)BZ)wPTZ)A>Mq<w22;pc$`2-I
z<SkR$Ox#hE46To$!Sb2x09~1H0>iq@@8oE<LvLwes5vRM&L)3EYu!HW=5q8&B_GU&
zVvoF1iQbEMSpRzJ#!C{1jXJo%-e?wYtyVxWCVqqMLk*A`IjOOHDYHYn1#!Fw;+{;y
z4%dhXe3Gk$v^*udC}k@4o319G+OpjH0%|e6hEn_N*8ZxBXWc*4krkWH_rCevKaTka
zOF$-lFX`u>gpW+uilUcmTUlR3g3lbj(xzE*mA9f7+k~_<SS?mANg5`kKq=-qOkNn~
zN4x53Qy3z8{kS&xYGi=(M=$zhX4~QT9g&KI;?D<bpL0PI>z9%L$UOX`^BoutvY;8a
z@M8%GfXRZaE%Q&-{5lUgE0yzQ6)82(S?QF)T!m6v0@o_>8Lqxxv_2l|tNm~-QW17^
z|6l%L{$W6c8nd)HP*Gh|(Y5)U;{N_(-S-r92SK%3bHg6!pOj|yHKwU1m$(eIkkbU^
z%dxe+L@OAnPsT@*Qf8}fM1cJYe~H$Lo-J097l=ll(o+uffQN9vkxp-X<KfWSlTQ3o
zz2WC%AR6kdZP)z>61OC9s4#;OtGA>-;RtykT6&iIn66g&qbACu&5$3`wdVAr&Dym}
z+;y!DMnK9lFlt#SaW!1q(y-;Z<VL?C&1-I4eZV%4%9vQ2eU)8PFI>Df>X0@;IvM4|
zl8PTp>Wo?-@2+6XL-c{o-<C==L_bS8h9iNS&`Z*K+{>(|BSgn8*WIpO1)*P~2fIAM
zKZh{5vvd7*w@@*F97Y3=XD@Lx{gdIDBma(e0TD<tx4I)|rBMtS4yFD%^%jjp5^^!6
zM6{@=+R5*1soc)FLHqWk-yep5E(r5ay>H~-YOFjjS)97Iq+MTaMW?71YOdB<%F1!5
z$4<=+{#kXbLBs5pESbXGfS-WJIfOlntT%sUNNlhz_4REhI0PJ!yZF;HV>Aaoebj#1
z*=H8L?d|?gAo>L{Mqf|cz^d2>wZ7gWIA>pjp%(Z{vUNxJ++YRHNx)|Nc?erq^6*rq
zE6U1e1ZaL`kWLl0716&L-doubwZDpz#&hbDG-@r=J(c#V+1q!Y_52lX<{l3FNv)l%
zQ|$hdJ)Kpr&AjG5X?plJkFJTSdgr&8AsYN+_(Y^SL}9mP+YtSH*qv)WNXyD>`HA3L
z=l{;XWZ<U5T1Y`IMnfB{F9jPC^*3mVw5WllhkeyU+zg`M87++qUG*OL(}Q+{;AVW(
zYh8B)Hf53{lemcDdI7b7;&mzl%+W7KU;b^GpW%_P=87shSjisH(RjgE-3YpczG@Ga
z0HD4fNC_Ns3||CO8(CIbUAR1_Z8_@VlljTbCXl!kJu}R<2&ukYb<xS^ri2>QNL<w!
z+#Px6J@5-Fl4EUrtLr+;Y3Dvb4F67oo^I>^pv~B(f=ndDA(j8=+_|iy-OY4j3Ro3-
zHJIfbwPAS`Y9RF@B=DCrmxPk6>VlE#=H?iJP8i<Uo|M9|#Jqyb@QXxmh4)WTKaGRu
z6~ne<EYP%TLQ!X15;!3Cd>GP488ojI$FTw>|9b}fo{#)U65x_Za~Uv3^((NpDFSmR
zA%EU|>}zFsO(N#Ds#;{lDMe@If?lxvPGpIG=6?GUw>^!Q#YM&L1=Mj6h->&uM6JGf
z@xq?-arkTY|88#rz=)ZLsqGo_(ZAJ4A;>}Ri4+MqCJwkH{KC2&EU5*}Dntb;qg9rB
znu)8ss|;C(DT~KiqhyLbhn{!H)q33b4+{fNQlEN9Mh={NSDX7zNBe1-+#jsk+*|e9
z!=s!318v~`@WGzPfWz#53mOh*=H<Pb6?^#??^TH{(&R>)m;WB`e<>*2ZBTy0@)&Fe
zK!!ZumdrFj?bI~p0A8PHF-o}0a6!G*$C&Ms#hBhb;)92wllQ>{g<}S0#vqABC;=*L
z^3#XBoO`1_j^V{)eKWPUM-$&l0^SaJZGJQFQ|W(JZRfz6jybSKT?NO60jao$QepFw
z(BG$`166wuLr?Qy7)=FFXWuJK0~QrlW0)%eerB$R=nPoR2-J7wsl2{nRyu3R^lJj>
zEd*GJVC#<GKT{i9SX|jwIQCf-us%0VzXfEk+R*I@syXC8jrn^ur$RCzL&AocSD;X}
zVKdz15=**p_<W9(1OV;ne)@)wmgL=C*!q0BksQ~^QH<9|9LkhAgw>x`3)@FBFD@<3
zt$yxUx(<{+KCSt8$Z{_~6qi3%d$wd%n0@xyduNK*9Xya<ekQ`?RrAF2@5?&$PA}NG
zV`Y;L>pltOB@j-(`G*Fpl^nU#gj!7*5fiiac2Sz0ed8Hxkf28K(kDu5zb4Joa9J)Z
z0G*V%1^afat^b_m&FgV>xKC*dd*{%bOWPWG2q&PRn^~Ayj4WEA02VQHOUqfotOPL;
zz~BUa5YDnqdA1P?v9fAscn!17L#=GlXt_n{7nAM?DUETVV3fF`GC_7dgGPI_NA6YX
zqY4N*O10OxZ7%ih*Pj&6#j-?}z~!U8oB1#hs48a^_a2~`v9<?u8l4X&NGGpA7N4sB
z$$vY=2b`Rjj^VB9>{#VgA790V@S-p$@e1VK`-j2CPJPZx*!Gh}U=aJY1PSDzwrxTd
z`qfMmCq7!TfVYA!k<B!;#c9oy7w_B)r5NSxs!~F-iQ-?qg&t8i)|l6%)Y+DyC7|`w
zIYnjI6phZVGG%V+J3qZb{P`F^Pf)(PqpBSz_;PNTfde0)JN#;QASZ!n{W~~KF!*p}
z;YUe}xP0S`m<FG$j#1I|hcdnuMg$2){Bq)rXs6k4!Y-dp820w?X_wc9Ol;xCSlIgi
zeXlb6($Bi;8-NPF1O;Tu)Lzng8s^A>s5HA_qb~XojuclrRBMJAN2rF;A~m=f3!H1>
zTvy5s$cFImmvL9i&V6(x+a$Rz%Wt|nlHHQFw(C5ts?@2`d8nXv%&#mXf9!H|&V!RD
zEgif3drwzuyI$yEeg950G!^jUf$4XI34<`(IipKZU9LeUn*&L(gy|)_{Xxh#=A=;i
zvjSa^VbPe1xUs{5h8xLS--~UPX)c|2$k@<#0MrKYMj`tKy?M`i!nb@Zt3s!8ck0dx
z_;5r7Ea`7s`^A40VEUTsNr&x<EtG>*d<6G0*Rgr*?^746s_VPMVd9$WBX8)8xw6XF
z=?V4nFTGDH+bolY?+?D3r)5g2IL-cTqHU@)h+Mlvo!8eSb8&zQnDaJaXL!iF+ub$2
zm-Rlt=~*?-bFA&KBLrXHG-+4$aJuD5{8-3?O!>y;C#*ewdNfa7HBSRAtKbVzF5>IM
zmTN6rVJK^3lMJ-$fr9yuPRl}u;p4$D&O!x7cua5ErSt&d!nGAox;`M2*Xn$w;ijK=
z_S%EbbVOk2VKm#$<6wQ)xznH}x0?4X^LO3ZbxH|lWu(>{q;G37!!PCs^F@>XXp(7a
zF+YB)+!FPYN|LaZvGQFo1s-tJZd5L~qU>v$72mq=Ao(TAqTW{M+%xO1Z`%9Kf#1K=
z1*w3APLSe<P#Zvj`Dm0<C~Z*~A}MlCI%cA@mM;Sj_Ht8fMM8t$Oqx9mTLVG@Es?S!
zS#E^T3K$o0RYeFU^0^ZBuzy@-wIOz2>!Gw^^0W4G1$X1L;c8tKXPARoD%4BIDEeCK
zQHma5P8?CmNwlB@T=_aMlOo0;<U<2_0ev1f!*8hSuUaMfYMrf;(;{A5)n(tmCAd3p
z&=V=U7xm~h)%52rk&*mZ8X1nR+vWcZ{YVv)sC6{9>Xv$oR=|JKBIFO?Rq3dm^0RL*
zacLNnL|KSdN(<S@=cdcSsSKxKxCVi?Xs#>InhVYsk`yyPtD5|A-Zwq=SHJHv@_WLE
zc5;hY{t9`!YomS;Je$*S#<EF2Ob%{SfgBJBD!1Y1^Fz`JW>`r2E~K|oj=MIC7t$7j
zWOJa&lfHAVUd5rJAejFZHO3zGQ|gLG{LbGwlOI48?aNUG>{cJ)95<q>X3yW9haH0X
zHh!oDGnxS+o`$W}(Khodi(V2$x>AzD2H!}IgXqrCM*;&pq#v&!!X~YO5}(2|qx*Uw
zzR9j$mNOa5EtqScy(aiXM`V~+Y0N&b#At5$&dIQ7tj6b7lVLF^av&$k=yqS#k8lyM
zYyS}0ObEeZ+6o<#{nf*>4$0fD>`Ui4j^@orDyfdV#lBg>Sz2OM`4@~m=+6$V8RtJA
z;XA(;KLus2DgSWCj?LlR=TX$ZI(Cw7h~{2_A>T0UCvY&jtbbJ+@A9z9kanO~R(<=<
z+Gkk@`0=yb*G0DG|5X1hV_@GqpY=bvL;9F&VWkMW|BK;<JPS_Czacs00V)s2dEIK7
z^-aJm5&y<K<F2~>svmPh+k}_3T;+#`T3+S7!LbGOsd}%YNN*DB(%C1kqYI9|nS=ra
zc$dfLw5o*U!4lPdO#<&5cuD$<h`XqZ%0fBR(v)G2zxH8gdz}}&{*_~S4(KuYxCVE$
z1H;L|-s!SU^5#C-lBA&EVn6ie%&~gsH>Iw<KD&G0IO%BPrpTzPwRX_}F(aQWC&l5b
z^KQ#mR<$mQQV{kcl$Vp>W^%rA{bTZ@<5ctMnHGs5CG7H<+;KAPREd}#A)N8M{rE!Q
z$&l>ty4*5AF9kk<o-4cxCEY;9*FXR}jTdpG&|{g6;+Fue%M6Wf2{h{@+J>4trVg`G
zYr6xtA++mtdxFcUyk$MEr|!|6ysnQonAR>x*Kp({<AAq=IT_4Ze^0_`L<`=#hW;#p
zl!JIzSJ#BKU7=KCX5sU_qx5QoZE-Uf+u#1$-DXnX&9936t>$ZwO+Tc`y<9x99Zpz@
z76dKVVL=yCO~TA>2`J`#X*s_Vj~V;QC@&?(0K8OcG8wQ?V<8mJN3T4l5-pT{Y|QyH
zT|3$2oXoXJIgbTHfLl23ZPWPrV%N_2mLtkz*F5t_okZ7e<-B-Je5*SPQRcsr&>pDE
z{#zFMy9a#@59TkBqr;(gZ6Id3X(mOx0L>hP<sOQGH<Gd&jeR^edlJ8_j*PS&gXNj>
zh2u=y9&OVlmMqu0#XC&NZglRwEz5DE9d5TfZ=Ye|{zB<6MT;$cHBV#0YW$vpcoSyV
z;%l6=7UVdV#>jXc=FJlLvd+6%XusT~{t2Ui3GX&(Dfy+9kun9yNq8hBC2Fw5zkC@X
zsm@R~<kFCBS|s0f%1xXTEH^wW^h!C}Q&s=XKRQRcs!CcPMvlAr9!nl@u(*qR6RM+`
z8;7iiOmKh!zs~1sD$0pOY&Xi16RvWWVBrY6iKK@`LAw-SPw(2>&hU_ze?jjhEvFw8
z`gd0a;QV?f8~_t=hduu0n)?G{>gD8o-|s44q=^pbXkWHrRuD?(cL`cvf`-Jec`q>s
zbiq7gBJ>tszs3G|VdOG!SL@-wnE9`xMup$=nEm)_Ni!=xknkK0RtI^?cer}W*vaPC
zGvp*o#txdI9Q9;;W$#5Z8DlPLcMV)uS6SInw@amnZg_7H)>;~IP`$T$S%~w``cs=8
z!YPv=2lrPgb_d|41VtsQq~%N$j5{9Ejif%eiULD7&Cdv;7Kc{zs~ouzg(ps)yn3&;
z+ioh>FJ`-y*RPSSqig+7>?F1IseVRVS?Ybv_J4G&_#tk-?v;r6p>lAT)P%oQo0Sr&
zzEghA9&of&?e;#`@Jsjm#V7Nl%`RR(*8F^Z2KUdATja%yHW!yoRLvXycle0!CSgmD
zY7GR4hjvi}k}_=ek}R^2f$H4~x@`-7`FgZoMp?mFQH^BQ%hSomp#ZkB6C7BEFboNF
zQf9?P-n(0UTdHySt}E)bOXHC-Q&B=-|H+Y>%)TcS>Ro&VrwRtsed=Xsij>tvTEZ~Z
z<bkeFZm^u4>S|I(kAQV7W7i$XEkWKq^E`gYtc!%6(?~Q%U&GyB=GRa4iLUW`B%%hI
z@SpW=Id`|iTbycoZ^Mg%I3^hm%p#VQ&#G(#dp}hefc{R}4%R~0pnKrm&9fcjm_S)3
ziLa%_yL!c5h>&w|XvEIGDU#8Mcn6f5!eaY=`yM3ucJzZWXP<(SKbWG-d$gFK?>Cp0
z5q6UH^3QWn=T_BLbXdKb*+J3O>Os*|Q~-mKavAK$FCC3$nKE`DB@Ka#IwIkTGtIlP
zmE~bGvqg!-t@M9%0<u5vh2f#XV}GXtb8R2HoNroPlby^7`FwJtK62(iyO#PhhH&s8
zt|#1s4jM)cs`aP^C~&q*zTk(nC?#-W4F(y`6}`O0A$&t%?h}mBqkFEexr-)`(N-~z
zqT!E2m}{PUe%w4AyTESSiLTQzE23QNn1>(nZrqQf7h$Fm+9iAE=&3YzKc@+dRLB#9
z$kE~J>?oywqt%zslpn4!okl^2sDPhbN0Q<!&>*?h9eiSB+dM$w*c<qd!!FMxZ;n)t
zI;2k7+F9>cf0wBo>&tplojGsXYyvKp{xN0?Nrx3g84ya%TKHG+RSk^2=rSbbC0_3%
z7ncYimA`ya4^7yM2FL=e1rQ6@^X?6k(xD~iw%Ymnbwql(3`Oj}wL7zm+_SFM%kbc*
z4*4=2h8+Ys2y_YYPzMpvO@xW3GB9QUb|pz!Da`zgd3R{n(1)A&7WQplpr^xkxULCe
z(PSE%hHUZ`=4#Bt`^<Fe^w5ETvw*+1XL+W3KTT`y^Nl?s57?;tx9z_b_b9_mega!L
zj9-K{h(xx7oJDBXZlzuQZy%L{XkyYMzp)$s-s>*i++K9E=k$$s+IK&-W_}SzY9DXl
zBXn3G92*u|S#p{oEyKDLJD>h09CskAsn$1%VSyZN3|!I0@LYe*u<SS*P3h6Pp_F62
zQ!d{7-wFysYqOH43^co&R@c7hsA^3O1e(FiHq@4lnLPjp_!nw_=F2%-UrqvX8*JEt
zZmv7!nw2FNeKTv7B4=OaIn*or8Yt#tepcLkaPi5r@2tWZh-w5w`rc3LpDMQ$lmuo3
z`PMzFdHVH$U$Op_?gO|kQkX^`yfc-%C7dNSQ<M~jRZ@G8jQgEuOW9Yl-`^@4>-66%
z%E-(r4P>?xt?Gc?<u9~1^(zoxx%XBw=wb49mYB1-?Tn88Cm0my!B2~?z+lcD|CkXC
zRYG|JoX{}nL}k$emTqXC8KU^mSlwRAh?UoadSmTbuH04=Ce)hsVuxjuO9rS}y~{@Z
z><ZXvb$f{SsJi1$eSQp4{9HJe9n*=;g^Te?Q?^c%$Uiq3$Kj@-4$Rd8B&Nyl`oo8G
z`>~?ESpglc?y_)};PN#0da264`$^B*4u&TyI{zd&I4Y#Jp#E-MO?F2S$j?rY<X;o!
zw$YZ($q2#DZ4roaq^9X;qqG}Xf=jMu;O%Dz;t%L16&rDCGL<X@ob@av(VQ&QcpdM|
zk{_%`0EZBgmbu~|(fNn{{hwoipR2qGseW(jPsv=uFRF#TSw7~$DIXdBv5TH7jivYw
z4{YCD=IQ)L=l&W{agtS``v2&3Y~6`(q+li_RevWRG%{*P&7iX<)GqFJ)s=Csnla5f
zF*{l5*^i>n0X0a=71uTQ=oUM9O5GD)7m5bQMZ7GTI^6eo*VOn64au8dm)FpGxZ6(g
zp#GT-HvOMI5^hcWGRW6FOP1g(P$Nhce}f8<!Djwaq8WA?G2|q=dPX4KBfd;GggcW$
zm~@!Lg_>`;BF~6u5L+n?3m+7}*4%z9qM$`Pvm0K0P@iocn~il*<BsWQi=$|$D=fCR
zEy;T5eGg>$xm?Thwg!LL$C7*y(n|m-c|FU;`?@Bk?M`>8;`_>`atv~wE`|wzS<2(L
z#|P`O4vjird%FI&yZ8?Z^*+WA-TV+fm|gJ|`j1Ddi59&?7seU%p7Pc)<l~(SP(R!q
zqZnbdGP+3Z-u3b0?ek@iBVUyM<Zt1Xe*47x_=SJn*?Uc}(=~LC3NeSrlm6)hoaw&=
zm~}PfOdZA&7_R_hS%`y_zlgbt?)8$j1j9*(%sh~mq$<m`A_GI`u8D`y5w?G9hE~$K
z@L};uap>&F=Z{W`#{*aQ5vDC8PV&JJYqv@T64wVICOy|K!q#WW2oq<NU@C@i`Ar7p
z>~?GoPdRiwYeB9&+)I}EKvupS%_Gkr6BWb{o(vTkW?c>ctJmJk&Aluog*HuIdNRbY
zke|xf9km)ap8k@wh_@2kjCdq!Eif0vCJ9?3C4Ygk4j|=;48r{ol~1-$f=sjgjjiFf
zZ=c5PZaT%~CT|zIc-lW++||1I&8M&RKP`i3>@Y_@n2&j=e_#pl(*eFRehU6O^qq1H
z8i@~0r3YS#!)*>JB|@;Ybb4tUzO6x|_;|x1<Ii4E6u%L-0{pBO|2&p?XuRg|AZ2gr
zxhFcTQ%nm)KMu4hhx8k)mLlXthOLbB<%o!q;<{A^ORlti?U;+K4F@X?)a)$@0D7Fs
zsLpvX0zF)KIH(*2a>8jrMg4;UDs{dO(wsIAgU>0D<Mo-QC}FsKB1Y-kK%9?AlEFs8
z4=x{2aDvk!-JI>V9a6sL3&SKyDx&@~<yWFhj@gAJGR3yW?7R$W*~vji?v}*teM!;9
zCr3bHM3ec;JnUS%{wN1qRw<(h%QINW(aHWc8M~=`!3b$7&x+2GciYa%KNL1OkPXqa
z!Trd``tlQ_v#MLfaEFXF({5W{dGFcR9rV1D8*?1YTEbk09LL7qfX(2jR@lKB!4<$m
z)GLBv#$DX7ld5KJm-K9o1a+3EERgUv0bBPE2#VK0Eoz!2!pS*_{0bEs1nFU=tF;U#
z`rzAvMVF$n>jE}}drz|y@wlkm^S!p)tICbToGqJ6<za@D!+mug5s%_nXDR*J1kJoD
zKBfbR=`gUxPOy-lI1qzU_+Rp+r7X)Teu~x74p*~6dWn!_s9lRD97HtPqbl>P>#i4M
zVF3}%#0@v!SgS&~<mKZLZ^xaxdpma4%+?QmEc%fh6BBh|yS}vk|Dm(N6eQR~P@a^x
z4XsyGv6D*L6;~HI`RZI#ZHu_<hS^?eXj7C0oUP*wGG}-*(T%pGCGt!~7niVXfbO!p
z^W*fh@O|7R=~hMePlTG*dR%qgbq2l&T?|XFQi3^3Ya|*f+3}3^^74gf&7PjRZE}tQ
znl7x}$AwmCIcVrUdDb~yuOHAcZDE^1^68k)_-1UJ+&wioeraOzahVPGdGhfyk>BH#
zKWTtR5C6|RZKtG)bOl>q*z$nxE8wis+R={+o%bF+`PRLF&Jyy7$^|zbP@ldHY>T)A
zieXW?+(+Kg5f>u9YP7oa?lw>ig#QT{9WGkKg{U{uOX?>LbDCsQ&XPZrPK^>SK8=YV
z&vWD)O#VROfwClVC1ZUbINII1^kc=Z_89~}WqIoKc7@&EO>XZ?H}^4Pgw(%um`a#B
z5^;<zDAaWGKWi#6C#CMoz!l1a=|O4-><48=#`T8<{`;$~zC!SEQIjiBmqycX8h?I!
zVobbBNlYym_dBDg>hRWk_nU{Eh3olwe*^5app;>O`pP8e`ra!_mwkwS(qrvfh96p>
z+@xJc@28qp(sP=WpnF%_mW-_|8k=qUGeX?@0QL2Zc~)h(e8=fd`;t;hqj_%bHNT>(
z)2%~0b*Fr_1`fy`8PJK)^)rg+VM?4#l2msj?+eXu+AWwL@~tR2OQ#;;G;)&pIM|V=
z>Csz-qKrp_q2~K)?vG_&VRi&X>2yb?*ZT`=t1hRcaO;B)@OA#tS@Yjn=2<K$hp*2w
z1uyceq%-*Wm@{IQgjvh{32~goT)KU@^?~ZNK{cf*&!mgtFVFD1cymYaiyl{Zc?Rvc
zasjt^$jjk<(c{o)QPN+XZ{N0B$FW@S2pungA>c6ZH}Z&%9#YzpLCm+EAIdgl*mb!^
zhn=!4<eLfG%z)E3ARl5i93Aqz>ZA5}p|rVDx9zdNfSKj-ZT-{dw+_UtDG9S>&eLA{
z&s@ff*(BCS${QyKjZ_Cgm#%az0gP_sW(qsR=B4(V_TXoARVn^Rc{*_;>c305<OU$~
z7pTSl?hmQvN$-BiGIhFG^K*W)m;cq^?|>6Fz!z%gBc#MBOQQy{2@;&->HrawYEDbR
zc0j~LWA=Ac;c+9*4!=2HWZw_TCguh~#Pr*DyJ*nApIRH9QD=J5@y9)3VT%v#y?Ph_
zk^*=pk|1Nn^F!unJ3xcR^ylmqXXIcDbG27u#PGg5dJ)J7!_8>SBf8ms<jhPOv+;@l
zxcQqa_d{pQ^$K5HnqS+6UIu>amZ(Kjv?ZYT;H9H=DgHNi{=k<?ILUY%?`xKT!VjY8
z0^*pNKFra7U5@!E-CL6D_Jq{TI*4B&pQScU6qw1^*FXJfbv-~vnBCp5C!&DOy}nM)
z=f0Ns2b`!<eTri}_El|wN`Gf8%*A!=NGQxiR^;hxGFic=AX%Md>__^rO_DEaz|#`B
zE>T_UU^s0^pU<=EVr~~>B*Z4I0KF4_?+^X~vayGJDEg=}Hdj{lLl;JI4cycv=k`rZ
za4mks!HSEK`#(B&iCN&~W6Hr!$B{Dd{Y5HwO|~nrnf1TZimmk8wXkV$5Fvw|$op2<
z0%k4TQ)r5`2x0O7bjz8EgyL~60clR!Trqk%yk(HL74vxBKGk2!dg^LJxOxaZ`fbO)
zRN1@Em!yiWdn1WUBf~ewf4!?qv2gYD{7b9iVLb3V)LjnRKS3b_Dh(+Qs_kQz+l2gu
zbw&kLR%N4h6I*&di<ZAPvMtG0E?FUzDHwD-`Ipw<yB2Lr#<Gi&Wnmkw!<~fLc?EZ=
z$*uc=bn%<6dSed^stscffQMLg1J9zj$~%l)*BO<8_kmfA$AO-z(tRQ?w>{r>PpMly
zO9@lzanC|-U1e>We^?3ihj<9Uk&v$1w1z`-kG&1FlDzrS>X~d(1IM5#3P9S<KGp($
z@WAA$+Md5)yBlQ1R<c6bxG+Ecr0eBTEY+oQcoVIH%ZqELf3H=VkJO%df7`U&GMO*8
zi2Y7?Rtt`h<vOr_pk0TMuVF?qiZM!RHeUj}l_qEqrQN>XcefIsjO{9VJL>#Cp_Ce(
zdF#ZO-@)?2fFbH^M$+3OgMlYto7$CTTm~sT4vGWdF3n>u3E`}O$5<@h+y$(L3k)(c
zINVet;LjVMxmf;iOl*n<Ii(WU1P0Ja`+41e)jg~3B7Cf~kv*K=Anwclt=2SCl+^P_
zWy1IR(|;%lQV@E$#=>EzKuntj@7w_Ph9}uoh8_*@(yMFo2g!xwepV&tduK9lC0<`C
zi@m;{TVI(c`bUTS;<|x?IM%BYiRG(tN{fGM?0*vnl$^SnP?j`NvVdvK*bZ<1sJ7(@
zY9X71i+(|ABnwPcdbHHkUSx;Vrd;E#L2E@Dl={~I^=>t;0rU7+z3VxJ>)&Y_Cr{m@
zn%ksQO;&{XZMac%LWcnjr9KfeLcQeRBF=ASr83umOLne@Twg#o#_)YS6SS#nq_l32
zv~*81$DC<_k(42wQ7)uPpt_tzZ#DR7?-hpmtsfi;slE0Tc=K;K8=lIBbPvJtZT$qr
zGBnksewtL$P@c$o+Bfl9ik}Pewo-}y2=sPLeBkjA=PftF^nQ!hS|bW}YMuMTKLa<}
zfU46jxp%Oya><KFV($yZVdn227Khe?<%mYnB#dJ@L1T;;u#@(vY#}l`dq_!31{r|>
zSA~)mV;j2aVuMdt2d<_hYqy|eWlgjBWWvXf;ft4zU3L}QARZ|WB`X}Z)9~)~HQnnv
z)_3)R*;D9F@Ca)tzXEV6sM~Kxf*S~lk|pp-X(@PIqyc_0N@@V=@cfJBM0Qb2#fro%
zgA12pFI`xZ`T1y1lx@jt{}bIG2@c_bv+ASuwJ*TZ6TV<VGtr1){{*F}EwP{{@E4yW
zZVaSLnk9xHxe!zY0P+~|izn?Y*~Tu$riX$4n@J*P;w`!5p6`05V#0c!X@9Tpb$D*y
z%+-o|lKS<LsDH=8Gi1!jOx71q+`<y<C7tFcla|*x6w+H?f>KujaXCG#*~+N*epm*+
z5p26){dLzvcrg_fu|)^@HNiD?+>4*e!o~YH7#d%P-OZ+UdbF_j$)51=yCc0SmC{46
zzRvv2wXb*0-)Nn-;`H@_ptOw-j_n_I|8DQ0M_<H2_<>U$pQwFBsbr_|r6cA2x-X$B
zbdY)n30M}|g`*TxCIP6@?#blEjQ!vQvR+fv%$DO;gzPZ)dG;FLP_82=rPfs64AI(f
z+fBO~YcH0=KwlZEgBRgcR{t}I<L9==$OBDqLnl}RoCXR~$k4+lLQ#T;j*e!5`WP+|
zON7MrXwQA%5UAxbq^lxMiu6-eD#IOy(RvUa!i-99?vmq7j-Nzx0;{{HhbVsC4m!9A
z*cAMq;rta%y9BoD5Vgz(GZ|DBAbcTd;Yi*><ei#9P?q+l$j05DbPhII5mB;~zmnc^
zJnfaM|KLe_LX&xKNvWje+|Pqtjpom%Lj12jainFi?j8Zhz?*5xa7H0(=s7Es9}L5#
z3kf8=08Yy$K)>!F)6?VY_~{K|Vhvh=cnBQxY`aPehr%^a&&W8d=tT#gJb#wVdQx4w
zUXv{>9y}4~AIB=N=i%FfukSzGK9zdvj@72qS>6>lcLd!yQ1{cm-gg0(p1%9^PI%5=
zy8kXt`4(PS0kGu>4LEdTi=qf=m1QMOmFqD`2w7pGB<w=iiB%g7%hF{-%exw#cDL>C
z3^#BFhxz?t@7uq*hfgSaUBW`-HEA1v)|F=KXuC;LX#ErMi-9m`rW!%Ha`t>Ws}aA9
zXBL95Y)K|s(aU`+{55+7BB#c`nJ%8g{r2mhedBlhEqa@wFAMWm9CV>6_I5qqV&CdN
z80+HGYZs-1`v_vfhFUy2(~!3TA!IO2WGrL4Q*)kGFT+OOws<^yLvC>hZ!OYxwQ4XI
zAJEQ?F-Z5V;dM^OZuvA$=2zufS>$-7p1N_uGD(NEhJu8$Uh)&2J<>_ie6e!{8Y>eF
z;}<aK>C(O=SMTVvQI=tI;kmg$?iNVV8@-(Tz;39ij2-)k&f3ZEvA*{AY<+Li{nwAk
z^jV+0UMaq}tqC8`TEuj~T$EW2v@|}>)oz%bLRmV8gD<A@8*0V3X<Kq1kBENRXPbV>
z+&F%$^SyP&2Xc3nIz51VpnEm9d+J52+rCcG7=-uL|6&MTb6gdcH&T@5kP~$20ZOCv
zl+MpsRNEC9yKlDt+bdp;!CY=OVXN-FA0*HBY+C)pd7T7UYUAI#gdfbddio%?<h7ch
zD$9u}iY@y6Q{6v0){38ZeYix7B+{~8w0=G<$r#<aVrq`XuFHUrnNY2@Bnc){wqnOM
zsYK!!Y56(KwqTU!*sWc<C8e10O%G#F!5&Rc@tD|vwLCPn{6t9h<KCh}H60GrX|G9~
z!=KrUAyZu)^mf+f&qGV$JOe@(|E`}U@QkFzQNGl!VzvbmAQ<oy^9VU|ZP7zUV4j(h
zpXwSC?tohol70U6gAiYX{L#F{U6BvDp3{cA<?5q743CnrrG6rJSq#nKt+)IoPQ=!Q
z^gK+dOsBgve2|kTvXs^MtE7JC<H~%dexK{2D5*?-A$VzTPQ&Lgk*2UJawVbh6P5bt
zWo@D(&DiNDvOUcuj=6$0=Px0xbCe*52yD{RmPScDMehUXOPBX|HQmCFAW8ftmtUtd
zBAQ?|9y=_hEer5RZ?-k~De4mg7gkY{#b(@^r(F(S0hg8K4x{UPCK79Z^3!4M;z5U+
z@SLazJGkvphGDAZnnwz5j>ZhMuS+o}QUbO|*6-j_vciU!va9doU+rbw*QT~bx9#gs
zf7sJe=HOxyuL`$4cr&^(PWNv%JVJm?1pa2)FFDE_+4{B=rolK%4*(iHB<rd@+hCNr
z<Cz)W$U(!BuM%7KFak=@JeQUK=sbzcFkgW=$X=5gYBzB7-i>*Lm4wZ5t`dA3FFNZd
z#gPm)>W-26AE@s2u}<?vHPT>(x2(;8O5EN<G@y^QG$jaThZOI#PRYGpCi*V>)I6~C
zYqELPF-fcP_Bxc{)$5-5aKVj74w(fY7J4zWa@6cD{w)RDw@nRExuclbDM9Vg01&W;
z88T6_iY2YDoowWzn>hkJ`jvhPZ^5WDErAuxHxweEvG!$D?hz&CU5;6HM^aL?cxBRu
zbk{vW#l+jV#(E!I27W1*Y&bNc+DfN1d@4$?FFkrdd2_^E{8TQ*jo4_dS89O&G15(<
z(lB$z7T9&V59K$=wtPiX3=%No7*#j=Kz+nRO4q^`?uPW8NK1n2S2LhWugY7D1m0ed
zARFWxi62)Cc*|ptyctw`fU@E7sS<;n@`*t+URs;_;FRv?<~e}xi=ku=>rp_{slpQh
zV@_RJOHcIsdq+oaz3!B`%cQ>6(>`f!#=F?7gFzk<Nj~=T+W(LeRyA3)65_EF#)qvv
z*WIK?9N#~jVO;s*#qp%Q?s|8AO*%IJrp|^q5|t!PmLSK&U9^j~D)$U~f5^}p1!Big
zZ{?(rxa_I&9MPCx(?wiMj{x1XGS|aV(%hrM%Fvm1I_*$<*|4%a%^oZmvVSq{`&|Df
zp>)()lZLVmwY&Pv(^!u~BS4>=s9cg%>LsHM7!7Oh$wR7g50IDihk;3Q6x=+~*oi+y
z?s?pjQBmHDVyd6_o4a<hZmzAR(TTdJm6ys&BTIMFZ-OO<G(k>dbJ=N<<;2z4VWmkm
z%vW)##O=ypHn-Ky)S@KTs_(e+dOb^Sd2rCPhF8~3`@ZY@`tIPgW{cOmXUA-hrEVc?
zDfIn6Y`tk%Q&$)F4Mjy|h=PKGkXBSwgs4m{L!u%gBA}umAf!qWLd4Vx5+NiCGK*9x
zaEpb2Od^CZBt#h!Aq=$?nG*;?25yxpaH0@SNl2e<@ArK^J>R_ax{fFN?7i3CYyH>n
zU-0JpShc~yrATaGfix<};=;&6Na}lcLfPm<gnsuoO{a#O>>hjWK3VUv?fR*6_y6m9
zXy<R=Z}{42))G`E@Ss!zMtFX7CY$RlRi(TP2ypp$`mx(bptyC_CjV6LrbmdLFng}u
za1b~SfPC4yuT^{{to60Vh?G#~7iAPtScYmZ(XB(ct%hv{V>&20OiQDojynNh8~d79
z+ys}LlI;ciucPJBsndbTb?`4M$D0NxwZ`LKFTaZ3xcFUR+x$HYXe_<42s@%glrG^I
zcB-$9l8C8a>5Q}hHMJe+okW)SCbe4W#dG@B3HcmH-C`5R*-Xs7+?vwfw9I4PrBo2(
ze1{jJJicFN@MZ4EXoliJo#AE?ayO-I8%89?Xag#FeY9|%Ci9SAg`dho&O&~f%ff9$
z{VvS<@}UKk&_lMo{E<ZqpL7~fy581lttl>_dmDpJq)qcB!pnoUi20sYEzcHcxT!Dg
z4H}F^0$3Vt{bX$bdf%yxhBcr>`7!vdC~KRN2-&qlapz=NU9z$OB8E%Wm8l+6iirFR
zwG61MT=0l4`68~Oo$71%%?_Rs_)@DU#^Eeq)p%|HC#amQuJpoz7FW~PyBfmtH?XQ*
zHBvw2c?{B*H;NzU{nBkA2>h$=HTFLiIoDe5Kf0_gs7M0L?_+rZ{FLa4-2(TMTi-|I
zpDM0s+cTfFyFEK-+{O6Mfljm3k*9y2n%^*Tt!T$Z5U-Ax!`__^y{vH?U>uWpso{$$
ziivBoD~XT%*qtf+Ti)2<`f;DQ)qdg1!~4|#e8a91uTf5X#;|OhLry9Dp2@M&AiEVW
zh4<qRcU5lV-zL8MOqwPMQ89TRK_PGO9;P{K458Ac!2}U%EK3vvP6Fx3x|D9=7Wk8R
zg-h2ZYFy!~ww5PRAO*PSJTQIhWKj{Zx{m$b$Zp=Zs=+}<hH<ZtSF=54EZ{Fe^3(P5
zl1SY4B@r?Q3k3;bt8y^->yN<pV9@UX#;YSxqVp4+_R5Z;GST~ZDl6lQvcd)lO{;y<
z60%RWp=<k3=MByn6z%{(!n=|x&Xy~)-vANA@Ul;lYej+HxchJla6`?1hT1^nUSK9G
zyr7D-Xf2C-0a`tlS{Iv{1((Kl7QaduJYBkZ`j0b?YO{a-e0-bw)0g3^?6jYA^LaUy
zIKvAkSX;*<a_xN$5jPk2;2d0HwjH&x+;gF;{^f6|ZRtDe4<FMOs4Y<wvD-+;|7~Y(
zr)LK1Hw-Kzwv)aE>>5Hk+Nf5h(<+_3A1^_qsLThI{w4l%x%oGNPSrlZ`CUorxJ%{u
zXhc)!JkQ(dPE*ov^La<qC=@mltmjv%b;4<fz4AK6Ce;XUmAUY^d}8)jA{ncR7ib%0
z_Wo`i%zci}^O<HjynAfY^GE*8s#_&9*0Xkao%e#!huOB($B=(%Dh*vg6D?A?-EoTA
zzUIf}Y_R2k!mX}qJ<<9Sv<ObMyMk!^j)FLUS!Y*P4YA5!cGloflWAJ{sVJJECrG<g
zl$S(V-dF_pOk%<(m7WK1N4=~e%OPn@u`WeHei=a~E@t!;+gxAYoxZ*XdydwAo1nY#
zzhUWWpHMdlQR9`>(Z-HdTH|-LoC~BaJk~kugH6@EFQvb9b(&n!blvNJ`KK-68X$q6
z6h9?g)pNpv*~4T0qxOf5`Z86i-yr9VfD=g}wsGZ+Q1F_x75Q)hG%93w+#)8vSuJG+
zc=9U5LL(xo6REAlhv0tJK8j=SVM3gY<*F=%cigT<JF;2hQ0PcCYH7M=NpTM$wf=uc
zMrz+?N?S~{2MV?fe*N|0fmAmeCK*mSu7i)?hLX9yuL;KVb^}PBCMvKvKe(Lb5WjCq
zQhKLJ_pxNt{2m5HJ0h=3(SE0|+$}y*(rcr!3S>2@jhL{k)gxKshTw^l8~;)J(5psq
zz&6Av4O2QPy5N`9Q+IJhWo%1WBeZ6k!=NTDBN7Xbz|NxPR(Itkkoe6tKx!?~HIN%;
zn{s4~5%ivEo^T!8<gH}F<zgLBp=Ma^mA#x+A)&LelPTabUaPrunIe*AjeXKY)^<zN
ze%}@54V|)H1P!8vg$#A&2h|%66zrHamZ;k7t+=FmkJ(P%z?EP$RioaLG$#tUzYDk(
zX{60x@IV8N0G|VMUS{%vokzDU_)t)uCOJ>D`cJe4zPW(n5xFmLM~m|dHS$^n1|kaQ
z^GvCfec6gV<N?3fm;Mvzr}!6eqPV=E;{B}Fy5v7W*T}g>9@FEQ@eeg8&rbvg&NMxg
z_uFK<hTNHMTu_I<0}-hP?8GZr6_>;0OIeCz%5WH1y)JH4O_F~YMq4T`43G``?10v1
zo$_o7sNm>1MHc~GmpZ721ao4_y+!A5%kW(SJ761^zOaZTB9fv5F$Qk??pMtOTdA!{
zWJsmy4+<++u{0LYIsXtM2_!$$%$LCE33LTvQev?wHOdpYK8+c8dPMAXdev;eoy=R6
zTH#C&DaL&SMLU!qm*MFkk9s6Hhv3rT-F-?!bJY$l304{sFY^!~QbEv+kw2H6#2PGz
zqjgX@61o;q)fdQH*xOh?<mB?wJH-CJm6R0n((T!^zinw&@*elhn&s1rHNo#SRy-sW
zrAZIO@q%Nf9EHi8S|DH8j+cFd(47ry%cJN|LCaa(W{e)Qp}RDg_%2@4H!`xt5f>}F
zGJ7ZAM<5iApOo7*B|o$MGr~ZG{M7tEG0TRo9I=!V^aY%Mmz+cV6{s9JeV%r7<-Eea
z;Nx91WmH6c`=zClM7Jh9{ovl<XnGHjb1fzDdJ{L7sk(T9Yt^5%d*4-*Mi>|@I+i~A
zwVHpYwrjB7)vWsJO1+zz+6lXUZ6lC!Q=9<b4o_(tq-^B;)Hm8A;>`ESdgNiid<DCm
zv;~6U_~*dK;uK4q1-pUXZkkCVG34Ti&7$FK<5&IGf23AO4?fM(%GPt=>XfJV7Tk)%
zPqAZASAzN!7P<_&uI$B&%5C~`2btmgW5`+_E2G|<N1MZW?S>qEQiv?%;(*n{61ZK$
zTAdEaEYN-XCO<53IV1H{a}{vGY(mP*SrV;`OpF&a@rVXuIT>`d$hH@9#D@_dw7j6a
zbY{lYxKd(Rhf&!x$1bZSsqqDN<59Pc$7#~Y(9|Y9jTiAf?>DQ_Uc!{%{+9bS;rZ-`
zH(LN!_21y>mi^)H$^Qk<meCd=>Q3KLXLu6G8K=m9QlaQ>F6Ao^cD>SA<|em<*J_9>
zZCJz-VjY}y1wPfJTLLWxyoRD*K)sE1;>s46%H!4JZ9tKECyy@(k~PQcUwXwJm>RK7
zy|H_Qa165-Y#z-VC@2U}5<;LXu_oa3ev#jmvD!e=*G=MtH6nReE3YWNm+=5yK%a{S
zku!<WryUR;n>gKQs?Qi8-If4Dwkr`^XY<P&sy#sD#H7${Ox#Hq)D`Yfwo3OSe5;aV
z4LN`6B#dUr@3Y|?REo_9Sua>{r=u)5$+21K-#$2A9f8&)Y@M^D3*eY@E$M;1jvhQK
zrnAeb<Xfdz=3?g?y{iGz4FTjF91%m{t=#@ipU91i`9`TBt7ywoSDH8RmC^ArvI`zp
zrvP1>)o}}b--KOI5x#PCnup#BuJ)K-!v>GI$~mK6X@{0+7QT3qe-HEfzv^kk-L*Wl
z^BlFlPig`{rCAU!rHuG27&z&;v~l#KIJ$FBCfZ8zdBIzF^UFztgoQ(U9(@)}u0`gL
z)kKb!HXhy7;dA5j6%9pQiVCrF?N{yd;F|c8P;lmlzrwGdj?PNf>v)o5dd<}Weq{K>
zmh|9paazH#>uH-ti;#VEsVCUg|2u*{0#1&>m@sg)IzZtr-p@4(OU7K!(gulPP6ALm
zcL%)kjO#)owkb~%j4<iZYX*`<uK}m9YI<kit~PO|w|m2gjkmTjWphwOlVJv@ff?rv
z47EXYNbRD8a8_**f<RDdq-t^g1}OYb0Jf(z%sVdwBC<F!OS#?nEWACm0!E6_kEokl
zY@z4>s9h=i)EP@}o1<&P{5FBAss>J;47UNczY)Hm!PHM;vfC2fOG1g~sIXg$Ez#+`
zZdN6+q~lv;KjHs<S>1_*E>Oo^E`SC8kUY-WL5aBBvYEXxLvpi9+=^@`Z>lex@*SQB
z+Eak;Vy}Zp4rT2vJrqfS$EkjXf_7VB_x-$aK-23)50*g&;g!Y|1@@bC25ccSkf?+`
z0lq%*7_uA#o#Ma;&H}$0#Q26O`F%cm*L#vD1kmLM#41r=2TB*0msUZ1$>*BxmT4v`
zLk#Lfif28~;`fq{R}f3Ypi7z;7#SHlw8+@G-0Mu{zL>ZiAs}il=b0-_trf@zw+-hD
z6z+`sJG$y4KrU-wCv?Z63C=xr((>M4FFu?)eab9Sjk1}_BuLlSkVk}!if*L9yQ67C
zwm9haR7^*o0m*HcWLw;KH@bBCDE#aa^_=IvKNr>}KYw=I82V_8Zobv_{o}X4Skf+B
zYP_fMX;p1a3PudX(6->K;17PJGw@uPgpg499XtR{$rGW)``xM4B(-U(9tk5MB<aIl
z1kG6^y$Hj{;eL}Q%?)spq{n+Zj>VJB>ihu7E6ec)w{S+e*>nJ7okV>-C9<_H6TLeP
zCk@t;F%cNpy;|u=n}B0fdNQ%6MLT7@aW(QUftzx#QF%c;<pqvyqU!gc03n;P@pzB3
zz0}@-muG$I*H@Y%H{cGZ(&83V+U%V?73V9us0sP34vMB~5N*YRt1SE4=f<6_I{*SX
zW4-FRRn#BzB>!q1tGTv-<UD$W-ZAM5AcvkYTn+mDs5@<ZwxO>?jXb721KzQVte&Mt
zd_yt?zQQP0r#+-9L*6r%_|}O!p!J;eG8S<uu5SlW*0`Cc(w#6NcizTT;_?sWIy|Z(
zXw2ja8Z-9_W_kCJZ(IRK@1NnXDZsT9jOg*CI^@RfgZH84^~+)XcCsmyl#)vMi840T
zEm*EdiF#(a&jjD4Lc?w%(DecHJM&-qyKLmh5a}fMm$OE^*HuAxSxrf6?;GC#HGirf
z(E}7C-EHKpe2geZAk0|K(w>f`rnewKiYbt2-w`7SDtPx=d|Tofg+qU5q+5B&JFcw!
zb@@yGh=H-*ZLvu$=iH*|Q@<NkSN+5QS2D$Iz!^7BQ0-72fMZ06l;CYZgLhxKRg3{<
zC75JT5ewSa;{yCr$^&uzckKeM=Tx{5!f@X-*gUK|!Tzal&!Azx8^G<H!H8s8>tL{2
zuA|1>B-TXiaWtk8{!$6=Ll{v){Sn*TM2f|fNeli>C2H-}cSafEz}z%C_hnT1EBxN!
zZw+s?XEPpw<ACrO@-(?iwX2^Lq6jAcIk{Eln^gg)w5tvPe;-YdLCN1h$8VSC)Py^H
z>R8mq<#%OOj(O47f239dR)U>hV}n`etw^W3)76ha{)&;CS2mMx`m`dv$*LfvG<?-H
zvplbK#v!PTO$9Xl$fTA#jShDTuHtvuHTv55*11OFaFN@5<vf|2_L0)?v}4FNa29hH
z5jKPicTlcjOlM5D_uKRt!BcPkQ8NZSQeq9)y`I5WUaA0B75E}spCQw&Tz6z*Rz~~<
zvt{m9c>AjVJL-nA==F7{vDfZV4F8o10M_FFMK0b13y;dyh00qMKa=~}pdIUn=d-GB
zA<X>8XoMy{;L$VO-AWi_HvDCaDK?e?E5}+2&8cUa0W7Sib>HWYy^{PX&{W>=xVPnV
z$vw*R&=DGQnc15oWf<nh{OXC1!9{Dw81Q}hTNys%SK1CTeA=A6WS-hD2i_VVb;!A{
zt*)}>K<B+T!vt{VJ_kBG+R!@v42~A;(k5)gNFBx4&BQR5`b5tGV2#2-kZ#D>*~QZV
z=z@sH<Ck%<r}A+4iW#}Dtb0AJtmW{D45NcDG`s)(eaLAK5EAYXjoa$Te|)9dbi4qS
ze)A5Cf7ArFEr^(@tEFQ=UV%xBq9#)iwo=FTzM8uj0cO-7f0Frfb^v!m<WC8o?7h>^
z_+WAj^AZ?=vNa(>2R#8};Iv7m)h^J?Y}qLxfN3>EIxZ$`!}$hGCRUHKGh<L=OdacU
z$&$ejdg0FtQAhWMTU||-=w){rztDtp0Ko=1BLweO16#DMYAW?I+R#=5PDhGn&<A9T
zorH`$w5`mPTIMg9E3}|;**2hjuC6@((q(h-EN3*|Y3oeWh2Y+!IQcUPW9y-z4Qgv3
zASZMX^+ALMe+VW|$boTUMT#;oOx!mHOo$#SF$9Upz8>GKlQMb&dKaA45xhkf{Df5t
zAaxRi&Ri~#r)5?J-1Td;|M}3bXP^H325C%bYcSP@^1v?g2-%>Sx`faP&$r{qH2vUZ
zI{YbMD5}T9*{4%5`4}i610izGOJe%!#wVYATLCy#+^faqSx>&T1_)En%!hlwy}$LC
zGq9}N4pEYv{J<3^Wv$jq=_&3t#5RGyB3VfKHeZ=tjVx2DjAhOh9f-}iT!AXh_OA=>
z<q^;fFp#}!T713#J*}`f4*zk-&Ff!*kme3wYuKq6(Uaf}5aAw0^dC;GT><b>2}kSK
z@;N_Y#>TrHCID@r+4-Ojwky~HcKy1^5qmlvp7?ieVe?x6?bYu*kJ)<R(_bya(OPe7
ztU_ZV)RZM)L#`#6fM!<JCSu{?krw;s5oikt+ntqs3#9$>nj*`(SmGBX&wZ64lKoMh
zUYGN~c%}p~8X8z5#f<#@%#HKX^@Ba~a62{fq^dm_0ae`NT<aV2Xjg55K4yq9y8h%o
z>Lx3x4F-X0%=gM6#8ksbSKe~mi|QNClP9dAJ;Tm(MxuAN?<Ck7k5~1i#HD?R0fJu)
z=*L|Lqdx(n3KebEC(hhVKu!ypD-WFX%ZTqht$JHLD?mPyvjOddXMYQI)-bLqNDc;d
zG@>^*fTqfA&~nUlaT&TfX=Yn}vj{nY;nLNK=3>Hqk~y>}=764X5mp_xKQXj~*h~ba
zY0umwu@Dj7XfU(A@M$T|fppG)EZ|t;hx8r48eV_Aa(dw}btRe7HpSM0($=WpP>4!R
z;W`*9&C_HVou*pYojO*35%W}AcapYO;<LoLya&72mN3%)_+0cnvS9Siac$*%d$xzg
zD@{o281e#{OE!c)J;Fp%Mip)3!vi*;3Eu;peVFF+YoKli-wt4;oCD+;ao-k_Ka`tI
zo6ct@wYRp)pT3;Qi}5v-XP0nq<DF{%tbWvf4>R_Un&(iI)Yz+b&?ZC6(!zbPnieHR
zc??DVSO?4w(Ov5r>uYQ4nU5^+juwvLB`hYBmHxe@D06qRP3EPG8t`YZls=P8zcSn4
zLv-a<yC8zNFM;WgK1{j}3}saZTUU~os*>R>G0kwwuieD@^nlZipBl|O1a}I`=bE~n
zg+*4az5L#0?S!Q3u;pdfW5`j)VQ!?hFQ|vF+v2wC@NsSYw!>V#2kHBtAJh9D6vH3c
zsGmP}Ne#?u_`l#ke+-;r-RWR|?gNR7c+?dbCyK-ZA{Uf$MwZf{V}Aka%8I)>1x5yY
ze(kybSEu6i`31{8jr`>xQ;a6j*U`B5g2mI~46fkh@$}1YUZ}5S^=tl}51u$0ydJ_P
za72|xmp(mkvH+(-?I7ZcJQR2~(T)0wW_$yDfT33m+W~GUnuM!@?asB^qP7H2Pnv+E
zYOn8HZ)-Daa6VUpJG&oXke?PIrW;f`kr4I)DHI&{uR$I}7MKTV-VcCrkdLe)8N-Td
zc0M14Fbp3EKN7CmH|YEMfN%Ge!6&QpGfls%qYeef<nk_;ar-q_6V7SMW)wS=TCjC7
zcvC(oK%86CKLz`XOi-sl-qUIZyS+uT^fDai);Q#3EJJmncdn%`D1D~r+M}J}jZLU@
z+i`jtc8is*Ntk!~r2KA6h-9aBG1DU94RX|fr|2_cohd*BfwKYxb|OvK=M4t(=^IaM
zQ)zx(oT$y=ScYMyGzzOrjPYa++Ia30c)X|y9`_tNbS-)C&-d@WZJuippX|MB9Puz;
zO)30WQ=?j>h<XW{@CCvK)q7L)Gj9GNw%w4@2cop!F}2M0WKgz@fs6d0Q)pF0!1|h+
z0psy_vvb2st@h_yYtw&fY-+BpFASgb2=@n;DT_M+6Aio7>3{_J4g7^0YyOb5Q!=qz
zaZH9uYH=?Y;2m^1&m(?zt|<mss34`!n9x6{&CJ!gwZq%E>X)P2`ZeKL&~ggGyt=B0
z1L0%t0|hkD;#9PA45rZr{Wg?s%Hwc~Ec?8SpSmPH_$Q#a#xH{8E3twbpwpeoJbl$;
zB4{Z{!@FV7rZ~=~r(*QPx6G|(f9%j$5W<#-`z<@C`ry5J(mwo@w^q36K^7#Op8|3r
zv`Gebu$p<Pza><R*c8#kPipZgjj!MN=ox+5sI0}W$+znIwbq8G?#ZEkk1uN|6T|-}
zb_d;&-tZn)g3?SxfcM$YYgQ2LxemyrYFqj!XpFxtE3d;9&E)1^F{;RDAwVf@sspl=
zG_cJ|(rzyI=@YXq4M)=mKGeUOhog;qGOC^iyM-J>{tCYEoxH@B10Zs@9aUncoV~gE
zmOwH`GE<yXI@Cg(w3|!g?#q3^ukYCz*_GhkATRB{8{dl_x{~EF<adeHnEO2eG|0?n
z{&^<y$0KTFxvDEz2g(DP{V{Vn4mioR*ghw^wXgaC_g~L)n8M8uEzc_TN0*3o%r6c9
z#Hy`JHxB>60j#5Fiy2?c(FN7Q>}PT5>q7q>8h?WXYGONSlc<?GijtGyXSc*b-w;ys
zQ2=g_{00|nAAhj7#is&BbpY&uBb?Y_x}C{WQl%RiI@l{vUUGCCKn0<@(Iv$*{K!p(
z6Q=htRj6-Z!#1im2wn6Pj&6%Z5fS-@turuB!ic>$!hvTR2ArJ5Qhm=PKwfDzJ2NCn
zc-Qq#uy@n0!zVLFQmy_9*MKL$Tm8{uEItC=mfOGyPWI1HkEoKcERwN#2LCJrtLHBM
zUTI07b&6lxKHkF4KACbkH`2@G$VdEX!l%O7{kgc0AW~`m{~ELZec$~Wt03={=-Z+X
z0x&qMwE5cjw*-mfH9H20)*`n~gc0n?oH*EX31m`lcNqnjiJEn+JB<#vCWj6!OYMey
zhk-3r;E#EYCqBn8^A8xu-lJ4Rt5Kd*C=G>g3bo)!u<6`gW03ZO+e14W2~54DN-VVE
z-}p6qUuCK9+Bo7A2>FTW86?m6$Z{MsJ~rN0L!@5e*-p3@C!vRc&u`v^>;4n}(U8r4
zE!Ju%z;{oyCLu&pKM;Xfz|v30yM0x+cq(f{IG7RUDayT)@d>MUpE^v92Al}?()G8d
zbWkoM*V7hlno;_mfbzy>t^d7lU&&fxxfX2>uh*}+;$Jfzi%MGp)^NdQgA8dLck;Wz
zWgSFt|8ksTyqh~ODl%X&P{-#C@Hc$%k;xun8e61EQ8yN@<xYMS;I8J|XHM+bP<o*q
zaIrU2WX)5iX(g8hGx?{oWIhsuyfR$lxw6(=YWa-HazuLQMx^DG)-Hp_+}h6dEk|CK
zp5Oia-ploBcZ2=~i2gJ3^@^wfI-&&7gv1p#dUN|mg(6Pdnzd?^pDatx7+|l5J&wZ%
z0QDNXj*i|P&fYQXWC`(s(`|~AdGVZ`gZUdyy5OqpQKI-+(C(oQ!^X+IjYiL&MV|3Q
zoXwSXh>+ibFAc^~1X@E^04Ls_=m8>3COG}Az!?gCqGQ+OQE%W)-rW_)F`jK&$r6hH
zEAaeCEhp+IJ)jct-hxav5Vjhyf-MUz2;005#pd3>VeH~wz&wWdWc`Lx?<Vz^fv-Zz
zRP9jxMP-<GP}a}(#hK<vfCN)%2vVvbe=++Dj>R&%Sz=1114LuMqwH9@QD)gl((HK9
zA3Rng-=N_^p`ojq1TdnufP}-Dl`}(RYvp$U-Ij5l9~s6TI0TZX8l7bIR^B06=w&Oq
zO%-<gjKkU0BpPGk*S=f0UA0_`>R-OU15Plb73~<<DXtS>{K7;)&h4`Xl8H#t@qQ=g
ziW$=bvWf>}3<qo;2;#HzLlOhdxDh20rP3u%0yst_D;=OBzeoxKwzb+LaF(qlZDBw@
zj|4OOH}H|>;AYk49x?U-RVNayHZ4>~8v*Uu`o%|~L!q({-5~8k%;>fcxKmc-8fTv7
z*Iu}8XbJ3V(?$>bj~8>r%^7c*2Nnnm%(q1bcML!$eU$op(h)dOf_MNJM5fA1fb+r;
zAN)!>+N3-V@#O^#!2n(QE73Z*R%V*HR(!pFoH>#wfAlO;-W*!Ep%8KOyF;OgFEm$H
zMBeZZG4dgqd4iLPWDj^%6V(ve)|1lCHsxh^1+SAKI+Gx`44+GbmZ-drN!?3pxk|4p
zanRi`BYMg`87lSIpp{gOZ+j!24H}d{btYj7OdBsYkfgSqB0DKDbud?98$qp)q`yIF
z&jz?9lXZ!0Ew0fr^Rvxx20@%j=`iAFMq~8gz&EUhnr1=?@y-{n?|Gud308f-GA%bK
z!1ILXsdI>qGhkuQdBZ<q$LXqvbU6d8>R({6y#ESSBYmiXExG`7Jo*!NEv_AHKHzk>
z0-q@^aA`AQC%&9vTh+>T2W4!4mOmvgT7JumjP7J#{Yh|Eet>K>8fZ-U{y`C<gd)CA
zxye~Q$`K5K4&a_C!++F{{HFe8Lu=7op#k5Ps!gPx8X^54@z#xKdXy+ZBJhIfkB@7@
z13o^!Ye%gL7re`U;X<I4%{B$CwRS!#slW!d-3`6Fj>kXTY2%fyo^#B2(h#tOl(!@%
z$ab_A^syC8aRXwyO2>k$+5xe%UJw&I92P2~#w{5WNY}y0g=I@G)d$t-L-VwXS2^s<
zl8{cdcn|`$wG`1nZIh$oQQ=3}9h|=(79kiMQ92Sjj{y96Z-k)vyezD3acu6=S|th)
zqV+GsKuT>0mEik{ijJoE6s4~(i@b>gEhdv9Uj#%LZU1;L|6MgktSeh*Z@Q~tWa^2r
zwpG<n>T6f=Lg<$iX=V9z?7Qbe=tP!)d(w!U^J20fELdjPnOHpY4euT9T}5@GV&BY<
zGrr$om=WL32E?rH@}X1&gh@B5D}k#b%#u*DghphP@{WuVa06`(^TBxo{CH)MZbszZ
z!Yo9Z$_#Gsl|AAZWQQGEIVzZ`n{Db9TpstheQS?F)i!UZ>gsv*55ww0<@fM;na30|
zbq_>sM<uf{aHZr$)Of))tTvG7#-z5~l5AvT{6GVP=Wj#M#x<2c&yS>aN`E)B@4aDJ
zl)u0`5b9RA_h*E!%zOT-;wp^fHg#tx@xWklkd1(-DL1Z<I31S&QN(8WYra)?IySU^
z;ni?-Cczh?6+SD!{Dx!0k6|4S>}Ywr`%$=tyjivJI9TWR)}C{I4AP%MzVS}N)Wu|A
zB0*N<(<P)~IXFd*wFH(c-5^4$CC$lN)a%oc7c;p7rpQhP6Zg$|F(FmnZQNZkUO%L!
zr@|AFx?9zs?b)ifR=idLHsBA`@h~@7UFP)>0h@8U31h30#r7}LzQUbo>j;WI6KK-Z
zU(0NJSt*uG>eiV&VFT!0vpilH@9U^z^lq`MX>aR0&fPK>YoQtYX{@@^PI(wMmeHr8
zdGrtnD_ZG9Ww4sox6&q?!yvABC4&?n{ahe)KV;|U(8@`&$qWv%oBSMjSHjGfefLOm
zdhcofeEZGnqX5_EvG$U@4ZgP0CEP~2P7r8`S&24dH$=mvpebP6wiR>_WNcbCeo-9-
z6QUQl67gPxv`{v?P|NZAPtBPNH5KWTYF|#jc!O*KW@1_J_lunr$P+R496Lto01e}+
zYyjRCpa7j|8&M;0ki5Sas>1dUb>{H{IO#U@t+w6w*t^Gw`8%W22EUwaVl+a_T~D?1
za`QNXw|lck)#8m6QD7V52OnCi;)G%!avBI+>gd!N*fCz#+!njS#puI}9YUj@;1bgU
z5oRaOUVwNQ8HLpzQ(D4AKry^9K(DADT(0VkSQr98(Pjtd<@RyrD-G~X9)h|QQb3pc
ztv#~Aj8WbIlm|VX+DJ(t>wtEsUjc6sy8-1CQ`#ebhDtR(z-RB74c;kZDa|;VXiGrt
zd@VzzM^Ct%X;FBmd<ru7$otdNVQwB5|NXx-n_s{_x<uw-8K`;xDf-x_E^vj!WC-ho
z4^+0Z0z_hqD_8=aD_P4yR*JLrO$0+=`f)&)19<?{vt~xLW0p?fBsXRsv#P~mUmh)W
z>A=&jV&IHv3=(Uaa`mqs$8Dp92iEd1p;-w)wB3On?em12D*@IoUQ9?bMaqQ9Y&#Bj
zhb{ISSo6eCi>2s4(O9iX(gFB>CdC_C$hjI)HOmvs`!@CdrFqU1<^2SAtqAcOM^pp6
z^)P81Q3a==CP`rn3dJEq=x<<0m42pux2fGoG$#Eh=^~$W{I>YjTd0Ow?4fy&Y$6~=
z@OZO}KCgMDuN(QFMqF_H0=p-<d11gf3AYC1x>JO4jN4icTay?8{IoP=Q}Rp(guNdn
zR2x&`U`(abV-U!MXM5gU@D|NEN=><*pao#hXkhS+ylIaED)q@wS1dzE5@dh*vDqM3
z2kEV*1h<NWMM~Q>4h}iqBW8ika$G{6|6z(cTGCc%Dr;8)Khn-LCAN|%><%^`ut9Do
z8oLfN92fPKz>?C0niQ33(Z$}!<S-ch%oO&>0&QQmA2Z1L#_t+SX5uWR>3K;jaNc|n
zMMxLc);yc)OKl2H2@L@|{!Z9UevhC=jOkeIt-tGM#Cs}gUQ7(OeGUEBZ?@8@DUeuk
zIbAF7**t&KjsEfRdt_%yTPR2Lntceoa>FzhU=t%D#AyI36^gxRFNw_xE3B!v%(@fM
zG1--2(IvJ@_Fn8J;56seZ)tPj$t2$;gPUiV`Qq(e%57So*4XHn8rcsf$PcaokDH?K
zNed`zK1bn6tZJVGZgNaIf|$ppsIw2^^Eb4XL>zXDu80uWHIx%C%z2I2^eFtVy{_lf
zy)NX<ZZgZ?^iyWev<7vs7#K5~knX^dQ%HT1qYT>)E^5FOBus?KU>ic5PPzu1!Zmzb
z343(h3EmG-Q7?&s9e0}cRmBtsN8}$0tZjs54F;}ob^09()G&1u#wx@Q;f(l$s4ZZw
zI&~G(JIhDAYp~No5ccJ#vf`@B7#@{DGXb89Z-Q>FcmUGb$)U?L{MdK&=+GOoz$+24
z59*xX7a`Ly&^ZEZCG4b+<AHZx4hK)rB^iMo*%&)2>~PS`AnPbG!?p@giS!8~W&;bQ
z<d)FtNqDi-qnv0PJ?<HJ1!{b{zMNVL&Yy3~ru#EOESHrmqu)fxA@VbjfY_@N<i$oO
z^@DG-h0Hg)_qv|>%5asC%08sy0DG?cCBFU*g}W#C+Ml0d3h=7DXhlla+CIv1wYqYY
zJdT6{yahf0=X{Bt2<|DqEXDT#0i(_~BmW8d`IS3Gi(_9TSAs$BOH`k3H!^KG2n2$x
zyDw%;HNY}ax+6O%dRGEw4JLO%Lo=~Afzt*)<QLxV1*L|(L}lhYNSQG)%2Mr30yiL+
z95sp+61qr-_jAA@Ui1RP46an1A$GsXH{?1xdT$J;=qNQsL5TCO`B-kD1~gelpEC+7
zZ<YjB1=+TEN)9l+_2*)MN3m{3vHxE;uQoOeR7cXTol#SMC_)Sn;JsneW*Klj1}zlf
z%A>FhqKZjaBc*#RAE{lV((7t^!AE~LE!+Y$2M0g3vvr#W4n=2rb$1Dv^Re-qq?=L(
zLJuju)5xOe&K-I0{96%HfKi@IQAGTsHn<*h1FPKsbpb3P`!&BHAQzQZgN!fYD7VK<
z0q3)!POK(Ct^kLk+mLjnU6_vC5V^SQy-^ULw5wyngwknKBWN+LrkXh})#?m320+1k
zyPIXE6-BdiFR#o9hJwS-QEvRF`X1(I!0d@D`*BLOY2ZcJt}r>h(agCXBmO=4RQx|`
z2h~&<vJJ@<9#K$KJfuF^VvOWCti;Nw@<iFE^p?BkT>1m@b{Qg#aJ{uquo5(U!wDrW
zuyQ7J*vs=xlPa!EUTLEJSB4WreykwQX#44X`^_u`NSGR)&om|1Rg=3ZOmucB&dx8k
zu<GS3@O$oT*0Dc3bmQA6vx;-WsG64Vw$pNQ3aT%>pO|>xv&#T-+cR|fammqpq&ko<
zB7dT^f$O=b5xpPGMt5&n$tlA9SZp^XMYuDM8&F<SjCvFb6C|F-ooqcrUjC`dFv)GP
z_pY(`;h%91U3C15@ND8O^Fry8Vm$uZfTfis>J0`@iUYGekC=E7!lv5@lYzu0G%ryZ
z7yn!+AbNBL?_Yb4$OIV*=^dhxqfUq~l#|!yy(x&8JlK9cFlF$$%qmk}pP?^wHU9ob
z#FVu-udOeGW5mo@M0{;42Jku_r)-8!iwHn+Q5wK~EWfLuq-=ziG0PW(B}KIc$cH>V
z#>XA)*{>2DFEuqYSx3_<(spQYWc>Lw#bpu-s;Qi!r%@U-r3h%T%>g+|X>19Zq9<_l
zNPERWNQL)##=w$L>b+%7wR31G6QgkP9X@2!jATx_$Xidz2fGkQKYrZtyGACAg)F9G
zy8d2%hD`v)9o0c)@M~z^*9T4ziYcI>m#B*0tmD2AGE~mH29;-3y)Ad8>@9eI=R$Dx
zrYJefLc{U+x94=LB$}WA?*lUOBm7MC0aY&s2}s5ce@X@i0fcf3S_c?05Rz$D%uR#5
zcEKFzmPuZku+qvHukgU14sCX~3X4kKes_nN8pWLoom_;iFu><=kE&;tI?n>>5!I#-
zGJW|dMBpN~3Gspr94KJ1+sLa~<UvR?;-oscQA(7@fK}0X*)QGaf<l6`{9B=d|Ncr0
z7F$NzW*8a``giZWr#Xm(e1!1#Zt^z(B)L<08Qu#tX>Es8DDodohTW0-7R4J{WpPvS
zD;>@uTnMIg8KG&0sZRFdW@iGhEr~o#91rZ5Myr=hyoXcH8^!0;&?v~1<xP=KByTj}
zQjk)0?iN?fcPreL;r%rrjT$45gQsL+Tsxzd)%7c>DkGA)Z1EAG`rP5Y<DP##aC4cW
zMWpx+Nttnxm`g*bilOVTJpQ<`Y^+uJ-DQ;J#2ah!esUiLiQec^as@<uq>Lig;iQ(e
zCUU<h&w*}fZ#9>i-txVS{D%%U>_Y=K4~9PsO|>?}jm`(eFg%*C|9;9m^_8aF1!ONi
zg49ql=LR7KTUYUh{vg&(sTVhem7af2(t}VbY%Sm%Yu;AiBC*RBJI8P_+EJeN?SQAV
zcw>ojkGjo92%oVbAZD5(Q&MYar1SMEl^H3DX1QQGc@GV)`w1T@ZQ&dob=*g!2`Gmg
z39!uhM-A8kd5EN8-2~a@&x$D%ex|MW7SeGJWLxSR8(ER?QD)yxebC7BHAQB3T6;=z
z6NWk(yjJNcQ%9%&Fjkz_SSpb_fY<&N6KR1ROA*yPHdJm^Om$23K|i~Gi0BpAluU+I
z`*0M5(_PK`pPHZt4v$hQW`qsh9T{34&-O354k%r=S3F!!H3apIx(_wE6^h+&G(KZh
zTFv0<@^GybV45)C_P!AVlJ3+x!%WPzto1|!unYs+?*odYg>5z55;sNNhI25_An6q2
zjnKssN(yE(ue;sBHyfO4w)+S9kHIm%kuLs)2R`zOj3O@gYfe{isjw5hW7X}x(}6PO
zg|!D!i@QiJLrZ}cm>ooJJB6W7L~udbS~~T4VY$GfjV0Vb3Ik_D)YwUB87AHKx5lR*
zE?X(H4g#}FJQ&>`Fi(GO@d57~Q48CPH=;FgSar6Ea(4@_#oZvw{Lx1^PZA&3l|OG;
z9u(mNn#;^ZfyO4A$6eCj@%q3ys9{3qm=ODZ&hKy^KIBJr81p{?q53i1lXrv6GL78#
zgo4IKtA&L-FL&4Yf9=vZ|HNy9dl90V^Z!l{<Oma5La$C)WTp5`>dBn*I*c)TJ)$1Y
zHxttiG}c2J>FS2^DEAigTjDgDVPHx}9sZ!;WYe}ri<fSdm9=rl?>ObCt=g-07|Q2>
zZ;!<q4I|sdK0^7j^O))1V74}|G04{7N81AFiT6g3=`nA6Mo%X@8yd0NklRU{M{d}z
zp}K-CQaYO^^GYKo*Fj1L^3zKEs%A%uOgFFMa(MWp5x*vKdD`!63-qq)Q%?n02Z12L
z@tsP*S-S82Rkyntm4R8)TvAust9TeB+K$rZ#)(9vBTZ~EDLz8dPw=utVc!5Y$YyT7
ziWR4+G*j&wRPGfE!J<9hm~}~J&_F4L{n|kVc)ooTfoaj~IN=qD53z3BvSAms)?3=Q
zjc|wqjLbv+*9!xj<92*4nH^eKnAF*vnyzJiWb?~Sd(=GDNGl?&8oVe;NoR1rQQ83U
zHF-C2{E8w*j!JCN68DC5vJV2^Je#@JkPE6FNPa)`MZ{`~oSa=DoXr#d)bMORKRRb(
zNfpFo3>IlN&kAdWQd$u%ps=|{)h%T1%Xl8%6#tP{jW=S=ugSu^1{nnwUX8h5&J8a+
zpZL;#Sa2C9H~6(T`tIFm8(&`IfQQrP($fn?ND8IR2t?Mp$-`h0o`OG3*;R%>1UFa=
zDW+;NL_OX{#8VUl(8|1J98cBVE4xv+nHPoJfl47^BSQ%hfWq&}ZYT?aum2q#UNc{4
z-0BeNyyrKK6;=lax=S13r`Rg6n<#DQsR5@;x1Z0}62tuYzy%aO9R)az`j`7mGl4d6
zJ@pM0F^P{2N`B7c2P8kn(Zll`a!P&t+p1>j-{k>djvm@lW>+zV-3~wN3gC|cOr%qw
z#01|VV2$lQ8~`kg=L9+Lswnbstv{}^6qknCXI<ZSn+{uzS{~cA{J+dH?_cpz2KceR
zfiu&;I00bQ<DH3W7i>rq(~i!`ZPuPCJ)$eZjV?XP47n}A7?Jit^oOJndLORhIDuft
zlJptkn}q2kkC$(av3Rx_&(@Q0v2f03*lHn6P1y=IvX@c7#0ZR}C$Yh2II7?%Xlwwm
zVek+3D&#QghUHCql%t~emld~`)`5jjX`hCy78sds=LTzT-YDEzF+`vr3cb_VRA{cY
zmbrExJd4Yz<<H+PB~nfg*;wuq%728nTC$&(j0Vi)lk|d>N1)!d`CrHUUDq=%1PQOa
zpPX<wNpqg)SkcSN_cytRDFg~VC$p0SH!-3Ds+yBK`f<6Z#Kb~A2n7Qs%HU|g+v=Gn
zR4RIdlFZ>VGIY*M@N>@Afo!NR1!Wtjb$5z6T+@PiekIt|MsO)({2t}^f8pbrgTgv;
z%5(Ucykjl9#a`lR<{{HeAsttEkT&%%OEm*)86#0a1lJMve%P0LanLs2N@bB@;^8q|
zebc<2Q`?#l=h5R{#(I^0`YU}#o?nCzRj3e0`fV&I>6lt<y5&;PK7>BrR2^O^icsxN
z@oLBj8i_*bz!_q4iFm^B{K(+;VHBf4<DASd9mNQ8_$Uc<w))bMzt;QkuxE7y>SuN3
zg?`OhfP~-Da}qEl!M=I}WWA+vr-y7?oypd1l^Ht0?feV%M!6~CtgZOieMOdpYlZ4@
zC368}YSm24Ri`z~#kvL#<B4%|_}*iP<$)r^e|_W)0K8+I1v}nWZ5sXpBir>c>6B1Q
zti&))fYk}Fw@+2Zi#REi#!^#VSyxNnPhNBoK{mBPD{l@1NNv;oS3Ji4maXEAOU>gK
zAzpgpF(f}ojgqISG*N#ZE<h=_&rKZ}SSqk~ci?d834+P$sBx`8jhA?Pw%U-v7vEve
z>htj|pXSTo239GkM`xpxzdKZ8b_@twLD|U%1BGX$I62n<b4>QW*;rm;NyKU%V3?!Q
zgUz5v#V>Jp{8lCnWIFs#&OP$h*Zh_rVxrd#P3QM^Cpq~@DB9jHarFU{J>tc!b4`b`
z8w;vt4ftxv8PqZ4AE>WlpkSRLifGCkK6EHQ=0S_~RX|s;yz}MQlb+*)H0;S1872#j
zoFL{dx`kVYL>~RrVQ(MfXY^lr@YyEDioKq&wIln?g8EwgIZe2q(sr6*sSobb(0Sze
zI2XNhV2Q2^5XPLwEU9}j01d4gP;sTx`37mFq+2o`wRCzFopW`2>!YV-xLgCsAGaF+
z+m-<Tfa5w$#(A#Z?t7#lfHGz&cRqU_4)9dtQyqlTnM{dsWSpElV7bhzWkz1tF#^^%
z^!U4_+{*uC&Ig2!EGK1t=uPlyY?$yDy!X)eBxn_B%7?1MSKU$>nSNZ=w}VU4+sFA)
zb5dmBfNh3Fr1xo_O{SM1(9*+W#Aa@^qG8xZdg9$(8mhWRlrLBi`2SdVV0R2)<GFK0
zeSL^&J8IpEG*aT|sehUY1aJyJ;7I5l%o@5O;zgTiaw%HM?eU-wU2*Zzc6Rfijn?8e
zV(u5$p_}GU`aGIs2F<rZwDltdiSN}Y7qL5SEcH8)8-a0eScd?eBl&kRa2`bgm<}aq
zNNO9YA2eVK8d+k=w30caOG-Zjhr*o7(JS7eFK{ch-nclN6OVtyUAyL?y7EsDcZ-_#
zWrF(TIuYCpm?LIqS^Q<nxPEu6FO9~%iZ`HF&g2`mqY~^LKr4ELyWV8*X!wfJ0t=mk
zyKR%ZN)mKcS(e^H7vCAYNB#mH=ep!++<~dpl(Nd^R!=>x!95}WiDYb_nh|s+)s$UZ
ziS=veYy$;^p@3i)=jJOjO=UTSWmkVl?Fpmc@ON(xyg$Ax6-e$bf;`^p3rZWq!88pV
z-P(3ge(G7X07mvbi~6%1hSh6H-~`5-(a<c@Wf2r-ltIw2QP=C+1Z|%PL8<935I2il
zUSL~0-^cDtDVcFUIy%$n3#rA1DR*ssJ}u}|>S@S_9J;d0Bf3umhR`x?&#bQjtNSeP
z274dzz@g>H?<ZVQqfEz>h0%?i#?K2y{$-cTj++5>$`K%r`&YOyh^@0qD<Q_n?bm*b
z!Xjpjt|yg@s@`GOU+8fksJ4viwd>sr-xiO3@CY>CU&Lhjo9FtMUVeV;bI+cKTFrnc
z5DnZ53N%i<22p}Y?qlzNH4ybw=~<!@nCkZ1WNr1V@b9Ua2{24UYbs-hNv_Xl1P$$c
zd4Lz^1<|LSFW?nK-r8PRc~{)}&BxW99|x8`v4H06hgdZ!+bCchOF9Lu&yltOkz=79
zM59fV4Ig<Q7!-H~-?-JAaBJO5ndds0qpQu)lI}e>{+RvqGSIrl-~@N5r8v2RS9VBP
zIW8cmpr)W4*A&mN^EJ9d4c#2*KRP-#zUPiS_fD?NjSv~R?iP35k*|f@moGFSQ0&kw
z49~YQqAT_39Y5n7enNjYVgsa%RVRm+N2@JEz*ILr{(7xok>R{g;d44yzIb+k-r_DX
z?mgHpxoa6UM~m}+#Yo@D^x(fz1MSQjizsky14EqswaICHxasb}sNT2}JPe*Qw&Dd$
zDk9qX7YCy~wCL%kJJUaQpC6(>F9e>?l6~Qy8o%<)GSl6S4}=yW<me*Amn;x_IlvOo
z6AX8XQfHVUH9uPmhE=f}_Bh91*0RtF44n8y)hFreTr(P6x!jbn|I_e-G%C~4dyrN`
z2)<i1bmP$cwa1aPAJfz@*{ffPh=^%$U)Av+u!+Q~Hus4g3j#q@am+#}wc#Gxw7pSM
z5^Y|vuii$AbT?vWTmE(7ZAC=LnGvR^4R(xSe}a2~)9{7dd-s+xkP84W#_UDqu1jK$
zE)1Z-M-=!OvSGgsR%a$JV5JQ-Nr5EJhMbU+(f7oRE=mKZ9kqkV!4?jAB}`66;ycNf
zd|OaN$iDQ%j?E{zR!1~VRyy-4UIe{=rw*5Z(yzU8=g{+MK9$)g4Wdorj6x@w&&hqU
z+D3Nt+gI`E%2Jmq(upCnk*h<f4@nF2yN9P349^pe{>2`{%*MdS2e~`WA(jpTutotG
zz${|iF(^y9&0hWmsz|bNHshiVp>An`;yf{q3y_BLXQ3ruoic2&k4%36%^wJtfu&JP
zFyyBPqvr5<9edAO;Kfu|&r0U;HWsCAJ%&E=uS)43wUa{Fn!^>WX90&(4`R)@%Yanr
zLnHG5fSH-4*H-TDN}m;ICZlzg2Zmd0i)UloPc&t!vcyui&PfYS|58s?+6~4tp*~>v
zw(l_KG0nkLD#nC+8lIAwzwyol1WtqOa{TIsW++2)>M?CPb|k5$3ha|!B_iqdp>u=F
zK}S~)%rkWyRD(Dg;l|hPe0I|RyTSuzcffXj3nLnc*FOa^v<czLQ+ygY*o|M|QShkL
z#(=H{!d1L()yuJIAp)&$mxZg0*xJF0;R$>qVjmCv*pz>{+N+opc>%?|vhx@w5>yZz
z_5sf|*xXP$Q-K$FJ*CaeDNM-&tItPg<pxbT`LnTL-!+)aH!W)9KlWB*4=`Kpy?HiO
zwS{Er%gcZR_{1d!ul+*(@24P{(>x8}Mqn4Gz$nn-j?OE`!X*-HcVtWltBFj-g~mus
zZVDyjX7LN#%wIlE?*BN#JWcumh$n$Twc(;O*d~*}HhFM#CimP)^_3W<0p@tW(hWSY
zW{m?D@s??UZ|hZp!b<7Kr_DzfI1KqP60bn4<b@V*aprYn{AgIRr60F&@1PBJ%XC2c
z?ui+rk9i=gPU5Y|eOI=sQL;L}s=ZpU(8);sQ~khIm{Xfno>Gd-x1|Z+AhqUVd<C9K
zH3fv*)o=n{iVq%H_^u&+$H(F2*6XVZzmdiN`Zf(S9eb)2Z?8AM$`4cfJ4B^>6Z(|G
z<iKWOQp?J@0E0~6L4=Tbzd>vTOM1kn*+L=If|KW_gk1WjD|75!%}oioCC}?q?d$_G
z`{b|@n=wm5D72EwoG@@7_ZnH&!rw!%IilZI4N}CQB>|(<ANPh-nPuU=hRC{@`GK1E
z{^5f7@~1fTYY8=Ra*ND9jro*TU7WBp8oQO4?KjeLyk=H6Gp1@Twy@;oto{}3<ohdU
z)c;0+o$-2jzU_)qZ|W?M04B{Bz|+HdCs9W8X(LIruCfwvahaa9XAX1f>1AmPV17xp
zE_%c**1H=DM3>UzWiJBM))v+tgV@TY*3;)liivUVLpCP*9-v0@Xz1*~5?(6^NJnWQ
zkna5t<CkaT=a1uXH=jCw$4cJMH{WOtXuLPSn&s#cW9L+xW)#kF)29;yHBNrTsxh`6
zkQGXBOU(yJE~Uh{PRu&AV+7f}pV1m|+W36!K#N-?0FpQ)H<t<CcZOC8iGkd_*awFC
z)A@J-xCo5=U$H(2+4EsaV?|MT@K>D$m&_H!q%wlcgKJsv{V5ajWOu+&^|HtJw!+Oy
zGZ>(jwdT%^V_lq%L;yCU6+k?v93MV!@WqX9)9UCu^pVA>Z+w-iv4#Uk>GhzQJZr-h
zO4|gb-iBqm73%mrM`_Sm%v^rDuivI}&qzy{n3{-Wgi@20L6yw{Yb;FV$_w?NvYIsd
z#LnoTgX3IN(}b>tjf@~$%QqPMOEuMTwl2}4t@i6P8P)wn5ANZfQq^AuY}>&P87Bs(
zvOQ&asc0<{qK@AZ_~T4Cu)L1E+0!w(r(tAy{I)^m3jv%M$ZBaWH1Yl0N)1B?5&byl
zs!$y^_5z`%4kIdeuYj%Fa}N}g|1tyw1A{(plWYC7>IWH(J|BX4*b-KD$SxeLt?h6l
z#e_IX&?lx3y&YMeA%#eu+IsX<$Trm61aJE9b43}!o1vQ^hOPg~H5z+c3SQUYV&M+i
z_11DCZb_<nrjCNZ2^PC_yymV9E!j0P(iqPyuYd9yTCffD&>(CmanAgmf2(IN<4_Tj
z5BirM@|D~0+~8dhs4ZB?7a>aGl8#|J7_bUy9&p~lw@(^Cyqu6?z{v{U)z7vkPI(O2
z=xCfAluDz3a${hrCostI%pgM%h&MrZO=@{~5F;h0`!%M3hUNd$O!EI#a9soM8v+h+
zKZE=BOZ4Wo47QH)Fl4XPV@W<q=^{*`U>kCi(|Q?SOie=Xp9yeYNkAh70YplBq4tRJ
z8>}YyvO#`9(1sLzi1>%)X5%>%mkUEty$1<;W0UX;Jb5?&9{M!+Po^ksff!LShiN!3
z6?u;-<VoN!<4DKW5>*Do=5Ejn>vtZe0tz&}isU=evUPjr$0VSB(3&g6z%h`j+pQLw
zm@Hovrdck<d13=b!t%JOw$56o8%Dr#+;%SpTMx|9DrDXA__YGn7NxF?HUCWHogv`2
zW7kb{5Jhl`W~YvucpOv#C$}|v8n<V~ivs~Mz^tx*<dBmst_&AjFi}`)xg0lsVEL!I
zq0E{3dm17vYyo5|C6X28_S<4Q7n$f#(MH%r(gLX{MYpBQ@%(^I*0%Ss!e17a6=|b$
zyPa(^a+Box0>*Q#!&k#nTAU^H?E;tQGjdOZvS_+T{L6_TbU~?W#Xa(7AhAW_!C_)k
z9hf(|pyJIy?S#$c25U9SKr!NLH^`@CuzhpJ_!3@25q{OG?3*hytBsjeIF<e@;3PRd
zhtrb`$_MX8E?kYuJ+O19r`p|^G?fW?2wCUdg;0;6>Y)uuUO?)9gowHfu{tptIF12&
z7v6LWpGGG+(p{@S8?IcnL$;7YFr}3ruL*CPQe1x;S321fW?S}`-_}jyBE+0IxRfXM
zkWu5)0hXL}%vJAXL3i4ZgHh8Y*Q#)gG07V=Yh2`CYe=$<cXNg0#h^&gX}_wQ9rwbr
z^Ibs+mPqZ0$q)LycJ%$6prapM{Ifa?6h!Mo!RKd?zD_?TDG2mpql^Lii{IY24!BZI
ztR$m%kPbt%_o{ubhv=kBx5_4oLs-63NL)ECpOwb!+ZN$)Dl?LR*L_wR9$=MLJe_NF
zGh>Zuo(9;dKO#1QDUkqDjBOsaS{{K4By7GYrQQvVBdnh&m|%g9=|^~cRp5Vk__$|x
zOQ73shpanh4qY%i>TtCFNvV;VSha&VB+moSh$Qnk2=u-yBs8C_51a|qoC2Q{-wnM1
zWkn4@IXTy3n_3V>H-u5xj1&CqlQKZ@`=NTlh!=_UjWoY#zq+BWEW#q>WxzekC82C5
zwF9$y7_)&Qahankr^7X59uiHZL7toqE5LvR!JzqOz0v>S>)pel%>V!KX;q3eN+@C~
zMXjU**_@_QNz!!K5HVYl!!*siMJC4FRyifvYGapWNJtKo7|Lld4%=FZama`{*bZVc
zvoY>9Gk4#oKJU-(`u?u#cm4JcuB)y4e%-Ib^YuJDo{xu&{S(86WyoAR0;&g?rfRti
zi?_I0mE>$h_CafShRBkm19KPrH_LO_W5c9muI~DN$M4UPR&C>sMVF*4b`@t?S+w|=
z#x78wM0hAs#3oF$yQK%=V^{)B=mxEgC8kWFn?Wm1z{0f5;FSx|`Sf`*YY{AEw}8;$
zY|F=1e;`+~66*COTYyk`siWOnNUoB#PVrWT=+b#)c}@n6x+tN{=~L?BiZV)fbcE@>
z0$=x#{BhA*p~}7z(}IZg@Qj*+$X7S+`kG2E24Cf&x||p)L@n4-{sVdqV3w`e3}3XS
zECkzv8jrDt8c9njk&V`9D!7ZM__nka3}+5Myg}O&Ish1F@=;c^k6}`ob(Pb%9=`7V
z_1~uZyktE_e?)XY7(qe+J_Qd3Bd#9l<q|o-Tg43~U<qR?u00M5L_|44sBr_(0u1Zy
zn6=aewyA>gOkLDy58QFG9B<VR>TE|%5wg-J6kAvA25MXG_=V%xnpY|^%+69mq9JC=
zzqpfBNWc4$w*14~{j{5bjeS#uR?l2QZ~1%?1JdVl4c@^~UH>4>8pL3=ekstCN+Yr<
z`_*~ds;HaFO5gn&8pV0c?4EOYGoHT4xgYr^bk4VnvZ|sy|AP0~)&;7K&WXw+Ot?d;
zNUdqQKziJr#@vIwBCc@+hT<`Ns-qp?THlp{q<84(dXT`fB^aVpet<-YtIB#_CEaO4
z_O7pemeApm=+S#V(=z<<dhedSPVW9NvI}q=4ymm3CY;UX){}<H^TDPjfTMXdQH#};
zGP{I^;Qk-%3D0t4&v^KL-?y!Py-wNf>>}^s?rYK4!nPjw^>x`gU+Q(jF_V$zC5Y$&
zBzI|(E^=sIxj_u14Vkr(s|)V~A*zu<!&ur4|AjEaDN`!nd@{OW?p-%;)UkSip(Dl{
zQ;e?OD{7Wx2OR9*N~?0KYS>Q=IQEO5_vo1emt%=}v{cA8k=dvv@O?A!D)#{?TusSB
zQ|HCqh3GDFZOWKMs>(`U=ObhBG(DXE)3|3aJewx+N|<(65_ImVA1MR_HRm24R(!DC
zv#CN4l-uU%z!t*xh<kvIuqx`wYa5pX-nW94Lc9!3pD+LEkQ60B35O`_NWJWMPWHKd
zeR#Ka_t+K5d^Jv9_P4*0-24uu=tER>qQpr{(#7$x;LVP%>1Q~6OV8<SizQTYIcX|G
zKBgso2<!u^%ja#|cZ^{5uX)d8o&^uzFkcZ?GR)*GGQd7k{I2EoY^x_D&_ge(xn92`
z3^_-AbfnSrUaLTYUhZ!FaonyJOOsGHjDF@B{h=uWx6}dC9+O97OHaruCB$Yc2NCN=
zqrGaUoO|1~wTy72zuqeXCi{#mEfq-8EWpigO!4Q}?~q)xZP?XnWS3BHy|kA-IcDTH
zkg8~K{<Pzfu=zX9H$o23p52%86t~sCLsQZsS<qyjh;)69)sA0CL6&m}NxK-NKIR6G
z2XwEtfgeBQSf?D5wE@epqg{Y=@niJj=kI&B+G;oK8|!)B=y!VSr=qF^IBRb6k@rLq
zwgfUKi>|{={EWTiR;Y_6XJppc(n`6V;yvmrD`{tLPHb-6jRuO@$;Vl^qST0NmyXeO
zGV3H;+5*5PfBLQLjhlqElEU1~FY0?+F$juc|Azlt(9pZCC%3oB!5X!kQW-#Ce@<Sb
z*eXwK#@`~!+@XbuTVdETmEyc!287-ed4L1~h3%2ol&I5Xe>IvXHu>nhzYUN<ZI>Pn
za4NsrYR#>RR}>T@0Uzc#>DfhXw(k|?nF~}rl_|6aUJ?onTS#M5u|m+2Hj(Eyf&NS8
zGT@FmBlDG5q&aTS9L?4#olE#RLb!|``8}UlRhrlMH2qVjlo(v&{>Uh}??^)IPNpr^
z0Xt-J=-~$egbq5&U5sdSO&&e%MAl&$Rw)k?TinJ>LwrU{XqRXfe48?twoHS2Aqb+A
zODWzeEl3wr`wMp@_2<Mo|2R+4SciWdiD|Q8de8Hb3*4WK454r;N&_vfPy|G2o1&2G
zj!yDf@nC%8ju6w8XlgEfXEaMYI5RsnBc7>+cJPqP{Hlfx{QV$N;TIJ{JTW+3Mmk>e
zv}a)AYgINMn$+RxZt8mOrL=_%J#>xo7}jcPr;cx28{BBwh*lKPT_n~CDw<|eqXm8V
zP_HebIi9oesa!Knr6F>EJx$j9;J;07`fIIS;-vq8MA<rPC{T~)S+NuIdU3?eP~0oX
z3`y~)`L<;{X_cWqhw_3Rhs-Yiu27d8GP`3$aP(aE#yIk~^Z;aA@ZZS_>76x8J#kp4
z3TlO#cT|*K$MxbEOQ_dWxbmResl(%yO%{F?T6YxfDx)9awa%#vZs~^Bs*B<W#f^1@
z#N7U=fK0VbFem$n)psPtVYd10jZruics6lhxto8$zJ;GYst8$%uRMcCTBb6EGN*|~
zn^ELXj77PWUG%3Pox(b5d=_Hg$+uNVlp}`w8v6<d@_?kY^wM+zpBg@5G`Js6S(PD3
zFNwao09EfbWywxSW>b+MP(>hWH||l{)jh31f07{`m>zmxRM+KBx_+8prXq<Ne(Y>D
z+L|#J_{Vngkk0-VJjchK6Lg&s{pv{s4&zC=qR)h63iWag>xt`6L3Q36e2b-x#0f<@
z|7=np$*Q50tHs__9p~oa==qPoU;U2zsh@%ZcY=l-q=FVXz$e~j0AE-fo7rbiYlqpw
zAC~!!V=F*UkrfY6ZpXEQ&SqH$WHUKM#UG!HlghGp@=nW{4dwK@R>7wNMX^nt*UKVG
z{<vbr@av|v8p&XnJ?DwE$4$A_Y|PBCorVQ$*7$oQK&;t@;2FnQqQVAQcZa~b-IBbr
zSv1Uw_hH|#RpOJL(5pYvsZ_=;>$p#)>*Xscvv!8MF0_Z$zt`|zIJ&Lc8tBnPID_y?
zAUG3Fr;&%fph}!FX7?2aFF>025J4`54H|n&CLQ0#U4m)R6Wdv)RfH8Eg-aMfwL`z&
z%-jgQ&u!eKa<d+WmyF}+6jVSOgH}9Ah*V;~X*ByGFuhqM+bEYtnBZHD>_bP5`kRQA
z1QgL!>5pOe|5ZQY%1$Zw0?y0sxTZ|4Jjx)c!FLhmv#P<bB_?53=oJZRHO6NdJ6^Lb
z=x!k=fZs85t$tsjAL{B_CA*y{n*iy%UK=HA<zJ&X8FFKqt0nED&Jgs^4x>>Xq_)i4
zWs;>4RL@C`OR(!K5m908O7Ks()sJu&?kRVuE{c{HVF&)i%~7x=70^{bKz<S_4J!p*
zb#7%w5)x{?N_AM~l~k_-z}(?|GGQ_sAm>1x-t&fj+gQCA(L%%8Ot;8Bm58zfjv7_7
zHvlN&32T3fZ|{t|HYIs7qHCGP+*7%Q%CH90nk_`5{rgT~OV%q7qA`;;ekW&aL938h
zwdvjU2exImK9{r01g<h|m%9^(`A5&so~%yu?HP^!?qYI;htscqtqU-OYrr(8^T$YS
z#AIYOwlQ?a1Yw2qR@Gj4Mr*g}M|sGAk)uyhDsad-xwkoQ={w&WUPp1-<$havwx9Ot
z)G>aU)upZJC#WIRMfE3Ib4`)2`Fr&`q*;?Idc>`XoD6!%xP-1(ZfCZeZdcbj6X;nd
zpP(gWK&>1jW*MDDE5+<vMVwxSS>)IuIe|B&feKHUn#w(s^MeJZ1rO+1ZaII1`V)F+
zsvX6_dNnu8=Gk}FD9JGU(L_<X0a9t*e&-ta2tT4-%I)4C{g?EGYeTm_WOY@W<Sai~
zWJ?#Z_31v)pKddp3rcp@p<D36LUqr43>&8ZNLzu%5%I6l%n4WSz;v44_|-w?YS>iZ
zzW_VB?6mdpgyJB2P#!Jvn(S9DM3ssOlmZ@QLq==JB-02D>*%Erwd=hkG2iOwc>*V)
zqXxv5?>--uUuKD^tH*1v)`Xn1N*zdyab`t2+STlq;g~mI=m+5W&j7edGQ`?hCV)QX
zV@pls_Y|P{**dlGBY7G4jKdPwcx>B8=2{v1I=1e>sJ`4Ou44>;ovAH*n^Pi5)%(6t
z_A=vfsL#vr&g}2~Ukkd5c^Bk3rZ+r)>wFC{l`Hcg4fP^JH>X4vaZG21eNX-A5{T0|
z{j(`kjmGqh<`d}Sf2O?Tk%=4~cXwIG&8;fm2SR#6<lwX$EqsLN|7t3NsC#CF67?=Q
zOx$JB@`I^Z8HqIWxhC98q#>GwHQ5O$(~KrWV;$Q0z(bU_mM(8x7fR6MoRdv?Cr}Ur
zG?G`lyFkR&4)HlwCP^{(Sc$9@nuK~-?5`h4NGXJ=fA1nEB{UIprmhnz(xlPKLqI?(
z51Ldfw=rKK#`RVYKc+qi%`rnsvgi)TmfBbmz1``Tg-06tp~*3{dbi-F&zpV!QJj34
zp}nl<NY9NsMzNdFPNhEcHB!k=D02*vD*<Sqhb=|-f5Dwj++QIlwb8C4x{L+liH6X3
z+F2zr8-&nImN;GJOg$1!aW57>y)7;eOb}dKx%=?hN18J(u)XrY3J<`{k}yMN8=`~Z
z8QbAce4x*(nz@!?`m7H#p&O66wsdQ$Kx6uKy={J3_B$330Fy+lcz<Wv07pVwqT@En
z@~Norx%?@7X+4n!QK<b)d65KJfum=r3_37vz`rgcsPmD)7zaf-ItA~Yf_AyZAP15^
zX7w#%h^9y);~Up^#mG<BFGYZ&oj0l}8?6Ba6xL5RQY~QhH2<xD&h@ij<%OB|2@mvK
zdeAqWwj62kD5U?c@sWg@b5({Km{y)B?RAZa1}szXN#@vg>~)R?>L#|t-@q24;}FV2
zcTISg=2;nu*BK17rX)Owkr>LN+Z&DgB3O%qePYt$*_;#|PvcY%o4V+-i#?pdep_uB
ze%_g>CCW~Bqniz-WSO-XX`%^$oc0S&uBljo29(f0O||oht-|GueMUuXWL=a<N*F#=
zA^TJ_HkHW4r5t-A`<=O-+c<a$q-c+UlJ4mqqj$3&Pb=>7&*0Qs)HmS;aP7-HL6n8`
zQ|5f$ZsApc)Se6;CCJQKVh`i7Szel!>OxPwnS9qF*{xasHN6pa+IXk~%hM8i=Y+?4
zsZ}i9vmbm^bI0-|Ru1!sPW58JM=K3?oa!DdD!Aj#C%H7@utf{9$axWy&#fS(BIjs{
zMua3b(<;P&A(|*=uNelg7?L_&X6G%tnk5;Ah<C5d@F&iuS1RLNw4~L?sX9emx3D4;
zt{$WK*<_k+vQ)K0GclH!`L)3H4fL93j*dn@7lR-cB`fQ<{2KT#^<9qST6RFf>T{_+
zZWq%Jd5_(;4T=mreX?~iPFW2_JE#n`(;wtOZKGRSV6*GcUEbDt6X<%|`{8l<3uE^6
zBenM10|UPcTzBjG-nGIeYXY;6D?3IWb`>M7PTFF2l4_~)s7hD<^0#Y63`?{`_SwIB
zfX1%hSLB}Whg!5Ye$!74XX&XkI{a75_1`CsI&B|!-eh3^QHXkZ_C~b!&QOlyKLONc
z-piza!4)v!R#WLSUlG+hynmVBFHp6qJmy^%Y}9`p{C-J4r4aOE8U!u4cbBP72g#6T
zXwPAcE|MEf7+J@S^8926yPKpW*S_#y<XFiVq8E(W$Q|w3$>lcB9QQN)B+<ZG41RKz
zI}uNJg;G&AQLKVS-?TZe_X>z)n@LiQFSu7DdkLLe39>VYKq=~0>32#jRIAACU`qEq
zP@V6yO@#zW8-8fEO|ZB?+-ZzY*ll$6j_5g4ceFb!C`8h&Lua?l5#kv{eb%k_Ret9Q
zt3MbBYLcd{!d#vYI+~QkGJBwB@FJoMoY76HHIQ_{mm{C^a`7F6*AP9vRbDxRG@o${
zQ(jdO(LEI9K?b5O+^TXDA!`{pndbGGYliIz-kR!Yd8GidW%_9eHY`1~(iISrD}g^h
zHn7LhMW3Bi?;a5(YRhQ18#Rw1w+{N`YR)XU0y8}ZQ(51!uosWoDHYkV4^MuV8ADLS
z(bo%ZF@}C&zWh)6O-I_D13fEm?!CXOVK4EwDbyTM=?5v~D7<2k5jp{6k=xZd!1+TV
z+#+*+8FlDm?uOd9ri_#%l4~Zh1Gs(l7i_H;`qFppm3t-E6D(qF!_z6h{tW{=cSU@z
zG$d1668br$adXdJ;=?q3q?rL3swfbtc6|)5Shz}^r?NHA%AGJAmk{;nh$5Z~HKfsQ
z(z9oNv{r*1jK#9)noRRwdQ#M$y-tYBT}jJQu}8qsAVa{Ov8KQSVcMWQatDcByLGZr
z?F9Ib&RfyX5VWpTMYGMJT)wmn<##aG^#PD3+s`K3p!--)6{nBW<vAx0ms*f2_*-vC
z1T8NI1~%vJUA}z2mwP^4PW<xfD=O`0q9{Fmw@;)>&kkGqo>nv@c-?F<>8ji+bX$~N
zzxzqUr(&5)(_BswUEY$E8u93(U8GO^3{S&$MB3jr!mIy$_|t-aVJS3^3x-MXy?5kq
zKKt&oQIL(CwLF4so^))izUMBvMtztraP_2byeqg?HX^xjG49Oy^Cu6@bJlDRogdKh
zwB|qAk}0kH$F;<yY1<1wtU2R*inFY=XkD@9!WD7f?Rk-lpVh3XiR)crMg1W`Fd$eh
zm6nx_9sZ#vZq*9jLfv+Q@A7Wi&KrjRM?oVFvb-;;R4;HV;-dV^s<flGl_-x1I<Kz3
z<>yYJg~&{OqeCpT-_`57hlOq3Uis_TT}k9Y&-<Og=Jx%9Sv!@U*1&)gpaAe$%BKz0
zasRxWQoL5DQ_H2>@@`86?*zzgQ_b6y=%h`aH-pVnGxwaob7teA3xVHyZ`V|AI<EQe
z5FA7CK=mtZgiz_%y8G3^E7z3Yo@sa^=NWl~%T#C3I}5GDzI}8pbMuMysRcn>R+dsY
ztE_N{S@;4a1SN|{h6H4!IfQur17IJf*1M;r%_i&jtvGuqBMO=1$Q!Yi@qqh&o|5)C
z!KmWpe->5`UX`6~d0}(-;{vSgmj$Y{5P|=%MA4`0E8NP`Nc@nw({Z~YE1r%=<MQzp
zyC2{)?l8|^yft#`?CPPPUvQFsz)vK^67R8xpxgo$<T?i&`5gayg{}(x>&oW2{@b0}
z-zyC&OX$`L4Wq)ckm~gcD(R%rz*Ado^s1jfLJ38J(@8ac|K<_~=D&g~J5pwS^g6a2
zz=&}#s*ECTnRoLtejNI>%xY}+T{1c*<_p~}owVKVH1@)5q~6y@JR+dBy?&xO)3%rJ
z!b@fRIe**$k$q1?zdKQ8(_r6Ul{UP5%C*-=&@NcqI}I}wj0mQ?3dY+v|1uQ9H?efz
z`FeP@^r1cVCwkW8)pzUg6USrsE&OK5y11Q79Ci1J;_R=hgEi(`$gf|p>Dmp7mN2j$
zV-M%{zSr0QfQK$nrR#1CjhBqk1csMcp#iBL4L7r*f2_W<D)ySLWXD_cSNMt0cLISz
zAbI)EsCJ$EvrW~toaZ<9NXw~3sSk2SB}-2~$Xxp1DqK9Cw+|29=_}D~n*S6dji3<1
zBw6V>+Cib3NIRt09-ryH`tyOBQvz>bdZSt0FCAQP;HmGKP9(;vba|J4eMSv!Wy#sU
z&T7o%p#>onkc~i7&c#qc(>Pj0GW793Gr}|JDjO;5PMleC*{YoS&NCtUnmF=iaG>XH
z?~(jFM|J>_*m^)U&7+5q$M03fULh13Y-Jzy?RPcRHF3VmG{J^XbKd7}Z?V37Pf>^t
zozJkle6uX<Kk1%VuTpH<{`U2Cr~Id7^@anu>2B2eZ5d~9UhGjZVz>L%Sz}rvb4_i{
zXYp-X<(oFSU6aJ&S4JD{TRQLA?F+*j5`QS&*|%U2X<lwcEdxF(;gd|C;eD4X89Kd}
z3w-GT@qy24`#H(wmoIqtyL4aKRaN=d(A_g<9^UzFC>2L1sMeMQ1V+MO&#IpU)mCzz
zvyRrz<9LS3tt6R#&I*zsO;nz>>Fuq%W=;kCaY4NL`kTEcJ)btzbGH5P{I|6ls^VbC
z*(q|=sZ?qy_k#7%`GJ=LZTDbq5Haq&Wpr>r+>+~z-7@}@+netP?0xyy-{0P<+_A^P
zW`PPUY_q8P>bwUvimqTPs;3aDlE!eZtZoS2K&gv%pNfTK_NBq<Cui^PI!J>y^>bEz
zD{9-WSf&1c&$6Lv5svuM{C}-17+Vd6Hnv2MLWO8-(NF3GNnLf^$BpQHiNnL2?^eH0
zy?lwen*K@g=i8G91NDYReVZdG+f4%-{?hH%-dF+fuerhFn*TT`kA)bWg1Rw5M!GAw
znA5IQxXC@)Q9geTrM@dEVi44vd!)Wk$!W85@i#;4eTGIm8{hSZcRB9cplx|Y_v?B3
zWA>-%vK@%%Q(DSjwGpww+zTltp1Tdw#rb{jQ775UH8ZRKxV4I#X_=B#P)D9lHp{ti
zZA~E1o(<~Y5Od+v<th2#p=gFco}|_O*l$aos&6@3mYqogoRvXlJ6ml1dJV_VXZV8q
z-=R@i6nkE%p`2RVK=nFlxARY0`7JOB9$!tu;TY?qHE;lb;)*z_v?A}OOP6VFcM^I>
zcU`n*ZVI8%t&SWjeB<{FANH2|`OW2wuyem^%t-(SR0?PHx1phNq3k39-E7V(68L(1
zdjqd1Cn7sF_4gG%LqkIX6<t1QFp!@9YU6)~hkbcQE(>)Z99(tyPW#Q9C3^`g{^u|}
zc&}RXKIkGqumLP)ecavs0=HIO;piF^#()!<VQ`hOh^f^b5aRU5KAVAouu%IO13w>@
z>etuIKHZ-*d#W-PIZj+FrLr5Bs?PoQUJ%n-wJ9a;j{=@mKd)i6MAe7w`wDqmR#E8+
zb-0a5ZQlA;dkHTsR7QI!RDwzm-w}Cbc%MoCp!AA-zh%}h3AWFk-5wMRo5!eYKYyFN
z$vw;w+kg14ifg^Uw*1R}rlA<dw7kCVqJ`t?hI8|~Xob><$<O%4^4EZz^-fU4HG(9g
z*?qqQK$q?kMl&Cgy>VI9qkq>n0&ZC&;JwvQ`yis>5?=~}nrTi_ts1Iy-J%UUQc7N|
zPxvn9(^~+?->Oat`|-nL{!1$>D)m5b#?QXPzAdZUmW9Te5LIh;P^e*WEW*?rpLYW7
zgeoXkl$3bptbR+O+(-Lmf=$nBc3Q3u@-9rb&2)OY<n0{|>eXcnCWNws?!FWfy2)_T
z(4?TspyGwn9yR}XpeEtFlkQo61l86(k4Qb?6J7FK!L#STU3YW*=Y>sauLB3icn%wG
z$C)!D(1S+|eetQxsyv7v!5;c&_E;u;L#D6x3nEa@#2bZ;47qLCB^YsLA;=G(n@)OG
zHq_1Af$X&!QwX|=Q&5(n(t~j8y-qf#;i0us7yGk@reC$A*?5Gk(vjJ!XF4|?c|2%X
zGiYa+5w_yp*%6Xc>tCPU;rRV+r!q;UPymEnZCp&vO@GH%`~tnkzRBxT-&ZRSWsD`g
zS2~s!9%g)Ka${7Jci_C<;ItMfN0gR=;WNy?$dv^J_p1!jA=CCv<4V^>oYEc5v}F{L
ziN=byWk>F`Uw``GaayYZ4x<5)ov-B<q9_Y`Rc9=!I5GSAiZ>_{NMS1Ewo*=dp3F>f
zD+lWx{ZO1^>^n5wWlyQ2kDPy=L3(;OFp^WVc>#7M{C_zt=d56vk~tjc3y8~OHdSX-
zzw#4wD?L?)Zqo9++tJs4MhA~LY)Uvy|NCt0)!HY2DE^E^p7g`{WYt{0SI`C14sN>@
zLuyCLkRnfqLu>p4vn$m_r}%hj;oRkdE48~nv!`c!rw1$Q??trbhYVQJHW)jEfu-pH
z$o5nR)zTe79iYQ1h=0kXoO>ZV`gHBZ%9?<%$KEOv^`i|HeMROwFLEo>j`7E;<{we(
zedgiL4T9lG9QN#yh6;M;MDKj(H_g@zseO9&E8mTc1QZ_upqjOoR$YTlNaCqCZ~mxw
zteNvJ=vonMnyux%hyR-F+DnKFU!Xn>Hayp}x(0gk@VEG9efK$56D#no!zF7jChWOT
zS&Q68DkJW_5!98~Ht^2)`wdmS`sGg9<#KB0>Y)2;HPq|DNic!A+ZhrSSfeteVA@I4
zstN6|b7LNdwDlGh)F1j&o0}5Vm+>FLs#KjSubnR1Z(NtR{w7I&xGca0koEdFB$W&?
zX?v$TJO=KP=DpJ+yI&5H_*GNGVT!T}{<PAVPTg91sm$2{Rg4b2d^s>;76)$alCgx*
z(N%}f#jpIX=fvq?4GB;>{ukcTGw-m^d8mJe$@xGU<|&RqNB$b-%d0{>a{<F&Hq~OS
zGoG_pM!e~4_Q7-~M}9gnwtmk!%0nP7^g2m5Zui&gnbEdh8l3K#X@39F*$|5}&-hg8
zAvRL%e`vNcmJXreJxm*#jn5&??wEE60q49Cbr8L85hh&4Hgn{(<ZyO8<eEJ{x7ViM
zK7Wt*p9y<bD#Jt4S!ZeTjqI$jnU>plcW^LrNyMIV5hreBud~;D(Q_f(eR02HJs@Sa
zMV=uNPF|Ngv_sSz7Pz}WOwez$h!3ZDARY<-yyGcJ$ExHONmVh&{B}zuy#ePQ8S7W}
zmEDLGFa~#@YW|PN)J*w3vzbs$m^?hHOW=^2h{mclDIJ}US(^Un9h;JdUH<o6cC!Qn
z)jrifL4!}w@bnD#Y5MzPnV&4DYii@(PqvSKpC0S%lB;cy5ous}wPxV%>dU2{*4I`4
zw!h-0Wb|O>ns1(6FyFJnd$H%qL#uVKfMQ|Mb)smBgl@J@sNV#Ps}sUS2oyw3CVb3O
z3df_M2T-jkIi2uak~LxME&XIG_3!4fR)oiVGkmh|?^`3I2lK~$uKr%L@`b|PGWbYq
zEa5H!V%Df7OS%P|0x!88&m>?hCq?$TnQ4N$6ig_XOJ&wP4~x@JUtNkI8h8|NZ!%oM
zVk8~`t<D=7`evTl;PFG9tLExLs?+Cexv#fU3v(2dT>PJNxM|W2e`onr3kxzr%NjQ`
zEbE{1F$=~X^twoB!m#I7^7HyXO{yZq#1$ce*&855l$8?w%+?{vc0zmUIsUt<+M9}l
zz9Clc+<bP!wXrwb4AXK0b71H3aQq%%s2s%lW9~&mM`+f$gV0Hmzp3izWtt7xVfQUI
z6U8q+U*3A5vMSmwTPhe>d<(wx1xuwrH3sP!3q_;)xs4jH;G+aY)~$%|RS`wB1lDqH
zQ1>D_@nqzaUPreub)GoYxJi*d2)x9Mh{!SWN;K}DPk%~=&&sX36m`X&xgq6uy$gT4
zyueWPoeQR={(?JXD|dkbB067i|5oSX(=j7ds3?OCcZw;%Oyzm9>U>$Wf~C%^KW!<b
z6FcVg8#;&5R??5X_vo+k2s`>~Ck+w9+&Ic3Myl)!??=>}kaZ_hXN1cpmIU?AT)<&*
zhy=2l!(1%2L;<+3=Ad>G7B#)#-=zR`p($FynTbmSleuWOuTZ0=y)Gqf^0{ims4-v#
zu2}F$Ph9iT;)6(rF8-z_q~*NjztsLYF)@bUY1`MGr1S5!)fzKXm>FIT*}D${?u9g!
z0RwOi@7X}sM_kGkRkErRTWIKJaw{I)Vw+GW#_OuCpp`+9Vs3Kn@;Y%!pbVdanYf3D
zt%yfa+LeNFQc-9vIkDd193<?TcF%3XQcAt)IlDwsbE=D9UjfTI=D5a;^8fplIb@j!
z8QtuvTJ>%M)?IF<xS>wRfSI?dL+Ye-8*jAbqHNi~RLgFFwC;NKjVt@?NT|lazWU7!
z!+dnV@>ox~P4=PT*37lm5g~=aUNt@s=UUDPW07OE?^UZZ06$yP6OlZKEnP25Z_e$V
zS(>i&;0(@WA9|5rb-!&S;f|qn5wfi$`m)zc4nLrx;qF}c?S89mJ}0zek&RFqg$egn
z{H6Yh7(x>0DH3JBH{#{9DclgY?nI86I<KA}cj4_c|7nb6>QBGdX1bZQ%D-8h!qTQR
z8V^=k>(M*fYCNkm7Z((SL`RIclKN~)Qo^6Q@5T3*AsBvvnmgm6?ZdZW#d4o!Byjv(
z-TE$tcdzjNKwLF76|S@Y(@RRUQ|QYMFElIW;izAT*UE!2G)nQ1f5`00rk_UzZ+smq
zwrl<|-(x;}9n&h2@yBYU>%)}G7<fKHAsH}&D+wzx2h^_3-$Zl2{j{?gH>X2l@~JML
zf-NB9KXw<Rm8}MzQAd5$<ynslD`FHeT5qc!{rv=|R-h1;EOG?5IRm5>f+UGa5kL!R
z%|qgijwOp|D?_7-T7}xdb2VTnVBI~Q^0!%V<q3Ck&oU_Ti0XoC;)w%U-`_UoE}KYC
zvN}2&71337vH-_4fbFdL1xF>KmKIH8@-Z=p=kOJmdy&wo#i6Ibxzfcp(Jg`9;W?s1
z*K4b-xtAN_ztwaX-|>{lqIX7U5aP3N&Z8)PhOpAlmF*4kY5n2UB`lqZ$Q~TCn>h#<
zFdN-t#^YAHwwF=bfr<#+8wMz>CdP7pW02(;&HkqSi~tEKAxEFyOISf~>2Rq-8^(rL
zK)B%+9SI=oj2kml%a*y5fVw;F?&sk8ypaP6*WAFg*V>8>b#=a+0eMqy6Miituu7&k
zeuB<DA(Mpcj`B<lE7Jx_)^ZM6H#EvQ%RKLz{{24rxMJ{>(5lKRY*X#tlZS8$QmRk}
zc{+4U(Bzn`qm8hp(FXei(POLtjbu;7V2-8y(m!;sGZnA4UY?>(qcb{3hIz~l1GdI7
z_6{YFR!$wKm<63PRzH}dPy(;L()b(-p&#}f5rO@!;i?Rj;*QBU)>5GJOnY6~f^cY)
zpJhOPv$<DgDM>T>kWqVqsoh`i`iL~f)~8z^7!03E;x2z6*MBb8yh*D+5mmEeqGrxX
znABC8p%~Z|GN6mQ3Zf>~=w`giFsPkX5tPC-#Ricl-PgH+?4emuk5gHT(+G_HvSTSo
z+1Zaj+x7_>?}?=T7<9}BwffSQjT?>DJRJXQ5~Q>{k`uGPg?FHO;9Qocucb^U4c$0z
zsWEN77<tVS1MfVj!jfORHw!t0NpL!J$gR%HQL5ab!^j|Cto)-Y#ymPKLTqBH;7Mq_
z6r%nIreS}%t@i4ASA%=Sf7IR!Wtub$UY^0@M}3BH*9a<uP6b%(xHl>n^)EJ4H^|k(
z$w)B*%%Ra}-dKa4o7~{Js7!0(L^YaPj-G!f>;RedZFLf-Qyq}@l*s0WLoxl7_9$xV
zbu{wyV4;lDkr4^a2c8vykS_`ZxWC#N>qcY|MN+BEP{iU9<32MstAA%&bjUhdqJrY4
zr;O3zeexOB&4_ILzFV(9EG^}U;39|izp{ve4|hW5zI*<p=ThcBCeD_1ZJAhfR`OnF
zQy6g$(tL$W0lCG<pBhb7+fbgE9gi$$8Zn&ZXXMi`DZcrXYDMEZ`CmqdK$saAkKYwb
zq)3~QP+;Sv(VDZNcY0XI?gW3jFzsyPv&N_Ob?#fFIO6IL|78Q6|K*&hzUOSs2uF34
zM;Q7jTe-{S(I|r<D@v<!k(IdhI&K}c>r;Vl`i}wPPQp@e)Y-v7$<lj6Z-_`{>;NVd
z!HdTqgFKbycVB%xDL5KS7_Ct`Lh_CJ1@~~jYV{W!ckVs3y98t8`#5BakV90h0tQ6~
zFc+9s8%=qE`O0(+AJfHNvns0#C}NXcVrRDKA)m2BrflLvNgZOC_{+6cZ`<A#l%g(e
zjmyw9iTk7a6IUcUzNh7j?~GlSAj{E*zGpw!4dfCEx$@PBR0#KTzj7lYsvNWUf^!0Z
z$_rE<ESUq$=}kre{HzQnR%bL@Ylo2axD@cI|Do@4MfZt?i@-G`uA&<Oj^3T9t>>EX
z(dj&|#fW$#{JZ6OlJR=iz|s#!{)u6duCTW10fl|e17PpY_<w(JQ!0e34|c~AGlWAy
z3MIVlu@BPxgY!Bl%Phl8&oYjy8<<uTrnacN+*jmTDO&indeDZZ)tv7=!Ce{w9+Xd~
zSnA$fOX6t*akF6@buT5#phk>hru&G=j{AP(`Q1B-!*YEwt$pBv?8cE)_Qs+=njDj7
zT3k)`g0M*H9_QEZM`MY<f`u`EFYSj<KP>~iX5BotV2Cd^gK|hI=0Hg5mMcXaHyKOj
zJhMu&H~jPd<RH1t)4;1ys{w_a-4c9~RJx)1v+dOKtx<n@I_vdut0HuKbaqc_%z4WV
zRjXKVwF2W^-H%+EoAr%3ith)(?-P&4J)PGLMz}9d`19JLPg!|9IS3bJo#ApU-w%zS
z2&uhQo7&<UVv;)i7szN~OqL$Djy@>qZe=GS`p%m|D<_028aJWu+qk-pNV%Vn4+txD
zr!oTBLNu+-r>qTn&F-h(n!8<BOdj<J2@C?EhK*f1oKoEf2V&RSe(ijphB;hltmY6!
zrQB~yo%g8BVGZb5SFN4YSF~lyhL*(At;b8)__M@B06}oiCJgg@B5#h#6S5@S1*D=0
z;5@J2TzkOOxKHJdEUyd@yLXWez3Q2^`VosI25>Kt(JgG%+V}@pr*N&UHH2)<b}CI7
zq3IQ>>6O;bT@Cv6BVO(P8=)=IxI!QF$xa16@MHMPrFVzNYq!q!h6>*0i=DiV$_j7O
zRHus7H+hGi^-*!e92RO$RvFUf88PGhR6FGCX6}vA6{wrsTFgzUKg)=uiiJ0Qh)Hjq
z4dtibWd%H>)TSpF(}}H2gT4Ykgw$)ZnN~Uzoqc3rq$>Ja_=nO_$@Cjs3|R?Tyk21q
zO}bA>RDG{zZEG}Sb`!L#$SIia0AqoKZ9vEGm-i3eJk>mE@ignO{9<Y$F!%<HrRfEy
z^ICm$MzG|_D8Yf6f%HheN8#Bs!m@@pI6@lXsZgbts2EdopedfVhS|xgq_tYZLuJh8
znh6XSNw$`bg@;VaO15~Ca+-!8p77t;Z{uh8{Xpq-XEyOfe^rC|yE)~-ivDTK27m3<
zw$e3IO%8a01-A4cY+60_J#0-VaSb<^IOHM;;-$sc?k)oQdtvI-Dc;;ba_-2)Y)avW
zZg!VACd@a(<w+kWq|C<G!`Cx`f8^fTzN%DR|5UFty_27sh!6~lQoi1fhI(S*WJG|h
zQn5{)TyLg4&Fm&FXHX?&W-X@H^753J0;FZjBTDV9MjJV3Quqatfa?7tVZ~6Jgs}3X
z>AL6X(J_}lAFUrO;Q!s1SMBbgeH`wvtu!fIGK+eE%_u-ZNDxA(=mbW7C;;Hui4x$~
zi0&|Tn7<xNJIgs`WAv2$vdb04LY3P*b!wU2sljk3;&BhROX1O3o$7D-hp&4PXwk;6
zmh-TsfZJMxhaG{U(FzMtwd@{>RN!TZ^q@?m$*xuy2N3_0^1(!o^>Tj#9%Tko$t{_-
zGl{L;i3ZNruj)4yXS*CqY=uHY;Y9JiVw84#kY-C>P97e@(Git_@T-XuFb=8H!$~&~
zu(y+d1{yL`#Gn~tU6!OlTlS)0!>H7Z*0dG$^X|x6x^L6m>`hyesme8x*A?^#y@Yli
z;cqpU0iJq~<F0EPBkj}g<xzGAFPO1b=|Q-(2dvbh*BG=-Fzl30a9W5exNIN=W*skv
zmXv(SV5*Iu3r|p9CZgd2TI?4mQWf}{Li{AB%d%M!WsjcZwd#J**)$hCrH>Uq4!v4a
zb98}RQ)TF-7=>x+U;y=}tVm3j%9Un7hIb6LEl2-Rl6$+a+qidj*+~egjynnugxAf}
zXC&UnHt1}a;8oif79kHm4Ae9do(-DS_k9vr`3qfs9naNo{02riD6AQ5CR|6BJL`_B
z;4XLGOys3$hcx0jau_V0;Efjf_l6(tN>7@5V~Ur*Pjvi_cFBfb8ea6AU**0aDt*hf
z2)$9LFvK#<VD-R-juSHnpr|ypnBjy5$`g6ek<++VwF8ZjgpECOTp_DGI3S&5>>K+d
zyexn>=XH}a;?*XYx*74V?v;utA?iZkHLDO5{_gxe5jkr&U{}LE|LiI5A65cUc94yJ
zOKK-2HtL{dGNEE8S|qW?fy^hCCFx#Fk1v!Zq?&TYWfw=RZDM|W$!j$=@8z5*3{~uO
zc{J`7X`p+sIHYEG?fpBM?H@-a$ML@sL&>j;6pz(69bLs~TFgGMri>t2fUmqTIZQ%W
z+9si2vZ#<RzaPMuyPRi!zbrUIP@WtaS?HJKb(+7S&-eRYF}L?JN86I(5pX1DTI21X
z^T{Oq5!6l|)`8$KOO-u3B;$H{Xh<wt*lXxWM~?Qug{PH$=lKjbarP16_r2u>Pq;Uu
zE&m9ptxkJc{XAKcxl{gRO&1P1`5#yvF}LQID+lf}A^d&%{XZLn?;aI+wXX`v{(kZO
zyTqF%Mpd`8@28$#_4|f++-A+c0rNpXEhDAFN-y}ghnZT~8)u`c9xLcY6fP3d9mL?q
zCvtThb)32Rf+4?9qfhq>Ro393++cSnF<izL%U_nsHQS<My2{=vN+f>ArrNzceQc$_
zym$x<Tr*Ifz^{W4DGM3b<t`>pVURxVF(PKX1xZtUD@5?%?vx;~30Q#ToHAr=eJ+Ej
zRJ)03)9btnwNqS85%)cLJ#J)BSr8g^C`*<`lJ$Ll^HI=!1G<+8CZV&tM|Whj`ot@q
z=c1LEo}Y2McH!A^qq1k3(_nD^?^nyr0G|3GH5V^YD%iE^TB0Zyk)1%2=7?>OpV>0N
zrIM4mD}0-c62bGK@25I=zp^E1j<5Jo?TqJ7Z|`kjC93eEDg41r!sLk5Ly|uSTWW0w
zZ-E)N>y<PPe9(AJ6t@7@V`^>(`z8T(nD-I7IJf|$c?+PHgh&NTs$86<G*zwXtG}W=
z;eJl8A!4O|!37Bo>4)Zg%V=)BGsb@8j?pFZ>ibT@#0d5hH!*1is(oz0HfyXD4OQ;#
ztG7~656v07Jn|mFA^w%~3x<f^^~YTVu<QYb@vYL6gq;?H7w>GpF?D-|^57qV5y}^<
zUAHxDKJ<qVw5Je7zmaRaRQf=^AUnZ@cdz7LB;QC?x?p_>A+6QQOK}5rkRabUrDv3O
z7JQ7Xt>!$YKNgZ2K-rf^M)#>shpjSrN=$OJ4Ye)FA}k4A`sky5*X=CG?ruTzF|8Bx
zNhtwzdwGSxsko1xE^sQ3FL|@AI6nmXNK7jVtL$T1Q=lawN;vk3?Oa!U=Dzaa?bPM>
zi@P5Cx$57FikWy>-5ZOrSglBs|4#I|9N)p!Z`?2uhGt3dty4zye2L+0m1`I+Feprd
zUqk1gZIoLi&(x)O>>TJg#$lZvn6aGrmpZMqbl7Yveo)1!`RU{)oaBSXN9!S)!czU1
zNJUnnSuMn;9nHkms*8j5Yx0^UMEzm(yp^*y5kGDiDGy2C6`I*zgA@c0)Yzx~eLM4F
zmU*tN(=kh@V;@^yN(SBfEvj&HX%a8h3h*(1lU;8z-Hzr1TitfFIG2uZG9~oYdyVN_
zGnXY)Wf~^hP$KIGY)i_Bd*#l>C2mFIo;y5{;<LWqFVl@;8v50P_k$=`cH)?R^L=_>
zdLf<s6$v7+Q-J4m?^`wGsV4`CL0@p{@3EDj8OX!%V1j=MQNf*8`3{ANevDUuw8`h6
zzV^<~o02+2ltK9C9ssXc>Kypz#b0nG-Az>sus^~VsL~;g%zYckM$HD*cV8egX6Wa=
zgn?`vlGULynf-#>vIB)1>Ec0I=NFt;qSORK)ZZ^qm3%GIeWlga01O1U@Gm4-zfeIn
zqG4s$S_tb44v1^=Vj#uNR;_~Q<>VPS)63_Fs4hchm~<@Gc}*^U$^u&k&%KK%5#;rl
z(*6r>{N5Pk<u6Tt9at{wp9@?LQJu4`0X{23Oa-PB0#vvE&Y^$CTDw;v<G1HxiN6t1
z8*A*u9l0;oO_C&H#oVEPV!wJYxrBet39CEQnMCP&cmS<Ed;zw7dY(h%Dbid`{3o9F
znumR|{DSl0jj{jzf}1(6Spa7!hWi#KvxcC)M}iT5d?~Y@|9`JE{a_PA!0^jaCRj1W
zzA9_=p3uGpA|MKnROR_9y1(G+z?U9)g6hL0!K+UFZ>{IQC7=0UgbJc;FaF=7){_uk
z1>)PdbH&&?s37x!L}b3{7}jYjk*f$IYr!jnRWPwc47!qiA8E`1an$vb#J5|Gywq9U
z?c}#&<ntHYL@s`MG#CHYLUHH|?ml?JqDKTpK;xn>xIR~C>HazpwJ(&X!J03G6Mp|E
zL{u%DnX$%7Q@6zu%Z}hck_|j`ph9{G4Ro-_g1VHznDtR5SK}DF{)f~ANS}jhRQcVC
z8?b;~@<^;0{}aUVL>26|yL;q8*b7z~amJuOSVMIPwkv*S8w~XvNFpysDuwFXLWs_1
z!qGw17u?(<jZctNXR97S?h*!hF-<-Q&{nKwF9C+oT=NC@PrUGT4OWjiArr?LfK;FV
z{Big!vGu<$8B)l=o)6-6tNpmkxG>-4u};xnJAO77sN;x}!}SXwjy`!@vlG^2P?d)$
zo&#-X;v~#dnVsxvtg`|<iyx3bZMdQwq9TC!l#D$hCPJ228w}Ms<j*Zx*vnI*DJ+W-
z_CG5aIKNqxzk;?88~(-}*yYt&J6Unoc^&d`5oIso{nY#feO=covW!Mh6}l_tbD$-#
z4Ij~N{;~k8=!2ci2#1M>p#%_>yV$Fck9q2nV2wFGP)1dX@v5?JB`obwHa!|<LUZ!{
z{~SMaVg*T61}nD66(-%bhdX^;p$Q#M_OZmf-KZH^RTPA2!!Zl!>c+}gy2mwViuMx5
zDDd}*utniiyKpD}<x<FMat<*UpAf8}oP$N#P5fI3sl+tpR<bsCMr-hqhH`f<Ue^5;
zY{vgzV^a&Qt3s(0eDXmbW(RS>CFVk`ov_f^mSM<e=u-<B-=cTq6J9c6Jj9;Yn~bRa
z{TcCIr}z=wf_#yJy&K38WIn;z%KjPrH{PT&@JJ8!BUKU8wH{%|aVl8DxM>v)ehxDZ
z$jD9I%V6b?Vc*d0!1;HjNm9ws*BvkWk%p%bbW~n)qroE${6R0de}kBHi)bV=wd-N*
zDyF0}jeBiLD}tZ$azEy5Z0Man(>rmxF&8rJ`tUq10Byb4sf6XK^>VK!Vnt2THirIK
zgTZjCzhRx+wT&FhUCybK8q8j)fTlxZxuJv=&j`wQd9=SIx+s;lm;bPlUsTm6T^Zx7
zc=_=^_<MjFM=kKu3gtJUOr2hUB9dd7X6P}<zEUq=W~_OPT&7!hFjo)$UHL3Jy6fBS
zc7l$h#~4A&I%)D|LEHQIa@$`SZj_>taX~?QhCx<w$YA7N!Ufa<(-Ff=w1a#_Vgdu2
zy<c~DJDbX{CKsY92WYyCKy@}_O<Cjp5}&r{0P`X-X$`~g6~jwB@xrPw^<8iMz6ax(
zWm$IjuLUmr^FuCS8S^#qiK{e1sX?#f<t$d0HEL7HOBnkkY6Frk-B;=}bzOBXkAD4V
z&GX$EX%Epl@oZAPm)LT6#6E0gXzfv>;g7W^N4#G=8uDp-bjGPk6U5s4QN0e+ZD_z4
zqRDWREuJSD>OepsE0;dp%-r0&NjJ1{t(+Xs@%0Pi2|i`*vfS!5cdRTR1PL)SdrVq*
z=|rrciNN<rRGG}DR-CFTDyyEMVam0k_XL9B;ckfPwxY!*ihP^x4}T<&x)w670t)@p
zl!=c-Y@>E=Z@YMBp!em#g0)K){A;FkgS9<_P-%ilMTd+e?UAsP(oL5F@cRk+Bk=}F
zCOl*m1g-sN=)s*%jTvH+4w^I3)-rLVKf*y8<SE~jn8Ie9&`c_~RbS+J`Ic$Dv)X{e
z52m3hotPGE$pdVK)fXJJ8mB-~Y6)WfXDm^l8%z=yD%xR{o@1}mop;K!bMocUia3-L
zlMjH|E3)@Z_6OS<Q*wi=?~zHcnu*BrdIzVOS)hwt@k%i3)&Kt9iT=xEsbS-Kc}B|2
zu+$5vg@$wS97y*X6HqIXdQBpBi989Xxw|)(Xx3=YSb{bvcd0z(tY-Y}QH=r22*_j?
zm+elGu$NLwz{$0{vbMu1C$H$NFnI1=8nV=V#JJUdd4BN+qfc2*jYSVWdI=)B8v1fg
z-S(P}E5Bp@1qoExv+NXq6X>e@j$u34_$^4B?XAsllQrI$izw{0T&)^b`<@w?>6BXX
z8jW6sqeGCx!><gTJC=MtF#htCI3&*tr-l}dq)Uj1L!7=y__qRiihzYaf<r$mY}Fht
zr5oLtAqAz7wW@7=v5eei@(sV0yo~uRV-xJOn2R17zSYZnMo_XuGk!x~y|u)W!p2h+
z1NK;!d3ITFR6%;>L&4%Y*5T)U(<6s96lU{R9ysPjgMtY4eKt?{dg9RY`lq#=n*M2F
zJhCdVFTD8Ey1Sb>mP<Iu?Wpp5o20jH*LYTZ%=9lPa+DvcsWwb+_r124h;PI(JBigS
z)vCcUZrUa0VxVeIlj_SWL0;DaWy>A>S>CcwscSPck~owuN~`lWc}JQftrVp+3v6eT
zZ6}6b{BZB=;IuLoIrBW)>RZd<e+_{5_HQ{}Wt;_@I!o66Q#n23l=|jO$g~g-I=;^z
z?aNhNQfE1Om3ss}93ml+2B~61TXlZG(L>_lbJ*%{4~KoSPj?<q)V7Ve6pb5E6?tJa
z>SoOcNV68U8Fslp&`JCN@XPtEq*t?__1LzeYvSl7n4M}D%3gdwU$wKhyvpgkFG**@
z2P=`Vl7yO|%t-h!YiEz$&mB)5qxhXV&Y!{Sbyy_Mc!!S{!Pd$nrGYSEkjf;BB6F2+
zUe+j=V%<cYaBs#^iJNU2LA7R(34KnIn(I{s{B6XluZ1cXD2xGS+&&w+T*Etw_7iS?
zc1<}JednGZeEy{OZC!%lar|2|Y-t-zM5?+HoJ~YlQ3ZvLlQKdwLr-o`i8%$4-7;)D
z8g@qR6(^RbW(-lwRM#Hx;N$dAyH+2I6yzzDwYM+useEmeb3=g}bj|ccP^R$oW3&5k
zN+EEao4C&#542mx>R@S|uTcNqxRRZwB1Vc+x|4`YolVitZlGzXwmh|E`4h&bQhJ?)
zn;K5l`@U~F|60Dz6^4^D=fUvDT^}0_`)sWBhQ^H)nG56q9|mP)KP42=nyu?MK_3Sf
zM-V4My@s)GP|EO)7SV1&F99K0Ma-o)I%vn3LwIazXlfuY`ibMT%X6?QmFUX1?YUA+
zejRF1YkFIF?&iC;ZL2jVtOa4%@~dDo?lSwx-!RQoxWVb}p)qkr0`psX)cY1^OF6NH
z2n3ccaz5(y{jg?Im5zg#oZLn>4!LRowI`z~-rSqwyz1P!-T5(#SusU#{>nJKKqZ~`
zA!~$B3{`6vDWhQ6_Kk}>l=h7EDWbtve0=6bZV7t5#mKsywFDX|2Ti}Bt?+;I5nJD*
zS|1~}PV!%v-o1B#u`l`&{qEF}zC*>Ud=y2GLk)B;&K1nP!O@s+gt99Z5O6F0MK#Kq
zU0gjYrY1<w&?H@6ZjJIssI{nj4L!_Xo_;^SbCa~@M#KmS)_tYpwbinELCbjU$V}nA
zpn_1lj5+h)77FrueNXZu)@chX>{M&#eG_eUJQre@Wmp#rU)H#oaTL8Kitajq8jX#4
z#W4aTQ2%w|4Za%<mmRxTN_UXB#-4vJEC20Ls_Us9@xWw6YQV93XBv9N1FngsRVIdq
za1un6OO}yY!-JTXt;~l2x&bN{YzM}c=Y!L5IiqzvWFZK(3bpV_l^-HKGg*l?!nLFH
zk`Bziw%-Q7d?Nko=mvhc!_x4w-DF+RB^xMNT!iG&nSPr!<lFu)jOc%>KpK63D5RhT
z$~_EknPG=@T+WU@#|3gPaas};3a)8}AwP%AX4pGdTr|;t%Ll!8*F*i&%DRwp8#UQw
zU|Q<#GH6p$H)3{%&jxHp-JT}m!|wl|+Xtd6DsdQk!KME~WuT2%1r6a63R#!_x%IeD
z2&gdUdsp8P<26v1BX`HA@!!ym_fxV4d!WBeT`iTKt8MIyh;cvO(5Ko5$dt44-Ib*i
zQL&nT+ANrZCokm6r=%4iSN<B^B>|sr^ry#kt|I-O57nBNvy{UxvxT;mVcsm}0~#6J
z73=$^s$xt##f@bTAKpQEWMH-uQxL83PG~FiV5ihuJpKUGPSa2D(jv?VfCP}xeR!GK
z#zp-YJ0aDg$i<J<0X8Ep1!+En1Q5|Jgf_BZs>2?84)lgA=_#!_hNv7;_e?^a-!4#V
zdeuv{#tczmb9$uDnzSZ+YEdG?!th3wHC{Mw;BUfbSc*E?i^w4ZbEfeTIL(ji;kKv;
z2DOC{B5FatdX0%|%hatsrenma6>Ch#OrPiC{}2wjV_H4RQ05;jP7xSGh%huz<xx2o
zc5%x4){Ze-cAJi=AFY{XfKUEAXYP>vYP`71rNzs$>j6a?2)vqhH)fD!CI(9PO1{+#
zS=C%kB4-_bz{wX|{tmt^H`Ly<sAve)R5-o5JXNLabnuIGLr=?hQ@sv8udTkj#Fo0#
zBy22!^T7R4NN?@vnGPTnt^Q?pdwXrdZ!y6aIlpMg@ro$*FGMOtWvmW7;k9Zh@YE0m
z)??1x2#NJgmY&Mx8k-({c;!cDv;I#r)X27+J;0<T1x_YCK8RIN25TyL=FcU@zEF@2
z{rrYk=n`}7-G<nhW(f(k0|kj)V$$-7(JlSl^CO;qmb|EK#q5t)g2~3ji$eX0A4BGx
zZq3F29Yu^+S<BPBfzHg<tGecXxLT7}d#Jd4!tkOM@i3nqp`8^SvX`iTS-P!sTlpng
zS@~A>rE>GC`pUWlcR<;egcup8P_nMw-xMcVdPkDE=ETOE2QNf;p4|LR0}gQ|%J$Kq
zs_%m&o?!eagSv=@s3;M71qcbVKZbxvdG}(KpS?l04B`3P-QRl2MyMCe+ys6*@w%r^
zWNWtTzRHv%K<q~{I_pPI<QY_F%+1En9Im$%OMUm^)OXcYKuUnxbC5vVZ8Kn@KP__?
z4f0+vv=Qo<FqvDa$P-zwQTfZ#;>wFS)$-GjzO?ZmC?265rHA+*P7258-Y4165^Jj~
z#CV;N2~(?H4ng~)(I#$+jV@l)JC7eI=ZX>lWDbe-&&^0BlFHZw2Wm?FI|Hvgh;>Dg
zZs$<9k<w^lGM?_$gze}{pZnZa8`MHui588Ko9afc4udP<M{2KKoc$Q(ACR?IS4aK6
z+f;AB@m%>?da1@ZRI-7#!4je{D+;6yT1T`MPoes3!0Z-QUgd7fdY}rB3nwS8iG=!S
z;rsd6IrQcP&vYA$hg1c1IEA$cbt079iea>-)qrU#lQ#U>79jQrYWq3Z)S{o^B>6wo
zy=hoeXZJoDii(O5K?VgO&Zr1!1*9@Xi;9YfBPa;bDl&<w1tdzyR**@AR8go{h>C)W
z5S1Z{K!gN%m12-70!jv|jFBCMuqDa%EZX<|UFXC5JJ<PN=hOKhUNtm%^6Y0=Yu)#{
z??uE$_FEFJKU-4``E?%YI~z(c>B4Ue6D$FJzFAbB8(BLU+`!Vocmi(kbZ>*erlR2-
zQX);gR6%?ZL6ge81*T`SQ$Dms|5(0v2Dd0I`*e)S%Q$-@tyrZTwqg>GHVPbw7hb-~
zli1w|FliF=y$y$*wiNa`Bk{N%^fZpM%-#;fkh+~>l3X_5r}JcvEaNH%ORoM6j#toK
zKd86+<)s(I72y6eKdmVtP!7UCuaL^J)eCRjVhV5ql$}Qql@-HUa}zmUti8W;jD3OW
zsJT^AwE)O-2e7c7k<Drw$usq4uuh%b$=HwfZ0<PL?$6I#T-oB{HNASgw_NIFUH^Fi
zpWmi-kp4y_!XB0|TiEC?j+dtRgZgw2e71qg5i?arX|9*^7QSU098zmNLtj@*#S7^-
zysilMpv+VS?GRen=$#Scx8?HPq0Xj<n8)Uh62{V7;DD+`hYa0iuC%&I-2nn=2^34v
zU!mM$6si0P(?&;?k!UXK1u3<6Hn#tE59nxgiyA1}*s#FT?v2{KpdqW*0(>NdiEgXt
zOJ0B3fac{IIZ=}Gt6PJ4ZBd@Fu1i%vMNquk<Z^-=!~^k{klJ4<5khPgkI&O#EW?K3
zEX=Q^=v6J1IkQX;(LE%MiB(?GbjOCkr6!NN26EV!?ka*aT+ZAJ)06tgba*6>jP<-H
z?aT;>-Ba1IX58~>RBZan@7T2*Y!ORs%<Y?~gMuGu<5N|n@SH-vIK}TLdP1EOCj~N!
z8CcANp~_`#!s!L~a04t|;aSK00j!mlpX(i*H`Ggd<aKmwUZa0&^GDXb!3j{0wr6&c
zP%lbPGCoUPqt8}8!?Zb!<!x0=(PO%20PM;eF9KcBhT_=5?<R7#fyxiX7!&eynAJvv
zULtYmY;G3UHcvla??MIP-AbKdZXFwQ663Rz!OyKR!OfBy3J`03IBUj$$rME-F%@b7
zB!hBx3T~a?#TrpovM-Hu^wmeug6!hqj~$ERRsI39Uw<PUxI&cM91n0m_>9+H@`Cas
zBDq6Fec`ggXJ5XrcFI<!RYAkB+6Jwxo21MJ=BB4q9?W;sVNp9uRzy%6D$}{CF1!0&
zkv)pQ{6Y)LPj>IH#IiW&t*tisZ=&LCCw40=K9y;G{YP}*IV1)ctD$#kOBG3?0o^H&
zi|XA)2SVHyq8}5EL_Qey`&j<qU43xDpr6l;;Dw?X(S#^+Gc7!vHm}*fb;**_?}5$k
z3#mv1L|6rR^9#J+)@<IEzisz%%`GIz|4jV9Znb;TPAMAJOMd%Kn{R)rd0x=6&Cx--
zh`&Wq&WX`okYZSg<YJU36(vEcxgGOXMbgRjpf!XW(|!4;oyh6x%|*jz>PY{PQR!vr
zSH?k!FePukV)@nXywsxlAW*}fIegZip0GjW^YNAI@s|Wj1rZCQV$KQp<!36BZv<)d
zloW9O+rLxlEM6+)qln}QWC{m`M8;MHH^Jq|9f)Rk0Nuds<ar6@LZ{`zwxu98C>52p
zkJt;7@`$Z+hcu3E7)gs$WqN-&Cr*?qQ6v@RW7&0n>=ec+4r5cNLx8WpqP#_C9Eyp0
zP%6;*1!;Ap{47@6;=rvLi-kHU5xTjd5E*}s`BIGTW2HboB&v_wqLNO?pG(E&uwsm=
z7R%m$*NMywr2o?MHZ+s5sKdo>`gna-5qhz|&cw_uLE2Sj!St*L?UM5{@eF!5(XeZP
zx%Qm)SSh~bGrTvXgm0`hX$Y`Leuls&{w7g4idi+vW8nGh!ywI{zMiMKOF35G4mTd9
zht@a8(&niGzbrF%T|{@35#z~6T1kgm+!k+idoJ<TrTa>m7wpM1H{Y(SS&jxKO1`Ss
zONuFcZnx)P_wonlkOLExa<baug-t&N{X~5GdX4+4FA-JYXhUquqjc537E!qAFLI8l
z-fW8KH~ewm_f5GV^8G9RdWzuO1HzvwRj~SJP5z1UueL}C*)rVC?hOwzq8V^8S8IA%
zeGo<uIi-&`6oo2G>&`}tFF52{`Js(z3&Shz=#l%-Vm$T!0lme?klEtlJj;#^lwIW<
z%sCUEo$vr+o9jnGcTt-kQ<-ri?ntoA!c^)jxIdmgW9U<-e{5X%wqyat+(GkQgtuqb
zrkclThg!;uEj{lo@$v>{=Otw%RN3&?>?a;_4osUJ)~1*tl#uy6Gv*s)etCF$jEq%J
zHW+eShAOYN4!JGwv>mqzt`A%fKH;VU*g(w{<+Aj%pYV^4BA3nJQslLNlv!&$-g;;n
zK@|yEDSDC(eAPNjGX*itf&KRRzBp3dq-C+pX1_fp9S)C+<ppg~{<`Vgzece@ezDKw
zv5aOgl+@Y1`^Zf!W@|_E`@qqc;IFh!wd*Oj;;QyrxS<k2f`BJ^Or2d7s~F~s(H*pS
zC(}lAXCX0^OIpCRR0nvOZ^8U;hWni?4G#i6{g)*GLepw*M37|x5BCgBu3+Evqrc~r
zvx$M&#ZN#j@e?r3$~vmnYN?u3JD43j^t1!}1u>25woH>;qpe<v{^d4Z<S!r@x=jmb
zPE$}Ch|>qCK}U+<@F$kVnJO!>+~OvgwS~*Om*KIuv3UZshTrl|KECT7iX5fgKS)3b
zQ-$tt?f)qN{~x1GLwoCZpV!bM@fS`M{Dyo$`|Eay0G{&x67hZ(s$2rBptRke1|S9$
zy=6q4==6<nIUJt_`Tr4NH-zC^-Qe@l?Ek5zKVzd2EOkMl@_PVPfTr2$jSX)g4ZYkz
z`p^&C8n*VUKqiDoT~?U+H^M#RbOPcGs3SDQuz8=a2r~c!p%?<{z-0c}u7$JU&t@um
zi2c<wSpFVxm&QHc2yK>$8%S5LYH9dL?eEmja6ZJReIvYeRKjuC%IOA1S|tE4o)k$J
z>+6qDr3(faD)SrRK38t~PlY~7S@eyt*vk{=jZ(&LZztUP&*=XR3H<MW>5Scl?R5uv
zb-<pZa%5lPHPwx2;WuEEFfR00Z*>7%*#hVWyHtcfDSXjQP&@t&=HVYHk|y!jmt;+s
z7}q!ukVqpfd=&x(om^8ngr7lQ`iS^Lioq_O^8hKWh4VB|{Fz1Ro`(w^>&26I+@|f)
zfuvYbh;Qw$XRB5)foak1zaRSc%%=c=_UE`B#Nb!g13y#gJmr7Z(b4BePyr+l3u$E~
z%+PtHD_<QAFCfJ&I+&sbiV?%`+BAUDukOKXNy>;`0F+u+t<?T73Q_|2E}jZrdh4z{
z1JCdV<_yoz7p4g*pBUkPBdq99!3etaFi&`f`sX*0njtQ-oDQD_4G2?66xs%CIFj5B
zkQVL#%q}UPH$?{iy4`m~3x0=+LYlKT0I;mLJEx$Lo<iKG6h`U;Z(I;YYEn*#iT?dc
z2KzIYG7=1+Q?!hw*+(h|IMFXk3qL?bBZJiidzIG#xjCwYie|@jRCbP{y%O|_U=>r4
z56jsLDI*O`nBpO|=K4Kt4GH?6n6TBKP(NQI_l)AN6J&+>9Y-UruYkh5Yg8|Q$y*P<
z{@nQ+L0oW?`03}rVH>!>)W&wW(3moD=AU8l-5{6v$JTt}Z-1hMGay3+mlCfQ8XQ|F
z`j7y-^GU>-rBHc|z(}}BVftZ|n4;b$4XxXjkG<mabJ8zVUc~kalqHqy3*|TN$)$>Q
z2{zfO_D9YDvCgBzfk0fW0Sx#e!WF9Ll}dTZI2mu@>8saU@dF|SBs496&XWq$Y+O#=
zrTh9ny|^kWmNx%}b8Kw-cSHln?&2ud?XfX!w$Zw)>|c)BM4P`~BHBm5S;*mBZCw94
z(xol2XHR$8kEVgctkwCbuWrU~@fHI$<tdg=<aaH*UbR^B2w#bQx-VPadaT9kQjI~H
zZ&mD5#<Iy}frq|-xO=6}hY7VQ3pRDU>;R@Mxd5ABZ*?&Ltf)3vkx^)R{y661;z+9N
zp<SfBtxW6o=-bL56@;!^+V~mULBCaHx`Icu>A_A@%*n~e=N6_Ko}*A<Gtl&519T;T
z8qIoOXA0BY3<sGDXxb3L6jPMxAP(QyXin94IWcKOHT(;Ne8wpz<kT%!I*-f5^%GaH
znpTr|QT;ZWY-Y4I{T#)JB6&Uu1hD5@D=}gm+(oXP4;?53vhqIWbx*xGoBxQhuvGEB
zD%&pX{=?0Z8x|{CMY7ui1*^uM^9=oL<c*1m-I&{_kcW&Q<9j-@BtmR`8a{he!k$H^
z)tRs@tE@}9=|?xWm03pw*F!<2YPt+D8ah20^w8(GUdSTO7G&DqEeZS5X!sI&Fl5*q
zi~MrzS!K?_4`&u?e`!<x1(Ww1Q#8e3F{V@Mk#b)FzwclTY0$Kil3=g5baQLfDk(|7
z@xeRyQ^jFsF-i93v0f`|!ViUeIoSjs_}=Z-J^xUr&BX#at?*#|T%Ef1DOA%k8NDH;
z2#^e(VU;l&D<vkBvq|b5pydOqG?-oO<TPEk`^Ce4mu@WLrZg>ESCQ3n^UCNR(9=ot
zvi4{LFX{k4Wz&w*%F1)vldxM;_Q9ShCXHD$bO2>}1MB>A!8wX`%?ili%6XFCcokbx
z3$Z-0K&%DrBMC8+v~-}JR_hNIw2n9H`f_<~#Z|i{!np!=m*sjOgFPo<TV1S*&&>GZ
z(cVfirR&z4To%8jXZ}=1(5!%uyUmk8*f4g`Z2=;^h{4u>6-H3|Y3}esDe0v0#s-?1
znu&cQ^u>8Lisz}%+>3ke*EuTqWvZbzUeD1Tj01u)_&=eaQjY=c+%~m<KRtsTJln&_
z|IZAGC0qmBA&4v&$)~I4s*k^Mb7eMD=9YUWQw_?(t>u>fJ)191cqmMhqqlG~_oCc1
zwd>i^5PUUSKi-^`d(Z23_-XEG>mtzQFQpkd)vyWzy9rE4t^~Uw*8r$|4SNm`t!LN)
zj=l<~<`S5vpdR}~C@+M?7ojOsAIWE|<96U{)h8A481TC5i79zbA}0UNAe#L?Mn*EH
zKN(+E-g>(|di_Y0-t1Q^S=Y}*7Y_REzqHQeHSlM>IXp>+5VPKY?b?UGn7Y_frZS6b
zy6Wgr1$#?)k0{>sTEv>pk9FPeOG>t<M0CccEVgr+bv#wq=^VXZZE)iS2|eIFli5jK
zPz4Wj+Hf0y1u7Z$Tv@t*9lNX~O|iC443#gbCqO)A4XK6n;Jy`?`<!(-`hH+3!Ppxt
z0~n!lvohBzW6kJ@`ef9B!!09>XnO*wRm5Vzmeq--oM(hw#ze~F&rYN4lnxv9H1>>Q
zmq_PaOLUFfoadEjb$U5BZTXKZKG)Q=^B4Dr4u50@_%{@<B_J*cy4k`S*WDYd=uut;
zOzv!$UshV5bI3YoTMX4A@iFSF2BQVnO$YqxO0mo)=?+JcGW1f`S>|{;LiRMGPm$8T
zJjwC7;W_3c#KHY)i>G28H!Iz5g!v5Jnn#eCE){ISg_5gOJsX@Ha3Fo1q<16Q9YExp
zn91m`J&&v&Aia&rf^LWzMy({(=HhGTD8L_h3tU}C7368P+bPn+VMwVr|GAzApQLY9
z{zyS(Rh{9~N_aCkspCXj8F^-CWpBPwaS6TL{_B?V2cdq)Olh}5_q=^S{CSYq(`(_i
zPg_n)W1}a;U<V7uRzAg?v8&z9gs$DtO*?O|D>fX;n~#MnNZyK=jB!`%9lPCN?aUM=
z9(htxrLepkeAw1uTFY1k+pl9uSys~&A^6P0vf)R>-*|^<*ix~)5mwqVl$Tx=t#Y92
zY^+4B&W$(Gbcbpj6#c2i>IG7e47EGxe*Zn4#_vx5Q2nBFJeTBI)jB@qZ@JEFb6)xF
zm$A#d9vobDljOyOhz33Bs5aJBhGBM)RAkgRU=b3MA>B@zl^7{wn;wKjIx(n^XnYV0
z-`Qi!E$N}3?QQ5CQhB4wKWrU}Bjg7^Jbv?#R<1p-K77$GB7g~qB$daVP#aOCS>=jM
zAmK(z-@45o3|xfh4g%i9lJ!uuL-TAqPqgkW=1c0U<7Ho{rRd0QU5jwv_%8dDX#cD?
za`LEym))T!t>;|#D(}ICe-<QF*iT5c#QAs&)zED|-CY23+?G8niu#f<|GrqNC6pZ9
z76kO~RV3w0d(2lln4p~Gqr1<@(gR;xKUJ^K*Axnz1gDvnt>fwb;JNKS6<viP$0*n$
z9cbTGc3>osyf&AT`N)g`o*pA8`W`uf26BcUn`+It7t7LJ`x0=&T=OlJ<&{<0brTcp
z@Um71|7+!DkJ~=cPAq0`&*JZ@Cj3Q#g@i5UfmS~xap*-dFm2q-u(K1=Lw@q)WVO3Y
z2xwDsV}+Z}^G>Uz#-FMcuR=S2X_n^d26TL~VYn91<0l>7+)>!zm!(~!hdUiKGn)2+
zj!0Jmt|x{I<qz21(-?XnzvO}iNrd1Sjb#=T@Fb@cl*V<Sf<;PUSf4iWGObtUS@Is|
z;FLM^yyiX-w|nsJp#gBVp91goD%Z*K{@o$d!<IHGI#LUz02&Y}Jov&n>I0hFfHt10
zSxC<mtflW)2cV<%r+Xb+8Fn1ksu(9PR@$A?ii+%wRD(rTX&bBZtR7cAZ#y}1>>0N@
zdncDiP~V=K*PE<FSXd{L)y6Cti!atuZ%UB*o@3}n^tsM%6s*fL#Bvq-qFVM`duP|}
z6t~xH^}Tbe+wK7TTw?BXF;+|*l8HfEk~*RZYuwp!v-%O2fQ2goY>D5AgHiQPFHdQ6
zp?opg`&!Rh_W0=&)H{u#^{~E=Jv)rKtnBFzhcMd!?;VNDA1lsPghy;|+f-E+A3*i0
zRBcJKz1__$x6IL+fa8K95rL||M;er<dB#XxCAL=zHiu)b<U^JV6-a%A-4=z<h042E
z9gFT@EDsY?QkUO{bHDqC<wSa0cLjRblw}02xJi7?=>g^bP*o_jR~rM9odkZ<4~A$a
zj1w6@;&XZY)DpKvgA~JPjy%BG{Ta$iI9cXw^;F~%exxXzY54?9adYofzWWu7&Lb@T
zxIA2W^gV%jWk8IElhnqgK5xc~eP~+h1#ecgkM&sm6kvW3Yr5s}Fw`)xyFPNo^#_ed
z!tWhuynn#Hp!Mq-&S-?m&?=wqPao%I{;2bjC5M;`Y&(I}aFp6jl=hD_DUv11LJB0=
zm%MM*qQ8>9+nMLk;$|(z5_Xri$j4aU4WHfh{ZQq2atf`u%qE!sr7@^D)HmBHy5oI(
z$YgKAgRpa?LWtwhFc3v6h^1T6W-|0DLT_F4;XcLQ+(}D2eOdeWV1v*rn^vT7vsY$p
zTdH4p^ojI$?ay$fgPMdk2tl!d^?=O8p_q#O@NkG-<|yz*RSbJnc)=<mu$8&wE&W=_
z&rd{*<ub3%9AMe5IT<An>k%*))jVq(W6kC!S8YBe^Q>OoxT*c5grM2-zr`>%Rj?PQ
z2{h$uEmhb674;U+WtfO`<Uh!oeO?J`drjNA$Ysz=W~w}!bl+4!nnN#GWFO}*Z7xX5
zAMSq5l>rmzHQG^_RJETbv%4FXXR4Ty3w8~6ARbtapgycg;~H%!qYbnnU-xbxSukG$
zn|nfSY^8*hG5$6^QW>eqQQOGa$-rE+;)@O5bvfLv>ZD0VG52L<3A;Mf-hDQEcV|#%
z4^y?vg>!_VMZIB8RlZJvkAai)%V1|Iy&%G@4j6%>m<Lbt37Ld?=~0e)8s`3u@MjPK
zvB=3D*$el9wdNU5l8?YX4yL9A&cqV?XgwJdg0o7V;)!=^w(q*&y2;b&5qBDD>=e{g
zj*r*Ujo5yZ)O(oYPV7|i;3pT;d-S8=ypYdWuR6{u!G3x*qCJ`q>F@)j*6({nmW9oY
zOK!-uvw9o6t$|slrJe+kIJ8fkKm{@sS}4m-bYN+N6?vS@!n-bSEt<hQ5#bQ0O?~qz
zu=N|kyDBZRp<(?|8@=YLQc&ut^3C!!HOZ`Xxe47)OfgbBrwr(aCbtw5GUx+)h4*dm
zJdAG6WQ4W5_$#&16|NSa9G0V-C<c246@JMH9~D<8`UF(;;o_WD#PsWK>|-DQV$O7K
zh84uKC$Us81ai*BN!SMjs7g5{F?44^laiMFSWPNdj5kF2OaG!<eyFlJR)K$?t)V6r
zhBs|a^9x^~*RHkWo|c-)tQVu6oE|Vl@KO+EpVHC2FJjJeQ)<it-UX@y6*2YczYf=}
z^Ygw`9`W<XSyk(0t}%k|z3v@i{M12~c5*(A#ojyC5kKfx{qaF(>k{3Y#7Z3WYahXK
zp(W!p6}}lHDT|LR*evxT?uJfGE+1$dr`=X6YM#%yesW^(AZ`r)cu|gli$qoz9nDUs
z{Vco}7NfPM46~&j=W?%Ve^Dt-VRb!V_K4A);WYD5<cX-h0_7yREfR*`0}<B1<t<T&
zIUImz-z?&?>H)^7@{EWp80cMj!@HuQHCiun`^8q3PisV!O3%l$C(de{=OQ8pCnL3u
zFi2`TX^uJ+EflaxQLftjUe}gSjP)f$Oac}vVQXVGHkRt!VLp@OG<yqMv0qC;`w2mJ
zbiMLgbm+b1*WSPC4(QqW(uu$rRZW9<Y9VqG!B*)csDl7MjX-sh`%z+ibPu9Sr8hP9
zuH>TB<Z;@(ZO3yGKP5<?_cX;Ol!Q4gPkenNrlc|4^xEC}hoMVkyKP2J-P3tPElXCL
z!^tt-Rg;a+o=OnJEH`sHQ4lx-J9_IKJ-^`>#*bJ+P#<|-DATkpIk$xV8=cwR(EDlF
z1MST#9d=t>S+RCq_U(h>uu{Q^k&*y{+aOHjq5&TIOMrN!Np^#SSrt5&1`w4;5sUYQ
z$sUcP*rwxXx%gtA3IfwT3^T5xBJ*LGLCEE>h=t4_p0(UAN3RLfaFJdaH*nPx#YI0t
z90^9a3rw><-a~$7Uu?rWESF(tikYwHx(AUPZcw_a8G5un1IeP`0KdNaZIbu8TNRr{
zbpr<_w3P2dOTCX;rUZVeKiydCQ?u+Tmw>OCqVA4-!Dmr!A+=4V%zBbu3FR2e5X5(p
z<Ig^or@HC;G2ets{Mkm12@^fb94+;|O$YoMQ{>F~Ud(Jbr;}>q9I9{BakH5V%Poy7
zTRz#Ia{;_L^fo-7Iwku_O=ctv`8yGVT*7R6jP-4!E+CI6Yv!l%eR9UK*B!0h%Q%tz
zBFF9WX?$L$;OE!mSwdORGn8RTp%LrtHp*1I>BTQ}`uj)V@S7nAA5-x4h<DT0+;p>4
zJD`+g1~7WICJXXrQd60(Wgu2PE}l(Y-FypsBIZwI+4a^-#q-{}IPsDk%+DK!R~k2G
zJS%)SxikOBnP0S|2$!ukU@1r8IsHl}*0GI{5Fvs73usPIQ&yl4nPe<hRzx!gu~r4K
zE9;9_n~Se&Zh2LXQOzQ*=a-w!r{?)lo9+ymh(j(8Mo23O6W;MKC8q#0i;;NO@w7qr
zGr2Kc=K#v#H_sM>e^RxgpHH2RiR;}rJwAh!u8H<G4xbEqUHVXOb+fc}#H#(|$&>kQ
zCr0FV^7hV{Bz$#O4#3z-@OM;nce-P3AW3uI%?66YyQO3T_0X`TCF-3NrAK;!>p{42
z@nf&-U-ZKLs5q(kVbpt?K<O9s0nfZMeD<MlO!vBL_lJ~b`?7o{UzcRxB%NV6K-ddV
zh2$aIuu5A>BGsd%(uw#*iloFNGF{rNslK~V$tWqrr}C<GWcX3p=&at*Ct;QgM0?)%
z#cH(o%?+E}^!kKDth2>V-RIW75aTH{A+|h54k^zxC|4U%%D}*(teU(DyB3U)FI0s}
znwdmX%=XLv)`F;ZH95NEAb)mf@5(1->nb0&(hi^J*cZL!*mu!3m)y%DkaF#{xKcJW
zGdJWdMPaB_7E%qZKF?NhoO_oZTvua^zP^TV=qy3+QV~beIz}O4h<oeJ%J%VG+QIfu
z#ZhwW?QO*+<Z*M=?>1{BIkIEvK!(c&^6e3r(u%ONKG*MiN~rOZE|p2_;5ggNBF6ES
zzK*D8w(|VkG5JnsYtLc(_BA=~5%jEVQC3r=QM_(ZO8gE9iA^<wY0KlGyI7c2wmbp#
zmwYOg07`jOnW-SBFpOp1T}=YgtY{xmTLW`7`{3h*jZd*qXrFwQF-&b??CG5J;S_o)
zZQQri9I$mT-}J`8)p}1mf$}7Ls`&sK0)i@p8N6eQm_q%{?>V)~N}Z-dX<6PnYaL#=
z?0EHOfmi*3ge(GnlyV|&DXzPRjY7bbbego_WX%!?$Z9=ogVCi-;e=SXzchK<jk-}y
zg}pQDLfe4i0QQqm>N3xYg-D&x94STj7iKD)yi?+>SE>&WX=z+xWx*dE*s(1WDgf)O
z>PS<9`(KkW_8p`)d>*b#kw#D&vXQwEqr~TIlWEpclby1%UC*O;@@7Za`DS&3xXF`2
z1?POGGTM7O%b1dK_(=teZ&GQ*T>n^+d&zQHa)ZfsEsYEE-#<wQt5+?alKek0immDw
zaJrg6L)_&c0C<B6@3fMW%*7?ukr6>R2Wm)<+D_Q6QHN7f{Qm{YtxUa8H~s9N*mZu_
zt|xmS`tRs8ceMW6$KnSe-8KU{Jx~Il4VpLkcp~i_WKd`A#rVD!omW&48$M4$_Y2Rl
z(LKf9Ae??i>TRU9(UddILVJH`VJ@e~2$agxc}6WYr0!gkxU<8uqOg`;%y&Pw_hDcF
zed&JmQz^X?9E^597~<(i3ugv|`JUw@(oPa64;QGR7OWF>X5P_8>f^6&`+lG6#~{ti
ze59B~(^;L0^j|-|i?rbI`dviHQe{GNUl6a6oVJVE>fT_jP?AzCSF-vD*trQqx)3*+
zJtSHxXcVkHly$~I`~KGtchYk@xBlt<bMx`TVFbkxK?8|<yvZOB_3?7=E37AD(HXZi
z*NQeu(toH~M+JrP@6`rgt38{&7`jB(QiVfSzVu*Kki&ptJr=Pr>k8-tc=TN_v&mWJ
zM$TG9988e;CWAof7A&%FJhOpa8r>ct;TY>wU^LS@e_BfR%qVMl3w^eXG`p)wCw;}C
zMrr8ns<JCKryd5_9u6|RsiWvonZsK2`bId(24~Al_$o0&3u712DgIb$qyr#$x}ZR<
zDZCV=@vL_WeDJxsB%HZGky|e7!oGMvH%rQmE`Dj`^fpPgw{3jZ3VoAB#Il;j@Q$x|
zs4pc2*HQSM8z*&Z^KtVwb--<Lh+}vEIeb25RU5drZO!=nOQw!)=8Dq^1%AU!^NtH^
zhQl8YO!(y7P2hH~u`MpSvZ_TJ{duYm|Bng$6`tgG(&uzCX2sI{E*ycI?Ez7$Au#>m
z6WiFIQ-mpO<w3WZ$dEs@^Y9*xs;~QwAOI^oQ&9jQC`7Lj5H}J^H&y3*OArm)k?*b9
zg_KRTW9AtH?sb&UR%*S0vZR;>iWp?IB^=@_0#s{|t`=|jsQg9%b?AV{{o^P+`2mhl
zn7yl2Q?)^*4~I8CT@g({ipT%&En1H7@&B}FvE-x;q*vwtv0p?EQ_x_FI*%+5fM1!a
zxDK_VcmHY4vO>@eq_5kp)C&QB3BK=$mpRI>1GcrCfGmfqQlt70qS~Ys7n(w4zP(48
z_8%Yxv!93W$W}rvskC0i8{eb0xk(&KkWti`LQCZBbpTg>5bx6YVg;8pq~@>Ix>+M#
zgX&#?t2nCMcIk{#<lhMJl}V}-fF|Lsl*s~h@CH&Q4-GF=-`1A&Yp#xF@Ft&>v%mb^
z-}Gh_TP;-QlknN|;44s7p2!e;Y6da_ro2O+^UzJiubUc2AR0Pm{uAJOS;ZSH;R@8T
zLS7m3fZwO$QZ?bk^Z%#?Yva4`!h}M4U%EhZ1rWlGK<y>I6k|?2e7Bv9q9U`W!=rf~
z03CFuQ{{zs55)LXYkJ8K$N>CjCK+>Hif<iN&zr!7Cc<xo-J$=Wntzqz`u5PF_Z6-u
zCS^py*bQBFY~{-TnKWCPy1)aU2_p+879v9v*uP=K<p{b<{MFAKp9K?kTm|QCA-Vg>
z->q4=Clbo}>d(e!iQ%QlKAL79mFo(q6?EWbVM}qJehfnT<B<i>QiS>c-I=Ee1&%|e
zYAN!n8~Ue-svpGP!6RP^UwQ1GUMjp8psNd@>&gCn4ccu*_-m^M_M}BIff=|<XW|EV
zW`W-bueTwefCe)$2>n67PqiuGdH{J`NrvbR{w}RAg=y|@0N16m0d2M2RNOdrAHKH-
z?}I55CZY5>24(jLqmp_8vj@D~c^@pqT(0JNj2u?d1LwwlT3>VFgJA5h7Q%G!R2DU^
zFv=lCF(K|fd`2`Z_W-1J18?LF?gTIJpqo}r|GTqn98NY{=+r_EvsCLw3CN()Rjtnx
z>V@S18d5bS$jIU;NO9OpZE=%W{lDyESR}P?sh=+%hml^z;FAkR7ef18_7s}=>Bt6B
z15a(~0SmN8wE*e*1v@_lFc*W+cQqjnK4u!!F|TI8Tfk-?QSySkHG#d_AY<$E_dMzD
zhnC4|801`}%NM4p<0T3z7{xGEo|Kd9uYN*&mOnhQ>-P|HPtw0%aC1Uly#wr#t+_6`
zNEzS7>?qUHgtq8>K8U8lGuGTkMqXFJFdrl+BmY@WnWVP>b2h-o<O9r^Ga#PasL}@7
zOD?p4O~3@g!oGSR(p_Z~$(S;}_~}hzGmPNBp~owzW!|vQ8@=KDna3Mn2Q%Hc^6!q*
zZ+|;=j#HGu@G)<Z+Fg{R5LZ@Oy#SwW<wFs}0xje_`X!1$Zm$?x)EyMIB>j@Y@1Iq*
zjam50viTgd@NTyYqT~Keh<<4I-I|1;*l6TTP(jc8FvrjD2xqwRG#Ke#4Ub3T&B45D
zk#d%N0f(^*jfsy26|@$YRiRQ+5-{*wesrkb(%acFo=)3@?U#tP2WzZ5*4RXN)tpCU
zMG?pQ`QHzj{S|1Dz1@56aM1%oEae3iv*oFcY0Bf6mt^$3cm^*#j>Z?ysUf}fx=W{Q
z5Y?D6=3wb(ZVj&OJtX$H(*v%^zI>u7y&`UPo#%a<vAA`khn_xeDHD{xDGOO+pJr~o
zlHeArd4fppin&C!(QL}}9;S#wa^R);#qdS#!Dv#7iw$V-1TJi)Mek21kNcn^K6w`1
zZex4&vzzG=^A2@H4a)<21=We=BkO*BseLZa5k+v_L70MHu_+xZwhnI2d|R{V5lZCC
zO^Cod^nwln;dzq5c%1ddvNPu1t)vDZc$m_;4QF$cu1!lT45^sprI7pHMEU#c>25bU
zyY5Ee+in8mx(Xgttvhg=fqpsTnbZOS{)b#fP7}F(*IHta=!8aw)aaw$7u2rP<?lpb
zl+BhP$(9Sz<b<UPlcHsh{f8~B<EE><ABI+*OuiF#wi;Mi8vR!<v}Hs8(YYL`S}q$k
z#&iUeI_XuqvIwLWN-+h+M>%wAeV%cr1CfYj@^e03cZu;k{rJ{!&i?v>!aGA*rav^E
z3Pz4bPVXrD*A@Qi%7hK1a;m}*jHL^47VIa7HYHqv{ctj7Qp-%`L<L9r04tY?GuUNT
z0<TzEc0J9!cX@wGmA_0o*r+XKiGQpO#jAC!D1hRQDiiMdHCkk)fmixqj&Jgq^UT|i
zTJ4*xf4qHugUiq7+-_<zrj~Fzn;R^jC82Z`N@k=N46)}jV$Lk`e~;{rSX$R>gpQv(
zsNUR1H4Xc%d&smRa6Ve|M^J~u>DIF9;DBfGq(=j0mfYg^p_5(%I%CU$83inWT2Ewv
zi}NYiuecjBW(R__I&~n^6)fi}Vw9g1H1$087A)@W0I7_^e@5fDEpxmWT~UgX&bcf&
zI^#UuZ8?@E==Mq~|D{)}9r7d-%zal&wAVb3P6yIlcbQnPHb2yqJ6V1AkDDYoRuwv<
zY9lV5hK$$&tVQnY|3+|kB`^)?y0UEf)ZKPpQ^eSBb<SnKjM~+v%)wmmV>hJYOEwWQ
zl#?o#e|TDv?bTUkf&A2I<8lz4XqdDR*wx<;&EMO`*m&FgX&Ewa;9+HY(&hWz=i-EL
ztk*UIPus%Z3zYacJ=-U(19moydOyqFfe}^T4^&?LC9rmRS!?Lz>vYto(YKX$W&Oco
z2iMh;!aa}v@Q6MdO^corxk#r!W`wUgg?CaO7uL&t`*<T=is$ugJ$yBm)O4_|YPal&
zWx5Qj0)p7AywUw>4K)^ukJ;b_O&7||($bHwa@l)3?8|{+g&!7Q=NS<8x^;39v4w1e
z)Yb!qkToAP1_BK`fFThO*0W8qC9w!>@t&gMT6UMPmboNhXXl8meNR^zaXtuG%t(av
zb$GY`p;wdCREAAS2oNthS$ccjJEG(}JG(y<h!76N6V>zJXNCG_j1O&MRCEU?!_o{h
zxF3>d@Te4PQrO8lI<oGgP5WpDVGSxib73dLxft}{+h$bv#qEhB`*&1P9<T|AdP7Z|
zVp3izR%GNn%<2Xi3U`$|vq6kTE6Y(k+3QU3dS7WZ(x{+pY-dcDd3w>LqS|Kjx*8&O
zw=ZHv#JcEqhMmOQ@Bm&f)}`6=48u*1hugUMQ&X6RPjj|0oAe(~%Y5*oj-+2b*IP-4
zAvZI&wbwXJ*)m;LwAJxSljFxQxRYlw_9-|G&ee9iF;BqSYTa%;7z{KjMR%5>oW8gk
zj$-MyR@$<Tn+h)uzvqnFT3Ynpb6cgN;I};ciWc<_E!BQiFcWSZG}`vD%7$^Wt!6R)
zo>w~BAS4JSX(9!$j@^X|`Ig^d&-&Oi{SW!Qr)RnYY8xf)GL>ZAtcx(yeHlHf-^K83
zImrl>{$9?W;T|MQbr?hQo@%KRahQ_5-aR+)S(@-ZS7)UMrYUAvwK5k83*KYgpJ=n8
z4g<?Q+SPsAw%boSz@rIpg_-oWO|8+_xVgo)4!I_L?+)_AE4{BKKYeTk>j{GEa39c#
zOhHnoShb6>ToLm^oK7t-;ewE%rAt}DP6d)2MNWkNj~a_Z!<ENOe+jI}JR_qfvFE5s
zvRiion`jIDDz44on&cKASWwpdbEnGd*;DAx7^mPfcdP7?+B51<m8*KQqF+6aqx=J-
zsesvIxl~bIT(+ALm$_Ntn8=6)5XxpJUy#GC8=W~k<yjPBh5k8ddm@T$LC<LOKrMKe
zY<W_PHmD*rI9kriA<jA%w-+vjKn-LeAFPqL*|Mx>Dj)nU{2Tnw;x1ubc(7~~u1<YQ
zaCm@rZLhVZ9y;cmlW|MNGOEvK{z)Q?RviSL;bJ4F##FU^%_`C1)SGQpdt;!>mpVsS
z96}(a!(;Rw#T>axD5k`xsb`dH?l9*KlfGk`sckyT--o-SC+{nsH@G>WnhBOp(ztcA
zuE0r@7zGO1u*5HY4gpoIvG?Bm7{~5EbL@o0p*iX0iPe9d_MIots#d|T)jmVG{Uf?6
zH+q6H3uAF`A#WboOgZmqEoMZR)>6#W8$_U&qet?+{_wEkbZG%LA@${_9b`Dnc)a5J
z?cS#RFsBMmL~L<rTg7itciPKsT(rj>@tG=>HB#Hq%^UHQ@C@+=b_J;x>1tAjD}qx1
z?j$GT-)U||j1d=vPjq|9LLUXvOKW!xlS&;MRl=ESXHj%G1YaZUIZ)g1l>WX#RP5p@
zYeHuDd&sUS$f++}l5yQs6;!8@s#PlM0Vc#;@#pb&sxFA%u)B(CYu2}&WOx)Z2nk!z
z-gF6N?r=63Tcg>j_{tD7@`wuk&MS5Yud{rs%X(>?&u8)iKY9$cWAi;K@jX4G+v||_
zAPrkyIFbp;iH%TY$XM8k1PObbB{3rkl?%OaJ7UVP#3EE1-_m32@wExiWO=|LohWcx
z8a5@L*$DlR*t~ilk$V7|oh)uJnR_>JINT)9ye%U7_mj~C;w3~<MJbI@oBF@teFt`r
z{rGHGl^0{J<}R*1(7V2)Oisa#)`s+&qr7u!TFJrC%OPB-_c`P<bTn*X3YoDnJoMgM
z%>2;vR`n^<B+I7ybq2lI7OKfihL4uI7!p#Fm^YHGnh(#n(~YFL!PE<>nWK3QAv`NS
zkJzRr-rXprUie0^9OKNvnq;HrT-LdWTGV!Z5s`Z}8Tb!jly0-rzjwar4iSkBs@!A1
zOmoC?{?h=n0E;obmD*?zuFF$7Beg-GBQ91lp}W?os4pf73AJ$+IK>GsxXqypCDom|
zg$$b(wNH2TxUxv{0aU_Ju7qLcE$A6o)>iI6Y9vI*KQZ=8KcdP^o%HB3^cZxl5GV*f
z6K|xVr)@LQNa@MzP_(MuL<wRgPx`PW#93W~dDF4t+jP$c(mWT7!k&Sw-3PJY#@<zx
znpEbpcf+{t8=F>FXKKeuw?*{V;mzB7WuXkuhtB3*FDSVb%!V@Z9(HIv%9i`9oChJL
zBVJrbDNC*wU!06!UEm#OEl|(T>lD|TH9Q95i>Y@d3KpXJA#D8`ef~|lj4$Y2h29v>
z^Eek3EBE<AMc;o3n|!fOWFjH8#_&hGfN0n87&VPw<DoXXq1=iNl%lL8xkoa-XwXtm
z!DU4)rsW^xYts9W1>6zmKBXcit*n{-Gl=2zH0G^~h&>qpWj{1EFMjUSJfQQL4?``)
zU@J`Dtzjc4AWr4uvwu)zfZ);mXzCmc3Bc?Wjo^@LD3Z2Mk}jBf>gm+!IrDL2><EeP
z&znKd+D|hW=%ng1wC*+cS*Hmt9SWW>4o38m4G5uNnF;#3exBBz{y!oS=E-0iVSXTQ
zRH8FdelMWvmo1N%22jOngJ(6>PlGlbe_s7G@6*Sh+75ZGdHv}H>Bcw00=ULm-OrWr
znp;OSMK#vy(~3{kD)+bI5VNdgh4<F>BPb<>vHXm5Um|0@)%l-MV@^^OM{7me^2+yv
zo%kG}(8We<_blGM#4KI@p<P0{OZu-NW=`H3O*tiuw-9f;uR2aI>|<w?Q@c--Ob=ka
zO)>?K`$RG0TFKyv{OznwPuk=WQF^-k%Kf)XE*F6OW$PM-MIoI|)ax4fK7^!z3P>vt
zO9jVdIJ`aB-v~K_DywgVFHkel(xj9_E1#*H2lKrOr3$>eN@c>-QRF1q4EsDR+bn8$
z9}`&iW=yPG8y;zduZC_Mo^1d9kZoxGPpvD~nN9GYQ*^@dg&kFke5IYK=&)d&=_HcC
z*+3~JV#k1K?~8+g4xDLHZ3z$02F;z->?g@1kc3W80BBLuM^2>7asmC`WMBt!w8DFB
z6rB3eG)szNhf@jAAWiqAZ2>7;0W~#8{xPku*tvnN2Z2~0WtLaav>GEtR&JlJw+ZHF
zLE%@X)I3hyKzUFwbvwxe3h{MuDm_c0u7o^2$t6k$w~#%xdi?IG%U{t@KKV;?Q*Ela
zAr&<eFZSwaZXZ#sAz8TC^>OA7BF3Tyvp29h|5E(vbfJ)1*{R+{8>h-usvgmmPXVFP
zu0Of%75WcwP9Du&@e2`h`TLY(ydGcWZB1g$vH*sk=4uUjm^YIVeJ>;?Z$U@7o}(8k
zP8my&*;sA8tTH&IYH?qHsh~z*VO(ZvP#;&Q7rBuaXSFw8yuY<qxVs|$1A+1r!xzqB
zBRB?vAReI^(w+S^W#cJjG?Ngs#-#Ey3}^JH@>i6Wvb4?Ny;Hv@FVkItTyP@}Fm2G1
zM_JrG71w3ny2EEFDP_)YW)$8I%VFLP509Cv!>2qUsf~zAfhM6USSBXnuP6&aU#>_{
z<MQTpV&5vtW5(jXbW=emwR>*Z<wN0?M%ZPkcs_m4#KF?)^X#39g_Wxm`q%Y76@?ZK
zo$fr_$)TOqQqlxG>_?FO)lx*huq1;T2dl@*|0#-Oj9Iwz-By%?uP(Vu_2O)EZ|Z}(
z&hGSU*=eA%na>X-w={n!eHrfBn@}>yO`oFl^}Wp5`c4~a1o7cWttsS*Y;1Mlbr5YM
zm7>^Di5TSFMsK!6b5f}b)Sfbm9-XpFaaB3Vyaf@LW3n(oy`XQ@V5oO_`5OmkFJw=b
zbO7wXJ@cAWz6YQ1I_;fpc4?1#XHd~FL~Yb0VbxJc41ZQV>B(sQQ`{0eJ1m$G6KkN0
z6}x^$F^}3BCAt_8T17t6$4ju(LObuq<quLKL_w{eT=pKlAC~18)XA3ic+mtgPCJwD
z6QX$NMoO0m*Np}1NLB-9AyRA43neC#N`q^kvrGp-PX72^MXh~$Y^|H4;?w1V8%@uV
zX;}CHjHHmSaoH@DoBOny*Zav!&P%<yZ-;s<+xk1od5=7TL24T;<~=E}rPe<nzs>I}
zDO7F6d)Ne~D?=LsrNkhGWBq6nTPsSe4;uBA+;cALmkhftZ?{x=g7l^iH7wA$#lC0#
zIL~xoH(hSJ4_v-)-`FHtylu@PZP^r4i#7#ZP9IgUM*2Yh99EtS5-NrgN2%k;2N}!!
z!2y2;@^{>*j+JR<hMo1j=pan2G3czB&TQF34;h?SA90)BCpewsecq<(2r?tBz+624
z5Vk@_hNuyao9Q8%Ohocm6Xop<+0JT}AM>qv1_Ci7zb?j!cCp4*?X1cDc`D>ndzoGs
z`;qgh#AR=vE|~EJY1pGxL1;hU@h8!4g=u28pm$lkdB>Y7YK)|(i8iZAMw)XDG2RDF
z8bhWd&)}18!n@?)4V2kyYIK;dk#dg|7h|+&d&js<_+~VTD<NH=%#*vgMiv!wl!@6%
zw3;;_!(79Wa)|E^`CDwI`)+K9q-0KQF*V#tUXy83${CIkNfsu{5qR@s@a7lr-aK6x
zE1%t6s=Ok?S71cG*}J@DZ7z$0B;q8hp4!!|s&hDeMp4NiGP}xHl14QS9DH=<%|IkQ
z&-L&CDWbh+6E2MN-xL0bI9P<wid8|nUfVQ5dQ7TyJ*qscDR-MT)k-T$9n+GD6WDq+
zlu+D4fux^MYe6<zDwRj>xZ$I@=C)oOk~d4?aP6<NqZjOT6n6~#1|8q@_RwRuRkSZr
z?b6{>(Lh>P6Rvw*LQWv*s87K+SOziI0=$){Jtj5}H`|ix_~Q355MK6vQRCEErZQ>$
z06v`6<`VB02E}1{i`&LDJH@qU-}hebvu~NVQ{j5SFF8>xpav@z>HNWjA~PBWB8Y{3
z6Sb^ls@Y+%n0<~uXoOTn&Nz4nn<r}&5K|`+fep#MV_8<f?0!KG67Qyqec|UYCO=(T
z!`K{rBtmvWrLwW}c~UMaE{kAVcyD?{zz}>kTvyZfYn}jxnN_I+ae<i{p(WPXW6=up
z1KD-mz5-f2zD(hf%CNda?^siA<JVIgxXf)WL@$~cPlf*dTOpGr&+{*|d@9TJ^=fl)
z4}Q>e=FZUR(>F=&$jD<Tpw@O)>WmDdF<a1V`JigO+8iy(l|-2J@F}x#r$Nj43RXRj
zfW;lL+JZJ_ILJMfj@Yw%&^><kRK<Dw9&t+Evga*peA+fV&GydT5x3-pHcG{H`_Os#
zY!%9DK(t+;;5waxeUO3<?v_p$y9abc>XCsPcohutW{p|w6z*?#AQ@oWLAsGNyJlwh
zAbW0aXP<Yc1Iti|Dnr$t(r0SNyN!LWCn+;)lBI`<{dwo0=A7KSK*33OiIuQ)7!F_;
z9}e|17pfHES{)BmoD2E1NpW95?7=4>5?>HP3BF>@k{4-C57mi0KQGUqaXodeEphAI
zMI2j!I*ug3MHALVx2jbhg&9{Z4q4Jx*GsA}GtG#i%)s~!-76Eem8Gey8Z2#SZ>f!X
zkjV}9xHZb4`y!nY7+vjWUcCd$7tH8a`Hg6Q-3Plv$XEwI@8UvI1(H-ng(=X-njHm5
z`UJiJ<)ymK1&Q*bGKWX#oJrHfpWE^iaO3IO$yHY9Gv>l~bVtFFK8S4~iGJaCp~fM?
zqv50I0L{oBYZNRp2Nk-PB-AfFWHFbeY`K;nzf!t|tz>Afl@uOJ{ccsxP``vBa$Nh{
z&6lo%CqlcA+m6K?2hH$q?71oo?_gUXA@@LbELFTv9aF-5Q;}1U@DO+l#$`R23rR-O
z6=R1sx%}8WC%N`?jb$stAmX<Dk_bC*G%NS^pfY>yq4(}#T*sI_ueB!O!5Ua0wPDD>
z7l@<+C~zu(eUjGKVi~E2sw`Ge<r{bvtQ0pV?8_doD^jF$GUQD1%X=G5c!lAeh6#oK
zgX>I`Em-VUwB$xe(e2PY?Kb;x@9zd{Og5qEtRx9qx#G8*q`Q>=79CpZs%9O6^I{t>
zf{m>rU#MAxH}Ond_MTGF=+7Jck_F9s`@l@bGs4sxZN6mc(^!v_v1FH=lXvqyQI2Pu
zZJVcp$bZXNDs$BpSeoXMlg%i6j$!vu&fk&S6XAc4+~(G-!HVH&LZKl3G~UZL0FQMf
z1<H&dLH&-c&j{x<Doh)48Xn)p`UOs}!OdoCxy7CdL5!c8X@xclX!`WFZ5?YI-s*G1
zIarLqDL|R|pmB~uchxTKk%MqIa4;K}H{0fc-p2H6mg|0C3Mo(S7$!!q-Vy1JI<3F;
z+jrYN=iPZ+Vd>~QyB#1}8Ob0Vw-uGMjWEuk4z(9FKZeCrcJgF4$R3cfY>qt8Ub5_Y
zyF&nVfBTB3AU0w?d_U+}RdrQf_>Jp-ohi8d9=fH>&bi&!T%knpx^E~Au~bB{SGfzT
zEnzHHlyGhx!h-#(+s1fv=r=q>W!BdXj~0S}jiqCY+DoE2>m2@j>ld#~-xiuxEA29^
z?AeJ?qn$TNHv??}Zc2p?V&;!1J5_DW!Mn{W2Lj2cvRoP$T1JeAOO=%{-q9MZS=Ya<
zeP^0XJX1|-Q6H4X9XR;@&nU40{iy#NwfpVBGfsJF4?-uem6yNUV7VDi!)}=RO-vCL
z-5(b$JA!FNqJ4ZO2@47hitZy#g+!p=q+Lgrx&At2cNg38y00#f2&Jjiaf<O!r^jAV
zl8cjlc!1s3noM8OiD=zs{YH?@T8+VxG2?ewP~L79a1%n<CN#xgA;z>St6S9Y-_*|7
zQH8FodQ?C%Nt>x2jAG3^K<7zl2@KbJ!=)RZRA=NOvH+X%SxZ&MS2Ks^b^GnqQuC((
ztG_K`|E*2)-~Pfg5a{yw>KOwt)=27<qGJ1LP=aa$!TYP?E^FKes;2RfuykF*w7(H{
z@c{G&2osbr$AdPI{+c>mA!fN+!F(@P9*QPwei#7oZrfBZo|fh>_&V2-&rq?ajj9$R
z!Bov!#?Lp2^1Q!$-Tq&J#Mt?%s=|;BOim^8YLS~h(zSC+vY^QN;1pb0Nzg!;6#o!_
zLO>=Zw<yXWklf(nP?a{_rBe?VBXo&^^yc^f?h<{34gW3N2njfq`qdreGhpz?+W5T5
z(kk5z7BOlAz<+;G>A=^W(ZU=1P_#=Y0ggK{D1r7+aJgto2~@J55Z4Ur;01hbFj90u
zMjDV~JV5Y?1KOWsaD6DjU)_PR@TUG+L}M!o(N@<_A(IoUx!(vZI%W70b@DsF?qHxg
z$B>s6FnoXrx@28|W7;_U-EpV}b;btvXM}>%gql1uKz@;UJ<KOSep7CTI=>??_h}L+
zBWyJto)$}bjer>a4<A6Y3aPzM`kbX_jW_rAkw2rne;(H)?f(Pt`#049g1i5dp3(k!
zxE?&5s{t5b$fGhIUc^hV*HT5midh2x9K-AtD}%)4R`|V9i(NV&W7OtEz-S}?R-iqN
zO~5lQY~b~OBZxMTVvyPZ<bx>{-9?7FDq#Pd@k(F_SpM5qjRMPb7A)VDtuUD|C0&>B
zm&oKzoCHV<w7n<7D+M&wdhZ1B<Vi&{fjPnalkz!&S}N51CceO%JU3vZr53|ll~6yY
zQ{a7+46z<%d?Vgw4;{n*PuiX&z_sj=4@-Gdk45Fm>4Ip<mwRqNTXXH6HU?iO;T7+%
zXE=mS%5AtUGIT@=C@UFO!<0ihbdN&WF2M`=usVjVJVAj(YfOWVs{a;2)%*Y`JnTA&
zO#F3+XsWmUh%f<}e9fK-s#8-fq5oj8JPu}e6!(Jne+w1BdK5}+yNb`Aqm+ih^vnS>
zcI|I(@bxZaX>LqI-g0yzK}|07EW)zu&-PxE3W<ZeTz+W2AMW>l%<N?L5u@z2eA>MC
zz3*zjdwI(K`z=&PYyJEf2vK}sT0>!eis3V|YrT{31qz}3{Y@*mfy#Y&Zg<#Ze>_Rx
zca<^?H!H0@ZCY39lX-hx`l&vR&ySpIF5WVtkvPn6dPDw^V|fNGW%t&cjOG~<nB@?=
z|At61Nn=OES_sN+N4`dG&{40~!Dqo<-eQ5mgv`=-d?RGr6OjM^{w9e{;R0J&SEYr&
zL5MD%XH<6BMkI*HGCAvULlQx&&B-V}g>rm5$_9egoi!B@lP9meE;><Z`S|0uh%+*x
zj^|B!zGqFW#jj9LJaYFC-P;eIts_95)0vC$*Od7+%NaUYX@28P##YR$PmlHjU)y@P
zro3Gq5#2mnA-7G>x*N2nGbb^zp}z7_O~vI~&r9=kQ<M*%hiJbF(H@1oa|LmvU*(Or
zQ!041Y)CgB0|?5hgC9yiL9fFbw^dLMcehFsNeeDZ57cylkoL>ykp8_OFmK<rJjt6F
zdb%=Ql(I)&cIIJF8;9Jxh$u&Ji_LIS5s}s~d$GC(+OaR)Bz`ni{sK!0u9(`L;|R9K
zLqO_cz2MF3kv7W9QGZ{BRRiTBrOZ>k#q$~}N>pzPmNswc?^{^2^l?=c=r1h6E*Ge&
zXo#C->7#ZR-?Kb}>B*O>T=Q##Wgoz}y)Yk6<=e2Ol6iynlQf))s2f=QU*Xt0s&YVT
z%_%2FdrXy+*ca9Op~?OWpk9?MxjULxwNbT^;h_+v-BI|k3f?!~uQwc)-w%B<<hDdn
zJ&~^7_;B#b#>fcTx;v)6H})y!w|$BjwQ1KLf2G3b3~C-7eo~d!s4UX_!5KYL{xs`#
zeHkltUA%JW$6UEwuRTY*@r3R2{TJSC&G>Ef%YuXZE)wvaHLDqR;F?8Cg#Z@UXKZP0
zbH@_V8;v#JW5IpZhStD^cO^9hYAf{fr8J|^Q$uI>H-F5&SHLbF^zBSV3VH+H2Cn%@
z_WEP&nWfiW{J5H+fdDvuE)cTO-PCTDjMBhcfY*x4{y?5wA`z=>ZqZ|8-u1JpHs0&z
z7j2UbtJ2;1fwSGr-b6%uc^-(ZM>`)sTv6zDUBk{#w~?u$eEqKe0<=rrsZ2HgC#1Hn
zcO~Ymu;X)qlW$JBWRfF_XSf%<XRJ=3Dv-pFSXy{Y!8`Xz$-mSa@6%(pwb>UajMhvZ
z0CugHvlq2Y-cF8q*d6+tHu@Z&xl#2UQVXYL$iHwWwXY@#2|ECNB%{*?vi*Yj6ifO?
z#3(FOhowGJXv0pmVJwD{5-r&#x~Qm&VSQ)#)Ud8Bo#yqVtSwVOz6*Hzq!%<|C^wKw
z#pP_ZA&6DYP>@D?6gQx)R&8t|QYN5s@%i%O3SzA_%?QArHnn$4#D1~^TW1BYXu!!b
zZDz+<Q|vvGw<tQ@af9fn&8_h43SfMnS#l1UZUi@;h*ugcpZLG1d(*I{uD4$pi%JzS
zjvydJML}hVRR+rx6%~;p3JNl&I6;UpRi-E*QIJ`nN`(psf-;0DL?8iWiV%ici_8In
zkb#O22<#|?T{84t{GaEX>pJgs&X@Pw`^8p2K(hB*_qx~b{taNX+0|f@++-y`O72JQ
zXxRjZb=nr^zZJP7fITGw_bT+kcv|7rla(&T0i5U{LV0s?%AX4tnRWGzgXU(7v$&c0
zp#H_b>(%BQ9RMwzEhs>;G&mK2FGE3sNUA639ge!<hV<v<;)xAFHOC3jW6dW<)~}q-
z0r5P=DWR9JyeGeedSzvIiu%pZ_jg^o>Lu&^NPKt%9gKz#W=q&|BckgS2st+j<~dhj
z2SGEzFS9*|8m};7XvS=t49w~0b;kJIwvaIJl7%~XGs&KY9PV+w8FPF~?~Nm8nCi}}
z-rcd8stF{E@Ng0ilAl%$^0iyc6b>1Fucf+BVv7BVn(44vU;n5}GsDAKkzRF&NV0wN
z_wm=7<Y$^}j7^!zcM9rr038$v&`iNjYz04WlsGIq2uDlxW%t0}68ylqyq0_*^ua>9
zqk-aZ1Nf>-vfR@{H|icW-886r1e8vggnd#s<@3)Y(46-#<7cHU)#X=5#SI;cmTUe7
zLxTm_82GW63Z3WjaMDKE8)dyfSwmJ=9Fo?>m%<es*~I>##UU793OA@e2m#aCJ_?mc
zatji|r1KWQ<1iPoz9{D~&Tvm3BDuRCD<zUA+imk6Y6ynkvEjoYgh^i(42Kny_5t#O
zFX<W_4E3C97+kP)Uq_5?KiHt1;aD4OQCv>B$qO9i$HeMO&WgTV%;yfhti#P#RIp7Y
zI^NrkYiP>Pt0vfW&XVL}qTeYcjS|96X6u0;5~`O@7slv!KA36jXQp{ysjIJT9uy4F
z@pE&Z2Mzm2&4ZfX#zyDbVJ!r;S-Thu9={+adPc`oT6W4>M_UB~25Eafummy{;(OW`
zzQ;P+upr~6d^4#w>t#sGzC^hz=R<iY5R<XA*5f2jC*KT2_$67&$4ci6;hC?0Eo;|W
zsjcp*br-<v&?XO{q4Rt-k{w(xHR?iZ0fR0JDNy4%b4sMa4=t?B9o@Bvve`4k_HM6;
zQC`3hZF3$yz?dyu(1fWT)m+P5SEWTCQ@_zXaMG=@sc#Zk`xLs5W~;sjEvLr!#A5=D
zHg`=d;2GlFM;FfbDz+D1#ZuI(z)+Q-(+w5=1Y$3;;jN031tAXrqQXE6ch?@7`Jj;)
z(Tw5nLfaYw<4Y&7){#-0*T8AuL-#5lQUo-%T9d2X0jR!tO4@a0bvVVqYJr1DFto0h
zy1|KUffjGr*<Ov%35b>~S^P2leZ(xLCbV0W=GcbQaxt46V2z(2Vg~5xzC%A~*$R%L
zeQbe{iU1zd5id`IUvjqw#%|6KP&dthOBdB&N=v>4nOXZf6gLHK&2HCj*)@od$cE<b
zRz2fArz<7&QPwwlRn^`bK);>OhRxWD?LDfE!BB;)Q2By%NbW}p!;Ebgp(HjtkeaJp
zM#EOo&^Z=mE4JkjG?g3$_1htKy%!1v%ddx3`{DCKR)B{Viem$=F3-)s$o_hU<?&@9
z8jHaKKD?i%*zHt8bZTq3O@(|kk%;#+nBY_svpyhLq?7cy&v5uB)+1)Jy;Fp6Lsi76
z<$!KY%q@}6twG-QXtVThfOzz^4}3$mGMz$jA9a;wLnSmhk#rBqWG9mk!P-1ZB30i=
zdPc?CTq|5yAM=dk4Lz~lT)#7+Rv;8=dHT3u+}sQYP7d7|9>WX}BDDNGq#J$I$QBnh
z8dQI=YpERw-sI#k2QkVPbmo?b+1nk>iCL&kaNwBlki^nlPxlO+ODhY_X`w%u2q?*Z
z6~fg^uPxOlGOP|&&KcMDTaJ5Q$?9=?qoyhb*4LZed3;s+m@EvuB#rhS)g{0gE(4!m
zQ~6M3O=-1eW3_O=Iq<Vd!ji)s1C8@i#$%F?(7??KxfuqQ+e;G_wCRaM0|l9XaxFcr
zX)kdP+~$)-rdl>$HG|=)b?Fn|&QSp%y$6w4s=f$x_XN4MY7jW9pd<_^73fpLCNlx`
z<xWOS#ANd^QI}$WCNYS-YuZrv92lkTl|IS#GIsO3oYMa%jQt7|TxtfZNN01N_M^=F
z&Nd8Ln7>1Vv0eo5;dS^|&82jJ@>Tw?+SJj9=wwue9$Er=`?V9wCY1@c<tUsc%2-1l
zp?t51DZ>Tsfs2Li`WE#JoGrWEO&g_Sl3pN<C?5aBYXYNZqe)ly?Sanp-?%2VQcE5o
zburJ*FTn2{OHBr@=j%YH6<fRIq_T<Z@beQSTxzLGoGDcQ2l?kiG%6y%`|>b2@%=#P
ziSoKH7s%QJFy2E13o9+pE5MQ?*<xYI{Jd)3rD}n(P&Jh${`z&w=Z?jl1JAHU_YLwN
z9t7Y%MX?PKhYrcX)w$J65iK?1AlFBL>|gyh^!Jtl>X+dRDY7g3E9FLrjp|rtVCuUG
zLsqY41`96q8M41Tu|xV(?<XwJzri{aE1aFNYIb*TXzZP1{fgjWwgQeIrtVg*P#Jcq
zmx5)F4!1W<Q42w;j7_3;mq`0po~i<O({d#;rGX`jz0K?#x-*&39;)+@H>#@|_+`@%
z$3b{93O24+Y}J>6HZV4m$e-+b47fT-Q1b@Z!EV0j?-kBclZ+)@E7xdDlBf7VIu#Mi
zlpJd_xyl~A^IgaT<@m?9w~-vFaqjMmVjT~@U-?6FA-t^8Qd8C`tOV>G#5i!QF?HS{
zk|quUUZv9Y6l9pI^Mqtq3bQ?!k4oww6}5_(`BM!f%chhyD6>8;__e(5FMRt9RnPbF
z)3vy!rn*D9#U3-2l_=Af2s?1pT8%DD5@ziZN*~K3KNroAwCF8)8cB2Exi97ye_u+~
z-S_5oOZNHv`G1%n-qHgX+})f#68b}e1{vUVcmS{N2pssfzmf3peNj(55=<;_^V1EF
z08?1{VK>cA!<}sDiMoNNGq2ptJjSP2UJjTo$}7@LFK(gNmC;x|BTKFuEG);*YSJC&
z#iQ@+39?Y-TcC>OkBAXFeN}&<naFl(ESGGP?e<0*kP*vbS6{_t+n)08DjA;``E)WW
zgkXNH=}o+aDAq13;pC=gO_$nJ)`-!1XhAs|x`g7H2tPJM8Iu@Ev@}<Q<Y0EBT1t^|
z5j|TA`dEKdqJADUH(xq_`}SPmSFYU{E;<uynSnR^wewbTTj|e;F>pWGr=!>oMiEMB
zhU_NrE@O-=%RVK7Ie<Qh`?0|mhSWPA9FEulXENY3RSJ{{v&#t>*kT)&XbBf`V`z-{
zqCu-O{YwkmDA#Fu!Pbd|@PieB`V0a-3|4cON;6ToFj66^PbY)c>@<KUaOhaz4rnfM
z+z*t+Xq<?$6~0?#e?ZW8w=&ex{29Mp&pC0?ea9I==GwpmgiV2%=I(*3#>FqMhC1%=
zXGWVoM0BHJlVFAZBe^$-*+Ac-ZYB@57=qB{M4=96!2oBtzZ#}sCvQpDv*<9*1<G$O
zBf9zm)gb9maG7yxuuiI_L$p(U4cBn^%3J)tfD=9?xe>JSfQKQJ){_*$7=rgfwpN*A
z?<c>6Lu#uKq(Crk8IvGX+s9F@iS4$Ajlu=QERW7elr*{Q2sEo6pf9C{*q<z$Zoq%c
zEpf9bFDpx(#^0)|Z47y6>pl{t(n?kWhyjlptq?9qj!<_wYAOsNeh1D(s`H3+O!Nh$
zxi>kL!iVqf>LYoUx(M~PTwVJUn$C20<fmHwokP!y_5D!J35p4`&I?&H#fCgku#LN{
z7A(tqz*>yT{F2nNpJW2Rhdyxh=93E*XL8?V>vbkp619grY&%~7=^k#_Hu#A-v&{Zv
zv6yViwPb8|2Q%ACT+7*RkIt1zSNzrpyytl}<t^|t0c_H0iWW5Jb<O!eHXUFC0RK&E
zb`2lw&7_v?wQw%P5qt(|V=f|HOTu@G(+OxD7#E;%qAx;XbS9${Xxa%PCbU%dQkHix
zROMA2Tr!(chLsf{w@_Nc0qBy?hrCb^`Rb0^!1s_v!GBM=jd`r6lYz4TA+&B{4;Sw#
ztWRz7p`8s+{fA^F(n33_MhV+|LwL_0Kd8zjlm&#ucAhiVuFGk!Ij%9|zN(8~n+-nr
ziZA(3%6DwxI`IEg9{J<Mh89RWw-UA!6!#=Gd5X$f42gc2tVzFKOKYwrUemvS7v*NC
zc763sju$<;Wcr8ks`%@u(eM!f(C%jonkcKd6MPsw_gRREMeDKeP<U0SF%2P8wP&zJ
zhv?i{r`kWb39Y5LD{`>$kX|DO0P9Nq0G&%d_Sgd0#CwP>H0oXKKHD+eh91q|#~!$|
zonyUHpdm4tn*<-31n$z0oAe<gp>sTt#UH*&d*=W`2`(g;%<$J)*t>`*+T9Sty}s^B
zHDn6Mo$6(cuZQ6~!+#EZH?7C5C>S;Sj&o+vVzJTB=aV`#snUEZR|B^n)jHy=EKG`&
zl*wIbk~EF>;zk$)Q9HS+gH7j1Hlp`dVKGsHy+X!z&P$h~4;96#yb7CS$sB;}BX)kB
zvx>Q}zRwaKQJ+JDhN?B6T}NIW8;e`^DT~>`85?jb`KiTXJ$^i`Mmk@MPFTWyI0%lo
z^>~bH-;DvQAH#Fs8o$oGIPmwgPN}53qbNhY5a5J-#SR_S_s``%s&{B4IvDZr!4i-T
z9|21ZFhUV=<TbOZHC%dlnq4PmOIMP@NazZPp#fvW{@GK&>$i|Li{4_drOPFq4d-k6
zj}dctQ(6%Txm6{<0tgXyS8Xr{9q|_Igf_&@2d$ltot75xT+-`abcrA&*(!4E{IJ~K
zx@_adFu^|-R<waX^__=k&s<pAN#lRaeLHqU<15%q>l&09KqAK<b(g(@l*5uSX)^`u
zuB~u~jPpu~h)I9)ffjDiFz_ipQ{T@*Y~sAa{cv^GaI4|AA%d^Xz=fy5g<_A;GzNCq
zhL=FAiUC&Q`41hIWq!(>mP4u$3{wMuK7jUK@;`gGcqT%twNfne)lLho%ZZS^t-{&1
zl*R0G#uvjBPQwKTBh(acFjWy2T+)pNK{IvL4(Tt#*Q|ne?YpTgw$h+}4j{O(h-518
zVnKX4rrM|>Ur!1F|8$q!A7})A?{QaQvunFvWM(m3%P~9zC6qK|B$9A~05VP<quF5_
z?vWG`vwPfs#<zqT{R$_uC0EeIw)l~&cbIR($Gtt&;GBo((_qg&XV=<D0_2xfJpM+7
zx?GnCDU9J^;V4SAho=COy2tsGZ50rk<7l8Q%ikvrulK#5=`-}oFXo!THq53FnO>1<
zzgx(RURn~Q{8)QGWQ`K^pqx^0IapY6I}2!M*#IK`;kPvkL-Htfjmnn%7oUadT!^JG
zJ2+yb0m)!8bw*``%MgVquBlA9_CD(vY35D0Nf#{cR9R8s3zpQa*a?(8u)LQTr^kOT
za@9g%GCT(GCme75hZ|;$RBW4_1gaF9Nt0yNPLeKHp)cq@_AYRzqXlqp|5t4{|3VHr
zq0-`W4u>QAb((kCo4j|}%7Ah;b?%6B$q1{2N-!9g(V}lx`}$2hB+rCWq2ORiDy}5d
z#up=Tm;V^r@SK(QX(cj?7u+7bZjkY^{+X-m`j%YISEm~&lgsrs_qz5+wz=D$zHzE@
zjUrER0VYhk$5FPm>?Q4iGhb1)6hK}xN!2FVNS71cRN3Wu8lCy;hZ%|=M0q>JIR-Ki
zE92}sY}q)wol+?FO~}6gcTAysOC$4{X`-4CsNleDD^`ol;X@v19-$pL{5tMYwIP{{
zl$x`tLM=@vh|rEss)ge`Qjj~vIn4^&iFg4x)0uVwfhv_B&Q()+H$pBss_%BdD8{x^
zS;8gI2i2DgWnlgpiv}<ikl^b}Jvjh3hOX$N(;LW*0(zL+pyQ@7IJLuZd#)%xzPqsa
z%Ofz`W))07FwQ4A-@Z9;3@qxv<a-uc`PCF0%|GC$0^~c8e7xr0eg){O;)wP-LIRS~
zdIKbj1t2>0tm+zzMt~lOnr3cR#S2eC>`++48d5)z$)ly;tiN*hzJ(UjNajK?ll3vR
zJF%Q|V?)>uS-0h8koEQ3e~UK%_y4R>fh%%k*CTr)A+U7!P5`M1&6|f^xa5PX_p7}8
zs7bjz@(s4hT_izw0!&8N2bbN3El#tb0|M7<tE2uIrfYQAP2sFfi0{n&9TPRx&(rEF
zs{>FU#+(^NP=!QnlgawKmk@Dmz1wEm;wk;eW_Bj$2RDP~1<!jwjlb7w`gVZ1cZyh$
zbLQ03#)BFwj{s;IB;N-Ya*lx#%L8xhUp1q4-yM7~{H(4A#{WhC__k0@WYpv)2LXG;
za#m$9Q0I@Vn{C(y*aa7=i~R04B>Zk~SCu<Pq|^}pQbTe9?QkC(I-f>4)d)V>6R=~e
zXK{3_jd>XyeJRe(FXrsWTZ1P3_F>SxftUWy^jkLfW}dZL`ab^Ue#XuH9>ssQ|IvB^
zT~!XiZ#^(^k1V8#!F#^M2NEWF5#L9g<5ecdlZPIpzbKm-zBn<nl1>HIZe7{dQCyp>
zo&(L}dE?A#pgQn-zyBC#pX>G-+gde}>j~uevO@Po=~Yx5o6u~|z^|vFlG(xZQ|8A%
zwW0og9p?(aB{<AQ-c<F<eg({=R`WkQgVM3W<nh4EUTP{Hic!gIH0^fvXkra4N^H3z
z`Nct0)m~;zbqzCq-hzR$s4_fmPRAFdyHr^ihbQd1^!L-DouFhrqr%|PdJF_B)6h7r
z!v?4R#9!!<y#aROi_=wtXR2YhA@WXzV}1XUX0FxKsy*O#X&K|IsrmN$Rg`i6(k}Yn
z&*!SV_8`QGqRv9v3{n%oYCP6bes(dItR~GWEE7LS8?^Q%=g~%qQJ3B}wX`(7B}yb_
z67yGCBC%L>P8hpu!YAO8?r-V}r_%p57)C6u&d~HgS`8X<!HjshIm-H1?0`S<&3Mk}
zCr<dUm=T<9H+|{1Zp}aTHP*aM_ls@}HnnP+hW<*L{<C1!n^nV1+;D64dK;*$qNA2f
zHT9bT_$RyH&vf<s@F5zPcHJ{kmIvF=Ka|W|>^8d>sv`~IIWj8V2Zz-98@~YAFp@3I
z>IQ%$el1@W*z$0)Bkb2htJ17d-+$G9YGw}Jz5{U2*fc`)^)RjRA~C2;Hu}HcF`qbh
zLvx?~?Mq|0!o3_*5Wx_^7C?B{3#qCNU69VXEY+V5zH-?pWLSK&_<h88p*A^@&mj|8
zB5MdGx&5M}yCW+%ta3(sdHK>=U^`wu^ZJwhJ&d0j$fWm*FQ0iZpIC@{U|bwjIo<H_
zIW4r|ETcHkPiz}lQ7pFpWqf8OE4S3w#j1EIeyON;+-Jhi)x5d8sk(bphJFP=UT%UX
z6D)2BptTWT6G<MoI0#Rq;0TgS*t_=$TJQT8!JT8j_sXxaE*_pi*Udi{MP=ubd+-N_
zYTV55_9x$=>5YCBxLI8Em}!#5+`J$`+&|9^nK!SZR~h;I{H8wNIHV*tB=0~%$Y|j+
zYwxp%PyUSfo1oh41Pmq@8Do6a_j`@YszO#miP3-?W0S;MW)IF)4ggO^#Vuue3NDA^
z@1{4CW2dEm)wFEl_uIc?ZC`As6ny&qA-bwTO{IYrd>ud4=Kcipx+>d1Qk0WN<+!Ik
zh@bi&*+*DPdP1>?sx~$=TyGsZCDL@2r<q)i{d4N_)jK5v1kt1Mx%r)H=u|MMAcNJl
zo<9Pt2fTsVVd&(gX6EbqOi^TW(C+2>BRtLlSp_uQr5Bie<Jm`PVSv~-?{i6B(Cx}w
zO)U*|%zBqQCMnjS0{9&Ue^{YmyJ*h=0w^V=AWFJ=(2QXbju}M?9bZ)X`3AJ!b<8Yt
zm8wq~R%=tsIGZvK#LwlNr5B5<c>!jgEg)fU`Gam<bA1*_r<#9=E~3Czt`}d|fDc$h
zj5Hk^b9IS8J*4V}D{bv6e*Zc1BHOxQ-NH!aGan;dMQ!lS`%$uxwV5$F{bGt)$J+D)
z<jeptF9t`PhQ7FAHEMTVzLI6Jn0B6Xg_-CHBa2-lN+$gHejVi@m|Ex7yzTx2H*&Z>
z*IkwRz5uQ@x>9>fM=!GM`hD7Xht@a~D$o#tQwU5TmbU})!_VRde_NVjNAT%vkJqWb
zgJ$R(<KFK5`<v?BJmju@RcNff8^)t{fOj$~ET}kOw&6fk@%>HigzI-JXD)tvzauB@
z6`1JsyX?Pv_UoTByDu5J?0<IT++^DNFHw<gulB|M_17;2Hw0kII0GL#bHdp{M<YtB
z|Et$vIx-3#FwWe@uR6V7#r?bxj$PuX&aP*K{Q9TlZplvrr>ik-hFmAJpaXWjfE2<i
z4b|3ji<ecD^L=J=0$&7&l>%eUmtk7Z6R1HqH9t*YFoFI}k+Q7FEUAk__g`O~H*G2W
zU|Mc;^dTi-{J&fYkm57oE3-qjb%2vI<546xiW?QB=iCl}Gcuik58Lz&oBdVcD|M_e
zNPoHG!dIU_mtygQJ4IQ;raO9qN=GIR>*E@M?JY<WH8Tdqkpj7*$5y_0vTFzE#me7Q
zN3ngMFykk&YjYB+1xi<!{@dI9l8w@U%cB=CqaC1Md9vIP|C#=rdGFJwGuzcj0Ag7`
zh8dZlwC-YGe`B_Qx1jZRb){-u(8v8AoPD8%!t<Qm{Ho5ouYFDyg{O(Nb!PFuY`Y#D
zgAL!(8m9S1!yT-O&7s=bXvo=p%mqcjoAED#Ry5DC)uJk>9yj)nqb2EhzMZMn>S^4h
zJ-qz@({3uHAm>E<zOWO9&7hXLv#SRwg5Qv@Z}4Iy#fl@U9!IU$IevD(-+7fHck`>z
zI{T-~p8Gp3=1{9SJNVx#x%I!e;cfT#*&fvRK!L)n%Sy1|xI9bYWq|^Jsk)|N*lJ;P
z*|iT}H7}7=fjbqFXC%DCvdAmuSSB04jL}Xj3gt1gvQo|4usMN+<i1ot(-+s&<ddom
zH%n($Xo~H}KzwXi3C2fk-A8U`*G%Lc=tvvX`Ng>uwD)V9wik)HDD$RgXR~txD{kH|
z3AL_li#9*?QT%c0c-7BY2h<c`&>UA|rKw4Q52Vr4IwVCpybK8txyT(q;(ou@&>}a^
zoJ_7#b={di&>*)otNC>Qu<EB9F2+M34tF7Hu9y;3PX55JO)mt#xS_T&U*2Ur&h*7x
z_2=9Vj?g4(oEQV;xAFZZsrBYjqbSex4IOF}8wx}OPXd6KYo}n1S0748&Qyw#b?iqG
zu3GzC8^b|<RX0-LEz!hQh^@1<_B4R}x_MUjwy{f%2`2T`Z@89k?%YUmJJokUO;x$r
z?D^BMWw)JgUxdB^=IqcM-pb9ytAAdyq;>4_fR!e3e$L9kR@Lu9C)_6BZ>3E2&+~ln
z^Z3u{AvcKQhW}{+Y{$I&Z!^&_h<%?bqxt%G$bH=^J`lp9@oS|s)?Q@Y^lz7+9lGhV
z{Q~n@$g`=X-~3K|?X3Cp$@DJu6@Dzyq98%c4XMIcT}zLSPTKEMkiX$qmmR&`x*?xa
zu8s!&Xmrc@?53i!_272_aX@DKgg(Ik1%)7qwlb$a$<oaNy-78^!bom9yOLf3*cnLZ
z6X0iFH_m9+8}skkHe<U#wO}^h%J18{xHSDM`|erJ)^5>Qsy%^xXQD84E4}(beuCU#
zd&9f#nb;bmp*k2aF(dudwp^E$llVk|Hi+*Ydi6GcVq(S3QDyhz=QHV_=NQ|xZ`J*N
zP(%9s1hR$=5wePDSPXQPJ(4hcnOy_6r<9$+9H~Oh7u3eOIs3pUsp+|Xvu%Ef={C(n
z5x80NV{R<3WBgE^tU9mv=6^}gzC+I1oIp-RfgN`1KLz88sV2^D)~+$lM23N#XyVs?
z{v3PWO-24*IHSDldg+<%jidj2y|@bMMRWzI7yo1yAZ92kEyqDKGw_@$4iWB0W3i4E
za%)o1z~UQ=J3+Dd^GYkEx|nb?Xm^bfm|^76LiOVO{E~0^nd*<#BA?>z+SjOZEZ3+m
zprK#pX(eJl<bxUuojpHj7GZa_=?c{NQ`Q&v##q_+OXfNPR9myY&%oa~JeTXP5)<#&
zE&VLJvq26C#lb)qz1!Ps;LH{ckwlGhgAd(WQa(mAsgma<-O*U>moXqMN!k7UarTj7
z$>-+8bVAljw4c{qhjweX`?u=vwWnuwibsCB*rN?07B>R_{t|GkJr8XN1hr({E+yNl
z8{zSq8y*lW8&;M_1R$^WGt8F^P*?hwkm>n$jRQ;OHW!)CaIUkOvo0?iYMWSDe&7jR
z&(SqBaV|il98{MtfZc12nsa}*Fc$2pQ<vz8N%>bz6E${0=ZLcT_6;a83E#g&w^0`O
zI<((Ak!_4VP~x2QW5iA1AUEJK$du?`7_>^eezB%MJk9veS>Oonc3!M$VCOba`SUaJ
zf12o`1m4F#Kk^RUv8bv#kfKR60%M4CeSka2xwmS?GoZ)>AK^CTvlY5JQTfSRRYU1o
zWyW}&S5stxZ#z!rvA45-robjq9Sa$h^*`6Rr+~YLvv4`iN^;U{p5CNiLHy>M3b2aD
z?O46^+;S{WG7*QBy;zhOU3_F_GHA$+p333!aQeN7Z%4QkK{*@p#7AEpiueG06Wk?b
z>*j0AFroFogz%aCPWR0r5HPOr82@ypm>A8OI5J?VrQw$DlV=u=N4O0v##jtps~#}J
zn-#>4s~w{V0W1P}@K?@7NxA_y6es=muUf8H4gLR<e+NOhKpqT|uXakuz#sA*Fp$7A
zBMUWB$OnN$wYgk@8YJ)S!WGVV2igxHftj6@oLL^)p#A98bc1zvIkrw^WNXeDIn@{H
z614f{zLQ~=)9;Y%-`1!INGOW0DC!dMl`nKSC}kj;xhhy2T(bhM7HgZ8zqVMD$JljU
zt<+eg8hQT*2-7v`=Wd92Qum;wq8LZnz(lU;#xp<yV$(t1X4)&<u<95z)T9|LP?|Uo
zTWSKZDekAb%=Y|UHPJm=u_usY426>t><Yk_FHWTZ_+S1_euA=i2XHOB<X08C$|8#3
zf3WKj9jJImQ#iY7n##nyTQJ~>-%BY%cDmIpaw`TytT@%LxG$t6wHQjP@&GTGZgW}c
z9Z&KpgrB(tw=ls#>25_2ZPxKDoe;fI%@0hw!3_!cLd@*t*W0KLFuHnFgv4)(QuUeD
zc?V+-1R0b0n7U03h`A;CSvW&>MXJF;ttY06be^C?GQJ1us(LsPSmk@fVm7wtBbX2)
z)m~F%9(7fEi^1?CMqi0V>cOEr<mOP{`InT^z?ggkgpZo4&fWzyGyeb-HUhbMmPevM
zztAM9qC==fyhpb^TI3`@!Gog$qAPR-0s4V&F=P4|T#UZwQB8A?yDxFKOm)Bf3c_po
z)fd*NVgU6_hsY5`b@ZfA02ghH=L@)(0s#F{^Z}2cgC4K2El#U{;)sNEJpl=uKF6}V
z_wyirFPE7*B3Td`>;G}Z!sx($&l84sPZ*X#sgtx${;0gY-q8})lBSAit*BiSSZ}?Z
z{8Y!Sq*GD?hp=rtBs+{Z9uP8YyAT%<qkoxt{%u1|?b|m4#SPIeG$t$OT+X?DH`HVc
zyH@kf2@6SqI>RKy<ic3CtWDY#tMDxOG(BMqB|br8scDV}Aa>GX^xzK@SljtWl`!|4
z%h2N3oA>EcT^CtzSa};<u0{O$T4Q!Wu?0|CF3GQ}#`;Jh@TA<4JeF^(jI-Agyx#|V
zRw#ag-71Jel@U?ik*z7@>$nTNpyh{vmv^wiaAW^sblx!xmz5XYsYy^ank3u~M{D7}
z8h~7+-!&u{Nd$Nw;O^IYfkg$nPh}+r^6dffI%PP_hHkpe+_IGF3HJ#X645(^&}RuX
z$po5WRT2|rxnN8z2OzZ3PuUltdKsvAj72-D_Q-T(P76&KV;fD?4*41Rj=oC7-cM;Y
zW(z*`BvT+y%;*<SWeMq|{2WY>5#cCckpmLoNY<=+7<X4nX;&T1<=A-hqS7K_2yPi7
z4Nf$2Jy!1)-5@<%I45q|JJfXMUjCjpE&U{$l9`5`AoKT~W3m#&Y7Q=>pleL#s-+m9
z=*P?b!2IzOe_fMJnc|eRo}<JFK2bHQ{)TZvkcH$WWhB|#iCoAQB&X^jE4~&si^`i7
zMoZAndfZGxg%-*u8&lVB?;zTO_`3m=dsQ!3T2HBv6To}iJCP%W@2L7@BzSCB$v>*v
zCccBaD*#l#g`^8z7u+e9dVBX-p%4>e*aud$cH~Y*96AIM_h5bIr2BT4SMK<`MSj!y
zdm8E?ZiX;5&9%MjV&hwAIN^kSwn`IVerp4i&Fot}qmD?Pw`f?gqjpk5qJ-*&Iw{Nu
zDJ{X#T1?%_oLz{Az<T%VC217EA6g#-XS5s#Z31hc9H#m8*&h=f49_f>t=l5j3s6L^
za5J>)?-o3y>>FIY(Iv|_Qd+-53yOWIb7_zfW&kZ<Vwj0@FF@dWtM<h4K6Y?VTux%A
z0|CH@oIIT_o%$B@zDg$DnS*97v`M~mbM+ap%5~oczv7>Ryz*`aiRi(;uM_0$-wncv
zSJYOS!?8=?=^O-{#}Qg9W?hRTxffZV(M}zk6izjYUZ}QQg*lV!X_KW*H=%*f2c5uY
zM0bX)*Uv;5lCHvU?E%NvF;R%vDo(2i$&oy<=2az|=L1}?nfo-lObxI_G{KTnHaYHu
zole0q5C>RkS2^w`YPQMJf`rtyL`~VRa2F^B-xDKSX<0LsOq3Qey3>}NR>ZUF?&#q7
zVP#&>i!WK%5?l;EssGV(1O#nJ<W4ZK-3aai)KiSM>PNW3xo;9=V2cP(&|5*6<*{}>
z43Nb&55DSUN`isPg;hE-Ee*BJDx?^`z=!R87Ra9%H~TKSBKd%tjIT*)Jp+h#6B-bJ
zk@@S$<CHq*IK^He-k5U&>WU|s%P%Ny0|8-z;>VX*ufEZl2Nv-!XB@4V1D0tfZnX)f
zu3C2Ptoqv8x|HMQ!j%1|3lR3rQg;ckr6c_UM;8zmL{aS-85Dg-V>r7Nv%y}Mp$LMX
zGvI-C8y+>8CC6-rojJ9{t}Y(8@GfmevvT&*nJrC&Kld;8ML2x;XRB`BLv#}cOvIXz
zAkIepUH-;i8fa-AvT>+2-LGI*PR>sg>!G!LrgovgeZ4C!L>76E=-KKUr{Ye0AHA@F
z7$LNEPDJUqlDFdMh95shLY)sW^23Ab{{(>74^~dA9U99Y(UHA?{$?{1C5Py$;V+Yv
z$FHOsv6K*uu2^-b5hNgdAglvXg8IXY2qf0f3YbE(ln4(9-`$y49O8;h1Ad92j+-+%
z^;vp#d8K)THp5+N3h#mqKj%mL2;bJ__(iAQzn(uK+F+<F$k*9+#`0*V*SX@9Gv4W^
zZ-z%~Dmt?Mp(FS#|A+G~<C|hyeR4sU*wcyJO1i>;XGMrqd)G;ZKFqk>I1HqxNL^e5
zEm?6z6cDQNw31ab;6%TMmZ7CQ57{m3oh7ZaU#I4$ypFmZtN!$E_mCPnfzoP@zD`X?
z)}tg9P^N%3r<9tvY$VQqxP;tFgZpsh;uWuYD4UbNwh5G-j3mSDj)sHblr5o-R=qZ3
zZh~>6v)m?hSSkEs@ed1<yU^_jAEurII4__hA%V$gz0%B24)73uMg~~@`oMj>n6v{t
z>^*=yZMe#J&|wR54K3k#A#kib3p-&efHUr}G%LDH5mD@?ux`iz1`oMXqtpGLhr-=(
zoek{teQ*UN`*s29R?%M0_Kw5!;f`9E>}G_?c2`q=L_@dMaW|s{h1|ad0_3Rni4Aib
zkj&9N!DVWby^A0)IarnkZ<yqd5+>_A2%~&a>@-J&Xa%Cuz_n6Pf-m7QC*KT(yJp4u
zHS2ps;|^6Vei%_yG#<KBSxIp0vByPUzZq`KN>c9#QC~JyeGgDMKuap85ZD>OSd2ef
zFDsBb&*6d~lePv=qFnX}T2B|@2uZ${AesHT)I8%cNnaSC)0+Py93gTDR&C!3_WX8(
zd)Gx0om2fxw{0@F3sVc18hV)yA?hpPtJ#L@L95&9ZtnyQi?knserw$lFmW*P$K`8C
zZ#~uE0KZTq(vqDBs(HyEQ(u0(2{D;>!JRkI^~1~rLVEqL21GKW2=acit>+B8`3*&r
z_~^Q=8|c;|gotD|GkETi)VZ^lbP#Tox(iG?kcdEHs*v`?Y9WrY-Tsn5>%rB<m<T+J
zul0$T`_6abc|_TCqJOVsem_g6Uhn4TPU_7ErIK|`<!h!Vj)6BD58AM;3ezfBM}(Ac
z<QVu{tKp%6seXH490vrvd|kyQA!aMqdzbv|iz+zUUs^o>v|{F4JjV9JMJ9043i-D0
zwnZ<ZzXvwzQf#4!qCgBq8+u2}VM^Nqv^=MTKoglXEL^Hjsj>$vX$Q$o#7+i^(Lf+7
zQD(%_6<C4QfTg)kn`+O1m4Ro6Ej6j|XsBMv)1v7I7IpgVHWRvP%2UdhXh9D<nXd_A
zQeEK;hzd~do{k<vSih|yF@@=#FmV7zgh3Uq(#O8L+?;&-w|Dg^g5h|>xQh1$e&T0v
zlw?BtO}`a-OGoiEj|(`eMweQo7eEXoc2$4H#VEGSs=gnRN0JATwcg3V?#4Zi3V9$?
z{-b<JKyS0Zx?+;Rq{iwo+H;i@Q9B>OU@6rDq&n$~8EX_bV4ISV97@8{3yVec`aJhb
z(z9>NKA=+Ojr+kUspAzNey2Wzh7Z>(wiK#1nu5S_a}dgr*og+Y2I-i3RBX$}(~hRZ
zVL@V-gQuu7^`)~Ay%GDMDQ7vo=`bl6@b`nDiLyz|_t@oQ0l++lXYuH6j8L8d7(ei@
zvrn-tyQIf8zFvW%Wi84|K*CJh?g<UQL+}!1$*``l8|R_-u^QB<IKH0h0O?qt75-<x
zGq<b)+|NUpWDxEsIp^!7Roc=J>-Q4B<KjOp9{UcirS3xCcISPO#Y0OOk6Ro8S(-`c
zLVyod`9KEvEKiX7Dr1r>B+ILE!bRNNTzmZ$+|$ncn2Rm%xEXyPYgkCY8;E?z$Nh?4
z9h!1hQ!zk)^NbHUxx)tu9fT2vaJiHE-D-cMI!<m=t%HZ6W2C07lyxoZ#1w5{X0^=m
z?MTlIDuLx4oK`lnMGFw`rR)?>mm6>U<`ywq{e9tJH;4(!=PHAN(1a2`M6AwV#{r1B
z%Kj{r`3z97gjB%Qp`=oQ9Zfucqx}^c59V<GRnuo-l6aA2P?_VN&=rk1OQbezbY8mL
z+4ICVvT<|0$j$jY#7{Bm4~FI&Y3AJcXoD<vp+$X^@HL_ge2*94ZhH#YmhscU%#{6T
zbyWlU!@7sc0`@h~5s<Dy`7fl=t&}w?%}})V5_Mz91hDP~gDP5E%f6OuFcMB|qih}}
zW_PS?ei_7=)pN^82+sb=rcTz7PY)|Eme7A)71amy!22<hdig$*7VHBuXuy;yHidLm
z$!^&_V`$R?9T<U!OBGJc;g;>QEta*+#=a_&ei3nD(xmg8mHDwwO<{$cuwxwSt<q~6
zs0v4EZJ4tf^BZpHJ%I*&^)*0Y`d3Z0F~DZ-C1m4S3x4<j8Ng>X@rg-_of@f&{Lux$
z#7k**0DK<;V%|LEa>`;e>fE5hMt%YK4;c?en4_=ONf9Y8`<k}Xuyu~+T&ponH>dX3
zJX(s?uZTZ-V3fCFTePf4nPPtkx<0uqStAcuoK-ff3_zaSQ4+FR`UQC5bxMhRAtTMo
z&8D4f*{?7PDj+V4>N_glHkpe85N$0++#s$ca?9A5pO|O0l=Zd{+y7}gszIP3iCXm>
zTE76SIYAP!sgN9BMrpkR_AX;IU)9x?g~q|_pj;2QM}$b^Z}`%1bOIe`?@$RxfylaO
zq2#1x;oZ;TW7CFP2Q1wsk%QaMWqS?u^L;?B4wx;+PElG90;XZlD9G!an-MY6_;nP(
zD~>@=o?^7QtCKFkZ!6)pF_A_*>H1ANKhzWwE;5qP+Z_*o@+BHywLgg$X@MDtBG@2q
z)|Zh&XQ4Mw6M}=w;osGl<wCSVzXvQC2hg9jEhOsg99HPm%Bo<uutFk;m<{M^<0odL
z4VEw<`7)n#s+yGzx~Cy?G!C=YH`H+l^xIPd4bC#RWfPRg;yw?;*&FWeyY@7E_7}vL
zD3vAx9CFV=o?I}3Czt&UtPGrGR4H20BLaT6hyPV`g@Yi}Bmxi=w&G-gHe3a+gqYjf
zviS`hB}!`92YgB5qlI}kr?|kF(Q-zwxhHMG-X^RBj-S6CV;y7XQ&Xd+N^b(2ZT)Hs
zeu3$}4t6@5tJ<ugq$_q>JQb#?|CHU@@_nZ45gWohE_&Th$748-TUrRb+1Bo8VcNP^
zwt<f#C$>Sg{xe=#waCpOH$T3(vqnLqv=YGX%4ajX=C;Z`LSC;fM`l)|JkXyM48>%m
z*z3wq!NXUi4!{~>*Hzeq;|#UbzJeFdOQ|V}D8_V7b{u2d*y-L$LmP0^QUptoWGS6S
z3v?_KqO~59kMyof^{c4R2UAA<+*G?UyQDjGl=-b^6JoA-;!MuO6i=k>^7EV6%Pv7V
zCNBG)?(BR1o1U6HT4hK9uL|t&qD1m1KAgoyqW@_@_k1frWY}XS5!#BAQuieLyOaDK
zz@J}b1ptZ|5n?Bi)3Gu^6Jd71xq(9#h6|otAkWacC6;?}BVx{qeeMug=Agg(Ixlk0
z5n=a7hN^uzsJ`f@+TbJCQA8*kDR^`|e?2;woy-wrq+8<Rq>l1Qf4!F4B5-rI|3MJo
z?AkEY6b&d9XBU`^tzz==K3da2S1c2+;{z#H5|igG-z+qF3bk}2&^rP6G=}(p<3LjB
zstt8v<U@2UX3R!*1E$OML7%6~zQsse=6NxsPQs`ZRjVi_%86?-yqK{K=$x?+qEf>#
zJFzSDzr9w{y6aO&4k9g+_JcVc^sGjlvIuWAtEqKuLiXn;^(in8{T*ziy<m|zf?Y`%
z8<v$1nNfm~JSU9uDavs(eC)C`_z7s$*NXFvnQ*dT+@`%wj~36Q8@=OU;+p&f<`myS
z5};jL#L?UB@j|>sSKBc-Wkr5z(Bj$v$y@~Z0kfSHh!CvUG3x_SQWlfg0s(_J+j&&n
zqCadoqA;2S5bbReQuG4F{7`WN`jWEXEo+uu_kjt1SkTb~pyHd(b60K-4RSau?=O{%
z1DoTh4n~6E53rHcTNK<%Ny=HZRzo}n@jJl~r^`2huFS8%mB3x^9E}E>4vFxNW0wa?
z-V7`qG+SymUYXFB>nG1G7^U4YFUiu~I-=fFs?KdekVx<>u((US2wWHuX=v@1^)SP`
zuNa!5izsox3oZ!iX}6^&erc{Ar1i42aIFtIQ_BLU2SROc<(9e@fBN+P`hoep>yeP9
zENfwlMm3SI+NdRuCjA8EHwsY6$hrl|eW}K~iG$TKsP+j>DO++#n%zO(F4cZvR0K2@
z3yBd6x|r#e<|i3?cDzvSDDC;_C)dqVLe&2TB4hP`2mkMAvnmX1%9);jP6xLGlVs{z
z^b#=p`ugwxqE!4x>$~cJ4OnV%c9g%n*w_WR?R%i1zeKVIcFi>p(cP1(&2pfL{#~ID
zNRInpz!j+Il4TSiKKnjIze2%QUF~|C<G?2S1-_9pRbLdsV2}>MT|%Xn75;qB1$=N|
zGt}nqGo9lx;l5@tBKnQl{8Zh*?e^tN4lZo}Mcb1`do)%OFKYY)SW+G2gV1m)_{g=$
zx{_)kYHLW~!Tz7Qz&bAy@5yOkCDhZLfa;X|5vkE+B$90O8@CpTc@EdxCd_)57@LS0
zKixkwpC~dwUha!Hj%S%W&hyj|9RQ(eU<-QOw}jXdB(?JM(>dw&MOSgF6u*8n0;|*T
zJg=&Z;ZjU;hKf}*!?Ym#zVXlu+SRyda@~=S+{ieI&UeSpE`j}a`s~d!!I76wd;B$b
zs=WM3?Xlfz1)H8-Q2ToljIlc7R2$JEEsYK~ba7#<rz3DDcQIo-@p?Nrd?d~ygcfiW
zUU{BhTL8zM<dTmQzg+5DYTkZzpychqQh?EwRq5v9`1v+bG?);9>UJw@!=(}R$^WRS
z5sTnT6KC7xA{@&Y>5&yfkM(4!HmR0W-aXVd5Vw_jxjM7mmyo#X)b%dsRvaT#@9+iQ
z^ZZo0I8aw=Of3q{*6te-dru&_5;I!P<au`bC-s%r@Q?_NAfg2e9hjYPePCacxsb4#
z^rIBmjDlptjLX%1U`}v$fMin^AhvC(tqk?#&F}(W(0Co@-4f-}U)ptb()X5MyY%cp
zo^sl%p~DP7tJl{M6Hg3*m-r05nVDwl-*4sM-Nx1-TVcs21D4A3e=c8yrf8H&S30@t
z!f+*>mi6UaOLH#^Z|cir4(_Xe^QIqkCzldzYMbiw-l5M@1dKqiEP(BMHl|)yEMkLI
zp*z3;-UvPEWSwfZbTd8Z)o37`-HAr9_!|MPQJ3xeyo0G@yO7d!sS<0b4^3riHmlw;
zLUSTBO8meiq^|DkLrTV(RSW(%eCSlhmJml!>0-~5IsMam6Hlwo6q5{?kgCigqs&Kq
zccwv>N}tvC{g_OadHz)Qpe2)-fi0V<UxzZYxKz-PaOld@6OQ1RiF;vx1stHN@B8GQ
z)4YYGMFX9y(oU8f4TrV*deJMfD|d>)F}`I))yLkTxE@mg2X=lH=`*(AyvSRj`s60h
zh~k+a0{DJ#7$;}`t>uOitX}-k8;yVbS0Am!K)wa69I5*pPJVE<MHeitts&X`T3Rc$
z8fU9r99%KuO}z!*7tY#IYs7k_VeM>WaASQwmtq|Jwd&^_UF#3qUp=JQvLT{-vb`O+
z+^$_xQc1|WjOo|JdLLyiaJX?ZYWo&i_X9EY3bc^W^1b3gzrvX@(_r+m;W<c92ql|A
zb$N6#2*(<k@t!yUDT@~&f1GW2lp6Aj&3|k)mb~W<iBJgGNj9NOxAzfshdHmpSt$7x
za!=qsU{gwRDjN-H&`2bqUn%^dgyPECoT=(EcRUSi>zGON^XH2n<SDzGpT|FMTK4wr
zSbIUdM%8=w{qE|bYFpPGr8Um`Z!>m3ZAfr-_PEkFnBe7c<+s=kYxUGrYuSRY8C#}x
zD7(?ukeWPPj>B*=6BW<b0nY23x|O`&c=H)W#EgzWO%?<QATwJp@Divr+_2+rsa8u`
z44^sHl{v;$a;}?w#YR<tjs^oB`hQZ;H5S1DcYPI{c%qjrsGQhZ&s}OZI!kQ_YSANb
zG^bbG@H~rZ(a7k&UKo0DI>$09tZgNq0musC2akR6DW3x0-=tvz_OI8pOWp@+2$0CD
zPNT0=Qjl6!7}(B6weif|5)eOYT}TiyMqS-uyfAsr-mf6gNrX;nSqIh6xe_J`YSTx@
z_<!WE)9ithAtPxEv7(K4A7mps*gR^wuFbf9OSOxe^@sY(0+^?QY90FrZUvEo7L;M?
z0~>{TgmY5u<Y@UB;+zjo@4uGHE$&x4)0enX>^Fa3e|_AC=u{U)8TI|!*pU5WW*1Wa
zlLbCDtkBI6F*HYsxvGu2f{LDPA=ddvrG}|;3sB1@wl#1qVS6_QF{(|6%GAyibw{7=
zz4^w?^Ku{Qhf-ostIToVkQqL>x{m-hMq|MFXzWt=4;CPsezvjEPtz}Vb~ZQK)YSBT
z)dI?5Dt&_6&z-Q&5lu~rZk;QrkKKR&R*v^MQJU`f^UFEl!R>J8VZ4A;hG!>xIBe-~
zp5xPJMNMPxjKG5tG2wrXhz(|kftO*4So@h9HYO+rYiZ*Zl~wbB5J4~t;~2G11HZJ(
zYgEY~ScH<SunLoJBKJ>d)=M`hqMuk2cwL@SM~3iR1a1S#wU~%&XKSc-V8MWJbMedl
zlJcw5<UK?7CZar>(?eBsKtLiWtVEi28@{~hV;z*dLzkj?ChfKwk5y_Ug48C3)eVM=
z`n}|Bq%%ViJzI!zo;7_;2YsNwN@rM26_<;7Pq;F@i1?zz{huZR{hbJF&-c3?-j@Yl
z;jvY6;h?ulD?*A)WKrS$$kuK!B4pyduRs7OPxnQoEOy&?*0c=T|4_*%U65)dS2C$v
zMtMEvp!XPu!vcF1Cvicg9k>X`<jNV}%1aIjg~4}^YmBoYAM`fx#`w^AaHE(26EU7D
z739DI0%M}6K4Fd!G49oMj@cyDNl_e&7P2)%w6kp=%b-uVzynh4vXT(J_0Kh%WwrEB
zYg@0pb=^y!n*e(l&0IBL0k^p=O-=>G4Alk)`NjZZG^qWvcsqejg1tkje@H`KR@u4)
zw(v`1zm;<HS3g}^`ta4>C7dfAb#=hxM)QD`J}%XCB<O9zx!=@3XTU#lIvjODL|i(W
znUz*W%sAB-LD44`3QQ77y2YWq7Ah??&|-Mb(Oz*}8Y4>-rs{u4y2Dal>uDqJ0`{Eq
zi`|D!8^<UJ@Hx1}@s{Hz7vDZqUtquokVy&$Q3h;`R&4)r5&GCzNK9$#ksVd$H2oMA
z^D;EjmzBo=Can;q%}__`6(1HB<j{Tu=cp&Ocv=oex9i=g%5JcJTN0{wp>Q2b`MkS9
zjSOfzt)ne_dc(np^uSbR0cQ5WnXE<;lIJRnp4Ky;C=SL~;F1fcRhDmusLlf=FHlxi
z{SsQj<R#p}VC{?DJL--1hu>0D&MSXyI#~c$$UMNOaT3OWooo20T%iHG-7Uf8Y%UJ2
z#OkHJfh^*;=687vOueaXeC)FO=?n8OPt^-cB!9F$MCVdrdlT^BSfC1!R6XR4Z>5Iu
zgh_LP>^+p75{}v6UNHl~x!w?PXWT%F>?gU498f2p2_piWPC-)@lZXx292o<PwE$fM
z&^&z3e|dM^$G0WUzW}ia2uLv0m9i6nNi`AG?yHlk*ehz*cLS!23UKoI0^Eb2Y>%!S
z<&=i3%s;Badh0y6Rb42q)6rh$-J#LO{e3V#Jv+OZ{hY%NYLxu|iiucARhSgbP$9P%
zqbpM9#PDvf9$8_dG-l#ODb5$4^%5s^ILhZ(^RiPcZdcuT^)`;v5b;;FA0Ow@o`Wy?
z+O@M|@Xj=IjWT?Omrkw3%53X0V}e24ba7tY%M!6~#9uZI<d;Fw8~sQ5S10`Jvz8;H
zBELF2u>RWSvI+X*S?64O<vZjbU5ec|r6$7Rc#5D94W0Oh<UYBuj(881z-C=2mTniB
z<t(R!JM6Vrhg7qZ*>j0j_32HaEAh$(*spbXE77#mqg90eWh5liS%}(hAN5zm=5i2H
z&e#$DeA~J48|kY9ho5Km9p9Axq^QF5(5A|w*zfoJ8g>Ht1>C|leg*wfv$BwK9i!zl
zn{$Sr#6-qXwz3SOPSg!n(zwh3G)9`0lCx7rFFtdOkL5lXnC3Oi*m(cyw7!VvRa8g#
zp}JvYjRFVI(EmQLiot<Zw0dBHF03LaCZ7ekwGR9gbTBnlWe5#bm6iEmmksw0tA+&1
zC^^C@c0T0h5G!NO4dKg0*WT6^Ez42PLskfrxty3!eQK1FB{fPWQn6b{MA0I$RhnDn
zc%0#OP&7p``%t<H``!aX_I4FlalYZeW|F)?aSWoSEc&3Bqx1MoZ>TE;ka;+Pdk1{a
zH1$O&jXXiM#Ip<>#lVcE6VP`%*@BOtIR}>0!1F3vI5ti=S1Vo5hMZb$ayG|Dl=+O!
z+K!jRPevDl><YabwZ-$rgu*m;H`_|tFYem;R+>hUy~?UjZ!}gm+7+GqdTw_2-3t3>
zc56?c)_*acyRp1n^VkpX)J;Hzg1f;sJ!^kS$N=@O_2jBvNe?V!TV!gJ!79LFD$AET
zKVCIjTV2b;;DBH#@Y2qTmmo8nH~;)@MDeVzA**<tC-%KSFB$hA3H8#kUe1cz?&r2U
zeGNze0-V^@mq7V<=>Nl=3<0V!Y@;FD5C0&)M`=A91Z8xMBiyBc%p8YV+Y~M3dx8|&
z5m$<EA&FO#DnhSO*g(sPq|<u`!)NyOTha-l`0RA!<alLP^<AMRVRPup&8bv+=wZPB
z4W(8u%stiHkCmINK9)Z%e}z&ULMQMK7i=t~Zrc7%?Vih$30=)jrK>Ij=R#qCGLHhi
zS6Bg6c;G_>d;<YotkR-n5n$qL0uBGG_TmAc1N{ozW>>8Equ}qGs2q&y<}^5^6HWko
z<>_HysHQkd(W3m54a}6mr63MquR*BMZ!#BU(W=ux3UEbvq(DQpuFAqD&B=dAVbF4$
zp686?4)@(8OQ}YpYIu@<w1ZGQz|3Xq%ow8k!@Iqmdc&J_&ZNw?8DZoOT$U){9yoNL
zH>_UF+~H&Os-L1|`QVOP2?jY=bU2}Es>XxriV1MPVgKWj(aM$|MI~TXnkXSFYN{)x
z>dqjegn$U;1+oi5bJ7#5rXQrGSHGI|by)iNq9SCa?nT(nc|g2+@cg&e6Ih_wxWCpW
z(uSLPCJY<4!?X3UtDfz{=q`oTvLqO|W;@Bj4O%z{KmS*)`+!;uz{1w%fdc#su~D^=
zCHM0ut$7VUrzwsPgk#i**^{VtzTvF4cfJu<qCmbPX0(xYS_qp%Ch$!1K51aFD8rB#
zxxa3RMc00R+jxlOmv+HrZtnmKKql_0Js(%^;LZ}D$2wxG@voYLt(xMD@(~)O$?K_(
z{Fi|ZYNQp7J?^++7D!^|3=a<46QpcmEHQzw?US!%)`U(U2wT0mb2*;y>aBE*)ZvNm
zoNr>1<@14XT-vq114H}|=|H7(gv%C;Ak%bK9O>7nfCtIzx)eQrRMi)*#JNcQ8yvp*
z^FC}G758PN*BiSXon}8J$4=anF%Bo){Nt>eO5M>;u@@NL{3GQ|qTadh8lUk^Ol<*f
z{BR<a*kQA>Y1qcrU?EAR2RB}YZoQ2v^bhnM4d^NM7e6rnix)oZ6`6f>v<c-<xvjSS
zp`qu0t`|Ho>2hz!#IMjlHbMhk6IO5(ePZS-)+VRx5$Q@5(fLYaf5}@`Q}$192Q4*c
zHQz4&b7!uys;DN*yDmD{)rWV?Y^&|VNV2K22oRMFru7oz?e9uwC!L=(nOA5AmBY9W
z$`0UKX|C>}9hJ2b|NEdN9^>CQz*t9D7Soqrzp2msqls1jHuZLI=kyvm3%up);4Q1U
z0r<lM2H#fpP#P@RLf%L;YNKqMSM4B%T>vQYqk*o#{oE$EmoR}7cu0C+icToS0V9;f
zy#I%~Hw|m*YTH1esECLWQ4kQ~fTA))%TyT>CqzVyipmfnwG<&BrYcB;kf6vcP^Cf(
z1!NW(qCh|y5+Mw4rN|Hl2|^|ZrpVq3VM{jYS@!*|bDbaGuk-Kwqh7U!oxRsy>v`_y
z9t^bXIvGX@u9?G%vrXJ)<q#={wEBwdU5m=H+A@nE8c4y!<k#AD3e&J!ge$p6y8QMa
z1n6T2StsExfV49CZT7pG3Tb-B8)3VoN~U;gKN=#58Z&Z7ol1k<i!iexDIvM%LoKep
zuLaZa=PHgE<?1YO)h0-*B1qXS=#sgXD93@lK>&6w{U99u&6MVVxcAO5XL~caU@A0s
zdf3|6?HqC&l-kW|0h-=3b`cQGr%iq2o~_5UC*RlGwcK#0$`bHuCxSyqjD{iZ3PZp|
z8Ut%|r3u1SIP;(#ZP_E8p;R%mOOw2Dltw-W_~px*p2N-OqYEdv?Nsa$^;7_GV4TZc
z#m_&5?Uu1M1fhGS7Y4R-qu#{e3E&ocFk9>VK@*}dMsV`y0Q{7>*tHq$kfgDt#~oG0
z1P$~+LYF5fDAEzVPC%!PcruOO(=r6c<j2E$PR(`X>5On%ODWH$pE7@PDI@nj-Z?ZY
zi2hamJh;mJV0-%U60m#n7bfMiJ$Wnv2V`T?w<+6)o5`ZN&2*~<$bN$6a&`!qLPy+q
z6fAH_MlS@8R4(|Ek7pX$FLl1|oaQMG<(zGJo;-2jB_WHeMvp+m5ZCp2AKritz**?a
z;pV~1!<O@8HTqFF;%;3|m5)R)@GAPO)V<FpO7j3)zj9uo>B=gJtNyvZrtbFppsIqS
zDrHh35Tk8o>^)TGgAx%IY$kE4Pq*plyib)1jX;$1dWy$*@tN@+0E-!UoKEWuc`S-|
zNV3SZ`(s<u&zHTvi5?mh7-nl(zmiX=0e)rzGZ3`Iya9dmMW!HW8$r*SxeD1K4&|oS
z_2{({v>gehNJHzsVEoqMW?!*GQnL##0bF1D`ccvpc67<F%zOzHWfez)ZGe>k@X-f(
z-B-K8S^7Qmat}uSJ4BFy!HYhMQ%{@csv*)tuuF_TWZY2ZD)}t{;*^NX22f{7lan8=
z-aB|-NT%Rk;}IaNN$t7UkRV&XTm8$7m;m~_IB4DNOJd@8C=KZmaWyHIC#UiZp!^Q3
zA#&p&KXu`KXHn!8>rm{)I)0Vbhk}T3W>~1KP~rT3sN?UZkJ;W^)P9479k?X!#yRtF
zY?4r$9swJk9*`B+@Nvx%-!K>&=gX<uOb^HUOgq1=gEks6i{d~3D84f;O?v<Ly^_~K
zYIh%Lg{r$W!MZPsXpGhZk}To^zb<Omi<@cVR~H=qbEQgfYr_HGZ91poJ&zX$xOezp
z|L&>!;sG%Zu_E$rAS7Nb@=-oHQrD~BQ#kbisW=67wOZJDLhln2f38hhh;q_AKgiiO
zWglNsJVw?RKjpRz%#T$x{hWNOGSnoZ;UK01=q&@mRKAl85qkw@atCCG2%9P}?KHBJ
z55qrmwK)2;*bal0y)o2zY~lrDa{&EVoB+`TjGP;inGmw(a)qQU_EROh#d6Mr`#`nY
zL|{TJ17s133iFs!8?1Rhy!B+>MyN9thw5s|i~0fprwv?d5JS7a*_$eMH*nLk6%2tm
z6jDQ%=Bikp;Kt!A^Ikrke--jC)gPf;IoB40?FBI>UzDr!;aYjnGKU$!8kJB57YG7P
zkL4Ett|YGl>3U7@0lIS;($?Kx<O?x*DU<k}9oLvrv&@0{17HxZz?>ae7{45nj%l}+
z^XtA^KOdM>leY<#YhNQ_p&~nGLs{yDNuHkIf>2}}FQ2*g^j4dCh9voTUy|MG?4vF}
zw}xLZIjt_XlX-)kZ7Y%rVU%kUAT^~1PmD>;+XypJ>&}Ei8du!gLDUY4%u47?7aw>J
zr#2*Ab-W}_wRaEVRR!@uM$^xYm$Qn4M}`G&cR0JUop!k&o~nZ|<De>wbr5GQV;jKC
z7<xI0Mdv5gpeP9!T@TV_dHIN0LmLs<$<FG`*9g%@ulAE91R&497_^j|;)Cvb22Ox>
z>c*L@2@~kI%kR9AkEaGez|HXMZk~X_emp6tF3et=F0rs3Io}w%TWvAne?8%CAQyDK
zP%?;xyxn?{U8O0CgOf^wL5A_p^v>0I{A9iTP$stowSLC8#u-jBwn6gSf!8S40^wtV
zZm<3aBPUbZZ#Me<!73j4l~y2|Exh%TP(ncBt-y?B7g^p8Ug5xG?$_l$^)KNHuot&t
zl#U>+S5pg)Rcefx$~Kjt4lr|e=+Q;=GMpe&71hHgOE9!jmc_I1Y!l4gF~1P{Ej}df
zcI6lv3~3M5<p|ePZbokUTWPu;$@2Ey-m?G%4C}!sKV#}A?oeWJic5dSw(=d%$Idb(
z%Xt_E!Cplf$i2ixwgNBOe^i25fNdZ<pjeBHNvZJ+>>K4@ILU6MDe4Rj$1x>MxuG(E
zpSgUiQCAZaZ1yxeY<f8q?v`R!<uzkppSzq<W-&lYJv(`Lv)ZEF8L-@~&=uASX|ZyG
zfy+3r8{u-&-9==Xx-M@i<__`M&iQ(w&WGp8J=OGQ;X9kZ|NB>cgWb7pMJh~PrnaLM
z94L2KF63CyE$ZOTA~7-f9~D)ODg6XuBf;s>_rb?n3gbu6m6GU?mw9`b>uAaU3G#WH
zZCrAzm~2s(L7MtPrqsH~yLTISTMVjZcLBxwDI~#l$XbgDC{l2Bkk5zQ=%N`P%V#iC
zvaYOn#^6+0s6}Q;$#iz;T;i_UL2KFJ*SD&0l~=`?0-)6SG0!yF<(SIy6>u`{Wwz?D
zn4+rh(W^i@4tL`2<YPE%nQi-veEp^vIzT}%))6U8q5Cx~Hu}~XI8Cs`J(m1K^#ftP
z7f3Sag+HjAw{qP+N|ol@i|wk4Sg8=PBDvK<<YY^ZzVfYobrZa5%$b|tx`ex@)bc_i
z+8P@Yw}Yq;K6^RpIQ%iu20&WPxfdordernSP-gEd`?8~ldw0Ghm~%yU$<Q%u3h>6|
zuAu)2B2{b@WLlH_6ciZSd=8WgRcu_`zL`a?Hh_wwK!jnQ?eJ`PV%?k$V*HxddNa~9
zk#6TynOZ%aWncQ@LuI!6J)e_yS&u*p0vn4OYQgWnwGt_IJ~(vK5h)As5spEri%FGu
z12o_%d<Co3Ouiv@-3nVrl9R4_NLcr>dt3(?{Uzk|wIOQ6VG$qaGg!ImC=ifNf*F`I
zgz3bjFxMP=!qw#LMxBu>HvFH$TSef|$!g_!+Xo6dv%}AbWkjMu62G&6ZtngjYc@Z$
z>9cKgX{gA+?+4@y+%36zACsUoK`(>DTJuo-;I^TvdC<`~!^{-xL>o7nWmV|H?y&JF
zPi{@h={v)6`GjG6+|})OK22|ar`@~vsrq~e*u<*9at-`eS;jKD@>VWaH8T|+7wJ3r
zoITSM`^n!SZf#605!@r7MYJ;ZjnGw@OiAbw0H4Hde>!v(C5l7CtE|WEjZTe*h4HK3
z4>}LMlV6B201}Zo#MTn`#!l{pq$)h=j>}IzG0dHzOerr5C=n7;lm@M$i04o}S7Kz>
zc6pB1SehYWZAz)S+Iw-NjzXvn*L2f7FyAZFh%ednx2}BgAog#<ZH@!_3qme_8-&%u
ze-Fz0TLpf>Rv~(kxZ9lVw5B#6_u;B*p_Bl8`L)tXgO<2I0qPkU9alUu&^Gct$=m1P
z=ei4hg(_#@xlUq=aMMrxtw;fw-nz6WhIw0-^cTQ$X#kB`UH1nyb45$W$@F&nyhoWE
z{B~B=j5|F}s@9!Y`P=jOeUGpLbySC|)Z!xVVK=!gq5(gcQ?9uLSBO>+w&0CvWa+7N
zs7cgOmRt>ZwxDB0PxpoOZl-yS`{LSr)jDv=R7Zy=Qw_$ZZqcftR~7>E+Qv=~U1F!7
zX;eX?fISR&EQgQ=g{JZ~$Z0EH=pBod*vb6GzGhu8>NGUZymwQ%wQi)@G(s9hU{C2O
zHSCnu@cTdI*}rl0UnF#_|LaD<D|~kWsFKougU4bRzcK#9g|2YBqCMn62#ysjgwAo(
zv8(1#Pf@g0X9kF>a|n=hrziNWCma0H?7b>StjK^pTDg>nhT)%@hpQ9f>xvuUm9Hy)
zxqsq8NxKM}f&Ioh+CI`DL`=JQguCRrz$Cx}(`O9(X~1@AkB~jL!r`AR7`<H++VBPT
zBN`ZpujIt819lNxM#(fV=06TzdXvHTU;-9iI^$Ya?BiFmuHsrmSqx)<z6mTz60k<a
zY0-B>#z_(;vUjmd81J{E23mMD!oZ^2YT;-hkEjv6xbhQQOQ&_DmhJ`JZCG;39sFDz
zc{fk5&reCUg{E%iT}wJhQ2*B<=r}PM3!N&*tJBYez9~R5C*bi28}%+AQK1rS^1hi&
zuruthMt+_^?gb6^Pcuy6Dt2$|PW}RgS~+16IS}Q3U3y-t__t=gd#XrQ5o3^BCrq$T
z#qpHJ%Y{mZNuPBIWusH}mPti)Kje1Fl)<rwWuz`j84&;G1h85I%ckVEPdh>b11M`R
z4A;XhYqg7mo;=bNg=$I`Ww#Xv0aG&|N}B7@N#4Y;1v^4GbfZnV2Pu*Ct`9kpElg`B
zmLOJbQ!FG64OtqhzkR7Z#I|$VEh^-z`IVLJnVEX)Dz1vK6NET`!;NrL?FsR8hhi{Y
zUm3StKJRVaqIsNO+~15VLTWH;r*Hw6s8^N(6Mm$o*;=fN`?259cl)lI+Wl{wuf`9*
zP2Y2nklTywA*0#^Y2YjjK16Hz55i?vCdEsMpBC1CV2Ozs6pwVlPIM4XIp%&ToQ$EV
zolTdV)Da?WQ?qsYmh(e>)$`*~UJqt?5b2FgY0l0&J7O54V9Qw*NVof3_yw>;$c9O1
z-Iu#$mAYMtZgscr>|!RL_^|Km8}IYUqNgh)F@)7zN;<Ml9r&&>q4U(+Oz7mC20a*H
z%kP(q9QPNYhk>UmiQLb&P_^c&g5E%LH7#?dgQL$M^A2)!En>DkhMT4uZ67`ndd(zr
zu&y>$Mr_hBaE+odC2Qy6$@7c}2Y@rFJz{?0Kf<(O5($8?m#AC=w!>x={LLMoF?tA;
zSEk<Kv;{p5HFWCN`JQ;~#=Lv8Q9YIJ`D9{-vEK7JiD~?1ih!XL146|Lr<-4n4u)F~
z1mL$ns~x<$Do<6x1x-L8{d<6Q$zh>#vys|ADtWmo4E=Ba>5d_Ku@U_CAK;X)QC_6%
zGr-+lAl}vXLVwJcen{}I8Vkve;6=HcwHf~aeN3dAJrZ2>zBooFrtv!_^p9J2z?<U#
zC;~IJ2&yD1(R%C_?jWIr`o9)iR^K86SA(i182r3vbU@d*69B{yfpLyD5g>q)<O#T@
zdXf*R#nXA)lp_fJFG#>#N2ZZ@k+GBwzO>ql*v)i}T@{7Xf|iHziF1<u#!Z#Ed;ePa
z6*FE=5d96NxTLS-23FeICd2Lx^zZtPUOq{`{R%y6u5;6F(~8@DIzV}>kKLl&jGkML
z=LR!Vu<Dm!+3<asC}$!mQfz{!F&+u1p5b60&ebJRQHRIV#zw<cX&KdT1TzK!9X-wP
zhY8P`md2;gzg)^BTB~8sELU)YoybJaKsZ%Elzu8N3C;vT%4Ma&gw4ur|Mfo69P{%M
zdcQ^D-J+TtnkWGcjqK-X#{=VClF$8o^McB<J-7{Kpj6yqla81%(-^j+<8=R81P6T-
zS*D1h()B{>C$?mCC@lvUfI#s9(&4CI8f0vo3DSfI-tmw6sld)%;Ix%7hC>P61EI5F
zvZK>>IusGMPY>j7^x!l)#N!O|YUOy|4i5aYk7c=Oym|8x$j*&lr`fx{<eschFq0jh
z4`a`8pAA^rYzx&bx#eFb^dosU^GV+0CzI4-7#86AwlPJqks#5S+s>@3#M>fs{*Zqg
zvo;}Ff>54JAR%o7v_&#Vr*oyU&P!|fYzw!xo4QJ!27Xxd*$YD@gCvjV%~`~_Fj|3~
z&Lj2Nz;*&+<=58zQn|MouturDep`Wmb)oPg&FV1BZS5v#(cHX7#EC8OITFnJ$q9Sd
zxV(_kQ1iGU|6EO9cv9uvJ0i-+Ap<=Xr5><N!TdA){|AMh?pCe^i0yBg^j`p&s*eD?
zsN#$KG9U>t{+kT|K3N3Vrx?3`RPF=AP4EbQ;>y6|Dx=;3VFfOI>Py?1t-0LK{=&M&
z<=mgYWd?8z0TM9^w9sJRQU@s0tCI{ZFmb&9?QI*9D!{+_T=g%)w+vW7B~0yRbrA;H
zBTTIm8q%5$K~;<GbE6ItQ(k_8eCbmWwahN1`BnrRBJxZzM|Tw3bQectFU%#-w@G|Y
zb)7n<aGv#X8oW?$(fd#{hFJn4C=8g8D=tmAiVhk9bx;$xp2wjFU_z_?ctWRzUb_La
zEk|YrVmimO+CzkzNLg!kCYLJeettQGsqI=yX*8}aKV{wUT&r{{LU7k%R#uXGkWgbb
zGh^}nt1o8<Sr%c-K#udA!{u_G1JBjYR|BSbz@c<HB26=d6tv?(NJ>)f_IQ(9CgIND
zKEgR*dB-EXHn0T&9pG3-*Tm|PFyTfTt_xeQC$o}bR)aj5=WZ=K+WqukyUu)r8J|^6
zCBCI+XWWP8bH>~ccZ%2jRaL$H{`JkL)w{sx_20pds`8!?3ern!HjDzbiV_h*0)D%|
zTuFcyWn?LK^9%!%e!2m_jqkWe!iwXnTc@u>lIPrn^2hV3{^y{w#Ce6;a{L6T$6!fF
zdtgzis^|rW%=hp}EW-%gF(+;)VLdX_zJ$A5=axR20<ul37TlvwH}J1~ay$Ysl?42D
z!1b6X-KsWPAt(hUB+0$ME@yYcTR)IRF7G?myLF@L*ZttAsYDM!gd~FKA!7q%87t{g
zy8uQU%;fw{m*Ba$E8z~_=pnH#AQ!TunQfm#mQI|YhRsmdPpw^Sv>0#S6H?w4O3%FB
zW0@bBDZ+wjoi{d7`5i(5-?@3Y5!cKFmx4j?BOTmY)6Vn+W4$c$pbR(!9&f%S6(;zZ
zKy$Ip+X`JADzozw9gkG{9SQ{eXNtw&vAr*Tc5@^BAyGkuO05id4k$9gXWm@SrtcB=
zZVbvEN#f|wkd5dLu=*kXf@V}MsZ}u1q&R|l!JL#*<W9$yx0DeB)?I+}(qf5v+J(MT
zjSrhaPWHhVWAMb)wUC)s&RX#3k19uWjm==&6!DDE2%)xdG$G%-s>h^JUs_p57Q+$h
ztfh*_*J$Jh3@%WtQ+2$C@EyT5CmR`mFlp2E^4jAu*msNIZDBs`LN}NKZ!d-kcs~0H
zKlZr2#GCgu`}&JnqgHY{pah$xs-I~X)Hwo=@Pv0c7$_^X*|cKy=9c&tF$)Momi#Kp
zE>=e9ere@~9J1c<TJ@_7xX_=Fxz=o8Yr28|vau^^-W@>HPRI=OVWyR#3oPTsBXlA~
ztUibXvCM^20G|xu0KdxWlG5%<-$RC^see=iKG!e4dO#MKJi>lR`1iFQr61tb4k)+L
zbUX$vcho)QHwTDQW@cXGT(KR#nLVD`(bHaq?&qzgnxu|y%o|iyj!o#mf$?-8TgK4F
zS|jBdlKj=Q24_CqMV!82(ry^|D6)d=d;auXy1*(4)~#_1jk@&Mo2b=O_4oIV*Lm9;
zpREAlDBn1;>U)5g<cyd)2DYr#=~M|O(O7rj6GM~HZ_w3&P0<~(ui^?A#wdP>VX1sI
zA_z>OpQjqS;_nv;M``Mvo;M@(_V0OK4=8KaC;D4oyd*qb27D7o=VA(DE2OL_15^1I
zWq?+*tD#6p3XVMX3?#_)`%N{LW|e!p+2j?J1?%285)lBHDD@*Z`Oc0Tnop&@#C8!-
zy&`E@D|a183}%W_p3da!(Dh2)ATud84kg2XScWT9gqqEE)u=ym1dMMR((e4t6dN=Q
zhB;w8Ml7<<*?z&NT+M!#NLjp)r4z&a`R1bT;!Vg`K-3zl8r*-8baCue2I(#7?-UcO
zR_iPM-D{uK{I&5}tx4jm|8yKTSN&FSw4Pw#=^G(1{05EmilGrlXPEf1aaR(QBeuLR
zVkIrTE|<7}-|dP-OIRC)j6RPbd+fb%ha_nYAZMe-cF@EBxStLAxt<NL$_<Y&(f#uE
ziR$w2;J)XA#Ew4fiXTDGP{;kr{W>|Bv(jBh-1Rb=D&nTwWJsKTn8I&Bo=FJtOm<#+
z5gk9m-nPHyThMnUdK5a97FPbjEyb7Ae$ya8(n{waTCXnmKZxzjzs+$(^{9wLpyXyL
zem8<uSa~D*ArQfJFg>wOTn0)EbEP4j&{vH&^dakK4pa4awG>T9u9<YTBD+-!+=`sH
zWdGp?rc>R!)ey;Y3Nwgx`y2Hywwft=#4zboTF@}(pt%m*X#PpW2@?9%z`FVPRB3v$
z@j6I28xSBNsv%?#S58Oe%u=YZO_+G0bKn()F=Tgl;oLL3RX^N)gncu$^*h&>TOLHJ
zPDh3<DbM})RvU8c>4q>7)dS0L&CoS*ZxUzCaFx>PE$zN?!`msra$FC$Jr3fgS%gQ^
zk-fB!`;c@6?)Wp#&?jci#Ef#Mt!MV1QL`3h&ktf|qs|P5E$<+5hS(u9PPh|%^H1SM
zZf6ItUaA2`Z}?aGmQ);zW%+aR#K7x;31Cuj_3F;F&D+vk1MX{o^HjSG+K~c3D~Q!j
z9h;L&kT{WV)G3&F$MKfpN5%j^0wR*;Z*>gcmk`z<MN*g4a4sf9;5&de*xzIo15+Jc
zE0zxFqVrbZn<xddR2f&)!!)AVg4<F5kw;3`0fa&@fra(jhz68AOx9_j?X^$8J0FVc
z5LmJ#hDQ6}TpXv^`&Cs=888ZNedlN!0Sq)ZwWhKx7Gs!{2}k&2EM5<>0-&Te9{Btn
zg*<Q5^?(p7rGsG(8y8SZf+ANXl^z_?6J(Y!!{AmbmAYYro9)NwXGd9Ph5OV$10Z-6
z4bXWvg7IgU%oIw)=}l_E1h?f<;AlEB@tty@p1hGKa*7fMwh`A(`B@q`*iX1W@}<S{
zvR~f|-@PMKFm|R^w}H5#;X()?z8q2xVb{|!5KA74e3Z^58JqVxVnnQUs0CcSBuqky
z<$|Ck+dms3H+{(YDNAqUK?g<<ZglE%w;MlHJA3Br;M|q@nax*m)m5_hU`yKA_&*Uz
zLwZWB0&u|6znwG@%fC0<iF<V>8%GlHTY|9$sEu@7?-aM;#UMz^2<93qchkB~4zLxw
z-%;krT8^|$nDnt{e)zP3P&d_BQuVjP{js2b-JA@*9W(%Gy#p>AjH(=og_A(~rUm>v
z?mB9h1!u|SSsXL?2c%q-u5BClXv}SUPkHc}N&8joO1ID}4;+1N{t*?i)$2zPuk<<N
z8xifz4W))5AjHs*f)D*k*=nD4yV;`vsp0X2HH6s(k<rbMhX*YdR?kxn5H+#sT}M+X
zQ8Sovq}Dqm&j2=l_?Ti)pa07SiC}uPVOy#sLInk`n6YffaM8FSXt2cTD$^X({wt25
zQmVl4r9s(Ux>@*RQU{BcauP~=D4{r>c|2wBPY|#`4r}9ZnoY>_B3n7`$y9&uUe~Cr
z4`LW{Mu)K@L~a+3YRZFP7Eib_h+zd~vLF|6vpqGj`M~3`;Oz6`ovGqbt0Th}{!Q!$
z$Kxh4s-_y#(x3QPS-j4D;^jwKyniGj)N!{e`j*)Wbd$~Mp#bgaC9nPn-;Bk!%c$}i
zD8D@v_cGxOF!gSRuyINZ8V<c~k-Qr?-!lNn<%u9<v&F#o*g3abHd+@9gN(hmKlf50
zRNxZG+H?(|9^h;O_Rn1%jhHkgmL_$sf%Wdv$>P*w!t;IXWxX>gJ#}0@t14HLZF=_X
z(VdqYa(C9hNH+YvBuRyk3Z@W_DP4J*)Vp9&H}E#W$KpZ#C`OW`ETdjg-C(G&JyW^%
zIW)+?vSH`f4{8jXLN|Q5$Zj5}WNQ?<MRh9-6(Qa`GdtlQ!9h5wHbZ=4*vZ(0TvLQA
zJM!0~;nh=0J%|_s&U4~ucPC>%Y+GeFI?q~%c!EN8Gu@~PN$?%~v~S{Aelf+?E;4R*
zjP$C$;XZT|U;?8JCx*gWBHZ}l|6|^Bxvls7fKBS&&%!eU3%<D14QZcvXZhipu9xdL
zPdRnjW)%+I-X#q$8Zr+QJd}jpR8byaik=IN@LEV9h(`vm!*!()$q`kV(AOik#ko;Z
z?dFkr;F+6tA0R`18pCyNb6f2G^yFO&_ObX=F!Xdtt1h+Zt9`}Zsl^Ko8^C$^%xxnK
zPTMYPonsGp)~9Nm&Cl+py-z;6(*$s_CZ|u-{QBzn0U%O#Q?Ahfg@Pz6o+|=Kjwv}2
zXo5Um0%L#9CRB~jF{HbVgyXcQ>az(kXoRFdap5189}#j#<DdMJ%-APFOd>~}x#Mi!
zcxWMPn`I##>$0*}VP3XYMFY_YL;;<`fsk`KX_zc2yS*w^#JcTM)=Jc!mbPby0A?xD
zP(`;|E~s;N5D&8+SIPndB%^GuK0-d4aV$HmnLW(T@!kIE2ODjR%7fU^IMB&p)j8nM
z&QPu!SuO|<N6JLx+4N1QCTPTHAs6r_d{4I#yyX;mtx{t$OSsOu$GME;z|!lerjgnW
zHb$Cwuw}1bl)Md+_q&(>UIo0ux+m3;{^eKz?P2d2gF-U)$-k$=&ORV&)${uIEFAbK
z4&+5g5n<ij@FLob#5B$vu<uuc#&0#v!z1}-&4^8oIzo~5%cJqPI{Kjc$HVTwJlpmQ
zX13aOgUPLcu(Tigiyydd-hM1m)1m3vn#bQ5S*iz3eq99u2*a78iaa|gp&b~f5@bzM
zt_qUj0yASBJru|3r-qvCBuvZ%uRJLGLlz;iI*wBW$~|D2Dtq|yY@hGJxwTVC+ixDb
z@CeiUN<}#eF1-hv$XM0ycuf(7S`VR~1(ZAjEKgC`AStbQZO&k*j4j+0#KpWvK%0;n
zuC=Po(>r`OeIGdWnnE;#O)>|JE)PqNqv^KC0a5uM6`+GS2t@z|jvkHW!w2LDs%B7Q
zSt7_5H@Yepf)2+>?dY?7k71i!(wW8wW+W{uH-1$$jx~2R05F<|H3GAbrW*aG_EiJi
zSr7bf)PBSf)YvQcLuvP=#C1ZXtesnTlCY6Z5Kr1T+^C!(tSbiMW}s5lD9tIe+Bx(w
z!GAD3b$h4uZ2YbUcH>ak8%rO3T-AnOFf&XErX8n-nnEtgjGc5h*e^~*RY6RhIj~*|
z-B%KNOn9QNPD}69-JV;IgY6cHTlVobSPmK9%Q(?bdikK&{LE8zBnI@3*ndX;PvHdE
zVlw0^e6tJ4s9Y6SP@Co7!>LB@&|I5OOJ<9dV2os(0=t7YW(93;kBu+W6}o4)?=9s%
zt>R*A_dr;*n|HkQc;EY`=<AE_BOdN#%=9DdXajoaJxKrR?_#{cB2EZsQ(psZT_O+)
zb7yZnVYU*Oq2zRI4ZcKbh%;_z!>*s)Q%vh7);;HQ8|W6&^p&(g2{G1kK?@(|QAWE>
z-yt>HAZ%ZXu4`xvPe>FESy)#QFYve34StHjn|=8Rz{UaK)X@28_0S*319p0a?fvB#
zO_Y8G%sqWojtBk@UH&b$b=9$Vr`10R(e*jX)r(?)gqd~_Q^D?|!`L$;)B-Wd-vLz&
zmF}r`dn^APa$l0a0d>pi$jn>Ar#pp9w6I=av|lhKZS~teL_bp*e8HzgVHj<AXrRuO
z*)Rthse_oQsP=D0+_UaC#N&~|Hjw)za|d8_wBEUdwk2*7R*VBmkrE`Hq|bLA44+#!
zm5*`UQy#KpkyboBVqcn4227YE1SR)8-UvdLoZ8`OTM_o-B7Eef0jn)NiK&g(ooR@S
zRs#Q;E<X!sRc&;!)8CEfKUIii%+t`PqKH!0TcLpwyYj(|!QCcf+*@$5rM8_vc4!an
zSGBl*!KUj?r8gb6Io*7AarxQ^x|FSQ!_7>q%H*Dt{$JSp|ESD>I#Wf-2CscGAflAD
z0tX)EY?htuJizX0NP$R!)kDU}fNqq&65UMJq+~^2&Ju+lUOWox)=E=vbaHgzpY0zi
zo2u1xlL~`;{Bo!T6dxCPs=SHii{vYIv~9(n``4;vNC@^8dDwC)-jUG<a@S@0aM@W{
z_>!p#Y_GsZn82_himLqE0At!ECM@(wJ236I@)7*G8CN-(XO?rQwvhwXmsy1vI8U%H
zffT6_E!$pS<|ZUe4PknloV*)x@YXi3YR2<_R0vfnTIOl{K0B=axV9rc`j;q?l6yi$
z2`o0V@}ZD9;JM|?0Hv`ylhP~Dl*b}H#Wb$;>L20KR81ap)mW<mAs)qvQeG%q#WL)L
z{7#VC=2uotD<AvTFXWzm?T$U(U{F$h+rQM;XajWv?XFrkLG%nT8$#1tnQsi`mM~Qo
zu5bW{SApcQasx<}xeug@5uHhnd+1BOag41rK98w2A0_;5+D{!K$7k}}4eV0DPU~Jy
ziA2Aj5|qV%0&a-DWcR^&Gp8NxFR`x7Ry<cUL>`sOZ!d#FCQv9)lgBI<;q53Bcm#&J
zTLEXNppT*Di(p+LYJ4*m1o{aA?>Xu`dZn}h$uaIB=U|)s`0!AB;wEyj-2S4ytmD)D
zV!^~4$}b^Hed?W9h}4VNm5Jt1ome>u`Y3aPG^Obs7z0XnV7n9UC3ii#6TaVUQBIyX
zB;B1%BYQ!96(X(%?bJk@?{*-o9^4AA%BmWj)~N8FuJ_Dlloj_B5HGP}n5JRh;59>I
z<Nm93SJouMsP@6?s|zy!ll`HWUwm&-=V@OutGmzjmwp%PitpU)>q>tp`SsZ5;;U~?
zfI|O}a0Lhs%6}%~#x`4E+Q|Z@Ja^DB8kip6g-aIi;5d3gdFvYC!*5>Nj5b>ohj7=1
zFNd6h6w_piy>n?*RdD3J3;4qme(t{*JywH`fY^9Y813jMfW}%7CEtnIfp2O2OiI;c
zyv3Vmi39Ik#qVclBMGf!?K-YL-4;qKiIC)yTN!|BIMcggyrF}oL4Nag3cn@eVl4@$
zO}a>FC>6TrpH@-Egkce@Uiq&2zWEU92C&-Lj4FvkwCSl>@=%yz{@uJSeIUuo><9m$
za4kdL2rz_3J)$2?*=2P*z0NK2Lvq?9B7Oh-_08Lv#^yeJ!7r*Pc&M#mT+w}{0q7de
z(5cAzN2ncA#R5dOGjLaHV^?DHcE|9*OX}@pjTz%LFZ#ondO;H=gVtt7Ry@WIKJ_X)
z)s6&ByeOskVH?xNPPahAW#TWU@iJh#^Af|$$1}gmaLXuF$^B;5GYveONpg>2=2fC#
zM&vnLR)}<;f>therW=?hn8F-Z$#}@{#O49>uqwB9KyUN!tFoN`%9fqzKG@IRV;!os
z5V~Q+d#EGrk0=(xcr`8c0#f;DaK^IU;FM`ZIT(_)rHH^6KTrf>Z~<2(O!+;tRh=Lv
zgP3;?fN^kjxHM`sG$-x+6>mX1B1vNvV-R=1ac1y%`8tmN5_i4!Y~S2Uz<O<OvF#G;
zrCMw0oaV3a+YB4M11=y&3uSTJhS=n_U{6>A1y&-S`y+Sh0AUP325WG!1oQ*Q?X3X!
zvRKLEDK&-^SJ5ArGtHZ?fHoiuyXs;PxX-bu$Bkffb_GkFCOq^MAZQkJ*A-`u1cGwn
z*u#?P%%#gs;U!(hS&xHlGk`B`ODbDHk;h>386ZyOi-4>^fR`coqTi64J0SqcgU+$W
zwxTL9uH6ApLpiDt74!l+08mS>p4@lnn$!$9J%zO6wV>;h_|<xHgUl55#08=bX#aV)
z*;+RRzIJYX;^Bq;Ay0&(ZzdaK)E8!%qF&Y;D|KvLnJgLe6WtjKiiz$*_Y~xpx(o(_
zs##w-BCO4;ReZB8G9p|Kz0tlDanFW&2e@oGi!@MD(dankrtvo52VTS;-pZ$%<b6CD
zr7*n{m22~f<s8@DLoqIR?7YVBwd$8Y^88z~&tg{S8{R*t4c_8)o?!=$1^m!??%@yf
z|B>BaiVjlkr2M{q;6H~%cV-VQ0e08N;TS?G6-+k)@lGs6H|-FocM{S8fxrrpia+ww
zRS}539b(1fH&iE3rK#l3VLvR?bq_FM+U>hiP&<i}`YEV1zkpV81lVd?x$|)g(NUf)
zLswZqDi$bia$s&&VRSJ1xlmBnY^%8UHepk<8+1gTyZopM)Z6~8_5e-T1ZJi`Q4=_T
z#Txwtxjw`$>u)|^2HZjC;^?lc@>$+q<3Z(BQ}&gM#`;a%dRV`YeqQ&XX&e~(y#kZj
zEOfn^7|`;h@>@uX!UesB@ZlXVm4*Wx(+SiJBE)gD0Xrz5DwoK!Ul+$hib$|uxfHhs
zDQzPeK5r%!cn2BWyiZx#e%5Px(I;-Ea`<MS3ga&DD1(CSX1k#s@*~RyczgO9K!|ei
zr5`~|q1sNeUZ^!I#RDY_q57;Ka6FjJZ3f1ZFVev-fN8d=_MUDmi=U4^HO5=I>p37G
z&4m8cm|FA(WI3x~+lGK{V&TEj|G0#yKiHJ~aVGuCQlHAeaVciUbM>uOy7~(rx#F+a
z4z2|ifpN{NSdATzXX37}V#K1#b1K$p$iydP>P3pb)3v-mUjC!9_4Id@HILWS9DicJ
z^14c|qv~7+s1qKos%;WA)!u(;-tp9_R>?e}@=Nx474w?iMk+T|qSdKiW)2!Ebs%t(
zr_#N}>8szoJp_mmto4%|gQqXJ4=z!t5!JyL1Ob%|)U}>EC6ylICK+}6h<n?&bZt!A
zv{`L=1-cD@PB)dE`w${;AF?RVSuSJawsbrSf|2giP~1pcm0nxK#2$D2c({VQc5<ng
z=g#yRsMAb6=j&E9wN(A0GT1gUYHVy`I$~u1UpD|3_7><9B;ZA~r&%dAY+!Yf4!Rd9
zlQ5GAYq&u`WczjAftt8~3P{W2>F1#*($+Ibqn6JiFMC(4xQEDFs$#Vh*ZLyYKfP}2
zJ(CRlH%|@D-o0smv%E5fu{x<#Mb-S#I+YE!Dn<zdF-{-l-iT(Ua)?})|FU<KcNjpr
z;^+`?hT>MD`=7%2T55Q7>7<=8Zg_S+U})~j?5pt!UfIs>i#b2|={4@Rc%G-aEmwum
z@)(#srN42$6nB+CVUB%Aic7Z1^Rf}fW<r1MJGk?~W~_K+H&5re#TML+U*Lk({8xuS
z?|+OdViO>DC%~EsQCt$BtANPSodmd*!0rd#3w3o8R6>k*-5J2@PjQS#nh$}yvT8gC
zzdz&TQ@%A2ba%Dqsf~PyJ>7pL)SPPV&|*xnFrVv@l{{B}m!3~R<ylIljfzV~?x;g;
z?&wFS8+k8!4?NOv{0d(9I_@G2A{K>84Gh@#<`a}_LKPImMIJhg-_{HDw*E?^wqrLa
zx6^V?@<-0W=QwMiu%)xX+1NW()v=V*2&>&LyECU4Bu|L*U7?|tp~a+X>->#wMXh2B
zx|#wkivM*V2ji+cG0OjB_s(uo_@g(MGi+F!rzY@Ch=U|Y%bwTS=$<-!ACrhWNXTm^
z{p<kUA-s6p@pF*i?Sw9jPjhrG;zd<>P1!F^N8Ze-4iSX2t7{`w;kp0$wsye$@hgCy
z75?B$*@B-%L;!o9tvF0S3K83xNrFWlIgYH}yb{C%{;brf=f6i{B_!eciHnoQoBDz9
zvwEtrA;H>#6nY-(4X<K>go(dvC`;Fa>~H?sU_S%oP(NY^(^&tmc%BEvzSv$}W~cC+
zYMgBhpY^dUsu-tl8=lY6@^Pbho@yDgCK2NEu+2mBGbA1u<N21h6keRx{mY`*fRkfh
z9;KoVnZk2ob$|*6lGB6+3>AdsF<?X1rLRTUFjh2|#Aa&sMBCneLW>3VRpI$7Lww@n
z@Fo5w(;mQ3D=q29jZ(MA6!4=nzkj)S!8YR$i$1kiYx(OBWgcGLy7J8(%xRZjoK<Xm
z``+vSCe=TCPRid=?=rRUNL|0=$0Ke#)CTo_!VE_Iqk{iU)d-jZ{L}Y;s~_etp-{UH
zVLTZGVSoZ*bvQZM&lY%p79(A)gbfTsB*GK6c*76N`A207jdwJe-^SSzefGSrt=`1;
z!EMS{{jZCz1p-Nmp00sY-RI!!%>2MGRV7eSL2Qm5v)>gEs&(<k|ERnNll0#rP(7X$
z%fqBIAy3Sh9<W*I)t>|<2nP!QdT~Nrolp<C^)df2&=baUzf<a=R`7$##evopKAfCV
zgx_YoZQ#m+%ueQ`%Uziq;%79-_FeUliu>RvkZlG?3jl7e$w#cDQei7AUa0#m_%9B-
zp0NWVxBB6c1~K*yej5_<2+2R~yB;*)2<aC53+=Oo&iO%Iq4SGj>&=c4;vU!LAHq%G
zbp?fgRfaU4%3>A);i{fspZa2e1d|4+sHTr*7<+&fA2x2n2zaa3rMi(}y+j)>mgad9
zNVGA>YIDvEu~SKBn}-VO`13vAw@pao%B5+qsw#^gGjF{+UK9bw_!-Nk&1A7Kkx-W|
zQ<n-?2NML!4KTM8*v=|(5T{D+HiMB7*CAP5*~;3&V8W$AS>=Kmu70YaeuVJzpt%fJ
z)hyigNuYW6fr$$IuhGXhKNir95D=RRc^qO0mgI^S2o#=TnEbLnUz@QJJ&)w5x8qg@
zbGGy6LGyN*V1SgJfr)p+4O`4EWOq(S>$GQEfBvh8cBj*!Mdvhk06kPV7L2I^Wtu%B
zQ*{Z9@>ixWmvRGp6Ufj>+}Jhr5}YDdX5rGAfy5N727S{dOd`m!BX^LsIi?5}F!t}z
z_dE*9HgC*iJqfn2W|y~(SWx^es^bbt!OFdWf%s4ys(x`e48nZIe|vmGW6ISB6wdV3
za0I#`Lw=YahE2&+X&S;C(E-OWE=1b0i@9N{@hVG9FrtN=Y0B_|hMP)&Ly1p({^LWG
z$5Yw44f$7|21i;}6whS;Jkp3SFC$-6p{b)={!+NoSN1c3vxqTgvmf0XI?7$ov7@Dk
zxN#g^gm7Y5#vYIAXyo2y96+s*90{}5D=6ViChtTaeUoTB;@l7z_%j1(jDe}J)HS{*
zX$kEd{Q>rA%yXvbJ{dSyEyLgh%2KSoNFzuwF*ZcxFf*X{Hdg~BQ|uBet#dtiWNrK=
zx)sEY0gl?fAuhuu{BU2w>3&DIf@xit-I47xV?g1f&IK2z^R^6Ir~1sReePDSs{uIh
zX=ba<JU8wsdKx+p1OY^_*==cF3CvB@r|e~!wO|jAxE-e~ku0CpblOWAt{-T23N4><
zE1z!oz$f1M;@Lkhy$({1PqDx09qmqhn;@-g5-ZF63u#|k?O&G@M#IK;bW9iyE*R!p
zQaHW-mnuiceS6=Hb=kCY&NrWRec!sV7C-*1^V9j=YRhG)K431WBMD;cTJZ15n>hwZ
zN}I7&Us%2l;_vqq&b%}1(-~Xs#d|#EliH9Iy|H`K_``Oq)gO}gNQCcuH(sv*W+L0T
z&~+jJTO29a1`utV=gKjskxpZ4nO*LlQbOlE^lpS<o+F;)Mf*#-X8VCGTgg(7lZ7XJ
zG99!Q#&PVqY)JWAmU34n|ETN8vHigU!|8+AH<l?dPt=fP9c|i<H$u1&*RRh;X4~c6
zx6q^4rQA4V9UbU0WbqR)4DdDecsBGAL?(|Pdqty~Q!77a4};{PYK!*|zWFyH+d)gj
z;T)i2k%tOr<zK>ecw^KB%1=cDp(1g9J4u*ikBhU3il!mE>4%4#jhLbt%zEKe)s0fh
z(kFHa!cdUXc@KnIjNXGUz=-C^$=ZJU8F7y6q8fre!VD6T?Oh$c@!!l4MdgHNWgVD%
z#@2ltBf34b*ska%Xw$|z^q8X)`p`#oCw?t>O~38I+QFYndk^(>HnAwbPEYI@Dyi*r
zbhu>E`9fmh=GHgAeB>+}JYo<h?<3UYP8K8TpdY|un4dvTaw=6om3J&>b)iPr6o%+Q
za_Yp2oR@^voOQw2TCl3pw~S4v-VpVI6$?l3sDh}&{ixn!TIqy-*dEKm5v3(f^WeyW
zgPEcV)8?bBcpStq8=Uv`<Qea+?R)uc<Ng2qNX&nKWVfesoi)OS#-xB{Um;I{?b^8d
zlX(u%htyK^d&sz;8oB;XIHe&Geuv`w9PK1B1K}BG#ZFYPj(aJ(n0%4)`R%C1a_&%F
z#P_Z%3JwyqfVA`{@LbN~ZGce}s8m*3!@k@Oq7lM;Nrvi~0r`pfYm``DTK1g6${ohE
z8?utPE76Dm@y|o0he|1eH1OzDkS8;4_AMXsL(7FzP>_9eM{lA{sG%Dd+&Nb@m@E!j
zk)PzJ3UtkIdP0m!gsH+U8T{2YBC>a`1Cs!9+6bazLOl~W=QH*Wpx2-;olIji^a+jF
zv9#p@u@Ff)K^m$}Ki~hUI9WToWZW&(YHI0WV@qZU<vn@o%iA|^$KIY${R)3$w|oPL
zu#+o6F?3him%k#60LVALA)8qA(_nC*w3y1TbD!(@qghL0<fo<X`2v{Hf|GG=Gqwa_
z9S^-Y>K!5oW9)>kHWY`16aaG~zs)bAS0kCi<0&0^8#8=VlwipO&w=Mo1JX)sdIXXH
z>qtF$WKD#?W3E9%@Ku$5NR!L&J0^lWvoHTq_U6r-ao_34&W5V##d?5!G!u%vrVTzO
zvSlvr!0OiF^w5H)8Bp(iyrI-GMZQ2kb;(tcXHfcCFm4;)A@RJ+rI2-jA*k`XVRn<d
zq1Q8rmD-GffDJH*^Xv2jAD8IT;0C2OZ1h`%J-xv-G`yr|<=p7|sIcGE<VDIgB?=e%
zN(j)0V&xNqbWadOAkPA<o6#sKlees)o>bR!_=`83-%d?1-T}GXX+BUgB?##GQ~=_|
zCrn4edTa$|B=4i&N!(^S>-kkws>Msfe|CXm5$t#W<5u?XZ)$ybosdX!JYx@P4I4Lv
z%PkB+x3J#P5PWNndq?l6b&FYhWa#qp$f#`l^TzyHdFJQtcVmZ~+M8^TY<%$j4i#oy
z78s=lVQ%NyLk;n0s2FpPphZ6<Cg@H25R*_V7G=U3ny)u_eVgS)n$E^o1ne0+*HWd-
zzd;RG`@UlHd*4@84<BK~TqQ;uc@M=(^Z<H)i5fSt0!b1xH`Bg|6B4*V)Q#vt@K%(&
zRQ@G)GL%I3zEqIEbFU=7xwUk@WiF8{{+JRN>!R0N>GOs%+*n%RPbr;=+%#OQiu(1b
zzvV(FSxNX+2tZ#}u3b*y?4i5EI}>6#Sm0rvfw)Pin~{q1UplkILd;a&KECN7JJnSt
z$@98mZZTAivs`g9b9l=9^KbEX;b8Iq_&dV_-Sa$oj|j<y<UyvXyW)fB6!DAg*?TrR
zUhmi*9PsaGbn-;a(*Tq8U^FM<ie|C*$eJ9BZ(Jc1LxH-x{EXqjd`)IRI(UcHIY#5+
zSsCYQppR*u5^^VQi<`J2_rzO#{*7`U#J^LiH%Kkwe`4);nsLq`^j+psN$&E)$Le2<
z{!8^-2R`*FS)a3sz8Q2VWi+3UlCE?|J4oIoF>Rd#=c6WS^aQCroqnvJ%}g}j-U5}D
zh<n%M2G4a5)X6;BDUYTNm<iG$s=5D&<H03z+<f`fW>=u&zwij;+;IPw;x!`+)g$~{
zyyipa=f<!S;0j<6#MQ<dO)G7nt8u^wmv_B8Tr9h}_>!Q3szQqPFO&8eJS|Q`5eZ?n
z3C7d@kT~sO0q=h|Gq3PDt>8#*!h(_Axh54f8`$L~D7DrjBT$x@B@0xXpczW^+Oe95
zSqEVgLyH!POYjLyS~wndMyknONlR1s!uXs*GWn}P=<u_W$q4m}p?b2UC*wiG_MH{}
zf#GG7kv$zT>PxD@K-aGYh7(0qGfZ8jK46-pUy67Vyu_)H_G(fDep#gy`Db6@w0-LG
zM3q)aYFujN*|*~p7rQsLu$#}iTPGP<^{FH8loQwu^i6P<T(Vq?$Dy{v2}z(NyRclr
z3`$SJtHSGn4V_7dat++u0kE6=HbLJ2d&~$&;;*VGn9kJW5r@OZ9nRN$QT9Cc68JgW
zG^)@`{@?BIpZ@<-Efd(aRTY|`x;_L}-W9}5xh6#sI05RRENQPc4FiBV#(F?~BBz!?
zbY1n136p;M0f`W#p8%MQ>M;b|OU!tJI5`W}IXSp<#74`|_s*F6083UhP}<nkko{Io
z0Xmn&qo6GKojHG&a3vqLXRaZ9<pC>jGetP#?|x;cki95dslc^L8sH9AD>bo^6<bLs
z+5X<>)cK-ptSdCCY+{^}6dq+%BCcs^NdEjob;;dv7xQ0dllnKRy_;51#u7v^Oz1e_
zt`It(o<zVF1Lc!m7k(WQ2&wTVRB}#(#({UazfQOrX(A&fc4<HM{ag<d60P$$Q0$HG
zi{C@KWjCI@RO%1mY;NJ^0Xby;jpW7iUocZ2$>4ZCLJ;LN_~^1j#M~4ndpJd6mTP(j
zI2YQGv2+WtPn-H=zYdyjaXZr|LhK5Om2bR+)_R_i=j>nKw=AM=tiL}U8TEI=H5F#=
zB0!WAYEcuU7PykS50|ZL2#2~Qrl}m`w==f#-hfps;O*;Hj$98trFmf2^9KWlU#*85
z(*$lw6Dxi@%0KbSH^%YPw-Z2Z380C0R)cM072z__!lcg%;Un_Y<suMg;s+uqu=jlO
z!T+%uIU?Rw4hHpaecmGeZJ_SD%9a>Kkzm5z=BwF%`uxdo<cBTWodi<Zdj6Pe%ZukN
zEqZ;e!KzEw6jzw7PsmTZ+KAu`k3(KS9+EkkX)$^nafPzF2pi`$@Y`t>;(t``(RVPo
z>wp}B#yi_@<EwKR2@tiM;Wk+J7|*%ZaqCB9z>Rs%QZ#779^6(RwdW-vCis6yUoU`G
zxC}Mip)gPmF`tgS6bd}R6t7lsaGdr<8j<i0o;9Gh^{z*-U~B{RCfH~u)b^wH@;nnH
zTH4~~IaGyjy%F(vhAW7SW{(MXmT*#oGYOOymCyNz`5bB(tJuqE`$y#|w;d;t%C7<)
zV!eByXo4*=g_(Dimeb1haAvM#ZXJ3E98;J$`S6m~TwL=ekwd!HjDaOvYC#}9nEo0*
z<K%L(mc#F;dN`Q5_(T=`vF}@vW1-ju?*3!!(}Z@+Xuc@09eXcd4@k;WsS<KKHr{Uo
zJeN#uR+aQ7aMnSQz6k$#J?vDSTS$u{A(y017hVfp_~9g{?cQ^aE=<dk@Bn=2h7Oz_
zk*$IP%EO%{@Zq4^4I~3^E?_^OB2Qlald}``8lER_qWkkXYk)UFzU~5MEs}FO;~b2=
z(+t#EdhJV?MEZU)bw%r?z)KWp?%V*|$w1*U7|@)5?kR^oC_6jwVfYu!dwh(Y<NiWI
z65UNax6b94`UkYwivwZDKjm5NCE+WW)E^r#8)~dmG*6iX4fQ?uE%@zEAZ5VO+>}~t
zz_o>s0#Sc`o*mMn@CupOU*B*2AII}mNJJN5EqdTl@Wj^S*Cs;?T6zaL$RUa0xS?AU
zSEu(<DTur5=y_P%LA5QpwcUmn!%$_m{=^i4%40R*5*Xv<$iG7z6b^K6_<e6I_bNHj
zj=WknCV3S!v1f#1Ok<sZ!D7_#qh*JBv@LnwnO#_3CCA;fcYkNFJxCC`@Mj)&aC@}R
zRJhqqFs_QVrXtpMN{wfs#gq$6a~<h|#S6o-`LWI6xt>JiHdK4;>EMD_RiXQl)6e?f
zBUY7e#R5Oy$`M<^l}1ka&U@eQteCc|(z*Cb6|G~of|(GoeP6>AJ<QivYEBVW0OUp5
zN!G$2pxL!IPGl9L$CaIfj+ewn{x2Kyj0YCpTt(f*%V2ctnP@$J)t51HhVKZV?nR#q
z-BtMa>`ljU7u6u!82l@6JEIt{PBY#T>LX@Bs?}aUS{qdbV4|B*ie=mr8fWZ;`_(Vb
z{qt4oUhpxNZGNd+c)-fxl53?wo;Q7hp1(*NHk`@1_33Us><YNgkpy^kKB|LJCcDT0
z*q=ZYyZoc_L!^q*h9F|+L#L=<O||X=P!fqdst}K)0hAvL<o*O6buHZwau%k9R{Fz%
z3G>*EGaO538X>i3$7g9}X0fIt{R%{5U*lWKC<aC?%c-)=W#iW$%wj~?`}3+xpe|qW
z%W@2TCn(NLm!CIpQrLmPSEpd^wj*c;R(B;Sw;}v95S#rQXZH}@K{WLA!51FGsClrk
zi67?fNs2yf7!*FUY~@`)P^fb;7kl=;f5VR$nS*kh4!A*Jar7Twu3<t`=x%^hV-8|p
zkIV|ekJJIC;Cf0;iUNGeR%=Hl+|ZGMZePy9Z)xak@#tje4OsUWc5!T=Qw=4k&JZ0Z
zHaxJfd7%Zvo7h>KF6~OF0^eV|yEw!kl#lp(WfA+T;;RCT^Hi5N<RjKZrAES-gec3%
z8%0W>qJLEWJg8&>+)ou-KQb%HuhEl*C=N0Henu;34pDC<Bu(sqj9AI<_{Z*BwgeWx
zmGqu|&e#0_n|}&mKhVChHp1$trLKq0*DHlFc+w-xBw4BTjg)@}Pd5R-R)RT6A_tiQ
z=awG^p(vb!xLRkw@VHvoV|>R;65!iGVkU+>dV5HczJAJhCy=aTdB38zLnT8NB%b}l
z56?hgCNDI+v@7(6i3rON1P;=DT*P#xFkzvatcjAAtF6g87bll;xe4K^{#{(n1(~Vq
z$mN<mCsU6hYX@p<wozwonHQPeGW02fS~dA4*tXv-P`A9SxjSOL`d0x;gpLZ=Dt7`~
zb?S}B&J`Ew1h_Yau8pr)*(5kp-XnHrp6&}6+{V6jIVy<d*IMo0aI1uN_K@L;_ij(s
zwf<Y?1~FS#aYeU*mdXX)SS0sHVim`g{eW4f+&8t)3ndK!Rw$v3pkYH^gIsW11(hYx
ztynWY6WmH#5fB&}JRjnU_wi+6Gnz((<I2Ac&JT|0`P}9vI~>IH=a1DYwS1Qo@S2P+
zZXL6edk3pWpcq+62(8pu;d(p{B(B&c(^aL|)zkIDwJ7chZNw8&78Ol`U2D@5^G4;v
z!ttpK1`j!nDJ5iI61gYv@e$2Y@cwIlYib1vs5V!r#aX`3yo!6{AdZj)D2}3MkvVLV
za{n}k(AY<}gNpnha_l@=lNQxVSWowWhRnn5V7nMJ{8sg}Agx3sI|5evMCkTmLGPJ5
zer6k`YFEp16+oxC(*zbUTL`Epv;GPVy6<v1*!t6x^NqXi;nx!4Y{oqgBUKX2N?O-J
z;0$OZ)D7ZjHvK=;y=hoeXWKT4MU99UnH7YnsAv_a%1{{+tph5>I8_9MRIM^ZOsyah
zLKcEDim6qh#YdtdL}iFd0A-30hFXivARuI_%4pV72&*Jn-51aEe&6x!W54^)yMOIJ
z?Qzf^D{Hv#>$>jqI<NC=KYd*iJPUPDrxr*qC<2WFq=z$Ahf2Q+>j~gwAB%mX0^PmT
z|4Oz0J~S@m*HV{UZ_L?*@)GY>`WSHh6><8K4GbSsy3LL3j|E|Qd2fGS*VwVDB*-9V
z)i18s_T7nEzhn!ojR9E{4P|IevpXcgz^P4cXzA++#7>r_=Yg(z$Tyf&LLm=<SLyPn
zNnR%ov`tvIB=$`Xrsp%l4bRRP9W%2V8u`rihfBhv+qd^@gwPMq8%&cW@(sktrG2A>
z!DrM%9gSBjFK8__F`PYsj=Bh5VW*7j8mP-~rs5UFR=aElElmA5NjDs>S@0BdyvP<W
ziOks9zde0tn`%r7iqfL&qV^Hj&jEVKR(HDA${IpMcX_+$cNbxrw3HAOZWZ)O3c?T5
z77-R<t^rATHdVXh;zII#(7^AqzAde+@DC~P_^Wf${%P9wvRF-H3g8;r38dC%M!jLa
z_#_WsGc~qVvx;MaH!08KCp8h!{i#{p;X+I4cBiF!o<v`32$KQ*+QAi76`d1?G=pKP
zgQ)Vle^AJ-i_TtOFiqcwMgJsSxf@wSn((&NT0yv+{ri!7{xz$)Z`%KSawl^ajK8kE
zyz<5x6Zh@hIe#AaKK-=u<c&MazvU%N%+ii<yJrS~llb$&h>TX^rZtV03mf^1`#JWy
ze67KK?ZFPtNri6R9*lHVYbZ}YhMi{fCFKW(f5gvi#~jOlq#7|<cbNuxp_#7D3I|6I
z-Ntv31p=`ikq*X5#^7&D(V6l3?cq4fuj3Iv!cU$+YC{oO4t0h@f0F1A_%Mc{pPK?e
zmV`?QC-i~AO`9!cKkaUGG9QW|rAJYW!ye;|`slu+hhu`P9}Z1%t*c0kj)@`@=>gF*
z(KS)*lJ3wq`k#PN2=qPK6)>hjW~x{pNJ)S#zUD8gIwxcs%5}*JS~?8;RU}__IDHB`
zTq1`w5)_(QZo3$L_fcTe{oCE}?B>Qwrq$?lQdV)`@cFi*ubqRwVXd|T6FS;||1d)Y
zcr0&KC5g>ulA#Flq@TjAQMmZ1c9kw0o`+#MNn3)`_kg>a4X&*7d#ts(C9z#xnsqR}
z9?&Bf%}HE-CnNf3oW1|!=PaXeY47xo$6XOd@uUeq`~Q5+#x)9BDpKaYYyYJ)Fx@~k
z`~AURHid1xi~F;_J8g2Y_3`3`&j%oXNwuc2#JnA7ff{7`5;BQCV6v+kg;%%$0$x6*
zu?VkO-d5@rC?B}WlM9z<_dKWCcWUkBmFYp=!6o1dA^&>)yV9T&M=~aSW8mGb56fhI
zUsA2rqqM$;&@nd|5O(_xm&MM!G;!J7TLr!+qAju>3~IOIevka$gl`P|J=3o|<_Ba>
z<V#SR4ZLpl`HlC(Fx3SUuL?$hbAnut#^>QHdD=w`x!-t}<~UOOO^rU$DqYNBk`rj(
z)6-0~=3T3Cdc=LG5E!PMz$hgg1gNAA7&3o|=kCRB^O8Jiq0|MVR<{S!T{8+tEHi{*
za1hEYI2Ppv#?Vq2KAy=>Hd1)44B)cpibM>vw?h?0;-u2stS0dSmvQUeJ@237cv&Cp
z5_vEnKXsSp9|?D0MIrb5nK53CxlFUNA4jq|*H^vWLb(W@gDv=SzZYVBO$gv6%v-`f
z4+XEj$fHhNl3c&IW>J`xTis?YO&%0dZ@V^Dw|93{AX1DAwqVtTRx1O}Cq^;J$=|ol
z`KvtOUw*$ZpLh%6e$nbru@n@o6<MPfP9<UAW!0&!fK3nOa?Ogjq2+D3Q@yP-hDi99
zux2pwjlH*`6iy3<Y4bU&9*(+ic{V?*I|fO0jxD>`E34XV{9Qclb-+whtNnk14-5!#
zw-f47+)JYmo|)s?3)si$egHiQC+%Xa=LOG%v#qA8CV4M@()GCzw^O(#DhBBEj!3UF
zp94CCz%3H*L4Ds9BE4sa_u<u5eo+ry_{omW&0F+!D-RO$XCe`C&18q}x%kBR(=RJN
z>hg#Mb`jq%KI4r&s&FNLIZ`M{+P8JSo(gA2k3sbIZr0c$if^@WxPRXlPyYY>SK37}
z?hXpzWQ`ZMk0Ii{pd~X(lG8<uRKiU6FHf?vl4Zs@fHn%iF)EJPL@_DV%^Tqww+8rr
z+1GNY1Wmdwvsp+mEJFJlOLCdfIqRRd7g3w-lZqW(mXY7}#nakMi3M;Hy>6=$h{r}D
z#&zvL;m^f?Kn>=`!#z~QffFc;_%mIeMF=T<)Ogy>f9Fo}Pzzzi)jc4-AfQ-B_lwO&
z#Ue^Qf1!3Qcz4lz`ArB(>!6S>4$6mJsf{Y&_~I_gxJ`7-GS%@)0PS+2QzTsvzkIBF
zQd4PU6Sa6Oa#(o$d1u6TFKDf!ge^s*hqQg>Hu3T6v^nCx%fOTZs_6tFClqICwn1pz
zDQ2oNX!AHbDCsp;P*p1zmKNZ&dNd%oH;`HJtwjv?*NWSDHMy)X_WF;4CpkWwPnD;<
z4fwTq|F=Koent9Fs)qnGD~vautl2~~)1aU}&CuhvQkHm<QI;RxEEgtZ3na~S#m?s^
zWDsRX?c`BS4KF=|1T9Lh^Rbi#VOAn=d2DlxY<BbOT3;OXEa^_gfdSuR&d#%RC8O|8
z4)Ae%UXsXxSsx=9f2CPvvuR6vlnraYRmiv@DmdC%Q=8}C92c$Q-vj<{r_1f*Q)B3E
zb&%8U$2Fa*51+=@um5-^KaB(*V!2Zvy)lMVkMylms_JP513s~GmaR4%7bs~)!7WU$
zD^oF~G|zLzquDN<-F~}my8cye6*Vb(8t}GhsrqB%+G{`T{7w%Gn86pwDgj}1Kvxd)
z8Au}Xgw)7NU@W19@-87HuH7(L@-(GUR~eZqny!L&tipy~JNOmOLWPoSs^D(;;D%07
z#JZzDhZ7`hPI2zByul#G@Nw(Ss_{FC`=9=@kK9kg*EDI(_-g%j<a;>0elleATdG;u
zDR4sR?N?02Yd6dJ$<oCH1$<RcRVw%twrLO=ofO&ZR5xgZ%`F!OTUVb8c#<~q-g>U6
zBf=`qdw))MW48ig@5`(I0r|<3Gii4@QoCJzES7@99v!<YL(I6{@cnFI0EiWTP~LRa
zlY(ti2oh?R;QXD~&cq96&s~_;sy$mY<bIjRaw*O`aZWJW7ik&en7j1P%<}f50R#R0
z@oa{6X$TzF40NfSAlUl__&8XVtHx;n^9UL!88JPzI`RvyG46wz)`?9g*8vv~lgP8`
zTa2YlKAJd^Jr)cEQjUY%C}7tlW08-*e{f{ytKCn2c~5-$8nkBL48a$eY|tfxeJUh*
zsWH(+D=|lPPyf+7B{X{L&shlS{>=v^geTsDPQ9>oY>R3!0L}p@F6A@1CKxXzl5QO4
z<{Hq=LuMmqI==Vmk4)b8B=$D-WBbUD<QG!hU8$Dqt`W{eBV$(0Y^^0Q@yuXC_@>*q
z2jFym?%s7Ek&Y-_u3nQN2AnVPm$LDL2YRAZB<ZNt>h$Q<Vx@{47*??}7hydb`LSB}
zF7IDuF;RaG&C*)zBl*j`4!`;aYe{rz-m^1(FQ@>@2M!a5GTyTbMdQa`e;nDK_Er0y
zm$Nr+Y_ckOKI@RhvVA1YA^=F{GvRH1#DtftJQO;LTBf@(KEXE&tvFSk-;XCMKh&uf
zFdzGemz@pn-&V*zS5IBr;WBP`Fl}v@lPDvE{<Kr1xtZCm?lw%hpRt8@LyUiYLQUv+
z+GCoZAQn(2rOAAoDiU^Zn=X^Od4#{X#*N9J?@~ZZwW3_oS{8B+=x&w1BJl#z$iBww
zg`>PY&X-umUxQ2Aot&a>?HWJ5qwBs?LD=xuq{-x5q;@ydb}<Amk6FPQZ`Rn^cm#Bu
zj$-P^X|{7#w>$Y}=0=#mdsx*Tg;*RJ={wn$@PlS2|6wnTy&h1N&8WYo9l4>8vj8G}
zj4*k<mFk<gM&rQt0l^e-d%6<MC)L<$x7pIVh^5R-t|JWkL}U7g&|rbQd1HU0`^xg1
zCEZbLoyQk`R2>ktMfq->IO~vClOMra&HO=+@C75ON@Ct9)*+7`>w(3(L3gdjl@o?-
zx1En4lkros6WQerS?9BQ%7Q5+;FhXAC=c|a?@RVAudMQQl^*I@Z+)OLZE*YJCz>4-
z@`&;Lnbyz2fAnxR^8ZX>wAZ=B!Z4knW;U1vq6b1bJ{lU#&Hkg;K%dXqj2p;kmui-S
zUTHBR(yl$LjL>gnm}tEV-{8^pUnR9y(FI42;FY^Bmk!Jw-PaaUqXAZ_?v?+aaDJSC
zddFUCeG$5WW;0e&G68oECT!xTxLZodbMOLrIpBq5wqIesP3q{R^&CINyEgA+88-L%
z8ms7J=U2TGe;3{Fi7H69v8W5VG~%ZI@#Tj#q-lWEB@*%X<Y_AF&1X16hsYq*xpvOd
z-sJvH0n^7fk72<yBju!V%Q#G0=T3gX<5Be1*USMutx`pp0F}m<woup}TXfea2DUm@
z?JjCKmOqrUw9^sh=RSFn8e-n6Z7JP{rQVsZb-6u}<rOeqLf4wn)Ovb+{0#i4KL78{
zyaZ`SV?D7AY{Wi6-Ib85J&s?{Y=NKNCO%Dua>-zF0`rp~Dg31XV^HSezpV3lwb-TE
zB=&wn|H1OI&Sj-lSNl|B;|@=92JJHka&Ij23(&(?$I~8@apw|sqwY84l+c#wV=NSh
zlCKQT!Ci{9A#L0*nEZv4lvMZ0<V22LQ7w9xa1~xDJc;Fqy^@ohtB?25Qn*W>bvPFt
zJXBKEEsxkfyg%rr;OIR)1o%R5pEuzSJpmBXovZH?j=$8bre?_pC<l9@%-WGq+T{TC
zgKjI|8&gy1`9m?3v`HhTzt~m%$<S-vuE#Z9F4jE9_PW>aM?&xXNdBacPbsP`oA@?V
zXSPxjZ4!h>HzF2XJGO93W%eL*cX1@cm@PTdHBpcn;dsC!-GB9yss!)y+a{s@SAM!z
z@wAn69S{Z(u|T9~ILP@nX_f<sbqPcjO+lM@hjtlG!|b-{?p66KdnYLAwq9tDB&ySM
zoziJ82gJaA>03LiPCkSXBd*+sUM*)m2pG1E&WhQe)HONJ;a=zZoFB<=c=%eO){Lhn
z!J<guaC<9GCXZj%Y-WptvGTDFOdv16q;*0+1J#GS94`sRlIxM=U^~?Ba%8iI#CAc?
zWc8WIik{NSc`8<B)0ma-wP&5B9=8Im!`{PW^o1F&Q+pF(GyoTmhXG{Zk0u=8w$SEr
zmvKA!Gt9T$_>PC1AXGJztqv-p6A3HkVYix9co#@IS)`v81hD&$v`T~8g;g6AI*WHM
zahBuLoM>Kje)Cy#T}E@&78^^g<rFdBP-D!_A`AjGd$eDH!tOzoGK03KTh!>I$VDv$
zEm!aosjEh(GoOTDc6C(8s@Q6`TC48o=KuxHwoHm*-pXJezS`n*HMFSEx2?Lmq#Q&5
zUj3g9br0#~n2)#Qtkjvg4&TB*)zh?O&sZ=A_%7$`AD;bU<hBc2c>4k4+n>J?I=9#q
zRTV$3=dHYQ*Y5C7GcqLn%do%mX(*j+i8Cd{x_0CYrS}^fr}{p}EaC9uQG`NRu+RCY
zHTgYFBHFzICDT)BqVaRvI)5>|6gX~oq+=|~*ZnV_5b*qrTJU5I=~EuWJpx|mWo{D{
ziq?dSNUe31kBoA4a2`0zxAaof3AdE=CS;LzZC3=ba>&*M-C2Y&)u%9<Tm4M#!s|!c
zqja$vOF8X|u-Mb>?x1wkH7r8l9UZoyuk_Nnc*HLN_H;U7Fj_PmaH`~(<{bC;e2HJj
z*rbQu1)#32Y*!iO=|s_o8&%(Sc?N|%9PXih`|`t^5!cM}?q5{pm1PNv%`5hi|7s!(
zH^IHm*JVtq@b$oV<0~vLQ9apqO@yBAW)({=H0At=wMeRWaH3^UW)5dd>k$&3^R`yO
zFf<DE#>@wDF6Os980pTjuIvhF|L$IC%`T@`ealFbrDUxcfUz3S{k{}PQ<MwmcK(tN
zHJ6|4Px{jx3o8{_jj8J+L>X<rr>>yf>^fq+h4Q;<9ALFMX1Xi=#KL{LOGs#thf<sf
z0o_eTsf}}!yEV|#2-Aw|4LNhrsdViwS{S{g&~^nn7I2kcG*l4|mP~=8HOpEBoub<|
zXQDPlM+$Spck7WRn}Nko*2U9?{uZBT(eCCaNVWZ7+4cug`-&oJf)-Xfn2|nWm&i!<
zLHY{*B~JtN#0%Q|NuedaS2hxCUV&vLMM;;2XTReom*O{ub5?g0t^jEbmag*dQATK1
zbb6FghOV#Q^Ytt(0hvRrwLYfV!y)UkW>yy021A;pDcPhtDT&=9r|<~NFzQ!WP%YR9
zhA7EqBf%zBtr47U!abmpSmX)~1(T0&M*H41Tulv$RKI+{==0wA3c6Qt68dkR;**=k
z1mfZj@d+n96;Z#}-7AIpd@|H$LLTjlV#0{y1WF|ZsT>EHFVZ-;q*RwFukhg+GqJEf
zZtC4|2b9@l{|&bKx$EtFOv8vgYoA7<zhlk|(xk**Yvw~3=*(Dl#9QeT^_#ZaWkkDl
zu1(pUx99J%yKeXE$@lyJiay#sE1vcXea3~^Y@ON-2#z8#dZ;DUb{+m%#`}Wfp?jd+
zt$;3G7LU7ZME^yN5f+hoSvkP0&!Qr!oI}pHDUy!CP^gtcLs9lsmCtp*dEFK49GEM=
zp+DW)1ym;rN{_Jq7VP&_{kPQHEdsvF7|dfw&_Y`-#oT;T`lS4q_cHKyW2F~Q+I*w@
zBUPL3Ky4pUkN7?g=x_GC*7$<*2VJ|!gP3opv1YS~`O9IM{f5!55+3YzawJI%^<SR@
z;mVnfQ5qulP?87=7JX49OqYtJsUHVbN3q1AX?k+h=et^eG(sm#n$$FV_*eU6>|E!w
zThPwB7q3742y@b!RT2hDIej6MSlb1NbFX`llLTm>!jb($QW3dMxG4P7kx=!f5zExP
zP<Km6P^`et?7_huPuiVh4WZC|zQKQ39qo2*hkiWrC8%ri$9pt(S{DqygBzf^=3FYr
z759F`Ie>q#Y^2Zf!9p6W=#mJ#`kc9L#EOo;z=;ng5rc**>_%OutkgF;*b&04V2d87
zSlb+RW^_qlJaT{m#}nB@3c43b3MOHG_2flFKci&s-Fx`99W^~s)?^ar41QM0H)jOC
zsXxi2fx%uK)vlZ4qwoqIE~`C}7upx}ZoKo;3U3QH_ju&$su{w0$NvBw`9IlEaO{|X
z(&&F;;dlfdCynx0DsjTs_-W0^as(_Jviy2Psw91os;{TPT!Pil{^5jUyVfAz@qy<O
zThS^X9#|kJjgJ>aLHV8*5p1-S5g6JY7E{!f^E@vei56pqAGF3QA_b|ZYiShofAs#o
z4@Mx+>q{u+Hr1Hw5@@nJVi9jFSLS5Ov~@&j5{fZ<?^Nw{Q;Ng)r9H>NQj?cN7~w^C
zhpZ%hEiN^Jhq#X~)=+-giL-4%OeA;pv$h{FlTa?jN~nh3)!*;_Hx;Fm3}q*rM}F32
ziDmculE*hI`F+2E!Z5>-W05SEg2Mr-k;D)JnI=$o4xp}8?l)@Ic5!^}NCQTHvN3s8
z`%752mBaIdKjf1IxB7=eVm)>((x3hj`$tb}C4md)V)hB1{&(2+FZib1rR*kXs60Fd
zC-y#V0JOhPp-JMiVe4b)DKxniW>HN|SImoirJU3CI^)5-JDo+jnJwdo=^KN$%p#8W
z?2F4DdEb8?dP8r0=jtk>|2_c7*}Jlj{kJP`*=#(UttSLJY_irGdL*;==%BEa-C@9C
zvO(OpO<nL9<6jk?rn-(GBo0N^OlrthU5w-z1>oCix%05|1qzRhgU}_*7Zi_BS7a%S
z@^dnyPYp_TmZ5)Vu2G$F35i`s?h^My2?JFBgi|<0?W)V;uF#sJS>UlDH6<)LR`Adb
zGz0c?s9HLjEUq!MF6dyc(%(74M?ziO<LF$V1KZb%l?0{whIQ-!)nWU{VN1iPFteZH
zxd>9L4>z1hdE7HD&@AjHI{Brpe5Eus*bz_13>&Q|$sDg-yd?;aleZ)jOL3$ih#fN4
zEk@HAeIwkJ-CCcA4RHmdV4EAKHe}9jb&jyy+TrLtel8H(MS25j#t81(L>RmRJlR;6
z&voXu#8B!%_tu;{N4o~gYOL00Jcs*Fr>+Q{epfCblShIby0v5>o7s^4S0>005?{56
z`p0d10^3#2IzNf~Td1Ft)gQC+!@0)TBGPMsSCJWls@gzT3{R57Hx!2p`=WPX(t0tF
zMS+@HIZmUugJB3OdD=d{YO{=-n&X5Y43TTT_FP-gzguBgec<zpDPnD>OY{DFKUfXq
zCx_(sd*}K-WNxu((pmtu;61$hSfUx?GY@>uz!h7rqCmpAiSCg~ayBKr*E9jgp17uH
zwgtry#^qARypcY?beHsJr<Yan>i3UiR&-~g;fLL?Ui+cY$$3~+=%@#GEW0L#ad@q1
zr8*w2j}R?V5oz2Ue1jO~)HR$R(RWSt8T5mtF!UqT3ni9xM8)<NijX-_^<Ro&?y`T}
zc3M=Q{lUNMy|`;Kj=8T(=sDoAJI-D*{S}Fa)SeT|q{26J^-j1pm$Oq>@Q>cfW?B=?
zP#b}I)H4<eqng3_66j?sh8V_LCycCcyTmnXxpUMht@NQIXWgTr7(s?eY!Q~TqWxV}
z5)(+Ku&VA1QpEx$VW9^Ux0!gBJ~JvV>m@^jCWUsA(L2>Zv(!>BiURN$D~>(tceU!I
zG6}z}WX*0U7^QyQ7QqR0speg-awzT}>Z4}eYbx}<Gwh0{r$2Wd*x0T7PTX1QFN`vb
zCpS^>ui=b+TLUvKwO-;7N`hFFH6~ywonXP9;Y2*aDN4E?Ob7Hy!Ny_{Qum#VPQgEK
z$CCKP`1OO&yF^CYAP}HMr4ANAH_l*9jB};+hb^z!Ec_tp(XWR}%zTCxOnOYT&<wyA
zD2{{R*61b;LKxHWqd;@uF400=dns45P7_TSi}52h&TXC)omiKu%gY6<5;-yRk5G88
z2y>XxM+wo`t8emdsegqdM>)Lq#6Yp^=ZaI;^1{lc2E><m+7!Lx^l6so)<Vut_{F)x
z;(>sGhB=KTkG9Hn+qSnJ>x|lbg4sVL^0oACw|ky*s3WqP+WfsJUjOf<aItinEE6ed
z(VBvY`ip$sZ!FKieDH0+AU2PbQx<CdA2loZ_%|@A`gwnAWX9gl5>Q@U<^GOHR#eg!
zg=MMkF_j0!Z7!n@=SMo~{Q_*u@3Wb8%P6n&{{0q)#9EU;^;VQVu7t9|NS6(d#Y%O5
zUm{oOaiDE?g{3_fCx4f&Iir$D!PWxrQ4~Lv>s%H7#?G(!=6(2btz*TTz=zJpg|4MW
zNx3d*M_$h&F4F$n9P=K$X3=fZULimpi5EG*WSfn4dY(|eL{72h;XZ_=tnFA1jNyiJ
z%`1SO?HP6q<+2vX-3zRYaO^*TdDUbf%C92=8!QR)j$((1AKI&YA2cZjob{*Sl$yez
z$#}@bHev-L$8i{c1Ft7!6Yc4gc2SA?JjMe}KlMy3jplp<f#<5HpT>juQ)=|F#w(z9
z!CJX$G5)!3aCJME6izI_PZZ->dpae<Znm(9lH%LOIX=qUChdbC8pC8B!;#{J_!8}j
zMd+`ji9ZogkH+n!Iw(C-65oQdMN!iS#W%DKe}i4a26(~__|0Y9W}3BFR)myO#?rCM
zh8%Zns@CbvA9V8_xx?TEizYLrCa|MY?NIUMz=j+<bo?*N?0slg=3U)GZp{*3XFQ$p
z<ngaH*Y6^s>{yTl$eg6$F0TlKIk5t%e?JFw+3z16=p6_Q9O;X0qNjWsu{!#>cIEzX
zSD4!<dziQT!b!WLW>HM$tp~#@=lw<RG6tUfGVp@doUFc&Z=j6HHNM<7q@<p@0<mmB
zEtTaB(nMqSQ{T0bYd!Z<>QpJV%TafBny+z`QBY)bch5Ig*TZ}sjW7kJFGW_Dhf;u*
zBnR*v#3Y{4&|SP<7--yPIlck2R6pP~)T~86)Gg5(%A|%`Drhph(C7C07UJzT%z%oS
zROtH!(Q)+oE%4s#QSZHVudaLgY)}9(t(ET0jya--_%Mt?phAVO@=n!~6mU$y4Qpwp
z)WvxJ5lHSQ<W4DvrRG%^6d%y&6hY~=NMsRsn;7E>Fw&oy9W`~$OP$Q=E_l@I&~PK*
zYSvk2s~MUz;8SxUyw`#X-484<vv>hZ0ulL*2Y8-TGHDAqhiP*-rf9z;XL(l@w5NOA
zoi1^fD{sd(Sv7${<-={o?8JRt3at40ouP^qHk3W+WErnm8csoP1haX&A$)ud&KBxl
zV4VknH!`R@<F!t8QUmQ?oQ_%V1<}R`7BDi3xNGoNjfs-rm95S%C#xOdj_M!}Iyuvf
zhqC<KW5NcPx4kD`i)&hiQHz~@V<j=lu$txV@ZC247a;#pOw3D!XCb&R_@(7q(-yE=
z@zMB(27BUJ7)g1m6tn)Ww6w!BN`dGN)sWDctN=KW{4y{3v;${tL4eH}W<PIE5T2<C
z>{@baBlBz+sD7%a{rV=C8MWXJVC4W9%51GJizdsFE&)0r(ktA8sU#G@)@J9S(P{eO
zwq6*WCqfp34C|Fhr`h4b7M&9+i}0!4c?C$_!MWvOMPaA2%6hV$U7t2Yos2zat``jf
zdbbL9TL)4JSciJH?l$2CnxCY4MjG^}Yc{i8rHafa1%c41@Q!z8Ej)t%s%on;m+SQF
ztn&Uv&c_kovhu*96aLS;TyCEWuIP@U)AqD|j6@c&+4{9KS%nk@40vpvW*PA!=W7tX
zK3PDq;W%M}TA=*Xt}|Lod6sy(!to+NGQhX;yddW#{WMgr-w;q$USr<vY~<Gv!$@-$
zE*kc;JY3QnmJLl|207ehw2z*`Susod^$Y=L*zMnh%g0jGN9UtHg_{>?17@VM()cD-
zzNom))&UdnR^falV~%(6=%8b}LzORkJqXqYo$24+I+3w{<kh{QvafW-m~)1ELurPe
ze>dbjziK^g;7r_y{F;h9g;|Xr7%o|>*+cxXTS?KcE!KuS#jTYrQ1qSA$*JDN$ZCLA
z@Dxu(u^Q&Cz-$YsPvrfuO9YaPz;C)D_uD?q$J3<s?!J=+_)nvf=vRuz<UuK*LTGr8
z)<jZ=EYvQMi&Jfl@tatPVlGcUu<=zR-{chBxNtVvik;&T>E104lSz&6l%YZM4yRIm
zk6~Nevge)e+9sZa9E&SvPN6}}Xc?u2uU)DStKxv}26C*(N9~2t#tP0U$;o|AO~O=5
z+8oaynaX(7U04r(I)^sB3AbX^+pIf`Ei7~ya>^BTeRQs7NPc0wydS>r2<*7i*>nDK
zuj-SLCJxH!xJxc!u=XCCA<1@2sj=eFF+qy+ZNuFiQ7wzZDNAaWh4u`7*)?{0Sy^Y*
zjtlogt(udP^Nx=CUGsg=A_!F<&JMbf<q&a<WhB}UvvFUG(EtQr{$Z?Fv!2^4Mtxz!
zQlNHE)gDAUUP#NE>Ra&reZ|)ltZ{NG6BXBkQVk<9*zh@i`96b5wd;uDoA!pEr&x(J
zy;bH9!YdfPLakk7gy(*9VQOv}Iz*bdejlPsF$LY_>#?W9S<`ZfZ#FqvX+wSedh}=)
zj6iNnKGc0CA|f{-F7QC|w$6z-i*>r4NBTZ}a-i&L7d`v9`evlgwXt<a#3It?{g9du
z{8t(&k!m4ksY$wDiCK6_6ZH#d!2ifjt{XJ(7WoD!3DY<~dEBHhV*-Hu>xWTZip#48
zfEMVB!YUeyi<tNE-%1TcG~<RxZ@mkoLsnO_<l=?#$hSYj-3n=__Zvl;8@?7>Ay;M?
zf5=jb8<wyC^O1Sp&s!Dqj+yM*8ofwjw)NK(#rFAWv$O}0T0|_nEuABl-J+FSq@&l>
z+-l5H`=u(Cp%2wy?l!a~Rd}kKr8PQR$S!XpzUcDYL`qRPhIDea38;6`kBG59V<g>N
zcOUpW>h;Yr6#?OXcPPo7|DM`<%s{uX-dM}w;2Wa;8|A;?W%Tu=I;$>clP+?OVJ8}<
zX_wyf_I6jXLS!!^1AS<-1t~|X27&!_+b{U>t$M4*+hI{fyX6|2gWj#hp0uLyGTZei
zN}BSTnTSSeVY3Y-YiF7k7zU+C_8vX(YXs{I%2<Y+_r_bT*4;-=(q`iYFcFnVHD_1u
zWXu~Kv=fO$m?8T_BPc^R0id?4C%cxAJOl^g_Nt&TdC@_})6(_`PoKE^EedNEnH_Gk
zAAH;5IpqI!2L4||Y5#QozvBv8SUd@xL_Oaaj^c3qU_mq}QPp|8npd;NOLe&lk@?ym
zswn9Y{iA1rC%*`&is=$33c6hk(<5lxv+B=}o)ZjDm*qOUpDfN-Gy1X)yPwXA$@rP{
z_nlE#k?@Sv%LOA9t3Z)Sqb|+)?A<986+9Oq7eU_D;+o5A{yB&HpN4}$LOK26ko(75
zD<4<B8FgQs2U?-GOLoNOOM`k_=1AgC!K=%MFeQ*q@c8`{2&DZAsIWFp=pq0A`1>p(
z8NwiotTioBMr%zA)L&xuiQ>=#A3D_4crC^_j0=SL7cGa{Tt3UJH^^0FeA~`8Cy+p|
zru(%<`5yixk%Sd7jO_PSl{|L8a+t=<es6s#UVrLoJgr$tEYyHf|F2qW_;xGslc3b!
zq~_frzYB<`orXi2Qy*W(AA>kN#})U*+|(B_j;$UZC1jrf)_Mq5mbch;DcV@69N0KB
z&%#fi)L*gsqMR}AoYdiux%?jCBzgR{SXkUF7_!LDDH6mZxlLLx=tMv@uzQZ~DuS(`
zS|FeIgRcKJ_>Cf6evK*j4FiSJyRQUh8kWFdV!GV#3TG=iwGGWmQAJL5(ByWB@~m2E
zGBUrEwrIHfr<be#7_$2KTy~p&82xkVWypg;_W92~Rh^>dFNxR;*H-;cum4krK)dC!
z5O;A>f7V?WpY#y+Y2?WGDvV#tpY6f`ADKs-FqzPp<J;pbCgG4$(FI(WHtp72zU63i
zS-=iK>h_#X?JVa3tB;`}U6D9gh3Rh!E8p;dG&z8g|Bd6%eukfu!R+Iw&wv7FYyBeR
z6!J)nHfJ$@0gHXX{Tk~@K}sTic<yUi7i`?h*&6i-Ppr54S4vsTsoPAlsyLt5lG)dL
z>RF1u_7dxqPkMi4iez@qh~kF@df)%@$LqWC>-CQ%Z8@bk0am-;-64PMCyW3%O~~Lj
z@JpJ;SXi!_tGgo(r6)<hs9Ao5XtSDXNH@nT71f3>Y$+I2hfJug<mH!7GwO(Cm~HMc
z!KhVPRso0B)f3#NxaK6%1P)kX$8!eN-sO6_yKrehjB0}sS+<(;m_HsOU`MN8;&U*!
z2HQ<I3G<eVFKLa?Ea*&u%(9XJU?!i$v?ZaFHMiwLqtUE#)yaiL!hnI%nEMaSlhSho
zrQy*XO-4@^%=#NTiF4l|wR>k=eZk~wZ}p7cd_Od(9C1qw`1kcf+u+d{3bX`=5TkLI
zaZ3dyWs(MdsKMyYQboi!O}ns@@t34wF$2X}7gm?cs}Js_^iS`-oj00e+Nu3!))b;O
zFCpfuAk{1AxV_tWv`jje+YPIX`xX9KNqQkorOnpPkvSzu7jaf$n;NDC>EO)c7KCPA
zi@k6khq9k&K#P;6FI7m>Jbem%PYA-M_wv2+u4HGWmXgVMY=GY1frJq>WfJZYP?;})
zAd|(IP0Z3B(><UXbBu8TN~@<>Mp7*B5T(;q&kd*|Za4VoURPK)(8;4Ui*D6dRNn|*
z-D=<J$vP$&7<_Y$dRsW$SH_PEo4qc7Fno(G?EE=z;RhbTSD;p%fM=1wtdfb=Nmsx%
z)P~^Ku`IBKl)(RmyUC>W<oVj&JqsTUI<#>PMins2xQn};`Xz*AhX`3PLXT4z9sK=C
z;IQ++>H$GlR1ozKnLhN%5>_F#en4n&2m32G^)Z}@nW{_hb?7;mp==@1>QqYs%y6qG
z8*(;b4#E^qTC~Gxxcgo{$imTCi`agLJ4)l+H9IkCT2IAyuU<yqKS~c%I9LX^O*|&U
zfMz22G(3c9B3eBUaF|9)?+4k3@eOE+QqaKS1uw%v2AVFB&f$c}d8vkX195#NS<;d=
zXopd*3adN{2Lf=vExwkuSyt3r4jr!^L0!}BT;S`pr=laGYDYn+9_7Q<nI>?-)EJy&
z=KyS*5DHu3Ny}LC*#d4Kr9>skVENz<u<q+(z(|)^r#*oBNkFKBSsy$P9p@#M>fC}+
zeyU5q!-4vy!qDiJ{J{$chWp-MTa{Fq8_XD*&d8X2K>|H28xQz_r8>xRq0-)UGPki&
zji)vakHh*E2D*C_^bGgvraGEwDEKe%FKcaNswBRJr;#Uh6>!fdJqA2L{kF77>)kH>
zrq#~Ptt6~sZ~24pZ9W&B6AR-J!-<)4!d9bM%b}xi?C#^KPvb3$A(ud*fz}SxAEH6F
zX<W39$!tEOlnl-S-36&Rb6==BIx9OWue-qY*8R6lg8raz3)hYT(SG^`rm5%9EaK@j
zS!=E#3?dYuNrElp1Az2Wt+rBM7cgC2r>7c)v)O(}6MzYrG~H(tBC)jxA2JjC+~Kq(
zZ7w#XdiR}K#bK7|uKa?qZa?*uMVlUCEJh=t+up2k;`RU=%zmt2?$irHSINYtt>`AX
zDnpK`GO7&DEqsm+NAXgvc$cDztR;jscKd#NSg->`Wy&{!E#N#9HECn${k*GCWZ?1}
z=U_fA*aj8pr^=ZMWY%;MEcG3_`&?7*OB#9z>7^-qnjGSQJ6KXz0V)N)`VG`I7Q*NV
zc?13%%2GJhHCrF;%FW2!#i8Y~6B{eOn@UmTn(WRG{VLr3#`zvrXjw@-k}vr0bI(h+
zL`3$G|HQXkyR=u?(wC`Hbmj5K-YLY%XSvONjK*8(-_+<amh|FwwS*zBeyXDV&(Scn
zLepStRnbvYv%<$xYuEZF=m=hN@L7k}jK%T!Vb+YbqNEp*{YsnonepZWFiq^_A^+&P
zn9b5=aerr^hskfUo$$?@)W7QrOQosf5J!4nftRBrzeFlQ(sMRG;Yo5#sP^b7ARvZ)
z#V%;D%)b2BPxwLk)D_2?S@_*5CxuP8A^7$7XqUUCI}7I*eH2CNkw>9cto0YmeqCk?
z=PSsu&pz<_?Brpzcw76G{O=7WNMGL}|0N&{Hp6Q6)}?8o(3}G$T0#cr4A#?7Nlv1X
zfCvnq#Hm)CikKeby&%XHwzk-}+%-UYD`fV#K4vee+I?p@IxENO-w>n=OL(|L(&Gza
zu7}!19w>Q~@*P~T5~+2JjN5de>mx+QJG7_UyDPrC{66=b#Z90l5tR>Lu}-iY{%jit
zzlh>+tJhDsSpBPzyf6#PzMQ*19v3|>d0v^lW~sh52T1Oebgl)i(;O$dX*N|xwngLw
zt_#urkDd+TfV+c_n+@$~dL6Lk*0Kv4skS`-$7Pk`@~2(bcXvlv?iVFYtF4)}&KrW>
z-dhi<emnGL&`~s;HI8XkabLMoO2u_Z-!>&9flFfY7paJ)z!$CUn`$tM-h+l*EUn&D
zXHf%nX65}_rO{8*ue`yG?<juDr%Kf7C`g(*)Ik$Di5e<+yE_}87I=u+6Nd0op%w^{
zkr#8eROz0HL&%H!@okdn%&I|CJOX3A;CcYQml|9*@ILt)6uIQ=wCHVk%v6etf2N0n
z>mTN6`e)sJ;w~IJX45?WjP%(KlBE!-^+rxO0bMLYcb67I@3U8yU#ywUR*xz#OQBV<
zA1@US5pzMyS!<^t&jJOJ^<^+?fAu*KTTJnSt=$}J=V@`0@Lk8`+KCLNPnV~cZFR&+
zMLzll4zC(0xoS_+WWNUM>;A=cW#6VnAibZPrVb+@(;1S_wug+YB7t9Ns-lQ_w8OqN
z(u)L)OtiQ>t{^-bh$9c*^u3H)5fGYf^RFy-5HNCyGnBXo3yX$jl)rNSbF3gu!+)r)
z=A(xgZ!G2IT9Xg5kQdP6ErntI1R!V{j8e=&ty^Wt`2mwAQI`e>m#0%5*($}E<RbhK
ze#`F(-Gm+UVGCA#JIpapkm(xp?rKr~;MQ5?<(WhJGt~+X*FT8J_=E662@Il@KbJ7)
zcG2e6IBUPfTRn|r!nyc1nUq)MfY~1g$Q!;vl4rz&QQH-X603$OtzC`PlQz!Uhb#NK
z?;kI}evtoddr@ZWz&G<A=y%X$=~DDC1Gf)`(q(q1E|Y5u%S2rYsWMhUsclKFVAZi~
z*_KKguWAEKcv#r3La%HnoSHs$TTv89hn<pKSJ99$o+P--&fS`|zuhtSIe&NMvnLod
z_#8+(_5Q9T7CORx=W{`G3%1N}d^1`IFOeY<*GaF6&1>A*x$>mnz|RIarO8Re${lxl
zIaKgqV5H`(glswKv@m??yscSl&mOcgw9l{KKJG*iw(yA{aA?}=W7Y{p219a(@*!v@
zTNd)hU<b^ZVV<4D3)Fjcw<iPt(d+k_vHW?o6-}?Tnp-MEW?(LkB{~Z7fG#S7q0Acd
z9udzN-&S8So>?HEM-&eAygGS)#Vwy6XUR$7kX2H_o$%~ag7dR*V^9}{%C2@7avUmo
z5A}ZBNaMzBq1bwoFsXv9b#_d}#Qrt7x5CS?DR==YNUWluQbkkzU!|B+y0gsz)!wHV
zwYo^VqvL%m$QY^nJMuy+2J;I4(L1q)uqC8=#0@U=glofQiY|&d>{us-7k|7|<H@$5
zEMapcN2!MRLoDzGLMH6kdt;wntVC5;w3K3Ynzhcf-pZ@5<rthF-rqXAo)Xa(<;B?f
z{Bf7#3)-)Id^2xG72Jx$>O_u#f%sg!Ury#(3F?q5CY-a_$A@TaKwDL`+?P}r=9R<?
zx!<g4rX0-LlGT`fvoYh*(XH|$Ea|?-9TDSEUXh{d0BN$I>jmwh69m=T<AAc-I-~p~
z&toSw7r3vo9r$S=u7aoacw@<ptXa5sL$+^Csi1%4tKk}ZFw}DCH;R@7FMD$JT|`s{
z>BtjN=S0Rg>(UKJ*~Q;qGt>Y3d-#BVBena*CnzbDaxil`*hnLBzZ@3ZaMo!|wGk}P
z!qe_X&#1Oz<;kEK%}+y0n$pIrHUY#H$UHwyPUW!XCZkMfxm>+zD+tRQ{xmYU^l4?!
zit6WG5fl5!BjO$K6V-6<4wE{VEIAD>H<YJ8SOj$ccC5g^wuo~EbxNB2H6m)=5ut;k
z3)s6}C-z_qFFtHq@O##@V`biO#p|1qPv4AWT12-(xk&nS0oL8maLrtzf%_HwTa46h
z<gU}Y;^oJ%5TFi3C_t<hFHnZmJ6%Qv@X46WBG}e-IUBO*=$XpAw=YjBtLa<O?q8j>
zTRb<c&K0}~9&D07n>6H`4-YPHg_|DTNygXtX-x>l;t=?l1{%tjzGgq&Ytd}wY%KeA
zWs1%A?jGvOB*oyqc_v$d9cB7{^9k?6Gsp@}if<OG#X3H6nt`ujT(0ube9hU~&V_S<
zoIdtWhFo(0aJ6cKS52O*nb~MTrQ&(Y@$GDndW&dF3+}2mk<Ll6FkL_|^8f0|^}y1u
zv9ZDTgD;)V=+SQf@o#ed0JMV-s>^Y*W+_s;$I~9u2R)?wl!ZV{{~+gQ5Q`+r>H`MW
zb%TpB?<+#>hG==e)M{jd1#2Pu@W|(HBJB5JzV%@D`IB=0)2=G|xm@<)o}<{pE3*iY
zFIU6VJ6X5VQVprSJ_YxO?h>TBU%j;!9_mc|pa$@xS|235rO#T%eF*da^Q)p}UUo0r
zjnU;?kYU0y4kKpcOqnp*kGewCt~x*Bn(Zil$lfz`1pPG9-FLoZbz*FObK%gm<HJ?&
zul+FV@8A9t*#GSw_is4tpDrx`E{PYa&dFKHeAJ)v<~jpQDzF9nNm~c}HyP9C<*{eC
zPhs?WsKse!HCAlvJqAp(_VpE08C8Mu@r6r%vltwV*tz-RyM*?&AGVMuul?Udd;YhC
z5Bc*>_?=SfGPZXk13lDClH^!-ujriQUy?o*)X|dxJzJlf^xhs=YNbw=+C%umlew=y
zOU(Q>w#aCyT!WtaZu;5Nk4Jy*7rnYLXP`=t^5>3!_ZmL}S)v~TJb@d*N?ok0a^YWs
zIya-Zx`^X|Gf}%nighV%?odE?uDo={KRQ_(jY?i*+M0K3x85BX9$eY(yd+TJS<yV%
zlvL`qE->5Is;{yCz|*u5MU)=#j;64t;48{?OOlDxjPYat=(T`xY4a;${$|bBY!CHz
z-E$;N+*=}73yPVxAVh(A`=RBRg<2n%qQ+{+l*hm#-w<Bzdbs<1x!?JprA7bBIvdb$
zC|q{b+1T^yjae9cabGDKL5J+Bo~gnzIN$07E)az!lEGz=?-FbD@N@Fh0hSV9j|MQa
zJDd!>Fa>-LlVx!s_1tCXUZGsI<N;bmA$R-Q`?ghW%?k_;9w~AyoGLrNjSg()XK*##
zHIbMHr=@`I>jLh}Y2oE4ql3FUBS*<*p@_(Sd~H+_{*zk$n#l}`^)3Ur0MsbXC=a!L
z$n@Gq2gGCU^LswgtOYT}yoX0z8g9ra&B-t{N6hQeEarBLZ4lYr0Q>RXa=wZ7Bw9X}
ziv{$^n&Pz%v@4uInUULfZZ%)xJb^ePYJ8hKM=YnA_!bBDay-k*VIpMmjc5+h*ZHoZ
zL%2G9?=P+T(;irp)_NU$(sP(wVwJC4wSfC)MT-RZckU29Lb+b3stHQufNt&bM+1SL
zhpEdtoOxE9BY>AodK7Jx=RUtGskd5KkT-DQly!l(_o^+lSMHyTBch|u6#7Se47q#+
zJ+fonvg0JZpPzqyXMX1_-5sR1T#D`#zS*W8(_QB}aN8KA<q}_(lAIDj^&I8T0|xa=
z>I%+Il$^|Qy3h80AtiJCU7v(=7qd%hV`?5kmCdDQzMj&s4v0I(#wM7Qu~F;TTj~9&
zFKB^c77cgvAPlz3$!}h%Z)2)jI66!P!cti$7uHfzX{K6=vWTSgZlYTRhfOz0cn0A$
zAXM_vnVd=i8F9JqHlLooDUm_`juX3CD>_sk?b|;Vx-1?qR_JNroSevoqzaptPVa;I
zW<dunOxRZ-4;BOYUTn-=#+L5v7-Q9}=J=wd<SN5^Y*M`yFX@h`bv<Fumb{n>xY;dU
z3H+4k!8KLge|QGO6{oXu8y4P~en#p8WUmExi-z+k+OM7uU1KNCT$s9p;Yc&WfU^X@
zjPdIRom#0*oKx6iaRq)-?hw+zlRK~g;xGgAzkW%N6)9EOvG>-4qrG9>?vsht)gNy?
zs$cf(X*GoJuSY=QMYoV9`x!x5Q(99~B@dd7>T~!wNEI6Qa9tn{bjj^7>tM{W6g#K1
zPgvfT+wGVqDnT<7!H*rb$HfVk)(Li`)ZMUoujBwW=betob$S0-?d{tU*-8ekLxKwI
zc4@MIfjSHD9R!M|@!c9n&YB)#p4J;*UZmY5-Y_gRtyv2>YdiLyhv_TC@r1cFG<d~h
z$Z9OWSx*(;q-4-jL`6Ol`u*Uz%DozkT(!o!x$F+5_B%NI64{g|Kwm{*#op|uouu`S
z)+1&x*bWjY(t5fj#}0MNsG2c_rC3uvamIn3QlWLIYw)@X(iRYQ@TjvTcdQrX78+UZ
zDQ~Z$h1shQ-ws(Vpym~Lsb^}lN~q0NLME_Aj`7}XQU~J>nw{L=VR(76<r192u+Ka3
zwF>b(r+RV<m4^1DMz)x9Jb@%rz%ucn)vL_euY%j7noUOK^#MOD8n!Abz7}_^@U7P%
zU;XN9$EEsHqjE%RZ38!tpvjUJ63%P{Xt_p=MK?@SFP{ig&{K2P;BstA5~Ip+xy*}G
zKaZ0`6cw9sR>_*J$2V1`N4RZ8b(f27-wUi=URAMMRs4c>3qsE3K*C^&#saCO5lgwR
zktMVrSYM1v4U%~rRxw~x$VEz1up6dIa@lm^jug*tYA6GM!i2L!p)wz?_>|J`T_q~*
zX-X~@;f1FXy`Oa65m$HV(XPelsbT+Q$%AiUJ?d*ZK6l=zd!9Nu7lxvwpz#=7P!x8p
z)-^A8SiGp}!X12%=1_;c!iedh<}(XkMTgn^AtHP3FMQE>WFKkz>=1-riq<&M2b4!#
zHR|1+Ro=1S4(jU0UEYm^vigo2od~KBm8A_T{ky(Lry6vITapiSzROUt?zK+%T6<r8
zf8pS_?IO*pgmyjhdnPe|6kcSI?kar#8Mz`DU6+x^pa@nnE+bG;o`G)!v^OPxZa*$O
zg8hoR_13K5P*G}85!<q!O0CA6(yDaPzSyOTn+;iMF5*S~Z${5QZO(rgaerWIF8CRD
zWWZ8`N?~?D!r;6gbXQMR{j&IYnolLK&tCn&CtZ+XZu>q;g!e~;m+XD<>dXGX!2aY@
zi)zh|8E>Ke%Im*H%q!7QIB?ue7~(cE9z&rv#EC{#V07}3W0cF;hS4uOi_OEqF2QqI
zc2G+L)AyVN2KhoV-eL5VIaw*Wc;Ia58O%YI!kV}xUKH*WwlcG<%;IM~gf7O6cv|B?
z;tFhjS0^=G`@`@S%AX{d`CL&xmM8}f)(Lf(F5c6z#=V_(QpH0S3c2n~+xfO@I-MpF
zBmYoaLmX4|tCC{KS0>jMYrk{4JQ=G>=&p!ix|azau$%U_dwR!NjZOvJ&d4u*LFoW~
z<~BGN%{~mK-d{oWl&&kJ{XM;p^w|)4yDM78F3jMt62et?ku_d*_N-<-PJdy{i77+%
zKmdPXUhIh|nQA^8M1lRdE@^Vk@tTDRn);UeHBVSY+mz2I4A&@Z*QFo*ZSpTYB1in+
z)d9asds)Q1>zZY_kXWd%D-?h4WGm)*hRuwiis!AsG1w^vgFu7W(arHEr%teX`wzEM
zDeT;a!NoAfXcZc~^t$rhThftM@YtvisHd8C7&Yib*;nt4&C+eA%&;Bj2^0U(TYTL6
zneHB_LTY(u`ByK6jBFUq)+3J7WWO;$&E}0tX$h#IdRljr>gvz#QSe>}-+W>iH^@|^
zaO%2l&$Z{2^l^$wll-=ERfK}27YyU<|L9@90n&_}Z`n*gNFwSS;mMP$AB41LsIPHn
z>0Cx=Xar4bd|pErKP}V!EOd^&Rq0U>7{}N<(`E?!JIcs0Hf3d+!_GQ~K&9gh7w80V
zfeK@CegiI$=l-JcjCW5mfeZ9!x%xT2IhS}XEk(vXG&FYXcb!q=`ZC725hjqmPc9B0
zj<6^y90EMPW+gkTHsDmjBkxn!`n(^ExCX4W%z7A}dOB;<p2sWdjYIW6z(WfWSsx8w
zWjS^h%Dwrp1i~pP;?kyzlj5|P=sEy<_1JE8!TQOKgez*Fe6JF_SzKAfVCQQN;O7)h
z2JA;uho7cPQuBtp4=`WdEh^4?K);Y5JeWaMywIP%fPtRYDp*nHF~0=ue$XD|HU|Jv
z+LRgKK=AKqx1t}KSbdg3J)SlNN4LB@Asnu7x=LM#^XuG;8gKu20D--}DAYak_W3ll
z`3sf*KK;L?kf2XPg1*XlLLML2P&q&8?jlV77wkmExGI^uF-W@v&ARB#18+pKVW>rg
zQ-Y_yGPcFS<%5J~0t3*~W#Wggl-qLi%5sZ+?z{=>i~XbGyT-dQS(#fXReTY|Zh$Ig
zr&i#GSTy9VF-$?e6ukK<N=l95&DVN^ls>3fP*-(x9EyfwPER*y`~{2{R%*>g^puc!
z)*-%Q(g%R#@`SiAKTSGoGMo;%22{tB6cA;u!*!4A5+G{Pdi52waZ61AXG3?*20VwJ
zK`g@=^6I&)6tM|s*32RgC5%vEVrg%b;ViVWVQ_xur0>Cc%ivAFIP56Z==Q$u?%(w|
z$g%ykzwmv9o({N72}wvTFlzQNzTiT<DD|rsC(`s>#Fr?h&@Un3x!Ac{!nL(#llCVp
zqM=5Jifdzfu0~9x59llC^}@w?fMyqF&?<i7a>DfrYkZ7#>Uq0rz3Oh#NvJDa_xzXg
zS{sEhfJ$=iG{k|gsGGo*2szb~0mlQ&S_ecK0`6K|{f?S7?DYES4-L{QT!Z9Y)YYlB
zJ#_(d6H#H);M~@Gt&v|xH1&Qg^|A4*cPlRsxZJFMs%8noviFhVk=hHOnIeV~y!Rl?
zF<|!UTpge;c%qC4%nsWX_*v(&X{277W=m`3#O8tkTb8UPsT{~Ah1_-QmL`)hfj7e(
zVGUblCE2$X`wsl8Ea2YA;jFWUdgRBT#>Yp`NVO*A3i~mNX0`SRK7d*u#b09HO8N`X
zNVlqDC>_ozDUB-9t_nc||BFyt&n!vBsf%cf0`&D<!tUZB8kmXNb7OepNKa<>@z39N
zIu@Vu(4)b5Q>I|dMCCaeGdR~<>T-dx1{{c<THfMNWU=QanQ!c#GH6$AYMLfrnP4mp
zo31KYU1ZrnTZ|7*`H0c+mgG#|)rir+5O&o2QTTr5SK)z?JsmG-N0A>?xNARQusm9`
zNo&x>T}`}(cPj?29}Ywvb9OoO1qoN}1+=k1;l*mmb`hqsR$c$EN@!tw;lxxI@)SBo
zb`teT=K@31hxCUd&2f(g;<<M45uv*PWjaf}0GKLZ=nO?2Ej~(h$twQ|Cfx~@Y0GS$
zEe;Io#UPrR#-(WYVgtgo;86uD&GUr9!7jMXk-9Yhx=qc^!oZ=5Bz~dKs>bZB?zK^0
zlO~MN4}=jU?gT1(+lw49NxmWu@rqS6rA_!+{2{4lm~ectSL%55W2Mq7c=11a9i`*j
zwxZ+)+I-x@`xo_3%@()rgj&Vjy!|Z6sN8gAISie7(9j=+T4RZNjV@h<oS>Kze^3`<
zmbKL$%B+TH+)2rsw?m0oakjL+JDl0HuN;F`BIZ%gb;4YDDZdy6_-=gPXcNi)N%6XA
zZ>G(PSNnW-em<l}@T#0(O}|EJts-egY-C5b_+*4%V|L@Ud&4oO3Y13Yl+f^5B^V9<
zva|5?ow91oq6nrH(rYMab7o%A(FVud*f9CH;m$UP;xns~ecH#?XBr-fr(GA~n-Ri*
zrCE*CZmwc!*08UuebD^p=%|E3ab{e}MpA2R261sij$7+QT%g=cIzPLE(K;!%W#+8L
zV(1FkJ1rJMfpoN|B2HAX>VDrLSD&bJMtX>oXx3!(*gDi+!hp^ND6M?OeNAlaoQ$K?
zF|4?5S`YlJ!uQ}-<`3P4BDxv=OOsEhp#6ST()(_YNm0)J2#1C$Y{y!E+qGYeeNX<s
zn!D1srp|ARrHY7YDk{{Vq>73y0uBrcm}n7^AEj8RfKbS_hzt>_VoGF4P=o*}recAL
zm4L`#5l|UYArK%8ty7r8P{?G<7&uV~M-q;A)86~xK2QIE`!V^DCwcRpJ*>U<T62$C
z7_I{Tr`@g_z7$MH?htkm%slOt8#O2O&xV{R-+dRKfi!LZA!BB1%C4ln>snLa18Wt1
zO$c0{jd0EJ;LsIEK4U##FMCX%Y9d#~C~c9B|DaFglr<BhyLxSvp)GFrpfGxa4I`{;
z@uw7<v@Y`XMQAd^z&{I!U<nnIi$@!G_6`mG753oL_+6c4<Ai^$4y@Ts#Dz1U5pt1l
zB~9;i2J{ZIJ7Qy|pQvJFN^wV|ds9c7fAU}D1%u%vFuqV22$C0FGpzp1Y0IR$pJ+sb
zSKTstR65DavwPGzU-pw{T15@pG2ucJxkQ4dKxqI|w_~T@>D)Hf_%Ywi!MY8=8&^fx
zZ(tX58u+K;4k(lX!c_l3Hqcs_Ux{~-S?;Iwp6$1u!;$625O&wnReYP=hT&(W5wT2G
zg_E-#r$`dPGmdS0c{`N4vn(N@)P((e6WJ2@`TvM8FG8D>6ef^nOCHB)H&8psHBo5-
zD%oI4u+GT>(Q`o^Ps;=>JCYS7P#a4S-e|CH^Ny~h4vk&0t;Errp2>b9Z4#Q^C<(7y
zN>1)w9C^O@Am+y4@bIsC^H~s+?BcN1qH=mPrK_4b==l}GC@%}EtGHE!@{TU$lfxaC
zs4YVoOBrqDIjM7O;(Be6SZjOv{&>#5w)+GADC@KSYDadNUqN5>ony^2yT^2}C}72q
zQ8VWBNzEDbrh25G905%ZTVZtr(UVtGR)T`mC;Ui-Cu?!fDvf^~w|y~dVR<#lxs{i<
z)ozr?_NaY$Gmy0Tsu=2it}9>Q5HgdyVrgT%GaN)P1X2zd9g@@ewle&nAQ1JH-=VrR
zK7@*@HEOLkdMTfOqyn|~$=$Y_rgU^xjkUr3Ci`Z$Cu9P5V4RSV{EBoAw|Spa%sL%r
zcI5JASU+YD2lo}y&nu*JocRglfWJ-WV-IQFHe~uu)}4H1znJhU-05P=YtXn5I_&Op
zTfc9`_VdYEiR8{WOdm=jy#U7ZpgrIp#a#_5Iu$juNrKHzwvkbVbe23P8S2lRHqcte
z%$ir%xs#2pSkeH>22{|(Fw5>9>T(La>mr+au_p5T_>`$pp2)2?1nEfDA%D)4Z=YR8
z!c3VMwPYCyduauVIBAZ5-$Pe;2688s?;$&17uyEIgsT?Jt}&3!sblmLweoRD%c(a7
z(saq(W!Md?;MM@-cc4y({QvJmb>*UAXY7NTrK^p`K=1Wpbi`nwJcijw!rly`t4Bc+
za7@Tat|O*em%qB+6Qp{v&<c!)M$29s$_KwOtF1tOseI+E*5d-M_DU20YhtfD)!C~n
zu<s-vF)Zn`3Q-#+l}lilPnorn*O5L!g%p(}gH}^j-6Qr^nWxb<&3pLFIGU`sd{Azd
zJtKGC(ont5d2QU6#s;}MZ({$!r6s6+l3KHrN0#1sr^Aa$YqY?6z+lhG8tIVRPcJAa
zNqB`NUg%%Rj)W-+HHeJ*DwK`^DpQthz!tw@gwAkhvWypZm&+3Htqy#L;>vr!4Y~EK
zDoTJ+I7Eh4Hwoerwde#bme_L$-uO9Chk1KJyP-;*iV#5+@G`8tS5sQhnqNWu!VfKb
zK+kC*A~y!wimBe?S4W?DRP!5q?mnqEvSie*S~NLjPW{PpX6yBt16J97U{?m-y<D<%
zh=_gyl<FH$X-)u`qx3Cg^pEaQ=?OU>fYCN^6FCO-#g68nPgEk7%?o!~pro~`G%Oao
zB|T)_+GxXT5X(?js8w=I2|d88`^WLcpJQKOnJ-Ebs&yBKdg0;x6ME12l-s2ge}*`x
zuCMP-#>hx*Mlo#ZRL?nFFTW7={!Qm%KlcamgzoCp%BWW^H8nTC>a!U+Xr67?D5$D6
z{NpINgG1(61t0cE@Ni)|OI44p*(=8n#k9j3&Ouq_5LdB-({7#8_;D|ZhzdH4z8wgl
zm&j8J%#-=f!3giT>gAIXde#GeLW$?*8{xh|re<IC$`fcijrNWvGLMbI0VLfbOEVns
zDf1)LV@vnvxh4@qK3NIOV$l1SRKc;BoUTA~7yC!u%Bv4;TWABu|9)AVhqG6fQGdUp
z)pTpurPPqDGmX9Fmi=x&=xQHUo(;JDtp3_s!?;_2of!DT=u}{@oxVxpxy^?AJM(Zl
z;GL}8kKrI8UG2b{1P{5>2`XP;qLq_&Qz@&RC~=x2z+>-V)f{Zxq;*$~vG{IK;v3QR
zWP;@Emn~zmm}}a|Qoo2HQUUC(&<@a)_HNagJ>ES;VDarRMh0~lJjNdq<N`%&=-V!N
zBv2la;*$l{3?4}Mn74AS5I0~ZbjN0Yy{1_X$yCrsgV;ba=#Sr0{B%*=N=^Y5Y#z5H
zoagW~BKE-|D>X7C(5`ztT)mi*9|`MjWG8_%k+N(6YVJCn0CxvN7N$ouUuuKJ3|zb`
zf^Q|K`rqAIfRxEgu3w^T93Qn)Z5&IRrjhXx%r$(XqK)Tq$eLVb>+WgjoKLZwJLW->
zoOpEMyL@8!-!h1@N_5Ba#ACoh{Sb9Qd=(3+q&@MT=nKSJ?%NFU6?GH}RyNwAK1?Mi
zEpJ^POuZ^5bI00<ED#H9$YE&@?R-#I`>Suj?Nc{BYjY17AMdMKmHwiM{Bk*q0@CP-
zZU<YXDNH{aF@w%QvmcDF-m2bw4WO{MboR<kIPWyAWx1As_Q+*4(hX+JZU>B05pRv?
zUFSPS-;L-TwHPRRSr%H}(&cGdSUC92s-JZ`1j{=Lfxz1mDZSxXM$j(JUdD6DCV+Kr
z%Q@{C!7`saB|{Sw{YDGAnJb*Jl)?sTQpqn<*seZ!&%ViSwqzt6(|gicJw?IcKb$h8
z#uoo9c8ILV<SiEE>mdi1r_sfdY3QN!09<X}#wTm67$U|dG(+<rDs!ziMn+5$;Nwl?
zB3+av_3apmIoW9|Sxpc2K>7>bA6n+Vr3CFmQVLc+U-Xs?d_4~SpTThkWt8gM0bS7{
z=U1Q&%XlY9CWC!}Xjr87K=*4%z$)56ld!Q}-Q=(g1BH27%>YKwx**0W@%H(2Z&@Yi
zGeT)M>aKDYn(Ft{a54V946}it@JHkRc4fsbCF6@#5xIGHE)7Li<gd`Yl@if|W!P$k
zJZdGlq?>MED$+V5VoKkf2T9|H=&?!fF*+S8)10=Jiq2=y@~8Z{iHwg>QFF|~Vtjpm
z?v#-9skk~V{cU#c_v6Fh^(}yBI15&>xR3Od?{pBZ`didpV;1iwW>`w-#&Yvipj+0r
z5s^xe*s#Wh_2-xp>R}HnsY)Kog0r%8{<;plPY&DN$`1;AIB@jnPz&Y2W1#))OguEK
z{u(X18;@H82PaAfW5>fjn&$`crXXa+k>{k^yjbJtMr&|A3bZy|;ppzZb2jwKnd#kU
zz$3wi%}yXW4o_LQ)@SZ`QeS(G|Jw@e=kJKfMR4x9_`3b+j6&U1-(6u<ZaHJ#11&`;
zb121KX%{YY+wrjBraNj~I`KGgu-+t&)iZA}Wt3}Ab$?cN@h0$Fd;xp;7Q)9f2AG)>
zwHv^lG)<+E+NWu$Kr+>v4pf;OhT(u?y8|;(>nyVoTb?JGYe^~wEX`XSM$@P={Kg1E
z1^XUqrHta9>a4chCx4AS#eMot=S0T&^V?t*O%6x;BU8#YblJ?&gt+PQ!<6p}sw$N}
zA<4Ingx%W{|6%U>?Pq?BUfbR3w|;ZQ?Z8BGE`B%;GuR7*bXWLp)0mK3+X4PfsG<Wj
z_NKd_COeMCDY%=%M|H)Q++X-8{2I_^Qc(p;X(8=n2}zdxF0HL`8_s6(!es7FPT43a
z<3R<hI6|VbNI0&$2*uvNRWR7uMki+T*>^hMaEzJFt>njJ%30YRW{1CEx(2b39a@0B
zvUq3D_ojU8>l$FsYo+EeJtArgo!RXFvk$}mb_-!=p{mR^;WLRhg5@X-*uXV?J;5+)
z{Bc~pn6EeY3@GsC%;t@P@i$=E8c3$%u?v@0Xhn4Izke$*Dv%5I*9B4TvxfB1VYRQy
zx23dk^?=rmq$~dO2`}$iQ;;F@6ji@z-gCsBW8BR1&q+CdCS??l^Hdyt%&*R7t`;8n
zmB-V;e)_ixkDSXLWMKy0n)M+2^#N|_;X9ouiU}1)4V-Bq2xzTKl2WcY(U{V}fRnv8
zalkv_Rt4pRD=3Djy-+t$l_0pr|I)t6<6_`8oP|pt|70jWjlU0^G$y=o7cDpFF8Yv>
zi!s`D6pZ6Y5&{lg_EtS6^&{TWmg>HRqVg()<PhdJlq53ZM?`n!D8E$QY{hIr!_Hh?
zlM@6+C>b^66|lOS8K(F`MXPNnu4HTXN-coZUE7MLKkX{)VLrZe=!}1$$NRB^-KY0^
zeyBHB1sO;0Q)aVKx$^w^txJ!rtc$Md7pJ$2)!!}M&zyXHyfD-~AhZGfB=ii=c<tR?
z{xdWEeP?L)#(R#Mo`m?lAAIl>dMsubWoS%Yf@)+2TPW@bw}Uw3s9?3@4JPtFPVdIW
zeSyrj3ep<QRmJS!^5)Z*OZ|jpL*aFOHH}3ZvzF%X#oTzFEza5V%NJ7Oflj@7D1%mY
zLQp*^_+}P0Z%op7qXz0alwBVGiD!DONXRup9ouf8x*b7I$ovFyhXsaN?uVc7Kw@sz
z7|j;?-PFX6V%-6i__n*hhf=@Goa`Jmpt>jGCuZ9ONHoB?mBP`F#PcI~_1%8$<p<#e
z4|PEiYAvMbFvH3nDJqZo2ZrvE1z`)=e)Oa)N`G*Y@Z&GFK)!$tu(W&5+poGS|I@GY
z8a5pv39cH1uX<W=+H=5M9fAId;DIKQ1>mCtB+G+A@f3uY#+8XU+Bn#o3@0ok#;<^d
z8jD~=C~UL^Z6P_%bfIa%AsOkP!`UC>e$i+1ri5zD`#m8fY=!1`)dJ|*z@JZoKKuq+
zg$EQeJRwf*%Z_3Y=~bU2V^^H^BSdv#*Su)`6rmy`rg$Jcmr<rz&Ms>a+O<s2OPTI8
zIgGc}dxkqKZfF1K`hGq!9d_hHwMH<P0>u~{%s)OPhl+-T^3fV3u02VytduyOBPOn8
z>_p!jR@q&VgV{0h==Cl8W@S;=_!lk*myR#w;p-jlnST7RtAI|!9h$4pIJ#7GE|KiT
zjDnHZ0nV~-tAW~VsSMi$a=V4Lf^>=@!-63a7?U>8_c!O_q3XJhZLSx<JW%u=wQ+S%
zlohQqRe;lOlm(LAx~*z{n-4r2_kv;ZsQA<fZlB1j*Q4f|l=#=9|K;RCjBMV;lu7{v
zFKH&D<{i@l#9hIIOe+I0DoKF5#7)6IMT+Z@P=zo1^M$-kxQIISjelwf?Lk@rb?@Up
zChjH#iT%@bJAMgUj89LOn(9JCAB6*-fKRt)M!@|uZ{rN!1o86U<;3s70vg*xXUS+a
z_Xxf%%=AXRF1}eYYAnwI8LEibv9x(gItb{j^%@L1MgJ@T?@^6BrL%o*p6Wf9H|tr|
zow?w}(^=H~)12a&&AS)`tcCK}8c14{YP%;$p**TtG&n3>XciGrdkVTk^{iEF2OzUI
z1Z^SqUT;kRE?UMDR+^yx?{u8S6+lAHSmQ?%Dc2PR`4>Mbp7787V;~@r5e*TTi1@>?
z@RW}<_%Jf8S(K=l0ce}z1w~<>q>a4)A{?ogbFSEs4Z?zOJvFcLJigH^3m6$#j=ZcS
zJ$avSlE<>7iG6DLH@|W?_gUY}GN>6ciykz<^bLv`FUh(#QADh}ZcOM&K$$Y%D|}ly
zSC`I_dUh;D`yn$tStZ^t%pv(sf29<^T<b9MGd)XeM~Ysu<bhs8?iTE5n;!z%?BhCQ
zL#Ff<2UMh{w?I4fl(LE(${jS9N2QXi(VXK;1((R*V>?xwnK(EIgO)}@C*K@McR5$u
z(=MC0;c=*WV6W4W@=2oM?x?w5$f3S&tS`E1f`6GDN>GH?#)4im5Ga8lg{_vznfl8r
zj9ZtA=V5m1FjG}HFiGGgYEQyrd#%sORc86wU+-s59qFeL--Di)l~h@SbMWeaGXl~X
zgc;8Ml3StozixdBQrSvoa|;FWV-AF>JIRlHp^FcJFT5RXi-KF|B>BiGPHy7K$~%Bq
zae_;nm$E|eDd+Ohq5?WGu$S+4F?)Sbp?{c2hAPioIV<*3y{Z8vpaT%~q<>0KGo!M*
z6NJ1%jei7*An3jH%w%fz11hmfqTEX>3$u^;t_v7c5i!ta9V#EUC#2l6;e=c!u^&th
zea`#v_nqAPpz3UIwL;5fHa`c}DsfO3TVo;T4&sk2-QZuS(0<;<SQ$<>na6)bADwN&
z_8``*ib`y^2)S-)_F2~@$nOOEWNlzfX;@eMzTWe+XScbyQxhv}GqxSF@ao%1_%W8Q
z_gZ$C_%#Eb;?40}Vazuqc`Q(_RJ|wht3$}mqU!=2wiT_#<A;O^<pP#=znqG5Kj{#d
z)%N0N`<S%wwU3?8FYI~yJkKwo4VXVgu<iJih`6L2J-bvzunY0o3!=RmpPcV+WL^(O
zw`>pj;m(8Ln9n&`gU2Iuuu$?jGP+wl{iQ;HTJxp@HMICcpn)DAsj-1;sb4L+)@Y+@
zza#aCI@W7TeG#Tj2y}17HX%&*U1XMho_|PIpyIkleqrf-tlL&2L0#un1><!E4tx6!
zlZz?;hUDP?ik3^XMxknR6;Zp{6<M!Vcg8y_?zpS{P*3FUlr-;&YGb^9g@53rJwcMl
z*h4={*)oplH>M1C>;rqw-bV9@%F9tq*)aYiQE1`RdOy0?q<8V~qz<u%s67hM#ox1A
z5zKBcEzfS-I`!TH5u=$3I-5y=YZz-cuoSb(O$cEjppUVUexGC-2E?s-rO~WVoU1im
zfkw$Fx}((2u)0*XPtROK&^w*OPXyf`_ea`{oC&WQ-s0`v6ZN_Jgbw4Y&i`S(>CJEY
z2R(=Ua>g1p_hgf)m3T~SYAbFegmJgbajyEaprQ$tGL6tFVJ)nc>xZH|)3W@j+?Yfg
z=6bY6d_uepy<PH0n6FRXriO02upxeIZDG;#p$JMM({D(u-TVZ8+36me1YfU*OXW5A
zb(HYM$ocsk)*N?mR-IehM;oqpKNVWrHTNtdPCAoO&|Df3eJtB2n(EM=RpfHP$+L9Q
z$Bt^-3mWR?S`+9gR;Dhc2!aDc)qnOdBcf7Gcc2GPtHu<Tf_5TnbZY~8S;5>A9^)T9
zLQmI^-&;DY-QB5;t_W}3adk_?=zOli)zma|)ZiW`h}y=h`Beu?cLF?I&j!xgB;Ho$
z`Qg-}p3<=rEHUR2wrNgu^Kmj}B82AKa%&^X@Zs0~;|_KO3QlsPA(EV3Q2MkiDvBoe
pTpt#D)CvokDT-WERjT*)zm^x+--)rkAd35cwW|LAzQVs7{BPhgC2Ifx

literal 0
HcmV?d00001

diff --git a/docs/readme/README.fr.md b/docs/readme/README.fr.md
index 97c78d4e713..e601abc2344 100644
--- a/docs/readme/README.fr.md
+++ b/docs/readme/README.fr.md
@@ -243,9 +243,9 @@ Associez-la à l'app de bureau pour surveiller et piloter vos agents depuis votr
 
 - **Discord :** Rejoignez la communauté sur **[Discord](https://discord.gg/fzjDKHxv8Q)**.
 - **Twitter / X :** Suivez **[@orca_build](https://x.com/orca_build)** pour les news et annonces.
-- **WeChat :** Scannez pour rejoindre le groupe WeChat 8 de la communauté Orca.
+- **WeChat :** Scannez pour rejoindre le groupe WeChat 8 de la communauté Orca. Le groupe 8 est peut-être complet ; dans ce cas, scannez plutôt le QR code du groupe 9.
 
-  <img src="../assets/wechat-qr-group8.jpg" alt="QR code WeChat groupe 8 de la communauté Orca" width="160" />
+  <img src="../assets/wechat-qr-group8.jpg" alt="QR code WeChat groupe 8 de la communauté Orca" width="160" />&nbsp;&nbsp;<img src="../assets/wechat-qr-group9.jpg" alt="QR code WeChat groupe 9 de la communauté Orca" width="160" />
 
 - **Feedback &amp; idées :** On ship vite. Il manque quelque chose ? [Demandez une feature](https://github.com/stablyai/orca/issues).
 - **Confidentialité :** Voir la [doc confidentialité &amp; télémétrie](https://www.onorca.dev/docs/telemetry) pour ce qu'Orca collecte en anonyme et comment désactiver la télémétrie.
diff --git a/docs/readme/README.ko.md b/docs/readme/README.ko.md
index 4a75722ff8c..837ecf2133f 100644
--- a/docs/readme/README.ko.md
+++ b/docs/readme/README.ko.md
@@ -238,9 +238,9 @@ yay -S stably-orca-bin
 
 - **Discord:** **[Discord](https://discord.gg/fzjDKHxv8Q)** 커뮤니티에 참여하세요.
 - **Twitter / X:** 업데이트와 공지는 **[@orca_build](https://x.com/orca_build)** 를 팔로우하세요.
-- **WeChat:** QR 코드를 스캔해 Orca 커뮤니티 WeChat 그룹 8에 참여하세요.
+- **WeChat:** QR 코드를 스캔해 Orca 커뮤니티 WeChat 그룹 8에 참여하세요. 그룹 8이 가득 찼을 수 있으니, 그런 경우 그룹 9 QR 코드를 스캔하세요.
 
-  <img src="../assets/wechat-qr-group8.jpg" alt="Orca 커뮤니티 WeChat 그룹 8 QR 코드" width="160" />
+  <img src="../assets/wechat-qr-group8.jpg" alt="Orca 커뮤니티 WeChat 그룹 8 QR 코드" width="160" />&nbsp;&nbsp;<img src="../assets/wechat-qr-group9.jpg" alt="Orca 커뮤니티 WeChat 그룹 9 QR 코드" width="160" />
 
 - **피드백과 아이디어:** 우리는 빠르게 출시합니다. 필요한 기능이 있나요? [새 기능을 요청](https://github.com/stablyai/orca/issues)하세요.
 - **개인정보 보호:** Orca가 수집하는 익명 사용 데이터와 수집 거부 방법은 [개인정보 및 텔레메트리 문서](https://www.onorca.dev/docs/telemetry)를 참고하세요.
diff --git a/docs/readme/README.zh-CN.md b/docs/readme/README.zh-CN.md
index d7bae3fba9e..10f47e20fe6 100644
--- a/docs/readme/README.zh-CN.md
+++ b/docs/readme/README.zh-CN.md
@@ -235,9 +235,9 @@ yay -S stably-orca-bin
 
 - **Discord:** 加入 **[Discord](https://discord.gg/fzjDKHxv8Q)** 社区。
 - **Twitter / X:** 关注 **[@orca_build](https://x.com/orca_build)** 获取更新和公告。
-- **微信:** 扫码加入 Orca 社区微信第 8 群。
+- **微信:** 扫码加入 Orca 社区微信第 8 群。第 8 群可能已满，如遇这种情况请扫描第 9 群二维码。
 
-  <img src="../assets/wechat-qr-group8.jpg" alt="Orca 社区微信第 8 群二维码" width="160" />
+  <img src="../assets/wechat-qr-group8.jpg" alt="Orca 社区微信第 8 群二维码" width="160" />&nbsp;&nbsp;<img src="../assets/wechat-qr-group9.jpg" alt="Orca 社区微信第 9 群二维码" width="160" />
 
 - **反馈与想法:** 我们发布很快。缺少什么功能？[提交功能请求](https://github.com/stablyai/orca/issues)。
 - **隐私:** 查看[隐私与遥测文档](https://www.onorca.dev/docs/telemetry)，了解 Orca 收集哪些匿名使用数据以及如何退出。

From 766b5b153c9f009d1445ad0d0aed4ac3f179973d Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 01:56:42 -0700
Subject: [PATCH 15/58] fix(relay): release the ConPTY conin handle after
 teardown, not before it (#18601)

A Windows SSH relay leaked one Windows File handle per terminal, for the life of
the relay process, across reconnects. node-pty's `kill()` flips `readable` on the
conin and conout sockets and destroys neither; `_cleanUpProcess` destroys
`_outSocket`, so only conin is stranded, and it wraps a real named-pipe handle
from `fs.openSync(term.conin, 'w')`.

The obvious fix -- and the one config/patches/node-pty@1.1.0.patch ships for the
desktop -- releases it at the top of the branch, before `_getConsoleProcessList()`
forks and before the native kill. Measured against a real Windows SSH host, that
is three times worse than leaving the leak alone: teardown aborts partway, the
forked console-list agent is never reaped, and both pipe handles stay alive.
Releasing it at the end of the branch instead is flat.

20 spawn/kill cycles, handles bucketed by NT object type, identical numbers
standalone and through a real relay:

  published node-pty        File +1/terminal,  Process flat
  desktop patch placement   File +2/terminal,  Process +1/terminal
  released last (this)      File flat,         Process flat

`windowsTerminal.js` takes the desktop's error-listener hunks verbatim. The conin
listener is not what fixes the leak -- adding it alone changed nothing -- but it
is what keeps a pipe error retiring one terminal instead of the host.

The desktop patch has the early placement and therefore the regression, measured
against its exact installed tree. Correcting it there needs its own verification
on a Windows desktop build, so the trees diverge on this one hunk deliberately and
a test pins that so a future patch sync cannot copy the bug back.
---
 ...e-pty-1.1.0-windows-pty-teardown-patch.cjs | 158 ++++++++++++++
 config/scripts/build-relay.mjs                |  11 +
 ...de-pty-windows-pty-teardown-patch.test.mjs | 195 ++++++++++++++++++
 src/main/ssh/ssh-relay-deploy.ts              |  25 ++-
 src/shared/relay-artifacts.ts                 |   4 +
 5 files changed, 386 insertions(+), 7 deletions(-)
 create mode 100644 config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs
 create mode 100644 config/scripts/node-pty-windows-pty-teardown-patch.test.mjs

diff --git a/config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs b/config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs
new file mode 100644
index 00000000000..dd26784ee46
--- /dev/null
+++ b/config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs
@@ -0,0 +1,158 @@
+const { createHash } = require('node:crypto')
+const { readFileSync, renameSync, rmSync, writeFileSync } = require('node:fs')
+const { join, resolve } = require('node:path')
+
+/**
+ * Release the ConPTY teardown handles a relay's npm-installed node-pty never releases.
+ *
+ * Two files, and the ORDER of one of the edits is the whole fix.
+ *
+ * `windowsPtyAgent.js` -- `kill()` flips `readable` on both sockets and destroys neither.
+ * `_cleanUpProcess` destroys `_outSocket`, so the conout handle comes back; nothing ever destroys
+ * `_inSocket`, and it wraps a real Windows named-pipe handle from `fs.openSync(term.conin, 'w')`.
+ * Every terminal leaks one File handle for the life of the host process.
+ *
+ * The obvious fix -- and the one the desktop patch ships -- releases it at the TOP of the branch,
+ * before `_getConsoleProcessList()` forks and before the native kill. That is measurably worse than
+ * leaving the leak alone: teardown aborts partway, the forked console-list agent is never reaped,
+ * and both pipe handles stay alive instead of one. This asset releases it at the END of the branch
+ * instead, after the fork and the kill have already happened.
+ *
+ * Measured on a Windows SSH host, 20 spawn/kill cycles, handles bucketed by NT object type
+ * (identical numbers standalone and through a real relay):
+ *
+ *   published node-pty        File +1/terminal,  Process flat
+ *   desktop patch placement   File +2/terminal,  Process +1/terminal   <-- 3x WORSE
+ *   released last (here)      File flat,         Process flat
+ *
+ * `windowsTerminal.js` carries the desktop's error-listener hunks verbatim. The conin listener is
+ * what keeps a pipe error retiring one terminal instead of the host -- its own comment names the
+ * failure mode: "Without a listener, Node promotes errors such as write EAGAIN to uncaughtException".
+ * It is not what fixes the leak (adding it changed nothing on its own), but it is the guard that
+ * makes destroying conin safe at all.
+ *
+ * Why this ships as a relay asset rather than only in config/patches/node-pty@1.1.0.patch: pnpm
+ * patches do not cross the SSH boundary -- a relay host runs the tree `npm install` put there.
+ *
+ * DELIBERATE DIVERGENCE FROM THE DESKTOP: the desktop patch has the early placement and therefore
+ * the +2 File / +1 Process regression, measured against its exact installed tree. Correcting it
+ * there is a separate change with its own verification, so the two trees differ on this one hunk on
+ * purpose, and the test pins that so a future "sync the patches" does not copy the bug back.
+ *
+ * NOT ADDRESSED, AND A SEPARATE DEFECT THAT IS STILL OPEN: a terminal that exits on its own is
+ * still torn down through `kill()` -- both hosts call `destroy()` on natural exit and
+ * `WindowsTerminal.destroy()` is `kill()` -- but the shell is already gone by then, and the
+ * ordering this patch relies on does not hold. Measured over 20 self-exit cycles with that
+ * `destroy()` issued: published +3 File/+1 Process per terminal, desktop-patched +2/+1, this tree
+ * +2/+1. So this patch does not close it and the desktop patch does not either. It is reachable
+ * for every Windows user, local and relay, on every terminal closed by typing `exit`.
+ */
+
+const EXPECTED_NODE_PTY_VERSION = '1.1.0'
+
+/** Each entry is one published file, its patched form, and the edits between them. */
+const PATCH_TARGETS = [
+  {
+    relativePath: ['lib', 'windowsPtyAgent.js'],
+    originalSha256: '8636d16b38266112204061a22b135734177c242837982fd3a4055be726efa64a',
+    patchedSha256: '1e23ef480569e73706e3ab4f5482c7e553c76f51414ae8e7b0bdcc2fd75f7280',
+    replacements: [
+      [
+        '                this._ptyNative.kill(this._pty, this._useConptyDll);\n                this._conoutSocketWorker.dispose();\n',
+        '                this._ptyNative.kill(this._pty, this._useConptyDll);\n                this._conoutSocketWorker.dispose();\n                // Orca: released AFTER the console-list fork and the native kill, not before them.\n                // Destroying conin first aborts teardown partway -- measured on a Windows SSH relay\n                // as +2 File and +1 Process handles per terminal, against +1 File unpatched.\n                this._inSocket.destroy();\n'
+      ]
+    ]
+  },
+  {
+    relativePath: ['lib', 'windowsTerminal.js'],
+    originalSha256: 'c3a65716f53fed0135a8a633373d5f9c2ab092544d651f27ef0a67096dd3bcd9',
+    patchedSha256: '8247ecd69be8b18257050fb026b290024612c5ffc6d492ff1d46f81e613be2cf',
+    replacements: [
+      [
+        '        _this._agent = new windowsPtyAgent_1.WindowsPtyAgent(file, args, parsedEnv, cwd, _this._cols, _this._rows, false, opt.useConpty, opt.useConptyDll, opt.conptyInheritCursor);\n        _this._socket = _this._agent.outSocket;\n        // Not available until `ready` event emitted.\n        _this._pid = _this._agent.innerPid;',
+        "        _this._agent = new windowsPtyAgent_1.WindowsPtyAgent(file, args, parsedEnv, cwd, _this._cols, _this._rows, false, opt.useConpty, opt.useConptyDll, opt.conptyInheritCursor);\n        _this._socket = _this._agent.outSocket;\n        // Attach before readiness so a broken ConPTY output pipe cannot be unhandled.\n        _this._socket.on('error', function (err) {\n            var code = err && err.code;\n            // PTY output can report EPIPE before `_close()` wins the race.\n            _this._close();\n            if (code === 'EPIPE' || code === 'ERR_STREAM_PUSH_AFTER_EOF' || code === 'ERR_STREAM_DESTROYED') {\n                return;\n            }\n            // EIO, happens when someone closes our child process: the only process\n            // in the terminal.\n            // node < 0.6.14: errno 5\n            // node >= 0.6.14: read EIO\n            if (typeof code === 'string') {\n                if (~code.indexOf('errno 5') || ~code.indexOf('EIO'))\n                    return;\n            }\n            // Throw anything else.\n            if (_this.listeners('error').length < 2) {\n                throw err;\n            }\n        });\n        // Not available until `ready` event emitted.\n        _this._pid = _this._agent.innerPid;"
+      ],
+      [
+        "                }\n            });\n            // Shutdown if `error` event is emitted.\n            _this._socket.on('error', function (err) {\n                // Close terminal session.\n                _this._close();\n                // EIO, happens when someone closes our child process: the only process\n                // in the terminal.\n                // node < 0.6.14: errno 5\n                // node >= 0.6.14: read EIO\n                if (err.code) {\n                    if (~err.code.indexOf('errno 5') || ~err.code.indexOf('EIO'))\n                        return;\n                }\n                // Throw anything else.\n                if (_this.listeners('error').length < 2) {\n                    throw err;\n                }\n            });\n            // Cleanup after the socket is closed.\n            _this._socket.on('close', function () {",
+        "                }\n            });\n            // Cleanup after the socket is closed.\n            _this._socket.on('close', function () {"
+      ],
+      [
+        '        _this._readable = true;\n        _this._writable = true;\n        _this._forwardEvents();\n        return _this;',
+        "        _this._readable = true;\n        _this._writable = true;\n        // A ConPTY input-pipe error must retire only this terminal. Without a listener, Node promotes\n        // errors such as write EAGAIN to uncaughtException and kills every PTY in the daemon.\n        _this._agent.inSocket.on('error', function () {\n            if (!_this._writable) {\n                return;\n            }\n            _this._close();\n            try {\n                _this._agent.kill();\n            }\n            catch (_a) {\n                // The failing pipe may have raced process exit; the terminal is already unwritable.\n            }\n        });\n        _this._forwardEvents();\n        return _this;"
+      ],
+      [
+        'exports.WindowsTerminal = WindowsTerminal;\n//# sourceMappingURL=windowsTerminal.js.map',
+        'exports.WindowsTerminal = WindowsTerminal;\n//# sourceMappingURL=windowsTerminal.js.map\n'
+      ]
+    ]
+  }
+]
+
+function inspectTarget(relayDir, target) {
+  const nodePtyDir = resolve(relayDir, 'node_modules', 'node-pty')
+  const packageJson = JSON.parse(readFileSync(join(nodePtyDir, 'package.json'), 'utf8'))
+  if (packageJson.version !== EXPECTED_NODE_PTY_VERSION) {
+    throw new Error(
+      `Refusing to patch node-pty ${packageJson.version}; expected ${EXPECTED_NODE_PTY_VERSION}`
+    )
+  }
+  const filePath = join(nodePtyDir, ...target.relativePath)
+  return { filePath, source: readFileSync(filePath, 'utf8') }
+}
+
+function assertPatchedNodePtyWindowsTeardown(relayDir = process.cwd()) {
+  for (const target of PATCH_TARGETS) {
+    const inspected = inspectTarget(relayDir, target)
+    if (sourceSha256(inspected.source) !== target.patchedSha256) {
+      throw new Error(
+        `node-pty ConPTY teardown release is not installed in ${target.relativePath.join('/')}`
+      )
+    }
+  }
+}
+
+function patchNodePtyWindowsTeardown(relayDir = process.cwd()) {
+  for (const target of PATCH_TARGETS) {
+    const inspected = inspectTarget(relayDir, target)
+    const sourceHash = sourceSha256(inspected.source)
+    if (sourceHash === target.patchedSha256) {
+      continue
+    }
+    if (sourceHash !== target.originalSha256) {
+      throw new Error(
+        `Refusing to patch unexpected node-pty source in ${target.relativePath.join('/')}`
+      )
+    }
+    let patchedSource = inspected.source
+    for (const [from, to] of target.replacements) {
+      // Why the count check: an anchor that matched twice would patch the wrong site silently, and
+      // the hash below would then reject a tree this script had already rewritten.
+      if (patchedSource.split(from).length - 1 !== 1) {
+        throw new Error(`Refusing to patch ${target.relativePath.join('/')}; anchor is not unique`)
+      }
+      patchedSource = patchedSource.replace(from, to)
+    }
+    const temporaryPath = `${inspected.filePath}.orca-patch-${process.pid}`
+    // Why: a terminated remote install must leave either known source version recoverable on reconnect.
+    try {
+      writeFileSync(temporaryPath, patchedSource)
+      renameSync(temporaryPath, inspected.filePath)
+    } finally {
+      rmSync(temporaryPath, { force: true })
+    }
+  }
+  assertPatchedNodePtyWindowsTeardown(relayDir)
+}
+
+function sourceSha256(source) {
+  return createHash('sha256').update(source).digest('hex')
+}
+
+if (require.main === module) {
+  patchNodePtyWindowsTeardown()
+}
+
+module.exports = {
+  assertPatchedNodePtyWindowsTeardown,
+  patchNodePtyWindowsTeardown
+}
diff --git a/config/scripts/build-relay.mjs b/config/scripts/build-relay.mjs
index 289c7a957bd..4d408712f97 100644
--- a/config/scripts/build-relay.mjs
+++ b/config/scripts/build-relay.mjs
@@ -57,6 +57,13 @@ const NODE_PTY_CONSOLE_LIST_PATCH_SOURCE = join(
   'relay-assets',
   NODE_PTY_CONSOLE_LIST_PATCH_FILENAME
 )
+const NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME = 'node-pty-1.1.0-windows-pty-teardown-patch.cjs'
+const NODE_PTY_WINDOWS_TEARDOWN_PATCH_SOURCE = join(
+  ROOT,
+  'config',
+  'relay-assets',
+  NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME
+)
 const NODE_PTY_MASTER_CLOEXEC_PATCH_FILENAME = 'node-pty-1.1.0-master-cloexec-patch.cjs'
 const NODE_PTY_MASTER_CLOEXEC_PATCH_SOURCE = join(
   ROOT,
@@ -132,6 +139,10 @@ for (const platform of RELAY_BUILD_PLATFORMS) {
       NODE_PTY_CONSOLE_LIST_PATCH_SOURCE,
       join(outDir, NODE_PTY_CONSOLE_LIST_PATCH_FILENAME)
     )
+    copyFileSync(
+      NODE_PTY_WINDOWS_TEARDOWN_PATCH_SOURCE,
+      join(outDir, NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME)
+    )
   }
   copyFileSync(
     NODE_PTY_MASTER_CLOEXEC_PATCH_SOURCE,
diff --git a/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs b/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs
new file mode 100644
index 00000000000..380cdd44c01
--- /dev/null
+++ b/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs
@@ -0,0 +1,195 @@
+// The relay's copy of the ConPTY teardown release, and the guard that keeps it in lockstep with the
+// desktop's own node-pty patch. pnpm patches do not cross the SSH boundary, so a relay runs the tree
+// `npm install` put there; the desktop had this fix and the relay did not, and every terminal on a
+// Windows SSH host leaked one File handle for the life of the relay process.
+//
+// The ORDER of the conin release is the fix. Releasing it at the top of the branch -- what the
+// desktop patch does -- was measured at 3x WORSE than shipping nothing (File +2/terminal and a new
+// Process +1/terminal); releasing it after the console-list fork and the native kill is flat.
+import { createRequire } from 'node:module'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+
+const require = createRequire(import.meta.url)
+const {
+  assertPatchedNodePtyWindowsTeardown,
+  patchNodePtyWindowsTeardown
+} = require('../relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs')
+const projectDir = resolve(import.meta.dirname, '..', '..')
+const cleanupDirs = []
+
+const PATCHED_FILES = ['windowsPtyAgent.js', 'windowsTerminal.js']
+
+/** The hunks config/patches/node-pty@1.1.0.patch adds to the installed desktop tree. */
+const DESKTOP_HUNKS = {
+  'windowsPtyAgent.js': [
+    [
+      [
+        '                this._inSocket.readable = false;',
+        '                // The non-DLL path previously only flipped `readable`, leaving the',
+        '                // conin PipeWrap alive until the host exited (#947).',
+        '                this._inSocket.destroy();',
+        '                this._outSocket.readable = false;',
+        ''
+      ].join('\n'),
+      [
+        '                this._inSocket.readable = false;',
+        '                this._outSocket.readable = false;',
+        ''
+      ].join('\n')
+    ]
+  ],
+  'windowsTerminal.js': [
+    [
+      '        // Attach before readiness so a broken ConPTY output pipe cannot be unhandled.',
+      null
+    ],
+    ['        // A ConPTY input-pipe error must retire only this terminal.', null]
+  ]
+}
+
+function desktopPath(file) {
+  return join(projectDir, 'node_modules', 'node-pty', 'lib', file)
+}
+
+afterEach(() => {
+  for (const dir of cleanupDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+describe('Windows SSH relay node-pty ConPTY teardown patch', () => {
+  // Why reconstruct rather than vendor upstream: the installed tree IS the published file plus the
+  // desktop's hunks, so un-applying them yields upstream exactly -- and pinning that against this
+  // asset's own hashes is what fails loudly if either side of the pair moves.
+  it('takes the desktop error listeners verbatim', () => {
+    const fixture = writeNodePtyFixture('1.1.0')
+    patchNodePtyWindowsTeardown(fixture.root)
+
+    expect(readFileSync(join(fixture.libDir, 'windowsTerminal.js'), 'utf8')).toBe(
+      readFileSync(desktopPath('windowsTerminal.js'), 'utf8')
+    )
+  })
+
+  // The one hunk that must NOT match the desktop, and the reason is measured, not stylistic:
+  // releasing conin before `_getConsoleProcessList()` forks aborts teardown partway.
+  it('releases conin after the console-list fork, not before it like the desktop patch', () => {
+    const fixture = writeNodePtyFixture('1.1.0')
+    patchNodePtyWindowsTeardown(fixture.root)
+    const patched = readFileSync(join(fixture.libDir, 'windowsPtyAgent.js'), 'utf8')
+
+    const branch = patched.slice(
+      patched.indexOf('if (!this._useConptyDll) {'),
+      patched.indexOf('else {', patched.indexOf('if (!this._useConptyDll) {'))
+    )
+    expect(branch).toContain('this._inSocket.destroy();')
+    expect(branch.indexOf('this._inSocket.destroy();')).toBeGreaterThan(
+      branch.indexOf('this._conoutSocketWorker.dispose();')
+    )
+    expect(branch.indexOf('this._inSocket.destroy();')).toBeGreaterThan(
+      branch.indexOf('this._getConsoleProcessList()')
+    )
+    // Pinned so a future "sync the relay asset to config/patches" cannot copy the regression back.
+    expect(patched).not.toBe(readFileSync(desktopPath('windowsPtyAgent.js'), 'utf8'))
+  })
+
+  it('installs and verifies idempotently', () => {
+    const fixture = writeNodePtyFixture('1.1.0')
+
+    patchNodePtyWindowsTeardown(fixture.root)
+    const once = PATCHED_FILES.map((file) => readFileSync(join(fixture.libDir, file), 'utf8'))
+    for (const file of PATCHED_FILES) {
+      expect(existsSync(`${join(fixture.libDir, file)}.orca-patch-${process.pid}`)).toBe(false)
+    }
+    expect(() => assertPatchedNodePtyWindowsTeardown(fixture.root)).not.toThrow()
+
+    patchNodePtyWindowsTeardown(fixture.root)
+    expect(PATCHED_FILES.map((file) => readFileSync(join(fixture.libDir, file), 'utf8'))).toEqual(
+      once
+    )
+  })
+
+  it('refuses a different package version or unexpected source', () => {
+    const wrongVersion = writeNodePtyFixture('1.2.0-beta.11')
+    expect(() => patchNodePtyWindowsTeardown(wrongVersion.root)).toThrow('expected 1.1.0')
+
+    for (const file of PATCHED_FILES) {
+      const drifted = writeNodePtyFixture('1.1.0')
+      const path = join(drifted.libDir, file)
+      writeFileSync(path, `${readFileSync(path, 'utf8')}\n// drift`)
+      expect(() => patchNodePtyWindowsTeardown(drifted.root)).toThrow('unexpected node-pty')
+    }
+  })
+
+  it('refuses a half-applied tree, so one file cannot pass for both', () => {
+    for (const file of PATCHED_FILES) {
+      const partial = writeNodePtyFixture('1.1.0')
+      const fixture = writeNodePtyFixture('1.1.0')
+      patchNodePtyWindowsTeardown(fixture.root)
+      writeFileSync(join(partial.libDir, file), readFileSync(join(fixture.libDir, file), 'utf8'))
+      expect(() => assertPatchedNodePtyWindowsTeardown(partial.root)).toThrow('is not installed')
+    }
+  })
+})
+
+/** A published node-pty tree, rebuilt by un-applying the desktop hunks from the installed one. */
+function writeNodePtyFixture(version) {
+  const root = mkdtempSync(join(projectDir, '.node-pty-teardown-patch-test-'))
+  cleanupDirs.push(root)
+  const libDir = join(root, 'node_modules', 'node-pty', 'lib')
+  mkdirSync(libDir, { recursive: true })
+  writeFileSync(join(root, 'node_modules', 'node-pty', 'package.json'), JSON.stringify({ version }))
+  for (const file of PATCHED_FILES) {
+    const desktop = readFileSync(desktopPath(file), 'utf8')
+    for (const [marker] of DESKTOP_HUNKS[file]) {
+      expect(desktop).toContain(marker)
+    }
+    writeFileSync(join(libDir, file), unapplyDesktopHunks(file, desktop))
+  }
+  return { root, libDir }
+}
+
+/**
+ * Reverse of the published-to-desktop transform.
+ *
+ * `windowsTerminal.js` is taken verbatim from the desktop, so the asset's own replacement table is
+ * the transform and reversing it is exact. `windowsPtyAgent.js` deliberately diverges, so its
+ * published form is rebuilt from the desktop hunk instead -- which is also what makes this file the
+ * place that notices if the desktop hunk itself ever moves.
+ */
+function unapplyDesktopHunks(file, desktop) {
+  if (file === 'windowsPtyAgent.js') {
+    let published = desktop
+    for (const [patched, original] of DESKTOP_HUNKS[file]) {
+      expect(published.split(patched).length - 1).toBe(1)
+      published = published.replace(patched, original)
+    }
+    return published
+  }
+  const asset = readFileSync(
+    join(projectDir, 'config', 'relay-assets', 'node-pty-1.1.0-windows-pty-teardown-patch.cjs'),
+    'utf8'
+  )
+  const { PATCH_TARGETS } = loadPatchTargets(asset)
+  const target = PATCH_TARGETS.find((entry) => entry.relativePath.at(-1) === file)
+  expect(target).toBeDefined()
+  let published = desktop
+  for (const [from, to] of target.replacements.toReversed()) {
+    expect(published.split(to).length - 1).toBe(1)
+    published = published.replace(to, from)
+  }
+  return published
+}
+
+function loadPatchTargets(assetSource) {
+  const module = { exports: {} }
+  const factory = new Function(
+    'module',
+    'exports',
+    'require',
+    `${assetSource}\nmodule.exports.PATCH_TARGETS = PATCH_TARGETS`
+  )
+  factory(module, module.exports, require)
+  return module.exports
+}
diff --git a/src/main/ssh/ssh-relay-deploy.ts b/src/main/ssh/ssh-relay-deploy.ts
index 257eb984caa..e7450478d92 100644
--- a/src/main/ssh/ssh-relay-deploy.ts
+++ b/src/main/ssh/ssh-relay-deploy.ts
@@ -743,6 +743,7 @@ function uploadStageNamespaceIfSupported(
 
 const NODE_PTY_VERSION = '1.1.0'
 const NODE_PTY_CONSOLE_LIST_PATCH_FILENAME = 'node-pty-1.1.0-console-list-agent-patch.cjs'
+const NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME = 'node-pty-1.1.0-windows-pty-teardown-patch.cjs'
 const NODE_PTY_MASTER_CLOEXEC_PATCH_FILENAME = 'node-pty-1.1.0-master-cloexec-patch.cjs'
 const NODE_PTY_CLOEXEC_STATUS_PREFIX = 'ORCA-NPTY-CLOEXEC:'
 /**
@@ -791,7 +792,8 @@ function nativeDepsProbeJs(successToken: string): string {
   // Why: node-pty's Windows wrapper defers conpty.node until first spawn, so require("node-pty") alone can't prove the binding is healthy.
   const loadNodePty =
     'require("node-pty"); require("node-pty/lib/utils").loadNativeModule(process.platform==="win32"&&Number(require("os").release().split(".")[2])>=18309?"conpty":"pty");' +
-    `if(process.platform==="win32"){require("./${NODE_PTY_CONSOLE_LIST_PATCH_FILENAME}").assertPatchedNodePtyConsoleListAgent(process.cwd())}`
+    `if(process.platform==="win32"){require("./${NODE_PTY_CONSOLE_LIST_PATCH_FILENAME}").assertPatchedNodePtyConsoleListAgent(process.cwd());` +
+    `require("./${NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME}").assertPatchedNodePtyWindowsTeardown(process.cwd())}`
   return `(()=>{const missing=[];try{${loadNodePty}}catch{missing.push("node-pty")}try{require("@parcel/watcher")}catch{missing.push("@parcel/watcher")}if(missing.length){console.log("${NATIVE_DEPS_MISSING_PREFIX}"+missing.join(","));process.exitCode=1}else{console.log(${JSON.stringify(successToken)})}})()`
 }
 
@@ -1327,10 +1329,16 @@ async function applyNodePtyMasterCloexecPatch(
   nodePath: string,
   signal?: AbortSignal
 ): Promise<NodePtyMasterCloexecOutcome> {
-  // Both Unix relay platforms leak, by different bugs: Linux inherits the master through forkpty()'s
-  // no-O_CLOEXEC path, macOS orphans one throwaway /dev/ptmx fd per spawn in pty_posix_spawn. Only
-  // Windows, which has no fds, is short-circuited -- and answering 'fixed' from a gate that ran
-  // nothing is exactly how a leaking darwin tree got published to the shared cache.
+  // Both Unix relay platforms leak the pty master, by different bugs: Linux inherits it through
+  // forkpty()'s no-O_CLOEXEC path, macOS orphans one throwaway /dev/ptmx fd per spawn in
+  // pty_posix_spawn. Windows is short-circuited because it has no fds for a master to leak into --
+  // and answering 'fixed' from a gate that ran nothing is exactly how a leaking darwin tree got
+  // published to the shared cache.
+  //
+  // What 'fixed' means here is exactly "this tree does not leak the pty MASTER", which is the only
+  // thing the shared native-deps cache keys on. It is NOT a statement that a Windows relay leaks
+  // nothing: it leaked one Windows File handle per terminal until the ConPTY teardown patch above,
+  // by a mechanism that has nothing to do with fds. Read this gate as scoped to its own question.
   if (isWindowsRemoteHost(hostPlatform) || isWindowsRelayPlatform(platform)) {
     return 'fixed'
   }
@@ -1530,8 +1538,11 @@ async function rebuildNativeDeps(
 }
 
 function windowsNodePtyPatchCommand(nodePath: string): string {
-  // Why: pnpm patches do not cross the SSH boundary; apply the version-checked fallback to the remote npm package.
-  return `& ${powerShellLiteral(nodePath)} ${powerShellLiteral(NODE_PTY_CONSOLE_LIST_PATCH_FILENAME)}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }`
+  // Why: pnpm patches do not cross the SSH boundary; apply the version-checked fallbacks to the remote npm package.
+  return [
+    `& ${powerShellLiteral(nodePath)} ${powerShellLiteral(NODE_PTY_CONSOLE_LIST_PATCH_FILENAME)}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }`,
+    `& ${powerShellLiteral(nodePath)} ${powerShellLiteral(NODE_PTY_WINDOWS_TEARDOWN_PATCH_FILENAME)}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }`
+  ].join('; ')
 }
 
 async function makeNodePtySpawnHelperExecutable(
diff --git a/src/shared/relay-artifacts.ts b/src/shared/relay-artifacts.ts
index 2f9e563f839..73ce8c7af1b 100644
--- a/src/shared/relay-artifacts.ts
+++ b/src/shared/relay-artifacts.ts
@@ -57,6 +57,10 @@ export const RELAY_ARTIFACTS: readonly RelayArtifact[] = [
   // title request with no title and no error.
   { filename: 'wsl-transcript-fs-process-entry.js' },
   { filename: 'node-pty-1.1.0-console-list-agent-patch.cjs', windowsOnly: true },
+  // The ConPTY teardown release the desktop's own node-pty patch already carries; pnpm patches do
+  // not cross the SSH boundary, so a relay ran the unpatched npm tree and leaked one Windows File
+  // handle per terminal for the life of the relay process.
+  { filename: 'node-pty-1.1.0-windows-pty-teardown-patch.cjs', windowsOnly: true },
   // Only Linux relays run it, but it ships everywhere: the manifest's only
   // platform axis is Windows, and a second one would buy nothing but a fork in
   // the hash. Its presence is what moves a host to a fresh relay directory, and

From 637dc30a3211ec0667c55118a4d17edbee5cff80 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 02:11:09 -0700
Subject: [PATCH 16/58] fix(relay): observe Windows PTY child processes instead
 of answering false (#18591)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(relay): observe Windows PTY child processes instead of answering false

`processHasChildren` returned a hardcoded `false` on Windows, and a hardcoded
negative is indistinguishable from a measurement. Every close guard reads it as
"nothing is running in this pane", so an SSH-to-Windows tab running a build
closed with no prompt. Measured on a real Windows SSH host: a live `PING.EXE`
under the pane's `cmd.exe` still reported `hasChildProcesses: false`, while the
identical harness on Linux reported `sleep` / `true`.

Windows has no `ps`, but it does have a process table, and the pane walk over it
already existed for the foreground reader. The answer now comes from
`queryWindowsPaneProcessInventory`; a table it could not read reports
`unverifiable` rather than a fabricated negative.

`hasChildProcesses` is a boolean, which cannot hold the third answer, and it is
read both as "busy, do not close" and as "the agent took the PTY, safe to type
into" — so no single mapping of `unverifiable` is safe for both. The verdict
moves to a new optional `childProcessEvidence` member that the close paths read;
the boolean keeps its exact meaning for every client that cannot.

Cost: `pty.inspectProcess` is the polled path and a relay host has no
`@vscode/windows-process-tree`, so its table read falls back to the 1.36s CIM
scan. Polling that would reinstate the fork storm the shared table exists to
prevent, so only a caller whose answer decides something asks for the scan.

* fix(runtime): forward scanChildProcesses through the environment inspection RPC

`guardRunningTerminalClose` asks the host to pay for a real child-process read,
but the environment path dropped the option before it reached the wire: the
renderer sent only `expectedIncarnationId`, and the RPC schema — the shared
`TerminalHandle` — silently stripped anything else. A host routing that pane
through an SSH relay then declined to scan and answered `unverifiable`, which
`inspectionReportsRunningWork` reads as running work. The result was a close
confirmation on an idle pane, which is the nag this PR exists to avoid.

Forwarded through all four layers: renderer payload, RPC schema, method handler,
and the runtime/controller signatures. The schema is a dedicated extension rather
than a field on `TerminalHandle`, so `clearBuffer`/`agentStatus`/`isRunningAgent`
keep refusing an option they have no use for.

The silent strip is not itself the defect — it is what makes a new optional member
safe to send to an old host, per docs/reference/remote-wire-compatibility.md. The
defect was the schema and its caller drifting inside one version, so the tests pin
the registered method rather than the schema alone: pointing it back at
`TerminalHandle` compiles, parses, and drops the option.

Found by review on #18591.

* fix(terminal): teach the shared running-work probe the third child-process answer

Rebasing onto main landed `probePtyRunningWork`, which is a better home for this
than the close guard: it already speaks `live` / `unverifiable` / `exited`, and it
exists so the tab-close and window-close guards cannot drift. The child-process
verdict belongs there, not in a parallel predicate beside it.

So the mapping moves into the probe and `inspectionReportsRunningWork` is deleted
rather than kept alongside. The probe now asks for the scan, and a host that could
not observe the pane reports `unverifiable` instead of collapsing onto `exited` --
which is what `hasChildProcesses: false` meant on every Windows relay.

The pane-close path is routed through the same probe for the same reason; it was
the third caller asking this question through a direct inspect of its own.
---
 src/main/ipc/pty/ipc/inspect.ts               |  17 ++-
 src/main/providers/pty-process-inspection.ts  |  16 ++-
 .../ssh-pty-provider-rpc-operations.ts        |   6 +-
 src/main/providers/ssh-pty-provider.ts        |   2 +-
 ...tore-structured-agent-session-tabs-once.ts |   2 +-
 .../terminal-inspect-process-params.test.ts   |  92 ++++++++++++
 .../terminal/terminal-query-methods.ts        |  23 +--
 .../rpc/methods/terminal/unary-schemas.ts     |  11 ++
 .../runtime-pty-controller-contract.ts        |   2 +-
 src/preload/api/pty-api.ts                    |   2 +-
 .../pty-bridge-stream-and-serialization.ts    |   2 +-
 src/relay/pty-child-process-inspection.ts     |  81 +++++++++++
 src/relay/pty-handler-spawn-admission.test.ts |   3 +-
 src/relay/pty-handler-test-harness.ts         |   4 +-
 ...ler-windows-child-process-evidence.test.ts | 132 ++++++++++++++++++
 src/relay/pty-handler.ts                      |  30 +++-
 src/relay/pty-shell-utils.test.ts             |  78 ++++++++++-
 src/relay/pty-shell-utils.ts                  |  42 +-----
 .../use-terminal-pane-close-actions.ts        |  10 +-
 ...-running-work-probe-child-evidence.test.ts |  94 +++++++++++++
 .../terminal/pty-running-work-probe.ts        |  21 ++-
 .../running-terminal-close-guard.test.ts      |   4 +-
 ...al-close-confirm-keyboard-vs-mouse.test.ts |   7 +-
 .../runtime-terminal-inspection.test.ts       |  52 +++++++
 .../runtime/runtime-terminal-inspection.ts    |  10 +-
 src/shared/terminal-process-inspection.ts     |  13 ++
 26 files changed, 665 insertions(+), 91 deletions(-)
 create mode 100644 src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts
 create mode 100644 src/relay/pty-child-process-inspection.ts
 create mode 100644 src/relay/pty-handler-windows-child-process-evidence.test.ts
 create mode 100644 src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts

diff --git a/src/main/ipc/pty/ipc/inspect.ts b/src/main/ipc/pty/ipc/inspect.ts
index c13c4242fea..041abaa7854 100644
--- a/src/main/ipc/pty/ipc/inspect.ts
+++ b/src/main/ipc/pty/ipc/inspect.ts
@@ -170,7 +170,10 @@ export function installPtyInspectIpcHandlers(deps: {
 
   ipcMain.handle(
     'pty:inspectProcess',
-    async (_event, args: { id: string; expectedIncarnationId?: string }) => {
+    async (
+      _event,
+      args: { id: string; expectedIncarnationId?: string; scanChildProcesses?: boolean }
+    ) => {
       // Why: same routing hazard as pty:hasPty — an unroutable id must read as client-only unverifiable, not as a local-provider answer or a raised IPC error.
       if (typeof args?.id !== 'string' || !args.id || args.id.startsWith('remote:')) {
         return clientOnlyUnverifiableInspection('terminal_gone')
@@ -182,10 +185,14 @@ export function installPtyInspectIpcHandlers(deps: {
       if (!hasPtyProviderForInspection(args.id)) {
         return clientOnlyUnverifiableInspection('terminal_gone')
       }
-      return args.expectedIncarnationId
-        ? inspectPtyProviderProcessForRenderer(getProviderForPty(args.id), args.id, {
-            expectedIncarnationId: args.expectedIncarnationId
-          })
+      const options = {
+        ...(args.expectedIncarnationId
+          ? { expectedIncarnationId: args.expectedIncarnationId }
+          : {}),
+        ...(args.scanChildProcesses === true ? { scanChildProcesses: true } : {})
+      }
+      return Object.keys(options).length > 0
+        ? inspectPtyProviderProcessForRenderer(getProviderForPty(args.id), args.id, options)
         : inspectPtyProviderProcessForRenderer(getProviderForPty(args.id), args.id)
     }
   )
diff --git a/src/main/providers/pty-process-inspection.ts b/src/main/providers/pty-process-inspection.ts
index 6869899de8b..59d910b2238 100644
--- a/src/main/providers/pty-process-inspection.ts
+++ b/src/main/providers/pty-process-inspection.ts
@@ -11,14 +11,24 @@ export type PtyProcessInspection = TerminalProcessInspection
 type CompletionSensitivePtyProvider = IPtyProvider & {
   inspectProcess?: (
     id: string,
-    options?: { expectedIncarnationId?: PtyIncarnationId }
+    options?: PtyProcessInspectionOptions
   ) => Promise<PtyProcessInspection>
 }
 
+/**
+ * `scanChildProcesses` marks a read whose answer decides something once, rather than a poll that
+ * self-corrects on its next tick. Only hosts where the child answer costs a process-table read
+ * act on it; everywhere else the answer was already captured.
+ */
+export type PtyProcessInspectionOptions = {
+  expectedIncarnationId?: PtyIncarnationId
+  scanChildProcesses?: boolean
+}
+
 export async function inspectPtyProviderProcess(
   provider: IPtyProvider,
   ptyId: string,
-  options?: { expectedIncarnationId?: PtyIncarnationId }
+  options?: PtyProcessInspectionOptions
 ): Promise<PtyProcessInspection> {
   if (provider.hasPty?.(ptyId) === false) {
     throw new Error('terminal_gone')
@@ -37,7 +47,7 @@ export async function inspectPtyProviderProcess(
 export async function inspectPtyProviderProcessForRenderer(
   provider: IPtyProvider,
   ptyId: string,
-  options?: { expectedIncarnationId?: PtyIncarnationId }
+  options?: PtyProcessInspectionOptions
 ): Promise<PtyProcessInspection> {
   try {
     return await inspectPtyProviderProcess(provider, ptyId, options)
diff --git a/src/main/providers/ssh-pty-provider-rpc-operations.ts b/src/main/providers/ssh-pty-provider-rpc-operations.ts
index 71ddbefce97..2e273239cd4 100644
--- a/src/main/providers/ssh-pty-provider-rpc-operations.ts
+++ b/src/main/providers/ssh-pty-provider-rpc-operations.ts
@@ -56,13 +56,15 @@ export function createSshPtyProviderRpcOperations({ mux, toRelayPtyId }: SshPtyP
     // Guarded by ssh-pty-inspect-observation-identity.test.ts; #17525 removes the poll.
     inspectProcess: async (
       id: string,
-      options?: { expectedIncarnationId?: string }
+      options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean }
     ): Promise<PtyProcessInspection> => {
       return (await mux.request('pty.inspectProcess', {
         id: toRelayPtyId(id),
         ...(options?.expectedIncarnationId
           ? { expectedIncarnationId: options.expectedIncarnationId }
-          : {})
+          : {}),
+        // Additive request member: an older relay ignores it and answers as it always did.
+        ...(options?.scanChildProcesses === true ? { scanChildProcesses: true } : {})
       })) as PtyProcessInspection
     },
     serialize: async (ids: string[]): Promise<string> => {
diff --git a/src/main/providers/ssh-pty-provider.ts b/src/main/providers/ssh-pty-provider.ts
index 70c01b5a1c7..3d0c46d7a03 100644
--- a/src/main/providers/ssh-pty-provider.ts
+++ b/src/main/providers/ssh-pty-provider.ts
@@ -63,7 +63,7 @@ export class SshPtyProvider implements IPtyProvider {
     this.rpcOperations.getForegroundProcess(id)
   inspectProcess = (
     id: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean }
   ): Promise<PtyProcessInspection> => this.rpcOperations.inspectProcess(id, options)
   serialize = (ids: string[]): Promise<string> => this.rpcOperations.serialize(ids)
   revive = (state: string): Promise<void> => this.rpcOperations.revive(state)
diff --git a/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts b/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
index 0ed3700ba99..4466594b0dc 100644
--- a/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
+++ b/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
@@ -153,7 +153,7 @@ export class OrcaRuntimeWithRestoreStructuredAgentSessionTabsOnce extends OrcaRu
 
   async inspectTerminalProcess(
     terminalSelector: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean }
   ): Promise<PtyProcessInspection> {
     const leaf = this.resolveLiveLeafForHandle(terminalSelector)
     if (!leaf?.ptyId || !this.ptyController) {
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts b/src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts
new file mode 100644
index 00000000000..48649bc372c
--- /dev/null
+++ b/src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts
@@ -0,0 +1,92 @@
+// The host half of the same contract: an RPC schema silently strips keys it does not declare, which
+// is exactly what forward compatibility needs and exactly how a caller's option can vanish inside
+// one version. `scanChildProcesses` has to be declared here, and only here -- the sibling handle
+// methods have no use for it and must keep refusing it.
+import { describe, expect, it, vi } from 'vitest'
+import type { ZodType } from 'zod'
+import { TERMINAL_QUERY_METHODS } from './terminal-query-methods'
+import { TerminalHandle, TerminalInspectProcess } from './unary-schemas'
+
+/** The method as registered, so a schema swap on the definition cannot pass unseen. */
+function inspectProcessMethod() {
+  const method = TERMINAL_QUERY_METHODS.find((entry) => entry.name === 'terminal.inspectProcess')
+  if (!method) {
+    throw new Error('terminal.inspectProcess is not registered')
+  }
+  return method
+}
+
+async function callRegisteredHandler(
+  params: Record<string, unknown>
+): Promise<{ terminal: string; options: unknown }> {
+  const method = inspectProcessMethod()
+  const parsed = (method.params as ZodType).parse(params)
+  const inspectTerminalProcess = vi.fn(async () => ({
+    foregroundProcess: null,
+    hasChildProcesses: false
+  }))
+  await method.handler(parsed, { runtime: { inspectTerminalProcess } } as never, undefined as never)
+  const [terminal, options] = inspectTerminalProcess.mock.calls[0] as unknown as [string, unknown]
+  return { terminal, options }
+}
+
+describe('terminal.inspectProcess registration', () => {
+  // The half the schema test alone cannot see: pointing the method back at the shared handle schema
+  // compiles, parses, and silently drops the option. This exercises the registered definition.
+  it('carries scanChildProcesses from the wire into the runtime call', async () => {
+    await expect(
+      callRegisteredHandler({ terminal: 'term_1', scanChildProcesses: true })
+    ).resolves.toEqual({ terminal: 'term_1', options: { scanChildProcesses: true } })
+  })
+
+  it('carries it alongside the incarnation fence', async () => {
+    await expect(
+      callRegisteredHandler({
+        terminal: 'term_1',
+        expectedIncarnationId: 'inc-1',
+        scanChildProcesses: true
+      })
+    ).resolves.toEqual({
+      terminal: 'term_1',
+      options: { expectedIncarnationId: 'inc-1', scanChildProcesses: true }
+    })
+  })
+
+  it('keeps the legacy one-argument shape for a bare poll', async () => {
+    await expect(callRegisteredHandler({ terminal: 'term_1' })).resolves.toEqual({
+      terminal: 'term_1',
+      options: undefined
+    })
+  })
+})
+
+describe('terminal.inspectProcess params', () => {
+  it('preserves scanChildProcesses', () => {
+    expect(TerminalInspectProcess.parse({ terminal: 'term_1', scanChildProcesses: true })).toEqual({
+      terminal: 'term_1',
+      scanChildProcesses: true
+    })
+  })
+
+  it('preserves it alongside the incarnation fence', () => {
+    expect(
+      TerminalInspectProcess.parse({
+        terminal: 'term_1',
+        expectedIncarnationId: 'inc-1',
+        scanChildProcesses: true
+      })
+    ).toEqual({ terminal: 'term_1', expectedIncarnationId: 'inc-1', scanChildProcesses: true })
+  })
+
+  it('leaves it absent for a polling caller', () => {
+    expect(TerminalInspectProcess.parse({ terminal: 'term_1' })).toEqual({ terminal: 'term_1' })
+  })
+
+  // The shape that produced the bug, pinned so nobody "simplifies" the method back onto the shared
+  // handle schema: TerminalHandle drops the option on the floor without complaining.
+  it('shows why the shared handle schema could not carry it', () => {
+    expect(TerminalHandle.parse({ terminal: 'term_1', scanChildProcesses: true })).toEqual({
+      terminal: 'term_1'
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts b/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts
index a8aec9ff573..bf7b4a5bd87 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-query-methods.ts
@@ -1,6 +1,7 @@
 import { defineMethod, type RpcAnyMethod } from '../../core'
 import {
   TerminalHandle,
+  TerminalInspectProcess,
   TerminalListParams,
   TerminalRead,
   TerminalRecoverPane,
@@ -65,15 +66,21 @@ export const TERMINAL_QUERY_METHODS: RpcAnyMethod[] = [
   }),
   defineMethod({
     name: 'terminal.inspectProcess',
-    params: TerminalHandle,
-    handler: async (params, { runtime }) => ({
-      process: await runtime.inspectTerminalProcess(
-        params.terminal,
-        params.expectedIncarnationId
+    params: TerminalInspectProcess,
+    handler: async (params, { runtime }) => {
+      const options = {
+        ...(params.expectedIncarnationId
           ? { expectedIncarnationId: params.expectedIncarnationId }
-          : undefined
-      )
-    })
+          : {}),
+        ...(params.scanChildProcesses === true ? { scanChildProcesses: true } : {})
+      }
+      return {
+        process: await runtime.inspectTerminalProcess(
+          params.terminal,
+          Object.keys(options).length > 0 ? options : undefined
+        )
+      }
+    }
   }),
   defineMethod({
     name: 'terminal.isRunningAgent',
diff --git a/src/main/runtime/rpc/methods/terminal/unary-schemas.ts b/src/main/runtime/rpc/methods/terminal/unary-schemas.ts
index 323b34a7544..afe0a3bb486 100644
--- a/src/main/runtime/rpc/methods/terminal/unary-schemas.ts
+++ b/src/main/runtime/rpc/methods/terminal/unary-schemas.ts
@@ -13,6 +13,17 @@ export const TerminalFocus = TerminalHandle.extend({
   navigation: z.enum(['caller', 'host']).optional()
 })
 
+/**
+ * `terminal.inspectProcess` carries one member the sibling handle methods must not: whether the
+ * caller's answer decides something once, which is what licenses the host to pay for a process-table
+ * read. Extended rather than added to `TerminalHandle` so `clearBuffer`/`agentStatus`/`isRunningAgent`
+ * keep refusing an option they have no use for.
+ */
+export const TerminalInspectProcess = TerminalHandle.extend({
+  // Additive request member understood by newer hosts; legacy hosts safely ignore it.
+  scanChildProcesses: z.boolean().optional()
+})
+
 export const TerminalListParams = z.object({
   worktree: OptionalString,
   limit: OptionalFiniteNumber,
diff --git a/src/main/runtime/runtime-pty-controller-contract.ts b/src/main/runtime/runtime-pty-controller-contract.ts
index 194d0bb665c..665c6fdb609 100644
--- a/src/main/runtime/runtime-pty-controller-contract.ts
+++ b/src/main/runtime/runtime-pty-controller-contract.ts
@@ -109,7 +109,7 @@ export type RuntimePtyController = {
   getForegroundProcess(ptyId: string): Promise<string | null>
   inspectProcess?(
     ptyId: string,
-    options?: { expectedIncarnationId?: PtyIncarnationId }
+    options?: { expectedIncarnationId?: PtyIncarnationId; scanChildProcesses?: boolean }
   ): Promise<PtyProcessInspection>
   confirmForegroundProcess?(ptyId: string): Promise<string | null>
   confirmShellForeground?(ptyId: string): Promise<boolean>
diff --git a/src/preload/api/pty-api.ts b/src/preload/api/pty-api.ts
index bf012306675..a1850398357 100644
--- a/src/preload/api/pty-api.ts
+++ b/src/preload/api/pty-api.ts
@@ -112,7 +112,7 @@ export type PtyApi = {
   getForegroundProcess: (id: string) => Promise<string | null>
   inspectProcess: (
     id: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean }
   ) => Promise<TerminalProcessInspection>
   confirmForegroundProcess: (id: string) => Promise<string | null>
   getCwd: (id: string) => Promise<string>
diff --git a/src/preload/api/pty-bridge-stream-and-serialization.ts b/src/preload/api/pty-bridge-stream-and-serialization.ts
index 7e2d7bbe4ff..414a5514bfa 100644
--- a/src/preload/api/pty-bridge-stream-and-serialization.ts
+++ b/src/preload/api/pty-bridge-stream-and-serialization.ts
@@ -7,7 +7,7 @@ import type { TerminalProcessInspection } from '../../shared/terminal-process-in
 export const ptyStreamAndSerializationApi = {
   inspectProcess: (
     id: string,
-    options?: { expectedIncarnationId?: string }
+    options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean }
   ): Promise<TerminalProcessInspection> =>
     ipcRenderer.invoke('pty:inspectProcess', { id, ...options }),
   confirmForegroundProcess: (id: string): Promise<string | null> =>
diff --git a/src/relay/pty-child-process-inspection.ts b/src/relay/pty-child-process-inspection.ts
new file mode 100644
index 00000000000..6d246817053
--- /dev/null
+++ b/src/relay/pty-child-process-inspection.ts
@@ -0,0 +1,81 @@
+/**
+ * Whether anything is running under a pane's shell.
+ *
+ * Split out of `pty-shell-utils` because it is a distinct question from "what is in front" and
+ * carries its own platform reasoning, its own cost budget, and the verdict vocabulary from
+ * docs/reference/ssh-execution-boundary.md.
+ */
+import { queryWindowsPaneProcessInventory } from '../main/providers/windows-foreground-process-rows'
+import { getProcessTableIndex } from '../shared/process-table-index'
+import {
+  getFreshProcessTableSnapshot,
+  getProcessTableSnapshot
+} from '../shared/process-table-snapshot-reader'
+import type { PtyChildProcessVerdict } from '../shared/terminal-process-inspection'
+import { isProcessAlive } from './pty-shell-utils'
+
+/**
+ * Check whether a process has child processes.
+ *
+ * Why the shared snapshot and not `pgrep -P`: this answers one field of
+ * `pty.inspectProcess`, which every tracked pane polls on a 750ms/2000ms
+ * cadence, and the fork was neither cached nor coalesced. procps-ng opens six
+ * procfs files per process to resolve a ppid — including a `/proc/<pid>/ctty`
+ * that never exists on Linux — so one call cost O(host process count) syscalls,
+ * ~4k opens per pgrep on a 690-process host, at up to 8 forks/sec (#13537).
+ * `getForegroundProcessName` in the same RPC already captured the TTL-cached
+ * `ps` table, whose index carries the parent/child map, so the answer is free.
+ *
+ * `fresh` opts out of that TTL. A poll can read a 500ms-old table because its
+ * next tick corrects it, but a close or cleanup decision acts on the answer
+ * once and destructively — a child that started inside the TTL would be killed
+ * with no confirmation. `pgrep` scanned per call, so anything that decides
+ * has to keep scanning per call.
+ */
+export async function inspectPtyChildProcesses(
+  pid: number,
+  options?: { fresh?: boolean }
+): Promise<PtyChildProcessVerdict> {
+  if (process.platform === 'win32') {
+    // Windows has no `ps`, but it does have a process table, and the pane walk over it already
+    // exists for the foreground reader. Answering `false` from nothing was the older shape: a
+    // hardcoded negative is indistinguishable from a measurement, and every close guard reads it
+    // as "nothing is running here".
+    //
+    // Deliberately the TTL-cached table even when `fresh` is asked for: on a relay without the
+    // native binding this falls back to the CIM scan, whose own 1.36s runtime is longer than the
+    // 500ms TTL a fresh read would be refreshing, so a "fresh" answer is not meaningfully fresher
+    // while N sequential ones are an N x 1.36s stall.
+    const inventory = await queryWindowsPaneProcessInventory(pid)
+    if (inventory) {
+      return inventory.candidates.length > 0 ? 'children' : 'no-children'
+    }
+    // A null inventory is an unreadable table OR a snapshot that never showed the root, and
+    // neither of those looked at the pane. The one answer available without the table is a root
+    // the kernel says is gone: nothing runs under a shell that does not exist.
+    return isProcessAlive(pid) ? 'unverifiable' : 'no-children'
+  }
+  try {
+    const rows = options?.fresh
+      ? await getFreshProcessTableSnapshot()
+      : await getProcessTableSnapshot()
+    return (getProcessTableIndex(rows).childrenByPpid.get(pid)?.length ?? 0) > 0
+      ? 'children'
+      : 'no-children'
+  } catch {
+    return 'unverifiable'
+  }
+}
+
+/**
+ * The boolean the wire has always carried. `unverifiable` keeps spelling itself `false` here on
+ * purpose: this value reaches clients too old to know the third answer, and it is read both as
+ * "busy, do not close" and as "the agent has taken over, safe to type into", so no single mapping
+ * of `unverifiable` is safe for both. Callers that can act on the distinction read the verdict.
+ */
+export async function processHasChildren(
+  pid: number,
+  options?: { fresh?: boolean }
+): Promise<boolean> {
+  return (await inspectPtyChildProcesses(pid, options)) === 'children'
+}
diff --git a/src/relay/pty-handler-spawn-admission.test.ts b/src/relay/pty-handler-spawn-admission.test.ts
index c25a623f406..045ee2e412d 100644
--- a/src/relay/pty-handler-spawn-admission.test.ts
+++ b/src/relay/pty-handler-spawn-admission.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import * as ptyChildProcessInspection from './pty-child-process-inspection'
 import * as ptyShellUtils from './pty-shell-utils'
 import * as processTableSnapshotReader from '../shared/process-table-snapshot-reader'
 
@@ -92,7 +93,7 @@ describe('PtyHandler', () => {
   })
 
   it('rescans the process table for a close decision but not for a poll', async () => {
-    const hasChildren = vi.mocked(ptyShellUtils.processHasChildren)
+    const hasChildren = vi.mocked(ptyChildProcessInspection.processHasChildren)
     const snapshot = vi
       .spyOn(processTableSnapshotReader, 'getStrictProcessTableSnapshotWithAge')
       .mockResolvedValue({
diff --git a/src/relay/pty-handler-test-harness.ts b/src/relay/pty-handler-test-harness.ts
index e3d99213ea5..fe6e17c5d9c 100644
--- a/src/relay/pty-handler-test-harness.ts
+++ b/src/relay/pty-handler-test-harness.ts
@@ -1,6 +1,6 @@
 import { vi } from 'vitest'
 import type { Mock } from 'vitest'
-import * as ptyShellUtils from './pty-shell-utils'
+import * as ptyChildProcessInspection from './pty-child-process-inspection'
 import { PtyHandler } from './pty-handler'
 import type { RelayDispatcher } from './dispatcher'
 
@@ -115,7 +115,7 @@ export function beginPtyHandlerTest(mocks: PtyHandlerTestMocks): {
     notifyOutput: vi.fn(),
     dispose: vi.fn()
   })
-  vi.spyOn(ptyShellUtils, 'processHasChildren').mockResolvedValue(false)
+  vi.spyOn(ptyChildProcessInspection, 'processHasChildren').mockResolvedValue(false)
 
   mockPtySpawn.mockReturnValue({ ...mockPtyInstance })
 
diff --git a/src/relay/pty-handler-windows-child-process-evidence.test.ts b/src/relay/pty-handler-windows-child-process-evidence.test.ts
new file mode 100644
index 00000000000..6d723824a04
--- /dev/null
+++ b/src/relay/pty-handler-windows-child-process-evidence.test.ts
@@ -0,0 +1,132 @@
+// Regression guard for the Windows SSH child-process answer. The relay used to return a hardcoded
+// `false` here, which every close guard reads as "nothing is running in this pane" -- so a Windows
+// SSH pane running a build closed with no prompt. The answer now comes from the process table, and
+// the one thing it may never do again is fabricate a negative.
+//
+// The second contract is cost. `pty.inspectProcess` is the polled path (750ms/2000ms per tracked
+// pane) and a relay host has no `@vscode/windows-process-tree`, so its table read falls back to a
+// 1.36s CIM scan. Polling that would reinstate the fork storm the shared table exists to prevent,
+// so only a caller whose answer decides something asks for the scan.
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
+
+const { mockPtySpawn, mockPtyInstance, mockCreateShellPromptReadinessProbe } = vi.hoisted(() => ({
+  mockPtySpawn: vi.fn(),
+  mockCreateShellPromptReadinessProbe: vi.fn(),
+  mockPtyInstance: {
+    pid: process.pid,
+    process: 'xterm-256color',
+    onData: vi.fn(),
+    onExit: vi.fn(),
+    write: vi.fn(),
+    resize: vi.fn(),
+    kill: vi.fn(),
+    clear: vi.fn(),
+    pause: vi.fn(),
+    resume: vi.fn()
+  }
+}))
+
+vi.mock('node-pty', () => ({ spawn: mockPtySpawn }))
+
+vi.mock('../main/pty/posix-pty-process-groups', () => ({
+  forceKillPosixPtyProcessGroups: vi.fn((_pid: number, fallback: () => void) => fallback())
+}))
+
+vi.mock('../main/shell-prompt-readiness-probe', () => ({
+  createShellPromptReadinessProbe: mockCreateShellPromptReadinessProbe
+}))
+
+import * as ptyChildProcessInspection from './pty-child-process-inspection'
+import type { PtyHandler } from './pty-handler'
+import {
+  beginPtyHandlerTest,
+  createPtyRequestHelpers,
+  endPtyHandlerTest
+} from './pty-handler-test-harness'
+import type { MockDispatcher } from './pty-handler-test-harness'
+
+type Inspection = {
+  foregroundProcess: string | null
+  hasChildProcesses: boolean
+  childProcessEvidence?: string
+}
+
+describe('PtyHandler Windows child-process evidence', () => {
+  let dispatcher: MockDispatcher
+  let handler: PtyHandler
+  let originalPlatform: PropertyDescriptor | undefined
+  let inspectChildren: ReturnType<typeof vi.spyOn>
+
+  const { spawnPty } = createPtyRequestHelpers(() => dispatcher)
+
+  /** Spawn under the harness's POSIX platform, then answer as the Windows relay would. */
+  async function spawnThenBecomeWindows(): Promise<string> {
+    const { id } = await spawnPty()
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    return id
+  }
+
+  async function inspect(params: Record<string, unknown>): Promise<Inspection> {
+    return (await dispatcher.callRequest('pty.inspectProcess', params)) as Inspection
+  }
+
+  beforeEach(() => {
+    ;({ dispatcher, handler, originalPlatform } = beginPtyHandlerTest({
+      mockPtySpawn,
+      mockPtyInstance,
+      mockCreateShellPromptReadinessProbe
+    }))
+    inspectChildren = vi
+      .spyOn(ptyChildProcessInspection, 'inspectPtyChildProcesses')
+      .mockResolvedValue('no-children')
+  })
+
+  afterEach(async () => {
+    await endPtyHandlerTest(handler, originalPlatform)
+  })
+
+  it('publishes what the host observed when the caller pays for the scan', async () => {
+    const id = await spawnThenBecomeWindows()
+    inspectChildren.mockResolvedValue('children')
+
+    const result = await inspect({ id, scanChildProcesses: true })
+
+    expect(inspectChildren).toHaveBeenCalledWith(mockPtyInstance.pid)
+    expect(result.childProcessEvidence).toBe('children')
+    expect(result.hasChildProcesses).toBe(true)
+  })
+
+  it('reports an observed-empty pane as no-children, not merely false', async () => {
+    const id = await spawnThenBecomeWindows()
+    inspectChildren.mockResolvedValue('no-children')
+
+    const result = await inspect({ id, scanChildProcesses: true })
+
+    // Asserted alongside the value so the case fails if the answer stops coming from a real read.
+    expect(inspectChildren).toHaveBeenCalledWith(mockPtyInstance.pid)
+    expect(result.childProcessEvidence).toBe('no-children')
+    expect(result.hasChildProcesses).toBe(false)
+  })
+
+  it('keeps the compatibility boolean false when the host could not observe the pane', async () => {
+    const id = await spawnThenBecomeWindows()
+    inspectChildren.mockResolvedValue('unverifiable')
+
+    const result = await inspect({ id, scanChildProcesses: true })
+
+    expect(result.childProcessEvidence).toBe('unverifiable')
+    // Clients too old to read the verdict also read `true` as "an agent took the PTY, safe to
+    // type into it", so `unverifiable` must not be promoted to `true` on the shared boolean.
+    expect(result.hasChildProcesses).toBe(false)
+  })
+
+  it('never reads the process table for a poll, and says so instead of guessing', async () => {
+    const id = await spawnThenBecomeWindows()
+
+    const result = await inspect({ id })
+
+    expect(inspectChildren).not.toHaveBeenCalled()
+    expect(result.childProcessEvidence).toBe('unverifiable')
+    expect(result.hasChildProcesses).toBe(false)
+  })
+})
diff --git a/src/relay/pty-handler.ts b/src/relay/pty-handler.ts
index 42f8bdc0a77..190bcabb3f9 100644
--- a/src/relay/pty-handler.ts
+++ b/src/relay/pty-handler.ts
@@ -10,11 +10,11 @@ import type { RelayDispatcher, RequestContext } from './dispatcher'
 import {
   resolveDefaultShell,
   resolveProcessCwd,
-  processHasChildren,
   getForegroundProcessName,
   isProcessAlive,
   listShellProfiles
 } from './pty-shell-utils'
+import { inspectPtyChildProcesses, processHasChildren } from './pty-child-process-inspection'
 import { getRelayShellLaunchConfig, isRelayWslShell } from './pty-shell-launch'
 import { RetiredPaneSurfaceRegistry } from './retired-pane-surfaces'
 import { addWslEnvKeys } from '../shared/wsl-env'
@@ -55,6 +55,7 @@ import {
 import { isTuiAgent } from '../shared/tui-agent-config'
 import type { TuiAgent } from '../shared/tui-agent'
 import { forceKillPosixPtyProcessGroups } from '../main/pty/posix-pty-process-groups'
+import type { PtyChildProcessVerdict } from '../shared/terminal-process-inspection'
 import { terminatePtyJob } from '../main/windows/windows-pty-job'
 import { stripInheritedBuildModeEnv } from '../main/pty/build-mode-env'
 import { stripLegacyTerminalShimEnv } from '../main/pty/legacy-terminal-shim-dir'
@@ -2610,6 +2611,7 @@ export class PtyHandler {
   private async inspectProcess(params: Record<string, unknown>): Promise<{
     foregroundProcess: string | null
     hasChildProcesses: boolean
+    childProcessEvidence?: PtyChildProcessVerdict
     foregroundProcessEvidence?: RemoteForegroundEvidence
   }> {
     pruneRetiredPtyIncarnations(this.retiredIncarnations)
@@ -2716,14 +2718,28 @@ export class PtyHandler {
       evidence?.verdict === 'live'
         ? (evidence.processName ?? managed.pty.process) || null
         : managed.pty.process || null
+    // Derive child liveness from the same capture; do not fork a second process-table probe for
+    // each field/pane in an event burst.
+    //
+    // Why Windows is gated on the caller asking: this is the one field whose Windows answer costs
+    // a process-table read, and `inspectProcess` is the polled path (750ms/2000ms per tracked
+    // pane). A relay host has no `@vscode/windows-process-tree`, so the read falls back to the
+    // 1.36s CIM scan, and polling that would reinstate exactly the fork storm the shared table
+    // exists to prevent (#15209, #15036). Close and cleanup decisions ask for the scan by name;
+    // a poll gets the honest `unverifiable` instead of a fabricated negative.
+    const childProcessEvidence: PtyChildProcessVerdict = rows
+      ? rows.some((row) => row.ppid === managed.pty.pid)
+        ? 'children'
+        : 'no-children'
+      : process.platform === 'win32' && params.scanChildProcesses !== true
+        ? 'unverifiable'
+        : await inspectPtyChildProcesses(managed.pty.pid)
     return {
       foregroundProcess,
-      // Derive child liveness from the same capture; do not fork a second
-      // process-table probe for each field/pane in an event burst. Windows
-      // has no evidence capture, so preserve the compatibility child probe.
-      hasChildProcesses: rows
-        ? rows.some((row) => row.ppid === managed.pty.pid)
-        : await processHasChildren(managed.pty.pid),
+      // `unverifiable` keeps spelling itself `false` on the compatibility field, which is what
+      // every client too old to read the verdict receives.
+      hasChildProcesses: childProcessEvidence === 'children',
+      childProcessEvidence,
       ...(evidence ? { foregroundProcessEvidence: evidence } : {})
     }
   }
diff --git a/src/relay/pty-shell-utils.test.ts b/src/relay/pty-shell-utils.test.ts
index 95d6a8e050f..94953aae1bc 100644
--- a/src/relay/pty-shell-utils.test.ts
+++ b/src/relay/pty-shell-utils.test.ts
@@ -14,10 +14,10 @@ vi.mock('child_process', () => ({
 import { resetWindowsProcessRowsSnapshotForTests } from '../main/providers/windows-foreground-process-rows'
 import { __setWindowsProcessTreeLoaderForTests } from '../main/windows/windows-process-table'
 import { resetProcessTableSnapshotForTests } from '../shared/process-table-snapshot-reader'
+import { inspectPtyChildProcesses, processHasChildren } from './pty-child-process-inspection'
 import {
   getForegroundProcessName,
   isProcessAlive,
-  processHasChildren,
   resolveDefaultCwd,
   resolveWindowsDefaultShell
 } from './pty-shell-utils'
@@ -42,6 +42,14 @@ function mockExecFile(
  * Feed the native Windows snapshot. A real snapshot always contains the
  * querying process, and the reader rejects a table without it.
  */
+/** A native reader that answers, but with no snapshot -- an unreadable table, not an empty one. */
+function mockUnreadableWindowsProcessTable(): void {
+  __setWindowsProcessTreeLoaderForTests(() => ({
+    ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2 },
+    getAllProcesses: (cb: (value: undefined) => void) => cb(undefined)
+  }))
+}
+
 function mockWindowsProcessTable(
   rows: { pid: number; ppid: number; name: string; commandLine?: string }[]
 ): void {
@@ -594,19 +602,79 @@ describe('processHasChildren', () => {
     })
   })
 
-  it('reports no children when the process table is unreadable', async () => {
+  it('reports an unreadable POSIX table as unverifiable, and still spells it false on the wire', async () => {
     await withProcessPlatform('linux', async () => {
       mockExecFile(() => new Error('ps table unavailable'))
 
+      await expect(inspectPtyChildProcesses(100)).resolves.toBe('unverifiable')
       await expect(processHasChildren(100)).resolves.toBe(false)
     })
   })
+})
 
-  it('spawns nothing on Windows, where the answer was always false', async () => {
+describe('inspectPtyChildProcesses on Windows', () => {
+  // Why this describe exists: the relay used to `return false` here unconditionally, and a
+  // hardcoded negative is indistinguishable from a measurement. Every close guard reads it as
+  // "nothing is running here", so a Windows SSH pane running a build closed with no prompt.
+  it('walks the process table rather than answering from nothing', async () => {
     await withProcessPlatform('win32', async () => {
-      await expect(processHasChildren(100)).resolves.toBe(false)
+      mockWindowsProcessTable([
+        { pid: 100, ppid: 99, name: 'cmd.exe', commandLine: 'cmd.exe' },
+        { pid: 101, ppid: 100, name: 'PING.EXE', commandLine: 'ping -n 40 127.0.0.1' }
+      ])
 
-      expect(execFileMock).not.toHaveBeenCalled()
+      await expect(inspectPtyChildProcesses(100)).resolves.toBe('children')
+      await expect(processHasChildren(100)).resolves.toBe(true)
+    })
+  })
+
+  it('finds a grandchild the shell backgrounded, not just direct children', async () => {
+    await withProcessPlatform('win32', async () => {
+      mockWindowsProcessTable([
+        { pid: 100, ppid: 99, name: 'cmd.exe', commandLine: 'cmd.exe' },
+        { pid: 101, ppid: 100, name: 'node.exe', commandLine: 'node build.js' },
+        { pid: 102, ppid: 101, name: 'tsc.exe', commandLine: 'tsc --watch' }
+      ])
+
+      await expect(inspectPtyChildProcesses(102)).resolves.toBe('no-children')
+      await expect(inspectPtyChildProcesses(101)).resolves.toBe('children')
+    })
+  })
+
+  it('separates an observed-empty shell from a table it could not read', async () => {
+    await withProcessPlatform('win32', async () => {
+      mockWindowsProcessTable([{ pid: 100, ppid: 99, name: 'cmd.exe', commandLine: 'cmd.exe' }])
+      await expect(inspectPtyChildProcesses(100)).resolves.toBe('no-children')
+
+      resetWindowsProcessRowsSnapshotForTests()
+      mockUnreadableWindowsProcessTable()
+      const alive = vi.spyOn(process, 'kill').mockReturnValue(true as never)
+      try {
+        await expect(inspectPtyChildProcesses(100)).resolves.toBe('unverifiable')
+        // The compatibility boolean keeps spelling unverifiable `false`: it reaches clients that
+        // cannot read the verdict, and they read `true` as "an agent took the PTY, safe to type".
+        await expect(processHasChildren(100)).resolves.toBe(false)
+      } finally {
+        alive.mockRestore()
+      }
+    })
+  })
+
+  it('does not read a missing shell as unverifiable when the kernel says it is gone', async () => {
+    await withProcessPlatform('win32', async () => {
+      // The root is absent from the snapshot, which on its own cannot distinguish a filtered
+      // table from an exited shell. Only ESRCH settles it.
+      mockWindowsProcessTable([{ pid: 900, ppid: 1, name: 'explorer.exe' }])
+      const gone = vi.spyOn(process, 'kill').mockImplementation(() => {
+        const error = new Error('no such process') as NodeJS.ErrnoException
+        error.code = 'ESRCH'
+        throw error
+      })
+      try {
+        await expect(inspectPtyChildProcesses(100)).resolves.toBe('no-children')
+      } finally {
+        gone.mockRestore()
+      }
     })
   })
 })
diff --git a/src/relay/pty-shell-utils.ts b/src/relay/pty-shell-utils.ts
index d84faad6ae9..9c8585933a1 100644
--- a/src/relay/pty-shell-utils.ts
+++ b/src/relay/pty-shell-utils.ts
@@ -11,10 +11,7 @@ import {
 import { getFirstCommandToken } from '../shared/command-token-scanner'
 import { getProcessTableIndex, type ProcessTableIndex } from '../shared/process-table-index'
 import { PS_MAX_BUFFER_BYTES, type ProcessTableRow } from '../shared/process-table-snapshot'
-import {
-  getFreshProcessTableSnapshot,
-  getProcessTableSnapshot
-} from '../shared/process-table-snapshot-reader'
+import { getProcessTableSnapshot } from '../shared/process-table-snapshot-reader'
 import { selectForegroundProcessCandidate } from '../shared/foreground-process-selection'
 import {
   resolveOuterWrapperForegroundProcess,
@@ -169,43 +166,6 @@ export async function resolveProcessCwd(pid: number, fallbackCwd: string): Promi
   return fallbackCwd
 }
 
-/**
- * Check whether a process has child processes.
- *
- * Why the shared snapshot and not `pgrep -P`: this answers one field of
- * `pty.inspectProcess`, which every tracked pane polls on a 750ms/2000ms
- * cadence, and the fork was neither cached nor coalesced. procps-ng opens six
- * procfs files per process to resolve a ppid — including a `/proc/<pid>/ctty`
- * that never exists on Linux — so one call cost O(host process count) syscalls,
- * ~4k opens per pgrep on a 690-process host, at up to 8 forks/sec (#13537).
- * `getForegroundProcessName` in the same RPC already captured the TTL-cached
- * `ps` table, whose index carries the parent/child map, so the answer is free.
- *
- * `fresh` opts out of that TTL. A poll can read a 500ms-old table because its
- * next tick corrects it, but a close or cleanup decision acts on the answer
- * once and destructively — a child that started inside the TTL would be killed
- * with no confirmation. `pgrep` scanned per call, so anything that decides
- * has to keep scanning per call.
- */
-export async function processHasChildren(
-  pid: number,
-  options?: { fresh?: boolean }
-): Promise<boolean> {
-  // Windows has no `ps`; the previous `pgrep` fork always failed here too, so
-  // this keeps the same answer without spawning anything to reach it.
-  if (process.platform === 'win32') {
-    return false
-  }
-  try {
-    const rows = options?.fresh
-      ? await getFreshProcessTableSnapshot()
-      : await getProcessTableSnapshot()
-    return (getProcessTableIndex(rows).childrenByPpid.get(pid)?.length ?? 0) > 0
-  } catch {
-    return false
-  }
-}
-
 // Why: signal 0 probes existence without delivering a signal. Only ESRCH ("no
 // such process") proves the pid is gone; EPERM means it exists but is
 // unsignalable, so treat every non-ESRCH outcome as alive. Kept conservative so
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
index 886c19fdf0d..330b42166cd 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
@@ -5,7 +5,7 @@ import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { closeWebRuntimeTerminal } from '@/runtime/web-runtime-session'
 import { resolveLeafCloseCopyKind } from '../terminal/terminal-close-copy-kind'
 import { RUNNING_CLOSE_PROBE_TIMEOUT_MS } from '../terminal/running-terminal-close-guard'
-import { inspectRuntimeTerminalProcess } from '@/runtime/runtime-terminal-inspection'
+import { probePtyRunningWork } from '../terminal/pty-running-work-probe'
 import {
   detachTerminalPaneToTab,
   isTerminalTabStripDropTarget,
@@ -99,12 +99,14 @@ export function useTerminalPaneCloseActions(controller: TerminalPaneBindingContr
           copyKind: getCloseDialogCopyKind(paneId)
         })
       const probeTimeout = setTimeout(() => decide(confirmClose), RUNNING_CLOSE_PROBE_TIMEOUT_MS)
-      void inspectRuntimeTerminalProcess(settings, ptyId)
-        .then((process) => {
+      // Why the shared probe rather than a direct inspect: this is the same question the tab-close
+      // guard asks, and the two must not drift on what an unanswered host means.
+      void probePtyRunningWork(settings, [ptyId], { timeoutMs: RUNNING_CLOSE_PROBE_TIMEOUT_MS })
+        .then((probes) => {
           clearTimeout(probeTimeout)
           decide(() => {
             if (
-              !process.hasChildProcesses ||
+              probes[0]?.verdict !== 'live' ||
               settings?.skipCloseTerminalWithRunningProcessConfirm
             ) {
               executeClosePane(paneId)
diff --git a/src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts b/src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts
new file mode 100644
index 00000000000..4d002ee0191
--- /dev/null
+++ b/src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts
@@ -0,0 +1,94 @@
+// The probe is the one place an inspection becomes a verdict, so it is the one place that has to
+// know `hasChildProcesses` cannot hold the third answer. A host that could not read its own process
+// table spells that the same way as one that read it and found nothing; Windows relays spelled it
+// `false` unconditionally, which read here as `exited` -- an idle verdict for a pane nobody looked at.
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { inspectRuntimeTerminalProcessMock } = vi.hoisted(() => ({
+  inspectRuntimeTerminalProcessMock: vi.fn()
+}))
+
+vi.mock('@/runtime/runtime-terminal-inspection', () => ({
+  inspectRuntimeTerminalProcess: inspectRuntimeTerminalProcessMock
+}))
+
+import { probePtyRunningWork } from './pty-running-work-probe'
+
+const SETTINGS = { activeRuntimeEnvironmentId: null }
+
+describe('probePtyRunningWork child-process evidence', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('asks the host to pay for a scan, because these probes back destructive decisions', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValue({
+      foregroundProcess: 'cmd.exe',
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+
+    await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+
+    expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledWith(SETTINGS, 'pty-a', {
+      scanChildProcesses: true
+    })
+  })
+
+  it('reports a host that could not observe the pane as unverifiable, not exited', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValue({
+      foregroundProcess: 'cmd.exe',
+      hasChildProcesses: false,
+      childProcessEvidence: 'unverifiable'
+    })
+
+    const [probe] = await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+
+    expect(probe).toMatchObject({
+      verdict: 'unverifiable',
+      reason: 'host_child_processes_unobserved',
+      timedOut: false
+    })
+  })
+
+  it('reports an observed-empty pane as exited', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValue({
+      foregroundProcess: 'cmd.exe',
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+
+    const [probe] = await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+
+    expect(probe?.verdict).toBe('exited')
+  })
+
+  it('reports an observed child as live', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValue({
+      foregroundProcess: 'PING.EXE',
+      hasChildProcesses: true,
+      childProcessEvidence: 'children'
+    })
+
+    const [probe] = await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+
+    expect(probe?.verdict).toBe('live')
+  })
+
+  it('keeps the boolean meaning for a host that never published the verdict', async () => {
+    inspectRuntimeTerminalProcessMock.mockResolvedValueOnce({
+      foregroundProcess: 'node',
+      hasChildProcesses: true
+    })
+    inspectRuntimeTerminalProcessMock.mockResolvedValueOnce({
+      foregroundProcess: 'bash',
+      hasChildProcesses: false
+    })
+
+    const [live] = await probePtyRunningWork(SETTINGS, ['pty-a'], { timeoutMs: 1000 })
+    const [idle] = await probePtyRunningWork(SETTINGS, ['pty-b'], { timeoutMs: 1000 })
+
+    expect(live?.verdict).toBe('live')
+    expect(idle?.verdict).toBe('exited')
+  })
+})
diff --git a/src/renderer/src/components/terminal/pty-running-work-probe.ts b/src/renderer/src/components/terminal/pty-running-work-probe.ts
index 609b71f12ca..1ee456ba389 100644
--- a/src/renderer/src/components/terminal/pty-running-work-probe.ts
+++ b/src/renderer/src/components/terminal/pty-running-work-probe.ts
@@ -54,14 +54,31 @@ export async function probePtyRunningWork(
         return
       }
       try {
-        const inspection = await inspectRuntimeTerminalProcess(settings, ptyId)
+        // Why the flag: this probe backs decisions that act once and destructively, so it is worth
+        // a host process-table read on platforms where the child question costs one. The polled
+        // inspections deliberately do not ask for it.
+        const inspection = await inspectRuntimeTerminalProcess(settings, ptyId, {
+          scanChildProcesses: true
+        })
         probe.timedOut = false
         if (isClientOnlyUnverifiableInspection(inspection)) {
           probe.verdict = 'unverifiable'
           probe.reason = inspection.reason
           return
         }
-        probe.verdict = inspection.hasChildProcesses ? 'live' : 'exited'
+        // `hasChildProcesses` cannot hold the third answer: a host that could not read its own
+        // process table spells that the same way as one that read it and found nothing. Windows
+        // relays spelled it `false` unconditionally, which read here as `exited`.
+        if (inspection.childProcessEvidence === 'unverifiable') {
+          probe.verdict = 'unverifiable'
+          probe.reason = 'host_child_processes_unobserved'
+          return
+        }
+        probe.verdict =
+          (inspection.childProcessEvidence ??
+            (inspection.hasChildProcesses ? 'children' : 'no-children')) === 'children'
+            ? 'live'
+            : 'exited'
         delete probe.reason
       } catch {
         // Why: `inspectRuntimeTerminalProcess` already maps every failure it can classify onto a
diff --git a/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts b/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts
index 165119f8b31..6b5b8343086 100644
--- a/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts
+++ b/src/renderer/src/components/terminal/running-terminal-close-guard.test.ts
@@ -111,7 +111,9 @@ describe('guardRunningTerminalClose', () => {
     guard(onClose)
     await settleProbe()
 
-    expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledWith(expect.anything(), 'pty-a')
+    expect(inspectRuntimeTerminalProcessMock).toHaveBeenCalledWith(expect.anything(), 'pty-a', {
+      scanChildProcesses: true
+    })
     expect(onClose).not.toHaveBeenCalled()
     expect(visibleRequest()).toMatchObject({ terminalTabId: 'tab-1' })
   })
diff --git a/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts b/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts
index 29b2e6cfd08..b2cdcb5b2ad 100644
--- a/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts
+++ b/src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts
@@ -5,7 +5,7 @@
  *
  * Mouse close path: SortableTab (X onClick / onAuxClick button===1) -> onClose
  *   -> Terminal.tsx handleCloseTab -> closeTerminalTab() -> running-process guard.
- * Keyboard path: Cmd+W -> TerminalPane.handleRequestClosePane -> inspectRuntimeTerminalProcess
+ * Keyboard path: Cmd+W -> TerminalPane.handleRequestClosePane -> probePtyRunningWork
  *   (split panes) or closeTerminalTab's guard (last pane) -> CloseTerminalDialog.
  */
 import { readFileSync } from 'node:fs'
@@ -99,8 +99,11 @@ describe('#10142 close confirmation policy is the same for keyboard and mouse',
       'utf8'
     )
     const handler = source.slice(source.indexOf('const handleRequestClosePane'))
+    // The shared probe, not a direct inspect: the pane path asks the same question as the tab
+    // guard, and routing both through one measurement is what stops them drifting on what an
+    // unanswered host means.
     expect(handler.slice(0, handler.indexOf('useImperativeHandle'))).toContain(
-      'inspectRuntimeTerminalProcess'
+      'probePtyRunningWork'
     )
   })
 
diff --git a/src/renderer/src/runtime/runtime-terminal-inspection.test.ts b/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
index 52609b75590..7f54f5873bc 100644
--- a/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
+++ b/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
@@ -146,6 +146,58 @@ describe('runtime terminal owner routing', () => {
     expect(localHasChildren).not.toHaveBeenCalled()
   })
 
+  // Why these exist: the close guards ask the host to pay for a real child-process read, and the
+  // environment path used to drop the option before it reached the wire. The host then declined to
+  // scan and answered `unverifiable`, which the guard reads as running work -- a confirmation
+  // dialog on every idle close of a remote Windows pane. Found by review on #18591.
+  it('forwards scanChildProcesses to the PTY owning environment', async () => {
+    await inspectRuntimeTerminalProcess(
+      { activeRuntimeEnvironmentId: 'env-2' },
+      'remote:env-1@@terminal-1',
+      { scanChildProcesses: true }
+    )
+
+    expect(runtimeCall).toHaveBeenCalledWith({
+      selector: 'env-1',
+      method: 'terminal.inspectProcess',
+      params: { terminal: 'terminal-1', scanChildProcesses: true },
+      timeoutMs: 15_000
+    })
+  })
+
+  it('forwards scanChildProcesses alongside the incarnation fence', async () => {
+    await inspectRuntimeTerminalProcess(
+      { activeRuntimeEnvironmentId: 'env-2' },
+      'remote:env-1@@terminal-1',
+      { expectedIncarnationId: 'incarnation-1', scanChildProcesses: true }
+    )
+
+    expect(runtimeCall).toHaveBeenCalledWith({
+      selector: 'env-1',
+      method: 'terminal.inspectProcess',
+      params: {
+        terminal: 'terminal-1',
+        expectedIncarnationId: 'incarnation-1',
+        scanChildProcesses: true
+      },
+      timeoutMs: 15_000
+    })
+  })
+
+  it('omits scanChildProcesses when the caller is only polling', async () => {
+    await inspectRuntimeTerminalProcess(
+      { activeRuntimeEnvironmentId: 'env-2' },
+      'remote:env-1@@terminal-1'
+    )
+
+    expect(runtimeCall).toHaveBeenCalledWith({
+      selector: 'env-1',
+      method: 'terminal.inspectProcess',
+      params: { terminal: 'terminal-1' },
+      timeoutMs: 15_000
+    })
+  })
+
   it('maps an old host inspection to client-only unverifiable', async () => {
     runtimeCall.mockResolvedValue({
       ok: true,
diff --git a/src/renderer/src/runtime/runtime-terminal-inspection.ts b/src/renderer/src/runtime/runtime-terminal-inspection.ts
index 284496426a0..8c354cdc415 100644
--- a/src/renderer/src/runtime/runtime-terminal-inspection.ts
+++ b/src/renderer/src/runtime/runtime-terminal-inspection.ts
@@ -138,7 +138,7 @@ export function recordRuntimeTerminalInputForPtyId(ptyId: string, timestamp = Da
 export async function inspectRuntimeTerminalProcess(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
-  options?: { expectedIncarnationId?: string }
+  options?: { expectedIncarnationId?: string; scanChildProcesses?: boolean }
 ): Promise<RuntimeTerminalProcessInspection> {
   const ownerEnvironmentId = getRemoteRuntimePtyEnvironmentId(ptyId)
   const target = ownerEnvironmentId
@@ -148,7 +148,7 @@ export async function inspectRuntimeTerminalProcess(
   const remote = isRemoteInspectionPtyId(ptyId)
   if (target.kind !== 'environment' || !terminal) {
     try {
-      const result = await (options?.expectedIncarnationId
+      const result = await (options
         ? window.api.pty.inspectProcess(ptyId, options)
         : window.api.pty.inspectProcess(ptyId))
       return normalizeInspectionResult(result, remote)
@@ -169,7 +169,11 @@ export async function inspectRuntimeTerminalProcess(
         terminal,
         ...(options?.expectedIncarnationId
           ? { expectedIncarnationId: options.expectedIncarnationId }
-          : {})
+          : {}),
+        // Why forwarded: the close guards pass this so the host pays for a real child-process read.
+        // Dropped here, the host declines to scan and answers `unverifiable`, which the guard reads
+        // as running work -- a confirmation dialog on every idle close of a remote Windows pane.
+        ...(options?.scanChildProcesses === true ? { scanChildProcesses: true } : {})
       },
       { timeoutMs: 15_000 }
     )
diff --git a/src/shared/terminal-process-inspection.ts b/src/shared/terminal-process-inspection.ts
index 6448cd9580e..c589bb65cdd 100644
--- a/src/shared/terminal-process-inspection.ts
+++ b/src/shared/terminal-process-inspection.ts
@@ -1,5 +1,15 @@
 import type { RemoteForegroundEvidence } from './foreground-process-evidence'
 
+/**
+ * What the execution host observed about processes running under a PTY's shell.
+ *
+ * Separate from `hasChildProcesses` because a boolean cannot hold the third answer. The host that
+ * could not read its own process table and the host that read it and found nothing both had to
+ * spell themselves `false`, and every close guard reads `false` as "nothing is running here".
+ * Windows relays spelled it `false` unconditionally.
+ */
+export type PtyChildProcessVerdict = 'children' | 'no-children' | 'unverifiable'
+
 /** Reasons the renderer could not observe the execution host. */
 export type ClientOnlyUnverifiableReason =
   | 'transport_loss'
@@ -17,6 +27,7 @@ export type ClientOnlyUnverifiableInspection = {
   verdict: 'unverifiable'
   reason: string
   foregroundProcessEvidence?: never
+  childProcessEvidence?: never
   authorityGeneration?: never
   observationEpoch?: never
   capturedAgeMs?: never
@@ -30,6 +41,8 @@ export type HostProcessInspection = {
   hasChildProcesses: boolean
   /** Optional on old hosts; the renderer treats an omitted field as old-host unverifiable. */
   foregroundProcessEvidence?: RemoteForegroundEvidence
+  /** Absent on hosts that predate the member, and on answers the host did not pay to observe. */
+  childProcessEvidence?: PtyChildProcessVerdict
   verdict?: never
   reason?: never
 }

From 886fcf083f99e22de4b6b45f2ce859a3cbcff221 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 05:06:44 -0700
Subject: [PATCH 17/58] fix(runtime): let a scoped worktree listing report the
 host it could not cover (#18645)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(runtime): let a scoped worktree listing report the host it could not cover

`orca worktree list --repo <id>` passed `[]` as `knownHostIds`, so a scoped
listing could never report a gap — for any host kind, reachable or not. With zero
matched rows both scope lists are empty by construction, and the answer is
`{hostIds: [], omittedHostIds: []}`: byte-identical to a repo that genuinely has
no worktrees. docs/reference/ssh-execution-boundary.md forbids a listing from
implying exactly that.

Measured on one runtime with one refusing SSH host, in the same second:

  unscoped  totalCount 0  omittedHostIds ["local","ssh:<target>"] (+ --host selectors)
  scoped    totalCount 0  hostScope {"hostIds":[],"omittedHostIds":[]}

The same runtime reports nine omitted hosts unscoped and zero scoped against a
live profile, so this is not a subtle inconsistency: it is one runtime giving two
contradictory answers about its own coverage.

A scoped listing now names the one host the caller asked about. That costs
nothing when rows come back — the host lands in `covered`, so it is never
reported omitted — and is the whole answer when they do not. Hosts the caller
scoped out are still never named, which a test pins, because naming them all is
the obvious over-correction.

* test(runtime): pin the scoped host derivation for local and executionHostId repos

Review flagged that the host-scope cases only covered a connectionId repo.
getRepoExecutionHostId reads two spellings, and a scoped listing naming the
wrong host would be worse than naming none, so both are pinned. Both fail with
the fix reverted.
---
 .../runtime-managed-worktree-queries.test.ts  | 120 +++++++++++++++++-
 .../runtime-managed-worktree-queries.ts       |  12 +-
 .../runtime/worktree-listing-host-scope.ts    |  28 +++-
 3 files changed, 151 insertions(+), 9 deletions(-)

diff --git a/src/main/runtime/runtime-managed-worktree-queries.test.ts b/src/main/runtime/runtime-managed-worktree-queries.test.ts
index 01df53cbd1d..3fb792fcc7c 100644
--- a/src/main/runtime/runtime-managed-worktree-queries.test.ts
+++ b/src/main/runtime/runtime-managed-worktree-queries.test.ts
@@ -40,14 +40,18 @@ function metadata(overrides: Partial<WorktreeMeta> = {}): WorktreeMeta {
   }
 }
 
-function queries(store: RuntimeStore): RuntimeManagedWorktreeQueries {
+function queries(
+  store: RuntimeStore,
+  overrides: Partial<ConstructorParameters<typeof RuntimeManagedWorktreeQueries>[0]> = {}
+): RuntimeManagedWorktreeQueries {
   return new RuntimeManagedWorktreeQueries({
     getStore: () => store,
     listResolved: async () => [],
     resolveRepo: async () => store.getRepos()[0]!,
     selectRepos: () => store.getRepos(),
     scanRepo: async () => ({ ok: true, worktrees: [] }),
-    listKnownHostIds: () => []
+    listKnownHostIds: () => [],
+    ...overrides
   })
 }
 
@@ -105,3 +109,115 @@ describe('RuntimeManagedWorktreeQueries.listDetected', () => {
     expect(legacy.worktrees[0]).not.toHaveProperty('visibilitySource')
   })
 })
+
+describe('RuntimeManagedWorktreeQueries.list host scope', () => {
+  // Measured on hardware before this fix, same runtime and same refusing SSH host in the same
+  // second: the UNSCOPED listing reported `omittedHostIds: ["local","ssh:ssh-scope-refused"]` with
+  // `--host` selectors, while the SCOPED listing reported `{"hostIds":[],"omittedHostIds":[]}`.
+  // A listing that covered nothing, reporting no gaps, is indistinguishable from a repo that
+  // genuinely has no worktrees -- the thing docs/reference/ssh-execution-boundary.md forbids.
+  function sshStore(): RuntimeStore {
+    const repo = folderRepo({
+      id: 'repo-ssh',
+      kind: 'git',
+      connectionId: 'conn-1',
+      path: '/home/dev/app'
+    })
+    return {
+      getRepos: () => [repo],
+      getRepo: () => repo,
+      getAllWorktreeMeta: () => ({}),
+      getWorktreeMeta: () => undefined,
+      setWorktreeMeta: vi.fn(),
+      getAllWorktreeLineage: () => ({}),
+      getSettings: () => settings
+    } as unknown as RuntimeStore
+  }
+
+  it('names the scoped repo host as omitted when the listing covered nothing', async () => {
+    const result = await queries(sshStore()).list('repo-ssh', 50)
+
+    expect(result.totalCount).toBe(0)
+    expect(result.hostScope).toEqual({
+      hostIds: [],
+      omittedHostIds: ['ssh:conn-1']
+    })
+  })
+
+  it('does not report the scoped host as omitted once it contributes rows', async () => {
+    const store = sshStore()
+    const result = await queries(store, {
+      listResolved: async () =>
+        [
+          {
+            id: 'repo-ssh::/home/dev/app',
+            repoId: 'repo-ssh',
+            path: '/home/dev/app',
+            hostId: 'ssh:conn-1'
+          }
+        ] as never
+    }).list('repo-ssh', 50)
+
+    expect(result.hostScope?.hostIds).toEqual(['ssh:conn-1'])
+    expect(result.hostScope?.omittedHostIds).toEqual([])
+  })
+
+  // The caller scoped the listing, so the hosts they excluded must not come back as gaps.
+  it('never names a host the caller scoped out', async () => {
+    const scoped = await queries(sshStore(), {
+      listKnownHostIds: () => ['local', 'ssh:other', 'runtime:elsewhere'] as never
+    }).list('repo-ssh', 50)
+
+    expect(scoped.hostScope?.omittedHostIds).toEqual(['ssh:conn-1'])
+  })
+
+  // `getRepoExecutionHostId` derives the host from two spellings, and a scoped listing that named
+  // the wrong one would be worse than naming none. These pin both.
+  it('names the local host for a scoped local repo', async () => {
+    const repo = folderRepo({ id: 'repo-local', kind: 'git', path: '/workspace/local' })
+    const store = {
+      getRepos: () => [repo],
+      getRepo: () => repo,
+      getAllWorktreeMeta: () => ({}),
+      getWorktreeMeta: () => undefined,
+      setWorktreeMeta: vi.fn(),
+      getAllWorktreeLineage: () => ({}),
+      getSettings: () => settings
+    } as unknown as RuntimeStore
+
+    const result = await queries(store).list('repo-local', 50)
+
+    expect(result.hostScope?.omittedHostIds).toEqual(['local'])
+  })
+
+  it('prefers executionHostId over connectionId for the scoped host', async () => {
+    const repo = folderRepo({
+      id: 'repo-runtime',
+      kind: 'git',
+      connectionId: 'conn-legacy',
+      executionHostId: 'runtime:env-1',
+      path: '/workspace/runtime'
+    })
+    const store = {
+      getRepos: () => [repo],
+      getRepo: () => repo,
+      getAllWorktreeMeta: () => ({}),
+      getWorktreeMeta: () => undefined,
+      setWorktreeMeta: vi.fn(),
+      getAllWorktreeLineage: () => ({}),
+      getSettings: () => settings
+    } as unknown as RuntimeStore
+
+    const result = await queries(store).list('repo-runtime', 50)
+
+    expect(result.hostScope?.omittedHostIds).toEqual(['runtime:env-1'])
+  })
+
+  it('still reports every configured host when the listing is unscoped', async () => {
+    const unscoped = await queries(sshStore(), {
+      listKnownHostIds: () => ['local', 'ssh:conn-1'] as never
+    }).list(undefined, 50)
+
+    expect(unscoped.hostScope?.omittedHostIds).toEqual(['local', 'ssh:conn-1'])
+  })
+})
diff --git a/src/main/runtime/runtime-managed-worktree-queries.ts b/src/main/runtime/runtime-managed-worktree-queries.ts
index 5a5812236af..158ab77cdd0 100644
--- a/src/main/runtime/runtime-managed-worktree-queries.ts
+++ b/src/main/runtime/runtime-managed-worktree-queries.ts
@@ -2,7 +2,7 @@ import type { DetectedWorktreeListResult, Worktree } from '../../shared/worktree
 import type { Repo } from '../../shared/repo-types'
 import type { RuntimeWorktreeListResult } from '../../shared/runtime-types'
 import { getRepoExecutionHostId, type ExecutionHostId } from '../../shared/execution-host'
-import { buildWorktreeListingPage } from './worktree-listing-host-scope'
+import { buildWorktreeListingPage, listingKnownHostIds } from './worktree-listing-host-scope'
 import { readWorktreeMetaForHost } from '../persistence/host-qualified-worktree-meta'
 import { getRepoOwnedWorktreeMeta } from '../worktree-metadata-ownership'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
@@ -80,7 +80,7 @@ export class RuntimeManagedWorktreeQueries {
       throw new Error('invalid_limit')
     }
     const resolved = await this.deps.listResolved()
-    const repoId = repoSelector ? (await this.deps.resolveRepo(repoSelector)).id : null
+    const scopedRepo = repoSelector ? await this.deps.resolveRepo(repoSelector) : null
     const pathsByRepo = new Map<string, string[]>()
     for (const worktree of resolved) {
       const paths = pathsByRepo.get(worktree.repoId) ?? []
@@ -100,12 +100,12 @@ export class RuntimeManagedWorktreeQueries {
     )
     const worktrees = resolved.filter(
       (worktree) =>
-        (!repoId || worktree.repoId === repoId) &&
+        (!scopedRepo || worktree.repoId === scopedRepo.id) &&
         this.isVisible(worktree, matchers.get(worktree.repoId), sourceDefaultsSupported)
     )
-    // Why: a `--repo` listing was scoped by the caller, so naming every configured host as
-    // omitted would report a gap the caller deliberately excluded.
-    return buildWorktreeListingPage(worktrees, limit, repoId ? [] : this.deps.listKnownHostIds())
+    // See `listingKnownHostIds`: a scoped listing must still name the host it was asked about.
+    const knownHostIds = listingKnownHostIds(scopedRepo, () => this.deps.listKnownHostIds())
+    return buildWorktreeListingPage(worktrees, limit, knownHostIds)
   }
 
   resolveRepoForConnection(selector: string, connectionId?: string | null): Promise<Repo> {
diff --git a/src/main/runtime/worktree-listing-host-scope.ts b/src/main/runtime/worktree-listing-host-scope.ts
index 99650882670..e499d7faaf3 100644
--- a/src/main/runtime/worktree-listing-host-scope.ts
+++ b/src/main/runtime/worktree-listing-host-scope.ts
@@ -1,4 +1,5 @@
-import type { ExecutionHostId } from '../../shared/execution-host'
+import type { Repo } from '../../shared/repo-types'
+import { getRepoExecutionHostId, type ExecutionHostId } from '../../shared/execution-host'
 import { selectHostBalancedPage } from '../../shared/host-balanced-listing-page'
 import type { RuntimeListingHostScope } from '../../shared/runtime-listing-host-scope'
 
@@ -62,3 +63,28 @@ export function buildWorktreeListingHostScope(args: {
   }
   return { hostIds: [...covered].sort(), omittedHostIds: [...omitted].sort() }
 }
+
+/**
+ * Which hosts a listing claims to have been looking at.
+ *
+ * A `--repo` listing was scoped by the caller, so naming every configured host would report gaps
+ * the caller deliberately excluded. Naming NONE — which is what a scoped listing did before — means
+ * the scope can never report a gap at all, for any host kind, because `covered` and `omitted` are
+ * both derived from the returned rows plus this list. A scoped listing whose scan did not succeed
+ * then answers `{hostIds: [], omittedHostIds: []}`: byte-identical to a repo that genuinely has no
+ * worktrees, which is the one thing docs/reference/ssh-execution-boundary.md forbids a listing from
+ * implying.
+ *
+ * Measured before the fix, on one runtime with one refusing SSH host, in the same second: the
+ * unscoped listing reported `omittedHostIds: ["local", "ssh:<target>"]` while the scoped listing
+ * reported `[]`.
+ *
+ * Naming the single host the caller asked about costs nothing when rows come back — it lands in
+ * `covered`, so it is never reported omitted — and is the whole answer when they do not.
+ */
+export function listingKnownHostIds(
+  scopedRepo: Repo | null,
+  listKnownHostIds: () => Iterable<ExecutionHostId>
+): Iterable<ExecutionHostId> {
+  return scopedRepo ? [getRepoExecutionHostId(scopedRepo)] : listKnownHostIds()
+}

From f7e3af254a5e6d5153be4ccf0ebdf38bbb3dff66 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 05:32:19 -0700
Subject: [PATCH 18/58] fix(pty): close the pseudoconsole and dispose the
 conout worker on Windows self-exit (F24) (#18635)

* fix(pty): close the pseudoconsole when a Windows shell exits by itself

`ClosePseudoConsole` is the only thing that reaps a ConPTY's console host.
node-pty calls it from one place, `PtyKill`, which starts by looking the baton
up by id -- and the exit watcher in `SetupExitCallback` erased that baton the
moment the shell died. So on the self-exit path (typing `exit`, how panes
usually close) the lookup missed, `PtyKill` did nothing at all, and the
pseudoconsole was never closed.

The baton now survives until BOTH the shell has exited and `kill()` has run;
whichever arrives second frees it. `PtyKill` copies `hpc` out under the lock and
closes it afterwards, guards `TerminateProcess` on a shell handle the watcher
may already have closed, and duplicates that handle rather than reordering, so
upstream's close-then-terminate sequence is unchanged.

Measured on Windows 11, 20 self-exit cycles driven exactly as Orca drives them
(`onExit -> destroy()`), handles bucketed by NT object type:

  relay spawn (no useConptyDll)   225 -> 285 (+1 Process +2 File/term)
                            after 219 -> 219  FLAT

  desktop spawn (useConptyDll)    239 -> 439 (+1 Process +2 Thread +5 File/term)
                            after 235 -> 395 (+2 Thread +4 File/term)

The desktop residue is a separate defect in the `useConptyDll` branch of
`WindowsPtyAgent.kill()`, which disposes the conout worker only from an
`_outSocket.on('data')` handler -- and no data arrives after the shell has gone.
Fixing that line as well takes the desktop to 222 -> 222 FLAT, but it lives in
the `kill()` hunk owned by F23, so it is left to that change.

Refs F24.

* fix(pty): dispose the conout worker when a Windows shell exits by itself

Second, independent defect on the same self-exit path, and the larger half of
the desktop's leak. The `useConptyDll` branch of `WindowsPtyAgent.kill()`
disposed the conout worker only from an `_outSocket.on('data')` handler -- and
once the shell has gone no more data ever arrives, so the worker was never
disposed. The non-DLL branch three lines above already disposed unconditionally,
which is why only the desktop (the only spawner that sets `useConptyDll`) hit it.

Measured on Windows 11, 20 cycles, handles bucketed by NT object type, totals:

  self-exit,     relay spawn     225 -> 285   now  219 -> 219  FLAT
  self-exit,     desktop spawn   239 -> 439   now  222 -> 222  FLAT
  explicit kill, relay spawn     225 -> 285   now  219 -> 219  FLAT
  explicit kill, desktop spawn   235 -> 395   now  219 -> 219  FLAT

Neither fix alone is enough on the desktop: the pseudoconsole close is worth
+1 Process +1 File per terminal, this dispose +2 Thread +4 File.

The relay asset (config/relay-assets/node-pty-1.1.0-windows-pty-teardown-patch.cjs)
deliberately gets no counterpart: the relay takes the non-DLL branch, where the
dispose is already unconditional. Its reconstruction table needs the new hunk
though, or un-applying the desktop hunks no longer yields published node-pty.

Taken over from F23 at win-relay-qa's request after they verified that the
desktop never executes the non-DLL branch F23 was scoped around.

Refs F24.

* fix(pty): harden PtyKill against a failed handle duplication and a missing DLL

Both from review of #18635.

DuplicateHandle's result was dropped. On the live explicit-kill path a failed
duplication left hShellDup null, which the guard below could not tell apart from
the self-exit case, so TerminateProcess was skipped and the shell kept running
after its pane closed -- a worse outcome than the handle leak this patch exists
to fix. The failure now terminates through handle->hShell under the lock, where
it is valid and where TerminateProcess does not block. The only cost is that the
rare path kills before the console closes instead of after.

LoadConptyDll is now resolved BEFORE any baton state is touched, matching what
PtyConnect already does for the same reason. It throws when conpty.dll is
missing, and a throw after consoleClosed was set would strand the pseudoconsole
permanently: the retry finds the work claimed and does nothing.

Also corrects three comments the earlier commits made stale:
  - the ptyJobMutex note still said PtyKill reads the table unlocked
  - PtyListJobProcessIds said the baton is gone once the shell exits; it now
    outlives the shell, and the nulled hJob is what makes the answer null
  - windows-pty-job.ts said node-pty drops its handle record on exit

Re-measured on Windows 11 with the rebuilt binary, 20 cycles, all four paths
still flat: self-exit relay 219->219, self-exit desktop 222->222, explicit-kill
relay 219->219, explicit-kill desktop 219->219. Both explicit-kill runs report
22/22 shells exited, so the kill still lands.

Refs F24.
---
 config/patches/node-pty@1.1.0.patch           | 170 +++++++++++++++---
 ...de-pty-windows-pty-teardown-patch.test.mjs |  18 ++
 pnpm-lock.yaml                                |   6 +-
 ...-pty-self-exit-pseudoconsole-close.test.ts | 134 ++++++++++++++
 src/main/windows/windows-pty-job.ts           |   6 +-
 5 files changed, 308 insertions(+), 26 deletions(-)
 create mode 100644 src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts

diff --git a/config/patches/node-pty@1.1.0.patch b/config/patches/node-pty@1.1.0.patch
index ff474f7d95e..8f5045b932a 100644
--- a/config/patches/node-pty@1.1.0.patch
+++ b/config/patches/node-pty@1.1.0.patch
@@ -603,7 +603,7 @@ index 7b4b9e1f990fbf95b51528bb56dc9717f5b87532..2ae787c5bd4f3eba470584dc658a01a5
  }
  #endif
 diff --git a/src/win/conpty.cc b/src/win/conpty.cc
-index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a6a4082ce 100644
+index 7b286d3d644c26141df516929703aa6e129df4b2..4aed260dd68e6a171dcfd349e9a7c5c97209248e 100644
 --- a/src/win/conpty.cc
 +++ b/src/win/conpty.cc
 @@ -18,6 +18,7 @@
@@ -614,7 +614,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  #include <vector>
  #include <Windows.h>
  #include <strsafe.h>
-@@ -44,12 +45,29 @@ struct pty_baton {
+@@ -44,12 +45,39 @@ struct pty_baton {
    HANDLE hOut;
    HPCON hpc;
  
@@ -630,22 +630,32 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
 +  // refused to create or assign one (an outer job without breakaway rights),
 +  // in which case callers fall back to their pre-job behaviour.
 +  HANDLE hJob = nullptr;
++
++  // Orca: teardown needs BOTH the shell's death and an explicit kill() before
++  // the baton can be freed, so each side records that it has run. Whichever
++  // arrives second frees it. Freeing on the shell's death alone -- what this
++  // file did before -- destroyed the only record of `hpc` while
++  // ClosePseudoConsole was still owed, which is why a self-exiting shell
++  // leaked its pseudoconsole and the console host it reaps (#18601 / F24).
++  bool shellExited = false;
++  bool consoleClosed = false;
  
    pty_baton(int _id, HANDLE _hIn, HANDLE _hOut, HPCON _hpc) : id(_id), hIn(_hIn), hOut(_hOut), hpc(_hpc) {};
  };
  
  static std::vector<std::unique_ptr<pty_baton>> ptyHandles;
-+// Orca: guards the job accessors below against the exit watcher thread. It does
-+// NOT make the whole table safe -- PtyResize/PtyClear/PtyKill read it unlocked,
-+// as they always have -- but it closes the window this patch opened, where the
-+// watcher can close hShell/hJob and free the baton between a lookup and its use.
++// Orca: guards the job accessors below, and PtyKill, against the exit watcher
++// thread. It does NOT make the whole table safe -- PtyResize and PtyClear still
++// read it unlocked, as they always have -- but it closes the window this patch
++// opened, where the watcher can close hShell/hJob and free the baton between a
++// lookup and its use.
 +// Handle VALUES are recycled aggressively, so an unguarded read could pass the
 +// shell-pid check against an unrelated process and terminate the wrong job.
 +static std::mutex ptyJobMutex;
  static volatile LONG ptyCounter;
  
  static pty_baton* get_pty_baton(int id) {
-@@ -102,8 +120,27 @@ void SetupExitCallback(Napi::Env env, Napi::Function cb, pty_baton* baton) {
+@@ -102,8 +130,31 @@ void SetupExitCallback(Napi::Env env, Napi::Function cb, pty_baton* baton) {
      // Get process exit code.
      GetExitCodeProcess(baton->hShell, (LPDWORD)(&exit_event->exit_code));
      // Clean up handles
@@ -665,9 +675,13 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
 +      // Why inside the lock: erasing frees the baton the job accessors hold a
 +      // pointer to. Note remove_pty_baton must not be an assert() argument --
 +      // NDEBUG would compile the call away and leak every baton.
-+      const bool removed = remove_pty_baton(baton->id);
-+      assert(removed);
-+      (void)removed;
++      baton->shellExited = true;
++      if (baton->consoleClosed) {
++        const bool removed = remove_pty_baton(baton->id);
++        assert(removed);
++        (void)removed;
++      }
++      // Else PtyKill has not run yet and still owns hpc. It frees the baton.
 +    }
 +    // Why the lock ends here: BlockingCall below waits on the JS thread, and the
 +    // JS thread can be waiting on ptyJobMutex inside PtyTerminateJob. Holding
@@ -675,7 +689,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  
      auto status = tsfn.BlockingCall(exit_event, callback); // In main thread
      switch (status) {
-@@ -409,6 +446,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -409,6 +460,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
      throw errorWithCode(info, "UpdateProcThreadAttribute failed");
    }
  
@@ -691,7 +705,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
    PROCESS_INFORMATION piClient{};
    fSuccess = !!CreateProcessW(
        nullptr,
-@@ -416,7 +462,10 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -416,7 +476,10 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
        nullptr,                      // lpProcessAttributes
        nullptr,                      // lpThreadAttributes
        false,                        // bInheritHandles VERY IMPORTANT that this is false
@@ -703,7 +717,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
        envArg,                       // lpEnvironment
        mutableCwd.get(),             // lpCurrentDirectory
        &siEx.StartupInfo,            // lpStartupInfo
-@@ -426,8 +475,47 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -426,8 +489,47 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
      throw errorWithCode(info, "Cannot create process");
    }
  
@@ -753,7 +767,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
    if (useConptyDll && fLoadedDll)
    {
      PFNRELEASEPSEUDOCONSOLE const pfnReleasePseudoConsole = (PFNRELEASEPSEUDOCONSOLE)GetProcAddress(
-@@ -440,6 +528,8 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -440,6 +542,8 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
  
    // Update handle
    handle->hShell = piClient.hProcess;
@@ -762,7 +776,91 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  
    // Close the thread handle to avoid resource leak
    CloseHandle(piClient.hThread);
-@@ -567,6 +657,143 @@ static Napi::Value PtyKill(const Napi::CallbackInfo& info) {
+@@ -544,29 +648,215 @@ static Napi::Value PtyKill(const Napi::CallbackInfo& info) {
+   int id = info[0].As<Napi::Number>().Int32Value();
+   const bool useConptyDll = info[1].As<Napi::Boolean>().Value();
+ 
+-  const pty_baton* handle = get_pty_baton(id);
++  // Orca: resolve the DLL BEFORE touching any baton state, for the same reason
++  // PtyConnect does it before creating anything. LoadConptyDll throws when
++  // conpty.dll is missing, and a throw after consoleClosed was set would strand
++  // the pseudoconsole permanently: the retry would find the work already
++  // claimed and do nothing. Only the useConptyDll path can throw here; the
++  // other returns kernel32.
++  HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
++  PFNCLOSEPSEUDOCONSOLE pfnClosePseudoConsole = nullptr;
++  if (hLibrary != nullptr) {
++    pfnClosePseudoConsole = (PFNCLOSEPSEUDOCONSOLE)GetProcAddress(
++      (HMODULE)hLibrary,
++      useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
++  }
+ 
+-  if (handle != nullptr) {
+-    HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
+-    bool fLoadedDll = hLibrary != nullptr;
+-    if (fLoadedDll)
+-    {
+-      PFNCLOSEPSEUDOCONSOLE const pfnClosePseudoConsole = (PFNCLOSEPSEUDOCONSOLE)GetProcAddress(
+-        (HMODULE)hLibrary,
+-        useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
+-      if (pfnClosePseudoConsole)
+-      {
+-        pfnClosePseudoConsole(handle->hpc);
++  // Orca: the baton now outlives the shell, so this runs on a self-exited pty
++  // too -- that is the whole point. Take what we need under the lock: the
++  // watcher thread nulls hShell the moment the shell dies, and TerminateProcess
++  // on a handle it just closed is an invalid-handle operation. Duplicating
++  // rather than reordering keeps upstream's close-then-terminate sequence.
++  HPCON hpc = nullptr;
++  HANDLE hShellDup = nullptr;
++  bool owed = false;
++  {
++    std::lock_guard<std::mutex> guard(ptyJobMutex);
++    pty_baton* handle = get_pty_baton(id);
++    // Why the consoleClosed check: a second kill() would otherwise close the
++    // same pseudoconsole twice. Upstream relied on the baton being gone.
++    if (handle != nullptr && !handle->consoleClosed) {
++      hpc = handle->hpc;
++      owed = true;
++      handle->consoleClosed = true;
++      // Null hShell means a self-exited pty, where there is nothing to kill.
++      if (useConptyDll && handle->hShell != nullptr) {
++        if (!DuplicateHandle(GetCurrentProcess(), handle->hShell, GetCurrentProcess(),
++                             &hShellDup, 0, FALSE, DUPLICATE_SAME_ACCESS)) {
++          // Why terminate here instead of skipping: a failed duplication leaves
++          // hShellDup null, which is indistinguishable from the self-exit case,
++          // and skipping would leave the shell RUNNING after its pane closed --
++          // a worse outcome than the leak this all exists to fix. hShell is
++          // valid under this lock and TerminateProcess does not block, so the
++          // only cost is that this rare path kills before the console closes.
++          hShellDup = nullptr;
++          TerminateProcess(handle->hShell, 1);
++        }
++      }
++      if (handle->shellExited) {
++        const bool removed = remove_pty_baton(id);
++        assert(removed);
++        (void)removed;
+       }
++      // Else the shell is still running and the watcher frees the baton.
+     }
+-    if (useConptyDll) {
+-      TerminateProcess(handle->hShell, 1);
++  }
++
++  // Why outside the lock: ClosePseudoConsole blocks until the conout side has
++  // drained, and the watcher must be able to take the lock while it does.
++  if (owed) {
++    if (pfnClosePseudoConsole)
++    {
++      pfnClosePseudoConsole(hpc);
++    }
++    if (hShellDup != nullptr) {
++      TerminateProcess(hShellDup, 1);
++      CloseHandle(hShellDup);
+     }
+   }
+ 
    return env.Undefined();
  }
  
@@ -808,9 +906,11 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
 + * Orca: the pids still alive in this pty's tree, straight from the kernel.
 + *
 + * Descendant liveness for a tree that is still tracked, including children that
-+ * detached from the console. Once the shell exits the baton is gone, so this
-+ * returns null rather than an empty list -- null means "no answer", never
-+ * "they died". Also returns null when no job was assigned.
++ * detached from the console. Once the shell exits the watcher nulls hJob, which
++ * ownsShell rejects, so this returns null rather than an empty list -- null
++ * means "no answer", never "they died". (The baton itself now outlives the
++ * shell, until kill() runs; hJob is what makes the answer null.) Also returns
++ * null when no job was assigned.
 + *
 + * Does not include the ConPTY console host: CreatePseudoConsole spawns it
 + * before this job exists, so it is not a member and ClosePseudoConsole is what
@@ -906,7 +1006,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  /**
  * Init
  */
-@@ -577,6 +804,9 @@ Napi::Object init(Napi::Env env, Napi::Object exports) {
+@@ -577,6 +867,9 @@ Napi::Object init(Napi::Env env, Napi::Object exports) {
    exports.Set("resize", Napi::Function::New(env, PtyResize));
    exports.Set("clear", Napi::Function::New(env, PtyClear));
    exports.Set("kill", Napi::Function::New(env, PtyKill));
@@ -917,7 +1017,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..ec6bf3932c65b89c013ff133dc6bf46a
  };
  
 diff --git a/lib/windowsPtyAgent.js b/lib/windowsPtyAgent.js
-index a358ffb..fb3a96f 100644
+index a358ffb177357e177661033c1b092f9c9d0e5f5a..26c2a4c58799ce649f5113131e4c52f7ed2d87ad 100644
 --- a/lib/windowsPtyAgent.js
 +++ b/lib/windowsPtyAgent.js
 @@ -136,6 +136,9 @@ var WindowsPtyAgent = /** @class */ (function () {
@@ -930,6 +1030,20 @@ index a358ffb..fb3a96f 100644
                  this._outSocket.readable = false;
                  this._getConsoleProcessList().then(function (consoleProcessList) {
                      consoleProcessList.forEach(function (pid) {
+@@ -154,9 +157,10 @@ var WindowsPtyAgent = /** @class */ (function () {
+                 // Close the input write handle to signal the end of session.
+                 this._inSocket.destroy();
+                 this._ptyNative.kill(this._pty, this._useConptyDll);
+-                this._outSocket.on('data', function () {
+-                    _this._conoutSocketWorker.dispose();
+-                });
++                // Orca: dispose unconditionally, as the non-DLL branch above does.
++                // Waiting for another 'data' event leaks the conout worker on every
++                // self-exiting shell, because no more data ever arrives (F24).
++                this._conoutSocketWorker.dispose();
+             }
+         }
+         else {
 diff --git a/lib/windowsTerminal.js b/lib/windowsTerminal.js
 index 3c38f89..e20b3e6 100644
 --- a/lib/windowsTerminal.js
@@ -1015,7 +1129,7 @@ index 3c38f89..e20b3e6 100644
 \ No newline at end of file
 +//# sourceMappingURL=windowsTerminal.js.map
 diff --git a/src/windowsPtyAgent.ts b/src/windowsPtyAgent.ts
-index d705444..ce611b8 100644
+index d7054449516f0c9a62af351c2caa17331206d530..0c28a32e2e1db2b3f208ddde8443cd4e67bb1ad6 100644
 --- a/src/windowsPtyAgent.ts
 +++ b/src/windowsPtyAgent.ts
 @@ -143,6 +143,9 @@ export class WindowsPtyAgent {
@@ -1028,6 +1142,20 @@ index d705444..ce611b8 100644
          this._outSocket.readable = false;
          this._getConsoleProcessList().then(consoleProcessList => {
            consoleProcessList.forEach((pid: number) => {
+@@ -159,9 +162,10 @@ export class WindowsPtyAgent {
+         // Close the input write handle to signal the end of session.
+         this._inSocket.destroy();
+         (this._ptyNative as IConptyNative).kill(this._pty, this._useConptyDll);
+-        this._outSocket.on('data', () => {
+-          this._conoutSocketWorker.dispose();
+-        });
++        // Orca: dispose unconditionally, as the non-DLL branch above does.
++        // Waiting for another 'data' event leaks the conout worker on every
++        // self-exiting shell, because no more data ever arrives (F24).
++        this._conoutSocketWorker.dispose();
+       }
+     } else {
+       // Because pty.kill closes the handle, it will kill most processes by itself.
 diff --git a/src/windowsTerminal.ts b/src/windowsTerminal.ts
 index 13f6c6d..eda63c8 100644
 --- a/src/windowsTerminal.ts
diff --git a/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs b/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs
index 380cdd44c01..64fb1b056b8 100644
--- a/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs
+++ b/config/scripts/node-pty-windows-pty-teardown-patch.test.mjs
@@ -38,6 +38,24 @@ const DESKTOP_HUNKS = {
         '                this._outSocket.readable = false;',
         ''
       ].join('\n')
+    ],
+    // The useConptyDll branch, which only the DESKTOP runs -- the relay takes the
+    // non-DLL branch above, where the dispose is already unconditional. Listed here
+    // so un-applying still yields published; the relay asset needs no counterpart.
+    [
+      [
+        '                // Orca: dispose unconditionally, as the non-DLL branch above does.',
+        "                // Waiting for another 'data' event leaks the conout worker on every",
+        '                // self-exiting shell, because no more data ever arrives (F24).',
+        '                this._conoutSocketWorker.dispose();',
+        ''
+      ].join('\n'),
+      [
+        "                this._outSocket.on('data', function () {",
+        '                    _this._conoutSocketWorker.dispose();',
+        '                });',
+        ''
+      ].join('\n')
     ]
   ],
   'windowsTerminal.js': [
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a045833577f..d7481f2e556 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -116,7 +116,7 @@ patchedDependencies:
   '@xterm/addon-webgl@0.20.0-beta.299': 94687e89a0115e6e6aa102837f986debdc029c091527ee5eb4a4e17ceaf9473e
   '@xterm/xterm@6.1.0-beta.303': 98756bcedc402bcdb7c6ab7b015d2e59cd18e97b03a2c06a27e95bb3ba429d9d
   lint-staged@16.4.0: 7333b3837f80a7fbd045964db6d76ba4fc118e49134bdbabb00585b6b7b60673
-  node-pty@1.1.0: e262847f57a1d4d3f2287a843822f7dcf3c9d8655892b07a69eba464e1317eaa
+  node-pty@1.1.0: 7cc9d45f3d2c38f142490d0805e75db55f0eef5174ad41c4b52abc5fbe079ad1
 
 importers:
 
@@ -157,7 +157,7 @@ importers:
         version: 3.3.1
       node-pty:
         specifier: ^1.1.0
-        version: 1.1.0(patch_hash=e262847f57a1d4d3f2287a843822f7dcf3c9d8655892b07a69eba464e1317eaa)
+        version: 1.1.0(patch_hash=7cc9d45f3d2c38f142490d0805e75db55f0eef5174ad41c4b52abc5fbe079ad1)
       posthog-node:
         specifier: ^5.33.3
         version: 5.33.3
@@ -12195,7 +12195,7 @@ snapshots:
 
   node-int64@0.4.0: {}
 
-  node-pty@1.1.0(patch_hash=e262847f57a1d4d3f2287a843822f7dcf3c9d8655892b07a69eba464e1317eaa):
+  node-pty@1.1.0(patch_hash=7cc9d45f3d2c38f142490d0805e75db55f0eef5174ad41c4b52abc5fbe079ad1):
     dependencies:
       node-addon-api: 7.1.1
 
diff --git a/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
new file mode 100644
index 00000000000..5f19772530a
--- /dev/null
+++ b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
@@ -0,0 +1,134 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * A shell that exits by itself must still close its pseudoconsole.
+ *
+ * `ClosePseudoConsole` is the only thing that reaps a ConPTY's console host —
+ * Orca's own job-ownership patch says so, because `CreatePseudoConsole` spawns
+ * that host before the per-pty job exists and it is therefore not a job member.
+ * Upstream node-pty calls it from exactly one place, `PtyKill`, which begins by
+ * looking the baton up by id — and the exit watcher in `SetupExitCallback`
+ * erased the baton the moment the shell died. So on the self-exit path (typing
+ * `exit`, which is how panes usually close) that lookup missed, `PtyKill` did
+ * nothing at all, and the pseudoconsole was never closed.
+ *
+ * There is a SECOND, independent defect on the same path: the `useConptyDll`
+ * branch of `WindowsPtyAgent.kill()` disposed the conout worker only from an
+ * `_outSocket.on('data')` handler, and no more data arrives once the shell has
+ * gone — so that worker leaked too. The non-DLL branch beside it already
+ * disposed unconditionally. The desktop always sets `useConptyDll`, so it hit
+ * both; the relay sets neither and hit only the first.
+ *
+ * Measured on Windows 11 / awin, 20 cycles, handles bucketed by NT object type,
+ * totals before -> after:
+ *
+ *   self-exit,     relay spawn     225 -> 285   becomes  219 -> 219  FLAT
+ *   self-exit,     desktop spawn   239 -> 439   becomes  222 -> 222  FLAT
+ *   explicit kill, relay spawn     225 -> 285   becomes  219 -> 219  FLAT
+ *   explicit kill, desktop spawn   235 -> 395   becomes  219 -> 219  FLAT
+ *
+ * Neither fix alone is enough on the desktop: the pseudoconsole close is worth
+ * +1 Process +1 File per terminal, the dispose +2 Thread +4 File.
+ *
+ * WHY THIS IS A PATCH-CONTENT PIN AND NOT A BEHAVIOURAL TEST: the defect is
+ * only observable as a per-NT-type handle count, which needs
+ * `NtQuerySystemInformation(SystemExtendedHandleInformation)`. Nothing in the
+ * repo can read that, and the cheaper Windows-observable proxies do not
+ * discriminate — the console host process is reaped either way (the leak is a
+ * handle to an already-exited object, not an orphaned process), and the
+ * `\\.\pipe\conpty-*` entries disappear either way. Both were measured and
+ * rejected as assertions rather than assumed. So this pins the mechanism
+ * instead, which is the real risk: a future resync of the vendored patch
+ * silently dropping the hunk.
+ */
+
+const PATCH = readFileSync(join(__dirname, '../../../config/patches/node-pty@1.1.0.patch'), 'utf8')
+
+describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
+  it('does not let the exit watcher free the baton while the close is still owed', () => {
+    // Pinned as one block: the erase must stay INSIDE the consoleClosed guard.
+    // Upstream ran it unconditionally, which is the line that caused the leak,
+    // and a resync that re-flattens this is the failure mode worth catching.
+    expect(PATCH).toContain(
+      [
+        '+      baton->shellExited = true;',
+        '+      if (baton->consoleClosed) {',
+        '+        const bool removed = remove_pty_baton(baton->id);',
+        '+        assert(removed);',
+        '+        (void)removed;',
+        '+      }'
+      ].join('\n')
+    )
+  })
+
+  it('closes the pseudoconsole from PtyKill even after the shell has exited', () => {
+    // hpc is copied out under the lock, so the close survives the baton's removal.
+    expect(PATCH).toContain('+      hpc = handle->hpc;')
+    expect(PATCH).toContain('+      pfnClosePseudoConsole(hpc);')
+  })
+
+  it('resolves the ConPTY DLL before it claims the close', () => {
+    // LoadConptyDll throws when conpty.dll is missing. Throwing after
+    // consoleClosed was set would strand the pseudoconsole for good: the retry
+    // finds the work claimed and does nothing.
+    const dllResolve = PATCH.indexOf('+  HANDLE hLibrary = LoadConptyDll(info, useConptyDll);')
+    const claim = PATCH.indexOf('+      handle->consoleClosed = true;')
+    expect(dllResolve).toBeGreaterThan(-1)
+    expect(claim).toBeGreaterThan(-1)
+    expect(dllResolve).toBeLessThan(claim)
+  })
+
+  it('reaches hShell only under the null check the watcher can trip', () => {
+    // Pinned as one block. The watcher nulls hShell on exit, and upstream
+    // dereferenced it unconditionally; every remaining use — the duplication and
+    // the failure fallback below it — must stay inside this guard.
+    const guarded = PATCH.slice(
+      PATCH.indexOf('+      if (useConptyDll && handle->hShell != nullptr) {'),
+      PATCH.indexOf('+      if (handle->shellExited) {')
+    )
+    expect(guarded).not.toBe('')
+    expect(guarded).toContain('DuplicateHandle(GetCurrentProcess(), handle->hShell')
+    expect(guarded).toContain('TerminateProcess(handle->hShell, 1);')
+    // No ADDED line outside that guard may terminate through hShell. Removed
+    // (`-`) lines still carry upstream's unguarded call, which is the point.
+    const strayAdds = PATCH.replace(guarded, '')
+      .split('\n')
+      .filter((line) => line.startsWith('+') && line.includes('TerminateProcess(handle->hShell'))
+    expect(strayAdds).toEqual([])
+  })
+
+  it('still kills the shell when DuplicateHandle fails', () => {
+    // A null hShellDup is indistinguishable from the self-exit case, so a
+    // swallowed failure would leave the shell running after its pane closed —
+    // a worse outcome than the leak this patch exists to fix.
+    expect(PATCH).toContain(
+      [
+        '+          hShellDup = nullptr;',
+        '+          TerminateProcess(handle->hShell, 1);',
+        '+        }'
+      ].join('\n')
+    )
+  })
+
+  it('keeps the close idempotent so a second kill cannot double-close', () => {
+    expect(PATCH).toContain('+    if (handle != nullptr && !handle->consoleClosed) {')
+    expect(PATCH).toContain('+      handle->consoleClosed = true;')
+  })
+})
+
+describe('node-pty patch: conout worker disposal on the self-exit path', () => {
+  // The desktop's larger half: 8 of its 10 leaked handles per terminal.
+  it('disposes the conout worker unconditionally in the useConptyDll branch', () => {
+    expect(PATCH).toContain('+                this._conoutSocketWorker.dispose();')
+    // The data handler is what never fired once the shell had gone.
+    expect(PATCH).toContain("-                this._outSocket.on('data', function () {")
+    expect(PATCH).toContain('-                    _this._conoutSocketWorker.dispose();')
+  })
+
+  it('applies the same change to the TypeScript source the patch also carries', () => {
+    expect(PATCH).toContain('+        this._conoutSocketWorker.dispose();')
+    expect(PATCH).toContain("-        this._outSocket.on('data', () => {")
+  })
+})
diff --git a/src/main/windows/windows-pty-job.ts b/src/main/windows/windows-pty-job.ts
index 193b1d8825a..169db375f3b 100644
--- a/src/main/windows/windows-pty-job.ts
+++ b/src/main/windows/windows-pty-job.ts
@@ -118,8 +118,10 @@ export function terminatePtyJob(proc: IPty): JobTerminationOutcome {
 /**
  * Pids still alive in a PTY's tree, or null when there is no answer.
  *
- * Measured on Windows 11: once the shell exits, node-pty drops its handle
- * record and closes the job, so a terminated tree reports **null**, not `[]`.
+ * Measured on Windows 11: once the shell exits, node-pty closes the job, so a
+ * terminated tree reports **null**, not `[]`. (Its handle record now outlives
+ * the shell until `kill()` runs — see config/patches/node-pty@1.1.0.patch — but
+ * the nulled job handle is what makes the answer null either way.)
  * Null therefore means "unverifiable" in the sense of
  * docs/reference/ssh-execution-boundary.md — this build has no job support,
  * the terminal is not a ConPTY, or it is no longer tracked. It is never

From a5c6f402f4e6fe85a7f92960eefb314e5fe9fd45 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 4 Sep 2026 12:37:10 +0000
Subject: [PATCH 19/58] Update README downloads badge

---
 docs/assets/readme-downloads.svg | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/assets/readme-downloads.svg b/docs/assets/readme-downloads.svg
index ef8ebb61bb4..c240c965fee 100644
--- a/docs/assets/readme-downloads.svg
+++ b/docs/assets/readme-downloads.svg
@@ -1,5 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 38m">
-  <title>downloads: 38m</title>
+<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 39m">
+  <title>downloads: 39m</title>
   <linearGradient id="s" x2="0" y2="100%">
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
     <stop offset="1" stop-opacity=".1"/>
@@ -15,7 +15,7 @@
   <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="11">
     <text x="37" y="15" fill="#010101" fill-opacity=".3">downloads</text>
     <text x="37" y="14">downloads</text>
-    <text x="90" y="15" fill="#010101" fill-opacity=".3">38m</text>
-    <text x="90" y="14">38m</text>
+    <text x="90" y="15" fill="#010101" fill-opacity=".3">39m</text>
+    <text x="90" y="14">39m</text>
   </g>
 </svg>

From 14e4031948f51251c6ae3e329cf3cf276ef39e40 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 06:08:33 -0700
Subject: [PATCH 20/58] test(pty): make the F24 patch pins catch the
 regressions they name (#18660)

Two of the pins added in #18635 did not discriminate. Found by review of the
merged change; both are test-only defects, the fix itself is unaffected.

`resolves the ConPTY DLL before it claims the close` searched the whole patch
for `HANDLE hLibrary = LoadConptyDll(info, useConptyDll);`. That line occurs
twice -- PtyConnect's copy comes first -- so indexOf always matched PtyConnect,
and the ordering assertion held no matter where PtyKill resolved the DLL.
Verified by simulation: moving PtyKill's resolve back below the claim left the
suite green.

`reaches hShell only under the null check` used a marker as a slice END bound
without checking it existed. If that marker vanished the slice ran to the end of
the patch, the stray-line filter found nothing, and the test passed silently.

Both now anchor inside the PtyKill hunk only, located by its header's function
context rather than line numbers. `indexIn` throws on a missing marker instead
of returning -1, so a marker that moves fails the assertion that depends on it
rather than making it vacuous.

Adds the pin that was missing entirely: PtyKill's half of the two-sided baton
free. Without it a self-exit followed by kill() -- the ordinary pane close --
leaks one baton and one entry in the vector get_pty_baton scans linearly.

Mutation-tested rather than only revert-tested, because wholesale reverting the
patch is what hid this: it fails every assertion for the trivial reason that
nothing matches. Simulating each specific regression instead:
  - move PtyKill's DLL resolve below the claim -> 1 failed (was: 0)
  - drop PtyKill's baton free, line-count-neutral -> 2 failed (was: 0)
Wholesale revert still fails all 9.

Refs F24.
---
 ...-pty-self-exit-pseudoconsole-close.test.ts | 64 ++++++++++++++++---
 1 file changed, 55 insertions(+), 9 deletions(-)

diff --git a/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
index 5f19772530a..1f9cae275c3 100644
--- a/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
+++ b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
@@ -46,6 +46,35 @@ import { describe, expect, it } from 'vitest'
 
 const PATCH = readFileSync(join(__dirname, '../../../config/patches/node-pty@1.1.0.patch'), 'utf8')
 
+/**
+ * Just the `PtyKill` hunk. Several markers below also occur in the `PtyConnect`
+ * hunk above it, and a bare `indexOf` on the whole patch silently matched the
+ * wrong one — an assertion that then held regardless of what `PtyKill` did.
+ */
+const ptyKillHunk = (() => {
+  // Anchored on the hunk header's function context rather than its line
+  // numbers, which shift whenever anything above it in the patch changes.
+  const header = /^@@ .* @@ static Napi::Value PtyKill\(.*$/m.exec(PATCH)
+  if (!header) {
+    throw new Error('no PtyKill hunk in config/patches/node-pty@1.1.0.patch')
+  }
+  const from = header.index
+  const next = PATCH.indexOf('\n@@ ', from + 1)
+  return PATCH.slice(from, next === -1 ? undefined : next)
+})()
+
+/**
+ * `indexOf` that throws instead of returning -1. A missing marker must fail the
+ * assertion that depends on it, not quietly make a slice or comparison vacuous.
+ */
+function indexIn(haystack: string, marker: string): number {
+  const at = haystack.indexOf(marker)
+  if (at === -1) {
+    throw new Error(`marker not found in the PtyKill hunk: ${marker}`)
+  }
+  return at
+}
+
 describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
   it('does not let the exit watcher free the baton while the close is still owed', () => {
     // Pinned as one block: the erase must stay INSIDE the consoleClosed guard.
@@ -73,10 +102,15 @@ describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
     // LoadConptyDll throws when conpty.dll is missing. Throwing after
     // consoleClosed was set would strand the pseudoconsole for good: the retry
     // finds the work claimed and does nothing.
-    const dllResolve = PATCH.indexOf('+  HANDLE hLibrary = LoadConptyDll(info, useConptyDll);')
-    const claim = PATCH.indexOf('+      handle->consoleClosed = true;')
-    expect(dllResolve).toBeGreaterThan(-1)
-    expect(claim).toBeGreaterThan(-1)
+    //
+    // Anchored inside PtyKill, not by a bare indexOf: the identical line also
+    // appears in the PtyConnect hunk, earlier in the file, and matching that one
+    // made this assertion pass no matter where PtyKill resolved the DLL.
+    const dllResolve = indexIn(
+      ptyKillHunk,
+      '+  HANDLE hLibrary = LoadConptyDll(info, useConptyDll);'
+    )
+    const claim = indexIn(ptyKillHunk, '+      handle->consoleClosed = true;')
     expect(dllResolve).toBeLessThan(claim)
   })
 
@@ -84,11 +118,9 @@ describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
     // Pinned as one block. The watcher nulls hShell on exit, and upstream
     // dereferenced it unconditionally; every remaining use — the duplication and
     // the failure fallback below it — must stay inside this guard.
-    const guarded = PATCH.slice(
-      PATCH.indexOf('+      if (useConptyDll && handle->hShell != nullptr) {'),
-      PATCH.indexOf('+      if (handle->shellExited) {')
-    )
-    expect(guarded).not.toBe('')
+    const start = indexIn(ptyKillHunk, '+      if (useConptyDll && handle->hShell != nullptr) {')
+    const end = indexIn(ptyKillHunk, '+      if (handle->shellExited) {')
+    const guarded = ptyKillHunk.slice(start, end)
     expect(guarded).toContain('DuplicateHandle(GetCurrentProcess(), handle->hShell')
     expect(guarded).toContain('TerminateProcess(handle->hShell, 1);')
     // No ADDED line outside that guard may terminate through hShell. Removed
@@ -99,6 +131,20 @@ describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
     expect(strayAdds).toEqual([])
   })
 
+  it('frees the baton from PtyKill when the shell has already exited', () => {
+    // The other half of the two-sided handshake. Without it a self-exit followed
+    // by kill() — the ordinary pane close — leaks one baton and one entry in the
+    // vector get_pty_baton scans linearly, forever.
+    expect(ptyKillHunk).toContain(
+      [
+        '+      if (handle->shellExited) {',
+        '+        const bool removed = remove_pty_baton(id);',
+        '+        assert(removed);',
+        '+        (void)removed;'
+      ].join('\n')
+    )
+  })
+
   it('still kills the shell when DuplicateHandle fails', () => {
     // A null hShellDup is indistinguishable from the self-exit case, so a
     // swallowed failure would leave the shell running after its pane closed —

From 0d2375a7ff2c805238a4467d7eba2198b3a45d36 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 06:09:07 -0700
Subject: [PATCH 21/58] fix(remote): stop a disclosure list latching the mirror
 completeness gate (#18619)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(remote): stop a disclosure list latching the mirror completeness gate

`hostScope.omittedHostIds` was doing two jobs with opposite requirements. As
disclosure it must over-name: `omitted-host-scope-selectors.ts` deliberately
keeps ids for servers that are no longer paired so a caller can still see the
gap, and `docs/reference/ssh-execution-boundary.md` requires a listing to name
what it did not cover. As a completeness gate it must name only coverage that
was owed and not delivered, or it latches.

It latched. `workspaceSessionsByHostId` keeps a partition for every runtime a
machine has ever paired with and nothing prunes it, and a mirrored `remote:` row
names its peer too — so any client that has ever paired outward publishes a
permanently non-empty `omittedHostIds`. `probeHostLiveTerminals` read that as
`unverifiable`, `markHostSessionMirrorHydrated` never fired, and panes parked on
`parkUntilHostSessionMirrorHydrates` never drained.

`hostScopeCensusIsComplete` gives the gate its own answer and leaves the
disclosure list alone. A `runtime:` host is never owed coverage by the runtime
answering: a paired runtime is a peer with its own control plane reached with
`--environment`, and there is no paired-runtime PTY provider for this runtime to
have queried. Two other branches stay load-bearing — an absent scope is a host
too old to claim one, and a listing that covered no host proves nothing.

No wire change: the host publishes byte-identical content and only the client's
reading moves, so this reaches the reporter by updating their client alone
rather than waiting for their remote. That also avoids a new field's fallback
rule, where "absent means complete" would recreate the bug with the polarity
flipped.

`queried-host-kinds.test.ts` pins the invariant the predicate rests on at its
source, because the consolidation moving the SSH path onto orcad is the change
most likely to introduce a runtime-backed PTY provider and quietly invalidate it.

Fixes #18595

* test(remote): pin the orphan-recovery host-scope gate and narrow the invariant claim

The readiness review found the second gate unpinned: reverting
`web-session-terminal-orphan-recovery-inventory.ts` alone to the pre-PR
expression left the whole renderer suite green, because every existing fixture
passes `omittedHostIds: []`. The commit claimed two gates and proved one.

Four cases now drive `resolveTerminalOrphanInventory` through a non-empty scope.
Reverting that gate alone fails the peer-runtime case. Note the absent-scope case
deletes the key rather than passing `undefined`, because `listResult` substitutes
its default for `undefined` — routing through the fixture there silently tests
the default instead.

`queried-host-kinds.test.ts` also claimed more than it caught: a runtime-backed
transport registered under an SSH connection id reports as `ssh:` and passes,
which is the shape the orcad consolidation is expected to take. It pins the
spelling this function emits, which is what the gate keys on, and now says so.

* fix(remote): require a legible covered host before believing a census

CodeRabbit found a real asymmetry: the predicate refused an omitted host id it
could not parse, but accepted an unparseable *covered* id as proof of coverage.
`isTerminalListResult` validates only that `hostIds` is an array, so
`{hostIds: ['runtime:'], omittedHostIds: ['runtime:env-7']}` was `unverifiable`
before this PR and would have become `complete` after it.

Taken as "at least one legible covered host" rather than the suggested "every id
parses". A host that later gains a kind this client cannot parse would otherwise
report an incomplete census forever — which is this bug in a new coat, and the
failure mode the predicate exists to prevent.

The check exposed four tests publishing `hostIds: ['remote-runtime']`, a bare
environment id that `parseExecutionHostId` rejects. No host emits that: a runtime
answering `terminal.list` names the execution hosts it covered, which is `local`
— verified against a live paired runtime. Those fixtures are corrected to the
shape the wire actually carries, which is why the assertions move.
---
 .../pty/runtime/queried-host-kinds.test.ts    | 60 ++++++++++++
 ...nal-orphan-recovery-regression-fixtures.ts |  4 +-
 .../src/runtime/host-live-terminal-probe.ts   |  9 +-
 ...sion-mirror-empty-inventory-settle.test.ts | 83 ++++++++++++++++
 ...al-orphan-recovery-host-scope-gate.test.ts | 98 +++++++++++++++++++
 ...sion-terminal-orphan-recovery-inventory.ts |  7 +-
 ...n-terminal-pending-handle-recovery.test.ts | 10 +-
 src/shared/runtime-listing-host-scope.test.ts | 81 +++++++++++++++
 src/shared/runtime-listing-host-scope.ts      | 31 +++++-
 9 files changed, 370 insertions(+), 13 deletions(-)
 create mode 100644 src/main/ipc/pty/runtime/queried-host-kinds.test.ts
 create mode 100644 src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts
 create mode 100644 src/shared/runtime-listing-host-scope.test.ts

diff --git a/src/main/ipc/pty/runtime/queried-host-kinds.test.ts b/src/main/ipc/pty/runtime/queried-host-kinds.test.ts
new file mode 100644
index 00000000000..1f7ce2459d8
--- /dev/null
+++ b/src/main/ipc/pty/runtime/queried-host-kinds.test.ts
@@ -0,0 +1,60 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { parseExecutionHostId } from '../../../../shared/execution-host'
+import { sshProviders } from '../provider/registry'
+import { listProcessesWithHostScopeFromRuntimeController } from './inventory-operations'
+import type { PtyRuntimeControllerDeps } from './controller-deps'
+
+/**
+ * `hostScopeCensusIsComplete` discounts a `runtime:` host in `omittedHostIds` on the strength of
+ * one fact about this process: it has no paired-runtime PTY provider, so it never queried that
+ * host and never owed it coverage. This file pins the producer side of that fact.
+ *
+ * What it catches: a new branch here that spells a queried host `runtime:`. Every id this
+ * function emits is built by `toSshExecutionHostId` or is `LOCAL_EXECUTION_HOST_ID`, so a third
+ * shape is the observable form of "a runtime host can now answer an inventory" — at which point
+ * the client predicate would start calling a genuine gap complete.
+ *
+ * What it does NOT catch, so do not lean on it: a runtime-backed transport registered under an
+ * SSH connection id still reports as `ssh:` and passes, which is fine — the predicate only
+ * discounts the `runtime:` spelling. The consolidation moving the SSH path onto orcad is expected
+ * to look exactly like that. The other route into `queriedHostIds` is separately fenced to
+ * `kind === 'ssh'` in `orca-runtime-refresh-pty-worktree-records-with-controller-inventory.ts`.
+ */
+describe('the hosts a PTY inventory can report having queried', () => {
+  afterEach(() => {
+    sshProviders.clear()
+  })
+
+  it('emits only local and ssh spellings, never a paired-runtime one', async () => {
+    const listProcesses = vi.fn(async () => [])
+    sshProviders.set('box-1', { listProcesses } as never)
+    // A connection id shaped like an environment uuid still has to come back `ssh:`; the spelling
+    // is what the gate keys on, so a `runtime:` id appearing here is the breakage that matters.
+    sshProviders.set('a2478221-1d5c-4603-b8bf-b6b728eac9df', { listProcesses } as never)
+
+    const { hostIds } = await listProcessesWithHostScopeFromRuntimeController({
+      runtime: null
+    } as unknown as PtyRuntimeControllerDeps)
+
+    expect(hostIds).toContain('ssh:a2478221-1d5c-4603-b8bf-b6b728eac9df')
+    expect(new Set(hostIds.map((hostId) => parseExecutionHostId(hostId)?.kind))).toEqual(
+      new Set(['local', 'ssh'])
+    )
+  })
+
+  it('drops a provider that threw rather than reporting its host as queried', async () => {
+    sshProviders.set('box-live', { listProcesses: vi.fn(async () => []) } as never)
+    sshProviders.set('box-down', {
+      listProcesses: vi.fn(async () => {
+        throw new Error('relay unavailable')
+      })
+    } as never)
+
+    const { hostIds } = await listProcessesWithHostScopeFromRuntimeController({
+      runtime: { markPtyLivenessUnverifiable: vi.fn() }
+    } as unknown as PtyRuntimeControllerDeps)
+
+    expect(hostIds).toContain('ssh:box-live')
+    expect(hostIds).not.toContain('ssh:box-down')
+  })
+})
diff --git a/src/renderer/src/runtime/__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures.ts b/src/renderer/src/runtime/__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures.ts
index 3f4860f2302..da9d55bca1d 100644
--- a/src/renderer/src/runtime/__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures.ts
+++ b/src/renderer/src/runtime/__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures.ts
@@ -96,7 +96,9 @@ export function listResult(
     totalCount: terminals.length,
     truncated: options.truncated ?? false,
     ...(options.hostScope === undefined
-      ? { hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] } }
+      ? // A host names the execution hosts it covered, not its own environment id: answering
+        // `terminal.list` on a paired runtime reports `local` (verified against a live runtime).
+        { hostScope: { hostIds: ['local'], omittedHostIds: [] } }
       : { hostScope: options.hostScope })
   }
 }
diff --git a/src/renderer/src/runtime/host-live-terminal-probe.ts b/src/renderer/src/runtime/host-live-terminal-probe.ts
index 8e5d8a14539..94c29c1e6cc 100644
--- a/src/renderer/src/runtime/host-live-terminal-probe.ts
+++ b/src/renderer/src/runtime/host-live-terminal-probe.ts
@@ -1,5 +1,6 @@
 import type { RuntimeTerminalListResult } from '../../../shared/runtime-types'
 import type { RuntimeRpcResponse } from '../../../shared/runtime-rpc-envelope'
+import { hostScopeCensusIsComplete } from '../../../shared/runtime-listing-host-scope'
 
 /**
  * Asks the host whether ANY terminal is live in an environment, for the one
@@ -74,10 +75,12 @@ async function probeHost(
   if (response.ok === false || !isTerminalListResult(response.result)) {
     return 'unverifiable'
   }
-  // An omitted execution host is an incomplete census. In particular, a relay
-  // can list its local PTYs while an SSH child host is still starting up.
+  // A host this listing owed coverage for and did not deliver leaves an incomplete census — a
+  // relay can list its local PTYs while an SSH child host is still starting up. A peer runtime
+  // is not such a host: it answers `--environment` for itself, and reading its disclosure entry
+  // as a gap latched this probe forever (#18595).
   const hostScope = response.result.hostScope
-  if (hostScope && hostScope.omittedHostIds.length > 0) {
+  if (hostScope && !hostScopeCensusIsComplete(hostScope)) {
     return 'unverifiable'
   }
   const { terminals, totalCount } = response.result
diff --git a/src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts b/src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts
index 8c815968eec..fcbd0c5dc0d 100644
--- a/src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts
+++ b/src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts
@@ -335,6 +335,89 @@ describe('empty host inventory settling the session mirror', () => {
     expect(hasHostSessionMirrorHydrated(environmentId, WORKTREE)).toBe(true)
   })
 
+  // #18595, the reporter's shape: the answering host holds a mirrored row for a peer runtime, so
+  // that peer is named in `omittedHostIds` for every listing it will ever give. Reading the
+  // disclosure list as the gate made this probe permanently `unverifiable`, the mirror never
+  // hydrated, and every remote pane parked forever.
+  it('settles on a peer runtime it disclosed but never owed coverage for', async () => {
+    const result = await probeHostLiveTerminals(
+      'env-peer-disclosed',
+      vi.fn(async () => ({
+        id: 'peer-disclosed',
+        ok: true as const,
+        result: {
+          terminals: [],
+          totalCount: 0,
+          truncated: false,
+          hostScope: { hostIds: ['local'], omittedHostIds: ['runtime:env-peer'] }
+        },
+        _meta: { runtimeId: 'runtime' }
+      }))
+    )
+
+    expect(result).toBe('none')
+  })
+
+  it('reports a live terminal through a peer-runtime disclosure', async () => {
+    const result = await probeHostLiveTerminals(
+      'env-peer-live',
+      vi.fn(async () => ({
+        id: 'peer-live',
+        ok: true as const,
+        result: {
+          terminals: [{ handle: 'terminal-1' }],
+          totalCount: 1,
+          truncated: false,
+          hostScope: { hostIds: ['local'], omittedHostIds: ['runtime:env-peer'] }
+        },
+        _meta: { runtimeId: 'runtime' }
+      }))
+    )
+
+    expect(result).toBe('live')
+  })
+
+  it('stays unverifiable for an SSH host the answering runtime did owe coverage for', async () => {
+    const result = await probeHostLiveTerminals(
+      'env-ssh-gap',
+      vi.fn(async () => ({
+        id: 'ssh-gap',
+        ok: true as const,
+        result: {
+          terminals: [],
+          totalCount: 0,
+          truncated: false,
+          hostScope: { hostIds: ['local'], omittedHostIds: ['ssh:box-1'] }
+        },
+        _meta: { runtimeId: 'runtime' }
+      }))
+    )
+
+    expect(result).toBe('unverifiable')
+  })
+
+  // A worktree-scoped listing whose target is a runtime host covers nothing and names `local`
+  // among its omissions. `local` is what keeps this unverifiable — the point is that the
+  // runtime-only rule does not rescue a listing that answered for nothing.
+  it('stays unverifiable when the listing covered no host at all', async () => {
+    const result = await probeHostLiveTerminals(
+      'env-covered-nothing',
+      vi.fn(async () => ({
+        id: 'covered-nothing',
+        ok: true as const,
+        result: {
+          terminals: [],
+          totalCount: 0,
+          truncated: false,
+          hostScope: { hostIds: [], omittedHostIds: ['local', 'runtime:env-peer'] }
+        },
+        _meta: { runtimeId: 'runtime' }
+      }))
+    )
+
+    expect(result).toBe('unverifiable')
+  })
+
   it('rejects a present malformed host scope as unverifiable', async () => {
     const result = await probeHostLiveTerminals(
       'env-malformed-scope',
diff --git a/src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts b/src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts
new file mode 100644
index 00000000000..27d03f4642e
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts
@@ -0,0 +1,98 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ENVIRONMENT_ID,
+  listResult,
+  makeSnapshot,
+  makeState
+} from './__fixtures__/web-session-terminal-orphan-recovery-regression-fixtures'
+import {
+  clearWebSessionTerminalOrphanRecoveryForTests,
+  recoverWebSessionTerminalOrphansBeforeApply
+} from './web-session-terminal-orphan-recovery'
+
+/**
+ * The second consumer of `hostScopeCensusIsComplete`. Pruning here needs two consecutive
+ * authoritative inventories that omit the surface, so an incomplete census must hold the binding
+ * open indefinitely — and a peer runtime named in `omittedHostIds` must not be read as one, or
+ * the ghost binding is retained forever (#18595).
+ */
+const LEAVES = [{ leafId: 'leaf-1', handle: 'term-ghost' }]
+
+/**
+ * `listResult` substitutes a default scope when handed `undefined`, so the absent-scope case has
+ * to drop the key itself — passing `undefined` through the fixture silently tests the default.
+ */
+async function recoverTwice(worktree: string, hostScope: Record<string, unknown> | null) {
+  const state = makeState(worktree, LEAVES)
+  const call = vi.fn(async ({ method }: { method: string }) => {
+    if (method === 'terminal.list') {
+      const listed = listResult(worktree, [])
+      if (hostScope === null) {
+        delete (listed as { hostScope?: unknown }).hostScope
+      } else {
+        listed.hostScope = hostScope as never
+      }
+      return { ok: true as const, result: listed }
+    }
+    return { ok: false as const, error: { code: 'conflict', message: 'unexpected' } }
+  })
+  await recoverWebSessionTerminalOrphansBeforeApply(
+    state,
+    makeSnapshot(worktree, 'epoch-1', LEAVES),
+    ENVIRONMENT_ID,
+    { call: call as never }
+  )
+  return recoverWebSessionTerminalOrphansBeforeApply(
+    state,
+    makeSnapshot(worktree, 'epoch-2', LEAVES),
+    ENVIRONMENT_ID,
+    { call: call as never }
+  )
+}
+
+describe('orphan recovery reads the host scope as coverage owed, not as disclosure', () => {
+  beforeEach(() => {
+    clearWebSessionTerminalOrphanRecoveryForTests()
+  })
+
+  it('prunes a twice-absent binding when the only omission is a peer runtime', async () => {
+    const settled = await recoverTwice('repo::peer-disclosed', {
+      hostIds: ['local'],
+      omittedHostIds: ['runtime:env-peer']
+    })
+
+    expect(settled?.tabs).toEqual([])
+  })
+
+  it('retains the binding when an SSH host this runtime does query went unanswered', async () => {
+    const settled = await recoverTwice('repo::ssh-gap', {
+      hostIds: ['local'],
+      omittedHostIds: ['ssh:box-1']
+    })
+
+    expect(settled?.tabs).toEqual([
+      expect.objectContaining({ leafId: 'leaf-1', terminal: 'term-ghost' })
+    ])
+  })
+
+  it('retains the binding when the listing covered no host at all', async () => {
+    const settled = await recoverTwice('repo::covered-nothing', {
+      hostIds: [],
+      omittedHostIds: ['local', 'runtime:env-peer']
+    })
+
+    expect(settled?.tabs).toEqual([
+      expect.objectContaining({ leafId: 'leaf-1', terminal: 'term-ghost' })
+    ])
+  })
+
+  // Why: a host predating `hostScope` (v1.4.187) cannot say what it covered, and absence of the
+  // claim is never the claim.
+  it('retains the binding when the host is too old to publish a scope', async () => {
+    const settled = await recoverTwice('repo::no-scope', null)
+
+    expect(settled?.tabs).toEqual([
+      expect.objectContaining({ leafId: 'leaf-1', terminal: 'term-ghost' })
+    ])
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-terminal-orphan-recovery-inventory.ts b/src/renderer/src/runtime/web-session-terminal-orphan-recovery-inventory.ts
index 422a741aec8..8dac25b6451 100644
--- a/src/renderer/src/runtime/web-session-terminal-orphan-recovery-inventory.ts
+++ b/src/renderer/src/runtime/web-session-terminal-orphan-recovery-inventory.ts
@@ -18,6 +18,7 @@ import {
   type RecoverySurface
 } from './web-session-terminal-orphan-recovery-surface'
 import { runInTerminalRecoveryRpcLane } from './web-session-terminal-orphan-recovery-rpc-lane'
+import { hostScopeCensusIsComplete } from '../../../shared/runtime-listing-host-scope'
 
 type RuntimeCall = (args: {
   selector: string
@@ -163,9 +164,9 @@ export async function resolveTerminalOrphanInventory(args: {
       listedByHandle.set(terminal.handle, terminal)
     }
   }
-  // Older hosts omit hostScope entirely; an unscoped absence cannot prove a PTY exited.
-  const hostScopeUnverifiable =
-    listed.hostScope === undefined || listed.hostScope.omittedHostIds.length > 0
+  // Older hosts omit hostScope entirely; an unscoped absence cannot prove a PTY exited. A peer
+  // runtime named in `omittedHostIds` is disclosure rather than a gap this host owed (#18595).
+  const hostScopeUnverifiable = !hostScopeCensusIsComplete(listed.hostScope)
   const dispositions = new Map<string, RecoveryDisposition>()
   const claims: RuntimeTerminalOrphanAdoptionClaim[] = []
   for (const surface of inventorySurfaces) {
diff --git a/src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts b/src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts
index 1411200b14c..cb92d4c8e98 100644
--- a/src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts
+++ b/src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts
@@ -145,7 +145,7 @@ describe('web session pending terminal handle recovery', () => {
             topologyRevisions: { [WORKTREE_ID]: 4 },
             totalCount: 1,
             truncated: false,
-            hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+            hostScope: { hostIds: ['local'], omittedHostIds: [] }
           }
         }
       }
@@ -316,7 +316,7 @@ describe('web session pending terminal handle recovery', () => {
             topologyRevisions: { [WORKTREE_ID]: 4 },
             totalCount: 1,
             truncated: false,
-            hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+            hostScope: { hostIds: ['local'], omittedHostIds: [] }
           }
         }
       }
@@ -394,7 +394,7 @@ describe('web session pending terminal handle recovery', () => {
             topologyRevisions: { [WORKTREE_ID]: 4 },
             totalCount: 1,
             truncated: false,
-            hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+            hostScope: { hostIds: ['local'], omittedHostIds: [] }
           }
         }
       }
@@ -459,7 +459,7 @@ describe('web session pending terminal handle recovery', () => {
         terminals: [],
         totalCount: 0,
         truncated: false,
-        hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+        hostScope: { hostIds: ['local'], omittedHostIds: [] }
       }
     }))
 
@@ -655,7 +655,7 @@ describe('web session pending terminal handle recovery', () => {
         terminals: [],
         totalCount: 0,
         truncated: false,
-        hostScope: { hostIds: [ENVIRONMENT_ID], omittedHostIds: [] }
+        hostScope: { hostIds: ['local'], omittedHostIds: [] }
       }
     }))
 
diff --git a/src/shared/runtime-listing-host-scope.test.ts b/src/shared/runtime-listing-host-scope.test.ts
new file mode 100644
index 00000000000..a5fd79de454
--- /dev/null
+++ b/src/shared/runtime-listing-host-scope.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest'
+import { hostScopeCensusIsComplete } from './runtime-listing-host-scope'
+
+/**
+ * The gate and the disclosure list answer different questions off the same field. These pin the
+ * cases where they disagree — which is every case that mattered in #18595.
+ */
+describe('hostScopeCensusIsComplete', () => {
+  it('reads a peer runtime as disclosure, not as coverage this host owed', () => {
+    expect(
+      hostScopeCensusIsComplete({ hostIds: ['local'], omittedHostIds: ['runtime:env-7'] })
+    ).toBe(true)
+  })
+
+  it('still reads an SSH host as a gap, because this runtime does query those', () => {
+    expect(hostScopeCensusIsComplete({ hostIds: ['local'], omittedHostIds: ['ssh:box-1'] })).toBe(
+      false
+    )
+  })
+
+  it('reads a mixed omission as incomplete on the strength of the SSH host alone', () => {
+    expect(
+      hostScopeCensusIsComplete({
+        hostIds: ['local'],
+        omittedHostIds: ['runtime:env-7', 'ssh:box-1']
+      })
+    ).toBe(false)
+  })
+
+  it('calls a clean census complete', () => {
+    expect(hostScopeCensusIsComplete({ hostIds: ['local', 'ssh:box-1'], omittedHostIds: [] })).toBe(
+      true
+    )
+  })
+
+  // Defence in depth: `listKnownExecutionHostIds` always seeds `local`, so a real scope that
+  // covered nothing also omits `local` and is refused by the runtime-only rule anyway. This
+  // branch is what stops a scope that answered for no host from ever reading complete if that
+  // ever stops holding.
+  it('refuses a listing that covered no host at all', () => {
+    expect(hostScopeCensusIsComplete({ hostIds: [], omittedHostIds: ['runtime:env-7'] })).toBe(
+      false
+    )
+    expect(hostScopeCensusIsComplete({ hostIds: [], omittedHostIds: [] })).toBe(false)
+  })
+
+  // Why: `hostScope` shipped in v1.4.187. An older host cannot say what it covered, and absence
+  // of the claim is never the claim — this must stay the first branch.
+  it('refuses a host too old to publish a scope', () => {
+    expect(hostScopeCensusIsComplete(undefined)).toBe(false)
+  })
+
+  // Why: without this the runtime-only rule trusts a coverage claim it cannot read — the shape
+  // `{hostIds: ['runtime:'], omittedHostIds: ['runtime:env-7']}` was `unverifiable` before the
+  // gate changed and must not become `complete` on the strength of an unparseable id.
+  it('refuses a coverage claim with no legible host in it', () => {
+    expect(
+      hostScopeCensusIsComplete({
+        hostIds: ['runtime:' as never],
+        omittedHostIds: ['runtime:env-7']
+      })
+    ).toBe(false)
+  })
+
+  // Why "at least one legible" and not "all legible": a host that later gains a kind this client
+  // cannot parse must not report an incomplete census forever — that is this bug in a new coat.
+  it('accepts a coverage claim carrying one legible host beside an unreadable one', () => {
+    expect(
+      hostScopeCensusIsComplete({ hostIds: ['local', 'newkind:x' as never], omittedHostIds: [] })
+    ).toBe(true)
+  })
+
+  it('refuses an unparseable host id rather than discounting it', () => {
+    expect(
+      hostScopeCensusIsComplete({
+        hostIds: ['local'],
+        omittedHostIds: ['runtime:' as never]
+      })
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/runtime-listing-host-scope.ts b/src/shared/runtime-listing-host-scope.ts
index 6232b0a4259..97dbb1a8249 100644
--- a/src/shared/runtime-listing-host-scope.ts
+++ b/src/shared/runtime-listing-host-scope.ts
@@ -1,4 +1,4 @@
-import type { ExecutionHostId } from './execution-host'
+import { parseExecutionHostId, type ExecutionHostId } from './execution-host'
 
 /**
  * What a bounded listing did and did not cover, by execution host. An absent scope means the
@@ -10,3 +10,32 @@ export type RuntimeListingHostScope = {
   hostIds: ExecutionHostId[]
   omittedHostIds: ExecutionHostId[]
 }
+
+/**
+ * Whether the answering runtime enumerated every host its listing owed coverage for.
+ *
+ * `omittedHostIds` is a disclosure list and deliberately over-names — `omitted-host-scope-selectors.ts`
+ * keeps ids for servers that are no longer paired so a caller can still see the gap. That makes it the
+ * wrong input for a completeness gate, which needs "coverage owed and not delivered". The two jobs pull
+ * in opposite directions, and reading the disclosure list as the gate latched every remote pane on any
+ * client that had ever paired outward (#18595).
+ *
+ * A `runtime:` host is never owed coverage by the runtime answering: a paired runtime is a peer with its
+ * own control plane, reached with `--environment`, and this runtime has no paired-runtime PTY provider to
+ * have queried. Its terminals are its own answer to give, so its presence here is disclosure, not a gap.
+ */
+export function hostScopeCensusIsComplete(scope: RuntimeListingHostScope | undefined): boolean {
+  // A host too old to publish a scope cannot claim one; absence is never completeness.
+  if (scope === undefined) {
+    return false
+  }
+  // A listing that covered no host proves nothing, and an unreadable coverage claim is not a
+  // claim: `isTerminalListResult` checks only that `hostIds` is an array, so at least one covered
+  // id has to be legible before the claim can be believed. Deliberately "at least one" rather than
+  // "all": a host that later gains a kind this client cannot parse would otherwise report an
+  // incomplete census forever, which is the bug this predicate exists to stop.
+  if (!scope.hostIds.some((hostId) => parseExecutionHostId(hostId))) {
+    return false
+  }
+  return scope.omittedHostIds.every((hostId) => parseExecutionHostId(hostId)?.kind === 'runtime')
+}

From 67999dcaae96e22fcd5f9719cdcc37ab4e7ef324 Mon Sep 17 00:00:00 2001
From: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Date: Fri, 4 Sep 2026 10:05:45 -0700
Subject: [PATCH 22/58] Keep attention glyph knockout white when row is
 selected (#18679)

* Simplify palette attention glyph styling

Remove visual styling from the container so the glyph appears as a
lightweight overlay on the row icon, not a selection bubble.

* Keep attention glyph knockout white when row is selected

The glyph now uses a white background (bg-popover) with a ring to create a
visual knockout effect that separates it from the icon. This prevents the
glyph from inheriting the row selection styling, ensuring it stays visible
and distinct regardless of selection state.

* Correct attention glyph knockout color description to popover-colored
---
 .../components/cmd-j/palette-live-status.test.tsx | 15 ++++-----------
 .../src/components/cmd-j/palette-live-status.tsx  | 12 ++----------
 2 files changed, 6 insertions(+), 21 deletions(-)

diff --git a/src/renderer/src/components/cmd-j/palette-live-status.test.tsx b/src/renderer/src/components/cmd-j/palette-live-status.test.tsx
index a2656104d87..3cc6a9077dd 100644
--- a/src/renderer/src/components/cmd-j/palette-live-status.test.tsx
+++ b/src/renderer/src/components/cmd-j/palette-live-status.test.tsx
@@ -451,7 +451,7 @@ describe('palette live status', () => {
     expect(dotLabels()).toEqual(['Needs permission'])
   })
 
-  it('cuts the pip out of the dialog surface, and out of accent when selected', async () => {
+  it('keeps the attention glyph knockout popover-colored when its row is selected', async () => {
     setAgentState('working')
     await act(async () => {
       testRoot.render(
@@ -469,18 +469,11 @@ describe('palette live status', () => {
         </PaletteLiveStatusProvider>
       )
     })
-    const pip = testContainer.querySelector<HTMLElement>('[aria-hidden="true"].rounded-full')
+    const pip = testContainer.querySelector<HTMLElement>('[aria-hidden="true"]')
     expect(pip).not.toBeNull()
-    // Why popover and not background: the CommandDialog surface is --popover (#171717 dark), while
-    // --background is the app canvas (#0a0a0a) — the mismatch punched a dark halo through each row.
     expect(pip?.className).toContain('bg-popover')
     expect(pip?.className).toContain('ring-popover')
-    expect(pip?.className).not.toContain('bg-background')
-    expect(pip?.className).toContain(
-      'group-data-[selected=true]:bg-[var(--jump-palette-selection-surface)]'
-    )
-    expect(pip?.className).toContain(
-      'group-data-[selected=true]:ring-[var(--jump-palette-selection-surface)]'
-    )
+    expect(pip?.className).toContain('rounded-full')
+    expect(pip?.className).not.toContain('group-data-[selected=true]')
   })
 })
diff --git a/src/renderer/src/components/cmd-j/palette-live-status.tsx b/src/renderer/src/components/cmd-j/palette-live-status.tsx
index 432b6c35210..da59663490f 100644
--- a/src/renderer/src/components/cmd-j/palette-live-status.tsx
+++ b/src/renderer/src/components/cmd-j/palette-live-status.tsx
@@ -9,7 +9,6 @@ import {
   buildExplicitEntriesByTabId,
   type TabPaneInputSources
 } from '@/components/sidebar/smart-attention'
-import { cn } from '@/lib/utils'
 import { isExplicitAgentStatusFresh } from '@/lib/agent-status'
 import { getLiveAgentStatusByWorktreeId } from '@/lib/worktree-activity-state'
 import {
@@ -255,15 +254,8 @@ export function PaletteRecentTabStatusDot({
       <span className="relative inline-flex size-3.5 shrink-0 items-center justify-center">
         {fallback}
         <span
-          className={cn(
-            // Why popover, not background: the dialog surface is --popover (#171717 in dark), while
-            // --background is the app canvas (#0a0a0a) — using it punched a dark halo through every
-            // dark-mode row. Selected rows use --jump-palette-selection-surface so the cutout tracks
-            // the stronger keyboard highlight from main.css.
-            'pointer-events-none absolute -right-0.5 -bottom-0.5 flex items-center justify-center rounded-full',
-            'bg-popover ring-2 ring-popover',
-            'group-data-[selected=true]:bg-[var(--jump-palette-selection-surface)] group-data-[selected=true]:ring-[var(--jump-palette-selection-surface)]'
-          )}
+          // The popover-colored knockout separates the glyph from its icon without inheriting row selection.
+          className="pointer-events-none absolute -right-0.5 -bottom-0.5 flex items-center justify-center rounded-full bg-popover ring-2 ring-popover"
           aria-hidden="true"
         >
           <RecentTabAttentionBadgeGlyph badge={badge} />

From b0df874b7b8a2c59a418313b50a1e30c69828c45 Mon Sep 17 00:00:00 2001
From: Jinjing <6427696+AmethystLiang@users.noreply.github.com>
Date: Fri, 4 Sep 2026 10:09:30 -0700
Subject: [PATCH 23/58] Add tab scrollbar (#18526)

* Add interactive scroll indicator for tab strip

- Support thumb dragging and track clicking to scroll
- Auto-expand on hover and show when scrolling
- Forward wheel events to tab container
- Disable indicator during tab drag operations

* Fully hide scroll indicator when disabled

When disabled, the tab strip scroll indicator is hidden, unexpandable on hover, and doesn't forward wheel events. Consolidates disabled state checks across visibility, event handling, and CSS classes.

* Cleanup active scroll indicator drag when disabled

When the scroll indicator becomes disabled or hidden mid-drag, immediately cancel the drag operation to prevent window listeners and body styles (cursor, user-select) from remaining in a stuck state.

* Refine tab scroll indicator appearance and sizing

Reduce idle and expanded heights by 1px and 2px respectively, simplify color
expressions from color-mix to straightforward opacity utilities, and use
transparent background at rest for a more subtle, cohesive appearance.
---
 .../tab-bar/TabStripScrollIndicator.test.tsx  | 223 ++++++++++++++++++
 .../tab-bar/TabStripScrollIndicator.tsx       | 189 ++++++++++++++-
 .../src/components/tab-bar/drop-indicator.ts  |   2 +-
 .../components/tab-bar/tab-bar-surface.tsx    |   8 +-
 4 files changed, 411 insertions(+), 11 deletions(-)
 create mode 100644 src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx

diff --git a/src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx b/src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx
new file mode 100644
index 00000000000..2ce81fdb7f6
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx
@@ -0,0 +1,223 @@
+// @vitest-environment happy-dom
+
+import React, { createRef } from 'react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { cleanup, fireEvent, render } from '@testing-library/react'
+import { TabStripScrollIndicator } from './TabStripScrollIndicator'
+import type { TabStripScrollMetrics } from './tab-strip-scroll-metrics'
+
+afterEach(() => {
+  cleanup()
+  vi.restoreAllMocks()
+})
+
+const OVERFLOW_METRICS: TabStripScrollMetrics = {
+  hasOverflow: true,
+  canScrollStart: false,
+  canScrollEnd: true,
+  thumbSizeFraction: 0.4,
+  thumbOffsetFraction: 0
+}
+
+const NO_OVERFLOW_METRICS: TabStripScrollMetrics = {
+  hasOverflow: false,
+  canScrollStart: false,
+  canScrollEnd: false,
+  thumbSizeFraction: 1,
+  thumbOffsetFraction: 0
+}
+
+describe('TabStripScrollIndicator', () => {
+  it('renders null when there is no overflow', () => {
+    const { container } = render(<TabStripScrollIndicator metrics={NO_OVERFLOW_METRICS} />)
+    expect(container.firstChild).toBeNull()
+  })
+
+  it('renders under the tabs with bottom-0 and idle 2px height', () => {
+    const { getByTestId } = render(<TabStripScrollIndicator metrics={OVERFLOW_METRICS} />)
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    expect(indicator).toBeTruthy()
+    expect(indicator.className).toContain('bottom-0')
+    expect(indicator.className).toContain('h-[2px]')
+    expect(indicator.className).toContain('z-[12]')
+    expect(indicator.className).toContain('opacity-0')
+    expect(indicator.className).toContain('group-hover/tab-strip:opacity-100')
+
+    const thumb = getByTestId('tab-strip-scroll-thumb')
+    expect(thumb).toBeTruthy()
+  })
+
+  it('expands to 3px and becomes opaque on pointer hover, restores on leave', () => {
+    const { getByTestId } = render(<TabStripScrollIndicator metrics={OVERFLOW_METRICS} />)
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    expect(indicator.className).toContain('h-[2px]')
+    expect(indicator.className).toContain('opacity-0')
+
+    fireEvent.pointerEnter(indicator)
+    expect(indicator.className).toContain('h-[3px]')
+    expect(indicator.className).toContain('opacity-100')
+
+    fireEvent.pointerLeave(indicator)
+    expect(indicator.className).toContain('h-[2px]')
+    expect(indicator.className).toContain('opacity-0')
+  })
+
+  it('applies pointer-events-none when disabled', () => {
+    const { getByTestId } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} disabled={true} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    expect(indicator.className).toContain('pointer-events-none')
+    expect(indicator.className).not.toContain('group-hover/tab-strip:pointer-events-auto')
+  })
+
+  it('stays hidden and unexpanded on hover when disabled', () => {
+    const { getByTestId } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} disabled={true} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    fireEvent.pointerEnter(indicator)
+    expect(indicator.className).toContain('opacity-0')
+    expect(indicator.className).not.toContain('opacity-100')
+    expect(indicator.className).toContain('h-[2px]')
+  })
+
+  it('does not forward wheel events when disabled', () => {
+    const scrollContainer = document.createElement('div')
+    scrollContainer.scrollLeft = 0
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId } = render(
+      <TabStripScrollIndicator
+        metrics={OVERFLOW_METRICS}
+        scrollContainerRef={scrollContainerRef}
+        disabled={true}
+      />
+    )
+    fireEvent.wheel(getByTestId('tab-strip-scroll-indicator'), { deltaX: 40, deltaY: 0 })
+
+    expect(scrollContainer.scrollLeft).toBe(0)
+  })
+
+  it('forwards wheel events to scrollContainer', () => {
+    const scrollContainer = document.createElement('div')
+    scrollContainer.scrollLeft = 0
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} scrollContainerRef={scrollContainerRef} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    fireEvent.wheel(indicator, { deltaX: 40, deltaY: 0 })
+
+    expect(scrollContainer.scrollLeft).toBe(40)
+  })
+
+  it('handles track click and smooth scrolls container', () => {
+    const scrollContainer = document.createElement('div')
+    Object.defineProperty(scrollContainer, 'scrollWidth', { value: 1000, configurable: true })
+    Object.defineProperty(scrollContainer, 'clientWidth', { value: 400, configurable: true })
+    scrollContainer.scrollLeft = 0
+    const scrollToMock = vi.fn()
+    scrollContainer.scrollTo = scrollToMock
+
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} scrollContainerRef={scrollContainerRef} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    Object.defineProperty(indicator, 'clientWidth', { value: 400, configurable: true })
+    vi.spyOn(indicator, 'getBoundingClientRect').mockReturnValue({
+      left: 100,
+      right: 500,
+      top: 30,
+      bottom: 33,
+      width: 400,
+      height: 3,
+      x: 100,
+      y: 30,
+      toJSON: () => {}
+    } as DOMRect)
+
+    // Click track at clientX = 300 (offset 200 within 400px track)
+    fireEvent.pointerDown(indicator, { button: 0, clientX: 300 })
+    expect(scrollToMock).toHaveBeenCalledTimes(1)
+    expect(scrollToMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        behavior: 'smooth'
+      })
+    )
+  })
+
+  it('scrolls container when dragging thumb', () => {
+    const scrollContainer = document.createElement('div')
+    Object.defineProperty(scrollContainer, 'scrollWidth', { value: 1000, configurable: true })
+    Object.defineProperty(scrollContainer, 'clientWidth', { value: 400, configurable: true })
+    scrollContainer.scrollLeft = 0
+
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId } = render(
+      <TabStripScrollIndicator
+        metrics={{
+          ...OVERFLOW_METRICS,
+          thumbSizeFraction: 0.4
+        }}
+        scrollContainerRef={scrollContainerRef}
+      />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    Object.defineProperty(indicator, 'clientWidth', { value: 400, configurable: true })
+    const thumb = getByTestId('tab-strip-scroll-thumb')
+
+    // Start drag on thumb
+    fireEvent.pointerDown(thumb, { button: 0, clientX: 50 })
+    expect(indicator.className).toContain('h-[3px]')
+
+    // Move pointer by 60px
+    fireEvent(window, new MouseEvent('pointermove', { clientX: 110 }))
+    expect(scrollContainer.scrollLeft).toBeGreaterThan(0)
+
+    // Release drag
+    fireEvent(window, new MouseEvent('pointerup'))
+    expect(indicator.className).toContain('h-[2px]')
+  })
+
+  it('cancels an active thumb drag when it becomes disabled', () => {
+    const scrollContainer = document.createElement('div')
+    Object.defineProperty(scrollContainer, 'scrollWidth', { value: 1000, configurable: true })
+    Object.defineProperty(scrollContainer, 'clientWidth', { value: 400, configurable: true })
+    scrollContainer.scrollLeft = 0
+
+    const scrollContainerRef = createRef<HTMLElement>()
+    ;(scrollContainerRef as React.MutableRefObject<HTMLElement>).current = scrollContainer
+
+    const { getByTestId, rerender } = render(
+      <TabStripScrollIndicator metrics={OVERFLOW_METRICS} scrollContainerRef={scrollContainerRef} />
+    )
+    const indicator = getByTestId('tab-strip-scroll-indicator')
+    Object.defineProperty(indicator, 'clientWidth', { value: 400, configurable: true })
+
+    fireEvent.pointerDown(getByTestId('tab-strip-scroll-thumb'), { button: 0, clientX: 50 })
+    expect(document.body.style.userSelect).toBe('none')
+
+    rerender(
+      <TabStripScrollIndicator
+        metrics={OVERFLOW_METRICS}
+        scrollContainerRef={scrollContainerRef}
+        disabled={true}
+      />
+    )
+
+    expect(document.body.style.userSelect).toBe('')
+    expect(document.body.style.cursor).toBe('')
+
+    fireEvent(window, new MouseEvent('pointermove', { clientX: 300 }))
+    expect(scrollContainer.scrollLeft).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/tab-bar/TabStripScrollIndicator.tsx b/src/renderer/src/components/tab-bar/TabStripScrollIndicator.tsx
index 42cecfcb942..c800d51ad2f 100644
--- a/src/renderer/src/components/tab-bar/TabStripScrollIndicator.tsx
+++ b/src/renderer/src/components/tab-bar/TabStripScrollIndicator.tsx
@@ -1,4 +1,4 @@
-import React, { useCallback, useLayoutEffect, useRef, useState } from 'react'
+import React, { useCallback, useEffect, useLayoutEffect, useRef, useState } from 'react'
 import {
   computeTabStripThumbLayout,
   type TabStripScrollMetrics,
@@ -7,13 +7,24 @@ import {
 
 const EMPTY_THUMB_LAYOUT: TabStripThumbLayout = { widthPx: 0, leftPx: 0 }
 
-export function TabStripScrollIndicator({
-  metrics
-}: {
+export type TabStripScrollIndicatorProps = {
   metrics: TabStripScrollMetrics
-}): React.JSX.Element | null {
+  scrollContainerRef?: React.RefObject<HTMLElement | null>
+  disabled?: boolean
+}
+
+export function TabStripScrollIndicator({
+  metrics,
+  scrollContainerRef,
+  disabled = false
+}: TabStripScrollIndicatorProps): React.JSX.Element | null {
   const trackRef = useRef<HTMLDivElement>(null)
+  const cleanupDragRef = useRef<(() => void) | null>(null)
   const [thumbLayout, setThumbLayout] = useState<TabStripThumbLayout>(EMPTY_THUMB_LAYOUT)
+  const [isHovered, setIsHovered] = useState(false)
+  const [isDragging, setIsDragging] = useState(false)
+  const [isScrolling, setIsScrolling] = useState(false)
+  const scrollTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null)
 
   const remeasureThumb = useCallback((): void => {
     const track = trackRef.current
@@ -37,23 +48,185 @@ export function TabStripScrollIndicator({
     return () => resizeObserver.disconnect()
   }, [remeasureThumb])
 
+  useEffect(() => {
+    const scrollContainer = scrollContainerRef?.current
+    if (!scrollContainer) {
+      return
+    }
+    const handleScroll = (): void => {
+      setIsScrolling(true)
+      if (scrollTimeoutRef.current) {
+        clearTimeout(scrollTimeoutRef.current)
+      }
+      scrollTimeoutRef.current = setTimeout(() => {
+        setIsScrolling(false)
+      }, 800)
+    }
+    scrollContainer.addEventListener('scroll', handleScroll, { passive: true })
+    return () => {
+      scrollContainer.removeEventListener('scroll', handleScroll)
+      if (scrollTimeoutRef.current) {
+        clearTimeout(scrollTimeoutRef.current)
+      }
+    }
+  }, [scrollContainerRef])
+
+  useEffect(() => {
+    return () => {
+      cleanupDragRef.current?.()
+    }
+  }, [])
+
+  // Why: hiding the indicator mid-drag would otherwise leave window listeners and body cursor/user-select stuck.
+  useEffect(() => {
+    if (disabled || !metrics.hasOverflow) {
+      cleanupDragRef.current?.()
+    }
+  }, [disabled, metrics.hasOverflow])
+
+  const handleThumbPointerDown = (e: React.PointerEvent<HTMLDivElement>): void => {
+    if (e.button !== 0 || disabled) {
+      return
+    }
+    e.preventDefault()
+    e.stopPropagation()
+
+    const scrollContainer = scrollContainerRef?.current
+    const track = trackRef.current
+    if (!scrollContainer || !track) {
+      return
+    }
+
+    const startX = e.clientX
+    const startScrollLeft = scrollContainer.scrollLeft
+    const trackWidth = track.clientWidth
+    const maxLeft = Math.max(1, trackWidth - thumbLayout.widthPx)
+    const maxScrollLeft = Math.max(0, scrollContainer.scrollWidth - scrollContainer.clientWidth)
+
+    if (maxScrollLeft <= 0 || maxLeft <= 0) {
+      return
+    }
+
+    setIsDragging(true)
+    const prevUserSelect = document.body.style.userSelect
+    const prevCursor = document.body.style.cursor
+    document.body.style.userSelect = 'none'
+    document.body.style.cursor = 'grabbing'
+
+    const onPointerMove = (moveEvent: PointerEvent): void => {
+      const deltaX = moveEvent.clientX - startX
+      const scrollDelta = (deltaX / maxLeft) * maxScrollLeft
+      scrollContainer.scrollLeft = Math.max(
+        0,
+        Math.min(maxScrollLeft, startScrollLeft + scrollDelta)
+      )
+    }
+
+    const cleanup = (): void => {
+      setIsDragging(false)
+      document.body.style.userSelect = prevUserSelect
+      document.body.style.cursor = prevCursor
+      window.removeEventListener('pointermove', onPointerMove)
+      window.removeEventListener('pointerup', cleanup)
+      window.removeEventListener('pointercancel', cleanup)
+      cleanupDragRef.current = null
+    }
+
+    cleanupDragRef.current = cleanup
+    window.addEventListener('pointermove', onPointerMove)
+    window.addEventListener('pointerup', cleanup)
+    window.addEventListener('pointercancel', cleanup)
+  }
+
+  const handleTrackPointerDown = (e: React.PointerEvent<HTMLDivElement>): void => {
+    if (e.button !== 0 || disabled) {
+      return
+    }
+    if (e.target !== trackRef.current) {
+      return
+    }
+    e.preventDefault()
+    e.stopPropagation()
+
+    const scrollContainer = scrollContainerRef?.current
+    const track = trackRef.current
+    if (!scrollContainer || !track) {
+      return
+    }
+
+    const trackRect = track.getBoundingClientRect()
+    const clickX = e.clientX - trackRect.left
+    const trackWidth = track.clientWidth
+    const thumbWidth = thumbLayout.widthPx
+    const maxLeft = Math.max(1, trackWidth - thumbWidth)
+    const maxScrollLeft = Math.max(0, scrollContainer.scrollWidth - scrollContainer.clientWidth)
+
+    if (maxScrollLeft <= 0 || maxLeft <= 0) {
+      return
+    }
+
+    const targetThumbLeft = Math.max(0, Math.min(maxLeft, clickX - thumbWidth / 2))
+    const targetScrollLeft = (targetThumbLeft / maxLeft) * maxScrollLeft
+
+    scrollContainer.scrollTo({
+      left: targetScrollLeft,
+      behavior: 'smooth'
+    })
+  }
+
+  const handleWheel = (e: React.WheelEvent<HTMLDivElement>): void => {
+    const scrollContainer = scrollContainerRef?.current
+    if (!scrollContainer || disabled) {
+      return
+    }
+    // Why: forward wheel events to tab container so scrolling over the indicator scrolls the strip.
+    const delta = Math.abs(e.deltaX) > Math.abs(e.deltaY) ? e.deltaX : e.deltaY
+    scrollContainer.scrollLeft += delta
+  }
+
   if (!metrics.hasOverflow) {
     return null
   }
 
+  // Why: during a tab drag the indicator fully yields — no reveal, no pointer/wheel interaction.
+  const isExpanded = !disabled && (isHovered || isDragging)
+  const isVisible = !disabled && (isHovered || isDragging || isScrolling)
+
   return (
-    // Why: top rail keeps the active tab's bottom underline unobstructed.
+    // Why: under-tab position matches editor tab scrollbar conventions, auto-hiding when idle so it never mimics an underline.
     <div
       ref={trackRef}
-      className="pointer-events-none absolute inset-x-0 top-0 z-[1] h-px bg-muted-foreground/10"
+      data-testid="tab-strip-scroll-indicator"
+      className={`absolute inset-x-0 bottom-0 z-[12] select-none transition-[height,background-color,opacity] duration-150 ease-out ${
+        isExpanded ? 'h-[3px] bg-muted-foreground/10 cursor-pointer' : 'h-[2px] bg-transparent'
+      } ${
+        disabled
+          ? 'opacity-0 pointer-events-none'
+          : isVisible
+            ? 'opacity-100 pointer-events-auto'
+            : 'opacity-0 group-hover/tab-strip:opacity-100 pointer-events-none group-hover/tab-strip:pointer-events-auto'
+      }`}
+      onPointerEnter={() => setIsHovered(true)}
+      onPointerLeave={() => setIsHovered(false)}
+      onPointerDown={handleTrackPointerDown}
+      onWheel={handleWheel}
+      // Why: decorative rail — keyboard/AT users scroll the strip with the adjacent labelled scroll buttons.
       aria-hidden
     >
       <div
-        className="absolute top-0 h-full rounded-full bg-muted-foreground/40 transition-[left,width] duration-75 ease-out"
+        data-testid="tab-strip-scroll-thumb"
+        className={`absolute bottom-0 h-full rounded-full transition-colors duration-150 ease-out ${
+          isDragging
+            ? 'bg-foreground/40 cursor-grabbing'
+            : isHovered
+              ? 'bg-muted-foreground/50 cursor-grab'
+              : 'bg-muted-foreground/25 cursor-default'
+        }`}
         style={{
           width: `${thumbLayout.widthPx}px`,
           left: `${thumbLayout.leftPx}px`
         }}
+        onPointerDown={handleThumbPointerDown}
       />
     </div>
   )
diff --git a/src/renderer/src/components/tab-bar/drop-indicator.ts b/src/renderer/src/components/tab-bar/drop-indicator.ts
index ab9f0ef5623..1b2c8221180 100644
--- a/src/renderer/src/components/tab-bar/drop-indicator.ts
+++ b/src/renderer/src/components/tab-bar/drop-indicator.ts
@@ -26,7 +26,7 @@ export function getDropIndicatorClasses(dropIndicator: DropIndicator): string {
 // flips the strip between "fits exactly" and "overflows by 1px", which jitters
 // every tab by 1px because the browser preserves scrollLeft near the end.
 export const ACTIVE_TAB_INDICATOR_CLASSES =
-  'pointer-events-none absolute inset-x-0 bottom-0 h-[2px] bg-[color-mix(in_srgb,var(--foreground)_60%,var(--card))] z-10'
+  'pointer-events-none absolute inset-x-0 bottom-0 h-[2px] bg-[color-mix(in_srgb,var(--foreground)_60%,var(--card))] z-20'
 
 export function getTabRootStateClasses(isActive: boolean): string {
   return isActive
diff --git a/src/renderer/src/components/tab-bar/tab-bar-surface.tsx b/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
index 5ed5936a457..dcf22611227 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
+++ b/src/renderer/src/components/tab-bar/tab-bar-surface.tsx
@@ -157,7 +157,7 @@ export function renderTabBarSurface({
       <SortableContext items={sortableIds}>
         {/* Why: no-drag lets tab interactions work inside the titlebar's drag region (outer container stays window-draggable). */}
         <div
-          className="relative flex min-h-0 min-w-0 max-w-full flex-[0_1_auto]"
+          className="group/tab-strip relative flex min-h-0 min-w-0 max-w-full flex-[0_1_auto]"
           style={{ WebkitAppRegion: 'no-drag' } as React.CSSProperties}
         >
           <div
@@ -181,7 +181,11 @@ export function renderTabBarSurface({
               />
             ) : null}
           </div>
-          <TabStripScrollIndicator metrics={tabStripOverflowState} />
+          <TabStripScrollIndicator
+            metrics={tabStripOverflowState}
+            scrollContainerRef={tabStripRef}
+            disabled={tabStripDragScroll.isTabDragActive}
+          />
         </div>
       </SortableContext>
       {tabStripOverflowState.hasOverflow ? (

From 3e4fd4a7af02270957e71b1026877b97a24bad34 Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:27:07 -0400
Subject: [PATCH 24/58] Shorten orchestration skill description under the Agent
 Skills 1024-char limit (#18683)

* Shorten orchestration skill description under the Agent Skills 1024-char limit

The folded description was 1038 chars, so spec-conforming installers such
as SkillStar rejected the bundled orchestration skill. Drop the two clauses
already covered elsewhere in the same description: "decomposing work across
agents" (implied by "structured multi-agent coordination") and "automation
of the browser embedded inside Orca" (restated by the locked `orca-cli`
embedded-pages sentence). Every routing trigger asserted by
orchestration-skill-guidance.test.mjs, the orca-cli handoff boundary, and
the Computer Use boundary are unchanged. Result: 958 chars.

Add config/scripts/skill-description-length.test.mjs, which parses every
skills/*/SKILL.md frontmatter with `yaml` and fails on an empty or >1024
char description, so the regression cannot return. orca-cli sits at 1015
and is left as is.

Fixes #17935

* Keep the embedded browser in the orchestration description's orca-cli routing

Restores the word "browser" in the orca-cli sentence ("and the Orca embedded
browser") so agents scanning for it still route embedded-browser control to
orca-cli. Description is 985 chars, 39 under the spec limit.
---
 .../scripts/skill-description-length.test.mjs | 39 +++++++++++++++++++
 resources/skills/current-manifest.json        | 12 +++---
 resources/skills/snapshot-registry.json       | 12 +++---
 skill-guides/orchestration.md                 | 24 ++++++------
 skills/orchestration/SKILL.md                 | 24 ++++++------
 src/cli/bundled-skill-guides.ts               |  4 +-
 6 files changed, 77 insertions(+), 38 deletions(-)
 create mode 100644 config/scripts/skill-description-length.test.mjs

diff --git a/config/scripts/skill-description-length.test.mjs b/config/scripts/skill-description-length.test.mjs
new file mode 100644
index 00000000000..e7a9db79541
--- /dev/null
+++ b/config/scripts/skill-description-length.test.mjs
@@ -0,0 +1,39 @@
+import { readdirSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+const skillsDir = resolve(import.meta.dirname, '../../skills')
+// Why: the Agent Skills spec caps `description` at 1024 chars and conforming installers
+// reject the whole skill (#17935); the frontmatter is what the installer parses, so check it.
+const MAX_DESCRIPTION_LENGTH = 1024
+
+function readDescription(skillName) {
+  const skillMarkdown = readFileSync(join(skillsDir, skillName, 'SKILL.md'), 'utf8')
+  const frontmatter = /^---\r?\n([\s\S]*?)\r?\n---\r?\n/u.exec(skillMarkdown)?.[1]
+
+  expect(frontmatter, `${skillName}: missing frontmatter`).toBeDefined()
+
+  return parse(frontmatter ?? '').description
+}
+
+describe('bundled skill descriptions', () => {
+  const skillNames = readdirSync(skillsDir, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+
+  it('discovers the bundled skills', () => {
+    expect(skillNames).toContain('orchestration')
+  })
+
+  it.each(skillNames)('%s keeps description within the Agent Skills spec limit', (name) => {
+    const description = readDescription(name)
+
+    expect(typeof description, `${name}: description must be a string`).toBe('string')
+    expect(description.trim().length, `${name}: description is empty`).toBeGreaterThan(0)
+    expect(
+      description.length,
+      `${name}: description is ${description.length} chars`
+    ).toBeLessThanOrEqual(MAX_DESCRIPTION_LENGTH)
+  })
+})
diff --git a/resources/skills/current-manifest.json b/resources/skills/current-manifest.json
index c8b204f00c5..fdb54016a8f 100644
--- a/resources/skills/current-manifest.json
+++ b/resources/skills/current-manifest.json
@@ -131,17 +131,17 @@
       "name": "orchestration",
       "sourcePath": "skills/orchestration",
       "releaseRevision": 29,
-      "packageDigest": "7a386ce558ba54abe02b4a0de5d71fe3d63c944ef0888ddde130c729b37f7cc8",
-      "gitTreeSha": "4199ec6988801dd491631706cba62631b4bed8fb",
+      "packageDigest": "689e31d84256aded123c801eaa87413474943a9a30d96bff9a19d0a321aefb54",
+      "gitTreeSha": "902cc33dd65730b32ac234dd0ae7166d75498b46",
       "files": [
         {
           "path": "SKILL.md",
-          "size": 4451,
+          "size": 4398,
           "executable": false,
           "classification": "text",
-          "exactSha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f",
-          "textNormalizedSha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f",
-          "identitySha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f"
+          "exactSha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18",
+          "textNormalizedSha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18",
+          "identitySha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18"
         }
       ]
     }
diff --git a/resources/skills/snapshot-registry.json b/resources/skills/snapshot-registry.json
index 5842b48858a..5b3412a497b 100644
--- a/resources/skills/snapshot-registry.json
+++ b/resources/skills/snapshot-registry.json
@@ -1046,17 +1046,17 @@
       },
       {
         "releaseRevision": 29,
-        "packageDigest": "7a386ce558ba54abe02b4a0de5d71fe3d63c944ef0888ddde130c729b37f7cc8",
-        "gitTreeSha": "4199ec6988801dd491631706cba62631b4bed8fb",
+        "packageDigest": "689e31d84256aded123c801eaa87413474943a9a30d96bff9a19d0a321aefb54",
+        "gitTreeSha": "902cc33dd65730b32ac234dd0ae7166d75498b46",
         "files": [
           {
             "path": "SKILL.md",
-            "size": 4451,
+            "size": 4398,
             "executable": false,
             "classification": "text",
-            "exactSha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f",
-            "textNormalizedSha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f",
-            "identitySha256": "a7e3350f037698ebbce36b2818d8383ec6e96c2a4825537caab39a83b4fb4b7f"
+            "exactSha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18",
+            "textNormalizedSha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18",
+            "identitySha256": "19ffdc1fe0d2c97dae845e8d636edb16781453ce2ec26f65a323c492ef90da18"
           }
         ]
       }
diff --git a/skill-guides/orchestration.md b/skill-guides/orchestration.md
index b9b7ca79442..0878532c447 100644
--- a/skill-guides/orchestration.md
+++ b/skill-guides/orchestration.md
@@ -3,18 +3,18 @@ name: orchestration
 description: >-
   Use Orca orchestration for structured multi-agent coordination: threaded
   messages, blocking ask/reply flows, task dispatch, worker_done/escalation
-  waits, task DAGs, decision gates, coordinator loops, or decomposing work
-  across agents. Use `orca-cli` instead for full ownership handoffs, including
-  requests phrased as "hand off", "handoff", "handover", "give this to another
-  agent", or "another worktree" when the user did not explicitly ask to
-  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for
-  terminal control, lightweight terminal prompts, shell commands, Orca
-  worktree management, reading or waiting on terminals, and automation of the
-  browser embedded inside Orca. Use Computer Use for external browser windows,
-  webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when
-  the task requires OS/window-level control such as focus, menus, dialogs,
-  coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a
-  page-automation tool such as Playwright or CDP for external pages.
+  waits, task DAGs, decision gates, or coordinator loops. Use `orca-cli`
+  instead for full ownership handoffs, including requests phrased as "hand
+  off", "handoff", "handover", "give this to another agent", or "another
+  worktree" when the user did not explicitly ask to supervise, monitor, wait
+  for results, or coordinate a DAG. Use `orca-cli` for terminal control,
+  lightweight terminal prompts, shell commands, Orca worktree management,
+  reading or waiting on terminals, and the Orca embedded browser. Use Computer
+  Use for external browser windows, webviews, Orca app UI, or desktop UI
+  outside Orca's embedded browser only when the task requires OS/window-level
+  control such as focus, menus, dialogs, coordinates, or screenshots. Use
+  `orca-cli` for Orca's embedded pages and a page-automation tool such as
+  Playwright or CDP for external pages.
 ---
 
 # Orca Inter-Agent Orchestration
diff --git a/skills/orchestration/SKILL.md b/skills/orchestration/SKILL.md
index 85a0ff8c4b0..5725a8f5512 100644
--- a/skills/orchestration/SKILL.md
+++ b/skills/orchestration/SKILL.md
@@ -3,18 +3,18 @@ name: orchestration
 description: >-
   Use Orca orchestration for structured multi-agent coordination: threaded
   messages, blocking ask/reply flows, task dispatch, worker_done/escalation
-  waits, task DAGs, decision gates, coordinator loops, or decomposing work
-  across agents. Use `orca-cli` instead for full ownership handoffs, including
-  requests phrased as "hand off", "handoff", "handover", "give this to another
-  agent", or "another worktree" when the user did not explicitly ask to
-  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for
-  terminal control, lightweight terminal prompts, shell commands, Orca
-  worktree management, reading or waiting on terminals, and automation of the
-  browser embedded inside Orca. Use Computer Use for external browser windows,
-  webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when
-  the task requires OS/window-level control such as focus, menus, dialogs,
-  coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a
-  page-automation tool such as Playwright or CDP for external pages.
+  waits, task DAGs, decision gates, or coordinator loops. Use `orca-cli`
+  instead for full ownership handoffs, including requests phrased as "hand
+  off", "handoff", "handover", "give this to another agent", or "another
+  worktree" when the user did not explicitly ask to supervise, monitor, wait
+  for results, or coordinate a DAG. Use `orca-cli` for terminal control,
+  lightweight terminal prompts, shell commands, Orca worktree management,
+  reading or waiting on terminals, and the Orca embedded browser. Use Computer
+  Use for external browser windows, webviews, Orca app UI, or desktop UI
+  outside Orca's embedded browser only when the task requires OS/window-level
+  control such as focus, menus, dialogs, coordinates, or screenshots. Use
+  `orca-cli` for Orca's embedded pages and a page-automation tool such as
+  Playwright or CDP for external pages.
 ---
 
 # Orca Orchestration
diff --git a/src/cli/bundled-skill-guides.ts b/src/cli/bundled-skill-guides.ts
index 66625fc9a1f..06aae7bdd7d 100644
--- a/src/cli/bundled-skill-guides.ts
+++ b/src/cli/bundled-skill-guides.ts
@@ -30,7 +30,7 @@ const ORCA_LINEAR_MARKDOWN = "---\nname: orca-linear\ndescription: >-\n  Use Orc
 const ORCA_PER_WORKSPACE_ENV_MARKDOWN = "---\nname: orca-per-workspace-env\ndescription: >-\n  Set up, review, debug, or validate Orca per-workspace environment recipes —\n  on-demand, disposable runtimes (cloud sandboxes, VMs, or local) created fresh\n  for each workspace. Covers first-time setup (provider prerequisites, the\n  reusable base snapshot, the coding-agent auth snapshot, credentials, and\n  state), not just the per-workspace lifecycle scripts. Use to stand up\n  per-workspace environments, fix an `environmentRecipes` entry in `orca.yaml`, scaffold\n  provider lifecycle scripts, or resolve an `orca vm recipe doctor` failure.\n---\n\n# Per-Workspace Environments\n\nHelp a user stand up and maintain a repo-owned per-workspace environment recipe end to end. Each\nworkspace gets its own on-demand, disposable runtime (a cloud sandbox, a VM, or a local one),\ncreated fresh and torn down after.\n\nOrca is a **thin wrapper**: you guide, detect, and scaffold; you never own the user's cloud account,\nbilling, images, or credentials.\n\n- **You DO:** sequence the setup, detect what's detectable (provider CLI present/logged-in? recipe\n  present? `doctor` passing?), scaffold provider-templated scripts the user fills in, drive the slow\n  snapshot/auth phases with the user, and always show the next action.\n- **You DO NOT:** create accounts, choose plans/regions, invent org/project/scope ids, store or print\n  secrets, or run anything that spends money without an explicit user OK.\n\nFirst-time setup has **four phases before the per-workspace recipe runs** — easy to miss, so walk\nthem in order:\n\n1. **Prerequisites** — cloud account, provider CLI, scope/project, plan limits, git token (§2).\n2. **Base snapshot** — reusable image: tools + repo + headless build, snapshotted once (§3).\n3. **Agent-auth snapshot** — boot the base, run interactive device-auth, re-snapshot (§4).\n4. **State** — thread snapshot id / scope / project / port between phases via a state file (§6).\n\nThen the **per-workspace contract** (create/suspend/resume/destroy) runs fast (§8).\n\n**The one branch that shapes everything — connection mode:** **Orca-server** (`create` runs `orca serve`\nin the env and emits a `pairingCode`; §7c/§7f) vs **SSH** (`create` runs no server and emits a\n`connection.type:\"ssh\"` block Orca dials into; §7g/§7h). Settle this first — it changes the `create`\noutput shape and half the templates.\n\nKeep Orca's checkout behavior unchanged by default: omit `checkoutMode`, emit schema version 1, and\nlet Orca create a linked worktree. Only use `checkoutMode: provisioned-root` when the user explicitly\nwants one ephemeral machine to clone the finished workspace itself. This niche mode currently requires\ndirect SSH, an ordinary non-bare/non-sparse primary checkout at `projectRoot`, and schema version 2.\n\n**Quick-start (happy path):** interview the user (connection mode Orca-server vs SSH, provider, agent CLI,\ngit auth — §1.2) + read the provider's CLI docs → scaffold `scripts/orca-vm/` from §7 → run the\nbase-snapshot script, then the auth script (you invoke these by hand; not via `orca.yaml`) → wire\n`environmentRecipes` in `orca.yaml` → `orca vm recipe doctor <id> --json` (free) → then the `--provision`\nself-test loop (§9) until it passes.\n\n---\n\n## 1. Setup workflow\n\nDrive these with the user. **[CHECKPOINT]** steps need explicit confirmation — they spend money, take\na long time, or need the user at the keyboard. Never create an Orca workspace or commit unless asked.\n\n1. **Inspect the repo** for an existing `environmentRecipes` entry, `scripts/orca-vm/`, a state file, or setup\n   notes. If a working recipe exists, jump to Doctor (§9) instead of rebuilding.\n2. **Interview the user up front** — gather these choices and confirm them back before scaffolding\n   anything. Don't pick for them (§11); don't guess.\n   - **Connection mode:** how Orca attaches to the environment — an **Orca server** (the VM runs\n     `orca serve` and Orca pairs over its pairing URL; worked example §7f) or **SSH** (Orca connects to\n     the host over SSH; §7g). This decides the recipe's connection shape, so settle it first.\n   - **Checkout ownership:** do not ask by default. Only when the user requires the environment to\n     create the exact final checkout, confirm `provisioned-root` and direct SSH; otherwise omit it.\n   - **Provider:** Vercel Sandbox, Fly, Modal, an existing SSH host, … For non-obvious providers, also\n     ask scope/project/region and plan limits (§2). Then **read that provider's CLI/SDK docs** (or\n     `<cli> --help`) before scaffolding — you need its exact create/exec/snapshot/remove verbs.\n     If a provider advertises `ssh`, verify whether it exposes a real dialable SSH target\n     (host/port/user/key or proxy command) or only a provider-mediated interactive shell; Orca SSH mode\n     needs the former.\n   - **Coding-agent CLI + account:** which agent runs in the VM (`codex`, `claude`, …) and that the user\n     has an account for it — it gets logged in during the Phase-3 auth snapshot (§4).\n   - **Git auth:** the token source for cloning a private repo (`GH_TOKEN`/`GITHUB_TOKEN` or `gh auth\ntoken`; §5).\n3. **Check prerequisites (§2)** — detect the provider CLI + auth and confirm the items above are in\n   place before any paid step.\n4. **Scaffold scripts + state file** from §7 (worked Vercel example: §7f; SSH host: §7g; Docker SSH:\n   §7h; Windows: §7i), filling in the provider's real commands. Make them executable.\n5. **[CHECKPOINT] Build the base snapshot (§3)** — paid, slow.\n6. **[CHECKPOINT] Authenticate the agent (§4)** — interactive; the user follows a URL/code. **You cannot\n   drive this step** — you run commands non-interactively, so there's no TTY for `docker exec -it` /\n   `ssh -t` to prompt against. The **user** runs the Phase-3 login in their own terminal (or via the\n   Claude Code harness bang-prefix — `! <cmd>`, with the required space after `!`); you scaffold and drive\n   the non-interactive phases around it. After kicking it off, **ask the user to report back once the login\n   finishes** — you can't observe it completing, and you need that confirmation before resuming the\n   non-interactive steps (base/auth commit, doctor, provision).\n7. **Wire the recipe** so `orca.yaml` points create/suspend/resume/destroy at the scripts (§8). The\n   workspace composer reads `environmentRecipes` from the project's primary checkout of `orca.yaml`, **not** from\n   a feature branch or worktree. So a recipe added only on a branch won't appear as a \"Run on\" option\n   until that `orca.yaml` change is committed and merged to the project's primary branch. Tell the user\n   this up front: `doctor`/`--provision` validate the scripts from the working copy on any branch, but\n   creating a workspace from the recipe in the picker needs it on primary.\n8. **Dry-run doctor** — `orca vm recipe doctor <recipe-id> --repo-path <repo> --json` (free, static; §9).\n   Fix every failure before going live.\n9. **[CHECKPOINT] Live self-test** — get the user's OK once, then run\n   `orca vm recipe doctor <recipe-id> --provision --json` as a loop: it runs create → validates →\n   destroys, and on failure returns a full transcript. Read it, fix the scripts, and re-run yourself until\n   it passes (§9). Spends cloud money; the one approval covers the loop.\n10. **[CHECKPOINT] Optional workspace test** — only if asked: create a workspace via the picker, then\n    verify sleep/wake/delete.\n\n---\n\n## 2. Phase 1 — Prerequisites\n\nThe user's responsibility; verify what's verifiable, ask for the rest, invent nothing. State which\nitems you verified vs. which the user asserted.\n\n- **Connection mode** (Orca server vs SSH) confirmed with the user — see §1 step 2; it shapes the recipe.\n- **Cloud account + plan** that allows sandboxes/VMs. Ask.\n- **Provider CLI installed + authenticated** — detect (`command -v <cli>`), check auth (e.g.\n  `vercel whoami`). If missing, point at the provider's docs; don't log them in.\n- **Scope / project / region** the sandboxes live under. Ask; flows into every script via state.\n- **Plan / timeout / RAM caps.** Record them — e.g. Vercel Hobby caps sandbox timeout at **45m**,\n  which limits both the base build and per-workspace runtime (see §10).\n- **Git token for private repos** (`GH_TOKEN`/`GITHUB_TOKEN`, or the provider's git auth; can fall back\n  to `gh auth token`). See §5.\n- **Coding-agent CLI choice** (`codex`, `claude`…) and that the user has an account — it gets\n  authenticated into the VM in Phase 3.\n\n---\n\n## 3. Phase 2 — Base snapshot (the reusable image)\n\nBuild **once**, snapshot, and every workspace boots from it in seconds instead of rebuilding.\nProvisioning + building takes a while (often ~20–30 min), so it runs behind a checkpoint. The script\nshape is §7a; key points:\n\n- Build the **headless Electron main only** (not the renderer) so it fits in plan RAM.\n- Use the VM image's package manager (`apt`/`dnf`/`apk`, per the base distro — not the provider brand).\n- Clone with the git token via `GIT_ASKPASS` (§5).\n- **Trap errors and remove the half-built sandbox** so a crash doesn't leave a paid resource running.\n- **Never snapshot a machine on which the Orca runtime has already run.** The first `orca serve` creates\n  the runtime's user-data dir, and everything in it gets baked into the image and shared by every VM\n  booted from it: the pairing keypair and device-token registry (`orca-devices.json`,\n  `orca-e2ee-keypair.json`), `agent-session-authority.key`, and the build box's logs, terminal history\n  and orchestration db. Confirmed: two VMs from one such snapshot emitted **identical `deviceToken` and\n  `pairedDeviceId`**. Snapshot **before** the runtime has ever run, or delete the resolved user-data\n  directory first: `orca_user_data_path=\"${ORCA_USER_DATA_PATH:-${XDG_CONFIG_HOME:-$HOME/.config}/orca}\"; rm -rf -- \"$orca_user_data_path\"`.\n  This matches Orca's Linux precedence for custom and default paths; deleting a named file list will\n  drift as Orca adds state.\n- Snapshot the stopped sandbox, parse the snapshot id, and write it + scope/project/port/repo to state.\n\n---\n\n## 4. Phase 3 — Agent-auth snapshot (interactive)\n\nThe base snapshot has the agent CLI installed but **not logged in**, and per-workspace VMs are\nephemeral — so authenticate once and bake it into a second snapshot layer. Script shape is §7b:\n\n1. Boot a sandbox from the base `snapshotId` (from state).\n2. Run the agent's login **interactively** (`--interactive --tty`); the user completes the URL/code in\n   their browser. On a **headless VM this must be the device-auth flow** (e.g. `codex login --device-auth`),\n   **not** plain `codex login`: the default OAuth login starts a loopback callback server on a container\n   port the host browser can't reach, so it hangs. Device-auth instead prints a URL + code the user opens\n   on the **host**.\n3. Verify login; **refuse to snapshot an unauthenticated VM.** Prefer the status command's **exit code**\n   (most agent CLIs exit non-zero when unauthenticated). If you grep instead, agent status often goes to\n   **stderr** (e.g. `codex login status` prints \"Logged in using ChatGPT\" there), so **fold stderr first**\n   (`... 2>&1 | grep …`) and match the agent's **exact success line** — never `grep -qi 'logged in'`, which\n   also matches \"**not** logged in\" and would commit an unauthenticated image.\n4. Re-snapshot, parse the new id, and overwrite `snapshotId` in state to the authenticated image\n   (recording `authSourceSnapshotId`). Remove the auth sandbox.\n\n**You can't drive step 2 yourself** (you run commands non-interactively — no TTY). The **user** runs it in\ntheir own terminal, or via the Claude Code harness bang-prefix (`! <cmd>`, with the required space after\n`!`). You scaffold/boot the sandbox and run steps 3–4, but **you cannot observe the interactive login\nfinishing** — so **ask the user to tell you when it's done** before you verify and re-snapshot.\n\nThis layer inherits §3's rule: if you started `orca serve` on the base or auth sandbox to smoke-test it,\ndelete the runtime's user-data dir (`~/.config/orca` on Linux) before re-snapshotting, or every workspace\nbooted from this image shares one pairing identity and one `agent-session-authority.key`.\n\nIf the agent's credentials are short-lived, warn that the snapshot may need periodic re-auth (§10).\n\nFor disposable runtimes, do **not** treat a host agent config directory (for example `~/.codex`) as the\nauth snapshot by bind-mounting or copying it wholesale. Agent homes often contain sqlite state, hook\napproval state, caches, logs, and host-specific env/config. Instead, authenticate/configure the agent\ninside the disposable runtime and snapshot/commit that runtime layer.\n\n---\n\n## 5. Credentials\n\n- **Never** commit secrets or put them in `userData`, recipe JSON, comments, docs, or the state file.\n- **Git token:** read from env (`GH_TOKEN`/`GITHUB_TOKEN`), falling back to `gh auth token`. Pass to the\n  VM only via the provider's ephemeral `--env`. Inside the VM, use a `GIT_ASKPASS` helper with\n  `x-access-token` (not the token in the clone URL) and `GIT_TERMINAL_PROMPT=0` so a missing token fails\n  fast instead of hanging. When you write the helper from inside `bash -lc` under `set -u`, escape the\n  positional arg and the token (`\\$1`, `\\$GH_TOKEN`) so they land **literally** and resolve at git-runtime\n  — an unescaped `$1` aborts with \"unbound variable\", and a literal `$GH_TOKEN` keeps the real token out of\n  the written file. `rm -f` the helper after the clone/fetch.\n- **Provider auth:** rely on the provider CLI's logged-in session, not checked-in keys.\n- **Agent auth:** lives in the authenticated snapshot (Phase 3) — never a file you write or commit.\n- State holds only **non-secret** wiring (snapshot ids, scope, project, port, repo url/ref).\n\n---\n\n## 6. State file\n\nA repo-local JSON file (e.g. `scripts/orca-vm/<provider>-state.json`) threads non-secret values between\nphases. Each script resolves values as **env var → state → built-in fallback**, and merges its outputs\nback. Phase 2 writes the base `snapshotId`; Phase 3 overwrites it with the authenticated snapshot;\nper-workspace `create` boots from `snapshotId`.\n\n```json\n{\n  \"baseName\": \"orca-base\",\n  \"snapshotId\": \"snap_authenticated_image_id\",\n  \"authSourceSnapshotId\": \"snap_base_image_id\",\n  \"scope\": \"<provider-scope>\",\n  \"project\": \"<provider-project>\",\n  \"port\": 7331,\n  \"repoUrl\": \"https://host/org/repo.git\",\n  \"repoRef\": \"main\",\n  \"projectRoot\": \"/abs/path/on/remote/repo\"\n}\n```\n\n---\n\n## 7. Script templates (provider-agnostic shapes)\n\nScaffold under `scripts/orca-vm/`. These are **shapes** — fill in the provider's real commands. All\nreserve stdout for the final JSON and log progress to stderr. Include a shared `json_value <key>` /\n`env_value <NAME>` reader (env → state → fallback) in each.\n\n**Where each script runs:**\n\n- **Local-side** (`create`/`suspend`/`resume`/`destroy` + the base-snapshot/auth scripts the user\n  invokes) runs **on the user's desktop**, so it must run on their OS. macOS/Linux: `#!/usr/bin/env\nbash`, `set -euo pipefail`, quoted paths. **Windows:** a bare `.sh` won't run — scaffold `.ps1`/`.cmd`\n  or require WSL/Git-Bash and point `orca.yaml` at the right launcher.\n- **Remote-side** (commands you `exec` _inside_ the Linux VM) always runs in the VM's Linux shell, so\n  bash is fine there regardless of the user's OS.\n\n### 7a. Base-snapshot (`<provider>-base-snapshot.sh`) — Phase 2\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve base_name/repo_url/repo_ref/project_root/port/scope/project/timeout (env→state→fallback)\n# resolve gh token: GH_TOKEN | GITHUB_TOKEN | `gh auth token`\n# 1. provision a sandbox (timeout/vcpus/published port/snapshot retention); trap: remove on error\n# 2. remote exec (long timeout): install pkgs + gh + corepack/pnpm + agent CLI;\n#    clone with GIT_ASKPASS(token); write headless main-only build config;\n#    dev setup; pnpm install; build CLI; build headless electron main; smoke-check tools\n# 3. snapshot stopped sandbox; parse snapshot id (fail if unparseable)\n# 4. merge { baseName, snapshotId, projectRoot, repoUrl, repoRef, port, scope, project } into state\n# print only the state JSON to stdout\n```\n\nWorked Vercel commands for this phase are in §7f. You run this script by hand (not via `orca.yaml`),\nafter exporting the first-run inputs the state file doesn't have yet — e.g. provider scope/project, the\nrepo URL/ref, and a git token (`GH_TOKEN`); later runs read them back from state.\n\n### 7b. Auth (`<provider>-base-auth.sh`) — Phase 3\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read source snapshot from state.snapshotId (fail if absent); auth_name=\"${base_name}-auth\"\n# 1. boot sandbox from source snapshot; trap: remove on error\n# 2. INTERACTIVE/TTY remote exec: agent login — user completes URL/code. Headless VM: MUST use the\n#    device-auth flow (e.g. `codex login --device-auth`) — plain OAuth login binds a loopback callback\n#    port the host can't reach and hangs. User runs this themselves (you have no interactive TTY); ask\n#    them to report back when it's done before continuing.\n# 3. verify login, then refuse to snapshot if not logged in. Prefer the status command's EXIT CODE (most\n#    agent CLIs exit non-zero when unauthenticated) over string-matching. If you must grep, fold stderr\n#    first (`status 2>&1 | grep …` — many agents print the success line there) and match the agent's exact\n#    success line; never `grep -qi 'logged in'`, which also matches \"not logged in\". Codex example: §7f.\n# 4. snapshot; parse new id\n# 5. merge { snapshotId:<new>, authSourceSnapshotId:<source> } into state; remove auth sandbox\n# print only the state JSON to stdout\n```\n\n### 7c. Create (`<provider>-create.sh`) — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# read authenticated snapshotId/scope/project/port/repo*/project_root (env→state→fallback)\n# fail clearly if snapshotId is missing (point back to Phases 2–3)\n# name = orca-${ORCA_RECIPE_ID}-${ORCA_VM_INSTANCE_ID} (sanitized, length-capped)\n# 1. boot sandbox from snapshotId with a published port; capture the public URL → pairing address\n#    (an externally reachable wss:// URL); trap: remove sandbox on error\n# 2. remote exec: ensure repo at desired commit; rebuild only if commit changed (cache marker)\n# 3. remote exec: start orca serve in the background and read the recipe JSON it writes (see below)\n# 4. print serve's JSON to stdout, optionally enriched with userData:\n#    { schemaVersion:1, pairingCode, projectRoot, userData:{ provider, resourceId:name, snapshotId } }\n```\n\n**The exact `orca serve` invocation and its output (verified — do not improvise the flags).** Inside the\nVM, run:\n\n```bash\norca serve \\\n  --port \"$PORT\" \\\n  --project-root \"$ABS_REPO_PATH_ON_REMOTE\" \\\n  --pairing-address \"$EXTERNAL_WSS_URL\" \\\n  --recipe-json\n```\n\n**Binary name:** in a VM built from source (the Phase-2 flow), run it as `pnpm exec orca-dev serve …`\nfrom the repo root — `orca-dev` is the in-repo entrypoint and is what the §7f example uses. Plain\n`orca serve …` is the same command when the built CLI is installed on the VM's PATH. The flags/output\nare identical either way.\n\nThere is **no `--host` flag**. `--project-root` must be an absolute directory on the remote. With\n`--recipe-json` the server **stays running** and prints exactly this single object to **stdout**, then\nkeeps serving:\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"pairingCode\": \"<orca pairing URL>\",\n  \"projectRoot\": \"<the --project-root you passed>\"\n}\n```\n\n`pairingCode` is the pairing URL, already pointing at whatever you passed as `--pairing-address` — so set\n`--pairing-address` to the externally reachable address and **pass `pairingCode` through unchanged; never\nhand-rewrite it**. Because serve runs in the foreground and doesn't exit, redirect its stdout to a file\nand poll until that file parses as JSON (and bail if the process dies — dump its stderr log). Your\n`create` script then prints that JSON (optionally merging `userData`). Concrete pattern: §7f.\n\n### 7d. Suspend / resume / destroy — per workspace\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\npayload=\"$(cat)\"                       # Orca passes lifecycle JSON on stdin\nresource_id=\"$(node -e 'const d=JSON.parse(process.argv[1]); process.stdout.write(d.recipeResult?.userData?.resourceId ?? \"\")' \"$payload\")\"\n[ -n \"$resource_id\" ] || { echo \"No resource id in lifecycle payload\" >&2; exit 1; }\n# suspend: provider suspend \"$resource_id\"\n# resume:  provider resume \"$resource_id\"; then RE-EMIT fresh recipe JSON (pairing may change)\n# destroy: provider remove \"$resource_id\"   (or set destroy: none in orca.yaml)\n```\n\n### 7e. State file — scaffold with scope/project/repo filled in and snapshot ids empty (§6).\n\n### 7f. Worked example — Vercel Sandbox (all three phases)\n\nA real, working shape (the Vercel surface is a CLI: `vercel sandbox create|exec|snapshot|remove`). Adapt\nnames; verify flags against `vercel sandbox --help` for the user's CLI version before relying on them.\nThese ground §7a (base snapshot) and §7b (auth), which are otherwise generic skeletons.\n\n**Phase 2 — base snapshot (§7a):** provision → install tools + clone + headless build → snapshot.\n\n```bash\n# provision a fresh build sandbox (retain a couple of snapshots); trap-remove on error\nvercel sandbox create --name \"$base\" --runtime node24 --timeout 30m --vcpus 4 --publish-port \"$port\" \\\n  --snapshot-expiration 30d --keep-last-snapshots 2 \"${vercel_args[@]}\" >&2\n# remote build (long timeout): install pkgs+gh+pnpm+agent CLI, clone with GIT_ASKPASS (write the helper\n# with LITERAL \\$1/\\$GH_TOKEN so they resolve at git-runtime, not write-time — see §5/§7f create — then\n# `rm -f /tmp/askpass.sh`), write the headless main-only build config (drop the renderer), dev setup,\n# build CLI + headless main, smoke-check\nvercel sandbox exec \"$base\" \"${vercel_args[@]}\" --timeout 25m --env \"GH_TOKEN=$gh_token\" … -- bash -lc '…build…' >&2\n# snapshot the STOPPED sandbox and parse the id from CLI output (fail if unparseable)\nout=\"$(vercel sandbox snapshot \"$base\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nsnapshot_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# merge { baseName, snapshotId, scope, project, port, repoUrl, repoRef, projectRoot } into state; print state JSON\n```\n\n**Phase 3 — agent-auth snapshot (§7b):** boot the base, log the agent in interactively, re-snapshot.\n(`codex` below is an example — substitute the user's chosen agent's login/status verbs, e.g. `claude`.)\n\n```bash\nvercel sandbox create --name \"$auth\" --snapshot \"$snapshot_id\" --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" >&2\n# INTERACTIVE — the USER runs this in their own terminal (you have no interactive TTY) and completes the\n# URL/code on the HOST. --device-auth is MANDATORY on a headless VM: plain `codex login` binds a loopback\n# callback port the host browser can't reach and hangs. Ask the user to report back when login finishes.\nvercel sandbox exec --interactive --tty \"$auth\" \"${vercel_args[@]}\" -- bash -lc 'codex login --device-auth'\n# refuse to snapshot an unauthenticated VM — fold stderr, match codex's exact success line (§4)\nvercel sandbox exec \"$auth\" \"${vercel_args[@]}\" --timeout 30s -- bash -lc 'codex login status 2>&1' | grep -Eqi 'Logged in using ChatGPT|Logged in via device' \\\n  || { echo \"agent not logged in; not snapshotting\" >&2; exit 1; }\nout=\"$(vercel sandbox snapshot \"$auth\" --stop --expiration 30d \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$out\" >&2\nnew_id=\"$(printf '%s\\n' \"$out\" | sed -nE 's/.*(snap_[A-Za-z0-9]+).*/\\1/p' | tail -1)\"\n# overwrite state.snapshotId = new_id, record authSourceSnapshotId = snapshot_id; remove the auth sandbox\n```\n\n**Per-workspace `create`** (the fast path):\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback: snapshot_id, scope, project, port, repo_url, repo_ref, project_root\nvercel_args=(); [ -n \"$scope\" ] && vercel_args+=(--scope \"$scope\"); [ -n \"$project\" ] && vercel_args+=(--project \"$project\")\n[ -n \"$snapshot_id\" ] || { echo \"snapshotId missing — run Phases 2–3 first\" >&2; exit 1; }\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nrecipe_id=\"${ORCA_RECIPE_ID:-vercel-sandbox}\"\nrecipe_id=\"${recipe_id//./-}\"  # Vercel names forbid dots.\ninstance_id=\"${ORCA_VM_INSTANCE_ID:-$(date +%s)}\"\nmax_recipe_id_length=$((128 - ${#instance_id} - 6))  # Preserve the unique instance suffix.\n[ \"$max_recipe_id_length\" -gt 0 ] || { echo \"ORCA_VM_INSTANCE_ID is too long for a Vercel sandbox name\" >&2; exit 1; }\nname=\"orca-${recipe_id:0:max_recipe_id_length}-${instance_id}\"\n\n# Arm cleanup BEFORE create so a failing create can't leak a half-built paid sandbox.\ncleanup_on_error() { [ \"$?\" -ne 0 ] && vercel sandbox remove \"$name\" \"${vercel_args[@]}\" >/dev/null 2>&1 || true; }\ntrap cleanup_on_error EXIT\n\n# 1. boot from the authenticated snapshot, publish the serve port\ncreate_output=\"$(vercel sandbox create --name \"$name\" --snapshot \"$snapshot_id\" \\\n  --timeout 30m --publish-port \"$port\" \"${vercel_args[@]}\" 2>&1)\"; printf '%s\\n' \"$create_output\" >&2\n# Vercel prints the published https URL; derive the external wss:// pairing address from it\npublic_url=\"$(printf '%s\\n' \"$create_output\" | sed -nE 's#.*(https://[^[:space:]]+\\.vercel\\.run).*#\\1#p' | head -1)\"\n[ -n \"$public_url\" ] || { echo \"no published URL in create output\" >&2; exit 1; }\npairing_ws=\"${public_url/https:\\/\\//wss://}\"\n\n# 2. (remote) ensure the repo is at the right commit; rebuild only if the commit changed (cache marker)\nvercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 20m \\\n  --env \"GH_TOKEN=$gh_token\" --env \"ORCA_PROJECT_ROOT=$project_root\" \\\n  --env \"ORCA_REPO_URL=$repo_url\" --env \"ORCA_REPO_REF=$repo_ref\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; \\\n    # Re-establish git auth for the private-repo fetch (why + full rationale: §5); else it hangs on a prompt.\n    # Load-bearing escaping: \\$1 and \\$GH_TOKEN must land LITERALLY and resolve at git-runtime. Test after\n    # any edit here — reformatting the nested printf/node quoting silently breaks the fetch or leaks the token.\n    if [ -n \"${GH_TOKEN:-}\" ]; then \\\n      printf \"%s\\n\" \"#!/usr/bin/env bash\" \"case \\\"\\$1\\\" in *Username*) echo x-access-token;; *Password*) echo \\\"\\$GH_TOKEN\\\";; esac\" > /tmp/askpass.sh; \\\n      chmod 700 /tmp/askpass.sh; export GIT_ASKPASS=/tmp/askpass.sh GIT_TERMINAL_PROMPT=0; fi; \\\n    git fetch origin \"$ORCA_REPO_REF\"; \\\n    git checkout -B \"$ORCA_REPO_REF\" FETCH_HEAD; \\\n    rm -f /tmp/askpass.sh; \\\n    c=\"$(git rev-parse HEAD)\"; [ -f .orca-built ] && [ \"$(cat .orca-built)\" = \"$c\" ] || { \\\n      pnpm install --prefer-offline && pnpm run build:cli && \\\n      node config/scripts/run-electron-vite-build.mjs --config config/electron-vite.vm-serve.config.ts && \\\n      printf \"%s\" \"$c\" > .orca-built; }' >&2\n\n# 3. (remote) start orca serve in the background, writing recipe JSON to a file; poll until it parses\nrecipe_json=\"$(vercel sandbox exec \"$name\" \"${vercel_args[@]}\" --timeout 60s \\\n  --env \"ORCA_PORT=$port\" --env \"ORCA_PROJECT_ROOT=$project_root\" --env \"ORCA_PAIRING_ADDRESS=$pairing_ws\" \\\n  -- bash -lc 'set -euo pipefail; cd \"$ORCA_PROJECT_ROOT\"; rm -f /tmp/orca-recipe.json /tmp/orca-serve.log; \\\n    nohup pnpm exec orca-dev serve --port \"$ORCA_PORT\" --project-root \"$ORCA_PROJECT_ROOT\" \\\n      --pairing-address \"$ORCA_PAIRING_ADDRESS\" --recipe-json >/tmp/orca-recipe.json 2>/tmp/orca-serve.log </dev/null & \\\n    pid=$!; for _ in $(seq 1 80); do \\\n      node -e \"JSON.parse(require(\\\"node:fs\\\").readFileSync(\\\"/tmp/orca-recipe.json\\\",\\\"utf8\\\"))\" >/dev/null 2>&1 && { cat /tmp/orca-recipe.json; exit 0; }; \\\n      kill -0 \"$pid\" 2>/dev/null || { cat /tmp/orca-serve.log >&2; exit 1; }; sleep 0.25; \\\n    done; cat /tmp/orca-serve.log >&2; echo \"serve recipe JSON timed out\" >&2; exit 1')\"\n\n# 4. print serve's JSON enriched with userData (single object on stdout)\nnode -e 'const p=JSON.parse(process.argv[1]); console.log(JSON.stringify({...p, schemaVersion:1,\n  userData:{...p.userData, provider:\"vercel-sandbox\", resourceId:process.argv[2], snapshotId:process.argv[3]}}))' \\\n  \"$recipe_json\" \"$name\" \"$snapshot_id\"\ntrap - EXIT\n```\n\n`suspend`/`resume`/`destroy` use `vercel sandbox stop|...|remove \"$resource_id\"` reading\n`userData.resourceId` from stdin (§7d). This is the **Orca-server** connection mode (the recipe emits a\npairing URL). If the user chose **SSH** in the §1 interview, use §7g instead.\n\n### 7g. Worked example — existing SSH host (SSH connection mode)\n\nSSH mode is **fundamentally different from §7c/§7f**, not a relabeling of them:\n\n- **`create` does NOT run `orca serve` and does NOT emit a `pairingCode`.** Orca itself connects to the\n  host over its SSH relay, brings up the git + filesystem providers, and imports the repo. The script's\n  only job is to make the host ready and **print SSH connection details** Orca will dial.\n- The result uses a `connection` block with `type: \"ssh\"` and a `target`, **not** the flat\n  `pairingCode`/`projectRoot` shape. Exact shape (Orca rejects anything else):\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"connection\": {\n    \"type\": \"ssh\",\n    \"projectRoot\": \"/abs/path/to/repo/on/host\",\n    \"target\": {\n      \"label\": \"my-box\",\n      \"host\": \"192.0.2.10\",\n      \"port\": 22,\n      \"username\": \"ubuntu\",\n      \"identityFile\": \"~/.ssh/id_ed25519\",\n      \"jumpHost\": \"bastion.example.com\",\n      \"proxyCommand\": \"cloudflared access ssh --hostname %h\",\n      \"relayGracePeriodSeconds\": 0,\n      \"portForwards\": []\n    }\n  }\n}\n```\n\n`label`, `host`, `port`, `username` are required; the rest are optional — omit any you don't need.\n\nFor an explicitly requested one-VM-per-workspace checkout, the create script must read\n`ORCA_RECIPE_RESULT_SCHEMA_VERSION`, `ORCA_REPO_URL`, `ORCA_REPO_REF`, `ORCA_REPO_REF_HEAD`, and\n`ORCA_REPO_BRANCH`. Use `ORCA_REPO_REF` to fetch the selected source, but create\n`ORCA_REPO_BRANCH` at the exact `ORCA_REPO_REF_HEAD` commit; resolving the symbolic ref again can race\nwith an upstream update. `ORCA_REPO_URL` and `ORCA_REPO_REF` are a matched fetch pair, including when\nthe desktop source uses multiple remotes. Return that primary checkout at `projectRoot` and emit the\nsame SSH result with:\n\n```bash\n[ -n \"${ORCA_REPO_REF_HEAD:-}\" ] || { echo \"missing pinned source commit\" >&2; exit 1; }\ngit fetch origin \"$ORCA_REPO_REF\"\ngit cat-file -e \"${ORCA_REPO_REF_HEAD}^{commit}\"\ngit checkout -B \"$ORCA_REPO_BRANCH\" \"$ORCA_REPO_REF_HEAD\"\n```\n\n```json\n{\n  \"schemaVersion\": 2,\n  \"checkoutMode\": \"provisioned-root\",\n  \"connection\": {\n    \"type\": \"ssh\",\n    \"projectRoot\": \"/abs/repo\",\n    \"target\": { \"label\": \"my-box\", \"host\": \"192.0.2.10\", \"port\": 22, \"username\": \"ubuntu\" }\n  }\n}\n```\n\nFail if the requested schema is not `2`; do not silently fall back to the ordinary recipe shape.\n\n**Networking → which `target` fields to set** (how _your desktop_ reaches the box — there is no\n`orca serve` URL in SSH mode):\n\n- Public IP / DNS, or a Tailscale/VPN address → `host`; SSH port → `port` (usually 22).\n- Key auth → `identityFile` (add `identitiesOnly: true` if the agent has many keys).\n- Through a bastion → `jumpHost` (a `user@host` ProxyJump) **or** a full `proxyCommand` (e.g. an access\n  proxy). Use one, not both.\n- A service port the workspace needs → add entries to `portForwards`.\n- `relayGracePeriodSeconds` (optional): how long Orca keeps the SSH relay alive after the workspace\n  detaches before tearing it down; `0` = tear down immediately. Leave it off unless the user wants a\n  reconnect grace window.\n\n**Toolchain & agent auth on a persistent (no-snapshot) host — do this ONCE, by hand, before wiring the\nrecipe** (there's no base image to bake; the host _is_ the base). Run the §7f Phase-2 install steps and\nthe §7f Phase-3 `<agent> login --device-auth` **directly over SSH on the host** (interactive, e.g.\n`ssh -t user@host '<agent> login --device-auth'`). After that the host stays ready across workspaces.\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n# resolve from env→state→fallback (default unset optionals to \"\"): ssh_username, host,\n#   ssh_port (default 22), identity_file, jump_host, proxy_command, project_root, repo_url, repo_ref\n: \"${identity_file:=}\"; : \"${jump_host:=}\"; : \"${proxy_command:=}\"   # avoid set -u aborts on optionals\ngh_token=\"${GH_TOKEN:-${GITHUB_TOKEN:-$(command -v gh >/dev/null 2>&1 && gh auth token 2>/dev/null || true)}}\"\nssh_target=\"${ssh_username}@${host}\"\nssh_opts=(-p \"$ssh_port\"); [ -n \"$identity_file\" ] && ssh_opts+=(-i \"$identity_file\")\n# Why: a fresh host's key isn't in known_hosts; a StrictHostKeyChecking prompt would HANG a\n# non-interactive create. Pre-add the key (or set the option) so it can't block.\nssh-keyscan -p \"$ssh_port\" \"$host\" >> \"$HOME/.ssh/known_hosts\" 2>/dev/null || true\n\n# 1. ensure the repo is present and at the right commit on the host (NO orca serve here)\nssh \"${ssh_opts[@]}\" \"$ssh_target\" \\\n  \"GH_TOKEN='$gh_token' GIT_TERMINAL_PROMPT=0 bash -lc '\n     set -euo pipefail\n     [ -d \\\"$project_root/.git\\\" ] || git clone \\\"$repo_url\\\" \\\"$project_root\\\"\n     cd \\\"$project_root\\\" && git fetch origin \\\"$repo_ref\\\" && git checkout -B \\\"$repo_ref\\\" FETCH_HEAD\n   '\" >&2\n\n# 2. print the SSH connection block (NO pairingCode, NO orca serve). host/port/username tell Orca's\n#    relay how to dial in; identityFile/jumpHost/proxyCommand/portForwards are emitted when set.\nnode -e 'const [host,port,user,idf,jh,pc,root]=process.argv.slice(1);\n  const target={ label:\"per-workspace-host\", host, port:Number(port), username:user };\n  if(idf) target.identityFile=idf; if(jh) target.jumpHost=jh; if(pc) target.proxyCommand=pc;\n  // add target.portForwards=[...] here if the workspace needs forwarded service ports\n  console.log(JSON.stringify({ schemaVersion:1, connection:{ type:\"ssh\", projectRoot:root, target } }))' \\\n  \"$host\" \"$ssh_port\" \"$ssh_username\" \"$identity_file\" \"$jump_host\" \"$proxy_command\" \"$project_root\"\n```\n\n`suspend`/`resume`/`destroy`: on a persistent host there's usually nothing to tear down — set\n`destroy: none` and omit suspend/resume. (Orca still disconnects/reconnects its own SSH relay on\nsleep/wake/delete — that's separate from these scripts.)\n\nIf the SSH host is instead an **ephemeral/snapshot-capable VM** (your hypervisor, or a cloud VM with\nimage support), keep the §7f Phase-2/3 base-image model for provisioning, but still emit the\n`connection.type:\"ssh\"` block above instead of starting `orca serve`.\n\n### 7h. Worked example — local Docker SSH (SSH connection mode)\n\nLocal Docker can model an ephemeral SSH VM without cloud cost: build a base image with `sshd`, tools,\nrepo prerequisites, and the agent CLI; run an **interactive auth container** once; then `docker commit`\nthat container as the authenticated image used by per-workspace `create`.\n\nKey points:\n\n- Publish container SSH to a random localhost port (`-p 127.0.0.1::22`) and emit\n  `connection.type:\"ssh\"` with `host:\"127.0.0.1\"`, that port, `username`, `identityFile`, and\n  `identitiesOnly:true`.\n- Generate a repo-local SSH key if needed, but gitignore the private/public key files.\n- **Bake SSH host keys into the base image** (`ssh-keygen -A` at **build** time; at runtime only generate\n  if absent). Ephemeral containers all present the **same** host key, so `known_hosts` on `127.0.0.1`\n  doesn't churn as the published port rotates across workspaces (otherwise every container's freshly\n  generated key collides on `localhost` and trips host-key-changed warnings).\n- The auth image is the Docker equivalent of Phase 3: the **user** runs the agent login **inside** the\n  container (you can't drive it — you have no interactive TTY), configures proxy env/config, approves\n  hooks, and you commit once they report it's done. On a headless container use the **device-auth** flow\n  (§4). Verify login before committing — exit code, or fold stderr and match the exact success line (§4).\n- Do not bind-mount or copy the host's full agent home into the image. Let each container have writable\n  agent state; only the committed auth image should carry reusable authenticated state.\n- If committing from an interactive shell, force the runtime entrypoint back to `sshd`:\n  `docker commit --change='ENTRYPOINT [\"/usr/local/bin/orca-docker-ssh-entrypoint\"]' …`.\n- `destroy` should read `recipeResult.userData.resourceId` and run `docker rm -f \"$resource_id\"`.\n\nValidation before wiring/live use:\n\n```bash\ndocker image inspect \"$auth_image\" --format '{{json .Config.Entrypoint}}'\ndocker run -d --name \"$name\" -p 127.0.0.1::22 -e \"ORCA_SSH_PUBLIC_KEY=$pubkey\" \"$auth_image\"\ndocker ps -a --filter \"name=$name\"\ndocker logs \"$name\"\nssh -i \"$key\" -p \"$port\" -o IdentitiesOnly=yes user@127.0.0.1 'codex --version'\n```\n\nIf the container exits immediately, inspect logs before the cleanup trap removes it; a committed\ninteractive image with `ENTRYPOINT [\"bash\"]` is a common cause.\n\nAlso confirm the **host key is stable** across containers: the SSH `ssh -i … 127.0.0.1` dial should not\ntrigger a host-key-changed warning when a second container reuses the port. If it does, the host keys\nweren't baked into the base image (see the `ssh-keygen -A` point above).\n\n### 7i. Windows local-side scripts\n\nThe local-side scripts run on the user's desktop. On **Windows**, a bare `.sh` won't execute. Either\nrequire WSL/Git-Bash (and point `orca.yaml` at e.g. `bash ./scripts/orca-vm/<name>.sh` via a `.cmd`\nlauncher), or scaffold PowerShell equivalents. Minimal PowerShell shape:\n\n```powershell\n#requires -Version 5\n$ErrorActionPreference = 'Stop'\n# resolve env→state→fallback; run the provider CLI / ssh the same way;\n# capture provider output; build the result object for the chosen mode and write ONE line of JSON to stdout.\n# Orca-server mode: @{ schemaVersion=1; pairingCode=$pairingCode; projectRoot=$projectRoot; userData=@{...} }\n# SSH mode:        @{ schemaVersion=1; connection=@{ type=\"ssh\"; projectRoot=$projectRoot;\n#                     target=@{ label=$label; host=$host; port=$port; username=$user } } }  (see §7g/§7h)\n($result | ConvertTo-Json -Compress -Depth 6)\n# progress/errors → Write-Error / the error stream, never stdout.\n```\n\nThe remote-side commands you run _inside_ the Linux VM stay bash regardless of the desktop OS.\n\n---\n\n## 8. Per-workspace recipe contract (the fast path)\n\nOnce the authenticated snapshot exists, this runs on every workspace create. Define recipes in\n`orca.yaml`:\n\n```yaml\nenvironmentRecipes:\n  - id: cloud-sandbox\n    name: Cloud Sandbox\n    create: ./scripts/orca-vm/cloud-sandbox-create.sh\n    suspend: ./scripts/orca-vm/cloud-sandbox-suspend.sh\n    resume: ./scripts/orca-vm/cloud-sandbox-resume.sh\n    destroy: ./scripts/orca-vm/cloud-sandbox-destroy.sh\n```\n\n`create` runs **locally from the repo root** and prints **one** JSON object to stdout. Its shape depends\non the connection mode chosen in §1:\n\n**Orca-server mode** — boot the env, start `orca serve` in it, and print serve's result:\n\n```json\n{\n  \"schemaVersion\": 1,\n  \"pairingCode\": \"orca-pairing-code-or-url\",\n  \"projectRoot\": \"/absolute/path/to/repo/on/remote\",\n  \"userData\": { \"provider\": \"example\", \"resourceId\": \"provider-resource-id\" }\n}\n```\n\nHere `pairingCode` (from `orca serve --recipe-json`) and `projectRoot` are required; `schemaVersion` (`1`)\nand `userData` are optional.\n\n**SSH mode** — do **not** run `orca serve`; print the `connection.type:\"ssh\"` block instead (full shape +\nworked script in §7g). `pairingCode` is **not** used in SSH mode.\n\n**Optional provisioned root** — only for direct SSH and only when explicitly requested. Add\n`checkoutMode: provisioned-root` to the recipe, require `ORCA_RECIPE_RESULT_SCHEMA_VERSION=2`, create\nthe requested `ORCA_REPO_BRANCH` at the pinned `ORCA_REPO_REF_HEAD` commit (use `ORCA_REPO_REF` only\nto fetch that commit) at the returned `projectRoot`, and emit schema version 2 with\n`checkoutMode: \"provisioned-root\"`. All recipes without this field retain the schema-v1 behavior above.\n\nLifecycle hooks (all run locally):\n\n- `create`: required. Prints recipe result JSON.\n- `suspend`: optional. Sleep; reads lifecycle payload on stdin.\n- `resume`: optional. Wake; reads payload on stdin and **prints fresh recipe JSON** (pairing may change).\n- `destroy`: optional unless `destroy: none`. Delete/cleanup; reads payload on stdin.\n\nStart Orca remotely with `orca serve --port \"$PORT\" --project-root \"$ABS_ROOT\" --pairing-address\n\"$EXTERNAL_WSS_URL\" --recipe-json` (exact flags + output in §7c). Set `--pairing-address` to the\nexternally reachable address so the emitted `pairingCode` is reachable; tunneling/port mapping is the\nscript's job.\n\nBackward compatibility: `command`→`create`, `cleanup`→`destroy`, `cleanup: none`→`destroy: none`.\nPrefer the lifecycle names.\n\n---\n\n## 9. Doctor and validation\n\nValidate in two stages — the cheap dry run first, then the live self-test.\n\n### Dry run (free, non-destructive) — always do this first\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --json` validates **static wiring only** — it does\n**not** boot anything. It checks: local-host execution (v1), repo path, recipe id exists,\ncreate/destroy/suspend/resume command paths resolve, suspend/resume are paired, and each script is\nexecutable (POSIX exec bit; skipped on Windows). Fix every failure here before spending any cloud money.\n\n### Live self-test (`--provision`) — diagnose and iterate yourself\n\n`orca vm recipe doctor <recipe-id> --repo-path <repo> --provision --json` actually runs the recipe end\nto end: it executes `create`, validates the returned recipe JSON, then runs `destroy` to **tear the\nenvironment back down** (so the test leaves nothing running, as long as `destroy` works). It spends real\ncloud money, so get the user's OK **once** before starting — that one approval covers the whole loop\nbelow; do not re-ask before each run.\n\nOn failure, the JSON result includes a `provisionTranscript` with the **complete** captured output of\neach stage so you can self-diagnose without asking the user to relay logs:\n\n```json\n{\n  \"ok\": false,\n  \"checks\": [{ \"id\": \"recipe.provision\", \"status\": \"fail\", \"message\": \"…\" }],\n  \"provisionTranscript\": {\n    \"provision\": { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\", \"parseError\": \"…\" },\n    \"destroy\": { \"exitCode\": 0, \"signal\": null, \"stdout\": \"…\", \"stderr\": \"…\" }\n  }\n}\n```\n\n**Run it as a loop:** read `provisionTranscript.provision.stderr` / `.stdout` / `.parseError` (and\n`destroy.*`), fix the script, and re-run `--provision` until `ok` is `true` — iterating on your own\nrather than waiting for the user to paste errors. Common reads: a non-empty `stderr` with `exitCode 0`\nplus a `parseError` means `create` ran but printed something other than the single recipe-result JSON on\nstdout (often a stray `echo` — route it to stderr, see §10); a non-zero `exitCode` is a provider/script\nfailure described in `stderr`. Each stream is redacted and capped (head+tail) — large logs keep both the\nsetup context and the failure.\n\nThe self-test cannot see provider-side truth beyond what the scripts print, so still confirm: state has a\npopulated **authenticated** `snapshotId` (Phases 2–3 done), and `destroy` is implemented/tested (or\nexplicitly `none` — in which case the self-test won't tear down, so clean up manually).\n\nFor SSH recipes, also smoke-test the exact emitted target before declaring success: dial the host/port\nwith the identity/proxy settings, run `pwd`, verify the repo path, check the agent binary, and confirm\n`destroy` removes the provider resource/container. For Docker, inspect the auth image entrypoint and do a\nstartup-only `docker run` before the full clone/install path.\n\n---\n\n## 10. Failure modes\n\n- **Build exceeds plan timeout (e.g. Hobby 45m).** Use enough vCPUs and a timeout covering the build;\n  else split work or use a higher plan. The cap also limits per-workspace runtime — surface it.\n- **Build exceeds plan RAM.** Build the **headless main only** (drop the renderer) — the biggest fitter.\n- **Private-repo clone hangs/fails.** Wrong/missing token. Use `GIT_ASKPASS` + `GIT_TERMINAL_PROMPT=0`\n  so it fails fast instead of prompting.\n- **`GIT_ASKPASS` helper aborts the clone with \"`$1: unbound variable`\".** The `printf`/heredoc that writes\n  the helper inside `bash -lc` under `set -u` expanded `$1`/`$GH_TOKEN` at **write** time. Escape them\n  (`\\$1`, `\\$GH_TOKEN`) so they land literally and resolve at git-runtime; this also keeps the real token\n  out of the file. `rm -f` the helper afterward (§5, §7f).\n- **Agent verified as \"not logged in\" despite a good login.** `codex login status` (and similar) print\n  \"Logged in …\" to **stderr**; an stdout-only `grep` misses it. Prefer the status **exit code**; if you\n  grep, fold stderr first (`status 2>&1 | grep …`) and match the exact success line — not `grep -qi\n'logged in'`, which also matches \"not logged in\".\n- **Headless agent login hangs.** Plain OAuth `login` starts a loopback callback server on a VM/container\n  port the host browser can't reach. Use the **device-auth** flow (`login --device-auth`) — it prints a\n  URL + code the user opens on the host.\n- **`known_hosts` host-key churn on local Docker.** Each ephemeral container regenerating its SSH host key\n  collides on `127.0.0.1` as the published port rotates. Bake host keys into the base image at build time\n  (`ssh-keygen -A`; runtime generates only if absent) so all containers share one stable key (§7h).\n- **Snapshot expired/evicted.** If `create` hits an unknown snapshot id, rerun Phases 2–3 and update\n  `snapshotId`.\n- **Agent auth didn't persist.** Confirm `snapshotId` points at the **authenticated** snapshot; re-run\n  Phase 3. Warn that short-lived tokens may need periodic re-auth.\n- **Agent auth copied from the host breaks.** Do not bind-mount/copy a full host agent home; sqlite\n  files can be unwritable or host-specific, hooks may need approval again, and config may reference\n  local-only env vars. Authenticate inside the runtime and snapshot/commit that layer.\n- **Docker auth image exits immediately.** Inspect `docker image inspect … .Config.Entrypoint` and\n  `docker logs`. If the image was committed from an interactive shell, reset the entrypoint to the SSH\n  entrypoint during `docker commit`.\n- **Leaked paid resource.** Every long script must trap errors and remove the sandbox it created.\n- **`create` emits non-JSON on stdout.** A stray `echo` corrupts the result — stdout is for the final\n  JSON only; everything else to stderr. The `--provision` self-test surfaces this as `exitCode 0` + a\n  `parseError` with the offending stdout in `provisionTranscript` (§9).\n\n---\n\n## 11. Boundaries\n\n- Don't create accounts, choose plans/regions, or invent scope/project/org/image/billing ids.\n- Don't invent or store credentials; no secrets in `userData`, state, comments, docs, or commits.\n- Don't run paid/long phases (base snapshot, auth, live test) without an explicit OK.\n- Don't hide provider errors behind generic messages — preserve actionable stderr.\n- Don't make Orca own provider lifecycle beyond invoking the configured scripts.\n- Don't commit or create an Orca workspace unless asked.\n"
 
 // oxfmt-ignore
-const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, coordinator loops, or decomposing work\n  across agents. Use `orca-cli` instead for full ownership handoffs, including\n  requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another\n  agent\", or \"another worktree\" when the user did not explicitly ask to\n  supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for\n  terminal control, lightweight terminal prompts, shell commands, Orca\n  worktree management, reading or waiting on terminals, and automation of the\n  browser embedded inside Orca. Use Computer Use for external browser windows,\n  webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when\n  the task requires OS/window-level control such as focus, menus, dialogs,\n  coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a\n  page-automation tool such as Playwright or CDP for external pages.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- `check --json` prints exactly one JSON document on stdout. While `--wait` blocks it also prints keepalive lines (`{\"_keepalive\":true,...}`) to stderr so you can tell the process is alive; those are never on stdout. Do not merge the streams before a parser — `check --wait --json 2>&1 | <parser>` fails with \"Extra data: line 2\". Pipe stdout only.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n## How deep workers can nest\n\nA dispatched worker normally cannot dispatch sub-workers. Attempting it fails with\n`nested_worker_depth_exceeded` and a message telling the worker to complete the task\nitself. Do that — do not try to route around it.\n\nThe limit is a number, not an on/off switch. `Settings -> Orchestration -> Nested worker depth`\nsets how many generations are allowed:\n\n- `1` (default): a coordinator dispatches workers; those workers do not dispatch.\n- `2`: workers may dispatch one further generation.\n\nDepth is counted from the terminal that issues the command, not from the Run. Creating a\nnew Run does not reset it — a worker that runs `run-create` then `worker-start` is still a\nworker, and still counted. This is the part that changed: the old behaviour rejected\nsub-dispatch only because a worker's terminal was not bound to a Run, so creating a Run was\nenough to slip past it.\n\nTwo limits worth knowing:\n\n- **It is a guardrail, not a security boundary.** A caller that declares another terminal's\n  handle while its own launch evidence is unverifiable (an ordinary restored terminal, for\n  example) can be counted as that terminal instead. Orca does not treat workers as hostile.\n- **It applies while a Dispatch is active.** After `worker_done`, or after a coordinator\n  settles the task, the terminal is no longer a worker and is counted as a root again. The\n  process may still be alive; that is the documented boundary, not an accident.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree current --agent claude --model opus --effort high --json\n```\n\n`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- The response was lost and named no Dispatch: run `orca orchestration request-show --request <request_id> --json` first. It is read-only. `completed` means the mutation already took effect. `pending` means the original mutation is still running or Orca restarted before recording its outcome. For either state, replaying the original command with `--retry-request <request_id>` reuses the same operation identity so Orca can replay, join, or safely recover it without starting a separate duplicate. `absent` means this runtime holds no receipt under your caller identity and is not proof that nothing happened; inspect the affected state before deciding whether to retry.\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n`dispatch --inject` deliberately keeps an operator-started terminal unsupervised: it never creates a `worker_dispatches` row and `worker-stop`/`worker-abandon` never close that process. The dispatch context is still authoritative, so `worker-show`, `worker-read`, and `worker-list` report it as `unsupervised`; settled `worker-retain` and `worker-release` report `retained` with `no_owned_resource` and take no process action. Use `worker-start --terminal <handle>` when supervision and worker lifecycle state are required.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end that dispatched turn and idle at the agent prompt. Do not autonomously start more work, poll, or attempt to close the terminal yourself. A direct user instruction takes precedence and starts ordinary user-owned work: follow it without coordinator approval or a fresh Dispatch, never refuse it because of worker/coordinator roles, and do not reuse the settled Dispatch's lifecycle IDs. A coordinator-supervised follow-up still arrives with a fresh preamble + TASK block.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
+const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n  Use Orca orchestration for structured multi-agent coordination: threaded\n  messages, blocking ask/reply flows, task dispatch, worker_done/escalation\n  waits, task DAGs, decision gates, or coordinator loops. Use `orca-cli`\n  instead for full ownership handoffs, including requests phrased as \"hand\n  off\", \"handoff\", \"handover\", \"give this to another agent\", or \"another\n  worktree\" when the user did not explicitly ask to supervise, monitor, wait\n  for results, or coordinate a DAG. Use `orca-cli` for terminal control,\n  lightweight terminal prompts, shell commands, Orca worktree management,\n  reading or waiting on terminals, and the Orca embedded browser. Use Computer\n  Use for external browser windows, webviews, Orca app UI, or desktop UI\n  outside Orca's embedded browser only when the task requires OS/window-level\n  control such as focus, menus, dialogs, coordinates, or screenshots. Use\n  `orca-cli` for Orca's embedded pages and a page-automation tool such as\n  Playwright or CDP for external pages.\n---\n\n# Orca Inter-Agent Orchestration\n\nOrchestration is Orca's structured coordination layer for agent messages, task ownership, dispatch state, and worker completion tracking.\n\nUse this skill when coordination state matters. For lightweight terminal prompts or basic worktree/terminal/built-in-browser control, use `orca-cli`.\n\n## Tool Boundary\n\nIf a task says to use Orca orchestration, the coordinator must create or bind a Run, create the Task with `orca orchestration task-create`, then attach the worker with either the preferred `orca orchestration worker-start` composition or the low-level `orca orchestration dispatch --inject` path.\n\nDo not substitute non-Orca subagent tools, generic agent-spawn APIs, or chat-only parallel worker features. Those may create useful workers, but they do not create Orca task/dispatch provenance, injected lifecycle preambles, `worker_done` authority, or decision gates.\n\nBefore claiming a worker was orchestrated, verify the task/dispatch exists:\n\n```bash\norca orchestration task-list --json\norca orchestration dispatch-show --task <task_id> --json\n```\n\nIf the work was accidentally run outside Orca orchestration, say so plainly. To repair provenance, rerun or revalidate the needed work through a fresh Orca terminal plus injected dispatch; do not retroactively describe the external worker as orchestrated.\n\n## When To Use\n\n- Send/reply/ask between agent terminals with persistent messages.\n- Dispatch structured tasks to workers and wait for `worker_done` or `escalation`.\n- Track task DAGs with dependencies.\n- Run coordinator loops or decision gates.\n\nDo not use orchestration merely because the user says \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or asks for another worktree/agent/model/effort. Those are full ownership transfers unless the user explicitly asks to supervise, monitor, wait for worker completion/results, coordinate a DAG, use decision gates, or keep a blocking ask/reply loop.\n\n## Preconditions\n\n- `orca status --json` should show a running runtime.\n- `orca` must be on PATH (`orca-ide` on Linux).\n- The orchestration experimental feature must be enabled in Settings > Experimental.\n- `orca orchestration` commands are RPC calls to the running Orca runtime.\n\n## Contract Migration\n\nOrca adopts a live pre-update orchestration assignment into an ordinary Run. Adoption preserves the existing agent process, PTY/session, terminal handle, tab/leaf/pane, worktree or folder workspace, Task, and Dispatch; it never restarts or replaces the worker. The retired scheduler is not revived, and a newly created attempt uses the current grammar.\n\nTreat the authority label on injected or formatted messages as definitive:\n\n- `[LEGACY COMPATIBILITY]` is live and attested. Run only the exact supported command printed with the message, using the same CLI executable and arguments that the original prompt supplied.\n- `[LEGACY RECOVERY REPLAY — MAY HAVE BEEN SEEN]` is one bounded, at-least-once cutover replay. Process it idempotently and acknowledge it only through the exact displayed guidance.\n- `[LEGACY READ-ONLY]` is inspection-only. It has no reply, acknowledgment, or lifecycle action.\n- An unlabeled current message uses the current guide and current grammar.\n\nAn explicitly selected current Run, attested current Run binding, current Dispatch, or federated attachment takes precedence over legacy fallback. A retained adoption record alone never turns a current command into a legacy call.\n\nDatabase provenance, an old-looking terminal, or a legacy Run ID does not prove mutation authority. If the runtime cannot prove liveness, principal ownership, capability, or the exact legacy contract, it degrades to read-only inspection and must not fall back to local execution. Exact recovery may restore the already-live PTY once in its original inactive background tab. It must not spawn, write, signal, stop, switch, focus, split, or inject a terminal. Loss of lifecycle authority does not invalidate the existing assignment, process, or filesystem work.\n\nCompatibility retries have narrow guarantees. A pending ask, a reply, a final Dispatch settlement, and a consuming check have durable recovery identities. A-era heartbeat and escalation calls remain at-least-once across a manual A-to-B retry because identical later signals may be intentional. If an A-era ask may already have been answered, run the exact non-consuming recovery check printed by the runtime first; after its answer is printed and acknowledged, a new invocation with the same question creates a new question. Never guess among multiple identical question threads.\n\nWhen a compatibility or recovery command returns structured next-step arguments, run those exact arguments with the same CLI executable. The arguments intentionally omit the executable name so the guidance works with `orca`, `orca-ide`, `orca-dev`, or another configured Orca CLI command. Do not translate the command from memory, broaden its recipient, or retry it as a current mutation unless the returned guidance explicitly says to.\n\nOn packaged Windows, a legacy ask uses a two-step commit/resume protocol. The initial command durably commits the question, prints its exact `ask --resume <message_id>` command, and exits with launcher status `75`; it does not wait for the answer. Run that exact resume command after the launcher or update boundary. Resume is idempotent and read-oriented: it waits for the already-committed question and does not create another one. For a WSL process that received compatibility proof at launch, use the printed executable `orca-ide` WSL resume command so the same distro and packaged launcher authority are preserved; do not substitute a PATH-resolved local CLI. Older WSL processes that never received the hidden launch token remain lifecycle read-only after the update, even while their terminal and filesystem work continue.\n\nLegacy inspection remains available without consuming mail:\n\n```bash\norca orchestration run-list --json\n# run_legacy_local is an empty audit tombstone after adoption.\norca orchestration run-show --id run_legacy_local --json\n# In run-list, find the ordinary Run whose objective is:\n# \"Recovered orchestration work from a contract update\"\norca orchestration run-show --id <adopted_run_id> --json\norca orchestration task-list --run <adopted_run_id> --json\norca orchestration inbox --full --json\norca orchestration check --terminal <legacy_handle> --peek --format --json\norca terminal read --terminal <legacy_handle> --json\norca terminal wait --terminal <legacy_handle> --for tui-idle --timeout-ms 60000 --json\n```\n\nIf the original coordinator is unavailable or cannot prove its retained authority, a current coordinator may explicitly take over the adopted Run from its own live agent terminal:\n\n```bash\norca orchestration run-use --id <adopted_run_id> --takeover-legacy --json\norca orchestration check --run <adopted_run_id> --json\n```\n\nTakeover fences only the old coordinator, binds the current one, and moves pending worker mail into current Run Delivery. It is bound to the authenticated invoking terminal; `--from` cannot name another coordinator. Live legacy workers keep their original Tasks, Dispatches, processes, filesystems, and old prompt commands; their later questions, escalations, and completion reports route to the current coordinator. Do not use takeover while the original coordinator is still actively coordinating, because its later lifecycle mutations are rejected.\n\nDo not launch a replacement editor merely because the desktop app or runtime was updated. If adoption cannot prove continuing authority, keep the original worker as the only editor until it reaches a stable handoff point, then use a new current Dispatch in a conflict-free placement for any remaining work.\n\n## Ownership\n\nNew orchestration messages and tasks belong to one explicitly bound Run. A Run is only a durable namespace and coordinator inbox; it never schedules or places workers. Lifecycle authority comes from the active Dispatch, and terminal handles remain routing metadata rather than durable identity. Send `worker_done` and `heartbeat` from the worker's own terminal; Orca routes them to that Dispatch's Run.\n\nClassify inherited context before sending lifecycle messages:\n\n- Coordinated subtask: a live coordinator owns the DAG and waits on this dispatch. Follow the preamble exactly, including `worker_done`, heartbeat/status, `ask`, and `escalation`.\n- Full handoff means ownership transfer, not supervised dispatch. The original actor is not monitoring a DAG, so do not create lifecycle obligations unless the user explicitly asks you to supervise.\n- Classify requests containing \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"another agent\", or \"another worktree\" as full handoffs by default, even when the user names a custom model or reasoning effort.\n- Use supervised orchestration only when the user explicitly asks you to \"supervise\", \"monitor\", \"wait\", \"track completion\", \"wait for worker_done\", return results, coordinate a DAG, use a decision gate, or manage ask/reply flow.\n- Do not use `orca orchestration dispatch --inject` for full handoffs. It injects a coordinator preamble that tells the worker to send `worker_done`, heartbeat, and `ask` messages, then end its turn under the original terminal's dispatch lifecycle.\n- Do not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. Do not peek at terminal output after prompt delivery to monitor progress.\n- A review-only `worker_done` reports findings; it does not authorize coordinator file edits. After a review-only completion, synthesize findings, ask a decision gate if ownership is unclear, and dispatch or hand off fixes unless the user explicitly asked the coordinator to own fixes.\n- If the user's plan names a next owner agent (for example, \"then use opencode to create a PR\"), post-review corrections and PR prep belong to that named owner. The coordinator routes, synthesizes, asks decision gates when needed, and supervises; the named owner edits files and creates the PR.\n\nIf unclear, inspect orchestration state before sending lifecycle messages:\n\n```bash\norca orchestration task-list --json\norca terminal list --json\n# If inherited context includes a task id:\norca orchestration dispatch-show --task <task_id> --json\n```\n\n## Messaging\n\n```bash\norca orchestration send --subject <text> [--to <run:id|dispatch:id|legacy_handle>] [--from <handle>] [--body <text>] [--type <type>] [--priority <level>] [--thread-id <id>] [--payload <json>] [--json]\norca orchestration check [--terminal <handle>] [--ack <delivery_id>] [--peek|--all] [--types <type,...>] [--format] [--wait] [--timeout-ms <n>] [--json]\norca orchestration reply --id <msg_id> --body <text> [--from <handle>] [--json]\norca orchestration ask (--question <text>|--resume <msg_id>) [--options <csv>] [--timeout-ms <n>] [--from <handle>] [--json]\norca orchestration inbox [--limit <n>] [--json]\n```\n\nRules:\n\n- Omit `--from` unless impersonating another terminal; Orca auto-resolves it from the current terminal.\n- A coordinator `check` returns the bound Run's oldest FIFO Delivery (up to 50 messages) and replays that exact batch until `--ack <delivery_id>`. Process every message before acknowledging; `check --ack <id> --wait` acknowledges, checks, and waits in one operation.\n- Use `--peek` and `--all` only for read-only history/debugging. Type filters decide when a waiter wakes; the returned actionable Delivery is still the oldest full batch.\n- Use `dispatch:<id>` for coordinator guidance to one supervised worker. Orca routes that stable address locally or through the connected-server relay; do not substitute a remote terminal handle.\n- Terminal handles remain appropriate for low-level pre-Dispatch messaging. Prefer `agentTerminalHandle` from the create response, fall back to `startupTerminal.handle` for older runtimes, then re-resolve with `orca terminal list --worktree ... --json` if missing or stale. Continue with the replacement handle only; never dual-send to old and new handles.\n- `terminal list --json` omits `visualLayouts` because handle recovery does not need topology. Add `--include-visual-layouts` only for explicit tab and pane inspection.\n- `orca orchestration check --peek --format --json` returns locally formatted unread mail without consuming it; it never writes to terminal input or remotely wakes another terminal. Use `orchestration dispatch --inject` to deliver a tracked task, or `terminal send` when an existing agent needs a free-form prompt.\n- While supervising workers manually, use `check --wait --types worker_done,escalation,question --timeout-ms <n>` instead of sleep/poll loops. Process the whole Delivery, reply to `question` messages with `orca orchestration reply --id <msg_id> --body <answer> --json`, then acknowledge and keep waiting.\n- `check --json` prints exactly one JSON document on stdout. While `--wait` blocks it also prints keepalive lines (`{\"_keepalive\":true,...}`) to stderr so you can tell the process is alive; those are never on stdout. Do not merge the streams before a parser — `check --wait --json 2>&1 | <parser>` fails with \"Extra data: line 2\". Pipe stdout only.\n- Treat a `check --wait` timeout or `{count:0}` as a checkpoint, not a worker failure. Long coding tasks routinely run 15-60 minutes; keep using rolling waits unless you receive `worker_done`/`escalation`, the terminal exits or disappears, or the user explicitly asks you to stop.\n- Heartbeats and visible terminal activity mean the worker is alive, not done. Do not stop, close, kill, or restart a worker just because it has not produced a completion message yet.\n- Use `ask` when a worker needs a blocking answer from the coordinator; it defaults to the active Dispatch's Run. Timeout or disconnect leaves the question pending, so resume by its original message ID instead of asking again.\n- `check --wait` returns one bounded Delivery, not every future completion. Process every message, acknowledge it, then keep waiting until every expected Dispatch settles.\n- Group addresses include `@all`, `@idle`, `@claude`, `@codex`, `@opencode`, `@gemini`, `@droid`, `@grok`, `@cursor`, and `@worktree:<id>`.\n- Message types include `status`, `dispatch`, `worker_done`, `merge_ready`, `escalation`, `handoff`, `question`, `decision_gate` (legacy/gates), and `heartbeat`.\n- Use group addresses only for messages that are genuinely useful to many terminals, such as `status` broadcasts or intentional fan-out questions. Do not send dispatch lifecycle messages to groups.\n- `worker_done` belongs to the active Dispatch and defaults to its Run mailbox; never target a group.\n- A valid `worker_done` for the active `taskId` + `dispatchId` marks the task and dispatch completed automatically. Do not follow it with `task-update --status completed`; reserve manual updates for explicit recovery or overrides.\n- `heartbeat` is also Dispatch-scoped. Include both IDs and omit `--to` so Orca uses the owning Run; use `status` for broad progress updates.\n\n## Tasks And Dispatch\n\nA Run is the namespace/inbox, a Task is the work item, and a Dispatch assigns one Task attempt to a terminal. Create or bind a Run once before the common loop.\n\n```bash\norca orchestration run-create --objective <text> --json\norca orchestration task-create --spec <text> [--deps <json_array>] [--parent <task_id>] [--json]\norca orchestration task-list [--status <status>] [--ready] [--brief] [--json]\norca orchestration task-update --id <task_id> --status <status> [--result <json>] [--json]\norca orchestration dispatch --task <task_id> --to <handle> [--from <handle>] [--inject] [--json]\norca orchestration dispatch-show --task <task_id> [--json]\n```\n\nTask statuses: `pending`, `ready`, `dispatched`, `completed`, `failed`, `blocked`.\n\nDispatch rules:\n\n- `--inject` sends the task spec plus preamble into a recognized agent CLI so it can report `worker_done`.\n- If the target is a bare shell, omit `--inject`, dispatch for tracking if needed, then send the prompt manually with `orca terminal send --terminal <handle> --text <prompt> --enter --json`.\n- After 3 consecutive failures on one task, the dispatch context circuit-breaks and the task is marked failed.\n- Use `task-list --brief --json` for coordinator sweeps; it collapses whitespace and caps each echoed spec at 160 characters (`spec_truncated` marks shortened rows). Omit `--brief` when the full spec is required, or when an older CLI rejects it as an unknown flag.\n\n## How deep workers can nest\n\nA dispatched worker normally cannot dispatch sub-workers. Attempting it fails with\n`nested_worker_depth_exceeded` and a message telling the worker to complete the task\nitself. Do that — do not try to route around it.\n\nThe limit is a number, not an on/off switch. `Settings -> Orchestration -> Nested worker depth`\nsets how many generations are allowed:\n\n- `1` (default): a coordinator dispatches workers; those workers do not dispatch.\n- `2`: workers may dispatch one further generation.\n\nDepth is counted from the terminal that issues the command, not from the Run. Creating a\nnew Run does not reset it — a worker that runs `run-create` then `worker-start` is still a\nworker, and still counted. This is the part that changed: the old behaviour rejected\nsub-dispatch only because a worker's terminal was not bound to a Run, so creating a Run was\nenough to slip past it.\n\nTwo limits worth knowing:\n\n- **It is a guardrail, not a security boundary.** A caller that declares another terminal's\n  handle while its own launch evidence is unverifiable (an ordinary restored terminal, for\n  example) can be counted as that terminal instead. Orca does not treat workers as hostile.\n- **It applies while a Dispatch is active.** After `worker_done`, or after a coordinator\n  settles the task, the terminal is no longer a worker and is counted as a root again. The\n  process may still be alive; that is the documented boundary, not an accident.\n\n## Preferred Supervised Worker Loop\n\nUse `worker-start` for the normal supervised path. It composes the existing worktree, terminal, readiness, and dispatch primitives while returning exact created/reused effects. Agents still choose placement and concurrency; Orca does not schedule workers or infer conflicts.\n\nCreate the Run and every independent Task first, then start all independent workers before waiting:\n\n```bash\norca orchestration run-create --objective \"<objective>\" --json\norca orchestration task-create --spec \"<worker A task>\" --json\norca orchestration task-create --spec \"<worker B task>\" --json\norca orchestration worker-start --task <task_a> --worktree current --agent codex --json\norca orchestration worker-start --task <task_b> --worktree current --agent claude --json\n```\n\n`current` and exact existing worktrees create a fresh agent terminal and do not rerun setup. Reuse an existing agent only with `--terminal <handle>`.\n\nFor a per-invocation Claude, Codex, or Cursor launch, pass an opaque provider model id with `--model`; add `--effort` only when that agent/model supports the level. These options apply only to fresh agent terminals, override general agent default arguments, and are reported under `launch.requested` and `launch.effective` in the receipt:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree current --agent claude --model opus --effort high --json\n```\n\n`--effort` requires `--model`, and neither option can combine with `--terminal`. A connected worker server must advertise launch-preference support before Orca forwards either option.\n\nFor a new worktree, setup runs by default and agent-first creation reuses the returned startup agent terminal:\n\n```bash\norca orchestration worker-start --task <task_id> --worktree new-child --name <name> --agent codex --setup run --json\n# Independent/top-level:\norca orchestration worker-start --task <task_id> --worktree new-top-level --name <name> --agent codex --setup run --json\n```\n\nSetup normally starts alongside the agent. Only a repository explicitly configured with `wait-for-setup` delays agent launch until setup succeeds. Use `--setup skip` or `--setup inherit` only for a concrete reason.\n\nRead the returned receipt before continuing: `ready` plus setup `running` is normal for start-immediately, while wait-for-setup returns setup `succeeded` before accepting task input. A failed or unknown start exits nonzero; inspect its `stage`, `effects`, and `residualResources` instead of guessing or automatically retrying. A wait-for-setup timeout can honestly leave setup `running`, which is not proof of failure.\n\nTo run the worker on another connected Orca server, add `--on <saved-environment>`. The Run and Tasks remain authoritative on the current server; later commands route by Dispatch ID, so never repeat `--on`:\n\n```bash\n# Mac Run home -> Windows worker (the reverse is identical from a Windows Run home)\norca orchestration worker-start --task <task_id> --on windows --worktree new-top-level --repo <exact_remote_repo_selector> --name <name> --agent codex --setup run --json\norca orchestration worker-show --dispatch <dispatch_id> --json\norca orchestration worker-read --dispatch <dispatch_id> --limit 50 --json\norca orchestration send --to dispatch:<dispatch_id> --subject \"Follow-up\" --body \"<attempt-specific guidance>\" --json\n```\n\nRemote `current` and `new-child` are intentionally invalid because those words are ambiguous across servers. Use an exact discovered remote worktree selector or `new-top-level` with an explicit remote repo selector.\n\nThe follow-up is structured inbox mail, not prompt injection. The worker's next\n`orchestration check` receives it even when the Dispatch is on another connected Orca server.\n\n`worker-read` defaults to `--source auto`: Orca returns the exact hook-reported Codex, Claude, OpenClaude, or Grok transcript when it can prove the worker session, otherwise it returns bounded terminal output with `source: \"terminal\"` and a typed `fallbackReason`. Continue with the returned top-level `cursor`; it stays pinned to that exact source. If Orca reports `source_changed`, start a fresh read without the old cursor. Never supply or guess a provider session ID or transcript path.\n\nWait until every expected Dispatch settles, not for a fixed number of batches:\n\n```bash\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n# Process every message. For each accepted worker_done that is not immediately reused:\norca orchestration worker-release --dispatch <dispatch_id> --json\n# Acknowledge only after every message and required release decision is handled:\norca orchestration check --ack <delivery_id> --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\nAfter processing each accepted `worker_done`, choose the terminal's next owner before you acknowledge the Delivery or wait again. If the same exact agent has an immediate follow-up Task, read the `worker.agent_terminal_handle` field of `worker-show --dispatch <dispatch_id> --json`, then run `orca orchestration worker-start --task <next_task_id> --terminal <handle> --json` so Orca transfers cleanup ownership to the new Dispatch. Otherwise run `orca orchestration worker-release --dispatch <dispatch_id> --json`.\n\nRun `worker-release` after both succeeded and failed `worker_done` reports unless the user explicitly asked to keep that worker live. Release is post-completion cleanup, not cancellation: Orca first preserves inspectable output, then closes only the exact agent terminal owned by that settled Dispatch. Reused or pre-existing terminals, setup terminals, coordinators, active workers, user-taken-over terminals, and identities Orca cannot prove are retained. If the user explicitly asks to keep the live terminal for debugging, record that exception with `orca orchestration worker-retain --dispatch <dispatch_id> --json` instead of silently skipping cleanup. When the user is finished, the same Dispatch can be passed to `worker-release`, which clears the requested retention and releases the terminal.\n\nDo not release a worker because of a timeout, TUI idle state, heartbeat, status, question, escalation, or rejected/stale `worker_done`. If release returns `release_pending` or `release_unknown`, do not substitute `terminal close`; follow the exact recovery action in the receipt. A replayed Delivery may repeat `worker-release` safely.\n\nWorkers report exactly once using the IDs and capability injected by Orca; they do not supply Run/server/terminal identity:\n\n```bash\norca orchestration send --type worker_done --subject \"<status>\" --body \"<what changed, findings, and what remains>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a,path/b\" --json\n# On failure, use --outcome failed; never encode failure only in prose.\n```\n\nA worker question defaults to its owning Run. Timeout leaves it pending:\n\n```bash\norca orchestration ask --question \"<question>\" --options \"yes,no\" --timeout-ms 600000 --json\norca orchestration ask --resume <message_id> --timeout-ms 600000 --json\n# Coordinator:\norca orchestration reply --id <message_id> --body \"<answer>\" --json\n```\n\nRecovery is conditional, never a fixed destructive sequence:\n\n- The response was lost and named no Dispatch: run `orca orchestration request-show --request <request_id> --json` first. It is read-only. `completed` means the mutation already took effect. `pending` means the original mutation is still running or Orca restarted before recording its outcome. For either state, replaying the original command with `--retry-request <request_id>` reuses the same operation identity so Orca can replay, join, or safely recover it without starting a separate duplicate. `absent` means this runtime holds no receipt under your caller identity and is not proof that nothing happened; inspect the affected state before deciding whether to retry.\n- `worker-show --dispatch <id>` says `ready`: keep waiting or read bounded output.\n- It proves `failed` or `stopped`: start a replacement with `worker-start --task <task> --retry-of <id>` plus an explicit `--on`/`--worktree` and `--agent`/`--terminal` choice. Retry does not silently inherit placement.\n- It remains `outcome_unknown`: either `worker-stop --dispatch <id>` and inspect again, or explicitly `worker-abandon --dispatch <id>` while accepting that resources may still be live. Abandon performs no remote, process, or filesystem action.\n- `worker-stop` closes only the exact supervised agent terminal. It never deletes the worktree, setup terminal, configured tabs, or unrelated processes.\n\nLow-level `worktree create`, `terminal create`, and `dispatch --inject` remain valid recipes for custom argv or topology that `worker-start` does not express.\n\n`dispatch --inject` deliberately keeps an operator-started terminal unsupervised: it never creates a `worker_dispatches` row and `worker-stop`/`worker-abandon` never close that process. The dispatch context is still authoritative, so `worker-show`, `worker-read`, and `worker-list` report it as `unsupervised`; settled `worker-retain` and `worker-release` report `retained` with `no_owned_resource` and take no process action. Use `worker-start --terminal <handle>` when supervision and worker lifecycle state are required.\n\n## Gates And Legacy Inspection\n\n```bash\norca orchestration gate-create --task <task_id> --question <text> [--options <json_array>] [--json]\norca orchestration gate-resolve --id <gate_id> --resolution <text> [--json]\norca orchestration gate-list [--task <task_id>] [--status <status>] [--json]\n```\n\nUse `ask` for worker-to-coordinator questions; it creates a `question` message that the coordinator answers with `reply`. Use `gate-create` only for coordinator-managed task DAG decisions, not for answering a worker's `ask`.\n\n`coordinator-start`, `coordinator-stop`, `run`, and `run-stop` are retired scheduler commands. They perform no effects and return the current-skill recovery action. They are not aliases for lightweight Run creation or binding.\n\nRecovery only: `orca orchestration reset --tasks|--messages|--all --json` clears the selected local orchestration database state. Do not run it during active coordination unless explicitly abandoning that state.\n\n## Full Handoffs\n\nFor full ownership transfer, use non-lifecycle terminal/worktree commands and then stop monitoring unless the user asks for supervision.\n\nTreat these as full handoff requests by default: \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", \"give this to another worktree\", \"send this to another agent\", \"another agent\", \"another worktree\", or \"launch another agent to own this.\" Custom model or reasoning effort words such as `gpt-5.5`, `high`, or `xhigh` do not make the handoff supervised.\n\nSupervised orchestration remains available only when the user explicitly asks for supervision or coordination: \"supervise\", \"monitor\", \"wait for worker_done\", \"wait for results\", \"track completion\", \"DAG\", \"decision gate\", \"ask/reply\", or \"coordinate workers.\"\n\nDo not run `orca orchestration task-create`, `orca orchestration dispatch --inject`, or `orca orchestration check --wait` for full handoffs. `task-create` is also forbidden because it records coordinator-owned tracking state; if a task row is needed, the user asked for supervised orchestration. Do not create a `taskId`/`dispatchId`, inject a lifecycle preamble, wait for completion, or read the worker terminal after prompt delivery except to avoid losing the initial prompt.\n\nNew top-level worktree handoff:\n\n```bash\norca worktree create --name <task-name> --no-parent --agent codex --prompt \"<task brief>\" --setup run --json\n```\n\nBefore creating a new worktree from an active feature branch, decide and state whether the desired Orca lineage is child or top-level. Use child worktree lineage only when the new work is conceptually stacked under or dependent on the active worktree. For independent repo-wide fixes, standalone feature work, or unrelated follow-up tasks, create a top-level worktree with `--no-parent`.\n\nExisting terminal handoff:\n\n```bash\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nCustom Codex model/effort handoff:\n\n`orca worktree create --agent codex --prompt ...` launches the known Codex agent but does not accept Codex-specific `--model` or `-c model_reasoning_effort=...` arguments. When the user asks for a specific Codex model or effort, create the independent worktree first, launch Codex with the requested command in that worktree, wait only for TUI readiness if prompt delivery would otherwise race startup, send the prompt, and stop.\n\nThe two-step custom-argv path cannot enforce a repository's explicit `wait-for-setup` startup policy because the later `terminal create` is not the startup owned by `worktree create`. Use it only when the repository starts agents immediately. If the repository requires `wait-for-setup`, use an agent-first configured launcher that can preserve sequencing, or stop and ask rather than silently bypassing the policy.\n\nNote: when no repo default-terminal configuration supplies a primary terminal, bare create opens a fallback shell before `terminal create` adds the agent. Configured default tabs are materialized instead and may run real commands. Prefer `--agent` whenever custom argv is not required. With the two-step path, target only the agent handle; close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell.\n\nUse the exact full `<repo-id>::<path>` worktree id returned by `orca worktree create --json`; a bare repo id cannot target the new worktree.\n\n```bash\norca worktree create --name <task-name> --no-parent --setup run --json\norca terminal create --worktree id:<newFullWorktreeId> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort=\"xhigh\"' --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca terminal send --terminal <handle> --text \"<task brief>\" --enter --json\n```\n\nWait only for `tui-idle` when needed to avoid losing the prompt. Do not monitor task completion.\n\n`--no-parent` only controls Orca lineage; it does not choose the Git base. If the work should start from the repo default base, omit `--base-branch` so Orca uses that default, or explicitly pass the repo default base (`origin/main`, `origin/master`, or the `orca repo show --repo <selector> --json` value); never base it on the current feature branch unless the user explicitly asks for stacked work or \"branch from current\". Put current-branch context in the prompt instead.\n\n## Worker Terminals\n\nChoose the worker location before creating a terminal. `Fresh worker` means a fresh agent session, not a new git worktree. For parallel work, create one fresh agent terminal per worker in the same required worktree, falling back to the active worktree when none is named. If the task says current worktree only, depends on uncommitted files/artifacts, or must validate/PR the current branch, keep every worker in the active worktree:\n\n```bash\norca terminal create --worktree active --title <task-name> --command \"codex\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nReuse an idle agent in the required worktree only if the prompt allows reuse; otherwise create a fresh terminal there. Create a new worktree only when the user explicitly requests one or a concrete checkout or filesystem conflict makes sharing unsafe or impossible; if the user did not request it, state that conflict before running `worktree create`. Independent tasks, parallel execution, convenience, or a preference for separate checkouts are not isolation requirements.\n\nWhen a new worktree is allowed, use child lineage for isolated work that is stacked under or dependent on the active worktree, and use `--no-parent` when it is not stacked. Decide the Git base separately: `--no-parent` makes the worktree top-level in Orca, while omitted `--base-branch` uses the repo default base.\n\nFor every new worktree, pass `--setup run` so any configured repository setup hook runs. This does not mean waiting for setup before agent launch: preserve the repository's startup policy, whose default starts setup and the agent side by side. Use `--setup skip` or `--setup inherit` only when there is a concrete task-specific reason, and state that reason before creating the worktree. This rule does not rerun setup for current or existing worktrees.\n\n```bash\norca worktree create --name <task-name> --agent codex --setup run --json\n# or: --agent claude | omp | pi | grok | ...\n# Read <handle> from agentTerminalHandle, falling back to startupTerminal.handle.\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\n```\n\nFor new-worktree workers, read the id and `agentTerminalHandle` from `worktree create`, falling back to `startupTerminal.handle` for older runtimes. Use that as the sole worker handle when present; otherwise use `terminal list` to resolve the agent handle. Omit `--repo` only inside an Orca-managed worktree; otherwise pass `--repo <selector>`.\n\n**For an allowed new worktree, use agent-first:** `--agent` reveals the new worktree and launches the selected agent **in its first terminal**, without adding a separate fallback shell for that worker. Pass `--setup run`; repo setup and default-terminal settings may add intentional tabs or splits. Do **not** run bare `worktree create` and then `terminal create --command <agent>` for the same worker when agent-first create is available: without configured default tabs, that two-step path leaves a fallback shell + agent pair. Only use it when custom agent argv is required (for example Codex model/effort flags) or when an older CLI rejects `--agent`; if you must, message only the agent handle. Configured default tabs are intentional surfaces, so close a prior terminal only after `terminal list` or `terminal show` confirms it is an unused shell. Do not run `worktree create` when the task must stay in the current worktree.\n\nUse `orca worktree create --prompt ...` or `orca terminal send ...` for full handoffs or untracked/lightweight prompts. Those paths do not attach `taskId`/`dispatchId`; the worker should not send lifecycle messages unless the prompt supplies a live orchestration preamble.\n\nSidebar lineage and orchestration lifecycle are related but not identical. A same-worktree worker may appear as a peer under that worktree in the sidebar while remaining a child dispatch in orchestration state; only an actual child worktree creates visible parent/child worktree lineage.\n\nOther terminal commands coordinators often need:\n\n```bash\norca terminal list [--worktree <selector>] [--include-visual-layouts] [--json]\norca terminal create [--worktree <selector>] [--title <text>] [--command <cmd>] [--json]\norca terminal split --terminal <handle> [--direction horizontal|vertical] [--command <cmd>] [--json]\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms <n> --json\norca terminal read --terminal <handle> --json\norca terminal send --terminal <handle> --text <text> --enter --json\n```\n\nIf an older CLI rejects `worktree create --agent`, create the worktree normally, then run `orca terminal create --worktree <selector> --command \"codex\" --json` or `--command \"claude\"`.\n\nWait for `tui-idle` before dispatching. Always pass `--timeout-ms`; real coding tasks can take 15-60 minutes. During supervision, use rolling `check --wait` windows. If a window returns no matching message, inspect `task-list`, `terminal read`, or `terminal wait --for tui-idle` as a liveness checkpoint; if the terminal is still working or producing activity, keep waiting instead of retrying the task.\n\n## Agent Guidance\n\n- Workers with a valid live preamble must send `worker_done` exactly once from their own terminal with an explicit `--outcome succeeded` or `--outcome failed`:\n  `orca orchestration send --type worker_done --subject \"<short status>\" --body \"<3-sentence summary: what you did, what you found, what's left>\" --task-id <task_id> --dispatch-id <dispatch_id> --outcome succeeded --files-modified \"path/a\" --report-path \"<optional>\" --json`\n- A failed outcome is still a terminal report, but Orca records both the Dispatch and Task as failed. Never encode failure only in the subject/body.\n- After sending `worker_done`, end that dispatched turn and idle at the agent prompt. Do not autonomously start more work, poll, or attempt to close the terminal yourself. A direct user instruction takes precedence and starts ordinary user-owned work: follow it without coordinator approval or a fresh Dispatch, never refuse it because of worker/coordinator roles, and do not reuse the settled Dispatch's lifecycle IDs. A coordinator-supervised follow-up still arrives with a fresh preamble + TASK block.\n- For long tasks, send heartbeat/status only when the preamble asks for it, including both IDs:\n  `orca orchestration send --type heartbeat --subject \"alive\" --payload '{\"taskId\":\"<task_id>\",\"dispatchId\":\"<dispatch_id>\",\"phase\":\"implementing\"}' --json`\n- If blocked before completion, use `ask`; use `escalation` only when ownership is valid and the coordinator must intervene.\n- Treat preambles inherited through terminal history or full handoffs as stale unless the current prompt explicitly keeps that coordinator in the loop.\n- Coordinators must account for every settled worker terminal before waiting again or ending the turn: immediately reuse the exact worker for a new Dispatch, explicitly retain it at the user's request with `worker-retain`, or run `worker-release`. Do not leave a completed worker live merely to inspect output; released workers remain readable through `worker-read`.\n- Coordinators should use `task-list --ready` as external memory, dispatch parallel waves, and avoid dependency chains deeper than 3-4 steps.\n\n## Example\n\n```bash\norca terminal create --worktree active --title login-css-worker --command \"claude\" --json\norca terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json\norca orchestration task-create --spec \"Fix the login button CSS\" --json\norca orchestration dispatch --task <task_id> --to <handle> --inject --json\norca orchestration check --wait --types worker_done,escalation,question --timeout-ms 900000 --json\n```\n\n## Next Action\n\nCoordinator: confirm `orca status --json`, create or bind a Run, inspect `task-list`/`dispatch-show` if inheriting state, then use the explicit supervised loop (`task-create` -> `worker-start` -> `check --wait`). Use low-level terminal creation plus `dispatch --inject` only when the composed start does not express the needed topology. After every accepted `worker_done`, either transfer the exact terminal to an immediate follow-up Dispatch or run `worker-release` before the next wait.\n\nWorker: if the current prompt contains a live dispatch preamble, do the task, use `ask` for blocking questions, and send `worker_done` once with the required payload. If the preamble is stale or absent, do not send lifecycle messages; inspect state or treat the prompt as an ordinary handoff.\n"
 
 // Why: no current guide has bundled reference documents, so --full is byte-identical for now.
 // oxfmt-ignore
@@ -86,7 +86,7 @@ export const BUNDLED_SKILL_GUIDES = [
   },
   {
     name: "orchestration",
-    description: "Use Orca orchestration for structured multi-agent coordination: threaded messages, blocking ask/reply flows, task dispatch, worker_done/escalation waits, task DAGs, decision gates, coordinator loops, or decomposing work across agents. Use `orca-cli` instead for full ownership handoffs, including requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or \"another worktree\" when the user did not explicitly ask to supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for terminal control, lightweight terminal prompts, shell commands, Orca worktree management, reading or waiting on terminals, and automation of the browser embedded inside Orca. Use Computer Use for external browser windows, webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when the task requires OS/window-level control such as focus, menus, dialogs, coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a page-automation tool such as Playwright or CDP for external pages.",
+    description: "Use Orca orchestration for structured multi-agent coordination: threaded messages, blocking ask/reply flows, task dispatch, worker_done/escalation waits, task DAGs, decision gates, or coordinator loops. Use `orca-cli` instead for full ownership handoffs, including requests phrased as \"hand off\", \"handoff\", \"handover\", \"give this to another agent\", or \"another worktree\" when the user did not explicitly ask to supervise, monitor, wait for results, or coordinate a DAG. Use `orca-cli` for terminal control, lightweight terminal prompts, shell commands, Orca worktree management, reading or waiting on terminals, and the Orca embedded browser. Use Computer Use for external browser windows, webviews, Orca app UI, or desktop UI outside Orca's embedded browser only when the task requires OS/window-level control such as focus, menus, dialogs, coordinates, or screenshots. Use `orca-cli` for Orca's embedded pages and a page-automation tool such as Playwright or CDP for external pages.",
     markdown: ORCHESTRATION_MARKDOWN,
     fullMarkdown: ORCHESTRATION_MARKDOWN,
     aliases: []

From 5412276776fbcfe3cfefa7ca44d7c10e0fbde1dd Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:09:15 -0400
Subject: [PATCH 25/58] Fix status bar runtime target render loop (#18685)

---
 ...rtsStatusSegment.render-stability.test.tsx | 89 +++++++++++++++++++
 .../runtime/use-worktree-runtime-target.ts    |  6 +-
 2 files changed, 92 insertions(+), 3 deletions(-)
 create mode 100644 src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx

diff --git a/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx b/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx
new file mode 100644
index 00000000000..d6d4ad95184
--- /dev/null
+++ b/src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx
@@ -0,0 +1,89 @@
+// @vitest-environment happy-dom
+
+import React, { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/components/ui/popover', () => ({
+  Popover: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  PopoverContent: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  PopoverTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('@/components/ui/tooltip', () => ({
+  Tooltip: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipContent: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipTrigger: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('@/components/SelectedTextCopyMenu', () => ({
+  SelectedTextCopyMenu: ({ children }: { children: React.ReactNode }) => <>{children}</>
+}))
+
+vi.mock('./ports-status-popover-rows', () => ({
+  PortRow: () => <div />,
+  WorkspaceGroupRows: () => <div />
+}))
+
+vi.mock('@/lib/react-error-boundary-reporting', () => ({
+  reportReactErrorBoundaryCrash: vi.fn()
+}))
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string, options?: Record<string, unknown>) =>
+    options
+      ? fallback.replace(/{{(\w+)}}/g, (_match, name: string) => String(options[name] ?? ''))
+      : fallback
+}))
+
+import { RecoverableRenderErrorBoundary } from '../error-boundaries/RecoverableRenderErrorBoundary'
+import { useAppStore } from '@/store'
+import { PortsStatusSegment } from './PortsStatusSegment'
+
+describe('PortsStatusSegment render stability', () => {
+  let container: HTMLDivElement
+  let root: Root
+  let consoleError: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    useAppStore.setState(useAppStore.getInitialState(), true)
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+    consoleError = vi.spyOn(console, 'error').mockImplementation(() => undefined)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+    consoleError.mockRestore()
+  })
+
+  it('keeps the status controls mounted when the runtime owner is local', () => {
+    act(() => {
+      root.render(
+        <RecoverableRenderErrorBoundary
+          boundaryId="oracle.status-bar"
+          surface="overlay"
+          compact
+          reportAsCrash={false}
+          title="The status bar hit an error."
+          description="Retry the status bar to remount its controls."
+        >
+          <PortsStatusSegment iconOnly={false} />
+        </RecoverableRenderErrorBoundary>
+      )
+    })
+
+    const underlyingException = consoleError.mock.calls.find(
+      ([message, error]) =>
+        message === '[oracle.status-bar] render crash contained by boundary' &&
+        error instanceof Error &&
+        error.message.includes('Maximum update depth exceeded')
+    )
+
+    expect.soft(container.textContent).not.toContain('The status bar hit an error.')
+    expect.soft(underlyingException).toBeUndefined()
+    expect(container.querySelector('button[aria-label^="Ports, 0 workspace"]')).not.toBeNull()
+  })
+})
diff --git a/src/renderer/src/runtime/use-worktree-runtime-target.ts b/src/renderer/src/runtime/use-worktree-runtime-target.ts
index 25bd9099e90..22ef4ed5c4b 100644
--- a/src/renderer/src/runtime/use-worktree-runtime-target.ts
+++ b/src/renderer/src/runtime/use-worktree-runtime-target.ts
@@ -1,3 +1,4 @@
+import { useMemo } from 'react'
 import { useAppStore } from '@/store'
 import { getExecutionHostIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { runtimeTargetForExecutionHostId, type RuntimeClientTarget } from './runtime-client-target'
@@ -10,7 +11,6 @@ import { runtimeTargetForExecutionHostId, type RuntimeClientTarget } from './run
 export function useWorktreeRuntimeTarget(
   worktreeId: string | null | undefined
 ): RuntimeClientTarget | null {
-  return useAppStore((state) =>
-    runtimeTargetForExecutionHostId(getExecutionHostIdForWorktree(state, worktreeId))
-  )
+  const executionHostId = useAppStore((state) => getExecutionHostIdForWorktree(state, worktreeId))
+  return useMemo(() => runtimeTargetForExecutionHostId(executionHostId), [executionHostId])
 }

From b0253673c9b3430c456a43a54127a0f6cf1ac0ba Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Fri, 4 Sep 2026 12:16:52 -0700
Subject: [PATCH 26/58] fix(mobile): separate image attachment paths from
 following prompt text (STA-4847) (#15690)

* fix(mobile): delimit image paste payloads

Keep the shared mobile image-paste payload attachment-only. Apply the canonical conditional separator only to the final native-chat image when non-whitespace prompt text follows, preserving byte-clean clipboard and enter:false terminal consumers.

* refactor(mobile): drop unrelated churn from the image separator fix

Keep the bugfix diff to the separator itself: restore the textDeadline
local under the comment that explains it, and revert the scopeKey comment
restyle and blank-line deletion.

* fix(mobile): separate the terminal-mode image attach path too (STA-4847)

The dock attach button wrote a bare bracketed paste, so the user's next
keystroke glued onto the path -- the ticket's exact `...pngadd`, reproduced
on device. Attach-then-type is the whole interaction here, so unlike native
chat there is no following text to test: always separate.

Desktop's twin of this button is terminal-drop-path-writer, which #15820
already routed through the shared helper. Terminal clipboard paste stays
bare on both platforms, tracked separately (desktop: STA-5258).

---------

Co-authored-by: Merge Sim <sim@local>
---
 .../session/mobile-image-attachment.test.ts   |  4 ++-
 mobile/src/session/mobile-image-attachment.ts |  6 +++-
 .../mobile-native-chat-image-send.test.ts     | 33 ++++++++++++++++---
 .../session/mobile-native-chat-image-send.ts  |  5 ++-
 .../session/mobile-native-chat-stale-input.ts |  1 +
 ...bile-native-chat-image-attachments.test.ts | 17 +++++++---
 ...se-mobile-native-chat-image-attachments.ts |  1 +
 7 files changed, 54 insertions(+), 13 deletions(-)

diff --git a/mobile/src/session/mobile-image-attachment.test.ts b/mobile/src/session/mobile-image-attachment.test.ts
index 9d725d5fe60..eead9691303 100644
--- a/mobile/src/session/mobile-image-attachment.test.ts
+++ b/mobile/src/session/mobile-image-attachment.test.ts
@@ -50,7 +50,9 @@ describe('attachMobileImageToTerminal', () => {
     const sendCall = client.calls.find((c) => c.method === 'terminal.send')
     expect(sendCall?.params).toEqual({
       terminal: 'term-1',
-      text: '\x1b[200~/tmp/orca-attach.png\x1b[201~',
+      // Trailing space: the user types on this same line next, so a bare
+      // `…\x1b[201~` would arrive as `…pngadd` (STA-4847).
+      text: '\x1b[200~/tmp/orca-attach.png\x1b[201~ ',
       enter: false,
       client: { id: 'device-9', type: 'mobile' }
     })
diff --git a/mobile/src/session/mobile-image-attachment.ts b/mobile/src/session/mobile-image-attachment.ts
index 567be99a9a1..9cb7d60aa8e 100644
--- a/mobile/src/session/mobile-image-attachment.ts
+++ b/mobile/src/session/mobile-image-attachment.ts
@@ -1,4 +1,5 @@
 import type { RpcClient } from '../transport/rpc-client'
+import { separateImagePasteFromFollowingText } from '../../../src/shared/image-paste-following-text'
 import {
   buildMobileImagePastePayload,
   saveMobileClipboardImageAsTempFile
@@ -47,7 +48,10 @@ export async function attachMobileImageToTerminal(
   })
   // Why: a generated image path is terminal image injection, so it's always
   // bracketed (matching desktop paste) regardless of terminal mode.
-  const payload = buildMobileImagePastePayload(imagePath)
+  // Always separated: attach-then-type is the whole interaction here, so the user's
+  // next keystroke would otherwise glue onto the path (`…pngadd`). Unlike native
+  // chat there is no batch to look ahead in, and a trailing space is inert.
+  const payload = separateImagePasteFromFollowingText(buildMobileImagePastePayload(imagePath), true)
   if (beforeTerminalSend && !(await beforeTerminalSend(terminal))) {
     return false
   }
diff --git a/mobile/src/session/mobile-native-chat-image-send.test.ts b/mobile/src/session/mobile-native-chat-image-send.test.ts
index cf1c59adf0f..a41b3fca3f1 100644
--- a/mobile/src/session/mobile-native-chat-image-send.test.ts
+++ b/mobile/src/session/mobile-native-chat-image-send.test.ts
@@ -38,7 +38,8 @@ describe('pasteMobileNativeChatImagePaths', () => {
       client,
       terminal: 'term-1',
       deviceToken: 'device-9',
-      imagePaths: ['/tmp/a.png', '/tmp/b.png', '/tmp/c.png']
+      imagePaths: ['/tmp/a.png', '/tmp/b.png', '/tmp/c.png'],
+      followedByText: true
     })
 
     expect(ok).toBe(true)
@@ -55,7 +56,7 @@ describe('pasteMobileNativeChatImagePaths', () => {
     })
     expect(client.calls[1]?.params.text).toBe('\x1b[200~/tmp/a.png\x1b[201~')
     expect(client.calls[2]?.params.text).toBe('\x1b[200~/tmp/b.png\x1b[201~')
-    expect(client.calls[3]?.params.text).toBe('\x1b[200~/tmp/c.png\x1b[201~')
+    expect(client.calls[3]?.params.text).toBe('\x1b[200~/tmp/c.png\x1b[201~ ')
   })
 
   it('stops and reports failure as soon as a paste is rejected', async () => {
@@ -66,7 +67,8 @@ describe('pasteMobileNativeChatImagePaths', () => {
       client,
       terminal: 'term-1',
       deviceToken: null,
-      imagePaths: ['/tmp/a.png', '/tmp/b.png']
+      imagePaths: ['/tmp/a.png', '/tmp/b.png'],
+      followedByText: true
     })
 
     expect(ok).toBe(false)
@@ -94,7 +96,8 @@ describe('pasteMobileNativeChatImagePaths', () => {
         client,
         terminal: 'term-1',
         deviceToken: null,
-        imagePaths: ['/tmp/a.png', '/tmp/b.png']
+        imagePaths: ['/tmp/a.png', '/tmp/b.png'],
+        followedByText: true
       })
 
       expect(ok).toBe(false)
@@ -121,6 +124,7 @@ describe('clearing a parked multi-line launch draft before the image paste', ()
       terminal: 'term-1',
       deviceToken: null,
       imagePaths: ['/tmp/a.png'],
+      followedByText: true,
       clearInput
     })
 
@@ -137,6 +141,7 @@ describe('clearing a parked multi-line launch draft before the image paste', ()
       terminal: 'term-1',
       deviceToken: null,
       imagePaths: ['/tmp/a.png', '/tmp/b.png'],
+      followedByText: true,
       clearInput
     })
 
@@ -151,9 +156,27 @@ describe('clearing a parked multi-line launch draft before the image paste', ()
       client,
       terminal: 'term-1',
       deviceToken: null,
-      imagePaths: ['/tmp/a.png']
+      imagePaths: ['/tmp/a.png'],
+      followedByText: true
     })
 
     expect(client.calls[0]?.params.text).toBe('\x15')
   })
+
+  it('keeps image writes byte-clean when no text or submit follows', async () => {
+    const client = clientWithResponses([sendResult(true), sendResult(true), sendResult(true)])
+
+    await pasteMobileNativeChatImagePaths({
+      client,
+      terminal: 'term-1',
+      deviceToken: null,
+      imagePaths: ['/tmp/a.png', '/tmp/b.png'],
+      followedByText: false
+    })
+
+    expect(client.calls.slice(1).map((call) => call.params.text)).toEqual([
+      '\x1b[200~/tmp/a.png\x1b[201~',
+      '\x1b[200~/tmp/b.png\x1b[201~'
+    ])
+  })
 })
diff --git a/mobile/src/session/mobile-native-chat-image-send.ts b/mobile/src/session/mobile-native-chat-image-send.ts
index adb996b7612..9f3c555062f 100644
--- a/mobile/src/session/mobile-native-chat-image-send.ts
+++ b/mobile/src/session/mobile-native-chat-image-send.ts
@@ -1,4 +1,5 @@
 import type { RpcClient } from '../transport/rpc-client'
+import { imagePasteWritesFollowedByText } from '../../../src/shared/image-paste-following-text'
 import { buildMobileImagePastePayload } from './mobile-clipboard-image'
 import {
   MOBILE_NATIVE_CHAT_MIN_WRITE_TIMEOUT_MS,
@@ -23,6 +24,7 @@ type PasteImagesArgs = {
   readonly terminal: string
   readonly deviceToken: string | null
   readonly imagePaths: readonly string[]
+  readonly followedByText: boolean
   /** Budget shared with the rest of the user action (the text body that follows, or
    *  the send this is healing for). Omit to open a fresh one for this paste alone. */
   readonly deadline?: number
@@ -42,6 +44,7 @@ export async function pasteMobileNativeChatImagePaths({
   terminal,
   deviceToken,
   imagePaths,
+  followedByText,
   deadline: sharedDeadline,
   clearInput
 }: PasteImagesArgs): Promise<boolean> {
@@ -55,7 +58,7 @@ export async function pasteMobileNativeChatImagePaths({
   const deadline = sharedDeadline ?? openMobileNativeChatSendBudget()
   for (const text of [
     clearInput ?? MOBILE_NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT,
-    ...imagePaths.map(buildMobileImagePastePayload)
+    ...imagePasteWritesFollowedByText(imagePaths.map(buildMobileImagePastePayload), followedByText)
   ]) {
     const remainingMs = deadline - Date.now()
     // Why: the budget is the whole sequence's — starting a write it can't fund would
diff --git a/mobile/src/session/mobile-native-chat-stale-input.ts b/mobile/src/session/mobile-native-chat-stale-input.ts
index 18d84d2e503..cdc21067683 100644
--- a/mobile/src/session/mobile-native-chat-stale-input.ts
+++ b/mobile/src/session/mobile-native-chat-stale-input.ts
@@ -55,6 +55,7 @@ export async function healMobileNativeChatStaleInput(args: {
       terminal: args.terminal,
       deviceToken: args.deviceToken,
       imagePaths: [],
+      followedByText: false,
       ...(args.deadline === undefined ? {} : { deadline: args.deadline })
     })
   } catch {
diff --git a/mobile/src/session/use-mobile-native-chat-image-attachments.test.ts b/mobile/src/session/use-mobile-native-chat-image-attachments.test.ts
index cb8522bae7a..022bb8c3953 100644
--- a/mobile/src/session/use-mobile-native-chat-image-attachments.test.ts
+++ b/mobile/src/session/use-mobile-native-chat-image-attachments.test.ts
@@ -182,9 +182,12 @@ describe('useMobileNativeChatImageAttachments', () => {
     expect(sendCalls).toHaveLength(2)
     expect(sendCalls[0]?.params).toMatchObject({ text: '\x15', enter: false })
     expect(sendCalls[1]?.params).toMatchObject({
-      text: '\x1b[200~/tmp/a.png\x1b[201~',
+      text: '\x1b[200~/tmp/a.png\x1b[201~ ',
       enter: false
     })
+    const combined = String(sendCalls[1]?.params.text ?? '') + 'look at this'
+    expect(combined).toContain('.png\x1b[201~ look')
+    expect(combined).not.toContain('.png\x1b[201~look')
     // Clear, then paste, then settle, then the text send — in that order.
     expect(order).toEqual(['clear', 'paste', 'settle', 'text:look at this'])
     // The local preview URI rides along so the sent bubble shows the photo.
@@ -267,7 +270,10 @@ describe('useMobileNativeChatImageAttachments', () => {
     }
   })
 
-  it('routes an attachments-only send through baseSend with empty text so the echo still shows the photo', async () => {
+  it.each([
+    ['empty', ''],
+    ['whitespace-only', '   ']
+  ])('routes an attachments-only send through baseSend with %s text', async (_label, text) => {
     pick.mockResolvedValue([{ base64: 'AAAA', uri: 'file:///a.jpg' }])
     const client = makeClient([
       methodNotFound('start'),
@@ -283,16 +289,17 @@ describe('useMobileNativeChatImageAttachments', () => {
     })
     let accepted = false
     await act(async () => {
-      accepted = await hook!.sendNativeChat('')
+      accepted = await hook!.sendNativeChat(text)
     })
 
     expect(accepted).toBe(true)
-    // Empty text still goes through baseSend (which submits the bare Enter) so the
+    // Attachment-only text still goes through baseSend (which submits Enter) so the
     // optimistic echo carries the preview URI.
-    expect(baseSend).toHaveBeenCalledWith('', ['file:///a.jpg'], expect.any(Number))
+    expect(baseSend).toHaveBeenCalledWith(text, ['file:///a.jpg'], expect.any(Number))
     const sendCalls = client.calls.filter((c) => c.method === 'terminal.send')
     // Only the clear + image paste hit the wire here; baseSend owns the submit.
     expect(sendCalls).toHaveLength(2)
+    expect(sendCalls[1]?.params.text).toBe('\x1b[200~/tmp/a.png\x1b[201~')
     expect(hook!.attachments).toEqual([])
   })
 
diff --git a/mobile/src/session/use-mobile-native-chat-image-attachments.ts b/mobile/src/session/use-mobile-native-chat-image-attachments.ts
index 77d839adf34..c36e30f44d7 100644
--- a/mobile/src/session/use-mobile-native-chat-image-attachments.ts
+++ b/mobile/src/session/use-mobile-native-chat-image-attachments.ts
@@ -240,6 +240,7 @@ export function useMobileNativeChatImageAttachments({
             terminal: handle,
             deviceToken: deviceTokenRef.current,
             imagePaths: pendingImages.map((attachment) => attachment.path),
+            followedByText: text.trim().length > 0,
             deadline,
             ...(seededLaunchDraft
               ? { clearInput: buildAgentTuiClearInputForText(seededLaunchDraft) }

From d9e44a6749014c0b7da81e52f3259463c0ead76b Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Fri, 4 Sep 2026 13:37:24 -0700
Subject: [PATCH 27/58] Keep the floating workspace above a working native chat
 pane (#18692)

* Keep the floating workspace above a working native chat pane

While an agent is streaming, `data-native-chat-working='true'` promoted the
native chat pane shell from z-10 to z-50, above the floating workspace panel's
z-45. Both compete in the root stacking context, so the chat column painted
over a summoned floating workspace and only the sliver past the chat's right
edge stayed visible.

Lower the working-state rule to z-44. It still clears the z-40 updater and
onboarding chrome the rule was added for (#16729) and the 41-44 band was
otherwise empty. Raising the panel instead would put it over the z-50 modal
layer it deliberately sits under.

The existing layering test pinned z-index 50 with no upper bound, which is
what let this through; it now derives both bounds from source.

* Stop the layering test reading a comment as the panel class

The panel's z-index was read with a lazy match from the data attribute to the
first `z-[NN]`. Nearby comments cite bare tiers (the toggle button's own note
mentions z-[45]), so a reworded comment landing after the attribute would be
read as the class. Strip comments and anchor to `className=`.

---------

Co-authored-by: Merge Sim <sim@local>
---
 src/renderer/src/assets/main.css              |  4 +--
 .../native-chat-stop-layering.test.ts         | 28 +++++++++++++++++--
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/src/renderer/src/assets/main.css b/src/renderer/src/assets/main.css
index 8187fe496c7..e3d267cb353 100644
--- a/src/renderer/src/assets/main.css
+++ b/src/renderer/src/assets/main.css
@@ -392,9 +392,9 @@
   z-index: 40 !important;
 }
 
-/* Keep interruption controls above unrelated updater/onboarding chrome. */
+/* Above the z-40 updater/onboarding chrome, below the floating workspace panel's z-45. */
 .native-chat-pane-shell:has([data-native-chat-working='true']) {
-  z-index: 50;
+  z-index: 44;
 }
 
 [data-sonner-toaster] [data-sonner-toast][data-styled='true'] {
diff --git a/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts b/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts
index 716f1dc3182..46bee5d6172 100644
--- a/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts
@@ -6,6 +6,15 @@ function source(path: string): string {
   return readFileSync(join(process.cwd(), path), 'utf8')
 }
 
+function workingChatZIndex(css: string): number {
+  const match =
+    /\.native-chat-pane-shell:has\(\[data-native-chat-working='true'\]\)[^{]*\{[^}]*z-index:\s*(\d+);/s.exec(
+      css
+    )
+  expect(match, 'working native-chat z-index rule not found in main.css').not.toBeNull()
+  return Number(match?.[1])
+}
+
 describe('native chat Stop layering', () => {
   it('keeps a working chat pane above bottom-right product chrome', () => {
     const css = source('src/renderer/src/assets/main.css')
@@ -15,9 +24,24 @@ describe('native chat Stop layering', () => {
 
     expect(terminalPane).toContain('native-chat-pane-shell absolute inset-0 z-10')
     expect(css).toMatch(/\[data-sonner-toaster\][^{]*\{[^}]*z-index:\s*40\s*!important;/s)
-    expect(css).toMatch(
-      /\.native-chat-pane-shell:has\(\[data-native-chat-working='true'\]\)[^{]*\{[^}]*z-index:\s*50;/s
+    expect(workingChatZIndex(css)).toBeGreaterThan(40)
+  })
+
+  // Why both bounds: raising the working pane over the panel hides a summoned
+  // floating workspace behind the chat column while an agent streams.
+  it('stays under the floating workspace panel while working', () => {
+    // Comments stripped first: the surrounding layering comment cites bare z-40/z-50
+    // tiers, and a reworded one could otherwise be read as the panel's own class.
+    const panel = source(
+      'src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx'
+    ).replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, '')
+    const panelZIndex = Number(
+      /data-floating-terminal-panel[\s\S]*?className=[\s\S]*?z-\[(\d+)\]/.exec(panel)?.[1]
     )
+
+    // FloatingTerminalPanel.bounds.test.tsx pins this same 45 through a real render.
+    expect(panelZIndex).toBe(45)
+    expect(workingChatZIndex(source('src/renderer/src/assets/main.css'))).toBeLessThan(panelZIndex)
   })
 
   it('publishes working state from both structured and bridge chat roots', () => {

From 9f10f415f5527d3dcca1eb1446bf6eb270539363 Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:51:42 -0400
Subject: [PATCH 28/58] feat(relay-infra): dynamic NAT ports and alerts for the
 2026-09-04 stall signals (#18693)

* feat(relay-infra): dynamic NAT ports and alerts for the 2026-09-04 stall signals

Relay cells reach Cloud SQL's public IP through Cloud NAT. The static default
of 64 ports per VM filled on 2026-09-04 and every cell's proxy dial timed out
at once, which read as a fleet-wide SQL stall against a healthy database.
Switch both regional NATs to dynamic port allocation (64..4096 per VM).

Add the three alerts that would have paged inside the first ten minutes:
- Cloud SQL WAL-triggered checkpoint loop (log metric on
  "checkpoint starting: wal", > 3 in 5 min)
- Cloud SQL disk utilization > 70%
- Cloud NAT OUT_OF_RESOURCES packet drops on the relay gateways

No workflow applies google_monitoring_* or the NAT resources today; every
relay workflow is target-scoped to cells. Apply is a reviewed targeted plan
(see PR body).

* test(cloud): register the three new relay alert policies in the root partition fixture
---
 .../terraform-root-partition/families.json    |   3 +
 cloud/infra/terraform/relay-gce-foundation.tf |  12 ++
 cloud/infra/terraform/relay-observability.tf  | 110 ++++++++++++++++++
 3 files changed, 125 insertions(+)

diff --git a/cloud/dev/fixtures/terraform-root-partition/families.json b/cloud/dev/fixtures/terraform-root-partition/families.json
index 9664c1eb299..3c57b2ea7cb 100644
--- a/cloud/dev/fixtures/terraform-root-partition/families.json
+++ b/cloud/dev/fixtures/terraform-root-partition/families.json
@@ -133,7 +133,10 @@
     "google_logging_metric.relay_snapshot",
     "google_monitoring_alert_policy.relay_assignment_5xx",
     "google_monitoring_alert_policy.relay_assignment_edge_429",
+    "google_monitoring_alert_policy.relay_cloud_nat_port_drops",
     "google_monitoring_alert_policy.relay_cloud_sql_backends",
+    "google_monitoring_alert_policy.relay_cloud_sql_checkpoint_loop",
+    "google_monitoring_alert_policy.relay_cloud_sql_disk",
     "google_monitoring_alert_policy.relay_custom",
     "google_monitoring_alert_policy.relay_gce_connection_headroom",
     "google_monitoring_alert_policy.relay_postgres_retry_exhausted",
diff --git a/cloud/infra/terraform/relay-gce-foundation.tf b/cloud/infra/terraform/relay-gce-foundation.tf
index aab3b4579eb..a8d64b3fcea 100644
--- a/cloud/infra/terraform/relay-gce-foundation.tf
+++ b/cloud/infra/terraform/relay-gce-foundation.tf
@@ -42,6 +42,12 @@ resource "google_compute_router_nat" "relay_gce" {
   router                             = google_compute_router.relay_gce[0].name
   nat_ip_allocate_option             = "AUTO_ONLY"
   source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
+  # Cells reach Cloud SQL's public IP through this NAT. The static default of 64 ports per VM
+  # filled during the 2026-09-04 incident and every cell's proxy dial timed out at once.
+  enable_dynamic_port_allocation      = true
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm                    = 64
+  max_ports_per_vm                    = 4096
 
   subnetwork {
     name                    = google_compute_subnetwork.relay_gce[0].id
@@ -85,6 +91,12 @@ resource "google_compute_router_nat" "relay_gce_additional" {
   router                             = google_compute_router.relay_gce_additional[each.key].name
   nat_ip_allocate_option             = "AUTO_ONLY"
   source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
+  # Cells reach Cloud SQL's public IP through this NAT. The static default of 64 ports per VM
+  # filled during the 2026-09-04 incident and every cell's proxy dial timed out at once.
+  enable_dynamic_port_allocation      = true
+  enable_endpoint_independent_mapping = false
+  min_ports_per_vm                    = 64
+  max_ports_per_vm                    = 4096
 
   subnetwork {
     name                    = google_compute_subnetwork.relay_gce_additional[each.key].id
diff --git a/cloud/infra/terraform/relay-observability.tf b/cloud/infra/terraform/relay-observability.tf
index a8fa4276eb2..5467555ccba 100644
--- a/cloud/infra/terraform/relay-observability.tf
+++ b/cloud/infra/terraform/relay-observability.tf
@@ -37,6 +37,10 @@ locals {
       description = "Relay PostgreSQL transactions that exhausted bounded retry."
       filter      = "((resource.type=\"cloud_run_revision\" AND (${local.relay_service_log_filter})) OR resource.type=\"gce_instance\") AND jsonPayload.event=\"orca_relay_postgres_transaction_exhausted\""
     }
+    cloud_sql_wal_checkpoint = {
+      description = "Cloud SQL checkpoints triggered by WAL volume instead of the timed schedule; a sustained run is the fsync loop that stalled every relay process at once on 2026-09-04."
+      filter      = "resource.type=\"cloudsql_database\" AND resource.labels.database_id=\"${var.project_id}:${local.relay_database_instance_name}\" AND textPayload:\"checkpoint starting: wal\""
+    }
   }
 
   relay_runtime_metrics = {
@@ -523,3 +527,109 @@ resource "google_monitoring_alert_policy" "relay_cloud_sql_backends" {
     mime_type = "text/markdown"
   }
 }
+
+resource "google_monitoring_alert_policy" "relay_cloud_sql_checkpoint_loop" {
+  project               = var.project_id
+  display_name          = "Orca Relay: Cloud SQL checkpoint loop"
+  combiner              = "OR"
+  enabled               = true
+  notification_channels = var.relay_alert_notification_channels
+
+  conditions {
+    display_name = "WAL-triggered checkpoints above 3 in 5 minutes"
+
+    condition_threshold {
+      filter          = "resource.type=\"cloudsql_database\" AND metric.type=\"logging.googleapis.com/user/orca_relay_cloud_sql_wal_checkpoint\""
+      comparison      = "COMPARISON_GT"
+      threshold_value = 3
+      duration        = "300s"
+
+      aggregations {
+        alignment_period     = "300s"
+        per_series_aligner   = "ALIGN_SUM"
+        cross_series_reducer = "REDUCE_SUM"
+      }
+
+      trigger {
+        count = 1
+      }
+    }
+  }
+
+  documentation {
+    content   = "Healthy operation is one timed checkpoint every 5 minutes. Repeated `checkpoint starting: wal` lines mean WAL is outrunning `max_wal_size` and every checkpoint fsync stalls all relay SQL for seconds. Check `checkpoint complete` sync= times and disk write throughput against the PD-SSD ceiling; the fix is disk size and `max_wal_size` in the Terraform root that owns the instance (orca-cloud `infra/terraform-foundation`)."
+    mime_type = "text/markdown"
+  }
+
+  depends_on = [google_logging_metric.relay_incident]
+}
+
+resource "google_monitoring_alert_policy" "relay_cloud_sql_disk" {
+  project               = var.project_id
+  display_name          = "Orca Relay: Cloud SQL disk utilization"
+  combiner              = "OR"
+  enabled               = true
+  notification_channels = var.relay_alert_notification_channels
+
+  conditions {
+    display_name = "Cloud SQL disk above 70%"
+
+    condition_threshold {
+      filter          = "resource.type=\"cloudsql_database\" AND resource.label.\"database_id\"=\"${var.project_id}:${local.relay_database_instance_name}\" AND metric.type=\"cloudsql.googleapis.com/database/disk/utilization\""
+      comparison      = "COMPARISON_GT"
+      threshold_value = 0.7
+      duration        = "600s"
+
+      aggregations {
+        alignment_period   = "300s"
+        per_series_aligner = "ALIGN_MAX"
+      }
+
+      trigger {
+        count = 1
+      }
+    }
+  }
+
+  documentation {
+    content   = "The shared auth/relay Cloud SQL disk is filling. `refresh_tokens` is the largest table and grows without pruning; grow the disk (IOPS scale with size) before it reaches the WAL checkpoint loop, and prune revoked token rows."
+    mime_type = "text/markdown"
+  }
+}
+
+resource "google_monitoring_alert_policy" "relay_cloud_nat_port_drops" {
+  count = local.relay_gce_configured ? 1 : 0
+
+  project               = var.project_id
+  display_name          = "Orca Relay: Cloud NAT port exhaustion"
+  combiner              = "OR"
+  enabled               = true
+  notification_channels = var.relay_alert_notification_channels
+
+  conditions {
+    display_name = "NAT packets dropped for lack of ports"
+
+    condition_threshold {
+      filter          = "resource.type=\"nat_gateway\" AND resource.label.\"gateway_name\"=monitoring.regex.full_match(\"${local.relay_gce_name}(-.*)?\") AND metric.type=\"router.googleapis.com/nat/dropped_sent_packets_count\" AND metric.label.\"reason\"=\"OUT_OF_RESOURCES\""
+      comparison      = "COMPARISON_GT"
+      threshold_value = 0
+      duration        = "120s"
+
+      aggregations {
+        alignment_period     = "60s"
+        per_series_aligner   = "ALIGN_SUM"
+        cross_series_reducer = "REDUCE_SUM"
+        group_by_fields      = ["resource.label.\"gateway_name\""]
+      }
+
+      trigger {
+        count = 1
+      }
+    }
+  }
+
+  documentation {
+    content   = "Relay cells reach Cloud SQL's public IP through this NAT. Port exhaustion makes every cell's Cloud SQL Auth Proxy dial time out at once, which reads as a fleet-wide SQL stall with a healthy database. Check `nat/port_usage` per VM and raise `max_ports_per_vm` in `relay-gce-foundation.tf`, or move the database to a private IP."
+    mime_type = "text/markdown"
+  }
+}

From 77334e7c8b24e31dbcb9ac36e7abb15b7bcf8e77 Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:51:45 -0400
Subject: [PATCH 29/58] fix(orca-profiles): tell the renderer when a cloud
 session is revoked (#18694)

A revoked refresh-token family makes the main process clear the stored
cloud session, but the renderer cached orcaProfileAuthStatus at startup
and only re-fetched when it was empty. The account card kept showing
"Connected" and Mobile pairing kept showing a generic Relay failure until
the user restarted the app.

- Push: clearing a session on an auth failure now emits an invalidation
  event that broadcasts orcaProfiles:authStatusChanged to every window;
  the renderer re-reads auth status from it. Explicit sign-out is unchanged.
- Pull: every pane that renders auth state re-reads it on mount through
  useOrcaProfileAuthStatusRefresh instead of only when the store is empty.
- Copy: a Relay mint failure re-reads auth status, and the failure notice
  says the session expired and to sign in again instead of offering a
  retry that cannot succeed. The LAN path is untouched.
---
 .../ipc/orca-profile-auth-status-broadcast.ts | 15 ++++
 src/main/ipc/orca-profiles.ts                 |  8 ++
 .../profile-cloud-session-invalidation.ts     | 30 +++++++
 .../profile-cloud-session-refresh.test.ts     | 45 ++++++++++
 .../profile-cloud-session-refresh.ts          |  4 +
 src/preload/api/orca-profile-api.ts           |  2 +
 src/preload/api/orca-profiles-bridge.ts       |  6 ++
 .../src/components/mobile/MobilePage.test.tsx |  4 +-
 .../src/components/mobile/MobilePage.tsx      |  4 +-
 .../mobile-relay-mint-failure-notice.tsx      | 33 ++++++--
 .../mobile/use-mobile-pairing-generation.ts   |  7 +-
 .../settings/ArtifactsSettingsPane.tsx        |  9 +-
 .../src/components/settings/DevToolsPane.tsx  |  2 +
 .../MobilePairingConnectionOptions.test.tsx   | 55 ++++++++++++-
 .../MobilePairingConnectionOptions.tsx        |  8 +-
 .../components/settings/MobilePane.test.tsx   |  7 +-
 .../src/components/settings/MobilePane.tsx    |  3 +
 .../settings/OrcaAccountSettingsPane.tsx      | 10 +--
 .../settings/ShareSkillsSettingsPane.tsx      |  9 +-
 .../ipc-events/app-lifetime-ipc-bridge.ts     |  2 +
 .../orca-profile-auth-ipc-bridge.test.ts      | 82 +++++++++++++++++++
 .../orca-profile-auth-ipc-bridge.ts           | 14 ++++
 .../use-orca-profile-auth-status-refresh.ts   | 14 ++++
 .../src/hooks/useIpcEvents-lifecycle.test.ts  |  2 +
 src/renderer/src/i18n/locales/en.json         |  4 +-
 .../web/preload-api/web-orca-profiles-api.ts  |  2 +
 src/shared/orca-profiles.ts                   |  2 +
 27 files changed, 339 insertions(+), 44 deletions(-)
 create mode 100644 src/main/ipc/orca-profile-auth-status-broadcast.ts
 create mode 100644 src/main/orca-profiles/profile-cloud-session-invalidation.ts
 create mode 100644 src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts
 create mode 100644 src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.ts
 create mode 100644 src/renderer/src/hooks/use-orca-profile-auth-status-refresh.ts

diff --git a/src/main/ipc/orca-profile-auth-status-broadcast.ts b/src/main/ipc/orca-profile-auth-status-broadcast.ts
new file mode 100644
index 00000000000..b5ac8483943
--- /dev/null
+++ b/src/main/ipc/orca-profile-auth-status-broadcast.ts
@@ -0,0 +1,15 @@
+import { BrowserWindow } from 'electron'
+import { ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL } from '../../shared/orca-profiles'
+
+export function broadcastOrcaProfileAuthStatusChanged(): void {
+  for (const window of BrowserWindow.getAllWindows()) {
+    if (window.isDestroyed()) {
+      continue
+    }
+    try {
+      window.webContents.send(ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL)
+    } catch {
+      // A renderer can disappear between isDestroyed() and send().
+    }
+  }
+}
diff --git a/src/main/ipc/orca-profiles.ts b/src/main/ipc/orca-profiles.ts
index bf1bf666270..480c6f350f9 100644
--- a/src/main/ipc/orca-profiles.ts
+++ b/src/main/ipc/orca-profiles.ts
@@ -45,6 +45,8 @@ import {
   signOutCurrentOrcaProfile
 } from '../orca-profiles/profile-cloud-service'
 import { registerOrcaProfileOrgMemberHandlers } from './orca-profile-org-members-handlers'
+import { onOrcaCloudSessionInvalidated } from '../orca-profiles/profile-cloud-session-invalidation'
+import { broadcastOrcaProfileAuthStatusChanged } from './orca-profile-auth-status-broadcast'
 
 type RegisterOrcaProfileHandlersOptions = {
   onBeforeRelaunch?: () => void | Promise<void>
@@ -178,6 +180,12 @@ export function registerOrcaProfileHandlers(
     getCurrentOrcaProfileAuthStatus(getProfileUserDataPath())
   )
 
+  // Why: a background refresh can revoke the session with no renderer request in
+  // flight, so push the change instead of waiting for the next pane to ask.
+  // Why not options.onAuthMutation: that hook drives the relay coordinator, which
+  // is the caller that just failed the refresh — re-entering it here would be a loop.
+  onOrcaCloudSessionInvalidated(broadcastOrcaProfileAuthStatusChanged)
+
   ipcMain.handle(
     'orcaProfiles:createLocal',
     (_event, args?: CreateLocalOrcaProfileArgs): CreateLocalOrcaProfileResult => {
diff --git a/src/main/orca-profiles/profile-cloud-session-invalidation.ts b/src/main/orca-profiles/profile-cloud-session-invalidation.ts
new file mode 100644
index 00000000000..a9415e28ac6
--- /dev/null
+++ b/src/main/orca-profiles/profile-cloud-session-invalidation.ts
@@ -0,0 +1,30 @@
+type OrcaCloudSessionInvalidationListener = () => void
+
+const listeners = new Set<OrcaCloudSessionInvalidationListener>()
+
+/**
+ * Fires when an auth failure (revoked or rotated-away refresh token) clears a
+ * stored cloud session. Never fires for an explicit user sign-out, which already
+ * hands the fresh auth status back to its caller.
+ */
+export function onOrcaCloudSessionInvalidated(
+  listener: OrcaCloudSessionInvalidationListener
+): () => void {
+  listeners.add(listener)
+  return () => {
+    listeners.delete(listener)
+  }
+}
+
+export function emitOrcaCloudSessionInvalidated(): void {
+  for (const listener of listeners) {
+    try {
+      listener()
+    } catch (error) {
+      console.warn(
+        '[orca-profiles] Cloud session invalidation listener failed:',
+        error instanceof Error ? error.message : String(error)
+      )
+    }
+  }
+}
diff --git a/src/main/orca-profiles/profile-cloud-session-refresh.test.ts b/src/main/orca-profiles/profile-cloud-session-refresh.test.ts
index 42b665d4e35..3b869beb6de 100644
--- a/src/main/orca-profiles/profile-cloud-session-refresh.test.ts
+++ b/src/main/orca-profiles/profile-cloud-session-refresh.test.ts
@@ -36,6 +36,8 @@ vi.mock('./profile-cloud-client', async (importOriginal) => {
 vi.mock('./profile-cloud-index', () => ({ linkOrcaProfileToCloud: linkMock }))
 
 import { readFreshOrcaCloudSession } from './profile-cloud-session-refresh'
+import { OrcaCloudRequestError } from './profile-cloud-client'
+import { onOrcaCloudSessionInvalidated } from './profile-cloud-session-invalidation'
 
 const config = {} as OrcaCloudAuthConfig
 const active = {
@@ -110,4 +112,47 @@ describe('profile cloud session refresh', () => {
     expect(saveIfCurrentMock).toHaveBeenCalledTimes(1)
     expect(linkMock).toHaveBeenCalledTimes(1)
   })
+
+  it('notifies subscribers when an auth failure clears the stored session', async () => {
+    const invalidated = vi.fn()
+    const unsubscribe = onOrcaCloudSessionInvalidated(invalidated)
+    refreshMock.mockRejectedValue(new OrcaCloudRequestError(401))
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'reconnect-required'
+    })
+
+    expect(clearMock).toHaveBeenCalledTimes(1)
+    expect(invalidated).toHaveBeenCalledTimes(1)
+    unsubscribe()
+  })
+
+  it('stays silent when a concurrent rotation already replaced the failed session', async () => {
+    const invalidated = vi.fn()
+    const unsubscribe = onOrcaCloudSessionInvalidated(invalidated)
+    refreshMock.mockRejectedValue(new OrcaCloudRequestError(401))
+    readMock.mockReturnValueOnce({
+      status: 'found',
+      session: staleSession,
+      persistence: 'memory-only'
+    })
+    readMock.mockReturnValueOnce({
+      status: 'found',
+      session: staleSession,
+      persistence: 'memory-only'
+    })
+    readMock.mockReturnValue({
+      status: 'found',
+      session: { ...staleSession, refreshToken: 'rotated-refresh' },
+      persistence: 'memory-only'
+    })
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'reconnect-required'
+    })
+
+    expect(clearMock).not.toHaveBeenCalled()
+    expect(invalidated).not.toHaveBeenCalled()
+    unsubscribe()
+  })
 })
diff --git a/src/main/orca-profiles/profile-cloud-session-refresh.ts b/src/main/orca-profiles/profile-cloud-session-refresh.ts
index ced48a16e7b..32e2e39f6e0 100644
--- a/src/main/orca-profiles/profile-cloud-session-refresh.ts
+++ b/src/main/orca-profiles/profile-cloud-session-refresh.ts
@@ -13,6 +13,7 @@ import {
   cloudSessionIdentity,
   tombstoneCloudSession
 } from './profile-cloud-session-mutation'
+import { emitOrcaCloudSessionInvalidated } from './profile-cloud-session-invalidation'
 
 const CLOUD_SESSION_REFRESH_SKEW_MS = 60_000
 
@@ -66,6 +67,9 @@ function clearCloudSessionIfUnchanged(
     )
   }
   clearOrcaCloudSession(profileId, userDataPath)
+  // Why: the renderer cached auth status at startup; without this it keeps
+  // showing "Connected" until the app restarts.
+  emitOrcaCloudSessionInvalidated()
 }
 
 async function refreshStoredCloudSession(
diff --git a/src/preload/api/orca-profile-api.ts b/src/preload/api/orca-profile-api.ts
index 16c2a575078..80e9f08fc8d 100644
--- a/src/preload/api/orca-profile-api.ts
+++ b/src/preload/api/orca-profile-api.ts
@@ -28,6 +28,8 @@ import type {
 export type OrcaProfileApi = {
   list: () => Promise<OrcaProfileListResult>
   authStatus: () => Promise<OrcaProfileAuthStatus>
+  /** Fires when main changed the stored auth status on its own (e.g. a revoked session). */
+  onAuthStatusChanged: (callback: () => void) => () => void
   createLocal: (args?: CreateLocalOrcaProfileArgs) => Promise<CreateLocalOrcaProfileResult>
   createCloudLinked: (
     args?: CreateCloudLinkedOrcaProfileArgs
diff --git a/src/preload/api/orca-profiles-bridge.ts b/src/preload/api/orca-profiles-bridge.ts
index 0b2897f8ab1..da58b2d9def 100644
--- a/src/preload/api/orca-profiles-bridge.ts
+++ b/src/preload/api/orca-profiles-bridge.ts
@@ -1,9 +1,15 @@
 import { ipcRenderer } from 'electron'
 import type { PreloadApi } from '../api-types'
+import { ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL } from '../../shared/orca-profiles'
 
 export const orcaProfilesApi = {
   list: () => ipcRenderer.invoke('orcaProfiles:list'),
   authStatus: () => ipcRenderer.invoke('orcaProfiles:authStatus'),
+  onAuthStatusChanged: (callback: () => void): (() => void) => {
+    const listener = (): void => callback()
+    ipcRenderer.on(ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL, listener)
+    return () => ipcRenderer.removeListener(ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL, listener)
+  },
   createLocal: (args) => ipcRenderer.invoke('orcaProfiles:createLocal', args),
   createCloudLinked: (args) => ipcRenderer.invoke('orcaProfiles:createCloudLinked', args),
   switchProfile: (args) => ipcRenderer.invoke('orcaProfiles:switch', args),
diff --git a/src/renderer/src/components/mobile/MobilePage.test.tsx b/src/renderer/src/components/mobile/MobilePage.test.tsx
index 2ef1cf5e965..2149cadc284 100644
--- a/src/renderer/src/components/mobile/MobilePage.test.tsx
+++ b/src/renderer/src/components/mobile/MobilePage.test.tsx
@@ -18,6 +18,7 @@ type StoreState = {
     mobilePairingCustomAddresses?: string[]
   }
   updateSettings: () => Promise<void>
+  fetchOrcaProfileAuthStatus: () => Promise<unknown>
 }
 
 const mocks = vi.hoisted(() => ({
@@ -146,7 +147,8 @@ describe('MobilePage pairing connection mode', () => {
       closeMobilePage: vi.fn(),
       orcaProfileAuthStatus: { state: 'connected' },
       settings: { showMobileButton: true },
-      updateSettings: vi.fn().mockResolvedValue(undefined)
+      updateSettings: vi.fn().mockResolvedValue(undefined),
+      fetchOrcaProfileAuthStatus: vi.fn().mockResolvedValue(null)
     }
     Object.defineProperty(window, 'api', {
       configurable: true,
diff --git a/src/renderer/src/components/mobile/MobilePage.tsx b/src/renderer/src/components/mobile/MobilePage.tsx
index ccb9a9e093f..434f0298626 100644
--- a/src/renderer/src/components/mobile/MobilePage.tsx
+++ b/src/renderer/src/components/mobile/MobilePage.tsx
@@ -39,6 +39,7 @@ export default function MobilePage(): React.JSX.Element {
   const [relayMintFailure, setRelayMintFailure] = useState<MobileRelayMintFailure | null>(null)
   const [pairLoading, setPairLoading] = useState(false)
   const signedIn = useAppStore((state) => state.orcaProfileAuthStatus?.state === 'connected')
+  const refreshAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const [connectionMode, setConnectionMode] = useMobilePairingConnectionMode()
   const [networkInterfaces, setNetworkInterfaces] = useState<MobileNetworkInterface[]>([])
   const pairingAddressChangeRef = useRef<(change: MobilePairingAddressChange) => void>(() => {})
@@ -93,7 +94,8 @@ export default function MobilePage(): React.JSX.Element {
     setPairingUrl,
     setPairingQrError,
     setPairLoading,
-    setRelayMintFailure
+    setRelayMintFailure,
+    refreshAuthStatus
   })
   useLayoutEffect(() => {
     pairingAddressChangeRef.current = ({ address, source }) => {
diff --git a/src/renderer/src/components/mobile/mobile-relay-mint-failure-notice.tsx b/src/renderer/src/components/mobile/mobile-relay-mint-failure-notice.tsx
index d5e929152fb..ee3d82a51d1 100644
--- a/src/renderer/src/components/mobile/mobile-relay-mint-failure-notice.tsx
+++ b/src/renderer/src/components/mobile/mobile-relay-mint-failure-notice.tsx
@@ -3,6 +3,7 @@ import { CircleAlert, Loader2 } from 'lucide-react'
 import { Button } from '../ui/button'
 import { translate } from '@/i18n/i18n'
 import type { MobileRelayMintFailure } from '../../../../shared/mobile-relay-mint-failure'
+import { useAppStore } from '@/store'
 import { cn } from '@/lib/utils'
 
 export function MobileRelayMintFailureNotice({
@@ -23,6 +24,10 @@ export function MobileRelayMintFailureNotice({
   busy?: boolean
 }): React.JSX.Element {
   const providerMissing = failure.stage === 'provider_missing'
+  // Why: a revoked cloud session fails every mint; "retry or use LAN" hides the one action that works.
+  const reconnectRequired = useAppStore(
+    (state) => state.orcaProfileAuthStatus?.state === 'reconnect-required'
+  )
   const [showBusyFeedback, setShowBusyFeedback] = useState(false)
   useEffect(() => {
     if (!busy) {
@@ -43,10 +48,15 @@ export function MobileRelayMintFailureNotice({
           'auto.components.mobile.MobileRelayMintFailureNotice.unavailableTitle',
           'Orca Relay isn’t available on this desktop.'
         )
-      : translate(
-          'auto.components.mobile.MobileRelayMintFailureNotice.title',
-          'Couldn’t create a Relay pairing code.'
-        )
+      : reconnectRequired
+        ? translate(
+            'auto.components.mobile.MobileRelayMintFailureNotice.reconnectTitle',
+            'Your Orca account session expired.'
+          )
+        : translate(
+            'auto.components.mobile.MobileRelayMintFailureNotice.title',
+            'Couldn’t create a Relay pairing code.'
+          )
   const body = visibleBusy
     ? translate(
         'auto.components.mobile.MobileRelayMintFailureNotice.retryingBody',
@@ -57,10 +67,15 @@ export function MobileRelayMintFailureNotice({
           'auto.components.mobile.MobileRelayMintFailureNotice.unavailableBody',
           'Use LAN to pair over Tailscale or the same Wi‑Fi.'
         )
-      : translate(
-          'auto.components.mobile.MobileRelayMintFailureNotice.body',
-          'Retry, or use LAN to pair over Tailscale or the same Wi‑Fi.'
-        )
+      : reconnectRequired
+        ? translate(
+            'auto.components.mobile.MobileRelayMintFailureNotice.reconnectBody',
+            'Sign in again to use Orca Relay, or use LAN to pair over Tailscale or the same Wi‑Fi.'
+          )
+        : translate(
+            'auto.components.mobile.MobileRelayMintFailureNotice.body',
+            'Retry, or use LAN to pair over Tailscale or the same Wi‑Fi.'
+          )
 
   return (
     <div
@@ -90,7 +105,7 @@ export function MobileRelayMintFailureNotice({
           <Button type="button" size={compact ? 'xs' : 'sm'} onClick={onUseLan}>
             {translate('auto.components.mobile.MobileRelayMintFailureNotice.useLan', 'Use LAN')}
           </Button>
-          {!providerMissing ? (
+          {!providerMissing && !reconnectRequired ? (
             <Button
               type="button"
               size={compact ? 'xs' : 'sm'}
diff --git a/src/renderer/src/components/mobile/use-mobile-pairing-generation.ts b/src/renderer/src/components/mobile/use-mobile-pairing-generation.ts
index 084d256e424..088e1c6d229 100644
--- a/src/renderer/src/components/mobile/use-mobile-pairing-generation.ts
+++ b/src/renderer/src/components/mobile/use-mobile-pairing-generation.ts
@@ -28,6 +28,8 @@ export function useMobilePairingGeneration(params: {
   setPairingQrError: (value: boolean) => void
   setPairLoading: (value: boolean) => void
   setRelayMintFailure: (value: MobileRelayMintFailure | null) => void
+  /** Re-read on a Relay mint failure: a revoked session is the likeliest cause. */
+  refreshAuthStatus: () => void
 }): {
   generatePairing: (
     rotate: boolean,
@@ -47,7 +49,8 @@ export function useMobilePairingGeneration(params: {
     setPairingUrl,
     setPairingQrError,
     setPairLoading,
-    setRelayMintFailure
+    setRelayMintFailure,
+    refreshAuthStatus
   } = params
 
   const generatePairing = useCallback(
@@ -92,6 +95,7 @@ export function useMobilePairingGeneration(params: {
             setPairingQrError(false)
             if (result.reason === 'relay_mint_failed' && result.relayFailure) {
               setRelayMintFailure(result.relayFailure)
+              refreshAuthStatus()
             } else {
               setRelayMintFailure(null)
               // Why: IPC now forwards reason/guidance for all unavailability paths;
@@ -132,6 +136,7 @@ export function useMobilePairingGeneration(params: {
       hasGeneratedRef,
       mountedRef,
       pairingRequestIdRef,
+      refreshAuthStatus,
       selectedAddress,
       setPairLoading,
       setPairQrDataUrl,
diff --git a/src/renderer/src/components/settings/ArtifactsSettingsPane.tsx b/src/renderer/src/components/settings/ArtifactsSettingsPane.tsx
index 60dd3e0c0c9..7e8b87029d4 100644
--- a/src/renderer/src/components/settings/ArtifactsSettingsPane.tsx
+++ b/src/renderer/src/components/settings/ArtifactsSettingsPane.tsx
@@ -1,8 +1,8 @@
-import { useEffect } from 'react'
 import { ArrowRight, Files } from 'lucide-react'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import { Button } from '@/components/ui/button'
 import { SettingsSwitchRow } from './SettingsFormControls'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { useAppStore } from '@/store'
 import { isWebClientLocation } from '@/lib/web-client-location'
 import { translate } from '@/i18n/i18n'
@@ -20,18 +20,13 @@ export function ArtifactsSettingsPane({
   const authStatus = useAppStore((state) => state.orcaProfileAuthStatus)
   const connecting = useAppStore((state) => state.orcaProfileConnecting)
   const connect = useAppStore((state) => state.connectCurrentOrcaProfile)
-  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const signedIn = authStatus?.state === 'connected'
   // Why: the capability lives in the desktop host's store and is deliberately absent from the
   // settings.update allowlist, so a web client can only mirror it — never grant it.
   const isWebClient = isWebClientLocation()
   const sharingEnabled = settings.artifactSharingEnabled === true
 
-  useEffect(() => {
-    if (!authStatus) {
-      void fetchAuthStatus()
-    }
-  }, [authStatus, fetchAuthStatus])
+  useOrcaProfileAuthStatusRefresh()
 
   const howToSteps: HowToStep[] = [
     ...(sharingEnabled
diff --git a/src/renderer/src/components/settings/DevToolsPane.tsx b/src/renderer/src/components/settings/DevToolsPane.tsx
index 11bfb36d933..5084dbfb4de 100644
--- a/src/renderer/src/components/settings/DevToolsPane.tsx
+++ b/src/renderer/src/components/settings/DevToolsPane.tsx
@@ -5,6 +5,7 @@ import { Badge } from '../ui/badge'
 import { SettingsSubsectionHeader } from './SettingsFormControls'
 import { showDeleteWorktreeFailureToast } from '../sidebar/delete-worktree-failure-toast'
 import { showLocalBaseRefUpdateSuggestionToast } from '../sidebar/local-base-ref-suggestion-toast'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { translate } from '@/i18n/i18n'
 import { useAppStore } from '@/store'
 import type { AppState } from '@/store/types'
@@ -137,6 +138,7 @@ function OrcaCloudDevSubsection(): React.JSX.Element {
   const refresh = useAppStore((s) => s.fetchOrcaProfileAuthStatus)
   const configured = authStatus?.configured === true
   const connected = authStatus?.state === 'connected'
+  useOrcaProfileAuthStatusRefresh()
 
   return (
     <section className="space-y-3">
diff --git a/src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx b/src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx
index 6ff64efa82a..a08c220038c 100644
--- a/src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx
+++ b/src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx
@@ -2,6 +2,7 @@
 
 import '@testing-library/jest-dom/vitest'
 
+import { StrictMode, useSyncExternalStore } from 'react'
 import { cleanup, render, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -17,13 +18,28 @@ type MobileRelayStoreState = {
 }
 
 const mocks = vi.hoisted(() => ({
-  state: {} as MobileRelayStoreState
+  state: {} as MobileRelayStoreState,
+  listeners: new Set<() => void>()
 }))
 
+// Why subscribable: a mid-mount auth re-read has to reach the rendered tree, which a
+// plain selector-over-a-mutable-object mock silently swallows.
 vi.mock('../../store', () => ({
-  useAppStore: (selector: (state: MobileRelayStoreState) => unknown) => selector(mocks.state)
+  useAppStore: (selector: (state: MobileRelayStoreState) => unknown) =>
+    useSyncExternalStore(
+      (onStoreChange) => {
+        mocks.listeners.add(onStoreChange)
+        return () => mocks.listeners.delete(onStoreChange)
+      },
+      () => selector(mocks.state)
+    )
 }))
 
+function publishStoreState(next: MobileRelayStoreState): void {
+  mocks.state = next
+  mocks.listeners.forEach((listener) => listener())
+}
+
 vi.mock('../../i18n/i18n', () => ({
   translate: (_key: string, fallback: string) => fallback
 }))
@@ -251,4 +267,39 @@ describe('MobilePairingConnectionOptions', () => {
     await user.click(lan)
     expect(onChange).toHaveBeenCalledWith('local-only')
   })
+
+  it('re-reads a session revoked since startup and offers Sign in again', async () => {
+    // Regression: the store cached "connected" at startup and the pane only
+    // fetched when it was empty, so a revoked session stayed invisible.
+    const connectedState: MobileRelayStoreState = {
+      ...mocks.state,
+      orcaProfileAuthStatus: {
+        activeProfileId: 'profile-1',
+        configured: true,
+        state: 'connected',
+        persistence: 'encrypted'
+      }
+    }
+    mocks.state = connectedState
+    fetchAuthStatus.mockImplementation(async () => {
+      const revoked: OrcaProfileAuthStatus = {
+        activeProfileId: 'profile-1',
+        configured: true,
+        state: 'reconnect-required',
+        persistence: 'encrypted'
+      }
+      publishStoreState({ ...connectedState, orcaProfileAuthStatus: revoked })
+      return revoked
+    })
+
+    // StrictMode double-invokes the effect: a fetch keyed on what it writes would loop.
+    render(
+      <StrictMode>
+        <MobilePairingConnectionOptions value="automatic" onChange={vi.fn()} />
+      </StrictMode>
+    )
+
+    expect(await screen.findByRole('button', { name: 'Sign in again for Relay' })).toBeVisible()
+    expect(fetchAuthStatus).toHaveBeenCalledTimes(2)
+  })
 })
diff --git a/src/renderer/src/components/settings/MobilePairingConnectionOptions.tsx b/src/renderer/src/components/settings/MobilePairingConnectionOptions.tsx
index 1af58c45827..7874bc5047f 100644
--- a/src/renderer/src/components/settings/MobilePairingConnectionOptions.tsx
+++ b/src/renderer/src/components/settings/MobilePairingConnectionOptions.tsx
@@ -4,6 +4,7 @@ import { Badge } from '../ui/badge'
 import { Button } from '../ui/button'
 import { translate } from '../../i18n/i18n'
 import { useAppStore } from '../../store'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { cn } from '@/lib/utils'
 import type { MobileRelayStatus } from '../../../../shared/mobile-relay-status'
 import type { MobilePairingConnectionMode } from '../../../../shared/mobile-pairing-connection-mode'
@@ -54,7 +55,6 @@ export function MobilePairingConnectionOptions({
   const authStatus = useAppStore((state) => state.orcaProfileAuthStatus)
   const connecting = useAppStore((state) => state.orcaProfileConnecting)
   const connect = useAppStore((state) => state.connectCurrentOrcaProfile)
-  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const [relayStatus, setRelayStatus] = useState<MobileRelayStatus>('offline')
   const signedIn = authStatus?.state === 'connected'
   const reconnectRequired = authStatus?.state === 'reconnect-required'
@@ -93,11 +93,7 @@ export function MobilePairingConnectionOptions({
     optionRefs.current[next]?.focus()
   }
 
-  useEffect(() => {
-    if (!authStatus) {
-      void fetchAuthStatus()
-    }
-  }, [authStatus, fetchAuthStatus])
+  useOrcaProfileAuthStatusRefresh()
 
   useEffect(() => {
     let receivedEvent = false
diff --git a/src/renderer/src/components/settings/MobilePane.test.tsx b/src/renderer/src/components/settings/MobilePane.test.tsx
index 1695263a740..28f83ccf697 100644
--- a/src/renderer/src/components/settings/MobilePane.test.tsx
+++ b/src/renderer/src/components/settings/MobilePane.test.tsx
@@ -32,6 +32,7 @@ type StoreState = {
   }
   updateSettings: (patch: Record<string, unknown>) => Promise<void>
   recordFeatureInteraction: (feature: string) => void
+  fetchOrcaProfileAuthStatus: () => Promise<unknown>
 }
 
 const mocks = vi.hoisted(() => {
@@ -188,7 +189,8 @@ describe('MobilePane pairing connection mode', () => {
       settingsSearchQuery: '',
       settings: { mobileAutoRestoreFitMs: null },
       updateSettings,
-      recordFeatureInteraction: vi.fn()
+      recordFeatureInteraction: vi.fn(),
+      fetchOrcaProfileAuthStatus: vi.fn().mockResolvedValue(null)
     }
     Object.defineProperty(window, 'api', {
       configurable: true,
@@ -797,7 +799,8 @@ describe('MobilePane', () => {
       settingsSearchQuery: '',
       settings: { mobileAutoRestoreFitMs: null },
       updateSettings: mocks.updateSettings,
-      recordFeatureInteraction: vi.fn()
+      recordFeatureInteraction: vi.fn(),
+      fetchOrcaProfileAuthStatus: vi.fn().mockResolvedValue(null)
     }
     Object.defineProperty(window, 'api', {
       configurable: true,
diff --git a/src/renderer/src/components/settings/MobilePane.tsx b/src/renderer/src/components/settings/MobilePane.tsx
index 39c6df203c0..0e51b677ffc 100644
--- a/src/renderer/src/components/settings/MobilePane.tsx
+++ b/src/renderer/src/components/settings/MobilePane.tsx
@@ -218,6 +218,9 @@ export function MobilePane(): React.JSX.Element {
           setEndpoint(null)
           if (result.reason === 'relay_mint_failed' && result.relayFailure) {
             setRelayMintFailure(result.relayFailure)
+            // Why: a revoked session is the likeliest cause; re-read it so the
+            // notice can offer sign-in instead of a retry that cannot succeed.
+            void useAppStore.getState().fetchOrcaProfileAuthStatus()
           } else {
             setRelayMintFailure(null)
             // Why: IPC now forwards reason/guidance for all unavailability paths;
diff --git a/src/renderer/src/components/settings/OrcaAccountSettingsPane.tsx b/src/renderer/src/components/settings/OrcaAccountSettingsPane.tsx
index cf6aec97946..8d7ef62f086 100644
--- a/src/renderer/src/components/settings/OrcaAccountSettingsPane.tsx
+++ b/src/renderer/src/components/settings/OrcaAccountSettingsPane.tsx
@@ -1,7 +1,8 @@
-import { useEffect, useState } from 'react'
+import { useState } from 'react'
 import { BookOpen, Check, CircleUserRound, Files, Smartphone } from 'lucide-react'
 import { Badge } from '@/components/ui/badge'
 import { Button } from '@/components/ui/button'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 import { useAppStore } from '@/store'
@@ -61,18 +62,13 @@ export function OrcaAccountSettingsPane(): React.JSX.Element {
   const authStatus = useAppStore((state) => state.orcaProfileAuthStatus)
   const connecting = useAppStore((state) => state.orcaProfileConnecting)
   const connect = useAppStore((state) => state.connectCurrentOrcaProfile)
-  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const signOut = useAppStore((state) => state.signOutCurrentOrcaProfile)
   const [signOutOpen, setSignOutOpen] = useState(false)
   const [signingOut, setSigningOut] = useState(false)
   const connected = authStatus?.state === 'connected'
   const canConnect = authStatus?.configured === true
 
-  useEffect(() => {
-    if (!authStatus) {
-      void fetchAuthStatus()
-    }
-  }, [authStatus, fetchAuthStatus])
+  useOrcaProfileAuthStatusRefresh()
 
   const confirmSignOut = async (): Promise<void> => {
     if (signingOut) {
diff --git a/src/renderer/src/components/settings/ShareSkillsSettingsPane.tsx b/src/renderer/src/components/settings/ShareSkillsSettingsPane.tsx
index 72da1ad4880..ddbf35734c9 100644
--- a/src/renderer/src/components/settings/ShareSkillsSettingsPane.tsx
+++ b/src/renderer/src/components/settings/ShareSkillsSettingsPane.tsx
@@ -1,6 +1,6 @@
-import { useEffect } from 'react'
 import { ArrowRight, BookOpen } from 'lucide-react'
 import { Button } from '@/components/ui/button'
+import { useOrcaProfileAuthStatusRefresh } from '@/hooks/use-orca-profile-auth-status-refresh'
 import { translate } from '@/i18n/i18n'
 import { isWebClientLocation } from '@/lib/web-client-location'
 import { useAppStore } from '@/store'
@@ -16,16 +16,11 @@ export function ShareSkillsSettingsPane(): React.JSX.Element {
   const authStatus = useAppStore((state) => state.orcaProfileAuthStatus)
   const connecting = useAppStore((state) => state.orcaProfileConnecting)
   const connect = useAppStore((state) => state.connectCurrentOrcaProfile)
-  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
   const signedIn = authStatus?.state === 'connected'
   const isWebClient = isWebClientLocation()
   const agentSharingEnabled = settings?.agentSkillSharingEnabled === true
 
-  useEffect(() => {
-    if (!authStatus) {
-      void fetchAuthStatus()
-    }
-  }, [authStatus, fetchAuthStatus])
+  useOrcaProfileAuthStatusRefresh()
 
   const steps: HowToStep[] = [
     {
diff --git a/src/renderer/src/hooks/ipc-events/app-lifetime-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/app-lifetime-ipc-bridge.ts
index 17a5357071d..fa683b7188f 100644
--- a/src/renderer/src/hooks/ipc-events/app-lifetime-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/app-lifetime-ipc-bridge.ts
@@ -12,6 +12,7 @@ import { createDirectSshBridgeRuntime } from './direct-ssh-bridge-runtime'
 import { registerDirectSshStateIpcBridge } from './direct-ssh-state-ipc-bridge'
 import { registerMobileAndTerminalCloseIpcBridge } from './mobile-terminal-close-ipc-bridge'
 import { registerMobileDriverIpcBridge } from './mobile-driver-ipc-bridge'
+import { registerOrcaProfileAuthIpcBridge } from './orca-profile-auth-ipc-bridge'
 import { registerOsMarkdownFileOpenBridge } from './os-markdown-file-open-bridge'
 import { registerProjectCatalogIpcBridge } from './project-catalog-ipc-bridge'
 import { registerRateLimitIpcBridge } from './rate-limit-ipc-bridge'
@@ -78,6 +79,7 @@ export function installAppLifetimeIpcEvents(
     remountTerminalTabsAwaitingHostHydration
   )
   registerSettingsAndSidebarIpcBridge(unsubs)
+  registerOrcaProfileAuthIpcBridge(unsubs)
   registerWorkspaceShortcutIpcBridge(unsubs)
   registerOsMarkdownFileOpenBridge(unsubs)
   unsubs.push(
diff --git a/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts b/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts
new file mode 100644
index 00000000000..593ace5336d
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts
@@ -0,0 +1,82 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { OrcaProfileAuthStatus } from '../../../../shared/orca-profiles'
+import { createTestStore } from '../../store/slices/store-test-helpers'
+
+const { storeHolder } = vi.hoisted(() => ({
+  storeHolder: { current: null as { getState: () => unknown } | null }
+}))
+
+vi.mock('../../store', () => ({
+  useAppStore: { getState: () => storeHolder.current?.getState() }
+}))
+
+vi.mock('sonner', () => ({
+  toast: { error: vi.fn(), info: vi.fn(), success: vi.fn(), warning: vi.fn() }
+}))
+
+import { registerOrcaProfileAuthIpcBridge } from './orca-profile-auth-ipc-bridge'
+
+const connectedAuthStatus: OrcaProfileAuthStatus = {
+  activeProfileId: 'local-default',
+  configured: true,
+  state: 'connected',
+  persistence: 'encrypted'
+}
+
+const reconnectRequiredAuthStatus: OrcaProfileAuthStatus = {
+  activeProfileId: 'local-default',
+  configured: true,
+  state: 'reconnect-required',
+  persistence: 'encrypted'
+}
+
+describe('orca profile auth IPC bridge', () => {
+  let listener: (() => void) | null = null
+  const unsubscribe = vi.fn()
+  const authStatus = vi.fn()
+
+  beforeEach(() => {
+    listener = null
+    unsubscribe.mockClear()
+    authStatus.mockReset()
+    vi.stubGlobal('window', {
+      api: {
+        orcaProfiles: {
+          authStatus,
+          onAuthStatusChanged: (callback: () => void) => {
+            listener = callback
+            return unsubscribe
+          }
+        }
+      }
+    })
+  })
+
+  it('re-fetches auth status on the push, flipping connected to reconnect-required', async () => {
+    authStatus.mockResolvedValue(connectedAuthStatus)
+    const store = createTestStore()
+    storeHolder.current = store
+    await store.getState().fetchOrcaProfileAuthStatus()
+    expect(store.getState().orcaProfileAuthStatus).toEqual(connectedAuthStatus)
+
+    const unsubs: (() => void)[] = []
+    registerOrcaProfileAuthIpcBridge(unsubs)
+    authStatus.mockResolvedValue(reconnectRequiredAuthStatus)
+    listener?.()
+    await vi.waitFor(() =>
+      expect(store.getState().orcaProfileAuthStatus).toEqual(reconnectRequiredAuthStatus)
+    )
+
+    unsubs.forEach((dispose) => dispose())
+    expect(unsubscribe).toHaveBeenCalledTimes(1)
+  })
+
+  it('skips registration when the preload bridge does not expose the event', () => {
+    vi.stubGlobal('window', { api: { orcaProfiles: { authStatus } } })
+    const unsubs: (() => void)[] = []
+
+    registerOrcaProfileAuthIpcBridge(unsubs)
+
+    expect(unsubs).toHaveLength(0)
+  })
+})
diff --git a/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.ts
new file mode 100644
index 00000000000..95397b64a62
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.ts
@@ -0,0 +1,14 @@
+import { useAppStore } from '../../store'
+
+/** Re-reads auth status when main clears a revoked cloud session behind the renderer's back. */
+export function registerOrcaProfileAuthIpcBridge(unsubs: (() => void)[]): void {
+  const subscribe = window.api.orcaProfiles?.onAuthStatusChanged
+  if (typeof subscribe !== 'function') {
+    return
+  }
+  unsubs.push(
+    subscribe(() => {
+      void useAppStore.getState().fetchOrcaProfileAuthStatus()
+    })
+  )
+}
diff --git a/src/renderer/src/hooks/use-orca-profile-auth-status-refresh.ts b/src/renderer/src/hooks/use-orca-profile-auth-status-refresh.ts
new file mode 100644
index 00000000000..692ed9bcfc1
--- /dev/null
+++ b/src/renderer/src/hooks/use-orca-profile-auth-status-refresh.ts
@@ -0,0 +1,14 @@
+import { useEffect } from 'react'
+import { useAppStore } from '../store'
+
+/**
+ * Re-reads the cloud auth status whenever a surface that renders it mounts. The
+ * store caches the startup value, so without this a session revoked since launch
+ * still reads as connected. The cached value stays rendered while the fetch runs.
+ */
+export function useOrcaProfileAuthStatusRefresh(): void {
+  const fetchAuthStatus = useAppStore((state) => state.fetchOrcaProfileAuthStatus)
+  useEffect(() => {
+    void fetchAuthStatus()
+  }, [fetchAuthStatus])
+}
diff --git a/src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts b/src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts
index 6e0e7238c05..5991c40c4de 100644
--- a/src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts
+++ b/src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts
@@ -19,6 +19,7 @@ const EXPECTED_DIRECT_CALLBACK_METHODS = [
   'emulator.onPaneFocus',
   'gh.onPRRefreshEvent',
   'keybindings.onChanged',
+  'orcaProfiles.onAuthStatusChanged',
   'pty.onExit',
   'rateLimits.onUpdate',
   'remoteWorkspace.onChanged',
@@ -126,6 +127,7 @@ const EXPECTED_CALLBACK_REGISTRATION_SEQUENCE = [
   'ui.onToggleWorktreePalette',
   'ui.onToggleFloatingTerminal',
   'ui.onTerminalShortcutCaptured',
+  'orcaProfiles.onAuthStatusChanged',
   'ui.onOpenQuickOpen',
   'ui.onToggleQuickCommandsMenu',
   'ui.onOpenNewWorkspace',
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index f2da58bffb3..e8bc924f64e 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -13771,7 +13771,9 @@
           "useLan": "Use LAN",
           "retrying": "Retrying…",
           "retry": "Retry Relay",
-          "copyDiagnostics": "Copy diagnostics"
+          "copyDiagnostics": "Copy diagnostics",
+          "reconnectTitle": "Your Orca account session expired.",
+          "reconnectBody": "Sign in again to use Orca Relay, or use LAN to pair over Tailscale or the same Wi‑Fi."
         }
       },
       "gitlab": {
diff --git a/src/renderer/src/web/preload-api/web-orca-profiles-api.ts b/src/renderer/src/web/preload-api/web-orca-profiles-api.ts
index 0b552bf15c8..e59d805ce3d 100644
--- a/src/renderer/src/web/preload-api/web-orca-profiles-api.ts
+++ b/src/renderer/src/web/preload-api/web-orca-profiles-api.ts
@@ -3,6 +3,7 @@ import {
   DEFAULT_LOCAL_ORCA_PROFILE_ID,
   createDefaultLocalOrcaProfile
 } from '../../../../shared/orca-profiles'
+import { noopUnsubscribe } from './web-storage'
 
 export function createWebOrcaProfilesApi(): Partial<PreloadApi> {
   const webOrcaProfileAuthStatus = () =>
@@ -22,6 +23,7 @@ export function createWebOrcaProfilesApi(): Partial<PreloadApi> {
           multiProfileUi: false
         }),
       authStatus: webOrcaProfileAuthStatus,
+      onAuthStatusChanged: () => noopUnsubscribe,
       createLocal: () =>
         Promise.resolve({
           activeProfileId: DEFAULT_LOCAL_ORCA_PROFILE_ID,
diff --git a/src/shared/orca-profiles.ts b/src/shared/orca-profiles.ts
index 851021a0779..298cfc28312 100644
--- a/src/shared/orca-profiles.ts
+++ b/src/shared/orca-profiles.ts
@@ -4,6 +4,8 @@ import type { ExecutionHostId } from './execution-host'
 export const ORCA_PROFILE_INDEX_SCHEMA_VERSION = 1
 export const DEFAULT_LOCAL_ORCA_PROFILE_ID = 'local-default'
 export const DEFAULT_LOCAL_ORCA_PROFILE_NAME = 'Personal'
+/** Main -> renderer push when the stored auth status changed without the renderer asking. */
+export const ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL = 'orcaProfiles:authStatusChanged'
 const LEGACY_ORCA_BROWSER_SESSION_PARTITION_PREFIX = 'persist:orca-browser-session-'
 
 export type OrcaProfileAvatar = {

From ef428d879e09a02daa3bb9ed977a7802d89da289 Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:51:49 -0400
Subject: [PATCH 30/58] feat(relay): tell the phone when its desktop is signed
 out (#18698)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On 2026-09-04 an auth outage signed ~21,600 desktops out of Orca Cloud and
every paired phone showed the generic "Can't reach desktop" for hours. The
desktop knew why, the cell watched it happen, and neither could say so.

The desktop now names auth loss on its control close reason; the cell
remembers that reason per (userId, relayHostId) and replays it as the close
reason of the 4404 it already sends a phone whose host is absent; the phone
turns it into "Desktop signed out — sign in to Orca on your desktop to
reconnect". Retry cadence, close codes and every message body are untouched.

The reason rides the WebSocket close reason because there is no additive JSON
channel to a shipped phone: RelayPhoneHelloSchema, RelayAuthSchema and the
director's ResolveResponseSchema are all zod .strict(), and /v1/connect
rejects any query string outright. A new close code was also rejected — an old
phone would fall out of mobileRelayRecoveryFor and off the 5-15s host-offline
backoff onto the faster transport backoff.

The cell keeps the reason in memory rather than Postgres: a phone reaches the
cell its host's assignment row already names, which is the cell that saw the
close, and losing it on a cell restart degrades to today's verdict rather than
a wrong one.
---
 .../src/host-close-reason-memory.test.ts      |  82 +++++++
 .../relay/src/host-close-reason-memory.ts     |  72 ++++++
 cloud/apps/relay/src/host-session-registry.ts |  40 +++-
 .../src/host-signed-out-rejection.test.ts     | 206 +++++++++++++++++
 .../relay-contract/src/host-close-reason.ts   |  18 ++
 cloud/packages/relay-contract/src/index.ts    |   1 +
 mobile/src/home/MobileHomeHostList.tsx        |   7 +-
 mobile/src/home/MobileHomeScreen.tsx          |   1 +
 .../home/home-host-connection-projection.ts   |   9 +-
 mobile/src/home/use-mobile-home-data.ts       |   1 +
 .../client-context-connection-metrics.ts      |   6 +-
 mobile/src/transport/client-context.test.ts   |   4 +-
 mobile/src/transport/connection-health.ts     |  19 ++
 .../transport/host-client-context-state.ts    |   8 +-
 .../logical-client-connection-path.ts         |  16 +-
 .../transport/mobile-endpoint-lifecycle.ts    |   3 +-
 .../mobile-endpoint-supervisor-contract.ts    |   4 +-
 .../mobile-endpoint-supervisor-test-fakes.ts  |  12 +
 .../mobile-endpoint-supervisor.test.ts        |  13 +-
 .../src/transport/mobile-relay-e2ee-link.ts   |  15 ++
 .../src/transport/mobile-relay-rpc-session.ts |   3 +
 .../mobile-relay-runtime-failover.test.ts     |  21 +-
 .../mobile-relay-session-establisher.ts       |  12 +-
 .../relay-host-signed-out-supervisor.test.ts  |  60 +++++
 .../relay-host-signed-out-verdict.test.ts     | 216 ++++++++++++++++++
 .../transport/rpc-client-context-contract.ts  |   1 +
 .../transport/stable-logical-rpc-client.ts    |   5 +
 mobile/src/transport/use-all-host-clients.ts  |   4 +-
 .../runtime/relay/desktop-relay-service.ts    |   5 +-
 .../runtime/relay/relay-auth-coordinator.ts   |  23 +-
 .../relay-auth-host-close-reason.test.ts      | 122 ++++++++++
 .../runtime/relay/relay-control-client.ts     |  24 +-
 .../relay/relay-control-close-reason.test.ts  |  92 ++++++++
 .../runtime/relay/relay-control-origin.ts     |   9 +-
 .../runtime/relay/relay-control-protocol.ts   |  26 +++
 .../relay/relay-control-socket-close.ts       |  26 +++
 src/main/runtime/relay/relay-origin-pool.ts   |   5 +-
 .../runtime/relay/relay-session-broker.ts     |   5 +-
 src/main/startup/main-window-core-services.ts |   6 +-
 src/shared/relay-host-close-reason.ts         |  19 ++
 40 files changed, 1164 insertions(+), 57 deletions(-)
 create mode 100644 cloud/apps/relay/src/host-close-reason-memory.test.ts
 create mode 100644 cloud/apps/relay/src/host-close-reason-memory.ts
 create mode 100644 cloud/apps/relay/src/host-signed-out-rejection.test.ts
 create mode 100644 cloud/packages/relay-contract/src/host-close-reason.ts
 create mode 100644 mobile/src/transport/relay-host-signed-out-supervisor.test.ts
 create mode 100644 mobile/src/transport/relay-host-signed-out-verdict.test.ts
 create mode 100644 src/main/runtime/relay/relay-auth-host-close-reason.test.ts
 create mode 100644 src/main/runtime/relay/relay-control-close-reason.test.ts
 create mode 100644 src/main/runtime/relay/relay-control-socket-close.ts
 create mode 100644 src/shared/relay-host-close-reason.ts

diff --git a/cloud/apps/relay/src/host-close-reason-memory.test.ts b/cloud/apps/relay/src/host-close-reason-memory.test.ts
new file mode 100644
index 00000000000..2985e6f1a1d
--- /dev/null
+++ b/cloud/apps/relay/src/host-close-reason-memory.test.ts
@@ -0,0 +1,82 @@
+import { ASSIGNMENT_LIMITS, RELAY_HOST_CLOSE_REASON } from '@orca-cloud/relay-contract'
+import { describe, expect, it } from 'vitest'
+import { HostCloseReasonMemory } from './host-close-reason-memory.js'
+
+function memoryAt(clock: { now: number }): HostCloseReasonMemory {
+  return new HostCloseReasonMemory(() => clock.now)
+}
+
+describe('HostCloseReasonMemory', () => {
+  it('remembers only reasons it knows', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    memory.record('b', 'quitting')
+    memory.record('c', Buffer.alloc(0))
+    memory.record('d', undefined)
+
+    expect(memory.read('a')).toBe(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    expect(memory.read('b')).toBeNull()
+    expect(memory.read('c')).toBeNull()
+    expect(memory.read('d')).toBeNull()
+  })
+
+  it('accepts the reason as the Buffer a ws close delivers', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+
+    memory.record('a', Buffer.from(RELAY_HOST_CLOSE_REASON.SIGNED_OUT))
+
+    expect(memory.read('a')).toBe(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+
+  it('expires an entry once its host may have been rebalanced away', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    clock.now += ASSIGNMENT_LIMITS.dormantTtlMs - 1
+    expect(memory.read('a')).toBe(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    clock.now += 1
+    expect(memory.read('a')).toBeNull()
+    expect(memory.size()).toBe(0)
+  })
+
+  it('forgets on demand', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    memory.forget('a')
+
+    expect(memory.read('a')).toBeNull()
+  })
+
+  it('drops the oldest survivors rather than growing without bound', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+    for (let index = 0; index < 50_050; index++) {
+      memory.record(`host-${index}`, RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    }
+
+    expect(memory.size()).toBe(50_000)
+    expect(memory.read('host-0')).toBeNull()
+    expect(memory.read('host-50049')).toBe(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+
+  it('re-recording refreshes recency so a live host is not evicted first', () => {
+    const clock = { now: 1_000 }
+    const memory = memoryAt(clock)
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    memory.record('b', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    memory.record('a', RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    expect([...['a', 'b'].map((key) => memory.read(key))]).toEqual([
+      RELAY_HOST_CLOSE_REASON.SIGNED_OUT,
+      RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    ])
+    expect(memory.size()).toBe(2)
+  })
+})
diff --git a/cloud/apps/relay/src/host-close-reason-memory.ts b/cloud/apps/relay/src/host-close-reason-memory.ts
new file mode 100644
index 00000000000..ed01aacd666
--- /dev/null
+++ b/cloud/apps/relay/src/host-close-reason-memory.ts
@@ -0,0 +1,72 @@
+import {
+  ASSIGNMENT_LIMITS,
+  relayHostCloseReasonFrom,
+  type RelayHostCloseReason
+} from '@orca-cloud/relay-contract'
+
+// Retention matches the dormant assignment TTL: past it the host may have been
+// rebalanced onto another cell, so this cell is no longer the one a phone asks.
+const RETENTION_MS = ASSIGNMENT_LIMITS.dormantTtlMs
+// A fleet-wide auth outage signs out every host at once; the cap bounds that
+// burst well above any single cell's host count without becoming a leak.
+const MAX_ENTRIES = 50_000
+
+// Why in-memory and not Postgres: a phone reaches the cell its host's assignment
+// row already names, which is the same cell that watched the control socket
+// close. Losing this on a cell restart degrades to the pre-existing generic
+// verdict, so the failure mode is the old behaviour rather than a wrong one.
+export class HostCloseReasonMemory {
+  private readonly entries = new Map<string, { reason: RelayHostCloseReason; expiresAt: number }>()
+
+  constructor(private readonly now: () => number = Date.now) {}
+
+  // Silently ignores anything that is not a known reason, which is every close
+  // from a host that predates the field and every abrupt 1006.
+  record(key: string, reason: unknown): void {
+    const parsed = relayHostCloseReasonFrom(reason)
+    if (!parsed) {
+      return
+    }
+    this.entries.delete(key)
+    this.entries.set(key, { reason: parsed, expiresAt: this.now() + RETENTION_MS })
+    this.evict()
+  }
+
+  forget(key: string): void {
+    this.entries.delete(key)
+  }
+
+  read(key: string): RelayHostCloseReason | null {
+    const entry = this.entries.get(key)
+    if (!entry) {
+      return null
+    }
+    if (entry.expiresAt <= this.now()) {
+      this.entries.delete(key)
+      return null
+    }
+    return entry.reason
+  }
+
+  size(): number {
+    return this.entries.size
+  }
+
+  private evict(): void {
+    const now = this.now()
+    for (const [key, entry] of this.entries) {
+      if (entry.expiresAt > now) {
+        break
+      }
+      this.entries.delete(key)
+    }
+    // Insertion order is recency order (record deletes before setting), so the
+    // head is always the oldest survivor.
+    for (const key of this.entries.keys()) {
+      if (this.entries.size <= MAX_ENTRIES) {
+        break
+      }
+      this.entries.delete(key)
+    }
+  }
+}
diff --git a/cloud/apps/relay/src/host-session-registry.ts b/cloud/apps/relay/src/host-session-registry.ts
index 11b7d1de030..5c53041e7ff 100644
--- a/cloud/apps/relay/src/host-session-registry.ts
+++ b/cloud/apps/relay/src/host-session-registry.ts
@@ -14,7 +14,8 @@ import {
   HostHelloSchema,
   InviteCreateSchema,
   RELAY_PROTOCOL_LIMITS,
-  RELAY_CLOSE_CODE
+  RELAY_CLOSE_CODE,
+  type RelayHostCloseReason
 } from '@orca-cloud/relay-contract'
 import nacl from 'tweetnacl'
 import type WebSocket from 'ws'
@@ -25,6 +26,7 @@ import {
   RelayCredentialStore,
   type CredentialReservation
 } from './credential-store.js'
+import { HostCloseReasonMemory } from './host-close-reason-memory.js'
 import { relayHostLogDigest } from './relay-host-log-digest.js'
 import type { RelayTokenClaims } from './relay-token-verifier.js'
 import type { RelayRuntimeObserver } from './relay-observability.js'
@@ -130,6 +132,10 @@ const ACTIVATION_QUEUE_WAIT_MS = 30_000
 export class HostSessionRegistry {
   private readonly sessions = new Map<string, HostSession>()
   private readonly activationQueues = new Map<string, Promise<void>>()
+  // Why it outlives `sessions`: the orphan grace deletes the session within 30s,
+  // but a signed-out desktop never comes back, so the phone that asks minutes
+  // later would otherwise find nothing to explain its rejection with.
+  private readonly hostCloseReasons = new HostCloseReasonMemory(() => this.now())
   private draining = false
 
   constructor(
@@ -175,7 +181,8 @@ export class HostSessionRegistry {
       return
     }
     this.observer.recordAuth(true)
-    const session = this.sessions.get(this.key(reservation.userId, hostId))
+    const sessionKey = this.key(reservation.userId, hostId)
+    const session = this.sessions.get(sessionKey)
     if (
       !session ||
       session.state !== 'active' ||
@@ -184,7 +191,13 @@ export class HostSessionRegistry {
     ) {
       capacityReservation?.release()
       await this.store.failReservation(reservation)
-      this.rejectClient(socket, RELAY_CLOSE_CODE.HOST_OFFLINE)
+      // The only rejection that can name a cause: the host is genuinely absent.
+      // The attach-deadline 4404 below fires while control is still connected.
+      this.rejectClient(
+        socket,
+        RELAY_CLOSE_CODE.HOST_OFFLINE,
+        this.hostCloseReasons.read(sessionKey)
+      )
       return
     }
     if (session.activeConnIds.size + session.pendingConns.size >= 8) {
@@ -793,7 +806,10 @@ export class HostSessionRegistry {
       regionalDrainTimer: null,
       regionalDrainExpiresAt: null
     }
-    this.sessions.set(this.key(identity.sub, identity.relayHostId), session)
+    const sessionKey = this.key(identity.sub, identity.relayHostId)
+    // A host that proved itself again is not signed out, whatever it said last.
+    this.hostCloseReasons.forget(sessionKey)
+    this.sessions.set(sessionKey, session)
     this.wireActiveControl(session)
     this.sendHelloAck(session)
   }
@@ -813,6 +829,11 @@ export class HostSessionRegistry {
     })
     socket.once('close', (code, reason) => {
       this.observer.recordControlClose?.(code)
+      // Guarded on identity: a predecessor retired by a rebind must not stamp a
+      // cause onto the live session that replaced it.
+      if (session.socket === socket) {
+        this.hostCloseReasons.record(this.key(session.identity.sub, session.relayHostId), reason)
+      }
       // One line per control close makes reconnect churners attributable by
       // host digest without exposing the raw relay host id.
       console.warn(
@@ -1187,9 +1208,16 @@ export class HostSessionRegistry {
     if (session.socket) send(session.socket, 'control-error', { ...(reqId ? { reqId } : {}), code })
   }
 
-  private rejectClient(socket: WebSocket, code: number): void {
+  // hostCloseReason rides the WebSocket close reason, never relay-hello: every
+  // shipped phone parses relay-hello with a strict schema that rejects an
+  // unknown key, and none of them read the close reason at all.
+  private rejectClient(
+    socket: WebSocket,
+    code: number,
+    hostCloseReason?: RelayHostCloseReason | null
+  ): void {
     send(socket, 'relay-hello', { ok: false, code })
-    closeRelayWebSocket(socket, code, 'relay connection rejected')
+    closeRelayWebSocket(socket, code, hostCloseReason ?? 'relay connection rejected')
   }
 
   private releaseControlActivity(session: HostSession): void {
diff --git a/cloud/apps/relay/src/host-signed-out-rejection.test.ts b/cloud/apps/relay/src/host-signed-out-rejection.test.ts
new file mode 100644
index 00000000000..0f8542c960f
--- /dev/null
+++ b/cloud/apps/relay/src/host-signed-out-rejection.test.ts
@@ -0,0 +1,206 @@
+import { EventEmitter } from 'node:events'
+import {
+  CONTROL_CONTINUITY_LIMITS,
+  RELAY_CLOSE_CODE,
+  RELAY_HOST_CLOSE_REASON
+} from '@orca-cloud/relay-contract'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type WebSocket from 'ws'
+import type { RelayAssignmentStore } from './assignment-store.js'
+import type { RelayConfig } from './config.js'
+import type { RelayCredentialStore } from './credential-store.js'
+import { HostSessionRegistry } from './host-session-registry.js'
+import type { RelayRuntimeObserver } from './relay-observability.js'
+import type { RelayTokenClaims } from './relay-token-verifier.js'
+import { ProcessQueuedByteBudget } from './splice-forwarder.js'
+
+class FakeSocket extends EventEmitter {
+  readonly OPEN = 1
+  readonly CLOSED = 3
+  readyState = this.OPEN
+  readonly send = vi.fn()
+  readonly close = vi.fn((code?: number, reason?: string) => {
+    this.readyState = this.CLOSED
+    this.emit('close', code, Buffer.from(reason ?? ''))
+  })
+  readonly terminate = vi.fn(() => {
+    this.readyState = this.CLOSED
+    this.emit('close', 1006, Buffer.alloc(0))
+  })
+}
+
+const config = {
+  port: 8080,
+  publicUrl: 'https://relay-c3.example.com',
+  cellUrl: 'https://relay-c3.example.com',
+  authIssuer: 'https://auth.example.com',
+  authAudience: 'orca-relay',
+  jwksUrl: 'https://auth.example.com/jwks',
+  assignmentSigningKey: new Uint8Array(32),
+  role: 'cell',
+  cellId: 'production-gce-c3',
+  cells: []
+} as unknown as RelayConfig
+
+const identity = {
+  sub: 'user-1',
+  prof: 'profile-1',
+  org: 'org-1',
+  relayHostId: 'AbCdEf0123_-xyZ9'
+} as unknown as RelayTokenClaims
+
+const reservation = {
+  userId: identity.sub,
+  relayHostId: identity.relayHostId,
+  credentialKind: 'resume',
+  relayDeviceId: 'device-1',
+  leaseExpiresAt: Date.now() + 60_000
+}
+
+function createRegistry() {
+  const store = {
+    resolveResume: vi.fn().mockResolvedValue({ userId: identity.sub }),
+    reserveCredential: vi.fn().mockResolvedValue(reservation),
+    failReservation: vi.fn().mockResolvedValue(undefined)
+  }
+  const assignments = {
+    activateControl: vi.fn().mockResolvedValue('control:production-gce-c3:1'),
+    markMigrationTargetRegistered: vi.fn().mockResolvedValue(undefined),
+    resolve: vi.fn().mockResolvedValue({ cellId: config.cellId }),
+    acquireActivity: vi.fn().mockResolvedValue(undefined),
+    renewControlActivity: vi.fn().mockResolvedValue(undefined),
+    releaseActivity: vi.fn().mockResolvedValue(true)
+  } as unknown as RelayAssignmentStore
+  const observer = {
+    recordAuth: vi.fn(),
+    recordForwardedBytes: vi.fn(),
+    recordHttp: vi.fn(),
+    recordReconnect: vi.fn(),
+    recordSql: vi.fn(),
+    recordControlClose: vi.fn(),
+    recordSpliceClose: vi.fn()
+  } satisfies RelayRuntimeObserver
+  const registry = new HostSessionRegistry(
+    config,
+    vi.fn(),
+    store as unknown as RelayCredentialStore,
+    assignments,
+    new ProcessQueuedByteBudget(),
+    observer
+  )
+  const activate = (socket: WebSocket, generation: number): Promise<void> =>
+    (
+      registry as unknown as {
+        activate: (
+          socket: WebSocket,
+          identity: RelayTokenClaims,
+          existing: null,
+          generation: number,
+          rebind: boolean,
+          assignmentEpoch: number,
+          appVersion: string
+        ) => Promise<void>
+      }
+    ).activate(socket, identity, null, generation, false, 1, '1.4.173')
+  return { registry, activate }
+}
+
+async function dialPhone(registry: HostSessionRegistry): Promise<FakeSocket> {
+  const phone = new FakeSocket()
+  await registry.acceptClient(phone as unknown as WebSocket, identity.relayHostId, 'credential')
+  return phone
+}
+
+// The 4404 hello body is unchanged: every shipped phone parses it with a strict
+// schema, so the cause has to ride the close frame instead.
+const HOST_OFFLINE_HELLO = JSON.stringify({
+  type: 'relay-hello',
+  ok: false,
+  code: RELAY_CLOSE_CODE.HOST_OFFLINE
+})
+
+describe('host sign-out reason on phone rejection', () => {
+  beforeEach(() => vi.useFakeTimers())
+  afterEach(() => {
+    vi.clearAllTimers()
+    vi.useRealTimers()
+  })
+
+  it('names the sign-out to a phone that arrives after the host is gone', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+
+    control.close(1000, RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.send).toHaveBeenCalledWith(HOST_OFFLINE_HELLO)
+    expect(phone.close).toHaveBeenCalledWith(
+      RELAY_CLOSE_CODE.HOST_OFFLINE,
+      RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    )
+  })
+
+  it('says nothing when the host died without naming a cause', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+
+    control.terminate()
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.close).toHaveBeenCalledWith(
+      RELAY_CLOSE_CODE.HOST_OFFLINE,
+      'relay connection rejected'
+    )
+  })
+
+  it('ignores a close reason the host invented', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+
+    control.close(1000, 'signed-out-ish')
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.close).toHaveBeenCalledWith(
+      RELAY_CLOSE_CODE.HOST_OFFLINE,
+      'relay connection rejected'
+    )
+  })
+
+  it('forgets the sign-out once the host proves itself again', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+    control.close(1000, RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const reconnected = new FakeSocket()
+    await activate(reconnected as unknown as WebSocket, 2)
+    // Drop it abruptly, as a network death would, so only the stale memory
+    // could still name a cause.
+    reconnected.terminate()
+    vi.advanceTimersByTime(CONTROL_CONTINUITY_LIMITS.orphanGraceMs + 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.close).toHaveBeenCalledWith(
+      RELAY_CLOSE_CODE.HOST_OFFLINE,
+      'relay connection rejected'
+    )
+  })
+
+  // A live host is present: the 4404 there is an attach deadline, not absence.
+  it('never names a cause while the host control is connected', async () => {
+    const { registry, activate } = createRegistry()
+    const control = new FakeSocket()
+    await activate(control as unknown as WebSocket, 1)
+
+    const phone = await dialPhone(registry)
+    expect(phone.close).not.toHaveBeenCalled()
+    expect(control.send).toHaveBeenCalledWith(expect.stringContaining('"type":"conn-open"'))
+  })
+})
diff --git a/cloud/packages/relay-contract/src/host-close-reason.ts b/cloud/packages/relay-contract/src/host-close-reason.ts
new file mode 100644
index 00000000000..3a5abde3f00
--- /dev/null
+++ b/cloud/packages/relay-contract/src/host-close-reason.ts
@@ -0,0 +1,18 @@
+// Mirror of src/shared/relay-host-close-reason.ts in the Orca app repo half.
+// A host control socket may close with one of these as its WebSocket close
+// reason; the cell records it so a later phone rejection can name the cause.
+// Anything else (including the empty reason of an abrupt 1006) means "unknown",
+// which is what every peer that predates this file sends.
+export const RELAY_HOST_CLOSE_REASON = {
+  SIGNED_OUT: 'signed-out'
+} as const
+
+export type RelayHostCloseReason =
+  (typeof RELAY_HOST_CLOSE_REASON)[keyof typeof RELAY_HOST_CLOSE_REASON]
+
+const REASONS: readonly string[] = Object.values(RELAY_HOST_CLOSE_REASON)
+
+export function relayHostCloseReasonFrom(value: unknown): RelayHostCloseReason | null {
+  const text = typeof value === 'string' ? value : (value?.toString() ?? '')
+  return REASONS.includes(text) ? (text as RelayHostCloseReason) : null
+}
diff --git a/cloud/packages/relay-contract/src/index.ts b/cloud/packages/relay-contract/src/index.ts
index 2a7d7d0feda..aab3b53b5f3 100644
--- a/cloud/packages/relay-contract/src/index.ts
+++ b/cloud/packages/relay-contract/src/index.ts
@@ -5,6 +5,7 @@ export * from './control-messages.js'
 export * from './control-continuity.js'
 export * from './credential-messages.js'
 export * from './director-messages.js'
+export * from './host-close-reason.js'
 export * from './host-proof-transcript.js'
 export * from './persistence-invariants.js'
 export * from './protocol-limits.js'
diff --git a/mobile/src/home/MobileHomeHostList.tsx b/mobile/src/home/MobileHomeHostList.tsx
index 3907df16f03..41d1f07156d 100644
--- a/mobile/src/home/MobileHomeHostList.tsx
+++ b/mobile/src/home/MobileHomeHostList.tsx
@@ -19,6 +19,7 @@ type MobileHomeHostListProps = {
   hostAttempts: Record<string, number>
   hostLastConnected: Record<string, number | null>
   hostPairingRejected: Record<string, boolean>
+  hostSignedOut: Record<string, boolean>
   hostPaths: Record<string, MobileConnectionPath>
   hostPendingPaths: Record<string, MobileConnectionPath | null>
   hosts: HostCatalogEntry[]
@@ -40,6 +41,7 @@ export function MobileHomeHostList(props: MobileHomeHostListProps) {
         hostAttempts={props.hostAttempts}
         hostLastConnected={props.hostLastConnected}
         hostPairingRejected={props.hostPairingRejected}
+        hostSignedOut={props.hostSignedOut}
         hostPaths={props.hostPaths}
         hostPendingPaths={props.hostPendingPaths}
         hostStates={props.hostStates}
@@ -54,6 +56,7 @@ export function MobileHomeHostList(props: MobileHomeHostListProps) {
       props.hostAttempts,
       props.hostLastConnected,
       props.hostPairingRejected,
+      props.hostSignedOut,
       props.hostPaths,
       props.hostPendingPaths,
       props.hostStates,
@@ -91,6 +94,7 @@ type MobileHomeHostRowProps = Pick<
   | 'hostAttempts'
   | 'hostLastConnected'
   | 'hostPairingRejected'
+  | 'hostSignedOut'
   | 'hostPaths'
   | 'hostPendingPaths'
   | 'hostStates'
@@ -113,7 +117,8 @@ const MobileHomeHostRow = memo(function MobileHomeHostRow(props: MobileHomeHostR
     lastConnectedAt: props.hostLastConnected[item.id] ?? null,
     endpoint: item.endpoint,
     pendingPath: props.hostPendingPaths[item.id] ?? null,
-    pairingRejected: props.hostPairingRejected[item.id] ?? false
+    pairingRejected: props.hostPairingRejected[item.id] ?? false,
+    hostSignedOut: props.hostSignedOut[item.id] ?? false
   })
   const open = useCallback(() => onOpen(item), [item, onOpen])
   const longPress = useCallback(() => onLongPress(item), [item, onLongPress])
diff --git a/mobile/src/home/MobileHomeScreen.tsx b/mobile/src/home/MobileHomeScreen.tsx
index 83cf3de4b8a..7772f5152c6 100644
--- a/mobile/src/home/MobileHomeScreen.tsx
+++ b/mobile/src/home/MobileHomeScreen.tsx
@@ -143,6 +143,7 @@ export function MobileHomeScreen() {
           hostAttempts={data.hostAttempts}
           hostLastConnected={data.hostLastConnected}
           hostPairingRejected={data.hostPairingRejected}
+          hostSignedOut={data.hostSignedOut}
           hostPaths={data.hostPaths}
           hostPendingPaths={data.hostPendingPaths}
           hosts={data.sortedHostCatalog}
diff --git a/mobile/src/home/home-host-connection-projection.ts b/mobile/src/home/home-host-connection-projection.ts
index f8fdfd4bcdf..9a49f6186c4 100644
--- a/mobile/src/home/home-host-connection-projection.ts
+++ b/mobile/src/home/home-host-connection-projection.ts
@@ -5,12 +5,14 @@ export type HomeHostConnectionProjectionEntry = {
   path: MobileConnectionPath
   pendingPath: MobileConnectionPath | null
   pairingRejected: boolean
+  hostSignedOut: boolean
 }
 
 export type HomeHostConnectionProjection = {
   hostPaths: Record<string, MobileConnectionPath>
   hostPendingPaths: Record<string, MobileConnectionPath | null>
   hostPairingRejected: Record<string, boolean>
+  hostSignedOut: Record<string, boolean>
 }
 
 /** Build all host lookup maps while reading each connection entry once. */
@@ -22,16 +24,19 @@ export function projectHomeHostConnections(
   const hostPaths = Object.create(null) as Record<string, MobileConnectionPath>
   const hostPendingPaths = Object.create(null) as Record<string, MobileConnectionPath | null>
   const hostPairingRejected = Object.create(null) as Record<string, boolean>
+  const hostSignedOut = Object.create(null) as Record<string, boolean>
 
-  for (const { hostId, path, pendingPath, pairingRejected } of entries) {
+  for (const { hostId, path, pendingPath, pairingRejected, hostSignedOut: signedOut } of entries) {
     hostPaths[hostId] = path
     hostPendingPaths[hostId] = pendingPath
     hostPairingRejected[hostId] = pairingRejected
+    hostSignedOut[hostId] = signedOut
   }
 
   Object.setPrototypeOf(hostPaths, Object.prototype)
   Object.setPrototypeOf(hostPendingPaths, Object.prototype)
   Object.setPrototypeOf(hostPairingRejected, Object.prototype)
+  Object.setPrototypeOf(hostSignedOut, Object.prototype)
 
-  return { hostPaths, hostPendingPaths, hostPairingRejected }
+  return { hostPaths, hostPendingPaths, hostPairingRejected, hostSignedOut }
 }
diff --git a/mobile/src/home/use-mobile-home-data.ts b/mobile/src/home/use-mobile-home-data.ts
index c77d024158e..6b28354a86d 100644
--- a/mobile/src/home/use-mobile-home-data.ts
+++ b/mobile/src/home/use-mobile-home-data.ts
@@ -179,6 +179,7 @@ export function useMobileHomeData() {
     connectedHosts,
     hostCatalog,
     hostPairingRejected: hostConnectionProjection.hostPairingRejected,
+    hostSignedOut: hostConnectionProjection.hostSignedOut,
     hostPaths: hostConnectionProjection.hostPaths,
     hostPendingPaths: hostConnectionProjection.hostPendingPaths,
     primaryHost,
diff --git a/mobile/src/transport/client-context-connection-metrics.ts b/mobile/src/transport/client-context-connection-metrics.ts
index 1e2ff6f7919..1fe72687bd2 100644
--- a/mobile/src/transport/client-context-connection-metrics.ts
+++ b/mobile/src/transport/client-context-connection-metrics.ts
@@ -30,14 +30,16 @@ export function useConnectionPathStatus(hostId: string | undefined): {
 export function useRelayRecoveryStatus(hostId: string | undefined): {
   pendingPath: MobileConnectionPath | null
   pairingRejected: boolean
+  hostSignedOut: boolean
 } {
   return useHostMetric(
     hostId,
     (context, id) => ({
       pendingPath: context.getPendingPath(id),
-      pairingRejected: context.isPairingRejected(id)
+      pairingRejected: context.isPairingRejected(id),
+      hostSignedOut: context.isHostSignedOut(id)
     }),
-    { pendingPath: null, pairingRejected: false }
+    { pendingPath: null, pairingRejected: false, hostSignedOut: false }
   )
 }
 
diff --git a/mobile/src/transport/client-context.test.ts b/mobile/src/transport/client-context.test.ts
index 4a7d5d7b0e8..56b227bdff7 100644
--- a/mobile/src/transport/client-context.test.ts
+++ b/mobile/src/transport/client-context.test.ts
@@ -533,12 +533,12 @@ describe('useAllHostClients', () => {
       await Promise.resolve()
     })
     act(() => client.emitPendingPath('relay'))
-    expect(status).toEqual({ pendingPath: 'relay', pairingRejected: false })
+    expect(status).toEqual({ pendingPath: 'relay', pairingRejected: false, hostSignedOut: false })
 
     // Why: the desktop refusing the credential is a status-only change — no
     // transport state moves, so only the connection-path signal can carry it.
     act(() => client.emitPairingRejected(true))
-    expect(status).toEqual({ pendingPath: 'relay', pairingRejected: true })
+    expect(status).toEqual({ pendingPath: 'relay', pairingRejected: true, hostSignedOut: false })
 
     act(() => renderer.unmount())
   })
diff --git a/mobile/src/transport/connection-health.ts b/mobile/src/transport/connection-health.ts
index 858b13a8b24..1a9e282047f 100644
--- a/mobile/src/transport/connection-health.ts
+++ b/mobile/src/transport/connection-health.ts
@@ -29,6 +29,10 @@ const STALE_SINCE_LAST_CONNECT_MS = 60_000
 // instead of leaving the user staring at a generic "Can't connect".
 const TAILSCALE_HINT = 'check Tailscale'
 
+// No hint field: the remedy is the label, and appending "— check Tailscale" to
+// it would be wrong advice for a desktop that is reachable but signed out.
+const SIGNED_OUT_LABEL = 'Desktop signed out — sign in to Orca on your desktop to reconnect'
+
 export type ConnectionVerdict =
   | { kind: 'normal'; label: string }
   | { kind: 'warning'; label: string; hint?: string } // "Can't connect"
@@ -54,6 +58,10 @@ export function classifyConnection(args: {
   // The desktop has repeatedly refused this device's relay credential — retrying
   // cannot fix it, so it outranks any "still connecting" reading (STA-4681).
   pairingRejected?: boolean
+  // The relay says the desktop's last control close named its own Orca Cloud
+  // sign-out. Retrying is still correct and still happens on the same cadence,
+  // but only the desktop's owner can end it, so the label has to say so.
+  hostSignedOut?: boolean
   nowMs?: number
 }): ConnectionVerdict {
   const { state, reconnectAttempts, lastConnectedAt } = args
@@ -70,6 +78,17 @@ export function classifyConnection(args: {
     return { kind: 'normal', label: 'Connected' }
   }
 
+  // Ahead of the attempt thresholds: this is evidence, not an inference from a
+  // failure streak, and waiting twelve dials to show it wastes the whole point.
+  // Below auth-failed because a revoked pairing cannot be fixed by signing in.
+  if (args.hostSignedOut) {
+    return {
+      kind: 'unreachable',
+      label: SIGNED_OUT_LABEL,
+      reason: lastConnectedAt == null ? 'never-connected' : 'stale'
+    }
+  }
+
   // A disconnected pending path can survive a cleared retry timer during a
   // lifecycle race. Only narrate Relay while dialing or after a retry has
   // recorded progress; otherwise the idle transport must read Disconnected.
diff --git a/mobile/src/transport/host-client-context-state.ts b/mobile/src/transport/host-client-context-state.ts
index 859e5d847f9..db4c7908b41 100644
--- a/mobile/src/transport/host-client-context-state.ts
+++ b/mobile/src/transport/host-client-context-state.ts
@@ -89,10 +89,16 @@ export function createHostClientSelectors(
     getPendingPath: (hostId: string): MobileConnectionPath | null =>
       clientPendingPath(entries.get(hostId)?.client),
     isPairingRejected: (hostId: string): boolean =>
-      clientPairingRejected(entries.get(hostId)?.client)
+      clientPairingRejected(entries.get(hostId)?.client),
+    isHostSignedOut: (hostId: string): boolean => clientHostSignedOut(entries.get(hostId)?.client)
   }
 }
 
+export function clientHostSignedOut(client: RpcClient | undefined): boolean {
+  const logical = client as Partial<StableLogicalRpcClient> | undefined
+  return logical?.isHostSignedOut?.() ?? false
+}
+
 export function clientPairingRejected(client: RpcClient | undefined): boolean {
   const logical = client as Partial<StableLogicalRpcClient> | undefined
   return logical?.isPairingRejected?.() ?? false
diff --git a/mobile/src/transport/logical-client-connection-path.ts b/mobile/src/transport/logical-client-connection-path.ts
index 55c6d1d28f3..b7f02b40b88 100644
--- a/mobile/src/transport/logical-client-connection-path.ts
+++ b/mobile/src/transport/logical-client-connection-path.ts
@@ -5,6 +5,7 @@ export class LogicalClientConnectionPath {
   private recovery: MobileConnectionPath | null = null
   private recoveryAttempt = 0
   private pairingRejected = false
+  private hostSignedOut = false
   private readonly listeners = new Set<() => void>()
 
   constructor(private readonly isConnected: () => boolean) {}
@@ -35,12 +36,23 @@ export class LogicalClientConnectionPath {
     })
   }
 
+  isHostSignedOut(): boolean {
+    return this.hostSignedOut
+  }
+
+  setHostSignedOut(signedOut: boolean): void {
+    this.update(() => {
+      this.hostSignedOut = signedOut
+    })
+  }
+
   clearAfterConnected(): void {
     this.migration = null
     this.recovery = null
     this.recoveryAttempt = 0
     // Why: an authenticated session is the desktop accepting this device.
     this.pairingRejected = false
+    this.hostSignedOut = false
   }
 
   setRecovery(path: MobileConnectionPath | null, attempt?: number): void {
@@ -69,11 +81,13 @@ export class LogicalClientConnectionPath {
     const previousPath = this.pending()
     const previousAttempt = this.reconnectAttempt(0)
     const previousRejected = this.pairingRejected
+    const previousSignedOut = this.hostSignedOut
     apply()
     if (
       previousPath === this.pending() &&
       previousAttempt === this.reconnectAttempt(0) &&
-      previousRejected === this.pairingRejected
+      previousRejected === this.pairingRejected &&
+      previousSignedOut === this.hostSignedOut
     ) {
       return
     }
diff --git a/mobile/src/transport/mobile-endpoint-lifecycle.ts b/mobile/src/transport/mobile-endpoint-lifecycle.ts
index 8ee8df6948e..7ec5f28b945 100644
--- a/mobile/src/transport/mobile-endpoint-lifecycle.ts
+++ b/mobile/src/transport/mobile-endpoint-lifecycle.ts
@@ -86,7 +86,7 @@ function createSupervisor(
 ): MobileEndpointSupervisor {
   return new MobileEndpointSupervisor(logical, host, {
     openDirect: (endpoint) => connect(endpoint, host.deviceToken, host.publicKeyB64, { onLog }),
-    openRelay: (relay, credential, confirmReqId) =>
+    openRelay: (relay, credential, confirmReqId, onHostCloseReason) =>
       connectMobileRelayRpcSession({
         relay,
         resumeToken: credential.token,
@@ -94,6 +94,7 @@ function createSupervisor(
         resumeConfirmReqId: confirmReqId,
         deviceToken: host.deviceToken,
         desktopPublicKeyB64: host.publicKeyB64,
+        onHostCloseReason,
         onLog
       }),
     resolveRelay: resolveMobileRelayEndpoint,
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
index 0098de6e079..2a784fd8895 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
@@ -1,4 +1,5 @@
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
+import type { RelayHostCloseReason } from '../../../src/shared/relay-host-close-reason'
 import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bundle'
 import type { MobileRelayRpcSession } from './mobile-relay-rpc-session'
 import type { resolveMobileRelayEndpoint } from './mobile-relay-resume-director'
@@ -10,7 +11,8 @@ export type MobileEndpointSupervisorDependencies = {
   openRelay: (
     relay: MobileRelayEndpoint,
     credential: { token: string; version: number },
-    confirmReqId: string
+    confirmReqId: string,
+    onHostCloseReason?: (reason: RelayHostCloseReason) => void
   ) => MobileRelayRpcSession
   resolveRelay: typeof resolveMobileRelayEndpoint
   readBundle: (hostId: string) => Promise<MobileRelayCredentialBundle | null>
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
index 1dc1473d9db..80f4438c160 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
@@ -134,10 +134,22 @@ export class FakeLogicalClient extends FakeSession implements StableLogicalRpcCl
     }
   })
   isPairingRejected = () => this.pairingRejected
+  private hostSignedOut = false
+  setHostSignedOut = vi.fn((signedOut: boolean) => {
+    if (this.hostSignedOut === signedOut) {
+      return
+    }
+    this.hostSignedOut = signedOut
+    for (const listener of this.pathListeners) {
+      listener()
+    }
+  })
+  isHostSignedOut = () => this.hostSignedOut
   // Mirrors LogicalClientConnectionPath.clearAfterConnected.
   publishState(state: ConnectionState): void {
     if (state === 'connected') {
       this.pairingRejected = false
+      this.hostSignedOut = false
     }
     super.publishState(state)
   }
diff --git a/mobile/src/transport/mobile-endpoint-supervisor.test.ts b/mobile/src/transport/mobile-endpoint-supervisor.test.ts
index aeb9cddef63..10ef892a479 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor.test.ts
@@ -185,7 +185,12 @@ describe('mobile endpoint supervisor', () => {
     await supervisor.start()
 
     expect(deps.resolveRelay).toHaveBeenCalledOnce()
-    expect(openRelay).toHaveBeenLastCalledWith(resolved, expect.any(Object), expect.any(String))
+    expect(openRelay).toHaveBeenLastCalledWith(
+      resolved,
+      expect.any(Object),
+      expect.any(String),
+      expect.any(Function)
+    )
     expect(deps.saveHost).toHaveBeenCalledWith(
       expect.objectContaining({ relay: resolved, endpoint: host.endpoint })
     )
@@ -556,7 +561,8 @@ describe('mobile endpoint supervisor', () => {
     expect(openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 3 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     supervisor.stop()
   })
@@ -603,7 +609,8 @@ describe('mobile endpoint supervisor', () => {
     expect(openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 3 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     supervisor.stop()
   })
diff --git a/mobile/src/transport/mobile-relay-e2ee-link.ts b/mobile/src/transport/mobile-relay-e2ee-link.ts
index 7743deb23dd..9b1f7a9a355 100644
--- a/mobile/src/transport/mobile-relay-e2ee-link.ts
+++ b/mobile/src/transport/mobile-relay-e2ee-link.ts
@@ -2,6 +2,10 @@ import {
   RelayPhoneHelloSchema,
   type RelayPhoneHello
 } from '../../../src/shared/mobile-relay-phone-protocol'
+import {
+  relayHostCloseReasonFrom,
+  type RelayHostCloseReason
+} from '../../../src/shared/relay-host-close-reason'
 import { MobileE2EEV2ClientSession } from './mobile-e2ee-v2-client-session'
 import { MobileE2EEV2PhysicalChannel } from './mobile-e2ee-v2-physical-channel'
 import { websocketPayloadToUint8 } from './websocket-payload-bytes'
@@ -26,6 +30,12 @@ type MobileRelayE2eeLinkOptions = {
   onText: (plaintext: string) => void
   onBinary: (plaintext: Uint8Array) => void
   onHello?: (hello: Extract<RelayPhoneHello, { ok: true }>) => void
+  // The cell's account of why the desktop is absent, read off the close frame.
+  // Reported separately from onError because a rejection is delivered as both a
+  // relay-hello and a close, and which one the runtime dispatches first is not
+  // ordered — only the close carries the reason, and it must not be lost to
+  // that race.
+  onHostCloseReason?: (reason: RelayHostCloseReason) => void
   // Fired once relay-auth is on the wire: from here the cell owns the wait.
   onOpen?: () => void
   onError: (error: Error) => void
@@ -129,6 +139,11 @@ export class MobileRelayE2eeLink {
         clearTimeout(this.transportErrorTimer)
         this.transportErrorTimer = null
       }
+      // Ahead of fail(), which no-ops once the hello already reported this close.
+      const hostCloseReason = relayHostCloseReasonFrom(event.reason)
+      if (hostCloseReason) {
+        this.options.onHostCloseReason?.(hostCloseReason)
+      }
       this.fail(new RelayOuterError(event.code || 1006))
     }
   }
diff --git a/mobile/src/transport/mobile-relay-rpc-session.ts b/mobile/src/transport/mobile-relay-rpc-session.ts
index 947a1d23ce8..203a0329192 100644
--- a/mobile/src/transport/mobile-relay-rpc-session.ts
+++ b/mobile/src/transport/mobile-relay-rpc-session.ts
@@ -13,6 +13,7 @@ import { RelayDialStageTracker, type RelayDialStageSource } from './relay-dial-s
 import { RelayPendingRequests } from './relay-pending-requests'
 import { RpcSessionLivenessWatchdog } from './rpc-session-liveness-watchdog'
 import { settleMobileRuntimeCapabilities } from './mobile-runtime-capability-negotiation'
+import type { RelayHostCloseReason } from '../../../src/shared/relay-host-close-reason'
 import type { RpcClient } from './rpc-client'
 import type { ConnectionLogSink, ConnectionState, RpcResponse } from './types'
 
@@ -40,6 +41,7 @@ export function connectMobileRelayRpcSession(args: {
   desktopPublicKeyB64: string
   requestTimeoutMs?: number
   createSocket?: (url: string) => WebSocket
+  onHostCloseReason?: (reason: RelayHostCloseReason) => void
   onLog?: ConnectionLogSink
 }): MobileRelayRpcSession {
   const requestTimeoutMs = args.requestTimeoutMs ?? 30_000
@@ -69,6 +71,7 @@ export function connectMobileRelayRpcSession(args: {
     deviceToken: args.deviceToken,
     desktopPublicKeyB64: args.desktopPublicKeyB64,
     createSocket: args.createSocket,
+    onHostCloseReason: args.onHostCloseReason,
     onOpen: () => dialStage.advance('awaiting-hello'),
     onHello: (hello) => {
       if (
diff --git a/mobile/src/transport/mobile-relay-runtime-failover.test.ts b/mobile/src/transport/mobile-relay-runtime-failover.test.ts
index 01f4d45feb0..ce7cca3fd9f 100644
--- a/mobile/src/transport/mobile-relay-runtime-failover.test.ts
+++ b/mobile/src/transport/mobile-relay-runtime-failover.test.ts
@@ -145,10 +145,22 @@ class FakeLogicalClient extends FakeSession implements StableLogicalRpcClient {
     }
   })
   isPairingRejected = () => this.pairingRejected
+  private hostSignedOut = false
+  setHostSignedOut = vi.fn((signedOut: boolean) => {
+    if (this.hostSignedOut === signedOut) {
+      return
+    }
+    this.hostSignedOut = signedOut
+    for (const listener of this.pathListeners) {
+      listener()
+    }
+  })
+  isHostSignedOut = () => this.hostSignedOut
   // Mirrors LogicalClientConnectionPath.clearAfterConnected.
   publishState(state: ConnectionState): void {
     if (state === 'connected') {
       this.pairingRejected = false
+      this.hostSignedOut = false
     }
     super.publishState(state)
   }
@@ -264,7 +276,8 @@ describe('relay runtime recovery without direct connectivity', () => {
     expect(openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 3 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     expect(logical.getActivePath()).toBe('relay')
     supervisor.stop()
@@ -353,7 +366,8 @@ describe('relay runtime recovery without direct connectivity', () => {
     expect(deps.openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 2 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     expect(logical.getActivePath()).toBe('relay')
     supervisor.stop()
@@ -382,7 +396,8 @@ describe('relay runtime recovery without direct connectivity', () => {
     expect(openRelay).toHaveBeenLastCalledWith(
       relay,
       expect.objectContaining({ version: 1 }),
-      expect.any(String)
+      expect.any(String),
+      expect.any(Function)
     )
     expect(logical.getActivePath()).toBe('relay')
     supervisor.stop()
diff --git a/mobile/src/transport/mobile-relay-session-establisher.ts b/mobile/src/transport/mobile-relay-session-establisher.ts
index 7a8ce372155..9a04ae44137 100644
--- a/mobile/src/transport/mobile-relay-session-establisher.ts
+++ b/mobile/src/transport/mobile-relay-session-establisher.ts
@@ -10,6 +10,7 @@ import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bund
 import type { RelayReconnectController } from './mobile-relay-reconnect-controller'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
+import { RELAY_HOST_CLOSE_REASON } from '../../../src/shared/relay-host-close-reason'
 import type { HostProfile } from './types'
 
 type EstablishResult = { ok: true } | { ok: false; error: Error }
@@ -100,7 +101,16 @@ export class MobileRelaySessionEstablisher {
     const session = args.openRelay(
       relay,
       credential,
-      `confirm-${encodeBase64Url(args.randomBytes(16))}`
+      `confirm-${encodeBase64Url(args.randomBytes(16))}`,
+      // Latched on the logical client, not on the dial result: the close that
+      // carries the reason can land after this dial has already reported its
+      // failure. Clearing is clearAfterConnected's job, so any path that
+      // reaches connected retires it.
+      (reason) => {
+        if (reason === RELAY_HOST_CLOSE_REASON.SIGNED_OUT) {
+          args.logical.setHostSignedOut(true)
+        }
+      }
     )
     try {
       // Why: backgrounding or a direct winner withdraws this dial before cutover.
diff --git a/mobile/src/transport/relay-host-signed-out-supervisor.test.ts b/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
new file mode 100644
index 00000000000..cc7a9ac6c35
--- /dev/null
+++ b/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
@@ -0,0 +1,60 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { MOBILE_RELAY_CLOSE_CODE } from '../../../src/shared/mobile-relay-close-codes'
+import { RELAY_HOST_CLOSE_REASON } from '../../../src/shared/relay-host-close-reason'
+import { RelayOuterError } from './mobile-relay-e2ee-link'
+import {
+  dependencies,
+  FakeLogicalClient,
+  FakeRelaySession,
+  host
+} from './mobile-endpoint-supervisor-test-fakes'
+import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
+
+vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
+vi.mock('expo-secure-store', () => ({ WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'when-unlocked' }))
+vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) }))
+
+// The reason travels from the cell's close frame to the screens. This covers
+// the production wiring between them: the supervisor's own openRelay callback.
+describe('a signed-out desktop reaches the phone verdict', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-07-13T12:00:00Z'))
+  })
+  afterEach(() => vi.useRealTimers())
+
+  function supervisorOver(closeReason: string | null) {
+    const logical = new FakeLogicalClient('disconnected', 'lan')
+    const deps = dependencies({
+      openDirect: vi.fn(() => new FakeRelaySession('disconnected')),
+      openRelay: vi.fn((_relay, _credential, _confirmReqId, onHostCloseReason) => {
+        if (closeReason) {
+          onHostCloseReason?.(closeReason as never)
+        }
+        return new FakeRelaySession(
+          'disconnected',
+          new RelayOuterError(MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE)
+        )
+      })
+    })
+    return { logical, supervisor: new MobileEndpointSupervisor(logical, host, deps) }
+  }
+
+  it('latches the sign-out the cell reported', async () => {
+    const { logical, supervisor } = supervisorOver(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    await supervisor.start()
+    await vi.waitFor(() => expect(logical.isHostSignedOut()).toBe(true))
+
+    supervisor.stop()
+  })
+
+  it('stays quiet for an ordinary host-offline rejection', async () => {
+    const { logical, supervisor } = supervisorOver(null)
+
+    await supervisor.start()
+
+    expect(logical.isHostSignedOut()).toBe(false)
+    supervisor.stop()
+  })
+})
diff --git a/mobile/src/transport/relay-host-signed-out-verdict.test.ts b/mobile/src/transport/relay-host-signed-out-verdict.test.ts
new file mode 100644
index 00000000000..2607b922b58
--- /dev/null
+++ b/mobile/src/transport/relay-host-signed-out-verdict.test.ts
@@ -0,0 +1,216 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('./mobile-e2ee-v2-client-session', () => ({
+  MobileE2EEV2ClientSession: { create: () => ({}) }
+}))
+
+vi.mock('./mobile-e2ee-v2-physical-channel', () => ({
+  MobileE2EEAuthenticationError: class extends Error {},
+  MobileE2EEV2PhysicalChannel: class {
+    start = vi.fn()
+    handleMessage = vi.fn(async () => {})
+    sendText = vi.fn(() => true)
+    sendBinary = vi.fn(() => true)
+    dispose = vi.fn()
+  }
+}))
+
+import { RELAY_HOST_CLOSE_REASON } from '../../../src/shared/relay-host-close-reason'
+import { MOBILE_RELAY_CLOSE_CODE } from '../../../src/shared/mobile-relay-close-codes'
+import { classifyConnection, verdictDisplayLabel } from './connection-health'
+import { MobileRelayE2eeLink, RelayOuterError } from './mobile-relay-e2ee-link'
+import { LogicalClientConnectionPath } from './logical-client-connection-path'
+import { RelayReconnectController } from './mobile-relay-reconnect-controller'
+
+const SIGNED_OUT_LABEL = 'Desktop signed out — sign in to Orca on your desktop to reconnect'
+
+class FakeSocket {
+  static readonly OPEN = 1
+  readonly OPEN = FakeSocket.OPEN
+  readyState = FakeSocket.OPEN
+  bufferedAmount = 0
+  onopen: (() => void) | null = null
+  onmessage: ((event: { data: unknown }) => void) | null = null
+  onerror: (() => void) | null = null
+  onclose: ((event: { code: number; reason: string }) => void) | null = null
+  send = vi.fn()
+  close = vi.fn()
+}
+
+function linkOver(
+  socket: FakeSocket,
+  onHostCloseReason: (reason: string) => void,
+  onError: (error: Error) => void
+): MobileRelayE2eeLink {
+  return new MobileRelayE2eeLink({
+    endpoint: { cellUrl: 'https://relay-c1.onorca.dev', relayHostId: 'AbCdEf0123_-xyZ9' },
+    credential: 'credential',
+    expectedCredentialKind: 'resume',
+    deviceToken: 'device-token',
+    desktopPublicKeyB64: 'desktop-key',
+    onAuthenticated: vi.fn(),
+    onText: vi.fn(),
+    onBinary: vi.fn(),
+    onHostCloseReason,
+    onError,
+    createSocket: () => socket as unknown as WebSocket
+  })
+}
+
+describe('relay close reason on the phone', () => {
+  it('reports the cell close reason and still fails with 4404', () => {
+    const socket = new FakeSocket()
+    const onHostCloseReason = vi.fn()
+    const onError = vi.fn()
+    linkOver(socket, onHostCloseReason, onError)
+
+    socket.onclose?.({
+      code: MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE,
+      reason: RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    })
+
+    expect(onHostCloseReason).toHaveBeenCalledWith(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+    expect(onError).toHaveBeenCalledWith(new RelayOuterError(MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE))
+  })
+
+  // An old cell sends its constant, and every other close sends nothing.
+  it('reports nothing for a reason it does not know', () => {
+    const socket = new FakeSocket()
+    const onHostCloseReason = vi.fn()
+    linkOver(socket, onHostCloseReason, vi.fn())
+
+    socket.onclose?.({
+      code: MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE,
+      reason: 'relay connection rejected'
+    })
+
+    expect(onHostCloseReason).not.toHaveBeenCalled()
+  })
+
+  // The rejection arrives as a relay-hello AND a close, in an unordered pair.
+  // Whichever lands first, the reason must survive.
+  it('still reports the reason when the hello already failed the link', async () => {
+    const socket = new FakeSocket()
+    const onHostCloseReason = vi.fn()
+    linkOver(socket, onHostCloseReason, vi.fn())
+
+    socket.onmessage?.({
+      data: JSON.stringify({
+        type: 'relay-hello',
+        ok: false,
+        code: MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE
+      })
+    })
+    await Promise.resolve()
+    await Promise.resolve()
+    socket.onclose?.({
+      code: MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE,
+      reason: RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    })
+
+    expect(onHostCloseReason).toHaveBeenCalledWith(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+})
+
+describe('the signed-out signal on the logical client', () => {
+  it('publishes on change and retires when any path reaches connected', () => {
+    const path = new LogicalClientConnectionPath(() => false)
+    const changes = vi.fn()
+    path.subscribe(changes)
+
+    path.setHostSignedOut(true)
+    path.setHostSignedOut(true)
+    expect(path.isHostSignedOut()).toBe(true)
+    expect(changes).toHaveBeenCalledTimes(1)
+
+    path.clearAfterConnected()
+    expect(path.isHostSignedOut()).toBe(false)
+  })
+})
+
+describe('RelayReconnectController cadence', () => {
+  // The reason changes no recovery decision; 4404 keeps the host-offline
+  // backoff it has always had, so a phone on this build retries exactly as
+  // often as one that never hears the reason.
+  it('keeps the host-offline retry delay for a 4404', () => {
+    const delays: number[] = []
+    const controller = new RelayReconnectController(
+      {
+        now: () => 0,
+        randomBytes: () => new Uint8Array([0, 0]),
+        setTimer: ((callback: () => void, delay: number) => {
+          delays.push(delay)
+          return 1 as unknown as ReturnType<typeof setTimeout>
+        }) as unknown as typeof setTimeout,
+        clearTimer: (() => {}) as unknown as typeof clearTimeout
+      },
+      vi.fn()
+    )
+
+    controller.registerFailure(new RelayOuterError(MOBILE_RELAY_CLOSE_CODE.HOST_OFFLINE))
+
+    // hostOfflineDelayMs' 5s floor, not the 250ms transport-backoff floor.
+    expect(delays.at(-1)).toBe(5_000)
+  })
+})
+
+describe('classifyConnection with a signed-out desktop', () => {
+  const base = { reconnectAttempts: 0, lastConnectedAt: null, hostSignedOut: true }
+
+  it('says so from the first failed dial instead of "Connecting via Relay…"', () => {
+    const verdict = classifyConnection({
+      ...base,
+      state: 'connecting',
+      pendingPath: 'relay'
+    })
+
+    expect(verdict).toEqual({
+      kind: 'unreachable',
+      label: SIGNED_OUT_LABEL,
+      reason: 'never-connected'
+    })
+    expect(verdictDisplayLabel(verdict)).toBe(SIGNED_OUT_LABEL)
+  })
+
+  it('replaces "Can\'t reach desktop" on the direct path too', () => {
+    expect(
+      classifyConnection({ ...base, state: 'reconnecting', reconnectAttempts: 20 }).label
+    ).toBe(SIGNED_OUT_LABEL)
+  })
+
+  it('reads as stale once this session had been connected', () => {
+    expect(
+      classifyConnection({ ...base, state: 'reconnecting', lastConnectedAt: 1, nowMs: 2 }).reason
+    ).toBe('stale')
+  })
+
+  // A Tailscale endpoint cannot make "sign in on your desktop" better advice.
+  it('never appends the Tailscale hint', () => {
+    expect(
+      classifyConnection({ ...base, state: 'reconnecting', endpoint: '100.64.0.1' })
+    ).not.toHaveProperty('hint')
+  })
+
+  it('never outranks a connected session', () => {
+    expect(classifyConnection({ ...base, state: 'connected' }).label).toBe('Connected')
+  })
+
+  // Re-pairing, not signing in, is the remedy when the pairing itself is dead.
+  it('never outranks a revoked pairing', () => {
+    expect(classifyConnection({ ...base, state: 'reconnecting', pairingRejected: true }).kind).toBe(
+      'auth-failed'
+    )
+  })
+
+  it('leaves every other verdict alone when the desktop is not signed out', () => {
+    expect(
+      classifyConnection({
+        state: 'connecting',
+        reconnectAttempts: 0,
+        lastConnectedAt: null,
+        pendingPath: 'relay',
+        hostSignedOut: false
+      }).label
+    ).toBe('Connecting via Relay…')
+  })
+})
diff --git a/mobile/src/transport/rpc-client-context-contract.ts b/mobile/src/transport/rpc-client-context-contract.ts
index 54e25973c7f..65262a6fc15 100644
--- a/mobile/src/transport/rpc-client-context-contract.ts
+++ b/mobile/src/transport/rpc-client-context-contract.ts
@@ -24,6 +24,7 @@ export type RpcClientContextValue = {
   getActivePath: (hostId: string) => MobileConnectionPath
   getPendingPath: (hostId: string) => MobileConnectionPath | null
   isPairingRejected: (hostId: string) => boolean
+  isHostSignedOut: (hostId: string) => boolean
   subscribeHostState: (hostId: string, listener: (state: ConnectionState) => void) => () => void
   getAllClients: () => { hostId: string; client: RpcClient }[]
   subscribeAllHosts: (listener: () => void) => () => void
diff --git a/mobile/src/transport/stable-logical-rpc-client.ts b/mobile/src/transport/stable-logical-rpc-client.ts
index d1f1701aed9..fb514128382 100644
--- a/mobile/src/transport/stable-logical-rpc-client.ts
+++ b/mobile/src/transport/stable-logical-rpc-client.ts
@@ -55,6 +55,9 @@ export type StableLogicalRpcClient = RpcClient & {
   // Latched when the desktop has repeatedly refused this device's relay credential.
   setPairingRejected(rejected: boolean): void
   isPairingRejected(): boolean
+  // Latched when the relay named the desktop's own sign-out as the reason it is absent.
+  setHostSignedOut(signedOut: boolean): void
+  isHostSignedOut(): boolean
   // Recovery attempts share this signal so status-only changes rerender.
   onConnectionPathChange(listener: () => void): () => void
   getGeneration(): number
@@ -282,6 +285,8 @@ export function createStableLogicalRpcClient(
     setRecoveryAttempt: (attempt) => connectionPath.setRecoveryAttempt(attempt),
     setPairingRejected: (rejected) => connectionPath.setPairingRejected(rejected),
     isPairingRejected: () => connectionPath.isPairingRejected(),
+    setHostSignedOut: (signedOut) => connectionPath.setHostSignedOut(signedOut),
+    isHostSignedOut: () => connectionPath.isHostSignedOut(),
     onConnectionPathChange: (listener) => connectionPath.subscribe(listener),
     getGeneration: () => generation
   }
diff --git a/mobile/src/transport/use-all-host-clients.ts b/mobile/src/transport/use-all-host-clients.ts
index 03ac5890015..70c709d965f 100644
--- a/mobile/src/transport/use-all-host-clients.ts
+++ b/mobile/src/transport/use-all-host-clients.ts
@@ -138,6 +138,7 @@ export function useAllHostClients(hostIds: string[], options?: UseAllHostClients
       path: MobileConnectionPath
       pendingPath: MobileConnectionPath | null
       pairingRejected: boolean
+      hostSignedOut: boolean
     }>((hostId) => {
       const client = clientsByHostId.get(hostId)
       return client
@@ -148,7 +149,8 @@ export function useAllHostClients(hostIds: string[], options?: UseAllHostClients
               state: ctx.getState(hostId),
               path: ctx.getActivePath(hostId),
               pendingPath: ctx.getPendingPath(hostId),
-              pairingRejected: ctx.isPairingRejected(hostId)
+              pairingRejected: ctx.isPairingRejected(hostId),
+              hostSignedOut: ctx.isHostSignedOut(hostId)
             }
           ]
         : []
diff --git a/src/main/runtime/relay/desktop-relay-service.ts b/src/main/runtime/relay/desktop-relay-service.ts
index 55b993bd5a6..def786e7758 100644
--- a/src/main/runtime/relay/desktop-relay-service.ts
+++ b/src/main/runtime/relay/desktop-relay-service.ts
@@ -6,6 +6,7 @@ import type {
   PairingGetEndpointsResult,
   PairingProvisionRelayParams
 } from '../../../shared/mobile-relay-credential-contract'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import { readRelayAuthContext } from './relay-auth-context'
 import { RelayAuthCoordinator } from './relay-auth-coordinator'
 import { RelaySessionBroker, type RelayBrokerStatus } from './relay-session-broker'
@@ -112,7 +113,7 @@ export class DesktopRelayService {
     this.refreshDemand()
   }
 
-  fenceAndCloseNow(): void {
+  fenceAndCloseNow(hostCloseReason?: RelayHostCloseReason): void {
     // Why: a fence must be hard — a surviving liveness tick could catch the
     // window between the pre-sign-out fence and the profile wipe and briefly
     // resurrect a broker. The next auth mutation re-arms via refreshDemand.
@@ -120,7 +121,7 @@ export class DesktopRelayService {
       clearInterval(this.livenessTimer)
       this.livenessTimer = null
     }
-    this.coordinator.fenceAndCloseNow()
+    this.coordinator.fenceAndCloseNow(hostCloseReason)
   }
 
   async createPairingRelay(
diff --git a/src/main/runtime/relay/relay-auth-coordinator.ts b/src/main/runtime/relay/relay-auth-coordinator.ts
index ae439a320d9..a7db0e3a81e 100644
--- a/src/main/runtime/relay/relay-auth-coordinator.ts
+++ b/src/main/runtime/relay/relay-auth-coordinator.ts
@@ -1,3 +1,7 @@
+import {
+  RELAY_HOST_CLOSE_REASON,
+  type RelayHostCloseReason
+} from '../../../shared/relay-host-close-reason'
 import type { RelayBrokerStatus } from './relay-session-broker'
 import { RelayHttpError, shouldRetryRelayConnectionError } from './relay-http-client'
 
@@ -14,7 +18,7 @@ export type RelayAuthContext = {
 }
 
 export type CoordinatedRelayBroker = {
-  closeNow(): void
+  closeNow(hostCloseReason?: RelayHostCloseReason): void
   isLive?(): boolean
 }
 
@@ -78,13 +82,16 @@ export class RelayAuthCoordinator {
     void reconcile
   }
 
-  fenceAndCloseNow(): void {
+  // hostCloseReason names an auth loss the phone should be told about. Quit,
+  // relaunch and every other fence pass nothing, so the control socket dies
+  // abruptly exactly as before and the cell records no cause.
+  fenceAndCloseNow(hostCloseReason?: RelayHostCloseReason): void {
     ++this.authEpoch
     this.cancelLinger()
     this.cancelRetry()
     this.retryAttempt = 0
     this.invalidatePendingOwnerships()
-    this.invalidateOwnership()
+    this.invalidateOwnership(hostCloseReason)
     this.options.onStatus('offline')
   }
 
@@ -146,7 +153,11 @@ export class RelayAuthCoordinator {
       if (!context || !context.relayEntitled) {
         this.cancelLinger()
         this.retryAttempt = 0
-        this.invalidateOwnership()
+        // Why only the null case: readContext throws on transient failures and
+        // returns null solely when the cloud session is gone (absent, or cleared
+        // by a 401). A present-but-unentitled context is still a signed-in
+        // desktop, and "sign in to reconnect" would be wrong advice for it.
+        this.invalidateOwnership(context ? undefined : RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
         this.options.onStatus('offline')
         return
       }
@@ -271,12 +282,12 @@ export class RelayAuthCoordinator {
     return context.accessToken
   }
 
-  private invalidateOwnership(): void {
+  private invalidateOwnership(hostCloseReason?: RelayHostCloseReason): void {
     const ownership = this.ownership
     this.ownership = null
     if (ownership) {
       ownership.valid = false
-      ownership.broker?.closeNow()
+      ownership.broker?.closeNow(hostCloseReason)
     }
   }
 
diff --git a/src/main/runtime/relay/relay-auth-host-close-reason.test.ts b/src/main/runtime/relay/relay-auth-host-close-reason.test.ts
new file mode 100644
index 00000000000..7d10e207a33
--- /dev/null
+++ b/src/main/runtime/relay/relay-auth-host-close-reason.test.ts
@@ -0,0 +1,122 @@
+import { describe, expect, it, vi } from 'vitest'
+import { RELAY_HOST_CLOSE_REASON } from '../../../shared/relay-host-close-reason'
+import { RelayAuthCoordinator, type RelayAuthContext } from './relay-auth-coordinator'
+
+const context: RelayAuthContext = {
+  identity: { userId: 'user-1', profileId: 'profile-1', organizationId: 'org-1' },
+  accessToken: 'access-1',
+  relayEntitled: true
+}
+
+function coordinatorOver(readContext: () => Promise<RelayAuthContext | null>) {
+  const broker = { closeNow: vi.fn() }
+  const coordinator = new RelayAuthCoordinator({
+    readContext,
+    openBroker: async () => broker,
+    onStatus: vi.fn()
+  })
+  return { broker, coordinator }
+}
+
+describe('relay control close reason', () => {
+  it('names the sign-out when the cloud session is gone', async () => {
+    let current: RelayAuthContext | null = context
+    const { broker, coordinator } = coordinatorOver(async () => current)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    current = null
+    coordinator.reconcile()
+    await coordinator.waitForLiveBroker()
+
+    expect(broker.closeNow).toHaveBeenCalledWith(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+
+  it('names the sign-out on the explicit pre-sign-out fence', async () => {
+    const { broker, coordinator } = coordinatorOver(async () => context)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    coordinator.fenceAndCloseNow(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    expect(broker.closeNow).toHaveBeenCalledWith(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+  })
+
+  it('stays silent on quit, which fences without a reason', async () => {
+    const { broker, coordinator } = coordinatorOver(async () => context)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    coordinator.fenceAndCloseNow()
+
+    expect(broker.closeNow).toHaveBeenCalledWith(undefined)
+  })
+
+  it('stays silent on stop, which is teardown rather than auth loss', async () => {
+    const { broker, coordinator } = coordinatorOver(async () => context)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    coordinator.stop()
+
+    expect(broker.closeNow).toHaveBeenCalledWith(undefined)
+  })
+
+  // A signed-in desktop that merely lost the entitlement must not tell the
+  // phone to sign in — the copy would be wrong and the user has nothing to do.
+  it('stays silent when the session survives but the entitlement is gone', async () => {
+    let current: RelayAuthContext = context
+    const { broker, coordinator } = coordinatorOver(async () => current)
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    current = { ...context, relayEntitled: false }
+    coordinator.reconcile()
+    await coordinator.waitForLiveBroker()
+
+    expect(broker.closeNow).toHaveBeenCalledWith(undefined)
+  })
+
+  it('stays silent when demand drops and the broker lingers out', async () => {
+    let demanded = true
+    const broker = { closeNow: vi.fn() }
+    const coordinator = new RelayAuthCoordinator({
+      readContext: async () => context,
+      hasDemand: () => demanded,
+      openBroker: async () => broker,
+      onStatus: vi.fn(),
+      lingerMs: 5
+    })
+    coordinator.reconcile()
+    await expect(coordinator.waitForLiveBroker()).resolves.toBe(broker)
+
+    demanded = false
+    coordinator.reconcile()
+    await vi.waitFor(() => expect(broker.closeNow).toHaveBeenCalled())
+
+    expect(broker.closeNow).toHaveBeenCalledWith(undefined)
+  })
+
+  // Replacing a stale broker is a reconnect, not a sign-out.
+  it('stays silent when an identity switch replaces the broker', async () => {
+    let current = context
+    const brokers: { closeNow: ReturnType<typeof vi.fn> }[] = []
+    const coordinator = new RelayAuthCoordinator({
+      readContext: async () => current,
+      openBroker: async () => {
+        const broker = { closeNow: vi.fn() }
+        brokers.push(broker)
+        return broker
+      },
+      onStatus: vi.fn()
+    })
+    coordinator.reconcile()
+    await coordinator.waitForLiveBroker()
+
+    current = { ...context, identity: { ...context.identity, organizationId: 'org-2' } }
+    coordinator.reconcile()
+    await coordinator.waitForLiveBroker()
+
+    expect(brokers[0]?.closeNow).toHaveBeenCalledWith(undefined)
+  })
+})
diff --git a/src/main/runtime/relay/relay-control-client.ts b/src/main/runtime/relay/relay-control-client.ts
index 7e742173f72..968f05795b2 100644
--- a/src/main/runtime/relay/relay-control-client.ts
+++ b/src/main/runtime/relay/relay-control-client.ts
@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto'
 import WebSocket, { type RawData } from 'ws'
 import { MOBILE_RELAY_CLOSE_CODE } from '../../../shared/mobile-relay-close-codes'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import type { E2EEKeypair } from '../e2ee-keypair'
 import {
   RelayConnectionOpenMessageSchema,
@@ -8,6 +9,7 @@ import {
   RelayHostChallengeMessageSchema,
   RelayHostHelloAckMessageSchema,
   RelayPingMessageSchema,
+  encodeRelayHostHello,
   parseRelayControlMessage,
   type RelayConnectionOpenMessage,
   type RelayDrainMessage,
@@ -21,6 +23,7 @@ import {
   RELAY_CONTROL_SILENCE_LIMIT_MS,
   RelayControlSilenceWatchdog
 } from './relay-control-silence-watchdog'
+import { closeRelayControlSocket } from './relay-control-socket-close'
 import { controlWebSocketUrl } from './relay-control-url'
 
 type RelayControlState = 'idle' | 'opening' | 'proving' | 'active' | 'draining' | 'closed'
@@ -166,7 +169,7 @@ export class RelayControlClient {
     return this.requests.confirmResume(reqId, basisConnId, (payload) => this.sendActive(payload))
   }
 
-  closeNow(): void {
+  closeNow(hostCloseReason?: RelayHostCloseReason): void {
     const wasConnecting = this.state === 'opening' || this.state === 'proving'
     this.state = 'closed'
     this.silenceWatchdog.stop()
@@ -175,8 +178,9 @@ export class RelayControlClient {
       this.clearConnectPromise()
     }
     this.requests.rejectAll(new Error('relay_control_closed'))
-    this.socket?.terminate()
+    const socket = this.socket
     this.socket = null
+    closeRelayControlSocket(socket, hostCloseReason)
   }
 
   private sendHostHello(): void {
@@ -185,19 +189,9 @@ export class RelayControlClient {
     }
     this.state = 'proving'
     this.socket.send(
-      JSON.stringify({
-        type: 'host-hello',
-        v: 1,
-        relayHostId: this.options.relayHostId,
-        assignmentEpoch: this.options.assignmentEpoch,
-        hostPublicKeyB64: this.options.keypair.publicKeyB64,
-        appVersion: this.options.appVersion,
-        ...(this.options.previousGeneration === undefined
-          ? {}
-          : { previousGeneration: this.options.previousGeneration }),
-        ...(this.options.controlResumeSecret
-          ? { controlResumeSecret: this.options.controlResumeSecret }
-          : {})
+      encodeRelayHostHello({
+        ...this.options,
+        hostPublicKeyB64: this.options.keypair.publicKeyB64
       })
     )
   }
diff --git a/src/main/runtime/relay/relay-control-close-reason.test.ts b/src/main/runtime/relay/relay-control-close-reason.test.ts
new file mode 100644
index 00000000000..0d9aba54f88
--- /dev/null
+++ b/src/main/runtime/relay/relay-control-close-reason.test.ts
@@ -0,0 +1,92 @@
+import { createHash } from 'node:crypto'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import nacl from 'tweetnacl'
+import { WebSocketServer, type WebSocket } from 'ws'
+import { RELAY_HOST_CLOSE_REASON } from '../../../shared/relay-host-close-reason'
+import { RelayControlClient } from './relay-control-client'
+
+type ObservedClose = { code: number; reason: string }
+
+describe('RelayControlClient close reason', () => {
+  const servers: WebSocketServer[] = []
+  const clients: RelayControlClient[] = []
+
+  afterEach(async () => {
+    for (const client of clients.splice(0)) {
+      client.closeNow()
+    }
+    await Promise.all(
+      servers.splice(0).map(
+        (server) =>
+          new Promise<void>((resolve) => {
+            for (const socket of server.clients) {
+              socket.terminate()
+            }
+            server.close(() => resolve())
+          })
+      )
+    )
+  })
+
+  async function connectedClient(): Promise<{
+    client: RelayControlClient
+    closed: Promise<ObservedClose>
+  }> {
+    const server = new WebSocketServer({ host: '127.0.0.1', port: 0, perMessageDeflate: false })
+    servers.push(server)
+    await new Promise<void>((resolve) => server.once('listening', resolve))
+    const address = server.address()
+    if (!address || typeof address === 'string') {
+      throw new Error('expected TCP relay test server')
+    }
+    const accepted = new Promise<WebSocket>((resolve) => server.once('connection', resolve))
+    const keypair = nacl.box.keyPair()
+    const client = new RelayControlClient({
+      cellUrl: `http://127.0.0.1:${address.port}`,
+      relayJwt: 'scoped-token',
+      relayHostId: createHash('sha256').update(keypair.publicKey).digest('base64url').slice(0, 16),
+      assignmentEpoch: 1,
+      identity: { userId: 'user-1', profileId: 'profile-1', organizationId: 'org-1' },
+      keypair: { ...keypair, publicKeyB64: Buffer.from(keypair.publicKey).toString('base64') },
+      appVersion: '1.2.3',
+      onConnectionOpen: vi.fn(),
+      onDrain: vi.fn(),
+      onClose: vi.fn()
+    })
+    clients.push(client)
+    // The handshake never completes here; only the transport close matters.
+    void client.connect().catch(() => {})
+    const socket = await accepted
+    // A pong proves the client socket left CONNECTING; closeNow can only send a
+    // close frame from OPEN, and that is the state a real sign-out fences from.
+    await new Promise<void>((resolve) => {
+      socket.once('pong', () => resolve())
+      socket.ping()
+    })
+    const closed = new Promise<ObservedClose>((resolve) => {
+      socket.once('close', (code, reason) => resolve({ code, reason: reason.toString() }))
+    })
+    return { client, closed }
+  }
+
+  it('delivers the sign-out reason to the cell', async () => {
+    const { client, closed } = await connectedClient()
+
+    client.closeNow(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
+
+    await expect(closed).resolves.toEqual({
+      code: 1000,
+      reason: RELAY_HOST_CLOSE_REASON.SIGNED_OUT
+    })
+  })
+
+  // Every non-auth close keeps today's abrupt terminate, so a cell can never
+  // read a quit, a rotation or a sleep as a sign-out.
+  it('closes abruptly with no reason when none is given', async () => {
+    const { client, closed } = await connectedClient()
+
+    client.closeNow()
+
+    await expect(closed).resolves.toEqual({ code: 1006, reason: '' })
+  })
+})
diff --git a/src/main/runtime/relay/relay-control-origin.ts b/src/main/runtime/relay/relay-control-origin.ts
index 4d42da47977..3a33e1617e6 100644
--- a/src/main/runtime/relay/relay-control-origin.ts
+++ b/src/main/runtime/relay/relay-control-origin.ts
@@ -8,6 +8,7 @@ import type {
   RelayDrainMessage,
   RelayHostHelloAckMessage
 } from './relay-control-protocol'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import type { RelayIdentity } from './relay-session-broker-contract'
 import type { RelayAssignment } from './relay-http-client'
 
@@ -144,7 +145,7 @@ export class RelayControlOrigin {
     }
   }
 
-  async close(): Promise<void> {
+  async close(hostCloseReason?: RelayHostCloseReason): Promise<void> {
     if (this.closed) {
       return
     }
@@ -154,7 +155,7 @@ export class RelayControlOrigin {
     }
     this.retiredControlTimers.clear()
     for (const control of this.controls) {
-      control.closeNow()
+      control.closeNow(hostCloseReason)
     }
     this.controls.clear()
     this.activeControl = null
@@ -166,8 +167,8 @@ export class RelayControlOrigin {
     }
   }
 
-  closeNow(): void {
-    void this.close()
+  closeNow(hostCloseReason?: RelayHostCloseReason): void {
+    void this.close(hostCloseReason)
   }
 
   private async openControl(overrides?: {
diff --git a/src/main/runtime/relay/relay-control-protocol.ts b/src/main/runtime/relay/relay-control-protocol.ts
index c94797f4815..75bf3a390e2 100644
--- a/src/main/runtime/relay/relay-control-protocol.ts
+++ b/src/main/runtime/relay/relay-control-protocol.ts
@@ -143,3 +143,29 @@ export function parseRelayControlMessage(raw: RawData): Record<string, unknown>
     return null
   }
 }
+
+export type RelayHostHello = {
+  relayHostId: string
+  assignmentEpoch: number
+  hostPublicKeyB64: string
+  appVersion: string
+  previousGeneration?: number
+  controlResumeSecret?: string
+}
+
+// Optional members are omitted rather than sent as undefined: the cell parses
+// host-hello strictly and an explicit null is not the same as absent.
+export function encodeRelayHostHello(hello: RelayHostHello): string {
+  return JSON.stringify({
+    type: 'host-hello',
+    v: 1,
+    relayHostId: hello.relayHostId,
+    assignmentEpoch: hello.assignmentEpoch,
+    hostPublicKeyB64: hello.hostPublicKeyB64,
+    appVersion: hello.appVersion,
+    ...(hello.previousGeneration === undefined
+      ? {}
+      : { previousGeneration: hello.previousGeneration }),
+    ...(hello.controlResumeSecret ? { controlResumeSecret: hello.controlResumeSecret } : {})
+  })
+}
diff --git a/src/main/runtime/relay/relay-control-socket-close.ts b/src/main/runtime/relay/relay-control-socket-close.ts
new file mode 100644
index 00000000000..2984b075425
--- /dev/null
+++ b/src/main/runtime/relay/relay-control-socket-close.ts
@@ -0,0 +1,26 @@
+import type WebSocket from 'ws'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
+
+const NORMAL_CLOSE_CODE = 1000
+const REASONED_CLOSE_FLUSH_MS = 1_000
+
+// hostCloseReason: only auth loss names itself. Every other control close
+// (rotation, drain, quit, sleep) stays an abrupt terminate, so the cell learns
+// nothing and can never read a restart as a sign-out. A named close has to
+// reach the cell as a real close frame, but the fence must still be hard —
+// bound the handshake and then terminate.
+export function closeRelayControlSocket(
+  socket: WebSocket | null,
+  hostCloseReason?: RelayHostCloseReason
+): void {
+  if (!socket) {
+    return
+  }
+  if (hostCloseReason && socket.readyState === socket.OPEN) {
+    socket.close(NORMAL_CLOSE_CODE, hostCloseReason)
+    const timer = setTimeout(() => socket.terminate(), REASONED_CLOSE_FLUSH_MS)
+    timer.unref?.()
+    return
+  }
+  socket.terminate()
+}
diff --git a/src/main/runtime/relay/relay-origin-pool.ts b/src/main/runtime/relay/relay-origin-pool.ts
index a95d8f21340..ca29c41e8a7 100644
--- a/src/main/runtime/relay/relay-origin-pool.ts
+++ b/src/main/runtime/relay/relay-origin-pool.ts
@@ -4,6 +4,7 @@ import type { MobileSocketWiring } from '../rpc/mobile-socket-wiring'
 import { RelayControlOrigin } from './relay-control-origin'
 import type { RelayControlClient } from './relay-control-client'
 import type { RelayDrainMessage } from './relay-control-protocol'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import { RelayDrainRetrySchedule } from './relay-drain-retry-schedule'
 import { RelayHttpError, requestRelayAssignment, type RelayAssignment } from './relay-http-client'
 import type { RelayBrokerStatus, RelayIdentity } from './relay-session-broker-contract'
@@ -79,7 +80,7 @@ export class RelayOriginPool {
     }
   }
 
-  closeNow(): void {
+  closeNow(hostCloseReason?: RelayHostCloseReason): void {
     if (this.closed) {
       return
     }
@@ -94,7 +95,7 @@ export class RelayOriginPool {
     }
     this.drainTimers.clear()
     for (const origin of this.origins) {
-      origin.closeNow()
+      origin.closeNow(hostCloseReason)
     }
     this.origins.clear()
     this.drainingOrigins.clear()
diff --git a/src/main/runtime/relay/relay-session-broker.ts b/src/main/runtime/relay/relay-session-broker.ts
index e12e09119a0..d8d0ec45047 100644
--- a/src/main/runtime/relay/relay-session-broker.ts
+++ b/src/main/runtime/relay/relay-session-broker.ts
@@ -6,6 +6,7 @@ import type {
   MobileRelayEndpoint,
   PairingProvisionRelayParams
 } from '../../../shared/mobile-relay-credential-contract'
+import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import type { DeviceCredentialInstallAuthorization } from './relay-control-requests'
 import {
   deriveRelayHostId,
@@ -180,7 +181,7 @@ export class RelaySessionBroker {
     return result
   }
 
-  closeNow(): void {
+  closeNow(hostCloseReason?: RelayHostCloseReason): void {
     if (this.closed) {
       return
     }
@@ -190,7 +191,7 @@ export class RelaySessionBroker {
       clearTimeout(this.refreshTimer)
       this.refreshTimer = null
     }
-    this.originPool.closeNow()
+    this.originPool.closeNow(hostCloseReason)
     if (publishOffline) {
       this.options.onStatus('offline')
     }
diff --git a/src/main/startup/main-window-core-services.ts b/src/main/startup/main-window-core-services.ts
index 759a4b2b100..d3ece383ee3 100644
--- a/src/main/startup/main-window-core-services.ts
+++ b/src/main/startup/main-window-core-services.ts
@@ -15,6 +15,7 @@ import {
 import { prepareCodexRuntimeHomeForLaunch } from './codex-launch-preparation'
 import { prepareCodexSessionResumeForLaunch } from './codex-session-resume-launch'
 import { isRecoveryReloadInFlight } from './main-window-lifecycle-flags'
+import { RELAY_HOST_CLOSE_REASON } from '../../shared/relay-host-close-reason'
 
 export function attachMainWindowCoreServices(
   window: BrowserWindow,
@@ -90,7 +91,10 @@ export function attachMainWindowCoreServices(
         })
       },
       onOrcaProfileAuthMutation: () => state.desktopRelayService?.authMutated(),
-      onBeforeOrcaProfileSignOut: () => state.desktopRelayService?.fenceAndCloseNow()
+      // Sign-out is the one fence a paired phone can be told about; quit and
+      // relaunch above stay reasonless so a restart never reads as signed out.
+      onBeforeOrcaProfileSignOut: () =>
+        state.desktopRelayService?.fenceAndCloseNow(RELAY_HOST_CLOSE_REASON.SIGNED_OUT)
     },
     state.pluginService ?? undefined,
     state.pluginMarketplaceService && state.pluginMarketplaceInstaller
diff --git a/src/shared/relay-host-close-reason.ts b/src/shared/relay-host-close-reason.ts
new file mode 100644
index 00000000000..460aa704a34
--- /dev/null
+++ b/src/shared/relay-host-close-reason.ts
@@ -0,0 +1,19 @@
+// Why a WebSocket close reason and not a JSON field: every relay-hello and
+// director-resolve schema on the phone is zod `.strict()`, so an added key is a
+// hard parse failure on already-shipped phones. The close reason is a wire slot
+// old peers never read, which makes it the only additive channel here.
+export const RELAY_HOST_CLOSE_REASON = {
+  // The desktop lost its Orca Cloud session (cleared, or refused with 401).
+  SIGNED_OUT: 'signed-out'
+} as const
+
+export type RelayHostCloseReason =
+  (typeof RELAY_HOST_CLOSE_REASON)[keyof typeof RELAY_HOST_CLOSE_REASON]
+
+const REASONS: readonly string[] = Object.values(RELAY_HOST_CLOSE_REASON)
+
+// Close reasons are attacker-adjacent free text; only exact known members count.
+export function relayHostCloseReasonFrom(value: unknown): RelayHostCloseReason | null {
+  const text = typeof value === 'string' ? value : (value?.toString() ?? '')
+  return REASONS.includes(text) ? (text as RelayHostCloseReason) : null
+}

From cae616384fd5453fb7b5dc93f042f5c418dcb96a Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:31:01 -0700
Subject: [PATCH 31/58] perf(orchestration): bound the worker terminal archive
 in linear time (#18622)

boundArchiveLines built its kept-lines array with kept.unshift() per line,
which is O(n) per call. The 256KB char budget admits ~262k lines when they are
short, so a blank-line-heavy terminal tail turned the truncation into a
quadratic main-process stall: 4.3s for a 300k-line input here, versus 6ms
after collecting newest-first and reversing once.

Order and truncation boundary are unchanged.
---
 .../worker-output-archive-bounding.test.ts    | 41 +++++++++++++++++++
 .../orchestration/worker-output-archive.ts    | 15 ++++---
 2 files changed, 50 insertions(+), 6 deletions(-)
 create mode 100644 src/main/runtime/orchestration/worker-output-archive-bounding.test.ts

diff --git a/src/main/runtime/orchestration/worker-output-archive-bounding.test.ts b/src/main/runtime/orchestration/worker-output-archive-bounding.test.ts
new file mode 100644
index 00000000000..a45cc6c0531
--- /dev/null
+++ b/src/main/runtime/orchestration/worker-output-archive-bounding.test.ts
@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest'
+import { boundArchiveLines } from './worker-output-archive'
+
+const TERMINAL_ARCHIVE_MAX_CHARS = 262_144
+
+function totalCost(lines: string[]): number {
+  return lines.reduce((sum, line) => sum + line.length + 1, 0)
+}
+
+describe('boundArchiveLines', () => {
+  it('returns the original array untouched when the tail already fits', () => {
+    const lines = ['one', 'two', 'three']
+    const bounded = boundArchiveLines(lines)
+    expect(bounded.truncated).toBe(false)
+    expect(bounded.lines).toBe(lines)
+  })
+
+  it('keeps the newest lines in order and reports truncation', () => {
+    const lines = Array.from({ length: 40_000 }, (_, index) => `line ${index}`)
+    const bounded = boundArchiveLines(lines)
+    expect(bounded.truncated).toBe(true)
+    expect(totalCost(bounded.lines)).toBeLessThanOrEqual(TERMINAL_ARCHIVE_MAX_CHARS)
+    expect(bounded.lines.at(-1)).toBe(lines.at(-1))
+    expect(bounded.lines).toEqual(lines.slice(lines.length - bounded.lines.length))
+  })
+
+  it('truncates a single oversized line from its tail', () => {
+    const bounded = boundArchiveLines(['x'.repeat(TERMINAL_ARCHIVE_MAX_CHARS * 2)])
+    expect(bounded.truncated).toBe(true)
+    expect(bounded.lines).toHaveLength(1)
+    expect(bounded.lines[0]).toHaveLength(TERMINAL_ARCHIVE_MAX_CHARS - 1)
+  })
+
+  it('bounds a blank-line flood in linear time', () => {
+    // The char budget admits ~262k blank lines; an unshift-per-line build was ~4.3s here.
+    const startedAt = performance.now()
+    const bounded = boundArchiveLines(Array.from({ length: 300_000 }, () => ''))
+    expect(bounded.lines).toHaveLength(TERMINAL_ARCHIVE_MAX_CHARS)
+    expect(performance.now() - startedAt).toBeLessThan(500)
+  })
+})
diff --git a/src/main/runtime/orchestration/worker-output-archive.ts b/src/main/runtime/orchestration/worker-output-archive.ts
index f6f2b52ecb1..55d16467269 100644
--- a/src/main/runtime/orchestration/worker-output-archive.ts
+++ b/src/main/runtime/orchestration/worker-output-archive.ts
@@ -114,7 +114,7 @@ export async function captureWorkerOutputArchive(args: {
   }
 }
 
-function boundArchiveLines(lines: string[]): { lines: string[]; truncated: boolean } {
+export function boundArchiveLines(lines: string[]): { lines: string[]; truncated: boolean } {
   let total = 0
   for (const line of lines) {
     total += line.length + 1
@@ -122,18 +122,21 @@ function boundArchiveLines(lines: string[]): { lines: string[]; truncated: boole
   if (total <= TERMINAL_ARCHIVE_MAX_CHARS) {
     return { lines, truncated: false }
   }
-  const kept: string[] = []
+  // Collected newest-first and reversed once: unshift per line is O(n^2) and the
+  // char budget admits ~260k blank lines.
+  const keptReversed: string[] = []
   let budget = TERMINAL_ARCHIVE_MAX_CHARS
   for (let index = lines.length - 1; index >= 0; index -= 1) {
     const cost = lines[index].length + 1
     if (cost > budget) {
-      if (kept.length === 0 && budget > 1) {
-        kept.unshift(lines[index].slice(-(budget - 1)))
+      if (keptReversed.length === 0 && budget > 1) {
+        keptReversed.push(lines[index].slice(-(budget - 1)))
       }
       break
     }
-    kept.unshift(lines[index])
+    keptReversed.push(lines[index])
     budget -= cost
   }
-  return { lines: kept, truncated: true }
+  keptReversed.reverse()
+  return { lines: keptReversed, truncated: true }
 }

From d9680eb753b3698f8bc93ee4b3595c083f49d564 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:31:50 -0700
Subject: [PATCH 32/58] fix(startup): apply the HTTP/1.1 compatibility toggle
 for migrated profiles, and stop parsing the settings file pre-ready (#18621)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* perf(startup): read the HTTP/1.1 compatibility flag from a marker, not the settings file

configureElectronNetworkCompatibility() runs before app.whenReady(), and it
answered one boolean by synchronously reading and JSON.parsing the whole
orca-data.json — 1.54 MB on a real profile here, measured at 6.6ms read +
3.5ms parse. The Store parses the identical file again moments later, so the
first parse was pure waste on the critical path of every cold start.

Cache the flag in a few-byte marker next to the other pre-ready markers
(gpu-fallback, hang-detection), written at store load and whenever the setting
changes. When no marker exists yet the old full read still runs, so an
upgrading profile keeps the setting on its first launch.

* refactor(startup): drop the unused marker clear helper
---
 src/main/startup/configure-process.test.ts    | 39 +++++++++++++-
 src/main/startup/configure-process.ts         |  9 +++-
 .../startup/http1-compatibility-marker.ts     | 51 +++++++++++++++++++
 .../startup/main-process-ready-foundation.ts  | 12 +++++
 4 files changed, 109 insertions(+), 2 deletions(-)
 create mode 100644 src/main/startup/http1-compatibility-marker.ts

diff --git a/src/main/startup/configure-process.test.ts b/src/main/startup/configure-process.test.ts
index ef7ec6a9b69..9d97dda6dae 100644
--- a/src/main/startup/configure-process.test.ts
+++ b/src/main/startup/configure-process.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -444,6 +444,43 @@ describe('configureElectronNetworkCompatibility', () => {
     ).toBe(false)
   })
 
+  it('answers from the marker without reading the settings file', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const userDataPath = createUserDataDir({ electronHttp1CompatibilityMode: false })
+    writeHttp1CompatibilityMarker(userDataPath, true)
+    rmSync(join(userDataPath, 'orca-data.json'), { force: true })
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(true)
+  })
+
+  it('falls back to the settings file when no marker has been written yet', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const userDataPath = createUserDataDir({ electronHttp1CompatibilityMode: true })
+
+    expect(existsSync(join(userDataPath, 'http1-compatibility.json'))).toBe(false)
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(true)
+  })
+
+  it('falls back to the settings file when the marker is corrupt', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const userDataPath = createUserDataDir({ electronHttp1CompatibilityMode: true })
+    writeFileSync(join(userDataPath, 'http1-compatibility.json'), '{ not json', 'utf-8')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(true)
+  })
+
+  it('lets the environment override the marker', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const userDataPath = createUserDataDir({})
+    writeHttp1CompatibilityMarker(userDataPath, true)
+
+    expect(
+      shouldDisableHttp2ForElectronNetworking({ env: { ORCA_DISABLE_HTTP2: '0' }, userDataPath })
+    ).toBe(false)
+  })
+
   it('appends Electron disable-http2 before sessions are created', async () => {
     const { app } = await import('electron')
     const { configureElectronNetworkCompatibility } = await import('./configure-process')
diff --git a/src/main/startup/configure-process.ts b/src/main/startup/configure-process.ts
index 6b167d7fe14..13dbd70c2c3 100644
--- a/src/main/startup/configure-process.ts
+++ b/src/main/startup/configure-process.ts
@@ -5,6 +5,7 @@ import { join, resolve } from 'node:path'
 import { getVersionManagerBinPaths } from '../codex-cli/command'
 import { getMainE2EConfig } from '../e2e-config'
 import { DISABLED_CHROMIUM_FEATURES } from './disabled-chromium-features'
+import { readHttp1CompatibilityMarker } from './http1-compatibility-marker'
 
 const DEV_PARENT_SHUTDOWN_GRACE_MS = 3000
 const HTTP1_COMPATIBILITY_ENV_VAR = 'ORCA_DISABLE_HTTP2'
@@ -54,7 +55,13 @@ export function shouldDisableHttp2ForElectronNetworking(
   if (envValue !== null) {
     return envValue
   }
-  return readPersistedHttp1CompatibilityMode(options.userDataPath ?? app.getPath('userData'))
+  const userDataPath = options.userDataPath ?? app.getPath('userData')
+  // Why the marker first: this runs before app.whenReady(), and the settings file is the multi-MB
+  // orca-data.json the Store parses again moments later. The marker is refreshed whenever settings
+  // change, so the full read only happens on a profile that has never written one.
+  return (
+    readHttp1CompatibilityMarker(userDataPath) ?? readPersistedHttp1CompatibilityMode(userDataPath)
+  )
 }
 
 export function configureElectronNetworkCompatibility(
diff --git a/src/main/startup/http1-compatibility-marker.ts b/src/main/startup/http1-compatibility-marker.ts
new file mode 100644
index 00000000000..9e85a83be66
--- /dev/null
+++ b/src/main/startup/http1-compatibility-marker.ts
@@ -0,0 +1,51 @@
+import { readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * Cached copy of `settings.electronHttp1CompatibilityMode` for pre-`ready` startup.
+ *
+ * Why a standalone file (not the Store): app.commandLine.appendSwitch('disable-http2') must run
+ * before the first Electron session exists, which is before the settings Store is constructed.
+ * Reading it from the settings file meant a synchronous read + JSON.parse of the whole multi-MB
+ * orca-data.json on the critical path of every cold start, duplicating the parse the Store does a
+ * moment later. This marker is a few bytes, mirroring gpu-fallback-marker.ts.
+ */
+
+export const HTTP1_COMPATIBILITY_MARKER_FILE = 'http1-compatibility.json'
+const MARKER_SCHEME_VERSION = 1
+
+type Http1CompatibilityMarker = {
+  schemeVersion: number
+  enabled: boolean
+}
+
+function markerPath(userDataPath: string): string {
+  return join(userDataPath, HTTP1_COMPATIBILITY_MARKER_FILE)
+}
+
+/** Returns null when the marker is missing or unreadable, so callers fall back to the settings file. */
+export function readHttp1CompatibilityMarker(userDataPath: string): boolean | null {
+  try {
+    const parsed = JSON.parse(
+      readFileSync(markerPath(userDataPath), 'utf-8')
+    ) as Partial<Http1CompatibilityMarker>
+    if (parsed.schemeVersion !== MARKER_SCHEME_VERSION || typeof parsed.enabled !== 'boolean') {
+      return null
+    }
+    return parsed.enabled
+  } catch {
+    return null
+  }
+}
+
+export function writeHttp1CompatibilityMarker(userDataPath: string, enabled: boolean): void {
+  if (readHttp1CompatibilityMarker(userDataPath) === enabled) {
+    return
+  }
+  const marker: Http1CompatibilityMarker = { schemeVersion: MARKER_SCHEME_VERSION, enabled }
+  try {
+    writeFileSync(markerPath(userDataPath), JSON.stringify(marker))
+  } catch {
+    // Best effort: a missing marker just costs the next launch the settings-file fallback.
+  }
+}
diff --git a/src/main/startup/main-process-ready-foundation.ts b/src/main/startup/main-process-ready-foundation.ts
index 171aaf50421..3c0e01fe09e 100644
--- a/src/main/startup/main-process-ready-foundation.ts
+++ b/src/main/startup/main-process-ready-foundation.ts
@@ -41,6 +41,7 @@ import { registerDocPreviewGrantHandlers } from '../ipc/doc-preview-grant-ipc'
 import { initializeBrowserSessionsForApp } from '../browser/browser-session-startup'
 import { browserSessionRegistry } from '../browser/browser-session-registry'
 import { logStartupMilestone } from './startup-diagnostics'
+import { writeHttp1CompatibilityMarker } from './http1-compatibility-marker'
 import { mainProcessState as state } from './main-process-state'
 import { recordDurableCrashBreadcrumb } from '../crash-reporting/durable-crash-breadcrumb'
 import { syncMacMenuBarIcon } from './main-window-actions'
@@ -193,9 +194,20 @@ export async function initializeReadyFoundation(): Promise<void> {
   }
   wslHookRelayManager.setManagedHookSettingsResolver(() => state.store?.getSettings() ?? null)
   logStartupMilestone('store-loaded')
+  // Why: pre-`ready` startup reads this flag from a marker so it never has to parse orca-data.json.
+  writeHttp1CompatibilityMarker(
+    canonicalUserDataPath,
+    store.getSettings().electronHttp1CompatibilityMode === true
+  )
   // Why: apply initial fallback WSL distro from store settings for global git/CLI calls.
   setDefaultWslDistroOverride(store.getSettings().terminalWindowsWslDistro ?? null)
   store.onSettingsChanged((updates, settings) => {
+    if ('electronHttp1CompatibilityMode' in updates) {
+      writeHttp1CompatibilityMarker(
+        canonicalUserDataPath,
+        settings.electronHttp1CompatibilityMode === true
+      )
+    }
     if ('terminalWindowsWslDistro' in updates) {
       // Why: synchronize fallback WSL distro updates to runner.
       setDefaultWslDistroOverride(settings.terminalWindowsWslDistro ?? null)

From c5ed53a1f509d6fc99184cc525f0019038b54b22 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:31:54 -0700
Subject: [PATCH 33/58] perf(git): overlap the three independent submodule
 status reads (#18623)

getSubmoduleStatus awaited the inner status, the parent gitlink oid and the
submodule HEAD one after another, though none depends on another's result. The
Source Control panel re-runs this on every parent status poll while a submodule
row is expanded, and the same function backs the git.submoduleStatus RPC, so
over SSH or WSL each read was a separate round trip.

Total latency drops from the sum of the round trips to the longest one.
---
 .../git/source-control/submodule-status.ts    | 27 +++++++++-------
 src/main/git/status-submodule.test.ts         | 31 +++++++++++++++++++
 2 files changed, 47 insertions(+), 11 deletions(-)

diff --git a/src/main/git/source-control/submodule-status.ts b/src/main/git/source-control/submodule-status.ts
index f3c808c9f2f..fb4ca8449e3 100644
--- a/src/main/git/source-control/submodule-status.ts
+++ b/src/main/git/source-control/submodule-status.ts
@@ -26,17 +26,22 @@ export async function getSubmoduleStatus(
   const submoduleWorktreePath = resolveSubmoduleWorktreePath(worktreePath, submodulePath)
   const limit = resolveGitStatusLimit(options.limit)
   // Why: staged expansion only represents HEAD→index; scanning the submodule worktree is wasted work.
-  const workingResult = options.staged
-    ? ({ entries: [], conflictOperation: 'unknown' } satisfies GitStatusResult)
-    : await getStatus(submoduleWorktreePath, options)
-  // Why: a moved gitlink (clean worktree) has no status rows; surface the parent-commit→checkout range as inner rows.
-  const fromOid = options.staged
-    ? await readGitlinkOidFromTree(worktreePath, 'HEAD', submodulePath, options)
-    : (await readGitlinkOidFromIndex(worktreePath, submodulePath, options)) ||
-      (await readGitlinkOidFromTree(worktreePath, 'HEAD', submodulePath, options))
-  const toOid = options.staged
-    ? await readGitlinkOidFromIndex(worktreePath, submodulePath, options)
-    : await readWorkingSubmoduleHead(submoduleWorktreePath, options)
+  // These three reads are independent, so they run concurrently — on SSH/WSL each one is a real round trip.
+  const [workingResult, fromOid, toOid] = await Promise.all([
+    options.staged
+      ? Promise.resolve<GitStatusResult>({ entries: [], conflictOperation: 'unknown' })
+      : getStatus(submoduleWorktreePath, options),
+    // Why: a moved gitlink (clean worktree) has no status rows; surface the parent-commit→checkout range as inner rows.
+    options.staged
+      ? readGitlinkOidFromTree(worktreePath, 'HEAD', submodulePath, options)
+      : readGitlinkOidFromIndex(worktreePath, submodulePath, options).then(
+          (indexOid) =>
+            indexOid || readGitlinkOidFromTree(worktreePath, 'HEAD', submodulePath, options)
+        ),
+    options.staged
+      ? readGitlinkOidFromIndex(worktreePath, submodulePath, options)
+      : readWorkingSubmoduleHead(submoduleWorktreePath, options)
+  ])
   if (fromOid && toOid && fromOid !== toOid) {
     const rangeEntries = await computeSubmoduleRangeEntries(
       submoduleWorktreePath,
diff --git a/src/main/git/status-submodule.test.ts b/src/main/git/status-submodule.test.ts
index b67a4eca9a0..6528d373a78 100644
--- a/src/main/git/status-submodule.test.ts
+++ b/src/main/git/status-submodule.test.ts
@@ -395,4 +395,35 @@ describe('getSubmoduleStatus', () => {
     expect(result.didHitLimit).toBe(true)
     expect(result.statusLength).toBe(2)
   })
+
+  it('overlaps the inner status, index and HEAD reads instead of serializing them', async () => {
+    const OLD_OID = 'a'.repeat(40)
+    const NEW_OID = 'b'.repeat(40)
+    readFileMock.mockResolvedValue('gitdir: /repo/flutter_mine/.git\n')
+    existsSyncMock.mockReturnValue(false)
+    const events: string[] = []
+    gitExecFileAsyncMock.mockReset()
+    gitExecFileAsyncMock.mockImplementation(async (args: string[]) => {
+      const name = args.includes('status') ? 'status' : args[0]
+      events.push(`start:${name}`)
+      if (name === 'status') {
+        // Hold the inner status open so a serialized caller could not have started the oid reads.
+        await new Promise((resolve) => setTimeout(resolve, 5))
+      }
+      events.push(`end:${name}`)
+      if (name === 'ls-files') {
+        return { stdout: `160000 ${OLD_OID} 0\tflutter_mine\n` }
+      }
+      if (name === 'rev-parse') {
+        return { stdout: `${NEW_OID}\n` }
+      }
+      return { stdout: '' }
+    })
+
+    await getSubmoduleStatus('/repo', 'flutter_mine')
+
+    // Serialized reads only start ls-files/rev-parse once the inner status has resolved.
+    expect(events.indexOf('start:ls-files')).toBeLessThan(events.indexOf('end:status'))
+    expect(events.indexOf('start:rev-parse')).toBeLessThan(events.indexOf('end:status'))
+  })
 })

From f46823a30aaea81817d5f71801ced1f6dc403381 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:32:05 -0700
Subject: [PATCH 34/58] test(renderer): pin the runtime-target selector's
 identity stability (#18625)

#18685 landed the fix (select the host id, derive in useMemo) without a
regression guard. This is that guard: it drives 50 unrelated store writes and
asserts the consumer re-renders once and the returned target keeps its identity.
Confirmed to fail against the pre-#18685 hook (51 renders).
---
 .../use-worktree-runtime-target.test.ts       | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 src/renderer/src/runtime/use-worktree-runtime-target.test.ts

diff --git a/src/renderer/src/runtime/use-worktree-runtime-target.test.ts b/src/renderer/src/runtime/use-worktree-runtime-target.test.ts
new file mode 100644
index 00000000000..6e59c6e035d
--- /dev/null
+++ b/src/renderer/src/runtime/use-worktree-runtime-target.test.ts
@@ -0,0 +1,34 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, expect, it } from 'vitest'
+import { useAppStore } from '@/store'
+import { useWorktreeRuntimeTarget } from './use-worktree-runtime-target'
+
+const initialState = useAppStore.getInitialState()
+
+afterEach(() => {
+  cleanup()
+  useAppStore.setState(initialState, true)
+})
+
+it('keeps the runtime target identity stable across unrelated store writes', () => {
+  let renders = 0
+  const { result } = renderHook(() => {
+    renders += 1
+    return useWorktreeRuntimeTarget('worktree-1')
+  })
+
+  const first = result.current
+  const rendersAfterMount = renders
+
+  act(() => {
+    for (let index = 0; index < 50; index += 1) {
+      useAppStore.setState({ activeRepoId: `repo-${index}` })
+    }
+  })
+
+  // A selector that built the target object inline re-rendered on every write.
+  expect(renders).toBe(rendersAfterMount)
+  expect(result.current).toBe(first)
+})

From 1b692088b89a0a4f65c6a6afc5e50e87e871c429 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:32:16 -0700
Subject: [PATCH 35/58] perf(terminal): stop copying every PTY chunk for two
 startup-error detectors (#18626)

Both detectors ran a case-folding copy on every PTY chunk for the pane's whole
life, to answer a boolean that is read at most once.

git-bash-console-capacity lowercased carry+chunk per chunk. A match that was not
already found has to end inside the new chunk, and the marker's last character is
a digit, so a chunk without it can skip the copy and fold only the 44-char carry.

codex-backfill-error-detector allocated a lowercased copy of the full 4KB carry
per chunk; a precompiled case-insensitive regex tests the carry in place.
---
 .../codex-backfill-error-detector.ts          |  4 +++-
 .../git-bash-console-capacity.test.ts         | 23 +++++++++++++++++++
 .../git-bash-console-capacity.ts              | 14 ++++++++++-
 3 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/src/renderer/src/components/terminal-pane/codex-backfill-error-detector.ts b/src/renderer/src/components/terminal-pane/codex-backfill-error-detector.ts
index 7c95bd7e46c..508ab978101 100644
--- a/src/renderer/src/components/terminal-pane/codex-backfill-error-detector.ts
+++ b/src/renderer/src/components/terminal-pane/codex-backfill-error-detector.ts
@@ -9,6 +9,8 @@ const ANSI_ESCAPE_PATTERN =
   // eslint-disable-next-line no-control-regex -- terminal escape sequences contain control bytes
   /\u001b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\u0007\u001b]*(?:\u0007|\u001b\\)?)/g
 const DETECTOR_BUFFER_MAX_CHARS = 4096
+// Why a regex over toLowerCase(): the case-folded copy allocated the whole 4KB carry on every chunk.
+const CODEX_BACKFILL_TIMEOUT_PATTERN = new RegExp(CODEX_BACKFILL_TIMEOUT_SIGNATURE, 'i')
 
 export type CodexBackfillErrorDetector = { observe(chunk: string): string | null }
 
@@ -23,7 +25,7 @@ export function createCodexBackfillErrorDetector(): CodexBackfillErrorDetector {
       }
       const normalized = (tail + chunk).replace(ANSI_ESCAPE_PATTERN, '').replace(/\r/g, '')
       tail = normalized.slice(-DETECTOR_BUFFER_MAX_CHARS)
-      if (!tail.toLowerCase().includes(CODEX_BACKFILL_TIMEOUT_SIGNATURE)) {
+      if (!CODEX_BACKFILL_TIMEOUT_PATTERN.test(tail)) {
         return null
       }
       armed = false
diff --git a/src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts b/src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts
index 27067b16828..9b6258efa6d 100644
--- a/src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts
+++ b/src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts
@@ -11,6 +11,29 @@ describe('Git Bash console capacity detection', () => {
     expect(detector.detected()).toBe(true)
   })
 
+  it('detects the marker at every chunk boundary, in any case', () => {
+    const noisyPrefix = 'x'.repeat(200)
+    const stream = `${noisyPrefix}Console device allocation failure - TOO MANY CONSOLES In Use, Max Consoles Is 128\r\n`
+
+    for (let split = 0; split <= stream.length; split += 1) {
+      const detector = createGitBashConsoleCapacityDetector()
+      detector.observe(stream.slice(0, split))
+      detector.observe(stream.slice(split))
+      expect(detector.detected(), `split at ${split}`).toBe(true)
+    }
+  })
+
+  it('still matches when the carry is rebuilt by chunks that skip the fast path', () => {
+    const detector = createGitBashConsoleCapacityDetector()
+
+    // None of these chunks contain the marker's final character, so each takes the fast path.
+    detector.observe('too many consoles in use, ')
+    detector.observe('max consoles is ')
+    detector.observe('128')
+
+    expect(detector.detected()).toBe(true)
+  })
+
   it('ignores unrelated shell failures', () => {
     const detector = createGitBashConsoleCapacityDetector()
     detector.observe('bash: command not found')
diff --git a/src/renderer/src/components/terminal-pane/git-bash-console-capacity.ts b/src/renderer/src/components/terminal-pane/git-bash-console-capacity.ts
index 6f70a8b2a2e..4753c817ca8 100644
--- a/src/renderer/src/components/terminal-pane/git-bash-console-capacity.ts
+++ b/src/renderer/src/components/terminal-pane/git-bash-console-capacity.ts
@@ -1,4 +1,8 @@
 const GIT_BASH_CONSOLE_CAPACITY_MARKER = 'too many consoles in use, max consoles is 128'
+const CARRY_LENGTH = GIT_BASH_CONSOLE_CAPACITY_MARKER.length - 1
+// Why this char: a match that was not already found must end inside the new chunk, so the chunk has
+// to contain the marker's final character. It is a digit, so the test needs no case folding.
+const MARKER_FINAL_CHAR = GIT_BASH_CONSOLE_CAPACITY_MARKER.at(-1) as string
 
 export type GitBashConsoleCapacityDetector = {
   observe: (data: string) => void
@@ -14,9 +18,17 @@ export function createGitBashConsoleCapacityDetector(): GitBashConsoleCapacityDe
       if (matched || data.length === 0) {
         return
       }
+      if (!data.includes(MARKER_FINAL_CHAR)) {
+        // Fold only the carry instead of copying the whole chunk: this runs per PTY chunk per pane.
+        tail =
+          data.length >= CARRY_LENGTH
+            ? data.slice(-CARRY_LENGTH).toLowerCase()
+            : (tail + data).slice(-CARRY_LENGTH).toLowerCase()
+        return
+      }
       const candidate = (tail + data).toLowerCase()
       matched = candidate.includes(GIT_BASH_CONSOLE_CAPACITY_MARKER)
-      tail = candidate.slice(-(GIT_BASH_CONSOLE_CAPACITY_MARKER.length - 1))
+      tail = candidate.slice(-CARRY_LENGTH)
     },
     detected: () => matched
   }

From fb99bcc3a4778c8662bc3b2070c3ea6ebea58d68 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:32:27 -0700
Subject: [PATCH 36/58] perf(terminal): gate the Command Code banner scan
 before building its scan windows (#18628)

Every PTY chunk on every pane built two ~4KB scan windows and then, for panes
that have not shown the banner, stripped terminal control sequences three times
over them. The existing prefilter ran after that work and only required the
letters C, o and d, which nearly every code agent's output contains.

COMMAND_CODE_BANNER_RE requires a literal '#' and stripTerminalControl only
removes characters, so raw bytes without one cannot match. Check that against the
carry and the chunk before either window is built.
---
 src/shared/command-code-output-status.test.ts | 16 +++++++++++++++
 src/shared/command-code-output-status.ts      | 20 +++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/src/shared/command-code-output-status.test.ts b/src/shared/command-code-output-status.test.ts
index 77a8005056e..4ca0be25bbc 100644
--- a/src/shared/command-code-output-status.test.ts
+++ b/src/shared/command-code-output-status.test.ts
@@ -49,6 +49,22 @@ describe('createCommandCodeOutputStatusDetector', () => {
     expect(onWorking).toHaveBeenCalledWith('')
   })
 
+  it('detects the banner after chunks that carry no banner characters at all', () => {
+    const onWorking = vi.fn()
+    const detector = createCommandCodeOutputStatusDetector({
+      startupCommand: null,
+      onWorking
+    })
+
+    // Ordinary agent output with no '#': the raw prefilter skips these without building a window.
+    expect(detector.observe('Codex is editing the file and rendering a diff\r\n')).toBe(false)
+    expect(detector.observe('Codex wrote 12 lines\r\n')).toBe(false)
+    expect(detector.observe('# Command Code v0.27.2\r\n')).toBe(false)
+    expect(detector.observe('⌘ Parsing...')).toBe(true)
+
+    expect(onWorking).toHaveBeenCalledWith('')
+  })
+
   it('detects the Command Code banner when ANSI styling splits the words', () => {
     const onWorking = vi.fn()
     const detector = createCommandCodeOutputStatusDetector({
diff --git a/src/shared/command-code-output-status.ts b/src/shared/command-code-output-status.ts
index 16942674219..e98f72d857b 100644
--- a/src/shared/command-code-output-status.ts
+++ b/src/shared/command-code-output-status.ts
@@ -142,6 +142,21 @@ function rawTextMayContainCommandCodeBanner(rawText: string): boolean {
   return rawText.includes('C') && rawText.includes('o') && rawText.includes('d')
 }
 
+// COMMAND_CODE_BANNER_RE requires a literal '#', and stripTerminalControl only ever removes
+// characters, so raw bytes without one cannot produce a banner match.
+const BANNER_REQUIRED_RAW_CHAR = '#'
+
+/**
+ * Prefilter run against the raw chunk before the scan windows are built. Testing the whole carry
+ * plus chunk over-admits relative to the window test (the windows drop middle content), so it can
+ * never turn a match into a miss.
+ */
+function rawChunkMayContainCommandCodeBanner(previousRawText: string, data: string): boolean {
+  return (
+    data.includes(BANNER_REQUIRED_RAW_CHAR) || previousRawText.includes(BANNER_REQUIRED_RAW_CHAR)
+  )
+}
+
 function appendRecentRawText(previousRawText: string, data: string): string {
   if (data.length >= RECENT_TEXT_LIMIT) {
     return data.slice(-RECENT_TEXT_LIMIT)
@@ -233,6 +248,11 @@ export function createCommandCodeOutputStatusDetector(args: {
     observe(data: string): boolean {
       const previousRawText = recentRawText
       recentRawText = appendRecentRawText(previousRawText, data)
+      // Why before the windows: a non-Command-Code pane pays two ~4KB string builds per chunk
+      // otherwise, only to fail the same prefilter a few lines later.
+      if (!hasSeenCommandCodeUi && !rawChunkMayContainCommandCodeBanner(previousRawText, data)) {
+        return false
+      }
       const scanRawText = buildStatusScanRawText(previousRawText, data)
       const scanRawTextWithChunkBoundary = previousRawText
         ? buildStatusScanRawText(`${previousRawText}\n`, data)

From 9130c6ee6cacf79795f2dbc35ceada5cadd428fb Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:32:37 -0700
Subject: [PATCH 37/58] perf(editor): build the closing-fence pattern once per
 fence, not once per line (#18629)

markdownFenceRanges recompiled the closing-fence RegExp for every line inside an
open code fence, though it only depends on the fence's own marker and length.
A 100k-line fenced block went from 16.6ms to 5.8ms.
---
 .../src/components/editor/details-markdown-html.ts | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/src/renderer/src/components/editor/details-markdown-html.ts b/src/renderer/src/components/editor/details-markdown-html.ts
index 109005460dc..964c08f35d6 100644
--- a/src/renderer/src/components/editor/details-markdown-html.ts
+++ b/src/renderer/src/components/editor/details-markdown-html.ts
@@ -94,7 +94,7 @@ export function renderDetailsAttributes(attrs: Record<string, unknown> | undefin
 function markdownFenceRanges(content: string): MarkdownFenceRanges {
   const ranges: [number, number][] = []
   let offset = 0
-  let openFence: { marker: '`' | '~'; length: number; start: number } | null = null
+  let openFence: { closingPattern: RegExp; start: number } | null = null
 
   for (const lineMatch of content.matchAll(/[^\r\n]*(?:\r\n|\n|\r|$)/g)) {
     const line = lineMatch[0]
@@ -104,11 +104,8 @@ function markdownFenceRanges(content: string): MarkdownFenceRanges {
 
     const lineText = line.replace(/(?:\r\n|\n|\r)$/u, '')
     if (openFence) {
-      const closingFencePattern =
-        openFence.marker === '`'
-          ? new RegExp(`^ {0,3}\`{${openFence.length},}\\s*$`)
-          : new RegExp(`^ {0,3}~{${openFence.length},}\\s*$`)
-      if (closingFencePattern.test(lineText)) {
+      // Built once per fence: rebuilding it per line recompiled the same regex for every fenced line.
+      if (openFence.closingPattern.test(lineText)) {
         ranges.push([openFence.start, offset + line.length])
         openFence = null
       }
@@ -116,8 +113,9 @@ function markdownFenceRanges(content: string): MarkdownFenceRanges {
       const openingFenceMatch = lineText.match(/^ {0,3}(`{3,}|~{3,})/u)
       if (openingFenceMatch?.[1]) {
         openFence = {
-          marker: openingFenceMatch[1][0] as '`' | '~',
-          length: openingFenceMatch[1].length,
+          closingPattern: new RegExp(
+            `^ {0,3}${openingFenceMatch[1][0]}{${openingFenceMatch[1].length},}\\s*$`
+          ),
           start: offset
         }
       }

From 7ccabe50735b14ec39793f4077a5656301df1784 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:32:48 -0700
Subject: [PATCH 38/58] perf(right-sidebar): cache the active checks status
 instead of rebuilding its cache keys per store write (#18631)

* perf(right-sidebar): cache the active checks status instead of rebuilding its cache keys per store write

The right sidebar is always mounted, so getActiveChecksStatus ran on every store
write while it was open and rebuilt two provider cache-key strings plus a branch
regex replace each time, only to return the same scalar.

Memoize on the input references, matching selectFloatingVisibleTabCount.

* refactor(right-sidebar): derive the active checks cache key and parameter type from one key list

The cache was keyed on a hand-written field list that had to be kept in sync
with every store field computeActiveChecksStatus reads; missing one would leave
the sidebar checks badge silently stale.

Derive both the parameter type and the cache key from ACTIVE_CHECKS_STATUS_INPUT_KEYS
so TypeScript rejects reading a field the cache is not keyed on, and add a Proxy
test that records every property actually read and fails on any unkeyed one.
---
 .../active-checks-status.test.ts              | 76 ++++++++++++++++++-
 .../right-sidebar/active-checks-status.ts     | 62 +++++++++++++--
 2 files changed, 131 insertions(+), 7 deletions(-)

diff --git a/src/renderer/src/components/right-sidebar/active-checks-status.test.ts b/src/renderer/src/components/right-sidebar/active-checks-status.test.ts
index 2686937c345..5bf09276c72 100644
--- a/src/renderer/src/components/right-sidebar/active-checks-status.test.ts
+++ b/src/renderer/src/components/right-sidebar/active-checks-status.test.ts
@@ -1,5 +1,9 @@
-import { describe, expect, it } from 'vitest'
-import { getActiveChecksStatus } from './active-checks-status'
+import { beforeEach, describe, expect, it } from 'vitest'
+import {
+  ACTIVE_CHECKS_STATUS_INPUT_KEYS,
+  clearActiveChecksStatusCacheForTests,
+  getActiveChecksStatus
+} from './active-checks-status'
 import type { AppState } from '../../store/types'
 import type { PRInfo } from '../../../../shared/github/pull-request-types'
 
@@ -16,6 +20,10 @@ function makePR(status: PRInfo['checksStatus']): PRInfo {
 }
 
 describe('getActiveChecksStatus', () => {
+  beforeEach(() => {
+    clearActiveChecksStatusCacheForTests()
+  })
+
   it('prefers repo-id scoped status over stale path-scoped status for the active worktree', () => {
     const state = {
       activeWorktreeId: 'wt-1',
@@ -125,3 +133,67 @@ describe('getActiveChecksStatus', () => {
     expect(getActiveChecksStatus(state)).toBeNull()
   })
 })
+
+describe('getActiveChecksStatus caching', () => {
+  beforeEach(() => {
+    clearActiveChecksStatusCacheForTests()
+  })
+
+  function makeState(prCache: Record<string, unknown>) {
+    return {
+      activeWorktreeId: 'wt-1',
+      repos: [{ id: 'repo-1', path: '/repo' }],
+      worktreesByRepo: {
+        'repo-1': [{ id: 'wt-1', repoId: 'repo-1', branch: 'refs/heads/feature/test' }]
+      },
+      prCache
+    } as unknown as Pick<AppState, 'activeWorktreeId' | 'repos' | 'worktreesByRepo' | 'prCache'>
+  }
+
+  it('reuses the cached status when every input reference is unchanged', () => {
+    const prCache = { 'repo-1::feature/test': { data: makePR('success'), fetchedAt: 2 } }
+    const state = makeState(prCache)
+
+    expect(getActiveChecksStatus(state)).toBe('success')
+    // A different state object carrying the same field references must still hit the cache.
+    expect(getActiveChecksStatus({ ...state })).toBe('success')
+  })
+
+  it('recomputes when a keyed input reference changes', () => {
+    expect(
+      getActiveChecksStatus(
+        makeState({ 'repo-1::feature/test': { data: makePR('success'), fetchedAt: 2 } })
+      )
+    ).toBe('success')
+    expect(
+      getActiveChecksStatus(
+        makeState({ 'repo-1::feature/test': { data: makePR('failure'), fetchedAt: 3 } })
+      )
+    ).toBe('failure')
+  })
+
+  it('reads no store field the cache is not keyed on', () => {
+    // Guards against a cast or widened type bypassing the derived key list: every property the
+    // computation touches on the state object must invalidate the cache.
+    const reads = new Set<PropertyKey>()
+    const keyed = new Set<PropertyKey>(ACTIVE_CHECKS_STATUS_INPUT_KEYS)
+    const state = new Proxy(
+      makeState({ 'repo-1::feature/test': { data: makePR('success'), fetchedAt: 2 } }),
+      {
+        get(target, prop, receiver) {
+          reads.add(prop)
+          return Reflect.get(target, prop, receiver)
+        },
+        has(target, prop) {
+          reads.add(prop)
+          return Reflect.has(target, prop)
+        }
+      }
+    )
+
+    expect(getActiveChecksStatus(state)).toBe('success')
+    expect([...reads].filter((prop) => !keyed.has(prop))).toEqual([])
+    // The read set must also be non-trivial, or the guard proves nothing.
+    expect(reads.has('prCache')).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/active-checks-status.ts b/src/renderer/src/components/right-sidebar/active-checks-status.ts
index d6f29e80658..9f1e08a03ba 100644
--- a/src/renderer/src/components/right-sidebar/active-checks-status.ts
+++ b/src/renderer/src/components/right-sidebar/active-checks-status.ts
@@ -5,17 +5,69 @@ import { getGitHubPRCacheKey } from '../../store/slices/github-cache-key'
 import { getHostedReviewCacheKey } from '../../store/slices/hosted-review-cache-identity'
 import { isGitHubPRSuppressed } from '../../../../shared/worktree/github-pr-suppression'
 
-type ActiveChecksStatusState = Pick<
-  AppState,
-  'activeWorktreeId' | 'worktreesByRepo' | 'repos' | 'prCache'
-> &
-  Partial<Pick<AppState, 'settings' | 'hostedReviewCache'>>
+// Why one list: the parameter type and the cache key both derive from it, so a new store field
+// cannot be read here (TS rejects it) without also invalidating the cache on it.
+const REQUIRED_INPUT_KEYS = [
+  'activeWorktreeId',
+  'worktreesByRepo',
+  'repos',
+  'prCache'
+] as const satisfies readonly (keyof AppState)[]
+const OPTIONAL_INPUT_KEYS = [
+  'settings',
+  'hostedReviewCache'
+] as const satisfies readonly (keyof AppState)[]
+/** @internal Every store field getActiveChecksStatus may read; the cache invalidates on any of them. */
+export const ACTIVE_CHECKS_STATUS_INPUT_KEYS = [
+  ...REQUIRED_INPUT_KEYS,
+  ...OPTIONAL_INPUT_KEYS
+] as const
+
+type ActiveChecksStatusState = Pick<AppState, (typeof REQUIRED_INPUT_KEYS)[number]> &
+  Partial<Pick<AppState, (typeof OPTIONAL_INPUT_KEYS)[number]>>
+type ActiveChecksStatusInputs = {
+  [K in (typeof ACTIVE_CHECKS_STATUS_INPUT_KEYS)[number]]: ActiveChecksStatusState[K]
+}
 
 function branchDisplayName(branch: string): string {
   return branch.replace(/^refs\/heads\//, '')
 }
 
+// Why cached: the right sidebar is always mounted, so this ran on every store write and rebuilt two
+// cache-key strings each time. Same single-entry, reference-keyed shape as selectFloatingVisibleTabCount.
+let activeChecksStatusCache: {
+  inputs: ActiveChecksStatusInputs
+  status: CheckStatus | null
+} | null = null
+
+/** @internal */
+export function clearActiveChecksStatusCacheForTests(): void {
+  activeChecksStatusCache = null
+}
+
+function hasSameInputs(inputs: ActiveChecksStatusInputs, state: ActiveChecksStatusState): boolean {
+  for (const key of ACTIVE_CHECKS_STATUS_INPUT_KEYS) {
+    if (inputs[key] !== state[key]) {
+      return false
+    }
+  }
+  return true
+}
+
 export function getActiveChecksStatus(state: ActiveChecksStatusState): CheckStatus | null {
+  const cached = activeChecksStatusCache
+  if (cached && hasSameInputs(cached.inputs, state)) {
+    return cached.status
+  }
+  const status = computeActiveChecksStatus(state)
+  const inputs = Object.fromEntries(
+    ACTIVE_CHECKS_STATUS_INPUT_KEYS.map((key) => [key, state[key]])
+  ) as ActiveChecksStatusInputs
+  activeChecksStatusCache = { inputs, status }
+  return status
+}
+
+function computeActiveChecksStatus(state: ActiveChecksStatusState): CheckStatus | null {
   const activeWorktree = state.activeWorktreeId
     ? (getWorktreeMapFromState(state).get(state.activeWorktreeId) ?? null)
     : null

From 6093b9f058ce0d79ef6a467968ec90e363869edc Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:32:55 -0700
Subject: [PATCH 39/58] perf(renderer): stop two store selectors allocating on
 every write (#18632)

The Claude and Codex account sync keys stringify a runtime map and join the whole
managed-account roster. Both are pure functions of settings, but they ran inside
useAppStore selectors, which Zustand re-runs on every store write. Memoize both
on settings identity in one shared module.

terminalTabLivenessMatches ran on every tab write including title frames and
allocated an [index, value] tuple per worktree and per tab in each changed
bucket; indexed loops visit the same entries in the same order.
---
 .../status-bar/ClaudeSwitcherMenu.tsx         |  9 +---
 .../status-bar/codex-switcher-projection.ts   |  8 +---
 .../provider-account-sync-key.test.ts         | 42 +++++++++++++++++++
 .../status-bar/provider-account-sync-key.ts   | 42 +++++++++++++++++++
 .../hooks/agent-hook-completion-store-sync.ts |  8 +++-
 5 files changed, 93 insertions(+), 16 deletions(-)
 create mode 100644 src/renderer/src/components/status-bar/provider-account-sync-key.test.ts
 create mode 100644 src/renderer/src/components/status-bar/provider-account-sync-key.ts

diff --git a/src/renderer/src/components/status-bar/ClaudeSwitcherMenu.tsx b/src/renderer/src/components/status-bar/ClaudeSwitcherMenu.tsx
index c5414d66d9a..2e159c67018 100644
--- a/src/renderer/src/components/status-bar/ClaudeSwitcherMenu.tsx
+++ b/src/renderer/src/components/status-bar/ClaudeSwitcherMenu.tsx
@@ -34,6 +34,7 @@ import {
 import { AccountRuntimeToggle } from './StatusBarAccountControls'
 import { InlineUsageBars, InlineUsageSkeleton } from './InlineProviderUsage'
 import { ProviderDetailsMenu } from './ProviderDetailsMenu'
+import { getClaudeAccountSyncKey } from './provider-account-sync-key'
 
 // Exported so its account-switch/reset logic is preserved for row drill-in even
 // though the footer now opens the consolidated UsageRosterPanel first.
@@ -83,13 +84,7 @@ export function ClaudeSwitcherMenu({
     getWindowsTerminalCapabilityOwnerKey(settings?.activeRuntimeEnvironmentId),
     runtimeTarget
   )
-  const claudeAccountSyncKey = useAppStore((s) => {
-    const settings = s.settings
-    if (!settings) {
-      return 'no-settings'
-    }
-    return `${settings.activeRuntimeEnvironmentId?.trim() || 'local'}:${settings.activeClaudeManagedAccountId ?? 'system'}:${JSON.stringify(settings.activeClaudeManagedAccountIdsByRuntime ?? null)}:${settings.claudeManagedAccounts.map((account) => `${account.id}:${account.updatedAt}`).join('|')}`
-  })
+  const claudeAccountSyncKey = useAppStore((s) => getClaudeAccountSyncKey(s.settings))
   const accountState = resolveClaudeStatusAccountState(settings, accounts)
 
   useEffect(() => {
diff --git a/src/renderer/src/components/status-bar/codex-switcher-projection.ts b/src/renderer/src/components/status-bar/codex-switcher-projection.ts
index 192f8d76fd9..5bddcce53f2 100644
--- a/src/renderer/src/components/status-bar/codex-switcher-projection.ts
+++ b/src/renderer/src/components/status-bar/codex-switcher-projection.ts
@@ -1,13 +1,7 @@
-import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { ProviderRateLimits } from '../../../../shared/rate-limit-types'
 import { formatResetCreditExpiry } from './tooltip'
 
-export function getCodexAccountSyncKey(settings: GlobalSettings | null | undefined): string {
-  if (!settings) {
-    return 'no-settings'
-  }
-  return `${settings.activeRuntimeEnvironmentId?.trim() || 'local'}:${settings.activeCodexManagedAccountId ?? 'system'}:${JSON.stringify(settings.activeCodexManagedAccountIdsByRuntime ?? null)}:${settings.codexManagedAccounts.map((account) => `${account.id}:${account.updatedAt}`).join('|')}`
-}
+export { getCodexAccountSyncKey } from './provider-account-sync-key'
 
 export function getCodexResetProjection(
   codex: ProviderRateLimits,
diff --git a/src/renderer/src/components/status-bar/provider-account-sync-key.test.ts b/src/renderer/src/components/status-bar/provider-account-sync-key.test.ts
new file mode 100644
index 00000000000..7931bb1598b
--- /dev/null
+++ b/src/renderer/src/components/status-bar/provider-account-sync-key.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+import { getClaudeAccountSyncKey, getCodexAccountSyncKey } from './provider-account-sync-key'
+
+function makeSettings(overrides: Partial<GlobalSettings> = {}): GlobalSettings {
+  return {
+    activeRuntimeEnvironmentId: null,
+    activeClaudeManagedAccountId: null,
+    activeClaudeManagedAccountIdsByRuntime: null,
+    claudeManagedAccounts: [{ id: 'a1', updatedAt: 5 }],
+    activeCodexManagedAccountId: null,
+    activeCodexManagedAccountIdsByRuntime: null,
+    codexManagedAccounts: [{ id: 'c1', updatedAt: 7 }],
+    ...overrides
+  } as unknown as GlobalSettings
+}
+
+describe.each([
+  ['claude', getClaudeAccountSyncKey],
+  ['codex', getCodexAccountSyncKey]
+])('%s account sync key', (_provider, getSyncKey) => {
+  it('returns the same string for the same settings identity', () => {
+    const settings = makeSettings()
+    expect(getSyncKey(settings)).toBe(getSyncKey(settings))
+  })
+
+  it('answers no-settings when settings are absent', () => {
+    expect(getSyncKey(null)).toBe('no-settings')
+    expect(getSyncKey(undefined)).toBe('no-settings')
+  })
+
+  it('recomputes for a new settings identity', () => {
+    const first = getSyncKey(makeSettings())
+    const second = getSyncKey(
+      makeSettings({
+        claudeManagedAccounts: [{ id: 'a1', updatedAt: 6 }],
+        codexManagedAccounts: [{ id: 'c1', updatedAt: 8 }]
+      } as unknown as Partial<GlobalSettings>)
+    )
+    expect(second).not.toBe(first)
+  })
+})
diff --git a/src/renderer/src/components/status-bar/provider-account-sync-key.ts b/src/renderer/src/components/status-bar/provider-account-sync-key.ts
new file mode 100644
index 00000000000..acc8e3e9867
--- /dev/null
+++ b/src/renderer/src/components/status-bar/provider-account-sync-key.ts
@@ -0,0 +1,42 @@
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+
+// Why memoized on settings identity: these run inside useAppStore selectors, which Zustand re-runs
+// on every store write. Building the key stringifies a map and joins the whole managed-account
+// roster, and its inputs only move when `settings` is replaced.
+const claudeKeyBySettings = new WeakMap<GlobalSettings, string>()
+const codexKeyBySettings = new WeakMap<GlobalSettings, string>()
+
+function memoizeSyncKey(
+  cache: WeakMap<GlobalSettings, string>,
+  settings: GlobalSettings | null | undefined,
+  build: (settings: GlobalSettings) => string
+): string {
+  if (!settings) {
+    return 'no-settings'
+  }
+  const cached = cache.get(settings)
+  if (cached !== undefined) {
+    return cached
+  }
+  const key = build(settings)
+  cache.set(settings, key)
+  return key
+}
+
+export function getClaudeAccountSyncKey(settings: GlobalSettings | null | undefined): string {
+  return memoizeSyncKey(
+    claudeKeyBySettings,
+    settings,
+    (resolved) =>
+      `${resolved.activeRuntimeEnvironmentId?.trim() || 'local'}:${resolved.activeClaudeManagedAccountId ?? 'system'}:${JSON.stringify(resolved.activeClaudeManagedAccountIdsByRuntime ?? null)}:${resolved.claudeManagedAccounts.map((account) => `${account.id}:${account.updatedAt}`).join('|')}`
+  )
+}
+
+export function getCodexAccountSyncKey(settings: GlobalSettings | null | undefined): string {
+  return memoizeSyncKey(
+    codexKeyBySettings,
+    settings,
+    (resolved) =>
+      `${resolved.activeRuntimeEnvironmentId?.trim() || 'local'}:${resolved.activeCodexManagedAccountId ?? 'system'}:${JSON.stringify(resolved.activeCodexManagedAccountIdsByRuntime ?? null)}:${resolved.codexManagedAccounts.map((account) => `${account.id}:${account.updatedAt}`).join('|')}`
+  )
+}
diff --git a/src/renderer/src/hooks/agent-hook-completion-store-sync.ts b/src/renderer/src/hooks/agent-hook-completion-store-sync.ts
index fc47a20205a..12c7d9102d6 100644
--- a/src/renderer/src/hooks/agent-hook-completion-store-sync.ts
+++ b/src/renderer/src/hooks/agent-hook-completion-store-sync.ts
@@ -48,7 +48,10 @@ function terminalTabLivenessMatches(
     return false
   }
 
-  for (const [worktreeIndex, worktreeId] of currentWorktreeIds.entries()) {
+  // Indexed loops, not .entries(): this runs on every tab write including title frames, and the
+  // iterator allocated a [index, value] tuple per worktree and per tab in each changed bucket.
+  for (let worktreeIndex = 0; worktreeIndex < currentWorktreeIds.length; worktreeIndex += 1) {
+    const worktreeId = currentWorktreeIds[worktreeIndex]
     // Why: duplicate tab ids use first-worktree-wins lookup semantics, so a
     // worktree-key reorder is a liveness change even when every array is reused.
     if (previousWorktreeIds[worktreeIndex] !== worktreeId) {
@@ -62,7 +65,8 @@ function terminalTabLivenessMatches(
     if (!currentTabs || !previousTabs || currentTabs.length !== previousTabs.length) {
       return false
     }
-    for (const [tabIndex, currentTab] of currentTabs.entries()) {
+    for (let tabIndex = 0; tabIndex < currentTabs.length; tabIndex += 1) {
+      const currentTab = currentTabs[tabIndex]
       visitTab?.()
       const previousTab = previousTabs[tabIndex]
       if (

From 537a75c94dab95301c8e79d194b1059ac5a34a46 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:33:06 -0700
Subject: [PATCH 40/58] perf(source-control): stop reconciling selection on
 every panel render (#18637)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

reconcileSourceControlSelectionState was called straight from the hook body, so
it reran on every Source Control render — every commit-message keystroke and
every status poll — and built a Set over every visible row to prune a selection
that had not moved.

Add an early return for the common empty-selection case and memoize the call on
its three inputs. At 500 changed files the empty case drops from 13.10µs to
0.03µs per call.
---
 .../source-control/listing/use-selection.ts   | 17 +++++----
 .../useSourceControlSelection.test.ts         | 35 +++++++++++++++++++
 2 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/src/renderer/src/components/right-sidebar/source-control/listing/use-selection.ts b/src/renderer/src/components/right-sidebar/source-control/listing/use-selection.ts
index 635ec2102f3..c76576d50dd 100644
--- a/src/renderer/src/components/right-sidebar/source-control/listing/use-selection.ts
+++ b/src/renderer/src/components/right-sidebar/source-control/listing/use-selection.ts
@@ -1,4 +1,4 @@
-import { useState, useCallback, useEffect, useRef, type RefObject } from 'react'
+import { useState, useCallback, useEffect, useMemo, useRef, type RefObject } from 'react'
 import type { GitStatusEntry } from '../../../../../../shared/git-status-types'
 import type { SourceControlRowOpenEvent } from './split-open'
 
@@ -34,6 +34,10 @@ export function reconcileSourceControlSelectionState(args: {
   flatEntries: FlatEntry[]
 }): { selectedKeys: ReadonlySet<string>; anchorKey: string | null } {
   const { anchorKey, flatEntries, selectedKeys } = args
+  // Nothing to prune and no anchor to invalidate: skip building the key set over every visible row.
+  if (selectedKeys.size === 0 && anchorKey === null) {
+    return { selectedKeys, anchorKey }
+  }
   const validKeys = new Set(flatEntries.map((e) => e.key))
   const nextSelected = new Set<string>()
   let selectedChanged = false
@@ -111,11 +115,12 @@ export function useSourceControlSelection({
     shouldOpenAsSplitRef.current = shouldOpenAsSplit
   }, [shouldOpenAsSplit])
 
-  const reconciledSelection = reconcileSourceControlSelectionState({
-    selectedKeys,
-    anchorKey,
-    flatEntries
-  })
+  // Memoized: this hook re-runs on every Source Control panel render (commit-message keystrokes,
+  // status polls), but the reconciliation only moves when one of these three references does.
+  const reconciledSelection = useMemo(
+    () => reconcileSourceControlSelectionState({ selectedKeys, anchorKey, flatEntries }),
+    [selectedKeys, anchorKey, flatEntries]
+  )
   if (reconciledSelection.selectedKeys !== selectedKeys) {
     // Why: visible source-control rows can disappear after filtering, staging,
     // or status refresh; prune stale bulk-action keys before children see them.
diff --git a/src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts b/src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts
index 7821b7f07f5..574d2c5c708 100644
--- a/src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts
+++ b/src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts
@@ -38,6 +38,41 @@ describe('reconcileSelectionKeys', () => {
 })
 
 describe('reconcileSourceControlSelectionState', () => {
+  it('returns the same references without scanning rows when nothing is selected', () => {
+    const selectedKeys: ReadonlySet<string> = new Set()
+    let keyReads = 0
+    const flatEntries = Array.from({ length: 50 }, (_, index) => ({
+      get key() {
+        keyReads += 1
+        return `file-${index}.ts`
+      }
+    })) as unknown as Parameters<typeof reconcileSourceControlSelectionState>[0]['flatEntries']
+
+    const result = reconcileSourceControlSelectionState({
+      selectedKeys,
+      anchorKey: null,
+      flatEntries
+    })
+
+    expect(keyReads).toBe(0)
+    expect(result.selectedKeys).toBe(selectedKeys)
+    expect(result.anchorKey).toBeNull()
+  })
+
+  it('still drops an anchor that is no longer visible when nothing is selected', () => {
+    const selectedKeys: ReadonlySet<string> = new Set()
+    const result = reconcileSourceControlSelectionState({
+      selectedKeys,
+      anchorKey: 'gone.ts',
+      flatEntries: [{ key: 'kept.ts' }] as unknown as Parameters<
+        typeof reconcileSourceControlSelectionState
+      >[0]['flatEntries']
+    })
+
+    expect(result.anchorKey).toBeNull()
+    expect(result.selectedKeys).toBe(selectedKeys)
+  })
+
   it('keeps selected keys and anchor identity when all keys are still visible', () => {
     const flatEntries = [
       makeEntry('unstaged::a.ts', 'unstaged', 'a.ts'),

From 1b4159a3187bdf4f5731829a37988b85f91f2ca0 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:33:17 -0700
Subject: [PATCH 41/58] perf(sidebar): stop building host projections the row
 model throws away (#18638)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* perf(sidebar): stop building host projections the row model throws away

getMixedHostContextLabels built a label map for every visible worktree and then
returned undefined unless two distinct hosts existed — so a single-host install,
the common case, paid the whole build on every buildRows rebuild. Decide first,
then build only when it is mixed.

getHostWorktreeCounts repeated getHostWorktreeIds' dedupe walk to compute a
number that is exactly the id list's length, and both loops built the identity
string twice per row. Derive the counts and hoist the identity.

* fix(test): correct the worktree types import path and drop an unused parameter
---
 .../grouping/host-labels.test.ts              | 62 +++++++++++++++++++
 .../worktree-list/grouping/host-labels.ts     | 24 +++----
 .../worktree/host-context-labels.test.ts      | 53 ++++++++++++++++
 src/shared/worktree/host-context-labels.ts    | 28 +++++++--
 4 files changed, 151 insertions(+), 16 deletions(-)
 create mode 100644 src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts
 create mode 100644 src/shared/worktree/host-context-labels.test.ts

diff --git a/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts b/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts
new file mode 100644
index 00000000000..7411dc00d6a
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts
@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest'
+import type { ExecutionHostId } from '../../../../../../shared/execution-host'
+import type { Repo } from '../../../../../../shared/repo-types'
+import type { Worktree } from '../../../../../../shared/worktree/types'
+import { getHostWorktreeCounts, getHostWorktreeIds } from './host-labels'
+
+const LOCAL = 'local' as ExecutionHostId
+
+function makeRepos(hostByRepo: Record<string, ExecutionHostId | undefined>): Map<string, Repo> {
+  return new Map(
+    Object.entries(hostByRepo).map(([id, executionHostId]) => [
+      id,
+      { id, path: `/${id}`, ...(executionHostId ? { executionHostId } : {}) } as Repo
+    ])
+  )
+}
+
+function makeWorktrees(rows: { id: string; repoId: string }[]): Worktree[] {
+  return rows.map((row) => row as Worktree)
+}
+
+describe('host worktree counts and ids', () => {
+  it('reports a count equal to the length of each host id list', () => {
+    const repoMap = makeRepos({
+      'repo-local': undefined,
+      'repo-remote': 'ssh:other' as ExecutionHostId
+    })
+    const worktrees = makeWorktrees([
+      { id: 'a', repoId: 'repo-local' },
+      { id: 'b', repoId: 'repo-local' },
+      { id: 'c', repoId: 'repo-remote' }
+    ])
+
+    const counts = getHostWorktreeCounts(worktrees, repoMap, LOCAL)
+    const ids = getHostWorktreeIds(worktrees, repoMap, LOCAL)
+
+    expect(ids).toBeDefined()
+    expect(counts).toBeDefined()
+    for (const [hostId, hostIds] of ids ?? []) {
+      expect(counts?.get(hostId), `count for ${hostId}`).toBe(hostIds.length)
+    }
+    expect([...(counts?.keys() ?? [])].sort()).toEqual([...(ids?.keys() ?? [])].sort())
+  })
+
+  it('counts a repeated host identity once', () => {
+    const repoMap = makeRepos({ 'repo-local': undefined })
+    const worktrees = makeWorktrees([
+      { id: 'a', repoId: 'repo-local' },
+      { id: 'a', repoId: 'repo-local' },
+      { id: 'b', repoId: 'repo-local' }
+    ])
+
+    expect(getHostWorktreeCounts(worktrees, repoMap, LOCAL)?.get(LOCAL)).toBe(2)
+    expect(getHostWorktreeIds(worktrees, repoMap, LOCAL)?.get(LOCAL)).toEqual(['a', 'b'])
+  })
+
+  it('returns undefined for an empty lane', () => {
+    const repoMap = makeRepos({})
+    expect(getHostWorktreeCounts([], repoMap, LOCAL)).toBeUndefined()
+    expect(getHostWorktreeIds([], repoMap, LOCAL)).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.ts b/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.ts
index d1c5c8be2d4..925b04eed41 100644
--- a/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.ts
@@ -153,17 +153,17 @@ export function getHostWorktreeCounts(
   if (worktrees.length === 0) {
     return undefined
   }
-  const counts = new Map<ExecutionHostId, number>()
+  // Derived from the id map rather than repeating its dedupe walk: every caller asks for both,
+  // and a host's count is exactly the length of its id list by construction.
   // Dedup by host, not by bare id: the same id on two hosts is two workspaces
   // and has to be counted under each of them (STA-4343).
-  const seenIdentities = new Set<string>()
-  for (const worktree of worktrees) {
-    if (seenIdentities.has(getWorktreeHostIdentity(worktree))) {
-      continue
-    }
-    seenIdentities.add(getWorktreeHostIdentity(worktree))
-    const hostId = getWorktreeExecutionHostId(worktree, repoMap.get(worktree.repoId), defaultHostId)
-    counts.set(hostId, (counts.get(hostId) ?? 0) + 1)
+  const idsByHost = getHostWorktreeIds(worktrees, repoMap, defaultHostId)
+  if (!idsByHost) {
+    return undefined
+  }
+  const counts = new Map<ExecutionHostId, number>()
+  for (const [hostId, ids] of idsByHost) {
+    counts.set(hostId, ids.length)
   }
   return counts
 }
@@ -179,10 +179,12 @@ export function getHostWorktreeIds(
   const idsByHost = new Map<ExecutionHostId, string[]>()
   const seenIdentities = new Set<string>()
   for (const worktree of worktrees) {
-    if (seenIdentities.has(getWorktreeHostIdentity(worktree))) {
+    // Hoisted: the identity string was built twice per row, once to test and once to record.
+    const identity = getWorktreeHostIdentity(worktree)
+    if (seenIdentities.has(identity)) {
       continue
     }
-    seenIdentities.add(getWorktreeHostIdentity(worktree))
+    seenIdentities.add(identity)
     const hostId = getWorktreeExecutionHostId(worktree, repoMap.get(worktree.repoId), defaultHostId)
     const ids = idsByHost.get(hostId) ?? []
     ids.push(worktree.id)
diff --git a/src/shared/worktree/host-context-labels.test.ts b/src/shared/worktree/host-context-labels.test.ts
new file mode 100644
index 00000000000..ccea06a25ed
--- /dev/null
+++ b/src/shared/worktree/host-context-labels.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest'
+import type { ExecutionHostId } from '../execution-host'
+import { getMixedHostContextLabels } from './host-context-labels'
+
+type Item = { id: string; hostId: ExecutionHostId }
+
+function argsFor(counters: { hostIdReads: number; identityReads: number }) {
+  return {
+    getHostId: (item: Item): ExecutionHostId => {
+      counters.hostIdReads += 1
+      return item.hostId
+    },
+    getIdentity: (item: Item): string => {
+      counters.identityReads += 1
+      return item.id
+    }
+  }
+}
+
+describe('getMixedHostContextLabels', () => {
+  it('returns undefined without building any labels when every item shares one host', () => {
+    const items: Item[] = Array.from({ length: 50 }, (_, index) => ({
+      id: `wt-${index}`,
+      hostId: 'local' as ExecutionHostId
+    }))
+    const counters = { hostIdReads: 0, identityReads: 0 }
+
+    expect(getMixedHostContextLabels(items, argsFor(counters))).toBeUndefined()
+    // The label map was built for all 50 and thrown away before; now nothing is built.
+    expect(counters.identityReads).toBe(0)
+  })
+
+  it('labels every item once a second host appears, wherever it appears', () => {
+    for (const lateIndex of [1, 25, 49]) {
+      const items: Item[] = Array.from({ length: 50 }, (_, index) => ({
+        id: `wt-${index}`,
+        hostId: (index === lateIndex ? 'ssh:other' : 'local') as ExecutionHostId
+      }))
+      const counters = { hostIdReads: 0, identityReads: 0 }
+
+      const labels = getMixedHostContextLabels(items, argsFor(counters))
+
+      expect(labels, `second host at index ${lateIndex}`).toBeDefined()
+      expect(labels?.size).toBe(50)
+      expect(labels?.has(`wt-${lateIndex}`)).toBe(true)
+    }
+  })
+
+  it('returns undefined for an empty list', () => {
+    const counters = { hostIdReads: 0, identityReads: 0 }
+    expect(getMixedHostContextLabels([], argsFor(counters))).toBeUndefined()
+  })
+})
diff --git a/src/shared/worktree/host-context-labels.ts b/src/shared/worktree/host-context-labels.ts
index 4b9481c441b..d3ab9ed2ed7 100644
--- a/src/shared/worktree/host-context-labels.ts
+++ b/src/shared/worktree/host-context-labels.ts
@@ -83,12 +83,30 @@ export function getMixedHostContextLabels<T>(
     sources?: HostContextLabelSources
   }
 ): Map<string, string> | undefined {
-  const labelsByIdentity = new Map<string, string>()
-  const hostIds = new Set<ExecutionHostId>()
+  // Why two passes: on a single-host install the map is built for every item and then discarded.
+  // Deciding first costs one getHostId per item and skips the label work entirely.
+  let firstHostId: ExecutionHostId | undefined
+  let isMixed = false
   for (const item of items) {
     const hostId = args.getHostId(item)
-    hostIds.add(hostId)
-    labelsByIdentity.set(args.getIdentity(item), getHostContextLabel(hostId, args.sources))
+    if (firstHostId === undefined) {
+      firstHostId = hostId
+      continue
+    }
+    if (hostId !== firstHostId) {
+      isMixed = true
+      break
+    }
   }
-  return hostIds.size > 1 ? labelsByIdentity : undefined
+  if (!isMixed) {
+    return undefined
+  }
+  const labelsByIdentity = new Map<string, string>()
+  for (const item of items) {
+    labelsByIdentity.set(
+      args.getIdentity(item),
+      getHostContextLabel(args.getHostId(item), args.sources)
+    )
+  }
+  return labelsByIdentity
 }

From a7223be538751342e50fc07d93c7dfa5982d1909 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:33:28 -0700
Subject: [PATCH 42/58] perf(agent-hooks): find spool newlines with
 Buffer.indexOf, not a per-byte loop (#18639)

readSpoolFile walked every byte of every spooled JSONL file in an interpreted
loop to locate newlines. drainAgentHookSpool runs inside start() before the hook
listener binds, over up to AGENT_HOOK_SPOOL_MAX_FILES files, so this sits on the
startup path.

Buffer.indexOf reaches the same newlines via memchr. A 5.3MB spool file drops
from 32.50ms to 9.26ms per read. The torn-trailing-line contract is unchanged:
a final line with no newline is still left unconsumed.
---
 src/shared/agent-hook-spool-read.test.ts | 65 ++++++++++++++++++++++++
 src/shared/agent-hook-spool.ts           | 14 +++--
 2 files changed, 71 insertions(+), 8 deletions(-)
 create mode 100644 src/shared/agent-hook-spool-read.test.ts

diff --git a/src/shared/agent-hook-spool-read.test.ts b/src/shared/agent-hook-spool-read.test.ts
new file mode 100644
index 00000000000..d589f5b2274
--- /dev/null
+++ b/src/shared/agent-hook-spool-read.test.ts
@@ -0,0 +1,65 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { readSpoolFile } from './agent-hook-spool'
+
+let dir: string
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'orca-spool-read-'))
+})
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+function write(contents: string): string {
+  const file = join(dir, 'spool.jsonl')
+  writeFileSync(file, contents)
+  return file
+}
+
+function record(paneKey: string): string {
+  return JSON.stringify({ paneKey, source: 'PreToolUse', payload: {}, receivedAt: Date.now() })
+}
+
+describe('readSpoolFile', () => {
+  it('leaves a trailing line without its newline unconsumed', () => {
+    const complete = `${record('a')}\n`
+    const result = readSpoolFile(write(`${complete}${record('b')}`))
+
+    expect(result.records.map((entry) => entry.paneKey)).toEqual(['a'])
+    // The in-flight final record must stay replayable: consumed stops at the last newline.
+    expect(result.consumed).toBe(Buffer.byteLength(complete))
+  })
+
+  it('consumes through the final newline when every line is complete', () => {
+    const contents = `${record('a')}\n${record('b')}\n`
+    const result = readSpoolFile(write(contents))
+
+    expect(result.records.map((entry) => entry.paneKey)).toEqual(['a', 'b'])
+    expect(result.consumed).toBe(Buffer.byteLength(contents))
+  })
+
+  it('skips blank lines without consuming less than the bytes they occupy', () => {
+    const contents = `${record('a')}\n\n\n${record('b')}\n`
+    const result = readSpoolFile(write(contents))
+
+    expect(result.records.map((entry) => entry.paneKey)).toEqual(['a', 'b'])
+    expect(result.consumed).toBe(Buffer.byteLength(contents))
+  })
+
+  it('returns nothing for an empty file', () => {
+    expect(readSpoolFile(write(''))).toEqual({ records: [], consumed: 0 })
+  })
+
+  it('returns nothing for a file that is one torn line', () => {
+    expect(readSpoolFile(write(record('a'))).records).toEqual([])
+    expect(readSpoolFile(write(record('a'))).consumed).toBe(0)
+  })
+
+  it('returns nothing for a missing file', () => {
+    expect(readSpoolFile(join(dir, 'absent.jsonl'))).toEqual({ records: [], consumed: 0 })
+  })
+})
diff --git a/src/shared/agent-hook-spool.ts b/src/shared/agent-hook-spool.ts
index 3ad478ed8a5..275e6f5ce52 100644
--- a/src/shared/agent-hook-spool.ts
+++ b/src/shared/agent-hook-spool.ts
@@ -67,19 +67,17 @@ export function readSpoolFile(
   const records: SpoolRecord[] = []
   let consumed = 0
   let start = 0
-  for (let end = 0; end <= bytes.length; end += 1) {
-    if (end !== bytes.length && bytes[end] !== 0x0a) {
-      continue
-    }
+  // indexOf, not a per-byte loop: this runs over every spooled file before the hook listener binds,
+  // and Buffer.indexOf finds the newline with memchr instead of an interpreted scan.
+  for (;;) {
+    const end = bytes.indexOf(0x0a, start)
     // A final line without its newline may still be in flight from a hook writer.
     // Leave it untouched until the writer terminates the record explicitly.
-    if (end === bytes.length && (end === 0 || bytes[end - 1] !== 0x0a)) {
+    if (end === -1) {
       break
     }
     const lineBytes = bytes.subarray(start, end)
-    if (end !== bytes.length) {
-      consumed = end + 1
-    }
+    consumed = end + 1
     start = end + 1
     if (lineBytes.length === 0) {
       continue

From c1850e3cc7472b76c7ffd4a710f7e8d40e18fdd3 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:33:39 -0700
Subject: [PATCH 43/58] perf(claude-usage): reject non-assistant transcript
 lines before parsing them (#18640)

Only assistant records carry usage, but the parser ran JSON.parse on every line
first and checked the type after. Claude transcripts interleave user and
tool-result lines that routinely embed whole files or captured command output,
so the scanner built and discarded a full object graph for each of them.

A substring gate on the line rejects them first: median 50.5ms to 8.4ms over
20000 realistic lines.
---
 ...transcript-record-parser-prefilter.test.ts | 40 +++++++++++++++++++
 .../claude-usage/transcript-record-parser.ts  | 20 ++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 src/main/claude-usage/transcript-record-parser-prefilter.test.ts

diff --git a/src/main/claude-usage/transcript-record-parser-prefilter.test.ts b/src/main/claude-usage/transcript-record-parser-prefilter.test.ts
new file mode 100644
index 00000000000..992b4ba8fd3
--- /dev/null
+++ b/src/main/claude-usage/transcript-record-parser-prefilter.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest'
+import { parseClaudeUsageRecord } from './transcript-record-parser'
+
+function assistantLine(overrides: Record<string, unknown> = {}): string {
+  return JSON.stringify({
+    type: 'assistant',
+    sessionId: 'session-1',
+    timestamp: '2026-01-01T00:00:00.000Z',
+    message: { usage: { input_tokens: 3, output_tokens: 5 } },
+    ...overrides
+  })
+}
+
+describe('assistant-record prefilter', () => {
+  it('still parses an ordinary assistant record', () => {
+    expect(parseClaudeUsageRecord(assistantLine())?.inputTokens).toBe(3)
+  })
+
+  it('rejects a user record that never mentions assistant', () => {
+    const userLine = JSON.stringify({
+      type: 'user',
+      sessionId: 'session-1',
+      timestamp: '2026-01-01T00:00:00.000Z',
+      message: { content: 'x'.repeat(200) }
+    })
+
+    expect(parseClaudeUsageRecord(userLine)).toBeNull()
+  })
+
+  it('rejects a non-assistant record that happens to contain the word assistant', () => {
+    const userLine = JSON.stringify({
+      type: 'user',
+      sessionId: 'session-1',
+      timestamp: '2026-01-01T00:00:00.000Z',
+      message: { content: 'ask the assistant about this' }
+    })
+
+    expect(parseClaudeUsageRecord(userLine)).toBeNull()
+  })
+})
diff --git a/src/main/claude-usage/transcript-record-parser.ts b/src/main/claude-usage/transcript-record-parser.ts
index 59b0e75be39..2ad51f3ee90 100644
--- a/src/main/claude-usage/transcript-record-parser.ts
+++ b/src/main/claude-usage/transcript-record-parser.ts
@@ -84,10 +84,30 @@ function dedupeClaudeUsageTurns(
   return deduped
 }
 
+/**
+ * Necessary condition for `JSON.parse(line).type === 'assistant'`, checked before the parse.
+ *
+ * Sound for any transcript written by a standard JSON serializer: `JSON.stringify` (which writes
+ * these files) escapes only quotes, backslashes and control characters, never ASCII letters, so
+ * the decoded value can only be `assistant` if the line spells it literally. The gate over-admits
+ * freely — the `parsed.type` check below stays authoritative.
+ *
+ * A `\u`-escape fallback was measured and rejected: it costs a second full-line scan and made
+ * transcripts whose tool results contain control characters 1.43x slower overall.
+ */
+function mayEncodeAssistantType(line: string): boolean {
+  return line.includes('assistant')
+}
+
 function parseClaudeUsageSourceRecord(
   line: string,
   fallbackSessionId: string | null = null
 ): ClaudeUsageParsedSourceTurn | null {
+  // Only assistant records carry usage, but transcripts interleave user/tool-result lines that
+  // routinely embed whole files. Reject those before paying for a full parse.
+  if (!mayEncodeAssistantType(line)) {
+    return null
+  }
   let parsed: ClaudeUsageSourceRecord
   try {
     parsed = JSON.parse(line) as ClaudeUsageSourceRecord

From a663a21fff997505cd7539992593e5df4120fd01 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:33:50 -0700
Subject: [PATCH 44/58] perf(orchestration): project task columns so task reads
 hit the statement cache (#18641)

SyncDatabase refuses to cache any statement containing a wildcard, so every
SELECT * FROM tasks recompiled on each call. getTask sits on the dispatch and
lifecycle paths and listTasks runs several times per coordinator tick on the
2s poll, so those recompiles were continuous during a run.

Project TASK_COLUMNS explicitly, the same fix #18420 applied to the graph
publish, using the column list already imported in this file. getTask drops from
7.88us to 2.18us per call.
---
 .../db/hot-path-statement-compilation.test.ts | 26 +++++++++++++++++++
 .../orchestration/db/tasks/task-store.ts      | 26 ++++++++++++++-----
 2 files changed, 45 insertions(+), 7 deletions(-)

diff --git a/src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts b/src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts
index 26f82410cfe..8e36605aeb5 100644
--- a/src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts
+++ b/src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts
@@ -131,6 +131,32 @@ describe('orchestration hot-path statement compilation', () => {
     }
   })
 
+  // Why: getTask sits on the dispatch/lifecycle path and listTasks runs several times per
+  // coordinator tick, so a wildcard there recompiles on every call the same way the publish did.
+  it('compiles the task lookup and listing SQL exactly once across repeated calls', () => {
+    const db = openDatabase(':memory:')
+    seedDispatchedWorker(db)
+    const seeded = db.listTasks()
+    expect(seeded.length).toBeGreaterThan(0)
+    const taskId = seeded[0].id
+
+    const compiled = trackCompiledSql(db)
+    for (let call = 0; call < 5; call += 1) {
+      db.getTask(taskId)
+      db.listTasks()
+      db.listTasks({ ready: true })
+      db.listTasks({ status: 'pending' })
+      db.listTasks({ runId: seeded[0].run_id })
+    }
+
+    const compilationsPerSql = new Map<string, number>()
+    for (const sql of compiled) {
+      compilationsPerSql.set(sql, (compilationsPerSql.get(sql) ?? 0) + 1)
+    }
+    expect([...compilationsPerSql].filter(([, count]) => count > 1)).toEqual([])
+    expect(compiled.filter((sql) => WILDCARD_PROJECTION.test(sql))).toEqual([])
+  })
+
   // Why: `SELECT *` is what made these statements uncacheable, and a retained wildcard is the only
   // way node:sqlite could build a row from stale column names after another connection's ALTER.
   // Seeds on one connection and publishes on a second so every compilation here is hot-path SQL.
diff --git a/src/main/runtime/orchestration/db/tasks/task-store.ts b/src/main/runtime/orchestration/db/tasks/task-store.ts
index 69316765a74..8bcc74ca3e5 100644
--- a/src/main/runtime/orchestration/db/tasks/task-store.ts
+++ b/src/main/runtime/orchestration/db/tasks/task-store.ts
@@ -79,9 +79,13 @@ export function createTask(
       runId,
       depsJson
     )
-  return this.db.prepare('SELECT * FROM tasks WHERE id = ?').get(id) as TaskRow
+  return this.db.prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE id = ?`).get(id) as TaskRow
 }
 
+// Why wildcard-free: SyncDatabase refuses to cache any statement containing `*`, so a `SELECT *`
+// here recompiles on every call — including the hot dispatch lookups and the coordinator poll.
+const TASK_COLUMN_LIST = selectColumns(TASK_COLUMNS)
+
 // Why: hoisted and wildcard-free so the per-publish lineage lookup hits the SyncDatabase statement cache.
 const TASK_RUNTIME_LINEAGE_SQL = `SELECT ${selectColumns(TASK_COLUMNS, 't')},
          creator.id AS creator_dispatch_id,
@@ -113,7 +117,9 @@ export function getTask(
   dispatchRunId?: string
 ): TaskRow | TaskRuntimeLineageRow | undefined {
   if (dispatchRunId === undefined) {
-    return this.db.prepare('SELECT * FROM tasks WHERE id = ?').get(id) as TaskRow | undefined
+    return this.db.prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE id = ?`).get(id) as
+      | TaskRow
+      | undefined
   }
   return this.db.prepare(TASK_RUNTIME_LINEAGE_SQL).get(dispatchRunId, id) as
     | TaskRuntimeLineageRow
@@ -128,20 +134,26 @@ export function listTasks(
   const runParams: Database.BindValue[] = filter?.runId ? [filter.runId] : []
   if (filter?.ready) {
     return this.db
-      .prepare(`SELECT * FROM tasks WHERE ${runWhere}status = 'ready' ORDER BY created_at`)
+      .prepare(
+        `SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE ${runWhere}status = 'ready' ORDER BY created_at`
+      )
       .all(...runParams) as TaskRow[]
   }
   if (filter?.status) {
     return this.db
-      .prepare(`SELECT * FROM tasks WHERE ${runWhere}status = ? ORDER BY created_at`)
+      .prepare(
+        `SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE ${runWhere}status = ? ORDER BY created_at`
+      )
       .all(...runParams, filter.status) as TaskRow[]
   }
   if (filter?.runId) {
     return this.db
-      .prepare('SELECT * FROM tasks WHERE run_id = ? ORDER BY created_at')
+      .prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE run_id = ? ORDER BY created_at`)
       .all(filter.runId) as TaskRow[]
   }
-  return this.db.prepare('SELECT * FROM tasks ORDER BY created_at').all() as TaskRow[]
+  return this.db
+    .prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks ORDER BY created_at`)
+    .all() as TaskRow[]
 }
 
 // Why: the correlated indexed lookup avoids materializing every retained Dispatch before filtering Tasks.
@@ -195,7 +207,7 @@ export function listTasksWithDispatch(
 // Why: runs in the status-update transaction, so a completed task never leaves its ready children unpromoted.
 export function promoteReadyTasks(this: OrchestrationDb, completedTaskId: string): void {
   const candidates = this.db
-    .prepare("SELECT * FROM tasks WHERE status = 'pending'")
+    .prepare(`SELECT ${TASK_COLUMN_LIST} FROM tasks WHERE status = 'pending'`)
     .all() as TaskRow[]
 
   for (const task of candidates) {

From 2881955bae055b40663374836e48a14f1d238308 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:34:00 -0700
Subject: [PATCH 45/58] perf(agent-hooks): stop cloning the whole status roster
 on every hook event (#18642)

AgentAwakeService.setStatuses deep-copied every row of an array the hook server
had just built fresh, and getEligibleRunningStatusCount allocated a filtered
array only to read its length. Both run on every agent turn and tool call, and
both scale with cached panes rather than with the one pane that changed.

Copy the array without cloning its rows, and count in place. At 500 panes the
per-event cost drops from 5.34us to 1.78us.
---
 ...agent-awake-service-platform-assertions.test.ts | 14 ++++++++++++++
 src/main/agent-awake-service.ts                    |  6 ++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/main/agent-awake-service-platform-assertions.test.ts b/src/main/agent-awake-service-platform-assertions.test.ts
index cd1d7fb1adc..7b3566b322f 100644
--- a/src/main/agent-awake-service-platform-assertions.test.ts
+++ b/src/main/agent-awake-service-platform-assertions.test.ts
@@ -22,6 +22,20 @@ function workingStatus(): AgentAwakeStatus {
   }
 }
 
+describe('AgentAwakeService status array ownership', () => {
+  it('does not observe rows appended to the caller array after setStatuses', () => {
+    const service = new AgentAwakeService()
+    service.setMode('auto')
+    const statuses: AgentAwakeStatus[] = [workingStatus()]
+
+    service.setStatuses(statuses)
+    const before = service.getWorkingAgentCount()
+    statuses.push(workingStatus(), workingStatus())
+
+    expect(service.getWorkingAgentCount()).toBe(before)
+  })
+})
+
 function createBlocker() {
   const startedIds = new Set<number>()
   let nextId = 1
diff --git a/src/main/agent-awake-service.ts b/src/main/agent-awake-service.ts
index b79612e2b9c..6be27e9d0e6 100644
--- a/src/main/agent-awake-service.ts
+++ b/src/main/agent-awake-service.ts
@@ -105,7 +105,8 @@ export class AgentAwakeService {
   }
 
   setStatuses(statuses: AgentAwakeStatus[]): void {
-    this.statuses = statuses.map((status) => ({ ...status }))
+    // Copy the array, not every row: the hook server allocates each row fresh per event.
+    this.statuses = [...statuses]
     this.refresh('status-change')
   }
 
@@ -171,7 +172,8 @@ export class AgentAwakeService {
 
   private getEligibleRunningStatusCount(): number {
     const now = this.now()
-    return this.statuses.filter((status) => this.isWakeEligible(status, now)).length
+    // Counted in place: the filtered array was only ever measured, and this runs per hook event.
+    return this.statuses.reduce((count, s) => count + (this.isWakeEligible(s, now) ? 1 : 0), 0)
   }
 
   private isWakeEligible(status: AgentAwakeStatus, now: number): boolean {

From 9008fb70a65e2bff9c81adadfbc36e5893a318e9 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:34:08 -0700
Subject: [PATCH 46/58] perf(sidebar): share one natural-worktree-id scan and
 drop a redundant row-key join (#18647)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The natural-worktree-id Set was spelled out four times — twice in the drag
groups module, once in the drag session hook, once in the drag units module —
each as rows.flatMap(row => cond ? [id] : []), which allocates a throwaway array
per row. All four memoize on the same rows, so they recompute together. Share
one loop-based helper.

use-row-measurement also built a joined string of every row key purely as an
effect dependency, alongside a Set memoized on the same input. A fresh Set
always changes identity, so the string could never fire the effect on its own.
---
 .../sidebar/natural-worktree-ids.test.ts      | 45 +++++++++++++++++++
 .../sidebar/natural-worktree-ids.ts           | 24 ++++++++++
 .../components/sidebar/worktree-drag-units.ts |  7 +--
 .../sidebar/worktree-list/drag/groups.ts      | 10 +----
 .../sidebar/worktree-list/drag/use-session.ts | 11 +----
 .../viewport/use-row-measurement.ts           | 13 +-----
 6 files changed, 75 insertions(+), 35 deletions(-)
 create mode 100644 src/renderer/src/components/sidebar/natural-worktree-ids.test.ts
 create mode 100644 src/renderer/src/components/sidebar/natural-worktree-ids.ts

diff --git a/src/renderer/src/components/sidebar/natural-worktree-ids.test.ts b/src/renderer/src/components/sidebar/natural-worktree-ids.test.ts
new file mode 100644
index 00000000000..b36fc2aa262
--- /dev/null
+++ b/src/renderer/src/components/sidebar/natural-worktree-ids.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import { PINNED_GROUP_KEY } from './worktree-list/grouping/group-keys'
+import { getNaturalWorktreeIds } from './natural-worktree-ids'
+
+const item = (id: string, sectionKey: string) => ({
+  type: 'item' as const,
+  sectionKey,
+  worktree: { id }
+})
+
+describe('getNaturalWorktreeIds', () => {
+  it('collects item rows outside the pinned section', () => {
+    expect([...getNaturalWorktreeIds([item('a', 'group-1'), item('b', 'group-2')])]).toEqual([
+      'a',
+      'b'
+    ])
+  })
+
+  it('excludes a pinned duplicate that also renders in its natural group', () => {
+    const rows = [item('a', PINNED_GROUP_KEY), item('a', 'group-1'), item('b', PINNED_GROUP_KEY)]
+
+    const ids = getNaturalWorktreeIds(rows)
+
+    expect(ids.has('a')).toBe(true)
+    expect(ids.has('b')).toBe(false)
+  })
+
+  it('ignores every non-item row type', () => {
+    const rows = [
+      { type: 'header', key: 'k' },
+      { type: 'host-header' },
+      { type: 'imported-worktrees-card' },
+      { type: 'new-external-worktrees-inbox' },
+      { type: 'pending-creation' },
+      { type: 'folder-workspace' },
+      item('a', 'group-1')
+    ]
+
+    expect([...getNaturalWorktreeIds(rows)]).toEqual(['a'])
+  })
+
+  it('returns an empty set for no rows', () => {
+    expect(getNaturalWorktreeIds([]).size).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/natural-worktree-ids.ts b/src/renderer/src/components/sidebar/natural-worktree-ids.ts
new file mode 100644
index 00000000000..7ac21ba1f9f
--- /dev/null
+++ b/src/renderer/src/components/sidebar/natural-worktree-ids.ts
@@ -0,0 +1,24 @@
+import { PINNED_GROUP_KEY } from './worktree-list/grouping/group-keys'
+
+/** The row shape both drag models share: only `item` rows carry a worktree and a section. */
+type NaturalWorktreeIdRow = { type: string } & Partial<{
+  sectionKey: string
+  worktree: { id: string }
+}>
+
+/**
+ * Ids of worktrees rendered in their own group.
+ *
+ * Why: a pinned duplicate of a worktree that also renders in its natural group is not its own drag
+ * slot. Shared by every drag model so the rule lives in one place, and built with a loop rather
+ * than `flatMap` — that allocated a throwaway array per row, four times per row-model rebuild.
+ */
+export function getNaturalWorktreeIds(rows: readonly NaturalWorktreeIdRow[]): Set<string> {
+  const ids = new Set<string>()
+  for (const row of rows) {
+    if (row.type === 'item' && row.sectionKey !== PINNED_GROUP_KEY && row.worktree) {
+      ids.add(row.worktree.id)
+    }
+  }
+  return ids
+}
diff --git a/src/renderer/src/components/sidebar/worktree-drag-units.ts b/src/renderer/src/components/sidebar/worktree-drag-units.ts
index e53d663a9f0..9b900ab72fc 100644
--- a/src/renderer/src/components/sidebar/worktree-drag-units.ts
+++ b/src/renderer/src/components/sidebar/worktree-drag-units.ts
@@ -1,5 +1,6 @@
 import type { WorktreeDragGroup } from './worktree-manual-order'
 import { ALL_GROUP_KEY, PINNED_GROUP_KEY } from './worktree-list/grouping/group-keys'
+import { getNaturalWorktreeIds } from './natural-worktree-ids'
 
 export type WorktreeDragUnitGroup = WorktreeDragGroup & {
   units: { worktreeId: string; worktreeIds: string[] }[]
@@ -19,11 +20,7 @@ export function getWorktreeDragUnitGroups(
 ): WorktreeDragUnitGroup[] {
   const groups: WorktreeDragUnitGroup[] = []
   let current: { key: string; units: WorktreeDragUnitGroup['units'] } | null = null
-  const naturalWorktreeIds = new Set(
-    rows.flatMap((row) =>
-      row.type === 'item' && row.sectionKey !== PINNED_GROUP_KEY ? [row.worktree.id] : []
-    )
-  )
+  const naturalWorktreeIds = getNaturalWorktreeIds(rows)
 
   for (const row of rows) {
     if (row.type === 'header') {
diff --git a/src/renderer/src/components/sidebar/worktree-list/drag/groups.ts b/src/renderer/src/components/sidebar/worktree-list/drag/groups.ts
index f8ee60c495e..7f1a8e19f49 100644
--- a/src/renderer/src/components/sidebar/worktree-list/drag/groups.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/drag/groups.ts
@@ -1,16 +1,8 @@
 import { ALL_GROUP_KEY, PINNED_GROUP_KEY } from '../grouping/group-keys'
+import { getNaturalWorktreeIds } from '../../natural-worktree-ids'
 import type { HostSectionRow } from '../../host-section-rows'
 import type { WorktreeDragGroup } from '../../worktree-manual-order'
 
-// A pinned duplicate of a worktree that also renders in its natural group is not its own drag slot.
-function getNaturalWorktreeIds(rows: readonly HostSectionRow[]): Set<string> {
-  return new Set(
-    rows.flatMap((row) =>
-      row.type === 'item' && row.sectionKey !== PINNED_GROUP_KEY ? [row.worktree.id] : []
-    )
-  )
-}
-
 export function getWorktreeDragGroups(rows: HostSectionRow[]): WorktreeDragGroup[] {
   const groups: WorktreeDragGroup[] = []
   let current: { key: string; ids: string[] } | null = null
diff --git a/src/renderer/src/components/sidebar/worktree-list/drag/use-session.ts b/src/renderer/src/components/sidebar/worktree-list/drag/use-session.ts
index 78b25b25f38..92e23ec4928 100644
--- a/src/renderer/src/components/sidebar/worktree-list/drag/use-session.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/drag/use-session.ts
@@ -24,6 +24,7 @@ import {
 } from '../../worktree-sidebar-drop-preview'
 import { getWorktreeDragGroups, getWorktreeDragIndexes } from './groups'
 import type { WorktreeItemRow } from '../listing/renderable-rows'
+import { getNaturalWorktreeIds } from '../../natural-worktree-ids'
 
 export type WorktreeStatusDropRequest = {
   pointerY: number
@@ -48,15 +49,7 @@ export function useWorktreeDragSession(args: {
 
   const worktreeDragGroups = useMemo(() => getWorktreeDragGroups(rows), [rows])
   const worktreeDragUnitGroups = useMemo(() => getWorktreeDragUnitGroups(rows), [rows])
-  const naturalDragWorktreeIds = useMemo(
-    () =>
-      new Set(
-        rows.flatMap((row) =>
-          row.type === 'item' && row.sectionKey !== PINNED_GROUP_KEY ? [row.worktree.id] : []
-        )
-      ),
-    [rows]
-  )
+  const naturalDragWorktreeIds = useMemo(() => getNaturalWorktreeIds(rows), [rows])
   const worktreeLineageDragRows = useMemo(
     () =>
       rows
diff --git a/src/renderer/src/components/sidebar/worktree-list/viewport/use-row-measurement.ts b/src/renderer/src/components/sidebar/worktree-list/viewport/use-row-measurement.ts
index ff812a950be..a6f795cf392 100644
--- a/src/renderer/src/components/sidebar/worktree-list/viewport/use-row-measurement.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/viewport/use-row-measurement.ts
@@ -51,10 +51,6 @@ export function useVirtualRowMeasurementSync(args: {
   const { virtualizer, isCurrentVirtualRowElement } = virtualization
   const prCacheLen = useAppStore((s) => countRecordKeysByReference(s.prCache))
   const issueCacheLen = useAppStore((s) => countRecordKeysByReference(s.issueCache))
-  const renderRowKeySignature = useMemo(
-    () => renderRows.map(getRenderRowKey).join('\n'),
-    [renderRows]
-  )
   const activeRenderRowKeys = useMemo(() => new Set(renderRows.map(getRenderRowKey)), [renderRows])
   const lineageRowRekeys = useMemo(() => buildLineageRowRekeyMap(renderRows), [renderRows])
   const totalSize = virtualizer.getTotalSize()
@@ -100,14 +96,7 @@ export function useVirtualRowMeasurementSync(args: {
     measureMountedRows()
     const frameId = window.requestAnimationFrame(measureMountedRows)
     return () => window.cancelAnimationFrame(frameId)
-  }, [
-    activeRenderRowKeys,
-    prCacheLen,
-    issueCacheLen,
-    measureMountedRows,
-    renderRowKeySignature,
-    virtualizer
-  ])
+  }, [activeRenderRowKeys, prCacheLen, issueCacheLen, measureMountedRows, virtualizer])
 
   useVirtualizedScrollAnchor({
     anchorRef: scrollAnchorRef,

From 368a6d6ca7061cfcbcefdf429d2f31c9a0538843 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:39:34 -0700
Subject: [PATCH 47/58] perf(terminal): use real event-loop yields between
 chunked writes (#18627)

* perf(terminal): use real event-loop yields between chunked writes

Both chunk-write loops yielded with setTimeout(resolve, 0), which is not a yield
but a timer tick. The paste executor's awaits are nested, so Chromium clamps them
to ~4ms each; a 4MB paste is ~256 chunks and up to a second of dead time. The
main-process pty:write loop pays a Node timer round trip per 16KiB.

Use the shared MessageChannel-based yieldToEventLoop in the renderer (already
used by pty-input-write-queue one file over) and setImmediate in main (already
used by the remote-runtime terminal.send path and the usage scanners).

* test(terminal): pin the event-loop yield between chunked PTY writes

The paste executor must default to the shared yieldToEventLoop helper and
write-input must yield via setImmediate; neither was covered, so a refactor
back to setTimeout(0) would have passed every suite. Both tests are
deterministic: the renderer test mocks the helper module and spies on
setTimeout with the operation timeout disabled, and the main-process test
fakes only setTimeout so a timer-based yield stalls while a setImmediate
yield races to completion on real check-phase turns.
---
 .../pty/ipc/write-input-chunk-yield.test.ts   | 134 ++++++++++++++++++
 src/main/ipc/pty/ipc/write-input.ts           |   4 +-
 ...minal-paste-executor-default-yield.test.ts | 101 +++++++++++++
 .../terminal-pane/terminal-paste-executor.ts  |   7 +-
 4 files changed, 240 insertions(+), 6 deletions(-)
 create mode 100644 src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
 create mode 100644 src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts

diff --git a/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts b/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
new file mode 100644
index 00000000000..86e16121f5c
--- /dev/null
+++ b/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
@@ -0,0 +1,134 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { TERMINAL_INPUT_CHUNK_MAX_BYTES } from '../../../../shared/terminal-input'
+import { agentSessionPtyWriteGate } from '../../../runtime/agent-session-pty-write-gate'
+import { ptyOwnership } from '../provider/ownership-state'
+import { createPtyWriteInput } from './write-input'
+
+const PTY_ID = 'pty-chunk-yield'
+
+const { provider } = vi.hoisted(() => ({ provider: { write: vi.fn() } }))
+
+vi.mock('../provider/registry', () => ({
+  tryGetProviderForPty: (id: string) => (id === PTY_ID ? provider : undefined)
+}))
+
+const realSetImmediate = globalThis.setImmediate
+const realReadmit = agentSessionPtyWriteGate.readmit.bind(agentSessionPtyWriteGate)
+const THREE_CHUNK_INPUT = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2 + 8)
+
+const mainWindow = {
+  isDestroyed: () => false,
+  webContents: { isDestroyed: () => false, send: vi.fn() }
+}
+
+/** Resolves after `turns` real check-phase passes; never touches the (faked) timer queue. */
+function afterImmediateTurns(turns: number): Promise<'stalled'> {
+  return new Promise((resolve) => {
+    const step = (remaining: number): void => {
+      if (remaining === 0) {
+        resolve('stalled')
+        return
+      }
+      realSetImmediate(() => step(remaining - 1))
+    }
+    step(turns)
+  })
+}
+
+function createWriteInput(): ReturnType<typeof createPtyWriteInput>['writePtyInput'] {
+  return createPtyWriteInput({
+    mainWindow: mainWindow as never,
+    clearHiddenRendererResizeOutput: vi.fn()
+  }).writePtyInput
+}
+
+beforeEach(() => {
+  ptyOwnership.set(PTY_ID, null)
+  provider.write.mockReset()
+  mainWindow.webContents.send.mockReset()
+  // Why: only setTimeout is faked. A setTimeout(0) yield would stall the write forever here,
+  // while a setImmediate yield still runs in Node's check phase — the race below is deterministic.
+  vi.useFakeTimers({ toFake: ['setTimeout'] })
+})
+
+afterEach(() => {
+  ptyOwnership.delete(PTY_ID)
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe('chunked pty write yield', () => {
+  it('yields between chunks via setImmediate, not a timer, and readmits before each later chunk', async () => {
+    const events: string[] = []
+    provider.write.mockImplementation((_id: string, data: string) => {
+      events.push(`write:${data.length}`)
+    })
+    vi.spyOn(agentSessionPtyWriteGate, 'readmit').mockImplementation((...args) => {
+      events.push('readmit')
+      return realReadmit(...args)
+    })
+    vi.spyOn(globalThis, 'setImmediate').mockImplementation(((callback: () => void) => {
+      events.push('yield')
+      return realSetImmediate(callback)
+    }) as typeof setImmediate)
+
+    const outcome = await Promise.race([
+      createWriteInput()({ id: PTY_ID, data: THREE_CHUNK_INPUT }),
+      afterImmediateTurns(50)
+    ])
+
+    expect(outcome).toBe(true)
+    expect(vi.getTimerCount()).toBe(0)
+    expect(events).toEqual([
+      `write:${TERMINAL_INPUT_CHUNK_MAX_BYTES}`,
+      'yield',
+      'readmit',
+      `write:${TERMINAL_INPUT_CHUNK_MAX_BYTES}`,
+      'yield',
+      'readmit',
+      'write:8'
+    ])
+    expect(mainWindow.webContents.send).not.toHaveBeenCalled()
+  })
+
+  it('does not yield for input that fits in a single chunk', async () => {
+    const immediate = vi.spyOn(globalThis, 'setImmediate')
+
+    const outcome = createWriteInput()({
+      id: PTY_ID,
+      data: 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
+    })
+
+    expect(outcome).toBe(true)
+    expect(provider.write).toHaveBeenCalledTimes(1)
+    expect(immediate).not.toHaveBeenCalled()
+  })
+
+  it('stops after a yield once readmission refuses', async () => {
+    const readmit = vi.spyOn(agentSessionPtyWriteGate, 'readmit').mockReturnValue({
+      admitted: false,
+      refusal: {
+        code: 'agent_session_checkpoint_stale',
+        sessionId: 'session-1',
+        ownerRuntimeKind: null,
+        handoffStage: null,
+        ownerPid: null,
+        runtimeFence: null
+      }
+    })
+
+    const outcome = await Promise.race([
+      createWriteInput()({ id: PTY_ID, data: THREE_CHUNK_INPUT }),
+      afterImmediateTurns(50)
+    ])
+
+    expect(outcome).toBe(false)
+    expect(provider.write).toHaveBeenCalledTimes(1)
+    expect(readmit).toHaveBeenCalledTimes(1)
+    expect(mainWindow.webContents.send).toHaveBeenCalledWith(
+      'pty:writeUnavailable',
+      expect.objectContaining({ id: PTY_ID })
+    )
+  })
+})
diff --git a/src/main/ipc/pty/ipc/write-input.ts b/src/main/ipc/pty/ipc/write-input.ts
index f27604dc9f8..6713e49000b 100644
--- a/src/main/ipc/pty/ipc/write-input.ts
+++ b/src/main/ipc/pty/ipc/write-input.ts
@@ -152,7 +152,9 @@ export function createPtyWriteInput(deps: {
         first = false
         provider.write(id, chunk.value)
         if (!nextChunk.done) {
-          await new Promise((resolve) => setTimeout(resolve, 0))
+          // setImmediate, not setTimeout(0): the yield exists to let abort/data callbacks run
+          // between chunks, and a clamped timer tick per 16 KiB is pure latency.
+          await new Promise((resolve) => setImmediate(resolve))
         }
         chunk = nextChunk
         nextChunk = chunks.next()
diff --git a/src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts b/src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts
new file mode 100644
index 00000000000..4adc98a585b
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts
@@ -0,0 +1,101 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+// Why: the executor must yield through the shared helper by default, not a local setTimeout(0)
+// that Chromium clamps once nested. Mocking the module pins the default's identity without
+// depending on the helper's Vitest-only setTimeout fallback.
+const { events, yieldToEventLoop } = vi.hoisted(() => {
+  const events: string[] = []
+  return {
+    events,
+    yieldToEventLoop: vi.fn(async () => {
+      events.push('yield')
+    })
+  }
+})
+
+vi.mock('../../../../shared/event-loop-yield', () => ({ yieldToEventLoop }))
+
+import { planTerminalPaste, type TerminalPasteTarget } from './terminal-paste-coordinator'
+import { executeTerminalPastePlan } from './terminal-paste-executor'
+
+const target: TerminalPasteTarget = {
+  kind: 'terminal',
+  paneId: 1,
+  leafId: 'leaf-1',
+  ptyId: 'pty-default-yield',
+  runtime: { platform: 'linux', runtimeKey: 'local:linux', kind: 'local' }
+}
+
+function chunkedPlan() {
+  return planTerminalPaste({
+    text: '0123456789abcdef',
+    source: 'keyboard',
+    target,
+    maxDirectBytes: 4,
+    maxChunkBytes: 4
+  })
+}
+
+afterEach(() => {
+  events.length = 0
+  yieldToEventLoop.mockClear()
+  vi.restoreAllMocks()
+})
+
+describe('terminal paste executor default yield', () => {
+  it('yields after every chunk through the shared event-loop helper, never a timer', async () => {
+    const setTimeoutSpy = vi.spyOn(globalThis, 'setTimeout')
+    const writePty = vi.fn((chunk: string) => {
+      events.push(`write:${chunk}`)
+      return true
+    })
+    const plan = chunkedPlan()
+    expect(plan.mode).toBe('chunked')
+
+    const result = await executeTerminalPastePlan(plan, {
+      pasteText: vi.fn(),
+      writePty,
+      isTargetCurrent: () => true,
+      canContinue: () => true,
+      // Why: 0 disables the per-operation timeout timer, so any setTimeout call would be a yield.
+      operationTimeoutMs: 0
+    })
+
+    expect(result.status).toBe('pasted')
+    expect(events).toEqual([
+      'write:0123',
+      'yield',
+      'write:4567',
+      'yield',
+      'write:89ab',
+      'yield',
+      'write:cdef',
+      'yield'
+    ])
+    expect(setTimeoutSpy).not.toHaveBeenCalled()
+  })
+
+  it('re-checks the target after a default yield before writing the next chunk', async () => {
+    let current = true
+    yieldToEventLoop.mockImplementationOnce(async () => {
+      events.push('yield')
+      current = false
+    })
+    const writePty = vi.fn((chunk: string) => {
+      events.push(`write:${chunk}`)
+      return true
+    })
+
+    const result = await executeTerminalPastePlan(chunkedPlan(), {
+      pasteText: vi.fn(),
+      writePty,
+      isTargetCurrent: () => current,
+      canContinue: () => true,
+      operationTimeoutMs: 0
+    })
+
+    expect(result.status).toBe('cancelled')
+    expect(result.reason).toBe('stale-target')
+    expect(events).toEqual(['write:0123', 'yield'])
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-paste-executor.ts b/src/renderer/src/components/terminal-pane/terminal-paste-executor.ts
index 39a05f4dd24..747bc7b8bed 100644
--- a/src/renderer/src/components/terminal-pane/terminal-paste-executor.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-paste-executor.ts
@@ -1,3 +1,4 @@
+import { yieldToEventLoop as yieldToEventLoopTask } from '../../../../shared/event-loop-yield'
 import { BRACKETED_PASTE_END, BRACKETED_PASTE_START } from './terminal-bracketed-paste'
 import { iterateTerminalPastePlanChunks } from './terminal-paste-chunks'
 import { createRedactedPasteExecutionDiagnostic } from './terminal-paste-diagnostics'
@@ -40,7 +41,7 @@ async function executeTerminalPastePlanNow(
     writePty,
     isTargetCurrent,
     canContinue,
-    yieldToEventLoop = defaultYieldToEventLoop,
+    yieldToEventLoop = yieldToEventLoopTask,
     operationTimeoutMs = getTerminalPasteOperationTimeoutMs(plan),
     now = defaultNow
   }: ExecuteTerminalPastePlanArgs
@@ -190,7 +191,3 @@ function result(
 function defaultNow(): number {
   return globalThis.performance?.now?.() ?? Date.now()
 }
-
-function defaultYieldToEventLoop(): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, 0))
-}

From b2c6f029efdf1cbef8512693a685fc19c1d8e5eb Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:47:47 -0700
Subject: [PATCH 48/58] perf(settings): commit free-text account settings on a
 debounce, not per keystroke (#18651)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* perf(settings): commit free-text account settings on a debounce, not per keystroke

Four raw text inputs bound value straight to the store and called updateSettings
in onChange, so every character was an IPC round trip that replaced the settings
object identity in every other window, re-rendering everything subscribed to it.

Route them through a DebouncedSettingsTextInput that keeps a local draft and
commits after 700ms, on blur, and on unmount — matching the repository-hook
script draft. The draft lives in the input component because the account
sections are render functions the settings search calls conditionally, so hooks
cannot legally live in them.

* fix(settings): update the draft's latest-commit ref in an effect, not during render

* fix(settings): flush a pending text-setting draft on beforeunload and drop the dirty flag

A window close or app quit never unmounts the React tree, so the unmount
flush could not run and a value typed within the last 700ms was lost. The
close coordinator already dispatches a synthetic beforeunload while the tree
is mounted, so listen for it the same way the session checkpoint does.

The pending timer is now the single source of truth for "uncommitted edits";
the separate dirty flag it duplicated is gone.
---
 .../settings/DebouncedSettingsTextInput.tsx   |  39 +++
 .../accounts-pane-minimax-section.tsx         |   9 +-
 ...ccounts-pane-provider-setting-sections.tsx |  18 +-
 .../use-debounced-settings-text-draft.test.ts | 222 ++++++++++++++++++
 .../use-debounced-settings-text-draft.ts      |  86 +++++++
 5 files changed, 359 insertions(+), 15 deletions(-)
 create mode 100644 src/renderer/src/components/settings/DebouncedSettingsTextInput.tsx
 create mode 100644 src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts
 create mode 100644 src/renderer/src/components/settings/use-debounced-settings-text-draft.ts

diff --git a/src/renderer/src/components/settings/DebouncedSettingsTextInput.tsx b/src/renderer/src/components/settings/DebouncedSettingsTextInput.tsx
new file mode 100644
index 00000000000..3461133d299
--- /dev/null
+++ b/src/renderer/src/components/settings/DebouncedSettingsTextInput.tsx
@@ -0,0 +1,39 @@
+import type React from 'react'
+import { Input } from '../ui/input'
+import { useDebouncedSettingsTextDraft } from './use-debounced-settings-text-draft'
+
+type DebouncedSettingsTextInputProps = Omit<
+  React.ComponentProps<typeof Input>,
+  'value' | 'onChange' | 'onBlur'
+> & {
+  value: string
+  commit: (next: string) => void
+  onEdit?: () => void
+}
+
+/**
+ * Text input for a free-text setting, committed on a debounce instead of per keystroke.
+ *
+ * Why a component and not a hook at the call site: the account sections are render functions the
+ * settings search calls conditionally, so hooks cannot live in them. Rendering this as JSX gives
+ * the draft its own component to mount and unmount with.
+ */
+export function DebouncedSettingsTextInput({
+  value,
+  commit,
+  onEdit,
+  ...inputProps
+}: DebouncedSettingsTextInputProps): React.JSX.Element {
+  const draft = useDebouncedSettingsTextDraft({ value, commit })
+  return (
+    <Input
+      {...inputProps}
+      value={draft.value}
+      onChange={(event) => {
+        onEdit?.()
+        draft.onChange(event.target.value)
+      }}
+      onBlur={draft.onBlur}
+    />
+  )
+}
diff --git a/src/renderer/src/components/settings/accounts-pane-minimax-section.tsx b/src/renderer/src/components/settings/accounts-pane-minimax-section.tsx
index 96321584483..ce72bc0a16d 100644
--- a/src/renderer/src/components/settings/accounts-pane-minimax-section.tsx
+++ b/src/renderer/src/components/settings/accounts-pane-minimax-section.tsx
@@ -10,6 +10,7 @@ import { Popover, PopoverContent, PopoverTrigger } from '../ui/popover'
 import { MiniMaxIcon } from '../status-bar/icons'
 import { SearchableSetting } from './SearchableSetting'
 import type { AccountsPaneSectionModel } from './accounts-pane-types'
+import { DebouncedSettingsTextInput } from './DebouncedSettingsTextInput'
 
 const MINIMAX_CONSOLE_URL = 'https://platform.minimax.io/console/usage'
 
@@ -265,10 +266,10 @@ export function renderMiniMaxAccountsSection(model: AccountsPaneSectionModel): R
           <Label>
             {translate('auto.components.settings.AccountsPane.bf160bb6c0', 'Group ID override')}
           </Label>
-          <Input
+          <DebouncedSettingsTextInput
             type="text"
             value={settings.minimaxGroupId}
-            onChange={(e) => updateSettings({ minimaxGroupId: e.target.value })}
+            commit={(minimaxGroupId) => updateSettings({ minimaxGroupId })}
             placeholder={translate(
               'auto.components.settings.AccountsPane.0747d6391a',
               'Use group ID from cookie'
@@ -290,10 +291,10 @@ export function renderMiniMaxAccountsSection(model: AccountsPaneSectionModel): R
           <Label>
             {translate('auto.components.settings.AccountsPane.4ff2af7524', 'Usage model names')}
           </Label>
-          <Input
+          <DebouncedSettingsTextInput
             type="text"
             value={settings.minimaxUsageModels}
-            onChange={(e) => updateSettings({ minimaxUsageModels: e.target.value })}
+            commit={(minimaxUsageModels) => updateSettings({ minimaxUsageModels })}
             placeholder={translate('auto.components.settings.AccountsPane.3c92b0d31c', 'general')}
             spellCheck={false}
             className="text-xs"
diff --git a/src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx b/src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx
index 258dea971ae..6bf03df51f4 100644
--- a/src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx
+++ b/src/renderer/src/components/settings/accounts-pane-provider-setting-sections.tsx
@@ -1,11 +1,11 @@
 import { translate } from '@/i18n/i18n'
 import { Button } from '../ui/button'
-import { Input } from '../ui/input'
 import { Label } from '../ui/label'
 import { Switch } from '../ui/switch'
 import { GeminiIcon, OpenCodeGoIcon } from '../status-bar/icons'
 import { SearchableSetting } from './SearchableSetting'
 import type { AccountsPaneSectionModel } from './accounts-pane-types'
+import { DebouncedSettingsTextInput } from './DebouncedSettingsTextInput'
 
 export function renderGeminiAccountsSection(model: AccountsPaneSectionModel): React.JSX.Element {
   const { localAccountRuntimeSentenceLabel, recordFeatureInteraction, settings, updateSettings } =
@@ -114,13 +114,11 @@ export function renderOpenCodeAccountsSection(model: AccountsPaneSectionModel):
           )}
         </Label>
         <div className="flex gap-2">
-          <Input
+          <DebouncedSettingsTextInput
             type="password"
             value={settings.opencodeSessionCookie}
-            onChange={(e) => {
-              recordOpenCodeSettingEdit('cookie')
-              updateSettings({ opencodeSessionCookie: e.target.value })
-            }}
+            onEdit={() => recordOpenCodeSettingEdit('cookie')}
+            commit={(opencodeSessionCookie) => updateSettings({ opencodeSessionCookie })}
             placeholder={translate(
               'auto.components.settings.AccountsPane.a7e38affcd',
               'Fe26.2**… token or auth=Fe26.2**… header'
@@ -180,13 +178,11 @@ export function renderOpenCodeAccountsSection(model: AccountsPaneSectionModel):
           {translate('auto.components.settings.AccountsPane.dbdb0b0bd8', 'Workspace ID override')}
         </Label>
         <div className="flex gap-2">
-          <Input
+          <DebouncedSettingsTextInput
             type="text"
             value={settings.opencodeWorkspaceId}
-            onChange={(e) => {
-              recordOpenCodeSettingEdit('workspaceId')
-              updateSettings({ opencodeWorkspaceId: e.target.value })
-            }}
+            onEdit={() => recordOpenCodeSettingEdit('workspaceId')}
+            commit={(opencodeWorkspaceId) => updateSettings({ opencodeWorkspaceId })}
             placeholder={translate(
               'auto.components.settings.AccountsPane.a122332371',
               'wrk_… (leave blank for automatic lookup)'
diff --git a/src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts b/src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts
new file mode 100644
index 00000000000..da12fd96a26
--- /dev/null
+++ b/src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts
@@ -0,0 +1,222 @@
+// @vitest-environment happy-dom
+
+import { StrictMode } from 'react'
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useDebouncedSettingsTextDraft } from './use-debounced-settings-text-draft'
+
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+
+afterEach(() => {
+  cleanup()
+  vi.useRealTimers()
+})
+
+describe('useDebouncedSettingsTextDraft', () => {
+  it('shows every keystroke immediately but commits once', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: '', commit }))
+
+    for (const next of ['w', 'wr', 'wrk']) {
+      act(() => result.current.onChange(next))
+    }
+
+    expect(result.current.value).toBe('wrk')
+    expect(commit).not.toHaveBeenCalled()
+
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+
+    expect(commit).toHaveBeenCalledTimes(1)
+    expect(commit).toHaveBeenCalledWith('wrk')
+  })
+
+  it('commits immediately on blur without waiting for the debounce', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: '', commit }))
+
+    act(() => result.current.onChange('abc'))
+    act(() => result.current.onBlur())
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('abc')
+
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+
+    // The pending timer must not fire a second, duplicate commit.
+    expect(commit).toHaveBeenCalledTimes(1)
+  })
+
+  it('commits a pending edit when the field unmounts', () => {
+    const commit = vi.fn()
+    const { result, unmount } = renderHook(() =>
+      useDebouncedSettingsTextDraft({ value: '', commit })
+    )
+
+    act(() => result.current.onChange('half-typed'))
+    unmount()
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('half-typed')
+  })
+
+  it('adopts an external value while the field is untouched', () => {
+    const commit = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ value }) => useDebouncedSettingsTextDraft({ value, commit }),
+      { initialProps: { value: 'first' } }
+    )
+
+    rerender({ value: 'from-another-window' })
+
+    expect(result.current.value).toBe('from-another-window')
+    expect(commit).not.toHaveBeenCalled()
+  })
+
+  it('does not let an external value overwrite an in-progress edit', () => {
+    const commit = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ value }) => useDebouncedSettingsTextDraft({ value, commit }),
+      { initialProps: { value: 'first' } }
+    )
+
+    act(() => result.current.onChange('typing'))
+    rerender({ value: 'from-another-window' })
+
+    expect(result.current.value).toBe('typing')
+  })
+
+  it('does not commit when nothing was edited', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: 'x', commit }))
+
+    act(() => result.current.onBlur())
+
+    expect(commit).not.toHaveBeenCalled()
+  })
+})
+
+describe('useDebouncedSettingsTextDraft flush paths', () => {
+  it('commits a pending edit on beforeunload, since a window close never unmounts the tree', () => {
+    const commit = vi.fn()
+    const { result, unmount } = renderHook(() =>
+      useDebouncedSettingsTextDraft({ value: '', commit })
+    )
+
+    act(() => result.current.onChange('quit-mid-word'))
+    act(() => {
+      window.dispatchEvent(new Event('beforeunload', { cancelable: true }))
+    })
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('quit-mid-word')
+
+    // The later unmount and timer must not commit the same value again.
+    unmount()
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+    expect(commit).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not commit on beforeunload when nothing is pending', () => {
+    const commit = vi.fn()
+    renderHook(() => useDebouncedSettingsTextDraft({ value: 'x', commit }))
+
+    act(() => {
+      window.dispatchEvent(new Event('beforeunload', { cancelable: true }))
+    })
+
+    expect(commit).not.toHaveBeenCalled()
+  })
+
+  it('stops listening for beforeunload after unmount', () => {
+    const commit = vi.fn()
+    const { result, unmount } = renderHook(() =>
+      useDebouncedSettingsTextDraft({ value: '', commit })
+    )
+
+    act(() => result.current.onChange('abc'))
+    unmount()
+    act(() => {
+      window.dispatchEvent(new Event('beforeunload', { cancelable: true }))
+    })
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('abc')
+  })
+
+  it('commits every edit burst, not only the first', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: '', commit }))
+
+    act(() => result.current.onChange('one'))
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+    act(() => result.current.onChange('one two'))
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+
+    expect(commit).toHaveBeenNthCalledWith(1, 'one')
+    expect(commit).toHaveBeenNthCalledWith(2, 'one two')
+  })
+
+  it('adopts external values again once a pending edit has been committed', () => {
+    const commit = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ value }) => useDebouncedSettingsTextDraft({ value, commit }),
+      { initialProps: { value: '' } }
+    )
+
+    act(() => result.current.onChange('typed'))
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+    expect(commit).toHaveBeenCalledExactlyOnceWith('typed')
+
+    // The store echoes the commit, then another window writes a different value.
+    rerender({ value: 'typed' })
+    rerender({ value: 'from-another-window' })
+
+    expect(result.current.value).toBe('from-another-window')
+  })
+
+  it('keeps a keystroke typed while the previous commit is still in flight', () => {
+    const commit = vi.fn()
+    const { result, rerender } = renderHook(
+      ({ value }) => useDebouncedSettingsTextDraft({ value, commit }),
+      { initialProps: { value: '' } }
+    )
+
+    act(() => result.current.onChange('abc'))
+    act(() => {
+      vi.advanceTimersByTime(700)
+    })
+    act(() => result.current.onChange('abcd'))
+    // The store echoes the first commit after the user has already typed more.
+    rerender({ value: 'abc' })
+
+    expect(result.current.value).toBe('abcd')
+
+    act(() => result.current.onBlur())
+    expect(commit).toHaveBeenLastCalledWith('abcd')
+    expect(commit).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not spuriously commit under StrictMode effect replay', () => {
+    const commit = vi.fn()
+    const { result } = renderHook(() => useDebouncedSettingsTextDraft({ value: 'x', commit }), {
+      wrapper: StrictMode
+    })
+
+    expect(commit).not.toHaveBeenCalled()
+
+    act(() => result.current.onChange('xy'))
+    act(() => result.current.onBlur())
+
+    expect(commit).toHaveBeenCalledExactlyOnceWith('xy')
+  })
+})
diff --git a/src/renderer/src/components/settings/use-debounced-settings-text-draft.ts b/src/renderer/src/components/settings/use-debounced-settings-text-draft.ts
new file mode 100644
index 00000000000..1f9fe235ead
--- /dev/null
+++ b/src/renderer/src/components/settings/use-debounced-settings-text-draft.ts
@@ -0,0 +1,86 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+
+// Matches the repository-hook script draft, the established debounce for settings text in this pane.
+const SETTINGS_TEXT_COMMIT_DEBOUNCE_MS = 700
+
+export type DebouncedSettingsTextDraft = {
+  value: string
+  onChange: (next: string) => void
+  onBlur: () => void
+}
+
+/**
+ * Local draft for a free-text setting, committed on a debounce and flushed on blur, unmount, and
+ * window unload.
+ *
+ * Why: binding an `<Input>` straight to `updateSettings` sends one IPC round trip per keystroke,
+ * and each one replaces the `settings` object identity in every other window, re-rendering every
+ * component subscribed to it. The committed value is unchanged — only the number of commits is.
+ *
+ * A pending timer is the single source of truth for "the draft has uncommitted edits": `onChange`
+ * is the only place that arms it and `flush` the only place that clears it, so there is no separate
+ * dirty flag to fall out of sync.
+ */
+export function useDebouncedSettingsTextDraft(args: {
+  value: string
+  commit: (next: string) => void
+}): DebouncedSettingsTextDraft {
+  const { value, commit } = args
+  const [draft, setDraft] = useState(value)
+  const draftRef = useRef(draft)
+  const commitRef = useRef(commit)
+  const timerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  // Why an effect, not a render-time write: render must stay pure, and React can replay it.
+  useEffect(() => {
+    commitRef.current = commit
+  }, [commit])
+
+  // Why gated on a pending commit: an external write (another window, a reset) should land in the
+  // field, but must not yank characters out from under someone mid-edit.
+  useEffect(() => {
+    if (timerRef.current !== null) {
+      return
+    }
+    draftRef.current = value
+    setDraft(value)
+  }, [value])
+
+  const flush = useCallback(() => {
+    if (timerRef.current === null) {
+      return
+    }
+    clearTimeout(timerRef.current)
+    timerRef.current = null
+    commitRef.current(draftRef.current)
+  }, [])
+
+  const onChange = useCallback(
+    (next: string) => {
+      draftRef.current = next
+      setDraft(next)
+      if (timerRef.current !== null) {
+        clearTimeout(timerRef.current)
+      }
+      timerRef.current = setTimeout(flush, SETTINGS_TEXT_COMMIT_DEBOUNCE_MS)
+    },
+    [flush]
+  )
+
+  // Why unmount: closing the pane (or the settings search hiding the section) mid-word must persist
+  // the same value typing it would have. `flush` has no dependencies, so this cleanup only ever runs
+  // on unmount.
+  // Why beforeunload: a window close or app quit never unmounts the tree, so the cleanup cannot run.
+  // The close coordinator dispatches a synthetic beforeunload while the tree is still mounted so
+  // listeners like this one can flush; `updateSettings` issues its IPC synchronously, ahead of the
+  // close confirmation, so main persists the value before it flushes the store on quit.
+  useEffect(() => {
+    window.addEventListener('beforeunload', flush)
+    return () => {
+      window.removeEventListener('beforeunload', flush)
+      flush()
+    }
+  }, [flush])
+
+  return { value: draft, onChange, onBlur: flush }
+}

From 2f4f4578c828370f6413dc48f438a6b189f6190d Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 17:53:13 -0400
Subject: [PATCH 49/58] feat(relay-infra): cell crash-rate alert and incident
 dashboard (#18717)

201 relay cell process exits over 48h on 2026-09-04 paged nobody. Adds a log metric on the Docker `container die` event for the orca-relay container, an alert at >3 exits per instance per 15 min, and a four-chart incident dashboard covering the signals that had to be assembled by hand during the outage.
---
 .../terraform-root-partition/families.json    |   2 +
 cloud/infra/terraform/relay-observability.tf  | 177 ++++++++++++++++++
 2 files changed, 179 insertions(+)

diff --git a/cloud/dev/fixtures/terraform-root-partition/families.json b/cloud/dev/fixtures/terraform-root-partition/families.json
index 3c57b2ea7cb..dfe100fd2dd 100644
--- a/cloud/dev/fixtures/terraform-root-partition/families.json
+++ b/cloud/dev/fixtures/terraform-root-partition/families.json
@@ -133,6 +133,7 @@
     "google_logging_metric.relay_snapshot",
     "google_monitoring_alert_policy.relay_assignment_5xx",
     "google_monitoring_alert_policy.relay_assignment_edge_429",
+    "google_monitoring_alert_policy.relay_cell_process_exit",
     "google_monitoring_alert_policy.relay_cloud_nat_port_drops",
     "google_monitoring_alert_policy.relay_cloud_sql_backends",
     "google_monitoring_alert_policy.relay_cloud_sql_checkpoint_loop",
@@ -140,6 +141,7 @@
     "google_monitoring_alert_policy.relay_custom",
     "google_monitoring_alert_policy.relay_gce_connection_headroom",
     "google_monitoring_alert_policy.relay_postgres_retry_exhausted",
+    "google_monitoring_dashboard.relay_incident",
     "google_project_iam_custom_role.github_production_relay_capacity_mutation",
     "google_project_iam_custom_role.github_relay_asia_topology_mutation",
     "google_project_iam_custom_role.github_relay_asia_topology_read",
diff --git a/cloud/infra/terraform/relay-observability.tf b/cloud/infra/terraform/relay-observability.tf
index 5467555ccba..964fc1060e6 100644
--- a/cloud/infra/terraform/relay-observability.tf
+++ b/cloud/infra/terraform/relay-observability.tf
@@ -37,6 +37,12 @@ locals {
       description = "Relay PostgreSQL transactions that exhausted bounded retry."
       filter      = "((resource.type=\"cloud_run_revision\" AND (${local.relay_service_log_filter})) OR resource.type=\"gce_instance\") AND jsonPayload.event=\"orca_relay_postgres_transaction_exhausted\""
     }
+    cell_process_exit = {
+      # The docker event stream is the only per-exit line: the relay's own crash footer only
+      # appears for unhandled rejections, and `container start` also counts healthy first boots.
+      description = "Relay cell container exits, one Docker `container die` event per process exit."
+      filter      = "resource.type=\"gce_instance\" AND logName=\"projects/${var.project_id}/logs/cos_system\" AND jsonPayload.SYSLOG_IDENTIFIER=\"docker\" AND jsonPayload.MESSAGE:\"container die\" AND jsonPayload.MESSAGE:\"name=orca-relay)\""
+    }
     cloud_sql_wal_checkpoint = {
       description = "Cloud SQL checkpoints triggered by WAL volume instead of the timed schedule; a sustained run is the fsync loop that stalled every relay process at once on 2026-09-04."
       filter      = "resource.type=\"cloudsql_database\" AND resource.labels.database_id=\"${var.project_id}:${local.relay_database_instance_name}\" AND textPayload:\"checkpoint starting: wal\""
@@ -633,3 +639,174 @@ resource "google_monitoring_alert_policy" "relay_cloud_nat_port_drops" {
     mime_type = "text/markdown"
   }
 }
+
+resource "google_monitoring_alert_policy" "relay_cell_process_exit" {
+  project               = var.project_id
+  display_name          = "Orca Relay: cell process exits"
+  combiner              = "OR"
+  enabled               = true
+  notification_channels = var.relay_alert_notification_channels
+
+  conditions {
+    display_name = "Cell container exits above 3 in 15 minutes"
+
+    condition_threshold {
+      filter          = "resource.type=\"gce_instance\" AND metric.type=\"logging.googleapis.com/user/orca_relay_cell_process_exit\""
+      comparison      = "COMPARISON_GT"
+      threshold_value = 3
+      duration        = "0s"
+
+      aggregations {
+        alignment_period     = "900s"
+        per_series_aligner   = "ALIGN_SUM"
+        cross_series_reducer = "REDUCE_SUM"
+        group_by_fields      = ["resource.label.\"instance_id\""]
+      }
+
+      trigger {
+        count = 1
+      }
+    }
+  }
+
+  documentation {
+    content   = "A Relay GCE cell restarted its container more than three times in 15 minutes. Each exit drops every host and phone on that cell, and 201 exits went unpaged over 48 h on 2026-09-04. The instance hostname is `relay-<cell>-<suffix>`; read `jsonPayload.MESSAGE` on `cos_system` for the exit code and the container's own stderr for the stack before blaming MIG autoheal or load. A same-capacity roll is the remedy when the running image is behind."
+    mime_type = "text/markdown"
+  }
+
+  depends_on = [google_logging_metric.relay_incident]
+}
+
+# Why: the four signals that had to be assembled by hand during the 2026-09-04 incident.
+resource "google_monitoring_dashboard" "relay_incident" {
+  project = var.project_id
+
+  dashboard_json = jsonencode({
+    displayName = "Orca Relay: incident overview"
+    mosaicLayout = {
+      columns = 12
+      tiles = [
+        {
+          xPos   = 0
+          yPos   = 0
+          width  = 3
+          height = 4
+          widget = {
+            title = "Cloud SQL WAL checkpoints"
+            xyChart = {
+              dataSets = [{
+                plotType   = "LINE"
+                targetAxis = "Y1"
+                timeSeriesQuery = {
+                  timeSeriesFilter = {
+                    filter = "metric.type=\"logging.googleapis.com/user/orca_relay_cloud_sql_wal_checkpoint\" AND resource.type=\"cloudsql_database\""
+                    aggregation = {
+                      alignmentPeriod    = "300s"
+                      perSeriesAligner   = "ALIGN_SUM"
+                      crossSeriesReducer = "REDUCE_SUM"
+                    }
+                  }
+                }
+              }]
+              yAxis = {
+                label = "checkpoints"
+                scale = "LINEAR"
+              }
+            }
+          }
+        },
+        {
+          xPos   = 3
+          yPos   = 0
+          width  = 3
+          height = 4
+          widget = {
+            title = "Cloud NAT dropped packets"
+            xyChart = {
+              dataSets = [{
+                plotType   = "LINE"
+                targetAxis = "Y1"
+                timeSeriesQuery = {
+                  timeSeriesFilter = {
+                    filter = "metric.type=\"router.googleapis.com/nat/dropped_sent_packets_count\" AND resource.type=\"nat_gateway\" AND resource.label.\"gateway_name\"=monitoring.regex.full_match(\"${local.relay_gce_name}(-.*)?\")"
+                    aggregation = {
+                      alignmentPeriod    = "60s"
+                      perSeriesAligner   = "ALIGN_SUM"
+                      crossSeriesReducer = "REDUCE_SUM"
+                      groupByFields      = ["resource.label.\"gateway_name\"", "metric.label.\"reason\""]
+                    }
+                  }
+                }
+              }]
+              yAxis = {
+                label = "packets"
+                scale = "LINEAR"
+              }
+            }
+          }
+        },
+        {
+          xPos   = 6
+          yPos   = 0
+          width  = 3
+          height = 4
+          widget = {
+            title = "Auth refresh 401s"
+            xyChart = {
+              dataSets = [{
+                plotType   = "LINE"
+                targetAxis = "Y1"
+                timeSeriesQuery = {
+                  timeSeriesFilter = {
+                    filter = "metric.type=\"logging.googleapis.com/user/orca_auth_refresh_401\""
+                    aggregation = {
+                      alignmentPeriod    = "300s"
+                      perSeriesAligner   = "ALIGN_SUM"
+                      crossSeriesReducer = "REDUCE_SUM"
+                    }
+                  }
+                }
+              }]
+              yAxis = {
+                label = "rejections"
+                scale = "LINEAR"
+              }
+            }
+          }
+        },
+        {
+          xPos   = 9
+          yPos   = 0
+          width  = 3
+          height = 4
+          widget = {
+            title = "Standing desktop controls (fleet sum)"
+            xyChart = {
+              dataSets = [{
+                plotType   = "LINE"
+                targetAxis = "Y1"
+                timeSeriesQuery = {
+                  timeSeriesFilter = {
+                    # ALIGN_MEAN, not ALIGN_SUM: each process reports its standing control count once per interval.
+                    filter = "metric.type=\"logging.googleapis.com/user/orca_relay_controls\""
+                    aggregation = {
+                      alignmentPeriod    = "300s"
+                      perSeriesAligner   = "ALIGN_MEAN"
+                      crossSeriesReducer = "REDUCE_SUM"
+                    }
+                  }
+                }
+              }]
+              yAxis = {
+                label = "controls"
+                scale = "LINEAR"
+              }
+            }
+          }
+        }
+      ]
+    }
+  })
+
+  depends_on = [google_logging_metric.relay_incident, google_logging_metric.relay_snapshot]
+}

From 7cb05477a11aafcd034cef969429bc207587c48d Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 17:59:25 -0400
Subject: [PATCH 50/58] feat(relay): let cells dial Cloud SQL over private IP
 (#18720)

Cells run cloud-sql-proxy against the auth database's public IP, so every
connection burns a Cloud NAT port on the relay gateway; that allocation filled
on 2026-09-04 and every cell's proxy dial timed out at once. Add --private-ip
behind relay_cloud_sql_private_ip so production can move the traffic onto the
VPC peering once the foundation root has applied it.

Default false, and the rendered startup script is byte-identical to main with
that default, so merging rolls nothing. --unix-socket is untouched: it selects
the listener, not the upstream address, so DATABASE_URL does not change.

The director is Cloud Run and egresses outside this VPC's NAT, so it is not
part of the problem; moving it would mean VPC egress plus a TCP DSN and its own
secret, which is a separate change.
---
 cloud/infra/terraform/relay-gce-cells.tf         | 1 +
 cloud/infra/terraform/relay-gce-startup.sh.tftpl | 3 +++
 cloud/infra/terraform/variables.tf               | 6 ++++++
 3 files changed, 10 insertions(+)

diff --git a/cloud/infra/terraform/relay-gce-cells.tf b/cloud/infra/terraform/relay-gce-cells.tf
index d6b7f3351f9..a4505ba2e37 100644
--- a/cloud/infra/terraform/relay-gce-cells.tf
+++ b/cloud/infra/terraform/relay-gce-cells.tf
@@ -242,6 +242,7 @@ resource "google_compute_instance_template" "relay_gce_cell" {
     artifact_registry_host          = "${var.region}-docker.pkg.dev"
     relay_image                     = each.value.image
     cloud_sql_proxy_image           = var.relay_gce_cloud_sql_proxy_image
+    cloud_sql_private_ip            = var.relay_cloud_sql_private_ip
     # Keep cell-only plans independent from unrelated database configuration drift.
     cloud_sql_connection_name = local.relay_database_connection_name
   })
diff --git a/cloud/infra/terraform/relay-gce-startup.sh.tftpl b/cloud/infra/terraform/relay-gce-startup.sh.tftpl
index f593d94e9e5..a77466f2169 100644
--- a/cloud/infra/terraform/relay-gce-startup.sh.tftpl
+++ b/cloud/infra/terraform/relay-gce-startup.sh.tftpl
@@ -109,6 +109,9 @@ docker run --detach \
   --user 0:0 \
   --volume "$${cloudsql_dir}:/cloudsql" \
   '${cloud_sql_proxy_image}' \
+%{ if cloud_sql_private_ip ~}
+  --private-ip \
+%{ endif ~}
   --unix-socket=/cloudsql \
   '${cloud_sql_connection_name}'
 
diff --git a/cloud/infra/terraform/variables.tf b/cloud/infra/terraform/variables.tf
index 68f6c555bd3..91f67e8ebe0 100644
--- a/cloud/infra/terraform/variables.tf
+++ b/cloud/infra/terraform/variables.tf
@@ -468,6 +468,12 @@ variable "relay_gce_fenced_cells" {
   default     = []
 }
 
+variable "relay_cloud_sql_private_ip" {
+  type        = bool
+  description = "Dial Cloud SQL over its private IP inside this VPC instead of its public IP through Cloud NAT. Requires the foundation root's private services access peering to be applied first; a cell that cannot reach the private IP never becomes ready."
+  default     = false
+}
+
 variable "relay_gce_cloud_sql_proxy_image" {
   type        = string
   description = "Digest-pinned Cloud SQL Auth Proxy image used by private relay workers."

From 5083b58b9c5e366e53ce79de2651989fce730f8d Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 18:05:10 -0400
Subject: [PATCH 51/58] fix(desktop): never replay a refresh token after a
 timeout; jitter relay lease renewal (#18719)

Two independent desktop hardening changes that share one incident date.

1. Refresh-token replay. A refresh POST that aborts client-side leaves the
   token's fate unknown: the server may already have rotated it before the
   reply was lost. Every caller above this module (the relay auth coordinator
   most of all) then re-entered and resent the same stored token, which the
   server reads as reuse and answers by revoking the whole token family. On
   2026-09-04 that turned a slow refresh endpoint into 21,605 sign-outs.

   - The refresh endpoint now gets one 60s attempt instead of a 30s attempt
     plus a replayed retry.
   - A failure with no status line is ambiguous: it is never retried, and the
     token is recorded so a re-entry within 30s is refused outright rather
     than replayed. The block is bounded, not permanent -- the token is only
     possibly spent, and a permanent block would sign out every desktop whose
     refresh merely timed out.
   - Before any retry or replay the stored session is re-read; if another
     caller already rotated it, that result is adopted and the old token is
     never sent again.
   - Only a definitive 5xx, which proves the server rejected without
     rotating, is retried, and exactly once.
   - A 401 on a token whose earlier attempt never answered now logs
     orca_cloud_refresh_possible_replay so support can tell a real revocation
     from a sign-out we caused ourselves. clearCloudSessionIfUnchanged
     semantics are unchanged and still emit the invalidation event.

2. Lease renewal jitter. Both desktop renewal timers took the mean of a
   60s-wide window before expiry. A cell recreate reconnects a whole cohort
   inside one second, so every host in it renewed inside the same second ~54
   minutes later, re-bursting the fleet every ~54 minutes. Renewal now
   carries full +/-10% jitter, spreading the same cohort over ~10 minutes.

   Early renewal is free on the server side: the rebind branch resets the
   full 55-minute TTL from whenever it arrives, with no minimum-age or
   early-renewal restriction (cloud/apps/relay/src/host-session-registry.ts
   :736-743, and :794 for a fresh session). Only lateness is fatal -- :997
   drains and closes a lease that has expired. The base interval is therefore
   shrunk to fit the upward jitter rather than clipping the jittered value at
   the margin, which keeps the distribution unbiased and keeps every sample at
   least 90s before expiry. No wire change.
---
 .../orca-profiles/profile-cloud-client.ts     |  44 +++++--
 .../profile-cloud-refresh-replay-guard.ts     |  55 ++++++++
 .../profile-cloud-service-auth-retry.test.ts  |   1 +
 .../profile-cloud-service-refresh.test.ts     |   1 +
 .../profile-cloud-session-refresh.test.ts     | 122 ++++++++++++++++++
 .../profile-cloud-session-refresh.ts          |  92 ++++++++++++-
 src/main/runtime/relay/relay-origin-pool.ts   |   4 +-
 .../relay/relay-renewal-jitter.test.ts        |  57 ++++++++
 .../runtime/relay/relay-renewal-jitter.ts     |  25 ++++
 .../runtime/relay/relay-session-broker.ts     |   4 +-
 10 files changed, 389 insertions(+), 16 deletions(-)
 create mode 100644 src/main/orca-profiles/profile-cloud-refresh-replay-guard.ts
 create mode 100644 src/main/runtime/relay/relay-renewal-jitter.test.ts
 create mode 100644 src/main/runtime/relay/relay-renewal-jitter.ts

diff --git a/src/main/orca-profiles/profile-cloud-client.ts b/src/main/orca-profiles/profile-cloud-client.ts
index e7657bbdb87..5893c8d109a 100644
--- a/src/main/orca-profiles/profile-cloud-client.ts
+++ b/src/main/orca-profiles/profile-cloud-client.ts
@@ -159,19 +159,37 @@ function normalizeSessionResponse(value: unknown): OrcaCloudSessionExchangeRespo
 
 const CLOUD_REQUEST_TIMEOUT_MS = 30_000
 
-async function postJson<T>(url: string, body: unknown, accessToken?: string): Promise<T> {
+// Why: refresh tokens rotate, so an aborted refresh is ambiguous — the server
+// may have rotated ours before the reply was lost, and the only recovery is a
+// replay the server reads as reuse. One long attempt beats a short attempt plus
+// a replayed retry.
+const CLOUD_REFRESH_TIMEOUT_MS = 60_000
+
+type PostJsonOptions = {
+  accessToken?: string
+  timeoutMs?: number
+}
+
+// Only a status line proves the server rejected the request without consuming
+// what was in it. Everything else — an abort, a dropped socket, a 200 we could
+// not parse — leaves a rotating credential possibly already spent.
+export function isAmbiguousCloudRequestFailure(error: unknown): boolean {
+  return !(error instanceof OrcaCloudRequestError)
+}
+
+async function postJson<T>(url: string, body: unknown, options?: PostJsonOptions): Promise<T> {
   const response = await fetch(url, {
     method: 'POST',
     headers: {
       'content-type': 'application/json',
-      ...(accessToken ? { authorization: `Bearer ${accessToken}` } : {})
+      ...(options?.accessToken ? { authorization: `Bearer ${options.accessToken}` } : {})
     },
     body: JSON.stringify(body),
     // Why: these are fixed first-party token endpoints; following a redirect
     // would re-send refresh tokens/code verifiers to another origin, and a
     // stalled server must not hang the renderer's awaited IPC call forever.
     redirect: 'error',
-    signal: AbortSignal.timeout(CLOUD_REQUEST_TIMEOUT_MS)
+    signal: AbortSignal.timeout(options?.timeoutMs ?? CLOUD_REQUEST_TIMEOUT_MS)
   })
   if (!response.ok) {
     await cancelUnreadResponseBody(response)
@@ -204,7 +222,7 @@ export async function refreshOrcaCloudCapabilities(
     cloud?: unknown
     organizations?: unknown
     capabilities: unknown
-  }>(config.capabilitiesEndpoint, {}, session.accessToken)
+  }>(config.capabilitiesEndpoint, {}, { accessToken: session.accessToken })
   return {
     cloud: response.cloud === undefined ? undefined : normalizeCloudSummary(response.cloud),
     organizations: normalizeOrganizations(response.organizations),
@@ -217,9 +235,11 @@ export async function refreshOrcaCloudSession(
   session: OrcaCloudSession
 ): Promise<OrcaCloudSessionExchangeResponse> {
   return normalizeSessionResponse(
-    await postJson(config.refreshEndpoint, {
-      refreshToken: session.refreshToken
-    })
+    await postJson(
+      config.refreshEndpoint,
+      { refreshToken: session.refreshToken },
+      { timeoutMs: CLOUD_REFRESH_TIMEOUT_MS }
+    )
   )
 }
 
@@ -235,7 +255,7 @@ export async function createOrcaCloudProfile(
         orgId: args.orgId,
         name: args.name
       },
-      session.accessToken
+      { accessToken: session.accessToken }
     )
   )
 }
@@ -249,7 +269,7 @@ export async function selectOrcaCloudOrg(
     cloud: unknown
     organizations?: unknown
     capabilities: unknown
-  }>(config.orgEndpoint, { orgId }, session.accessToken)
+  }>(config.orgEndpoint, { orgId }, { accessToken: session.accessToken })
   return {
     cloud: normalizeCloudSummary(response.cloud),
     organizations: normalizeOrganizations(response.organizations),
@@ -261,5 +281,9 @@ export async function revokeOrcaCloudSession(
   config: OrcaCloudAuthConfig,
   session: OrcaCloudSession
 ): Promise<void> {
-  await postJson(config.logoutEndpoint, { refreshToken: session.refreshToken }, session.accessToken)
+  await postJson(
+    config.logoutEndpoint,
+    { refreshToken: session.refreshToken },
+    { accessToken: session.accessToken }
+  )
 }
diff --git a/src/main/orca-profiles/profile-cloud-refresh-replay-guard.ts b/src/main/orca-profiles/profile-cloud-refresh-replay-guard.ts
new file mode 100644
index 00000000000..d5c22f6b527
--- /dev/null
+++ b/src/main/orca-profiles/profile-cloud-refresh-replay-guard.ts
@@ -0,0 +1,55 @@
+// Refresh tokens whose server-side fate is unknown: the POST left the client but
+// no status came back, so the server may already have rotated the token before
+// the reply was lost. Sending it again reads as reuse and revokes the whole
+// token family — on 2026-09-04 that turned one slow refresh endpoint into 21,605
+// sign-outs, because every caller's retry loop replayed the same stored token.
+
+// A replay this soon after the ambiguous attempt is a retry loop, not a person
+// asking again; holding it back keeps one lost reply from becoming a storm.
+export const AMBIGUOUS_REFRESH_REPLAY_DELAY_MS = 30_000
+
+type AmbiguousRefreshAttempt = {
+  refreshToken: string
+  attemptedAt: number
+}
+
+const ambiguousRefreshAttempts = new Map<string, AmbiguousRefreshAttempt>()
+
+export class AmbiguousRefreshReplayBlockedError extends Error {
+  constructor() {
+    super('orca_cloud_refresh_replay_blocked')
+    this.name = 'AmbiguousRefreshReplayBlockedError'
+  }
+}
+
+export function recordAmbiguousRefreshAttempt(
+  key: string,
+  refreshToken: string,
+  now = Date.now()
+): void {
+  ambiguousRefreshAttempts.set(key, { refreshToken, attemptedAt: now })
+}
+
+// Call once the token's fate is known: it rotated, or the session it belonged to
+// is gone. Leaving the record would mislabel a later, unrelated 401.
+export function forgetAmbiguousRefreshAttempt(key: string): void {
+  ambiguousRefreshAttempts.delete(key)
+}
+
+export function wasRefreshTokenAmbiguouslyAttempted(key: string, refreshToken: string): boolean {
+  return ambiguousRefreshAttempts.get(key)?.refreshToken === refreshToken
+}
+
+export function blocksAmbiguousRefreshReplay(
+  key: string,
+  refreshToken: string,
+  now = Date.now()
+): boolean {
+  const attempt = ambiguousRefreshAttempts.get(key)
+  if (!attempt || attempt.refreshToken !== refreshToken) {
+    return false
+  }
+  // Why bounded rather than permanent: the token is only *possibly* spent. A
+  // permanent block would sign out every desktop whose refresh merely timed out.
+  return now - attempt.attemptedAt < AMBIGUOUS_REFRESH_REPLAY_DELAY_MS
+}
diff --git a/src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts b/src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts
index 9db1d830986..53b26a75595 100644
--- a/src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts
+++ b/src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts
@@ -53,6 +53,7 @@ vi.mock('./profile-cloud-pkce', () => ({
 
 vi.mock('./profile-cloud-client', () => ({
   OrcaCloudRequestError: OrcaCloudRequestErrorMock,
+  isAmbiguousCloudRequestFailure: (error: unknown) => !(error instanceof OrcaCloudRequestErrorMock),
   createOrcaCloudProfile: createOrcaCloudProfileMock,
   exchangeOrcaCloudAuthCode: exchangeOrcaCloudAuthCodeMock,
   refreshOrcaCloudCapabilities: refreshOrcaCloudCapabilitiesMock,
diff --git a/src/main/orca-profiles/profile-cloud-service-refresh.test.ts b/src/main/orca-profiles/profile-cloud-service-refresh.test.ts
index 075573eea3a..877c74c3c46 100644
--- a/src/main/orca-profiles/profile-cloud-service-refresh.test.ts
+++ b/src/main/orca-profiles/profile-cloud-service-refresh.test.ts
@@ -51,6 +51,7 @@ vi.mock('./profile-cloud-pkce', () => ({
 
 vi.mock('./profile-cloud-client', () => ({
   OrcaCloudRequestError: OrcaCloudRequestErrorMock,
+  isAmbiguousCloudRequestFailure: (error: unknown) => !(error instanceof OrcaCloudRequestErrorMock),
   createOrcaCloudProfile: createOrcaCloudProfileMock,
   exchangeOrcaCloudAuthCode: exchangeOrcaCloudAuthCodeMock,
   refreshOrcaCloudCapabilities: refreshOrcaCloudCapabilitiesMock,
diff --git a/src/main/orca-profiles/profile-cloud-session-refresh.test.ts b/src/main/orca-profiles/profile-cloud-session-refresh.test.ts
index 3b869beb6de..2aa3dc0266e 100644
--- a/src/main/orca-profiles/profile-cloud-session-refresh.test.ts
+++ b/src/main/orca-profiles/profile-cloud-session-refresh.test.ts
@@ -38,6 +38,7 @@ vi.mock('./profile-cloud-index', () => ({ linkOrcaProfileToCloud: linkMock }))
 import { readFreshOrcaCloudSession } from './profile-cloud-session-refresh'
 import { OrcaCloudRequestError } from './profile-cloud-client'
 import { onOrcaCloudSessionInvalidated } from './profile-cloud-session-invalidation'
+import { forgetAmbiguousRefreshAttempt } from './profile-cloud-refresh-replay-guard'
 
 const config = {} as OrcaCloudAuthConfig
 const active = {
@@ -61,6 +62,8 @@ const staleSession = {
 describe('profile cloud session refresh', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    vi.restoreAllMocks()
+    forgetAmbiguousRefreshAttempt('/data\0profile-1')
     saveIfCurrentMock.mockReturnValue('memory-only')
     readMock.mockReturnValue({ status: 'found', session: staleSession, persistence: 'memory-only' })
   })
@@ -156,3 +159,122 @@ describe('profile cloud session refresh', () => {
     unsubscribe()
   })
 })
+
+describe('refresh-token replay after an ambiguous attempt', () => {
+  const timeout = (): Error =>
+    Object.assign(new Error('The operation timed out.'), { name: 'TimeoutError' })
+  const rotatedResponse = {
+    accessToken: 'new-access',
+    refreshToken: 'new-refresh',
+    expiresAt: 4_000_000,
+    organizations: [],
+    capabilities: { flags: { 'relay.use': true }, refreshedAt: 2 },
+    cloud: { userId: 'user-1', cloudProfileId: 'cloud-profile-1', activeOrgId: 'org-1' }
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.restoreAllMocks()
+    forgetAmbiguousRefreshAttempt('/data\0profile-1')
+    saveIfCurrentMock.mockReturnValue('memory-only')
+    readMock.mockReturnValue({ status: 'found', session: staleSession, persistence: 'memory-only' })
+  })
+
+  it('never resends a refresh token whose attempt timed out', async () => {
+    refreshMock.mockRejectedValue(timeout())
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).rejects.toThrow(
+      'The operation timed out.'
+    )
+    expect(refreshMock).toHaveBeenCalledTimes(1)
+
+    // The retry loop above this module re-enters immediately; it must not turn
+    // one lost reply into a second POST of the same token.
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).rejects.toThrow(
+      'orca_cloud_refresh_replay_blocked'
+    )
+    expect(refreshMock).toHaveBeenCalledTimes(1)
+    expect(clearMock).not.toHaveBeenCalled()
+  })
+
+  it('adopts the stored session when a timed-out attempt was rotated elsewhere', async () => {
+    const rotated = { ...staleSession, refreshToken: 'rotated-refresh', expiresAt: 4_000_000 }
+    refreshMock.mockRejectedValue(timeout())
+    readMock
+      .mockReturnValueOnce({ status: 'found', session: staleSession, persistence: 'memory-only' })
+      .mockReturnValueOnce({ status: 'found', session: staleSession, persistence: 'memory-only' })
+      .mockReturnValue({ status: 'found', session: rotated, persistence: 'memory-only' })
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'found',
+      session: rotated
+    })
+    expect(refreshMock).toHaveBeenCalledTimes(1)
+    expect(saveIfCurrentMock).not.toHaveBeenCalled()
+  })
+
+  it('retries once after a definitive 5xx, which cannot have rotated the token', async () => {
+    refreshMock
+      .mockRejectedValueOnce(new OrcaCloudRequestError(503))
+      .mockResolvedValueOnce(rotatedResponse)
+
+    const result = await readFreshOrcaCloudSession(config, active, '/data')
+
+    expect(refreshMock).toHaveBeenCalledTimes(2)
+    expect(refreshMock).toHaveBeenNthCalledWith(2, config, staleSession)
+    expect(result).toEqual({
+      status: 'found',
+      session: expect.objectContaining({
+        accessToken: 'new-access',
+        refreshToken: 'new-refresh'
+      })
+    })
+  })
+
+  it('gives a definitive 5xx exactly one retry', async () => {
+    refreshMock.mockRejectedValue(new OrcaCloudRequestError(503))
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).rejects.toThrow(
+      'orca_cloud_request_failed_503'
+    )
+    expect(refreshMock).toHaveBeenCalledTimes(2)
+    expect(clearMock).not.toHaveBeenCalled()
+  })
+
+  it('marks a 401 that follows an ambiguous attempt as a possible self-replay', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const now = vi.spyOn(Date, 'now').mockReturnValue(1_000_000)
+    const invalidated = vi.fn()
+    const unsubscribe = onOrcaCloudSessionInvalidated(invalidated)
+    refreshMock.mockRejectedValueOnce(timeout())
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).rejects.toThrow(
+      'The operation timed out.'
+    )
+
+    now.mockReturnValue(1_000_000 + 31_000)
+    refreshMock.mockRejectedValueOnce(new OrcaCloudRequestError(401))
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'reconnect-required'
+    })
+
+    expect(refreshMock).toHaveBeenCalledTimes(2)
+    expect(warn.mock.calls.flat().join(' ')).toContain('orca_cloud_refresh_possible_replay')
+    expect(clearMock).toHaveBeenCalledTimes(1)
+    expect(invalidated).toHaveBeenCalledTimes(1)
+    unsubscribe()
+  })
+
+  it('does not mark a 401 that follows no ambiguous attempt', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    refreshMock.mockRejectedValue(new OrcaCloudRequestError(401))
+
+    await expect(readFreshOrcaCloudSession(config, active, '/data')).resolves.toEqual({
+      status: 'reconnect-required'
+    })
+
+    expect(warn.mock.calls.flat().join(' ')).not.toContain('orca_cloud_refresh_possible_replay')
+    expect(clearMock).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/orca-profiles/profile-cloud-session-refresh.ts b/src/main/orca-profiles/profile-cloud-session-refresh.ts
index 32e2e39f6e0..221b4908bee 100644
--- a/src/main/orca-profiles/profile-cloud-session-refresh.ts
+++ b/src/main/orca-profiles/profile-cloud-session-refresh.ts
@@ -6,8 +6,20 @@ import {
   readOrcaCloudSession,
   saveOrcaCloudSessionIfCurrent
 } from './profile-cloud-session-store'
-import { OrcaCloudRequestError, refreshOrcaCloudSession } from './profile-cloud-client'
+import {
+  isAmbiguousCloudRequestFailure,
+  OrcaCloudRequestError,
+  refreshOrcaCloudSession
+} from './profile-cloud-client'
 import { linkOrcaProfileToCloud } from './profile-cloud-index'
+import type { OrcaCloudSessionExchangeResponse } from './profile-cloud-session-exchange'
+import {
+  AmbiguousRefreshReplayBlockedError,
+  blocksAmbiguousRefreshReplay,
+  forgetAmbiguousRefreshAttempt,
+  recordAmbiguousRefreshAttempt,
+  wasRefreshTokenAmbiguouslyAttempted
+} from './profile-cloud-refresh-replay-guard'
 import {
   captureCloudSessionMutation,
   cloudSessionIdentity,
@@ -67,11 +79,78 @@ function clearCloudSessionIfUnchanged(
     )
   }
   clearOrcaCloudSession(profileId, userDataPath)
+  forgetAmbiguousRefreshAttempt(cloudSessionRefreshKey(profileId, userDataPath))
   // Why: the renderer cached auth status at startup; without this it keeps
   // showing "Connected" until the app restarts.
   emitOrcaCloudSessionInvalidated()
 }
 
+// Why: support cannot otherwise tell a genuine revocation from a sign-out we
+// caused ourselves by resending a refresh token whose first attempt never
+// answered. Never log the token itself.
+function warnIfPossibleRefreshReplay(
+  profileId: string,
+  userDataPath: string,
+  failed: OrcaCloudSession,
+  error: unknown
+): void {
+  if (!(error instanceof OrcaCloudRequestError) || error.statusCode !== 401) {
+    return
+  }
+  const key = cloudSessionRefreshKey(profileId, userDataPath)
+  if (!wasRefreshTokenAmbiguouslyAttempted(key, failed.refreshToken)) {
+    return
+  }
+  console.warn(
+    '[orca-cloud] orca_cloud_refresh_possible_replay: refresh rejected 401 for a token whose earlier attempt never answered'
+  )
+}
+
+type CloudSessionRefreshAttempt =
+  | { status: 'refreshed'; response: OrcaCloudSessionExchangeResponse }
+  | { status: 'rotated-elsewhere'; session: OrcaCloudSession }
+
+function isRetryableCloudRefreshRejection(error: unknown): boolean {
+  return error instanceof OrcaCloudRequestError && error.statusCode >= 500
+}
+
+async function attemptCloudSessionRefresh(
+  key: string,
+  config: OrcaCloudAuthConfig,
+  active: ActiveOrcaProfileState,
+  userDataPath: string,
+  session: OrcaCloudSession
+): Promise<CloudSessionRefreshAttempt> {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const response = await refreshOrcaCloudSession(config, session)
+      forgetAmbiguousRefreshAttempt(key)
+      return { status: 'refreshed', response }
+    } catch (error) {
+      const ambiguous = isAmbiguousCloudRequestFailure(error)
+      if (ambiguous) {
+        recordAmbiguousRefreshAttempt(key, session.refreshToken)
+      }
+      // Only a status line proves the server rejected this token without
+      // rotating it, so a definitive 5xx is the only failure worth retrying.
+      const retryable = !ambiguous && attempt === 0 && isRetryableCloudRefreshRejection(error)
+      if (!ambiguous && !retryable) {
+        throw error
+      }
+      // Another caller may have rotated the stored session while this attempt
+      // was in flight; that result is the one to use, and the token this attempt
+      // held is no longer ours to send again.
+      const current = readOrcaCloudSession(active.profile.id, userDataPath)
+      if (current.status === 'found' && current.session.refreshToken !== session.refreshToken) {
+        return { status: 'rotated-elsewhere', session: current.session }
+      }
+      if (ambiguous) {
+        throw error
+      }
+    }
+  }
+}
+
 async function refreshStoredCloudSession(
   config: OrcaCloudAuthConfig,
   active: ActiveOrcaProfileState,
@@ -95,9 +174,16 @@ async function refreshStoredCloudSession(
     if (!active.profile.cloud) {
       throw new StaleCloudSessionMutationError()
     }
+    if (blocksAmbiguousRefreshReplay(key, session.refreshToken)) {
+      throw new AmbiguousRefreshReplayBlockedError()
+    }
     const expectedIdentity = cloudSessionIdentity(active.profile.id, active.profile.cloud)
     const snapshot = captureCloudSessionMutation(expectedIdentity, userDataPath)
-    const refreshed = await refreshOrcaCloudSession(config, session)
+    const attempt = await attemptCloudSessionRefresh(key, config, active, userDataPath, session)
+    if (attempt.status === 'rotated-elsewhere') {
+      return attempt.session
+    }
+    const refreshed = attempt.response
     const refreshedIdentity = cloudSessionIdentity(active.profile.id, refreshed.cloud)
     if (
       refreshedIdentity.cloudUserId !== expectedIdentity.cloudUserId ||
@@ -148,6 +234,7 @@ export async function readFreshOrcaCloudSession(
     }
   } catch (error) {
     if (isOrcaCloudAuthFailure(error)) {
+      warnIfPossibleRefreshReplay(active.profile.id, userDataPath, session.session, error)
       clearCloudSessionIfUnchanged(active.profile.id, userDataPath, session.session, active)
       return { status: 'reconnect-required' }
     }
@@ -168,6 +255,7 @@ export async function forceRefreshOrcaCloudSession(
     }
   } catch (error) {
     if (isOrcaCloudAuthFailure(error)) {
+      warnIfPossibleRefreshReplay(active.profile.id, userDataPath, session, error)
       clearCloudSessionIfUnchanged(active.profile.id, userDataPath, session, active)
       return { status: 'reconnect-required' }
     }
diff --git a/src/main/runtime/relay/relay-origin-pool.ts b/src/main/runtime/relay/relay-origin-pool.ts
index ca29c41e8a7..acd2f90292e 100644
--- a/src/main/runtime/relay/relay-origin-pool.ts
+++ b/src/main/runtime/relay/relay-origin-pool.ts
@@ -7,6 +7,7 @@ import type { RelayDrainMessage } from './relay-control-protocol'
 import type { RelayHostCloseReason } from '../../../shared/relay-host-close-reason'
 import { RelayDrainRetrySchedule } from './relay-drain-retry-schedule'
 import { RelayHttpError, requestRelayAssignment, type RelayAssignment } from './relay-http-client'
+import { relayRenewalDelayMs } from './relay-renewal-jitter'
 import type { RelayBrokerStatus, RelayIdentity } from './relay-session-broker-contract'
 import type { RelayRegion } from './relay-region-preference'
 
@@ -245,8 +246,7 @@ export class RelayOriginPool {
     }
     const now = (this.options.now ?? Date.now)()
     const random = this.options.random ?? Math.random
-    const earlyMs = 60_000 + Math.floor(random() * 60_001)
-    const delay = Math.max(0, origin.controlLeaseExpiresAt - earlyMs - now)
+    const delay = relayRenewalDelayMs(origin.controlLeaseExpiresAt, now, random)
     this.rotationTimer = setTimeout(() => void this.rebindActiveControl(origin), delay)
   }
 
diff --git a/src/main/runtime/relay/relay-renewal-jitter.test.ts b/src/main/runtime/relay/relay-renewal-jitter.test.ts
new file mode 100644
index 00000000000..5bbc0994836
--- /dev/null
+++ b/src/main/runtime/relay/relay-renewal-jitter.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest'
+import {
+  RELAY_RENEWAL_JITTER_RATIO,
+  RELAY_RENEWAL_SAFETY_MARGIN_MS,
+  relayRenewalDelayMs
+} from './relay-renewal-jitter'
+
+const LEASE_MS = 55 * 60_000
+const latest = LEASE_MS - RELAY_RENEWAL_SAFETY_MARGIN_MS
+const base = latest / (1 + RELAY_RENEWAL_JITTER_RATIO)
+
+describe('relay renewal jitter', () => {
+  it('keeps every sample inside the jitter band and before the safety margin', () => {
+    let seed = 1
+    const random = (): number => {
+      seed = (seed * 1103515245 + 12345) % 2147483648
+      return seed / 2147483648
+    }
+    const samples: number[] = []
+    for (let i = 0; i < 20_000; i++) {
+      samples.push(relayRenewalDelayMs(LEASE_MS, 0, random))
+    }
+    for (const sample of samples) {
+      expect(sample).toBeGreaterThanOrEqual(Math.floor(base * (1 - RELAY_RENEWAL_JITTER_RATIO)))
+      expect(sample).toBeLessThanOrEqual(latest)
+      // The renewal never lands inside the margin, so it never races expiry.
+      expect(LEASE_MS - sample).toBeGreaterThanOrEqual(RELAY_RENEWAL_SAFETY_MARGIN_MS)
+    }
+    const mean = samples.reduce((total, sample) => total + sample, 0) / samples.length
+    expect(Math.abs(mean - base) / base).toBeLessThan(0.005)
+  })
+
+  it('spreads a same-second cohort over minutes instead of one second', () => {
+    const delays = Array.from({ length: 1000 }, (_, index) =>
+      relayRenewalDelayMs(LEASE_MS, 0, () => index / 999)
+    )
+    const spread = Math.max(...delays) - Math.min(...delays)
+    expect(spread).toBeGreaterThan(9 * 60_000)
+  })
+
+  it('pins the band ends to the base interval', () => {
+    expect(relayRenewalDelayMs(LEASE_MS, 0, () => 0)).toBe(
+      Math.floor(base * (1 - RELAY_RENEWAL_JITTER_RATIO))
+    )
+    expect(relayRenewalDelayMs(LEASE_MS, 0, () => 0.5)).toBe(Math.floor(base))
+    expect(relayRenewalDelayMs(LEASE_MS, 0, () => 1)).toBe(latest)
+  })
+
+  it('renews immediately once the lease is inside the safety margin', () => {
+    expect(relayRenewalDelayMs(RELAY_RENEWAL_SAFETY_MARGIN_MS, 0, () => 1)).toBe(0)
+    expect(relayRenewalDelayMs(0, 60_000, () => 1)).toBe(0)
+  })
+
+  it('measures the delay from now, not from the epoch', () => {
+    expect(relayRenewalDelayMs(LEASE_MS + 1_000_000, 1_000_000, () => 0.5)).toBe(Math.floor(base))
+  })
+})
diff --git a/src/main/runtime/relay/relay-renewal-jitter.ts b/src/main/runtime/relay/relay-renewal-jitter.ts
new file mode 100644
index 00000000000..8b1f1ec6412
--- /dev/null
+++ b/src/main/runtime/relay/relay-renewal-jitter.ts
@@ -0,0 +1,25 @@
+// Why: a cell recreate reconnects a whole cohort inside one second. Every host
+// in it then took its lease from the same second and, with only a 60s-wide
+// spread, renewed inside the same second ~54 minutes later — a self-sustaining
+// fleet-wide reconnect burst. Full +/-10% jitter spreads that cohort over
+// minutes instead.
+export const RELAY_RENEWAL_JITTER_RATIO = 0.1
+
+// The latest jittered renewal still lands this far before expiry.
+export const RELAY_RENEWAL_SAFETY_MARGIN_MS = 90_000
+
+// Why: the relay accepts a rebind at any point in the lease and resets the full
+// TTL from it (cloud/apps/relay/src/host-session-registry.ts:736-743), so
+// renewing early is free; only renewing late is fatal (:997 drains an expired
+// lease). That asymmetry is why the base is shrunk to fit the upward jitter
+// rather than the jittered value being clipped at the margin.
+export function relayRenewalDelayMs(expiresAt: number, now: number, random: () => number): number {
+  const remaining = expiresAt - now
+  const latest = remaining - RELAY_RENEWAL_SAFETY_MARGIN_MS
+  if (latest <= 0) {
+    return 0
+  }
+  const base = latest / (1 + RELAY_RENEWAL_JITTER_RATIO)
+  const jittered = base * (1 + (random() * 2 - 1) * RELAY_RENEWAL_JITTER_RATIO)
+  return Math.max(0, Math.min(Math.floor(jittered), latest))
+}
diff --git a/src/main/runtime/relay/relay-session-broker.ts b/src/main/runtime/relay/relay-session-broker.ts
index d8d0ec45047..cd83545e9ca 100644
--- a/src/main/runtime/relay/relay-session-broker.ts
+++ b/src/main/runtime/relay/relay-session-broker.ts
@@ -16,6 +16,7 @@ import {
   type RelayAssignment
 } from './relay-http-client'
 import { RelayOriginPool } from './relay-origin-pool'
+import { relayRenewalDelayMs } from './relay-renewal-jitter'
 import type { RelayBrokerStatus, RelaySessionBrokerOptions } from './relay-session-broker-contract'
 
 export type { RelayBrokerStatus } from './relay-session-broker-contract'
@@ -243,8 +244,7 @@ export class RelaySessionBroker {
     }
     const now = (this.options.now ?? Date.now)()
     const random = this.options.random ?? Math.random
-    const earlyMs = 60_000 + Math.floor(random() * 60_001)
-    const delay = Math.max(0, authorization.expiresAt - earlyMs - now)
+    const delay = relayRenewalDelayMs(authorization.expiresAt, now, random)
     this.refreshTimer = setTimeout(() => void this.refreshAuthorization(), delay)
   }
 

From 92456b1618b2ae9676045fe652bdaddf31205520 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:07:15 -0700
Subject: [PATCH 52/58] perf(ports): serve unchanged macOS listeners from
 remembered metadata (#18650)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* perf(ports): serve unchanged macOS listeners from remembered metadata

The workspace port scan shells out three times every 30s while the window is
visible. Profiling an idle app showed the cycle costs 0.67s of CPU — about 2.2%
of a core sustained, roughly 65% of Orca's total idle CPU — and two of those
three commands only re-derive the command line and cwd of listeners that have
not changed since the last scan.

Reuse the metadata already remembered for a listener when this scan's free
lsof -F c process name still matches, so a recycled pid re-probes instead of
inheriting a dead process's attribution. In steady state that drops the cycle to
the single listening scan.

* perf(ports): pin cached listener metadata to its socket and re-probe every tenth scan

The metadata cache trusted an entry on pid:host:port plus the lsof -F c
process name, so a recycled pid running the same command name on the same
port would inherit a dead process's command line and cwd, and a process that
chdir'd while listening kept its old cwd forever.

Add the socket's kernel identity (lsof -F d) to the already-running listening
command — measured at no spawn and no wall-time cost — and require it to
match before reusing an entry: a restarted process listens through a new
socket. Also re-probe every remembered entry every tenth scan (~5 min) so a
changed cwd cannot go stale indefinitely. Steady state stays at one command
per cycle for nine of every ten scans.

* docs(ports): note the ordering contract between the reuse split and the remember step

* fix(ports): never authorize a kill from remembered listener metadata

requireMetadata is the SIGTERM authorization re-scan, and its own comment says
it must never land on a cycle that skipped owner attribution. The metadata cache
could serve it entirely from memory, so a process that had chdir'd out of a
worktree could stay attributed to it for up to the re-probe ceiling and be
killed on Stop. That caller now always probes; background polls still cache.

* fix(ports): re-derive every port of a pid when any one of them needs metadata

A process listening on several ports could have one row served from remembered
metadata and another from a fresh probe, so a process that moved between scans
reported two different workspace attributions until the next full re-probe.
Decide per pid first, then hydrate only pids that need no probe at all.

* refactor(ports): let the cache module own the requireMetadata bypass

Keeps the scanner under the max-lines gate and puts the cache policy with the
cache rather than at the call site.
---
 .../local-workspace-platform-port-scanner.ts  |  39 ++--
 .../ports/local-workspace-port-scan-state.ts  | 108 ++++++++-
 .../local-workspace-port-scanner.test.ts      | 205 +++++++++++++++++-
 3 files changed, 329 insertions(+), 23 deletions(-)

diff --git a/src/main/ports/local-workspace-platform-port-scanner.ts b/src/main/ports/local-workspace-platform-port-scanner.ts
index 7e3b9941617..9a760870540 100644
--- a/src/main/ports/local-workspace-platform-port-scanner.ts
+++ b/src/main/ports/local-workspace-platform-port-scanner.ts
@@ -3,6 +3,7 @@ import { getProcessOutputFields } from '../../shared/process-output-field-scanne
 import { readWindowsProcessTable } from '../windows/windows-process-table'
 import { runPortScanCommand } from './port-scan-command-client'
 import {
+  partitionListenersNeedingMetadata,
   recallListenerMetadata,
   rememberListenerMetadata,
   shouldSkipMetadataCommands,
@@ -19,25 +20,27 @@ import {
 
 export function parseLsofListeningOutput(output: string): RawListeningPort[] {
   const ports: RawListeningPort[] = []
-  let currentPid: number | undefined
-  let currentProcessName: string | undefined
+  let pid: number | undefined
+  let processName: string | undefined
+  let socketId: string | undefined
 
   for (const line of output.split('\n')) {
-    if (!line) {
-      continue
-    }
     const tag = line[0]
     const value = line.slice(1)
     if (tag === 'p') {
-      const pid = Number.parseInt(value, 10)
-      currentPid = Number.isFinite(pid) ? pid : undefined
-      currentProcessName = undefined
+      const parsedPid = Number.parseInt(value, 10)
+      pid = Number.isFinite(parsedPid) ? parsedPid : undefined
+      processName = socketId = undefined
     } else if (tag === 'c') {
-      currentProcessName = value
+      processName = value
+    } else if (tag === 'f') {
+      socketId = undefined // each file record restarts; a socket without `d` must not inherit one
+    } else if (tag === 'd') {
+      socketId = value || undefined
     } else if (tag === 'n') {
       const parsed = parseAddressWithPort(value)
       if (parsed) {
-        ports.push({ pid: currentPid, processName: currentProcessName, ...parsed })
+        ports.push({ pid, processName, ...(socketId ? { socketId } : {}), ...parsed })
       }
     }
   }
@@ -118,17 +121,23 @@ async function scanDarwinLsofPorts(
     '-iTCP',
     '-sTCP:LISTEN',
     '-F',
-    'pcn'
+    // Why `d`: the socket's kernel identity is free on this command and lets the metadata cache
+    // tell a recycled pid on the same port apart from the process it remembered.
+    'pcnd'
   ])
   const ports = parseLsofListeningOutput(stdout)
   if (shouldSkipMetadataCommands(spawnMs, options)) {
     return { ports, metadataAvailable: false }
   }
-  const metadata = await loadDarwinProcessMetadata(
-    new Set(ports.flatMap((p) => (p.pid ? [p.pid] : [])))
-  )
+  // Why: on a quiet machine the same servers keep listening, so the two metadata commands — the
+  // expensive half of the scan — would re-derive answers the last scan already has.
+  const { hydrated, pidsNeedingMetadata } = partitionListenersNeedingMetadata(ports, options)
+  if (pidsNeedingMetadata.size === 0) {
+    return { ports: hydrated, metadataAvailable: true }
+  }
+  const metadata = await loadDarwinProcessMetadata(pidsNeedingMetadata)
   return {
-    ports: ports.map((port) => ({ ...metadata.get(port.pid ?? -1), ...port })),
+    ports: hydrated.map((port) => ({ ...metadata.get(port.pid ?? -1), ...port })),
     metadataAvailable: true
   }
 }
diff --git a/src/main/ports/local-workspace-port-scan-state.ts b/src/main/ports/local-workspace-port-scan-state.ts
index 582e8b9731e..e4025944c79 100644
--- a/src/main/ports/local-workspace-port-scan-state.ts
+++ b/src/main/ports/local-workspace-port-scan-state.ts
@@ -7,10 +7,14 @@ import {
 } from './workspace-port-scan-timeout-backoff'
 
 const SLOW_SPAWN_SKIP_METADATA_MS = 2_000
+/** Re-probe a remembered listener every Nth scan (~5 min at 30s) so a cwd change cannot go stale forever. */
+const METADATA_REPROBE_INTERVAL_SCANS = 10
 const commandTimeoutBackoff = new WorkspacePortScanTimeoutBackoff()
 let loggedWorkerUnavailable = false
 let skippedMetadataOnLastScan = false
-let lastListenerMetadata = new Map<string, ProcessMetadata>()
+let lastListenerMetadata = new Map<string, RememberedListenerMetadata>()
+let metadataScanSequence = 0
+let reusedListenerKeys = new Set<string>()
 
 export type WorkspacePortScanOptions = {
   requireMetadata?: boolean
@@ -21,6 +25,8 @@ export type RawListeningPort = {
   port: number
   pid?: number
   processName?: string
+  /** Kernel socket identity from `lsof -F d`; a new socket on the same pid:port gets a new one. */
+  socketId?: string
   commandLine?: string
   cwd?: string
 }
@@ -31,6 +37,11 @@ export type ProcessMetadata = {
   cwd?: string
 }
 
+type RememberedListenerMetadata = ProcessMetadata & {
+  socketId?: string
+  probedAtScan: number
+}
+
 export type NormalizedWorkspacePortProbe = {
   worktree: WorkspacePortProbe
   normalizedPath: string
@@ -58,6 +69,8 @@ export function resetWorkspacePortScanTimeoutBackoffForTests(): void {
   loggedWorkerUnavailable = false
   skippedMetadataOnLastScan = false
   lastListenerMetadata = new Map()
+  metadataScanSequence = 0
+  reusedListenerKeys = new Set()
 }
 
 export function shouldSkipMetadataCommands(
@@ -72,17 +85,98 @@ export function shouldSkipMetadataCommands(
   return skip
 }
 
+// dedupeRawPorts already collapses rows by connectHost:port:pid, so this key is unique per row.
 function listenerMetadataKey(port: RawListeningPort): string {
   return `${port.pid ?? 'unknown'}:${port.host}:${port.port}`
 }
 
+/** Call after partitionListenersNeedingMetadata: it consumes the reuse set that call recorded. */
 export function rememberListenerMetadata(ports: readonly RawListeningPort[]): void {
-  lastListenerMetadata = new Map(
-    ports.map((port) => [
-      listenerMetadataKey(port),
-      { processName: port.processName, commandLine: port.commandLine, cwd: port.cwd }
-    ])
-  )
+  const previous = lastListenerMetadata
+  lastListenerMetadata = new Map()
+  for (const port of ports) {
+    const key = listenerMetadataKey(port)
+    // Why: a reused entry keeps its original probe time so the staleness ceiling still expires it.
+    const probedAtScan = reusedListenerKeys.has(key)
+      ? (previous.get(key)?.probedAtScan ?? metadataScanSequence)
+      : metadataScanSequence
+    lastListenerMetadata.set(key, {
+      processName: port.processName,
+      socketId: port.socketId,
+      commandLine: port.commandLine,
+      cwd: port.cwd,
+      probedAtScan
+    })
+  }
+  reusedListenerKeys = new Set()
+}
+
+/**
+ * Split listeners into those a previous scan already resolved and the pids still needing a probe.
+ *
+ * Records which keys were reused; rememberListenerMetadata reads and clears that on the same scan.
+ *
+ * Why: the metadata commands are the expensive half of a macOS scan, and a listener that is still
+ * the same process on the same address has the same command line it had 30s ago. A remembered
+ * entry is only trusted when the free `lsof -F c` process name and `-F d` socket identity from
+ * this scan still match, so a recycled pid re-probes instead of inheriting the dead process's
+ * metadata; and every entry is re-probed after METADATA_REPROBE_INTERVAL_SCANS so a process that
+ * chdir'd while listening cannot keep a stale cwd forever.
+ */
+export function partitionListenersNeedingMetadata(
+  ports: readonly RawListeningPort[],
+  options: WorkspacePortScanOptions = {}
+): { hydrated: RawListeningPort[]; pidsNeedingMetadata: Set<number> } {
+  metadataScanSequence += 1
+  reusedListenerKeys = new Set()
+  // Why requireMetadata opts out: that caller is the SIGTERM authorization re-scan, so it must
+  // attribute the owner from this cycle's probe and never from a remembered cwd.
+  if (options.requireMetadata) {
+    return {
+      hydrated: [...ports],
+      pidsNeedingMetadata: new Set(ports.flatMap((port) => (port.pid ? [port.pid] : [])))
+    }
+  }
+  const hydrated: RawListeningPort[] = []
+  const pidsNeedingMetadata = new Set<number>()
+  const reusableByPort = new Map<RawListeningPort, ProcessMetadata>()
+  for (const port of ports) {
+    const remembered = lastListenerMetadata.get(listenerMetadataKey(port))
+    // Why require commandLine: a probe that returned nothing must not be cached as an answer.
+    if (
+      remembered?.commandLine !== undefined &&
+      remembered.processName === port.processName &&
+      remembered.socketId === port.socketId &&
+      metadataScanSequence - remembered.probedAtScan < METADATA_REPROBE_INTERVAL_SCANS &&
+      port.pid !== undefined
+    ) {
+      reusableByPort.set(port, remembered)
+      continue
+    }
+    if (port.pid !== undefined) {
+      pidsNeedingMetadata.add(port.pid)
+    }
+  }
+  // Why the second pass: if any of a pid's sockets needs a probe, none of its sockets may be
+  // served from cache — otherwise one process reports a fresh cwd on one row and a remembered
+  // cwd on another, i.e. two different workspace attributions.
+  for (const port of ports) {
+    const remembered =
+      port.pid !== undefined && !pidsNeedingMetadata.has(port.pid)
+        ? reusableByPort.get(port)
+        : undefined
+    if (remembered) {
+      reusedListenerKeys.add(listenerMetadataKey(port))
+      hydrated.push({
+        ...port,
+        commandLine: port.commandLine ?? remembered.commandLine,
+        cwd: port.cwd ?? remembered.cwd
+      })
+      continue
+    }
+    hydrated.push(port)
+  }
+  return { hydrated, pidsNeedingMetadata }
 }
 
 export function recallListenerMetadata(port: RawListeningPort): RawListeningPort {
diff --git a/src/main/ports/local-workspace-port-scanner.test.ts b/src/main/ports/local-workspace-port-scanner.test.ts
index be37ad60eb3..4f6820be0bd 100644
--- a/src/main/ports/local-workspace-port-scanner.test.ts
+++ b/src/main/ports/local-workspace-port-scanner.test.ts
@@ -50,6 +50,35 @@ describe('local workspace port scanner parsing', () => {
     ])
   })
 
+  it('keeps the socket identity from lsof -F d and tolerates its absence', () => {
+    const ports = parseLsofListeningOutput(
+      [
+        'p123',
+        'cnode',
+        'f18',
+        'd0x469ca588d83e7924',
+        'n127.0.0.1:5173',
+        'f19',
+        'n127.0.0.1:5174',
+        'p456',
+        'cnginx',
+        'n*:8080'
+      ].join('\n')
+    )
+
+    expect(ports).toEqual([
+      {
+        pid: 123,
+        processName: 'node',
+        socketId: '0x469ca588d83e7924',
+        host: '127.0.0.1',
+        port: 5173
+      },
+      { pid: 123, processName: 'node', host: '127.0.0.1', port: 5174 },
+      { pid: 456, processName: 'nginx', host: '*', port: 8080 }
+    ])
+  })
+
   it('parses multiple lsof listening ports for the same process', () => {
     const ports = parseLsofListeningOutput(
       ['p123', 'cnode', 'n127.0.0.1:5173', 'n127.0.0.1:55173'].join('\n')
@@ -387,7 +416,19 @@ describe('scanWorkspacePorts with delayed process creation', () => {
 
   it('does not let a required-metadata scan reset the background skip parity', async () => {
     vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
-    mockStalledDarwinScan()
+    // Why a fresh pid each cycle: a listener the previous scan already resolved is served from the
+    // remembered metadata, so a stable pid would hide whether this scan skipped the probe or not.
+    let listenerPid = 123
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        listenerPid += 1
+        return { stdout: `p${listenerPid}\ncnode\nn127.0.0.1:5173`, spawnMs: 4_200 }
+      }
+      if (command === 'lsof') {
+        return { stdout: [`p${listenerPid}`, 'n/repo'].join('\n'), spawnMs: 4_200 }
+      }
+      return { stdout: `${listenerPid} node /repo/server.js`, spawnMs: 4_200 }
+    })
 
     await scanWorkspacePorts(worktrees, urlWatcherStub())
     await scanWorkspacePorts(worktrees, urlWatcherStub(), { requireMetadata: true })
@@ -397,6 +438,168 @@ describe('scanWorkspacePorts with delayed process creation', () => {
     expect(runPortScanCommandMock).toHaveBeenCalledTimes(7)
   })
 
+  it('serves an unchanged listener from remembered metadata instead of re-probing', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: LSOF_LISTEN_OUTPUT, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', 'n/repo'].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: '123 node /repo/server.js', spawnMs: 5 }
+    })
+
+    const first = await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(3)
+
+    const second = await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    // Only the listening scan itself runs; the two metadata commands are served from the cache.
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(4)
+    expect(second.ports).toEqual(first.ports)
+  })
+
+  it('re-probes every port of a pid when any one of them needs metadata', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    let secondSocket = 'd0xbbbb'
+    let cwd = '/repo'
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return {
+          stdout: [
+            'p123',
+            'cnode',
+            'f10',
+            'd0xaaaa',
+            'n127.0.0.1:5173',
+            'f11',
+            secondSocket,
+            'n127.0.0.1:5174'
+          ].join('\n'),
+          spawnMs: 5
+        }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', `n${cwd}`].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: `123 node ${cwd}/server.js`, spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(3)
+
+    // One socket is replaced and the process has since moved, so this pid must be re-derived for
+    // BOTH its rows — serving one from cache would report two different workspaces for one process.
+    secondSocket = 'd0xcccc'
+    cwd = '/elsewhere'
+    const scan = await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(6)
+    expect(new Set(scan.ports.map((entry) => entry.kind)).size).toBe(1)
+  })
+
+  it('always probes metadata for a requireMetadata scan, even when the cache is warm', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: LSOF_LISTEN_OUTPUT, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', 'n/repo'].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: '123 node /repo/server.js', spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(3)
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    // Warm cache: the background poll is served without the metadata commands.
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(4)
+
+    // Why: this is the SIGTERM authorization re-scan; a remembered cwd must never authorize a kill.
+    await scanWorkspacePorts(worktrees, urlWatcherStub(), { requireMetadata: true })
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(7)
+  })
+
+  it('re-probes when a recycled pid is running a different process', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    let processName = 'node'
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: `p123\nc${processName}\nn127.0.0.1:5173`, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', 'n/repo'].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: `123 ${processName} /repo/server.js`, spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(3)
+
+    // Same pid and address, different process: the remembered metadata must not be reused.
+    processName = 'python3'
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(6)
+  })
+
+  it('re-probes when the same pid and name listen through a different socket', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    let socketId = '0x1'
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: `p123\ncnode\nf18\nd${socketId}\nn127.0.0.1:5173`, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', 'n/repo'].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: '123 node /repo/server.js', spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(4)
+
+    // Same pid, name and address but a new kernel socket: a restarted process, not the cached one.
+    socketId = '0x2'
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(7)
+  })
+
+  it('re-probes a remembered listener every tenth scan so a changed cwd cannot stay stale', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    let cwd = '/repo'
+    runPortScanCommandMock.mockImplementation(async (command: string, args: string[]) => {
+      if (command === 'lsof' && args.includes('-iTCP')) {
+        return { stdout: LSOF_LISTEN_OUTPUT, spawnMs: 5 }
+      }
+      if (command === 'lsof') {
+        return { stdout: ['p123', `n${cwd}`].join('\n'), spawnMs: 5 }
+      }
+      return { stdout: '123 node server.js', spawnMs: 5 }
+    })
+
+    await scanWorkspacePorts(worktrees, urlWatcherStub())
+    cwd = '/repo/worktrees/feature'
+    for (let scan = 2; scan <= 10; scan += 1) {
+      const cached = await scanWorkspacePorts(worktrees, urlWatcherStub())
+      expect(cached.ports[0]).toMatchObject({ owner: { worktreeId: 'repo::/repo' } })
+    }
+    // 3 for the first scan, then one listening command per cached scan.
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(12)
+
+    const reprobed = await scanWorkspacePorts(worktrees, urlWatcherStub())
+
+    expect(runPortScanCommandMock).toHaveBeenCalledTimes(15)
+    expect(reprobed.ports[0]).toMatchObject({
+      owner: { worktreeId: 'repo::/repo/worktrees/feature' }
+    })
+  })
+
   // Regression for #11161 review: without carry-forward the panel moves every
   // workspace port into External on each skipped cycle.
   it('carries the previous cycle attribution through a skipped scan', async () => {

From f4c2821167dd802e3cc38838538761af9732f07e Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:09:23 -0700
Subject: [PATCH 53/58] refactor(agent-session-journal): move the session
 journal onto SQLite (#18652)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* refactor(agent-session-journal): move the session journal onto SQLite

The agent-session journal kept its state in three hand-rolled file formats: an
append-only `log.jsonl` with torn-tail repair, a `snapshot.json` holding folded
state plus a retained tail, and byte-quarantine files for anything unreadable.
This replaces all of it with one SQLite database per session — `journal.db`
beside the existing `blobs/` store — using the in-house adapter and the
open/pragma/migrate/harden pattern the orchestration database already follows.

Two tables: `journal_rows` (the append-only log, keyed by
`(session_id, epoch, seq)`) and `journal_sessions` (the derived projection,
upserted in the SAME transaction as every insert). Rows stay JSON in one
column, so the row schema, the version upcast chain, and the reducer survive
byte for byte — `journal-reducer.test.ts` and four other suites pass unchanged
and are the regression proof.

Deleted: `journal-log-file.ts`, `journal-compaction.ts`,
`journal-corruption-quarantine.ts`, and the public `compact()` /
`compactionBoundary` / `autoCompact` members, none of which had a non-test
caller.

Existing `log.jsonl` / `snapshot.json` journals are deliberately abandoned. No
importer: a session created on the old path stops working, which is acceptable
because the feature is off by default.

## The physical quota is repriced, because SQLite does not charge like a file

The 256 MiB per-session bound is unchanged, but the arithmetic under it could
not survive: SQLite grows the database in pages and the WAL in frames, and the
checkpoint that copies the WAL forward holds the same pages in both files at
once, so a transaction's peak is about twice its content. Admission now charges
the candidate transaction's own measured page cost, validated against a sweep
that runs as a regression test (`journal-database-space.test.ts`) rather than
derived from reasoning about the allocator.

Four things are load-bearing rather than tuning, each measured:

- `auto_vacuum = INCREMENTAL` must be set BEFORE `journal_mode = WAL`. Set it
  after and it is ignored with no error, reclamation silently becomes a no-op,
  and the file never shrinks again. Both halves are asserted.
- `wal_autocheckpoint = 0` plus an explicit `wal_checkpoint(TRUNCATE)` at the
  end of every write path, so the one moment the same pages live in two files is
  a moment the charge accounts for.
- Reclamation runs in bounded chunks. A single unbounded `incremental_vacuum`
  took a 252 MB directory to 504 MB — the reclamation added to defend the bound
  would have breached it. `PRAGMA incremental_vacuum(N)` also frees exactly one
  page unless it is stepped to completion, which no size assertion catches, so
  the freed page count is asserted directly.
- A blocked checkpoint leaves the WAL on disk together with the database growth
  it already copied, so admission charges that deferred copy explicitly. The
  term is zero whenever the last checkpoint succeeded, so the uncontended path
  admits and refuses an identical set.

The epoch discard is `DELETE FROM journal_rows` with no WHERE clause, which
takes SQLite's truncate optimization: measured at ~0.26% of the database in WAL
bytes where the `WHERE session_id = ?` form rewrote every emptied leaf at up to
99%. One database per session is what makes the unqualified form correct.

An open, empty journal costs 57,344 bytes before a single row exists, so a
configured quota below `JOURNAL_MIN_SESSION_BYTES` now fails loudly at open with
the existing `journal_bound_exceeded` instead of as a run of identical append
failures. No production caller configures one; the affected surface is test
fixtures, rescaled to the smallest value that restores what each case proves.

## One deliberate behaviour change

Compaction was the only mechanism that shed bytes inside an epoch, and the write
path called it precisely so an append at the bound was not refused. The
SQLite-shaped replacement — a bounded prefix delete — cannot be used: with the
snapshot gone the surviving rows ARE the state, so dropping the oldest of them
loses the oldest transcript silently at the next reopen. So no row is ever shed
inside an epoch, and a session whose row bytes alone reach the bound now refuses
every append where it previously compacted and continued. A loud typed refusal
beats silent data loss.

What still sheds is unreferenced BLOB bytes — the dominant and unbounded byte
source — on the same write-path hook. The escape from the hard stop is the fold
that already exists, `replaceEpochItems`, which now actually returns bytes to
the filesystem instead of leaving them on the freelist.

The prune's protected set is a union of live reducer digests AND the candidate
row's own digests, including those cited only by a nested lifecycle-batch
mutation. Content addressing never rewrites a digest already on disk, so
protecting live state alone deletes the blob the append is about to cite — a
dangling reference that surfaces one reopen later as an empty expansion on an
item the user can see. `journal-store-blob-budget.test.ts` pins it, and it goes
red when the set is narrowed back.

## Handle ownership

A file handle used to be opened and closed per append; a SQLite handle is held
for the session's lifetime. Every path that can open a connection now has one
owner: the open function owns its raw connection until it returns, the store
owns its retained one and releases it in a new `close()`, and every other
connection is closed by the call that opened it. The attach, recovery,
eviction, map-overwrite and host-teardown paths close what they drop, and host
teardown is failure-complete — the sink-barrier flush throws by design, so a
trailing close statement would be skipped on exactly the path that leaks.

`close()` has a stated contract: admission at enqueue and permanent, the close
step on the same queue past that gate, one shared in-flight attempt, fulfilment
terminal, and the release last and deliberately unguarded so a retry re-enters
it. Guarding the release would skip it on retry, guaranteeing a permanent leak
in exactly the case where it did not release.

`journal_closed` joins the error union for a write after `close()`; no file
outside the directory references any of these codes.

* fix(agent-session-journal): make a COMMIT final, stop repairs deleting valid rows, and keep rejected closes retryable

Six review findings on the SQLite journal migration.

1. A successful COMMIT is now the point of no return. The ordinary append,
   the epoch roll and the epoch replacement each adopt the committed row or
   epoch BEFORE any post-commit filesystem work; checkpoint, reclaim, blob
   prune and directory measurement run through `runJournalPostCommit`, which
   is best-effort by design and falls back to the transaction's own charge as
   a conservative footprint. Previously a post-COMMIT scan failure rejected a
   durable append and the next one reused its sequence, and a failed epoch
   housekeeping step left the store writing into a prefix already deleted.

2. Corruption repair preserves instead of destroying. A rejected suffix is
   copied into a new `journal_quarantine` table and removed from the live
   epoch in ONE transaction per chunk, charged against the session bound
   before a byte is written; a journal that cannot afford the copy refuses to
   open rather than falling back to deletion. The repair state is exposed as
   `journal.repair` and the rows are readable through
   `recoverQuarantinedRows()`, so Orca-owned submission, receipt and
   lifecycle identity survives a gap or a malformed row.

3. The physical charge covers the B-tree key payload. `session_id` and
   `epoch` are stored in both tables and both primary-key indexes and appear
   nowhere in `row_json`, so the journal boundary now bounds them and
   `journalTxnPhysicalCost` charges those bounds plus the projection upsert.
   The charge sweep runs the exact production transaction at maximum admitted
   key sizes.

4. A rejected `close()` no longer orphans its handle. Callers hand the
   journal to `agentSessionJournalCloseRetries` instead of swallowing the
   rejection, the attach map replacement is ABORTED when the previous
   journal will not close, host teardown retries what the registry holds, and
   a failed runtime teardown is retained so the next stop is a real retry.

5. `journalWalBytes()` returns zero only for ENOENT and propagates every
   other stat error, so admission and reclamation fail closed.

6. The WAL contention test closes the writer before removing its temp root
   and asserts the directory is removable once handles close.

Regression coverage: post-commit divergence (4), corruption repair (5),
key bounds (5), WAL stat (8), close retry (5), plus a runtime stop-retry
case. Each fix was ablated on this head and the matching tests go red.

* fix(agent-session-journal): anchor replay at sequence 1, make quarantine append-only, and charge it in bytes

Three ways the corruption quarantine still lost rows it was written to keep.

Replay validated contiguity from the first row that HAPPENED to remain, so an
epoch missing only its sequence-1 row declared the leftovers contiguous and set
no `truncateFrom`. The load was still corrupt, so recovery imported provider
history and `replaceEpochItems` deleted every live row — including Orca-minted
submission, receipt and lifecycle identity that no transcript can reconstruct,
and that nothing had quarantined. Replay now anchors at sequence 1, so a missing
epoch row rejects the whole surviving range before any replacement runs.

`journal_quarantine` was keyed on `(session_id, epoch, seq)` and copied with
`INSERT OR REPLACE`. A repair frees the sequences it removed and the live epoch
reuses them, so a second repair in the same epoch silently deleted what the
first preserved. The table is now keyed on a surrogate `quarantine_id`, the copy
is a plain append, and `(epoch, seq)` is metadata; existing v1 databases are
rekeyed in the migration that already bumps `user_version`.

The admission charge read `length(row_json)`, which counts CHARACTERS for a TEXT
value where `journalTxnPhysicalCost` expects physical UTF-8 bytes. A multibyte
suffix was charged at up to a third of what it writes, which defeats the
pre-write physical bound — over a megabyte on a maximum-size lifecycle batch.

* fix(agent-session-journal): keep a repaired epoch anchored and stop the v1 quarantine migration doubling the file

Replay validated numeric contiguity from sequence 1 but never that sequence 1
IS the epoch row. When the anchor was missing the repair set aside every
surviving row, and if provider-history import then failed — a transcript that
is temporarily gone is enough — the journal reopened as a clean, row-less
epoch: an ordinary append took sequence 1, replay accepted it, read-restore
published it as history, and automatic recovery never ran again while the
user's real messages sat in quarantine.

Replay now rejects an unanchored prefix, the open publishes an
`unreconcilable_prefix` anchor for an epoch its repair emptied, and that anchor
keeps reporting corrupt — so provider history is retried on every attach —
until the timeline is rebuilt or the session writes content of its own. A
repair also discloses rows it set aside when no line was unreadable at all,
which is the case that removes the most.

The v1 quarantine rekey copied every legacy row into the new table inside one
transaction and dropped the old one. A quarantine holds whole rejected rows: a
single 8 MiB row nearly doubled the database past the physical bound the open
had already checked, the dropped pages only reached the freelist, and the next
open refused the session it had just migrated. The v1 table is renamed and
frozen instead, and reads take both generations. Table creation also moves
inside the migration transaction, so a crash can no longer leave a v2-shaped
database still reporting version 0 for an older build to write into.

* fix(agent-session-journal): stop an empty provider transcript retiring the repair marker

A transcript that exists but decodes to zero messages was imported as a
success: the import published an empty `legacy_import` replacement that
deleted the `unreconcilable_prefix` anchor and its disclosure, so the next
probe read the session as clean and every later attach skipped provider
recovery while the user's rows sat in quarantine for good.

The import now leaves the epoch untouched when nothing decodes, reporting
`replaced: false`, and recovery treats that like a transcript it could not
read — the marker stands and a later attach with real history rebuilds the
timeline.

* style(agent-session-journal): merge the duplicate journal-database-space import

* refactor(agent-session-journal): drop quarantine, byte bound, blob spill and rate limit

Match what comparable implementations do: the journal is an unbounded
append-only SQLite log with no side tables and no admission control.

Corruption: the rejected suffix is DELETED rather than copied into a
quarantine table. The load still reports `corrupt` and recovery still
rebuilds the epoch from provider history, so the observable outcome is
unchanged — only the preservation half is gone. The schema is back to one
version with two tables; no v1 database exists outside unmerged commits of
this branch, so the rekey migration and the two-generation read path go with
it. Sequence-1 epoch anchoring and the empty-provider-transcript retry are
kept: both are about the corrupt signal being correct.

Size: no `maxSessionBytes`, so no page-cost arithmetic, reclaim band,
incremental vacuum, lifecycle byte reservations or `journal_bound_exceeded`.
`auto_vacuum` and `wal_autocheckpoint = 0` existed only to make a
transaction's physical cost predictable for that charge; with the charge gone
SQLite's default checkpointing is what the journal wants, and the explicit
pre-close checkpoint is redundant with the one `db.close()` performs. WAL,
`synchronous = FULL` and `busy_timeout` stay.

Payloads: an oversized body is truncated at the existing inline cap with the
existing marker and the remainder is discarded, bounded at the translation
layer that already calls these helpers. The truncation point and message do
not change; the content-addressed blob directory and all digest tracking do.

Rate: no `maxAppendsPerWindow` and no `journal_rate_exceeded`.

`JournalPayloadLimits` is now just the inline cap.

* fix(agent-session-journal): mark a partial repair pending and bound multi-block tool input

A repair that keeps its prefix had nothing durable to show for the suffix it
deleted: a sequence gap costs no malformed row, so no disclosure is appended,
and the surviving rows keep their epoch anchor. The next probe read a
contiguous anchored prefix, called it clean, and the deleted stretch of
timeline was never asked for again — silent loss, with the deletion already
committed. The deletion now writes a `journal_repairs` marker in the SAME
transaction, and replay keeps reporting corrupt while it stands. It retires
under exactly the rule the emptied-epoch anchor takes: a fresh epoch carries
the rebuild, or the session writes content of its own past the sequence the
repair left free. The repair's own disclosure is not that content.

Legacy import bounded a tool call's input only when it was the message's sole
block; the multi-block path returned `tool-call` unchanged, so a mixed message
from Claude, Grok or an omp execution cell persisted the whole input despite
`inlineHeadBytes`. `boundBlock` now routes it through `boundToolInput`.

Also drops canonical comments describing quarantine, snapshot files, blob
storage and blob compaction — none of which exist any more.

* fix(agent-session-wire): stop awaiting the synchronous journal probe

loadJournal runs on a sync-database connection and returns JournalLoad | null, so both wire call sites were awaiting a non-Promise. The type-aware code-quality gate flags it; the native gate does not.

---------

Co-authored-by: Merge Sim <sim@local>
---
 .../codex/codex-prompt-registry-bounds.ts     |   5 +-
 .../codex-structured-item-stream-bounds.ts    |  10 +-
 .../codex-structured-item-stream-contracts.ts |   1 -
 .../codex/codex-structured-item-streams.ts    |  17 +-
 .../codex-structured-item-translation.test.ts |   6 -
 .../codex-structured-item-translation.ts      |  18 +-
 ...codex-structured-journal-generic-frames.ts |   8 +-
 .../codex/codex-structured-journal-items.ts   |  14 +-
 .../codex-structured-journal-settlement.ts    |   6 +-
 .../codex/codex-structured-journal-sink.ts    |   8 +-
 ...ctured-journal-translation-streams.test.ts |   4 +-
 ...ex-structured-journal-translation-turns.ts |   2 -
 src/main/codex/codex-turn-ordinals.ts         |   5 +-
 .../journal-blob-store.ts                     | 110 ----
 .../journal-close-retry.ts                    |  68 +++
 .../journal-compaction.ts                     | 206 -------
 .../journal-corruption-quarantine.ts          | 102 ----
 .../journal-corruption-repair.test.ts         | 265 +++++++++
 .../journal-crash-boundary.test.ts            |  19 +-
 .../agent-session-journal/journal-cursor.ts   |   4 +-
 .../journal-database-schema.ts                |  37 ++
 .../journal-database.test.ts                  | 201 +++++++
 .../agent-session-journal/journal-database.ts |  80 +++
 .../journal-epoch-controller.ts               |  69 +--
 .../journal-epoch-replacement.test.ts         | 204 +++----
 .../journal-epoch-replacement.ts              | 333 ++---------
 .../journal-epoch-rollover.ts                 |  66 ++-
 .../journal-handle-ownership.test.ts          | 161 +++++
 .../journal-item-appender.ts                  |  46 +-
 .../journal-legacy-import.test.ts             | 457 ++++++---------
 .../journal-legacy-import.ts                  |  94 +--
 .../journal-lifecycle-admission.ts            | 160 -----
 .../journal-lifecycle-capacity.test.ts        |  30 -
 .../journal-lifecycle-capacity.ts             | 193 ------
 .../journal-log-file.test.ts                  | 374 ------------
 .../agent-session-journal/journal-log-file.ts | 365 ------------
 .../agent-session-journal/journal-open.ts     | 313 +++++-----
 .../agent-session-journal/journal-paths.ts    |   7 +
 .../journal-payload-bounds.ts                 |  30 +-
 .../journal-physical-quota.test.ts            | 125 ----
 .../journal-physical-quota.ts                 |  41 --
 .../journal-prompt-body-bounds.ts             |  12 +-
 .../journal-reducer.test.ts                   |  53 --
 .../agent-session-journal/journal-reducer.ts  |  24 -
 .../journal-repair-disclosure.ts              |  32 +
 .../journal-repair-marker.ts                  |  69 +++
 .../journal-row-table.ts                      |  92 +++
 ...journal-row-writer-read-only-latch.test.ts | 362 ------------
 .../journal-row-writer.test.ts                |  94 +++
 .../journal-row-writer.ts                     | 182 +-----
 .../journal-store-close.test.ts               | 259 +++++++++
 .../journal-store-close.ts                    | 106 ++++
 .../journal-store-collaborators.ts            |  88 +++
 .../journal-store-contracts.ts                |   7 -
 .../journal-store-open.ts                     |  79 +--
 .../journal-store-restore.ts                  |  49 ++
 .../journal-store-schema.test.ts              | 360 +++++-------
 .../journal-store-test-open.ts                |  34 ++
 .../journal-store.test.ts                     | 549 ++----------------
 .../agent-session-journal/journal-store.ts    | 246 +++-----
 .../journal-terminal-settlement.ts            |  13 +
 .../journal-tool-output-fallback.ts           |  58 --
 .../journal-write-guards.ts                   | 102 +---
 .../agent-session-history-page.test.ts        |  41 +-
 .../agent-session-journal-recovery.test.ts    | 362 ++++++++++--
 .../agent-session-journal-recovery.ts         |  45 +-
 .../structured-agent-session-attach-flow.ts   |   9 +-
 ...ured-agent-session-attach-orchestration.ts |  52 +-
 .../structured-agent-session-attach.ts        |  16 +-
 ...ructured-agent-session-close-retry.test.ts | 257 ++++++++
 ...tured-agent-session-event-sink-estimate.ts |  10 +-
 ...tructured-agent-session-event-sink.test.ts |  10 +-
 .../structured-agent-session-event-sink.ts    |  28 +-
 .../structured-agent-session-eviction.test.ts |   8 +-
 .../structured-agent-session-eviction.ts      |   5 +-
 .../structured-agent-session-handoff.test.ts  |  10 +-
 ...uctured-agent-session-host-handoff.test.ts |   7 +-
 .../structured-agent-session-host-lifetime.ts |   5 +-
 .../structured-agent-session-host-teardown.ts |  53 ++
 .../structured-agent-session-host.test.ts     |   7 +-
 .../structured-agent-session-host.ts          |  18 +-
 ...ured-agent-session-journal-handles.test.ts | 250 ++++++++
 .../structured-agent-session-read-restore.ts  |   2 +-
 ...red-agent-session-send-idempotency.test.ts |   7 +-
 ...ructured-agent-session-subscribers.test.ts |  38 +-
 .../structured-agent-session-turns.test.ts    | 200 +------
 .../structured-agent-session-turns.ts         |  72 +--
 ...tured-agent-session-wire-admission.test.ts |  76 ++-
 .../structured-tui-transcript-catchup.test.ts |   7 +-
 .../unhandled-provider-frame.test.ts          |  20 +-
 .../unhandled-provider-frame.ts               |   2 -
 .../db/database-file-permissions.ts           |  16 +-
 ...d-agent-session-integration-replay.test.ts |   7 +-
 ...ructured-agent-session-integration.test.ts |  11 +-
 .../structured-agent-session-runtime.test.ts  |  69 +++
 .../structured-agent-session-runtime.ts       |  42 +-
 src/main/sqlite/harden-database-files.ts      |  18 +
 src/shared/agent-session-journal-schemas.ts   |  13 +-
 src/shared/agent-session-journal-types.ts     |   8 +-
 99 files changed, 3947 insertions(+), 4988 deletions(-)
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-blob-store.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-close-retry.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-compaction.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-corruption-quarantine.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-database-schema.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-database.test.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-database.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-lifecycle-admission.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.test.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-log-file.test.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-log-file.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-physical-quota.test.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-physical-quota.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-repair-disclosure.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-repair-marker.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-row-table.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-row-writer-read-only-latch.test.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-row-writer.test.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-store-close.test.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-store-close.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-store-restore.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-store-test-open.ts
 create mode 100644 src/main/native-chat/agent-session-journal/journal-terminal-settlement.ts
 delete mode 100644 src/main/native-chat/agent-session-journal/journal-tool-output-fallback.ts
 create mode 100644 src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
 create mode 100644 src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
 create mode 100644 src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
 create mode 100644 src/main/sqlite/harden-database-files.ts

diff --git a/src/main/codex/codex-prompt-registry-bounds.ts b/src/main/codex/codex-prompt-registry-bounds.ts
index 84b3cda6151..e5f79fe3a31 100644
--- a/src/main/codex/codex-prompt-registry-bounds.ts
+++ b/src/main/codex/codex-prompt-registry-bounds.ts
@@ -20,10 +20,7 @@ export function codexJournalPromptIdPart(value: string): string {
   }
   const suffix = `#${digestPayload(value).slice(0, 32)}`
   const bounded = boundPayload(value, {
-    inlineHeadBytes: CODEX_JOURNAL_PROMPT_ID_COMPONENT_MAX_BYTES - suffix.length,
-    maxSessionBytes: Number.MAX_SAFE_INTEGER,
-    maxAppendsPerWindow: Number.MAX_SAFE_INTEGER,
-    appendWindowMs: Number.MAX_SAFE_INTEGER
+    inlineHeadBytes: CODEX_JOURNAL_PROMPT_ID_COMPONENT_MAX_BYTES - suffix.length
   })
   return `${bounded.head}${suffix}`
 }
diff --git a/src/main/codex/codex-structured-item-stream-bounds.ts b/src/main/codex/codex-structured-item-stream-bounds.ts
index e84d8dd2efa..572c954b010 100644
--- a/src/main/codex/codex-structured-item-stream-bounds.ts
+++ b/src/main/codex/codex-structured-item-stream-bounds.ts
@@ -17,14 +17,8 @@ export function codexStructuredItemKey(threadId: string, itemId: string): string
   return `${key.slice(0, 960)}:${(hash >>> 0).toString(16)}`
 }
 
-export function pendingPatchBytes(pending: {
-  body: unknown
-  blobs: readonly { payload: string }[]
-}): number {
-  return (
-    Buffer.byteLength(JSON.stringify(pending.body), 'utf8') +
-    pending.blobs.reduce((total, blob) => total + Buffer.byteLength(blob.payload, 'utf8'), 0)
-  )
+export function pendingPatchBytes(pending: { body: unknown }): number {
+  return Buffer.byteLength(JSON.stringify(pending.body), 'utf8')
 }
 
 export function boundStreamItem(item: Record<string, unknown>): Record<string, unknown> {
diff --git a/src/main/codex/codex-structured-item-stream-contracts.ts b/src/main/codex/codex-structured-item-stream-contracts.ts
index cf8aff5795d..f252d048210 100644
--- a/src/main/codex/codex-structured-item-stream-contracts.ts
+++ b/src/main/codex/codex-structured-item-stream-contracts.ts
@@ -24,7 +24,6 @@ export type CodexItemStreamState = {
 export type CodexPendingItemPatch = {
   identity: AgentJournalItemIdentity
   body: NonNullable<ReturnType<typeof codexJournalItem>['body']>
-  blobs: ReturnType<typeof codexJournalItem>['blobs']
 }
 
 export type CodexStructuredItemStreamAdmission =
diff --git a/src/main/codex/codex-structured-item-streams.ts b/src/main/codex/codex-structured-item-streams.ts
index dda5e9688bd..a765f8339da 100644
--- a/src/main/codex/codex-structured-item-streams.ts
+++ b/src/main/codex/codex-structured-item-streams.ts
@@ -103,8 +103,8 @@ export function createCodexStructuredItemStreams(
     }
     const options = { coalescingKey: `checkpoint:${agentJournalItemKey(state.identity)}` }
     const admission = deps.sink.tryAppendItem
-      ? deps.sink.tryAppendItem(state.identity, translated.body, translated.blobs, options)
-      : (deps.sink.appendItem(state.identity, translated.body, translated.blobs, options),
+      ? deps.sink.tryAppendItem(state.identity, translated.body, options)
+      : (deps.sink.appendItem(state.identity, translated.body, options),
         { accepted: true as const })
     if (!admission.accepted) {
       return false
@@ -167,9 +167,8 @@ export function createCodexStructuredItemStreams(
     }
     for (const [key, pending] of pendingPatches) {
       const admission = deps.sink.tryAppendItem
-        ? deps.sink.tryAppendItem(pending.identity, pending.body, pending.blobs)
-        : (deps.sink.appendItem(pending.identity, pending.body, pending.blobs),
-          { accepted: true as const })
+        ? deps.sink.tryAppendItem(pending.identity, pending.body)
+        : (deps.sink.appendItem(pending.identity, pending.body), { accepted: true as const })
       if (!admission.accepted) {
         flushed = false
         continue
@@ -193,9 +192,8 @@ export function createCodexStructuredItemStreams(
       return { accepted: true }
     }
     const admission = deps.sink.tryAppendItem
-      ? deps.sink.tryAppendItem(pending.identity, pending.body, pending.blobs)
-      : (deps.sink.appendItem(pending.identity, pending.body, pending.blobs),
-        { accepted: true as const })
+      ? deps.sink.tryAppendItem(pending.identity, pending.body)
+      : (deps.sink.appendItem(pending.identity, pending.body), { accepted: true as const })
     if (!admission.accepted) {
       return admission
     }
@@ -237,8 +235,7 @@ export function createCodexStructuredItemStreams(
         if (translated.body) {
           const nextPending: CodexPendingItemPatch = {
             identity: state.identity,
-            body: translated.body,
-            blobs: translated.blobs
+            body: translated.body
           }
           const previous = pendingPatches.get(key)
           const previousBytes = previous ? pendingPatchBytes(previous) : 0
diff --git a/src/main/codex/codex-structured-item-translation.test.ts b/src/main/codex/codex-structured-item-translation.test.ts
index 63c3d59b0b9..f0f843e4ed6 100644
--- a/src/main/codex/codex-structured-item-translation.test.ts
+++ b/src/main/codex/codex-structured-item-translation.test.ts
@@ -220,12 +220,6 @@ describe('codex item bodies', () => {
       throw new Error('expected bounded command output')
     }
     expect(body.output.head.length).toBeLessThan(20_000)
-    expect(translated.blobs).toEqual([
-      {
-        digest: body.output.digest,
-        payload: output
-      }
-    ])
   })
 
   it('continues to accept camel-case command completion output', () => {
diff --git a/src/main/codex/codex-structured-item-translation.ts b/src/main/codex/codex-structured-item-translation.ts
index f640ad5fb3d..19052dca365 100644
--- a/src/main/codex/codex-structured-item-translation.ts
+++ b/src/main/codex/codex-structured-item-translation.ts
@@ -172,7 +172,6 @@ function commandState(item: CodexThreadItem): 'running' | 'completed' | 'failed'
 
 export type CodexJournalItem = {
   body: AgentJournalItemBody | null
-  blobs: { digest: string; payload: string }[]
   handled: boolean
 }
 
@@ -190,10 +189,6 @@ function commandItem(item: CodexThreadItem): CodexJournalItem {
       state: commandState(item),
       ...(bounded === null ? {} : { output: bounded.bounded })
     },
-    blobs:
-      output !== null && bounded?.bounded.truncated
-        ? [{ digest: bounded.bounded.digest, payload: output }]
-        : [],
     handled: true
   }
 }
@@ -215,7 +210,6 @@ function fileChangeItem(item: CodexThreadItem): CodexJournalItem {
         input: boundToolInput({ changes: item.changes ?? null }, DEFAULT_JOURNAL_PAYLOAD_LIMITS),
         state: commandState(item)
       },
-      blobs: [],
       handled: true
     }
   }
@@ -227,7 +221,6 @@ function fileChangeItem(item: CodexThreadItem): CodexJournalItem {
       path: changes.length === 1 ? changes[0]!.path : `${changes.length} files`,
       patch: bounded
     },
-    blobs: bounded.truncated ? [{ digest: bounded.digest, payload: patch }] : [],
     handled: true
   }
 }
@@ -246,7 +239,6 @@ export function codexJournalItem(item: CodexThreadItem): CodexJournalItem {
         blocks.length === 0
           ? null
           : { kind: 'message', role: item.type === 'userMessage' ? 'user' : 'assistant', blocks },
-      blobs: [],
       handled: true
     }
   }
@@ -266,14 +258,11 @@ export function codexJournalItem(item: CodexThreadItem): CodexJournalItem {
         text === null
           ? null
           : { kind: 'status', text: boundInlineText(text, DEFAULT_JOURNAL_PAYLOAD_LIMITS).text },
-      blobs: [],
       handled: true
     }
   }
   const unhandled = unhandledProviderFrameJournalItem('codex', `item:${item.type}`, item)
-  return unhandled
-    ? { body: unhandled.body, blobs: unhandled.blobs, handled: false }
-    : { body: null, blobs: [], handled: true }
+  return unhandled ? { body: unhandled.body, handled: false } : { body: null, handled: true }
 }
 
 export function codexItemBody(item: CodexThreadItem): AgentJournalItemBody | null {
@@ -292,7 +281,7 @@ export function codexStreamingMessageBody(text: string): AgentJournalItemBody {
 /** Snapshot body for any item-level stream, keyed onto its parent item. */
 export function codexStreamingJournalItem(item: CodexThreadItem, text: string): CodexJournalItem {
   if (item.type === 'agentMessage') {
-    return { body: codexStreamingMessageBody(text), blobs: [], handled: true }
+    return { body: codexStreamingMessageBody(text), handled: true }
   }
   if (item.type === 'commandExecution') {
     return commandItem({ ...item, aggregatedOutput: text })
@@ -304,10 +293,9 @@ export function codexStreamingJournalItem(item: CodexThreadItem, text: string):
     const bounded = boundInlineText(text, DEFAULT_JOURNAL_PAYLOAD_LIMITS).bounded
     return {
       body: { kind: 'diff', path: path ?? 'pending patch', patch: bounded },
-      blobs: bounded.truncated ? [{ digest: bounded.digest, payload: text }] : [],
       handled: true
     }
   }
   const bounded = boundInlineText(text, DEFAULT_JOURNAL_PAYLOAD_LIMITS)
-  return { body: { kind: 'status', text: bounded.text }, blobs: [], handled: true }
+  return { body: { kind: 'status', text: bounded.text }, handled: true }
 }
diff --git a/src/main/codex/codex-structured-journal-generic-frames.ts b/src/main/codex/codex-structured-journal-generic-frames.ts
index f6b9ff375d3..6c211a8f5a4 100644
--- a/src/main/codex/codex-structured-journal-generic-frames.ts
+++ b/src/main/codex/codex-structured-journal-generic-frames.ts
@@ -91,13 +91,11 @@ export class CodexJournalGenericFrames {
     const admission = this.deps.sink.tryAppendItem
       ? this.deps.sink.tryAppendItem(
           { provider: 'orca', clientMessageId: `provider-frame:codex:${this.fallbackSequence}` },
-          translated.body,
-          translated.blobs
+          translated.body
         )
       : (this.deps.sink.appendItem(
           { provider: 'orca', clientMessageId: `provider-frame:codex:${this.fallbackSequence}` },
-          translated.body,
-          translated.blobs
+          translated.body
         ),
         CODEX_JOURNAL_ADMITTED)
     if (!admission.accepted) {
@@ -136,13 +134,11 @@ export class CodexJournalGenericFrames {
               kind: 'status',
               text
             },
-            [],
             { coalescingKey: `provider-frame-suppressed:codex:${bucket}` }
           )
         : (this.deps.sink.appendItem(
             { provider: 'orca', clientMessageId: `provider-frame-suppressed:codex:${bucket}` },
             { kind: 'status', text },
-            [],
             { coalescingKey: `provider-frame-suppressed:codex:${bucket}` }
           ),
           CODEX_JOURNAL_ADMITTED)
diff --git a/src/main/codex/codex-structured-journal-items.ts b/src/main/codex/codex-structured-journal-items.ts
index 2b5d8c04bba..0e4e3f5a900 100644
--- a/src/main/codex/codex-structured-journal-items.ts
+++ b/src/main/codex/codex-structured-journal-items.ts
@@ -2,7 +2,7 @@ import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity
 } from '../../shared/agent-session-journal-types'
-import { requiresTerminalSettlement } from '../native-chat/agent-session-journal/journal-lifecycle-capacity'
+import { requiresTerminalSettlement } from '../native-chat/agent-session-journal/journal-terminal-settlement'
 import {
   codexItemIdentity,
   codexJournalItem,
@@ -126,19 +126,13 @@ export class CodexJournalItems {
       return CODEX_JOURNAL_ADMITTED
     }
     if (method === 'item/completed') {
-      const admission = appendCodexLifecycleItem(
-        this.deps.sink,
-        identity,
-        translated.body,
-        translated.blobs
-      )
+      const admission = appendCodexLifecycleItem(this.deps.sink, identity, translated.body)
       return admission.accepted ? publishCodexLifecycle(this.deps.sink) : admission
     }
     const options = requiresTerminalSettlement(translated.body) ? { lifecycle: true } : {}
     const admission = this.deps.sink.tryAppendItem
-      ? this.deps.sink.tryAppendItem(identity, translated.body, translated.blobs, options)
-      : (this.deps.sink.appendItem(identity, translated.body, translated.blobs),
-        CODEX_JOURNAL_ADMITTED)
+      ? this.deps.sink.tryAppendItem(identity, translated.body, options)
+      : (this.deps.sink.appendItem(identity, translated.body), CODEX_JOURNAL_ADMITTED)
     if (!admission.accepted) {
       return admission
     }
diff --git a/src/main/codex/codex-structured-journal-settlement.ts b/src/main/codex/codex-structured-journal-settlement.ts
index f4378d1a16f..2b8eb627d4f 100644
--- a/src/main/codex/codex-structured-journal-settlement.ts
+++ b/src/main/codex/codex-structured-journal-settlement.ts
@@ -243,14 +243,12 @@ function appendLifecycleMutations(
       for (const mutation of chunk) {
         if (mutation.kind === 'item') {
           if (sink.tryAppendItem) {
-            admission = sink.tryAppendItem(mutation.identity, mutation.body, [], {
-              lifecycle: true
-            })
+            admission = sink.tryAppendItem(mutation.identity, mutation.body, { lifecycle: true })
             if (!admission.accepted) {
               return admission
             }
           } else {
-            sink.appendItem(mutation.identity, mutation.body, [], { lifecycle: true })
+            sink.appendItem(mutation.identity, mutation.body, { lifecycle: true })
           }
         } else {
           if (sink.tryAppendTombstone) {
diff --git a/src/main/codex/codex-structured-journal-sink.ts b/src/main/codex/codex-structured-journal-sink.ts
index b135c89ec0a..5c4ecec9658 100644
--- a/src/main/codex/codex-structured-journal-sink.ts
+++ b/src/main/codex/codex-structured-journal-sink.ts
@@ -4,7 +4,6 @@ import type {
 } from '../../shared/agent-session-journal-types'
 import type {
   StructuredAgentSessionEventSink,
-  StructuredAgentSessionJournalBlob,
   StructuredAgentSessionSinkAdmission
 } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import type { CodexPendingJournalPrompt } from './codex-structured-journal-settlement'
@@ -20,13 +19,12 @@ function criticalAdmission(
 export function appendCodexLifecycleItem(
   sink: StructuredAgentSessionEventSink,
   identity: AgentJournalItemIdentity,
-  body: AgentJournalItemBody,
-  blobs: readonly StructuredAgentSessionJournalBlob[] = []
+  body: AgentJournalItemBody
 ): CodexJournalTranslationAdmission {
   if (sink.tryAppendItem) {
-    return criticalAdmission(sink.tryAppendItem(identity, body, blobs, { lifecycle: true }))
+    return criticalAdmission(sink.tryAppendItem(identity, body, { lifecycle: true }))
   }
-  sink.appendItem(identity, body, blobs, { lifecycle: true })
+  sink.appendItem(identity, body, { lifecycle: true })
   return CODEX_JOURNAL_ADMITTED
 }
 
diff --git a/src/main/codex/codex-structured-journal-translation-streams.test.ts b/src/main/codex/codex-structured-journal-translation-streams.test.ts
index c06d468a1ba..a9bc79b71c4 100644
--- a/src/main/codex/codex-structured-journal-translation-streams.test.ts
+++ b/src/main/codex/codex-structured-journal-translation-streams.test.ts
@@ -89,11 +89,11 @@ describe('codex journal translation', () => {
     const { translator, tap } = translatorWith()
     let rejectTerminal = true
     const appendItem = tap.sink.appendItem
-    tap.sink.tryAppendItem = (identity, body, blobs, options) => {
+    tap.sink.tryAppendItem = (identity, body, options) => {
       if (rejectTerminal && body.kind === 'tool-call' && body.state === 'failed') {
         return { accepted: false as const, reason: 'backpressure' as const }
       }
-      appendItem(identity, body, blobs, options)
+      appendItem(identity, body, options)
       return { accepted: true as const }
     }
     for (let index = 0; index <= 256; index += 1) {
diff --git a/src/main/codex/codex-structured-journal-translation-turns.ts b/src/main/codex/codex-structured-journal-translation-turns.ts
index 3f295d2add1..06bb28f85f9 100644
--- a/src/main/codex/codex-structured-journal-translation-turns.ts
+++ b/src/main/codex/codex-structured-journal-translation-turns.ts
@@ -40,7 +40,6 @@ export function publishCodexTurnLifecycle(input: {
             text: 'Codex is working…',
             turnLifecycle: { turnId: input.turnId, state: input.state }
           },
-          [],
           { lifecycle: true }
         )
       : (input.sink.appendItem(
@@ -50,7 +49,6 @@ export function publishCodexTurnLifecycle(input: {
             text: 'Codex is working…',
             turnLifecycle: { turnId: input.turnId, state: input.state }
           },
-          [],
           { lifecycle: true }
         ),
         ADMITTED)
diff --git a/src/main/codex/codex-turn-ordinals.ts b/src/main/codex/codex-turn-ordinals.ts
index 7087c28e4ac..e2b4132d2b2 100644
--- a/src/main/codex/codex-turn-ordinals.ts
+++ b/src/main/codex/codex-turn-ordinals.ts
@@ -37,10 +37,7 @@ export class CodexTurnOrdinals {
     const suffix = `#${digestPayload(value).slice(0, 24)}`
     return `${
       boundPayload(encoded, {
-        inlineHeadBytes: 256 - Buffer.byteLength(suffix, 'utf8'),
-        maxSessionBytes: Number.MAX_SAFE_INTEGER,
-        maxAppendsPerWindow: Number.MAX_SAFE_INTEGER,
-        appendWindowMs: Number.MAX_SAFE_INTEGER
+        inlineHeadBytes: 256 - Buffer.byteLength(suffix, 'utf8')
       }).head
     }${suffix}`
   }
diff --git a/src/main/native-chat/agent-session-journal/journal-blob-store.ts b/src/main/native-chat/agent-session-journal/journal-blob-store.ts
deleted file mode 100644
index 9b02877cec7..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-blob-store.ts
+++ /dev/null
@@ -1,110 +0,0 @@
-// Content-addressed store for the remainder of a bounded payload.
-//
-// Blobs are named by their sha256, so writing the same output twice costs one
-// file and re-import is idempotent. They live beside the journal (host-side
-// per-workspace state, never inside the user's working tree) and share the
-// epoch's retention: compaction prunes every blob no retained row references.
-
-import { mkdir, readFile, readdir, rm, stat } from 'node:fs/promises'
-import { join } from 'node:path'
-import { durableWriteTempPath, writeFileDurable } from '../../durable-file-write'
-
-export const JOURNAL_BLOB_DIR = 'blobs'
-const DIGEST_PATTERN = /^[0-9a-f]{64}$/
-
-/** A digest arrives back from a row on disk, so it is untrusted by the time it
- *  reaches the filesystem: anything but a bare sha256 could escape the store. */
-function blobPath(journalDir: string, digest: string): string | null {
-  return DIGEST_PATTERN.test(digest) ? join(journalDir, JOURNAL_BLOB_DIR, digest) : null
-}
-
-/** Persist `payload` under its digest. Returns the digest so the caller can
- *  stamp it on the row it is about to append. */
-export async function putJournalBlob(
-  journalDir: string,
-  digest: string,
-  payload: string
-): Promise<string> {
-  const target = blobPath(journalDir, digest)
-  if (!target) {
-    throw new Error('refusing to write a journal blob under a name that is not a sha256 digest')
-  }
-  // Content addressing makes a rewrite pointless: identical digest, identical bytes.
-  if (await pathExists(target)) {
-    return digest
-  }
-  await mkdir(join(journalDir, JOURNAL_BLOB_DIR), { recursive: true })
-  await writeFileDurable(durableWriteTempPath(target), target, payload)
-  return digest
-}
-
-export async function readJournalBlob(journalDir: string, digest: string): Promise<string | null> {
-  const source = blobPath(journalDir, digest)
-  if (!source) {
-    return null
-  }
-  try {
-    return await readFile(source, 'utf-8')
-  } catch {
-    return null
-  }
-}
-
-/** Remove a blob written speculatively for a row that was rejected. */
-export async function removeJournalBlob(journalDir: string, digest: string): Promise<void> {
-  const target = blobPath(journalDir, digest)
-  if (target) {
-    await rm(target, { force: true })
-  }
-}
-
-/** Drop every blob outside `retained`. Called from compaction, under the
- *  current lease fence, after the snapshot is durable — so a crash mid-prune
- *  leaves extra blobs rather than dangling references. */
-export async function pruneJournalBlobs(
-  journalDir: string,
-  retained: ReadonlySet<string>
-): Promise<number> {
-  let removed = 0
-  let names: string[]
-  try {
-    names = await readdir(join(journalDir, JOURNAL_BLOB_DIR))
-  } catch {
-    return 0
-  }
-  for (const name of names) {
-    if (retained.has(name)) {
-      continue
-    }
-    await rm(join(journalDir, JOURNAL_BLOB_DIR, name), { force: true }).catch(() => {})
-    removed += 1
-  }
-  return removed
-}
-
-async function pathExists(path: string): Promise<boolean> {
-  try {
-    await stat(path)
-    return true
-  } catch {
-    return false
-  }
-}
-
-export async function journalBlobFileSize(
-  journalDir: string,
-  digest: string
-): Promise<number | null> {
-  const target = blobPath(journalDir, digest)
-  if (!target) {
-    return null
-  }
-  try {
-    return (await stat(target)).size
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return null
-    }
-    throw error
-  }
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-close-retry.ts b/src/main/native-chat/agent-session-journal/journal-close-retry.ts
new file mode 100644
index 00000000000..e73be0a59b8
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-close-retry.ts
@@ -0,0 +1,68 @@
+// Where a journal goes when its close REJECTS.
+//
+// `AgentSessionJournal.close()` is deliberately retryable: a rejection does not
+// release the handle, and a second call is a real second attempt. Every caller
+// that did `close().catch(() => undefined)` and then threw or overwrote its map
+// entry defeated that contract — the store became unreachable with its SQLite
+// connection still open. On POSIX that is a silent leak; on Windows the open
+// handle blocks renaming or removing the journal directory outright.
+//
+// So a rejected close hands the journal here instead of dropping it, and host
+// teardown retries everything this holds. Retention is bounded by construction:
+// an entry leaves the set the moment its close fulfils, and a journal can be
+// retained only once because the set is keyed by identity.
+
+/** Everything the registry needs; `AgentSessionJournal` satisfies it. */
+export type RetryableJournalClose = {
+  close: () => Promise<void>
+  readonly directory: string
+}
+
+export class JournalCloseRetryRegistry {
+  private readonly retained = new Set<RetryableJournalClose>()
+
+  /** Directories still held by a journal whose close has not fulfilled. */
+  get pendingDirectories(): string[] {
+    return [...this.retained].map((journal) => journal.directory)
+  }
+
+  /**
+   * Close it. Returns true when the handle is actually released; on a rejection
+   * the journal is RETAINED for `retryAll` and the rejection is returned rather
+   * than thrown, because every caller of this is already unwinding a different
+   * failure it must not lose.
+   */
+  async closeOrRetain(
+    journal: RetryableJournalClose
+  ): Promise<{ closed: boolean; error?: unknown }> {
+    try {
+      await journal.close()
+      this.retained.delete(journal)
+      return { closed: true }
+    } catch (error) {
+      this.retained.add(journal)
+      return { closed: false, error }
+    }
+  }
+
+  /** Retry every retained close. Ones that fulfil are dropped; ones that reject
+   *  stay retained and their rejections are returned for the caller to report. */
+  async retryAll(): Promise<unknown[]> {
+    const entries = [...this.retained]
+    const failures: unknown[] = []
+    for (const journal of entries) {
+      const result = await this.closeOrRetain(journal)
+      if (!result.closed) {
+        failures.push(result.error)
+      }
+    }
+    return failures
+  }
+}
+
+/**
+ * Process-wide, because ownership of these handles is process-wide: the attach
+ * path, the recovery wrapper and runtime teardown are separate call trees that
+ * must all be able to reach the same orphan.
+ */
+export const agentSessionJournalCloseRetries = new JournalCloseRetryRegistry()
diff --git a/src/main/native-chat/agent-session-journal/journal-compaction.ts b/src/main/native-chat/agent-session-journal/journal-compaction.ts
deleted file mode 100644
index b9600a4f4e9..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-compaction.ts
+++ /dev/null
@@ -1,206 +0,0 @@
-// Retention and compaction.
-//
-// The snapshot carries the retained tail with it, so publishing both is ONE
-// atomic write and there is no window where the folded state exists without the
-// rows a reconnecting client still needs. Truncating the log afterwards is
-// idempotent: a crash before it leaves the log a superset of the tail.
-//
-// The retained tail must cover the longest reconnect window Orca supports, or a
-// client that was merely asleep gets a full snapshot reload instead of a resume.
-
-import { blobDigestsInBody, renderJournalState, type JournalReducerState } from './journal-reducer'
-import { pruneJournalBlobs } from './journal-blob-store'
-import {
-  rewriteJournalLog,
-  writeJournalSnapshotFile,
-  type JournalSnapshotFile
-} from './journal-log-file'
-import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
-import type { JournalRow } from './journal-row-schema'
-import { AgentSessionJournalError } from './journal-write-guards'
-import { assertJournalPhysicalCapacity, journalDirectoryBytes } from './journal-physical-quota'
-
-export type JournalCompactionPolicy = {
-  /** Always keep at least this many rows, however old they are. */
-  minTailRows: number
-  /** Keep every row observed within this window. */
-  retainTailMs: number
-  /**
-   * `window` honours `retainTailMs` outright. `budget-pressure` lets it yield:
-   * the alternative is refusing the user's writes until the window ages out,
-   * and the tail is only a resume optimization — compaction folds every shed
-   * row into the snapshot before truncating the log, so a client that loses
-   * its resume point reloads instead of losing conversation. Defaults to
-   * `window`.
-   */
-  retention?: 'window' | 'budget-pressure'
-}
-
-/** Two hours of tail comfortably covers a phone that slept through a commute,
- *  which is the longest reconnect Orca resumes rather than reloads. */
-export const DEFAULT_JOURNAL_COMPACTION_POLICY: JournalCompactionPolicy = {
-  minTailRows: 512,
-  retainTailMs: 2 * 60 * 60 * 1000
-}
-
-export type JournalCompactionResult = {
-  tailRows: JournalRow[]
-  compactedThrough: number
-  oldestSequence: number
-}
-
-export async function compactJournal(input: {
-  journalDir: string
-  /** Parent quota root when compacting an in-directory staging journal. */
-  physicalQuotaRoot?: string
-  state: JournalReducerState
-  tailRows: readonly JournalRow[]
-  policy?: JournalCompactionPolicy
-  now: number
-  maxSessionBytes: number
-  sessionId?: string
-}): Promise<JournalCompactionResult> {
-  const policy = input.policy ?? DEFAULT_JOURNAL_COMPACTION_POLICY
-  const retained = retainTail(input.tailRows, policy, input.now)
-  const rendered = renderJournalState(input.state)
-  const compactedThrough = input.state.lastSequence
-
-  const snapshot: JournalSnapshotFile = {
-    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-    epoch: input.state.epoch,
-    compactedThrough,
-    highestFence: input.state.highestFence,
-    items: rendered.items,
-    submissions: rendered.submissions,
-    receipts: [...input.state.receipts.values()].map((receipt) => ({
-      clientMessageId: receipt.clientMessageId,
-      providerItemId: receipt.providerItemId,
-      epoch: receipt.cursor.epoch,
-      sequence: receipt.cursor.sequence,
-      acceptedAt: receipt.acceptedAt
-    })),
-    aliases: [...input.state.aliases.entries()].map(([providerItemId, itemId]) => ({
-      providerItemId,
-      itemId
-    })),
-    tombstones: [...input.state.tombstones.entries()].map(([itemId, revision]) => ({
-      itemId,
-      revision
-    })),
-    appliedSettlementIds: [...input.state.appliedSettlementIds],
-    tail: retained
-  }
-
-  const snapshotBytes = Buffer.byteLength(JSON.stringify(snapshot), 'utf8')
-  if (snapshotBytes > input.maxSessionBytes) {
-    throw new AgentSessionJournalError(
-      'journal_bound_exceeded',
-      `agent-session journal snapshot reached its ${input.maxSessionBytes}-byte bound`
-    )
-  }
-
-  const sessionId = input.sessionId ?? input.state.sessionId
-  const quotaRoot = input.physicalQuotaRoot ?? input.journalDir
-  const retainedLogBytes = retained.reduce(
-    (total, row) => total + Buffer.byteLength(JSON.stringify(row), 'utf8') + 1,
-    0
-  )
-  // Durable writes keep the old final alongside the new temp until rename.
-  // Reserve the complete compaction peak up front so a later copy cannot leave
-  // a half-published snapshot/log pair when the quota is tight.
-  await assertJournalPhysicalCapacity({
-    journalDir: quotaRoot,
-    sessionId,
-    maxBytes: input.maxSessionBytes,
-    peakAdditionalBytes: snapshotBytes + retainedLogBytes
-  })
-  await writeJournalSnapshotFile(input.journalDir, snapshot)
-  await rewriteJournalLog(input.journalDir, retained)
-  // Blobs are pruned last: a crash before this leaks bytes, whereas pruning
-  // first would strand a snapshot pointing at a payload that no longer exists.
-  // Recompute from exactly what the durable snapshot and retained log carry;
-  // this preserves reused/pre-existing blobs while allowing stale payloads to
-  // be pruned safely after both files are published.
-  const retainedDigests = new Set<string>()
-  for (const item of snapshot.items) {
-    blobDigestsInBody(item.body, retainedDigests)
-  }
-  for (const row of retained) {
-    if (row.kind === 'item') {
-      blobDigestsInBody(row.body, retainedDigests)
-    } else if (row.kind === 'lifecycle-batch') {
-      for (const mutation of row.mutations) {
-        if (mutation.kind === 'item') {
-          blobDigestsInBody(mutation.body, retainedDigests)
-        }
-      }
-    }
-  }
-  await pruneJournalBlobs(input.journalDir, retainedDigests)
-
-  if ((await journalDirectoryBytes(quotaRoot)) > input.maxSessionBytes) {
-    throw new AgentSessionJournalError(
-      'journal_bound_exceeded',
-      `agent-session journal for ${sessionId} exceeds its physical bound after compaction`
-    )
-  }
-
-  return {
-    tailRows: retained,
-    compactedThrough,
-    oldestSequence: retained[0]?.seq ?? compactedThrough + 1
-  }
-}
-
-function retainTail(
-  rows: readonly JournalRow[],
-  policy: JournalCompactionPolicy,
-  now: number
-): JournalRow[] {
-  if (rows.length <= policy.minTailRows) {
-    return [...rows]
-  }
-  const floor = now - policy.retainTailMs
-  const byAge = rows.findIndex((row) => row.ts >= floor)
-  const byCount = rows.length - policy.minTailRows
-  const start = byAge === -1 ? byCount : Math.min(byAge, byCount)
-  if (policy.retention !== 'budget-pressure') {
-    return rows.slice(start)
-  }
-  // Halve rather than empty: the newer half keeps live clients resuming, and
-  // shedding at least one row guarantees the append that triggered this makes
-  // progress instead of latching the session read-only.
-  return rows.slice(Math.max(start, Math.ceil(rows.length / 2)))
-}
-
-/** Only when the retention window would actually drop rows: inside it,
- *  compaction rewrites an identical log, and doing that per append is a full
- *  state serialization on the hot path. */
-export function journalTailIsReadyToCompact(
-  tailRows: readonly JournalRow[],
-  policy: JournalCompactionPolicy,
-  now: number
-): boolean {
-  if (tailRows.length <= policy.minTailRows * 2) {
-    return false
-  }
-  return (tailRows[0]?.ts ?? now) < now - policy.retainTailMs
-}
-
-/** The policy an append falls back to when the size bound would otherwise
- *  refuse it: both floors that normally protect the tail step aside. */
-export function budgetPressurePolicy(policy: JournalCompactionPolicy): JournalCompactionPolicy {
-  return { ...policy, minTailRows: 0, retention: 'budget-pressure' }
-}
-
-/** Budget pressure may need to shed rows before the ordinary batching threshold.
- *  Pass a `budget-pressure` policy, or a tail wholly inside the retention
- *  window answers false and the size bound refuses every append until it ages
- *  out — two hours of a session the user cannot write to. */
-export function journalTailCanShedRows(
-  tailRows: readonly JournalRow[],
-  policy: JournalCompactionPolicy,
-  now: number
-): boolean {
-  return retainTail(tailRows, policy, now).length < tailRows.length
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-corruption-quarantine.ts b/src/main/native-chat/agent-session-journal/journal-corruption-quarantine.ts
deleted file mode 100644
index e12d5b67a0a..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-corruption-quarantine.ts
+++ /dev/null
@@ -1,102 +0,0 @@
-// Corruption never deletes history. A journal that cannot be read end to end
-// keeps its intact prefix live and moves the unreadable remainder aside, so the
-// bytes stay on disk for inspection instead of being rebuilt into an empty epoch.
-
-import { readFile } from 'node:fs/promises'
-import { join } from 'node:path'
-import {
-  JOURNAL_SNAPSHOT_FILE,
-  quarantineJournalRemainder,
-  readJournalLog,
-  rewriteJournalLog
-} from './journal-log-file'
-import type { JournalRow } from './journal-row-schema'
-import { assertJournalPhysicalCapacity } from './journal-physical-quota'
-
-/** Keep the readable prefix and set the unreadable suffix aside. */
-export async function quarantineCorruptSuffix(
-  journalDir: string,
-  retainedRows: readonly JournalRow[],
-  remainder: string | undefined,
-  quota?: { sessionId: string; maxBytes: number }
-): Promise<void> {
-  if (remainder) {
-    if (quota) {
-      await assertJournalPhysicalCapacity({
-        journalDir,
-        ...quota,
-        peakAdditionalBytes: Buffer.byteLength(remainder, 'utf8')
-      })
-    }
-    await quarantineJournalRemainder(journalDir, remainder)
-  }
-  if (quota) {
-    const retainedBytes = retainedRows.reduce(
-      (total, row) => total + Buffer.byteLength(JSON.stringify(row), 'utf8') + 1,
-      0
-    )
-    await assertJournalPhysicalCapacity({
-      journalDir,
-      ...quota,
-      peakAdditionalBytes: retainedBytes
-    })
-  }
-  await rewriteJournalLog(journalDir, retainedRows)
-}
-
-/** Copy everything aside before a read-only journal is rebuilt under a newer
- *  schema: those rows are unreadable to THIS build, not worthless. The
- *  snapshot is preserved as raw bytes — a future-version snapshot does not
- *  parse under this build's schema, and its bytes must survive verbatim. */
-export async function quarantineUnreadableSchema(
-  journalDir: string,
-  quota?: { sessionId: string; maxBytes: number }
-): Promise<void> {
-  const snapshot = await readSnapshotBytes(journalDir)
-  const log = await readJournalLog(journalDir)
-  const preserved = [
-    snapshot ?? '',
-    log.rows.map((row) => JSON.stringify(row)).join('\n'),
-    log.remainder ?? ''
-  ]
-    .filter(Boolean)
-    .join('\n')
-  if (preserved) {
-    if (quota) {
-      await assertJournalPhysicalCapacity({
-        journalDir,
-        ...quota,
-        peakAdditionalBytes: Buffer.byteLength(preserved, 'utf8')
-      })
-    }
-    await quarantineJournalRemainder(journalDir, preserved)
-  }
-}
-
-async function readSnapshotBytes(journalDir: string): Promise<string | null> {
-  try {
-    return await readFile(join(journalDir, JOURNAL_SNAPSHOT_FILE), 'utf-8')
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return null
-    }
-    throw error
-  }
-}
-
-/** The disclosure row for lines that failed to parse. Skipped lines are lost
- *  rows; counting them silently is the drop this exists to prevent. */
-export function malformedRowsDisclosure(count: number): {
-  identity: { provider: 'orca'; clientMessageId: string }
-  body: { kind: 'status'; text: string }
-} {
-  const plural = count === 1 ? '' : 's'
-  return {
-    // One stable identity, so a reopen upserts the same row instead of adding one.
-    identity: { provider: 'orca', clientMessageId: 'journal-malformed-lines' },
-    body: {
-      kind: 'status',
-      text: `${count} journal line${plural} could not be read and ${count === 1 ? 'was' : 'were'} skipped`
-    }
-  }
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts b/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts
new file mode 100644
index 00000000000..978f076d6e9
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts
@@ -0,0 +1,265 @@
+// A repair drops what it cannot replay, and says so.
+//
+// Two things make a suffix unreplayable: a row this build cannot parse, and a
+// sequence gap that makes every later row unanchored. The rejected suffix is
+// DELETED; the load reports `corrupt`, and recovery rebuilds the epoch from
+// provider history. Every case here asserts the same two halves: the live epoch
+// holds only the replayable prefix, AND the epoch stays anchored so nothing
+// replays a repaired journal as a clean timeline.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import type Database from '../../sqlite/sync-database'
+import { openJournalDatabase } from './journal-database'
+import { journalDatabaseFile } from './journal-paths'
+import { parseJournalRow, type JournalRow } from './journal-row-schema'
+import { loadJournal } from './journal-open'
+import type { openAgentSessionJournal } from './journal-store-factory'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: 'thread-1' }
+}
+
+let root: string
+let clock = 1_000
+const journals = createTrackedJournalOpener()
+
+function tick(): number {
+  clock += 1
+  return clock
+}
+
+function item(ordinal: number): AgentJournalItemIdentity {
+  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
+}
+
+function body(value: string): AgentJournalItemBody {
+  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
+}
+
+function open(overrides: Partial<Parameters<typeof openAgentSessionJournal>[0]> = {}) {
+  return journals.open({
+    identity: IDENTITY,
+    journalDir: root,
+    now: tick,
+    mintEpoch: () => `epoch-${clock}`,
+    ...overrides
+  })
+}
+
+async function withJournalDatabase(run: (db: Database.Database) => void): Promise<void> {
+  const opened = openJournalDatabase(journalDatabaseFile(root))
+  try {
+    run(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** The row replay anchors on, parsed exactly as replay parses it. */
+function firstLiveRow(): Promise<JournalRow | null> {
+  let row: JournalRow | null = null
+  return withJournalDatabase((db) => {
+    const stored = db.prepare('SELECT row_json FROM journal_rows ORDER BY seq LIMIT 1').get() as
+      | { row_json: string }
+      | undefined
+    const parsed = stored ? parseJournalRow(stored.row_json) : null
+    row = parsed?.ok ? parsed.row : null
+  }).then(() => row)
+}
+
+function liveSequences(): Promise<number[]> {
+  let sequences: number[] = []
+  return withJournalDatabase((db) => {
+    sequences = (
+      db.prepare('SELECT seq FROM journal_rows ORDER BY seq').all() as { seq: number }[]
+    ).map((row) => row.seq)
+  }).then(() => sequences)
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-repair-'))
+  clock = 1_000
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a malformed row', () => {
+  it('keeps the readable prefix live and drops the rest of the epoch', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('readable'), { fence: 1 })
+    await journal.appendItem(item(1), body('unreadable'), { fence: 1 })
+    await journal.appendItem(item(2), body('after the fault'), { fence: 1 })
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('{"not":"a row"}', 3)
+    })
+
+    const reopened = await open()
+    expect(reopened.repair.malformedRows).toBe(1)
+    // 1..2 is the surviving prefix; 3 is the disclosure the repair appends.
+    expect(await liveSequences()).toEqual([1, 2, 3])
+  })
+
+  it('discloses the line it could not read', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('readable'), { fence: 1 })
+    await journal.appendItem(item(1), body('later'), { fence: 1 })
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('}{', 2)
+    })
+
+    const reopened = await open()
+    const disclosure = reopened
+      .snapshot()
+      .items.map((entry) => entry.body)
+      .find((entry) => entry.kind === 'status')
+    expect(disclosure).toMatchObject({ kind: 'status' })
+    expect(disclosure && 'text' in disclosure ? disclosure.text : '').toContain(
+      '1 journal line could not be read'
+    )
+  })
+})
+
+describe('a sequence gap', () => {
+  it('drops every row after the hole and reports the epoch corrupt', async () => {
+    const journal = await open()
+    for (let ordinal = 0; ordinal < 5; ordinal += 1) {
+      await journal.appendItem(item(ordinal), body(`m${ordinal}`), { fence: 1 })
+    }
+    await journal.close()
+    // Sequence 1 is the epoch row, so the items occupy 2..6. Removing 4 leaves
+    // 5 and 6 valid but unanchored.
+    await withJournalDatabase((db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(4)
+    })
+
+    const reopened = await open()
+    expect(await liveSequences()).toEqual([1, 2, 3])
+    expect(reopened.repair).toEqual({ malformedRows: 0 })
+    expect(reopened.snapshot().items.map((entry) => entry.body)).toEqual([body('m0'), body('m1')])
+  })
+
+  // The prefix survives, so there is no emptied epoch to re-anchor and — a gap
+  // costing no malformed row — no disclosure either. Without a durable marker
+  // the next probe reads a contiguous anchored prefix and calls it clean, and
+  // the rows the repair deleted are never asked for again.
+  it('still reports corrupt on the next probe, with the deleted suffix unrebuilt', async () => {
+    const journal = await open()
+    for (let ordinal = 0; ordinal < 5; ordinal += 1) {
+      await journal.appendItem(item(ordinal), body(`m${ordinal}`), { fence: 1 })
+    }
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(4)
+    })
+
+    const repaired = await open()
+    await repaired.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: true })
+
+    // Same policy the emptied-epoch repair takes: a session that writes into the
+    // epoch owns it, and a later import must not replace rows the user has seen.
+    const writable = await open()
+    await writable.appendItem(item(9), body('typed after the repair'), { fence: 1 })
+    await writable.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: false })
+  })
+
+  // The disclosure is the repair talking about itself, not the session writing:
+  // counting it as content would retire the marker the instant it was raised.
+  it('is not settled by the repair disclosure it appends for a malformed row', async () => {
+    const journal = await open()
+    for (let ordinal = 0; ordinal < 3; ordinal += 1) {
+      await journal.appendItem(item(ordinal), body(`m${ordinal}`), { fence: 1 })
+    }
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('}{', 3)
+    })
+
+    const repaired = await open()
+    expect(repaired.repair.malformedRows).toBe(1)
+    await repaired.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: true })
+  })
+})
+
+describe('a missing epoch row', () => {
+  // Sequence 1 is the anchor for the whole epoch. Validating from the first row
+  // that HAPPENS to remain declares the leftovers contiguous, and replay then
+  // renders a repaired journal as a clean timeline.
+  it('rejects the whole surviving range rather than declaring it contiguous', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('anchor'), { fence: 1 })
+    await journal.appendSubmission({
+      clientMessageId: 'client-message-1',
+      payloadFingerprint: 'fingerprint-1',
+      body: {
+        kind: 'message',
+        role: 'user',
+        blocks: [{ type: 'text', text: 'the user typed this' }]
+      },
+      fence: 1
+    })
+    await journal.resolveDispatch({
+      clientMessageId: 'client-message-1',
+      state: 'accepted',
+      providerIdentity: item(1),
+      fence: 1
+    })
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(1)
+    })
+
+    const reopened = await open()
+    expect(reopened.repair).toEqual({ malformedRows: 0 })
+    expect(reopened.snapshot().items).toEqual([])
+
+    // The epoch cannot be left row-less. An ordinary append would then take
+    // sequence 1, and replay would call that non-epoch row a clean timeline.
+    expect(await liveSequences()).toEqual([1])
+    const anchor = await firstLiveRow()
+    expect(anchor).toMatchObject({ kind: 'epoch', reason: 'unreconcilable_prefix' })
+  })
+
+  // The repair epoch is a placeholder for history it could not rebuild. Left
+  // clean it would end automatic recovery: the provider transcript is never
+  // consulted again and the dropped rows never come back.
+  it('keeps asking for provider history until the epoch has content of its own', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('anchor'), { fence: 1 })
+    await journal.close()
+    await withJournalDatabase((db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(1)
+    })
+
+    const repaired = await open()
+    await repaired.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: true })
+
+    // A session that writes into the epoch owns it: its own rows are not a
+    // repair placeholder, and a later import must not replace them.
+    const writable = await open()
+    await writable.appendItem(item(1), body('typed after the repair'), { fence: 1 })
+    await writable.close()
+    expect(loadJournal(root, IDENTITY.sessionId)).toMatchObject({ corrupt: false })
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts b/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
index c58f1b57bc8..a7f54a14a4c 100644
--- a/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
@@ -21,7 +21,7 @@ import {
   type ProviderHistoryItem,
   type ProviderHistoryWindow
 } from './journal-submission-reconciler'
-import { openAgentSessionJournal } from './journal-store-factory'
+import { createTrackedJournalOpener } from './journal-store-test-open'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -52,8 +52,10 @@ function userMessage(text: string): AgentJournalMessageItem {
   return { kind: 'message', role: 'user', blocks: [{ type: 'text', text }] }
 }
 
+const journals = createTrackedJournalOpener()
+
 async function open() {
-  return openAgentSessionJournal({
+  return journals.open({
     identity: IDENTITY,
     journalDir: root,
     now: tick,
@@ -89,6 +91,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -195,14 +198,8 @@ describe('crash between provider accept and journal commit', () => {
     ).toEqual([])
   })
 
-  it('keeps the receipt after the row that minted it was compacted away', async () => {
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      now: tick,
-      mintEpoch: () => `epoch-${clock}`,
-      compaction: { minTailRows: 1, retainTailMs: 0 }
-    })
+  it('keeps the receipt across a reopen', async () => {
+    const journal = await open()
     await journal.appendSubmission({
       clientMessageId: 'cm_1',
       payloadFingerprint: digestPayload('kept'),
@@ -215,7 +212,7 @@ describe('crash between provider accept and journal commit', () => {
       providerIdentity: ACCEPTED_IDENTITY,
       fence: 1
     })
-    await journal.compact()
+    await journal.close()
 
     const reopened = await open()
     expect(reopened.receiptFor('cm_1')?.providerItemId).toBe(agentJournalItemKey(ACCEPTED_IDENTITY))
diff --git a/src/main/native-chat/agent-session-journal/journal-cursor.ts b/src/main/native-chat/agent-session-journal/journal-cursor.ts
index bdec8adfd19..bd43623ae49 100644
--- a/src/main/native-chat/agent-session-journal/journal-cursor.ts
+++ b/src/main/native-chat/agent-session-journal/journal-cursor.ts
@@ -77,7 +77,7 @@ export function findSequenceGap(
 export function readJournalSince(
   source: {
     state: { epoch: string; lastSequence: number; oldestSequence: number }
-    tailRows: readonly JournalRow[]
+    rowsAfter: (afterSequence: number) => JournalRow[]
     readOnly: boolean
   },
   cursor: AgentJournalCursor,
@@ -92,7 +92,7 @@ export function readJournalSince(
   }
   return {
     ok: true,
-    rows: source.tailRows.filter((row) => row.seq > resume.afterSequence),
+    rows: source.rowsAfter(resume.afterSequence),
     cursor: currentCursor()
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-database-schema.ts b/src/main/native-chat/agent-session-journal/journal-database-schema.ts
new file mode 100644
index 00000000000..37675fbcd8e
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-database-schema.ts
@@ -0,0 +1,37 @@
+// Table shape for one session's journal database.
+//
+// `journal_rows` is the append-only log; `journal_sessions` is the derived
+// projection, upserted in the SAME transaction as every row insert so the live
+// epoch and the rows that belong to it can never disagree. `journal_repairs`
+// carries at most one row per session: the standing demand for a rebuild a
+// partial repair leaves behind (see journal-repair-marker.ts).
+
+/** DB shape version, carried in `PRAGMA user_version`. Independent of the row
+ *  body version (`JournalRow.v`): a newer build can change either alone.
+ *  v2 added `journal_repairs`; a build without it would replay a partially
+ *  repaired journal as clean, so it must latch read-only rather than write. */
+export const JOURNAL_DB_SCHEMA_VERSION = 2
+
+export function createJournalTablesSql(): string {
+  return `
+CREATE TABLE IF NOT EXISTS journal_rows (
+  session_id TEXT    NOT NULL,
+  epoch      TEXT    NOT NULL,
+  seq        INTEGER NOT NULL,
+  ts         INTEGER NOT NULL,
+  row_json   TEXT    NOT NULL,
+  PRIMARY KEY (session_id, epoch, seq)
+);
+CREATE TABLE IF NOT EXISTS journal_sessions (
+  session_id TEXT PRIMARY KEY,
+  epoch      TEXT    NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS journal_repairs (
+  session_id   TEXT PRIMARY KEY,
+  epoch        TEXT    NOT NULL,
+  content_from INTEGER NOT NULL,
+  repaired_at  INTEGER NOT NULL
+);
+`
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-database.test.ts b/src/main/native-chat/agent-session-journal/journal-database.test.ts
new file mode 100644
index 00000000000..358c42c8d55
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-database.test.ts
@@ -0,0 +1,201 @@
+import { mkdtemp, rm, stat } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import {
+  JOURNAL_BUSY_TIMEOUT_MS,
+  journalPragmaNumber,
+  openJournalDatabase
+} from './journal-database'
+import { JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+import { journalDatabaseFile } from './journal-paths'
+import {
+  deleteAllJournalRows,
+  deleteJournalRowSuffix,
+  insertJournalRow,
+  readJournalEpochRows,
+  readJournalRowsAfter,
+  readJournalSessionEpoch,
+  upsertJournalSessionRow
+} from './journal-row-table'
+import type { JournalRow } from './journal-row-schema'
+import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+
+let root: string
+let dbPath: string
+
+function epochRow(seq: number, epoch = 'epoch-1'): JournalRow {
+  return {
+    kind: 'epoch',
+    reason: 'session_created',
+    providerHandle: { kind: 'codex', threadId: 'thread-1' },
+    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
+    epoch,
+    seq,
+    fence: 0,
+    ts: 1_700_000_000_000 + seq
+  }
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-db-'))
+  dbPath = journalDatabaseFile(root)
+})
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('journal database open', () => {
+  it('creates both tables and reads back every load-bearing pragma', () => {
+    const opened = openJournalDatabase(dbPath)
+    try {
+      const tables = opened.db
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name")
+        .all()
+        .map((entry) => (entry as { name: string }).name)
+      expect(tables).toContain('journal_rows')
+      expect(tables).toContain('journal_sessions')
+      expect(opened.db.pragma('journal_mode', { simple: true })).toBe('wal')
+      expect(journalPragmaNumber(opened.db, 'synchronous')).toBe(2)
+      expect(journalPragmaNumber(opened.db, 'busy_timeout')).toBe(JOURNAL_BUSY_TIMEOUT_MS)
+      expect(journalPragmaNumber(opened.db, 'foreign_keys')).toBe(1)
+      expect(journalPragmaNumber(opened.db, 'user_version')).toBe(JOURNAL_DB_SCHEMA_VERSION)
+      expect(opened.readOnly).toBe(false)
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('latches read-only on a future user_version without touching the file', async () => {
+    const seeded = openJournalDatabase(dbPath)
+    upsertJournalSessionRow(seeded.db, 'session-1', 'epoch-1', 1)
+    insertJournalRow(seeded.db, 'session-1', epochRow(1))
+    seeded.db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 5}`)
+    seeded.db.close()
+    const before = await stat(dbPath)
+
+    const latched = openJournalDatabase(dbPath)
+    try {
+      expect(latched.readOnly).toBe(true)
+      expect(journalPragmaNumber(latched.db, 'user_version')).toBe(JOURNAL_DB_SCHEMA_VERSION + 5)
+      expect(readJournalEpochRows(latched.db, 'session-1', 'epoch-1')).toHaveLength(1)
+      expect(() => latched.db.exec("INSERT INTO journal_sessions VALUES ('x', 'y', 1)")).toThrow()
+    } finally {
+      latched.db.close()
+    }
+    expect((await stat(dbPath)).size).toBe(before.size)
+    expect(journalPragmaNumber(openJournalDatabase(dbPath).db, 'user_version')).toBe(
+      JOURNAL_DB_SCHEMA_VERSION + 5
+    )
+  })
+
+  // Site 1: the raw connection is owned by the open call until it returns.
+  it('closes the raw connection when schema setup throws', async () => {
+    const failing = join(root, 'nested', 'journal.db')
+    expect(() => openJournalDatabase(failing)).toThrow()
+    await expect(stat(`${failing}-wal`)).rejects.toThrow()
+    await expect(rm(root, { recursive: true, force: true })).resolves.toBeUndefined()
+    root = await mkdtemp(join(tmpdir(), 'orca-journal-db-'))
+  })
+})
+
+describe('journal row statements', () => {
+  it('serves replay, resume, discard and suffix truncation from the primary key', () => {
+    const opened = openJournalDatabase(dbPath)
+    try {
+      const { db } = opened
+      db.exec('BEGIN IMMEDIATE')
+      for (let seq = 1; seq <= 5; seq += 1) {
+        insertJournalRow(db, 'session-1', epochRow(seq))
+      }
+      insertJournalRow(db, 'session-1', epochRow(1, 'epoch-old'))
+      upsertJournalSessionRow(db, 'session-1', 'epoch-1', 42)
+      db.exec('COMMIT')
+
+      expect(readJournalSessionEpoch(db, 'session-1')).toBe('epoch-1')
+      expect(readJournalSessionEpoch(db, 'absent')).toBeNull()
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-1').map((row) => row.seq)).toEqual([
+        1, 2, 3, 4, 5
+      ])
+      expect(readJournalRowsAfter(db, 'session-1', 'epoch-1', 3).map((row) => row.seq)).toEqual([
+        4, 5
+      ])
+
+      // The rejected suffix leaves `journal_rows`, scoped to its own epoch.
+      expect(deleteJournalRowSuffix(db, 'session-1', 'epoch-1', 4)).toBe(2)
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-1').map((row) => row.seq)).toEqual([
+        1, 2, 3
+      ])
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-old')).toHaveLength(1)
+
+      deleteAllJournalRows(db)
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-1')).toHaveLength(0)
+      expect(readJournalEpochRows(db, 'session-1', 'epoch-old')).toHaveLength(0)
+      expect(readJournalSessionEpoch(db, 'session-1')).toBe('epoch-1')
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('refuses a duplicate sequence inside one epoch', () => {
+    const opened = openJournalDatabase(dbPath)
+    try {
+      insertJournalRow(opened.db, 'session-1', epochRow(1))
+      expect(() => insertJournalRow(opened.db, 'session-1', epochRow(1))).toThrow()
+      insertJournalRow(opened.db, 'session-1', epochRow(1, 'epoch-2'))
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('upserts the session projection in place', () => {
+    const opened = openJournalDatabase(dbPath)
+    try {
+      upsertJournalSessionRow(opened.db, 'session-1', 'epoch-1', 1)
+      upsertJournalSessionRow(opened.db, 'session-1', 'epoch-2', 2)
+      expect(readJournalSessionEpoch(opened.db, 'session-1')).toBe('epoch-2')
+      expect(
+        opened.db.prepare('SELECT count(*) AS total FROM journal_sessions').get()
+      ).toMatchObject({ total: 1 })
+    } finally {
+      opened.db.close()
+    }
+  })
+})
+
+describe('schema creation', () => {
+  // Creating the tables outside the migration transaction left a v2-shaped
+  // database still reporting version 0, which an older build does not latch
+  // read-only: it stamps its own version on and writes through v1 SQL.
+  it('publishes no table until the version bump commits with it', () => {
+    const original = Database.prototype.pragma
+    const pragma = vi.spyOn(Database.prototype, 'pragma').mockImplementation(function (
+      this: Database.Database,
+      sql: string,
+      options?: { simple?: boolean }
+    ) {
+      if (sql.startsWith('user_version =')) {
+        throw new Error('crash before the version is published')
+      }
+      return original.call(this, sql, options)
+    })
+
+    expect(() => openJournalDatabase(dbPath)).toThrow('crash before the version is published')
+    pragma.mockRestore()
+
+    const inspected = new Database(dbPath)
+    try {
+      expect(inspected.pragma('user_version', { simple: true })).toBe(0)
+      expect(
+        inspected
+          .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'journal_rows'")
+          .get()
+      ).toBeUndefined()
+    } finally {
+      inspected.close()
+    }
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-database.ts b/src/main/native-chat/agent-session-journal/journal-database.ts
new file mode 100644
index 00000000000..6f1cd60733b
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-database.ts
@@ -0,0 +1,80 @@
+// Opening one session's journal database.
+//
+// `PRAGMA user_version` is read FIRST, on a connection that has set no
+// persistent pragma and run no DDL: a future-schema database must be left
+// byte-identical, and `journal_mode = WAL` writes the file header.
+
+import Database from '../../sqlite/sync-database'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import { createJournalTablesSql, JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+
+export const JOURNAL_BUSY_TIMEOUT_MS = 5000
+
+export type OpenJournalDatabase = {
+  db: Database.Database
+  /** A newer `user_version` was met: this build reads and never writes. */
+  readOnly: boolean
+}
+
+export function journalPragmaNumber(db: Database.Database, name: string): number {
+  return Number(db.pragma(name, { simple: true }) ?? 0)
+}
+
+export function openJournalDatabase(dbPath: string): OpenJournalDatabase {
+  const probe = new Database(dbPath)
+  let stored: number
+  try {
+    stored = journalPragmaNumber(probe, 'user_version')
+  } catch (error) {
+    probe.close()
+    throw error
+  }
+  if (stored > JOURNAL_DB_SCHEMA_VERSION) {
+    probe.close()
+    return { db: new Database(dbPath, { readonly: true, fileMustExist: true }), readOnly: true }
+  }
+  let transferred = false
+  try {
+    configureJournalPragmas(probe)
+    createJournalSchema(probe, stored)
+    hardenSqliteDatabaseFiles(dbPath)
+    const opened = { db: probe, readOnly: false }
+    transferred = true
+    return opened
+  } finally {
+    if (!transferred) {
+      probe.close()
+    }
+  }
+}
+
+function configureJournalPragmas(db: Database.Database): void {
+  db.pragma('journal_mode = WAL')
+  db.pragma(`busy_timeout = ${JOURNAL_BUSY_TIMEOUT_MS}`)
+  db.pragma('foreign_keys = ON')
+  // Why FULL rather than the house NORMAL: the write-ahead submission row must
+  // survive a power loss before the adapter dispatches anything, and NORMAL in
+  // WAL mode does not fsync at commit.
+  db.pragma('synchronous = FULL')
+}
+
+/**
+ * Table creation and the `user_version` bump are ONE transaction. Creating the
+ * tables first left a shaped database still reporting version 0, which an older
+ * build does not latch read-only: it stamped its own version on and wrote
+ * through SQL for a schema it did not have.
+ */
+function createJournalSchema(db: Database.Database, stored: number): void {
+  if (stored >= JOURNAL_DB_SCHEMA_VERSION) {
+    return
+  }
+  db.exec('BEGIN IMMEDIATE')
+  try {
+    db.exec(createJournalTablesSql())
+    db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION}`)
+    db.exec('COMMIT')
+  } catch (error) {
+    db.exec('ROLLBACK')
+    throw error
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-controller.ts b/src/main/native-chat/agent-session-journal/journal-epoch-controller.ts
index 087ac9e6a26..f428675fb2c 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-controller.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-controller.ts
@@ -2,28 +2,21 @@ import type {
   AgentJournalCursor,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import type { JournalCompactionPolicy } from './journal-compaction'
-import { quarantineUnreadableSchema } from './journal-corruption-quarantine'
+import type Database from '../../sqlite/sync-database'
 import { replaceJournalEpoch, type JournalReplacementItem } from './journal-epoch-replacement'
 import { publishNewEpoch } from './journal-epoch-rollover'
 import type { JournalLoad } from './journal-open'
 import type { AgentJournalEpochReason } from './journal-row-schema'
-import {
-  assertJournalFence,
-  assertJournalWritable,
-  type JournalAppendBudget
-} from './journal-write-guards'
+import { assertJournalFence, assertJournalWritable } from './journal-write-guards'
 
 export class JournalEpochController {
   constructor(
     private readonly deps: {
       identity: AgentSessionJournalIdentity
-      journalDir: string
-      budget: JournalAppendBudget
-      compaction: JournalCompactionPolicy
       now: () => number
       mintEpoch: () => string
       serialize: <T>(run: () => Promise<T>) => Promise<T>
+      database: () => { db: Database.Database }
       readOnly: () => boolean
       setReadOnly: (readOnly: boolean) => void
       highestFence: () => number
@@ -32,33 +25,33 @@ export class JournalEpochController {
     }
   ) {}
 
-  async start(reason: AgentJournalEpochReason, fence: number): Promise<void> {
-    this.deps.adopt(
-      await publishNewEpoch({
-        journalDir: this.deps.journalDir,
-        sessionId: this.deps.identity.sessionId,
-        providerHandle: this.deps.identity.providerHandle,
-        epoch: this.deps.mintEpoch(),
-        reason,
-        fence,
-        now: this.deps.now(),
-        maxSessionBytes: this.deps.budget.maxSessionBytes
-      })
-    )
+  start(reason: AgentJournalEpochReason, fence: number): void {
+    publishNewEpoch({
+      db: this.deps.database().db,
+      sessionId: this.deps.identity.sessionId,
+      providerHandle: this.deps.identity.providerHandle,
+      epoch: this.deps.mintEpoch(),
+      reason,
+      fence,
+      now: this.deps.now(),
+      onPublished: this.deps.adopt
+    })
   }
 
-  async roll(reason: AgentJournalEpochReason, fence: number): Promise<AgentJournalCursor> {
-    if (reason !== 'schema_unreadable') {
+  /**
+   * Every reason takes the same writable guard. A latched store refuses a roll
+   * like any other write, and `schema_unreadable` has no production caller.
+   *
+   * Serialized like every other write, so the discard cannot land between an
+   * admitted append's sequence assignment and its commit.
+   */
+  roll(reason: AgentJournalEpochReason, fence: number): Promise<AgentJournalCursor> {
+    return this.deps.serialize(async () => {
       assertJournalWritable(this.deps.readOnly(), this.deps.identity.sessionId)
-    } else if (this.deps.readOnly()) {
-      await quarantineUnreadableSchema(this.deps.journalDir, {
-        sessionId: this.deps.identity.sessionId,
-        maxBytes: this.deps.budget.maxSessionBytes
-      })
-    }
-    await this.start(reason, fence)
-    this.deps.setReadOnly(false)
-    return this.deps.cursor()
+      this.start(reason, fence)
+      this.deps.setReadOnly(false)
+      return this.deps.cursor()
+    })
   }
 
   replace(
@@ -69,17 +62,15 @@ export class JournalEpochController {
     return this.deps.serialize(async () => {
       assertJournalWritable(this.deps.readOnly(), this.deps.identity.sessionId)
       assertJournalFence(fence, this.deps.highestFence())
-      await replaceJournalEpoch({
-        journalDir: this.deps.journalDir,
+      replaceJournalEpoch({
+        db: this.deps.database().db,
         identity: this.deps.identity,
         reason,
         fence,
         items,
-        budget: this.deps.budget.fork(),
-        compaction: this.deps.compaction,
         now: this.deps.now,
         mintEpoch: this.deps.mintEpoch,
-        onSnapshotPublished: this.deps.adopt
+        onPublished: this.deps.adopt
       })
       return this.deps.cursor()
     })
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts
index d4036755fda..96273366d5f 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts
@@ -1,18 +1,19 @@
-import { mkdtemp, readdir, rm } from 'node:fs/promises'
+// Republishing an epoch is ONE transaction.
+
+import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type {
-  AgentJournalItemBody,
+  AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import { DEFAULT_JOURNAL_COMPACTION_POLICY } from './journal-compaction'
+import { openJournalDatabase, type OpenJournalDatabase } from './journal-database'
 import { replaceJournalEpoch } from './journal-epoch-replacement'
-import { putJournalBlob, readJournalBlob } from './journal-blob-store'
-import { boundPayload, DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import { JournalAppendBudget } from './journal-write-guards'
-import { openAgentSessionJournal } from './journal-store-factory'
+import type { JournalLoad } from './journal-open'
+import { journalDatabaseFile } from './journal-paths'
+import { readJournalEpochRows, readJournalSessionEpoch } from './journal-row-table'
+import { createTrackedJournalOpener } from './journal-store-test-open'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -24,150 +25,79 @@ const IDENTITY: AgentSessionJournalIdentity = {
 
 let root: string
 let clock = 1_000
-
-beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-journal-replace-'))
-  clock = 1_000
-})
-
-afterEach(async () => {
-  await rm(root, { recursive: true, force: true })
-})
+let database: OpenJournalDatabase
+const journals = createTrackedJournalOpener()
 
 function now(): number {
   clock += 1
   return clock
 }
 
-function toolBody(output: ReturnType<typeof boundPayload>): AgentJournalItemBody {
-  return {
-    kind: 'tool-call',
-    name: 'shell',
-    input: {},
-    state: 'completed',
-    output
-  }
+function item(ordinal: number): AgentJournalItemIdentity {
+  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
 }
 
-describe('journal epoch replacement', () => {
-  it('publishes one observable replacement and prunes stale root blobs afterward', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 8 }
-    const stalePayload = 'stale'.repeat(1_000)
-    const retainedPayload = 'retained'.repeat(1_000)
-    const stale = boundPayload(stalePayload, limits)
-    const retained = boundPayload(retainedPayload, limits)
-    const published: unknown[] = []
-    await putJournalBlob(root, stale.digest, stalePayload)
+function replace(input: {
+  items: Parameters<typeof replaceJournalEpoch>[0]['items']
+  onPublished?: (loaded: JournalLoad) => void
+}): void {
+  replaceJournalEpoch({
+    db: database.db,
+    identity: IDENTITY,
+    reason: 'legacy_import',
+    fence: 1,
+    items: input.items,
+    now,
+    mintEpoch: () => `epoch-${clock}`,
+    onPublished: input.onPublished ?? (() => undefined)
+  })
+}
 
-    await replaceJournalEpoch({
-      journalDir: root,
-      identity: IDENTITY,
-      reason: 'handle_forked',
-      fence: 2,
-      items: [
-        {
-          identity: { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 },
-          body: toolBody(retained),
-          blobs: [{ digest: retained.digest, payload: retainedPayload }]
-        }
-      ],
-      budget: new JournalAppendBudget(IDENTITY.sessionId, {
-        ...limits,
-        maxSessionBytes: 512 * 1024
-      }),
-      compaction: DEFAULT_JOURNAL_COMPACTION_POLICY,
-      now,
-      mintEpoch: () => 'epoch-new',
-      onSnapshotPublished: (loaded) => published.push(loaded)
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-replace-'))
+  clock = 1_000
+  database = openJournalDatabase(journalDatabaseFile(root))
+})
+
+afterEach(async () => {
+  try {
+    database.db.close()
+  } catch {
+    // Already closed by the case.
+  }
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('journal epoch replacement', () => {
+  it('publishes one observable replacement', () => {
+    const published: JournalLoad[] = []
+
+    replace({
+      items: [{ identity: item(1), body: { kind: 'status', text: 'republished' } }],
+      onPublished: (loaded) => published.push(loaded)
     })
 
     expect(published).toHaveLength(1)
-    expect(await readJournalBlob(root, stale.digest)).toBeNull()
-    expect(await readJournalBlob(root, retained.digest)).toBe(retainedPayload)
-    expect((published[0] as { sizeBytes: number }).sizeBytes).toBe(
-      await journalDirectoryBytes(root)
-    )
+    const epoch = readJournalSessionEpoch(database.db, IDENTITY.sessionId)
+    expect(epoch).toBe(published[0]?.state.epoch)
+    expect(readJournalEpochRows(database.db, IDENTITY.sessionId, epoch ?? '')).toHaveLength(2)
   })
 
-  it('keeps root blobs and reports no publication when replacement never becomes authoritative', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 8, maxSessionBytes: 6_000 }
-    const stalePayload = 'stale'.repeat(500)
-    const stale = boundPayload(stalePayload, limits)
-    const published: unknown[] = []
-    await putJournalBlob(root, stale.digest, stalePayload)
+  it('discards every superseded row in the same transaction', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.appendItem(item(1), { kind: 'status', text: 'old' }, { fence: 1 })
+    await journal.appendItem(item(2), { kind: 'status', text: 'older' }, { fence: 1 })
+    const before = journal.epoch
 
-    await expect(
-      replaceJournalEpoch({
-        journalDir: root,
-        identity: IDENTITY,
-        reason: 'handle_forked',
-        fence: 2,
-        items: [
-          {
-            identity: { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 },
-            body: {
-              kind: 'message',
-              role: 'assistant',
-              blocks: [{ type: 'text', text: 'x'.repeat(10_000) }]
-            }
-          }
-        ],
-        budget: new JournalAppendBudget(IDENTITY.sessionId, limits),
-        compaction: DEFAULT_JOURNAL_COMPACTION_POLICY,
-        now,
-        mintEpoch: () => 'epoch-new',
-        onSnapshotPublished: (loaded) => published.push(loaded)
-      })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
+    await journal.replaceEpochItems('legacy_import', 1, [
+      { identity: item(9), body: { kind: 'status', text: 'republished' } }
+    ])
 
-    expect(published).toHaveLength(0)
-    expect(await readJournalBlob(root, stale.digest)).toBe(stalePayload)
-    expect((await readdir(root)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(false)
-  })
-
-  it('charges replacement blobs cumulatively and rolls back staging on quota refusal', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 8, maxSessionBytes: 7_000 }
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits,
-      autoCompact: false,
-      now,
-      mintEpoch: () => `epoch-${clock}`
-    })
-    const existingPayload = 'existing'.repeat(250)
-    const existing = boundPayload(existingPayload, limits)
-    await journal.appendItemWithBlobs(
-      { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 0 },
-      toolBody(existing),
-      [{ digest: existing.digest, payload: existingPayload }],
-      { fence: 1 }
-    )
-
-    const replacementPayload = 'replacement'.repeat(200)
-    const replacement = boundPayload(replacementPayload, limits)
-    const secondPayload = 'second'.repeat(200)
-    const second = boundPayload(secondPayload, limits)
-    await expect(
-      journal.replaceEpochItems('handle_forked', 2, [
-        {
-          identity: { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 1 },
-          body: toolBody(replacement),
-          blobs: [{ digest: replacement.digest, payload: replacementPayload }]
-        },
-        {
-          identity: { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal: 2 },
-          body: toolBody(second),
-          blobs: [{ digest: second.digest, payload: secondPayload }]
-        }
-      ])
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(journal.epoch).toMatch(/^epoch-/)
-    expect(await readJournalBlob(root, existing.digest)).toBe(existingPayload)
-    expect(await readJournalBlob(root, replacement.digest)).toBeNull()
-    expect(await readJournalBlob(root, second.digest)).toBeNull()
-    expect((await readdir(root)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(false)
-    expect(await journalDirectoryBytes(root)).toBeLessThanOrEqual(limits.maxSessionBytes)
+    expect(journal.epoch).not.toBe(before)
+    expect(readJournalEpochRows(database.db, IDENTITY.sessionId, before)).toHaveLength(0)
+    expect(journal.snapshot().items.map((entry) => entry.body)).toEqual([
+      { kind: 'status', text: 'republished' }
+    ])
   })
 })
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
index 342c60c4f1d..9512d5e9fa1 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
@@ -1,298 +1,85 @@
-import { mkdir, mkdtemp, rm, stat } from 'node:fs/promises'
-import { join } from 'node:path'
-import { copyFileDurable } from '../../durable-file-write'
+// Republishing a live item set into a fresh epoch.
+//
+// One transaction: discard every row, insert the epoch row plus the replacement
+// items, move the session projection, and retire any repair marker — this
+// republished history is exactly what the marker was holding out for.
+
 import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import { compactJournal, type JournalCompactionPolicy } from './journal-compaction'
-import { JOURNAL_LOG_FILE, JOURNAL_SNAPSHOT_FILE, appendJournalRows } from './journal-log-file'
-import {
-  applyJournalRow,
-  blobDigestsInBody,
-  createJournalReducerState,
-  referencedBlobDigests,
-  type JournalReducerState
-} from './journal-reducer'
-import { buildJournalItemRow, journalRowBase } from './journal-row-builders'
-import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
-import { journalRowByteLength } from './journal-row-schema'
-import { assertJournalFence, type JournalAppendBudget } from './journal-write-guards'
+import type Database from '../../sqlite/sync-database'
 import type { JournalLoad } from './journal-open'
-import { assertJournalPhysicalCapacity, journalDirectoryBytes } from './journal-physical-quota'
+import { clearJournalRepairMarker } from './journal-repair-marker'
+import { applyJournalRow, createJournalReducerState } from './journal-reducer'
+import { buildJournalItemRow, journalRowBase } from './journal-row-builders'
 import {
-  JOURNAL_BLOB_DIR,
-  journalBlobFileSize,
-  putJournalBlob,
-  pruneJournalBlobs,
-  removeJournalBlob
-} from './journal-blob-store'
+  deleteAllJournalRows,
+  insertJournalRow,
+  upsertJournalSessionRow
+} from './journal-row-table'
+import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
+import { assertJournalFence } from './journal-write-guards'
 
 export type JournalReplacementItem = {
   identity: AgentJournalItemIdentity
   body: AgentJournalItemBody
-  blobs?: readonly { digest: string; payload: string }[]
   observedAt?: number
 }
 
-export async function replaceJournalEpoch(input: {
-  journalDir: string
+export function replaceJournalEpoch(input: {
+  db: Database.Database
   identity: AgentSessionJournalIdentity
   reason: AgentJournalEpochReason
   fence: number
   items: readonly JournalReplacementItem[]
-  budget: JournalAppendBudget
-  compaction: JournalCompactionPolicy
   now: () => number
   mintEpoch: () => string
-  onSnapshotPublished: (loaded: JournalLoad) => void
-}): Promise<void> {
-  const stagingDir = await mkdtemp(join(input.journalDir, '.epoch-replacement-'))
-  const stagedBlobDigests = new Set<string>()
-  const publishedBlobDigests: string[] = []
-  let snapshotPublished = false
-  let adoptionReported = false
-  let publishedLoad: JournalLoad | null = null
+  /** Called the instant the transaction commits, before any fallible follow-up. */
+  onPublished: (loaded: JournalLoad) => void
+}): void {
+  const epoch = input.mintEpoch()
+  const state = createJournalReducerState(input.identity.sessionId, epoch)
+  const epochRow: JournalRow = {
+    kind: 'epoch',
+    reason: input.reason,
+    providerHandle: input.identity.providerHandle,
+    ...journalRowBase(epoch, 1, input.fence, input.now())
+  }
+  const rows: JournalRow[] = [epochRow]
+  applyJournalRow(state, epochRow)
+  for (const item of input.items) {
+    const row = buildJournalItemRow({
+      state,
+      identity: item.identity,
+      body: item.body,
+      seq: state.lastSequence + 1,
+      fence: input.fence,
+      ts: item.observedAt ?? input.now()
+    })
+    assertJournalFence(row.fence, state.highestFence)
+    applyJournalRow(state, row)
+    rows.push(row)
+  }
+
+  input.db.exec('BEGIN IMMEDIATE')
   try {
-    const epoch = input.mintEpoch()
-    const state = createJournalReducerState(input.identity.sessionId, epoch)
-    const epochRow: JournalRow = {
-      kind: 'epoch',
-      reason: input.reason,
-      providerHandle: input.identity.providerHandle,
-      ...journalRowBase(epoch, 1, input.fence, input.now())
-    }
-    const rows: JournalRow[] = [epochRow]
-    applyJournalRow(state, epochRow)
-    let sizeBytes = journalRowByteLength(epochRow)
-    await assertStagingCapacity(input, sizeBytes)
-    await appendJournalRows(stagingDir, [epochRow])
-
-    for (const item of input.items) {
-      sizeBytes += await stageReplacementBlobs({
-        journalDir: input.journalDir,
-        stagingDir,
-        identity: input.identity,
-        budget: input.budget,
-        stagedBlobDigests,
-        blobs: item.blobs ?? []
-      })
-      const appendTime = input.now()
-      const row = buildJournalItemRow({
-        state,
-        identity: item.identity,
-        body: item.body,
-        seq: state.lastSequence + 1,
-        fence: input.fence,
-        ts: item.observedAt ?? appendTime
-      })
-      assertJournalFence(row.fence, state.highestFence)
-      input.budget.assert(row, appendTime, sizeBytes)
-      await assertStagingCapacity(input, journalRowByteLength(row))
-      await appendJournalRows(stagingDir, [row])
-      applyJournalRow(state, row)
-      rows.push(row)
-      sizeBytes += journalRowByteLength(row)
-    }
-
-    const compacted = await compactJournal({
-      journalDir: stagingDir,
-      physicalQuotaRoot: input.journalDir,
-      state,
-      tailRows: rows,
-      policy: input.compaction,
-      now: input.now(),
-      maxSessionBytes: input.budget.maxSessionBytes
-    })
-    // All destination publishes use durable temp files while the staging
-    // source and existing finals remain present. Reserve the whole publication
-    // peak before touching the live epoch so a later file cannot fail halfway
-    // through replacement.
-    const stagedSnapshotBytes = (await stat(join(stagingDir, JOURNAL_SNAPSHOT_FILE))).size
-    const stagedLogBytes = (await stat(join(stagingDir, JOURNAL_LOG_FILE))).size
-    let stagedPublishBytes = stagedSnapshotBytes + stagedLogBytes
-    for (const digest of stagedBlobDigests) {
-      stagedPublishBytes += (await stat(join(stagingDir, JOURNAL_BLOB_DIR, digest))).size
-    }
-    await assertJournalPhysicalCapacity({
-      journalDir: input.journalDir,
-      sessionId: input.identity.sessionId,
-      maxBytes: input.budget.maxSessionBytes,
-      peakAdditionalBytes: stagedPublishBytes
-    })
-    for (const digest of stagedBlobDigests) {
-      if (
-        await publishPreparedBlob(
-          stagingDir,
-          input.journalDir,
-          digest,
-          input.identity.sessionId,
-          input.budget.maxSessionBytes
-        )
-      ) {
-        publishedBlobDigests.push(digest)
-      }
-    }
-    await publishPreparedFile(
-      stagingDir,
-      input.journalDir,
-      JOURNAL_SNAPSHOT_FILE,
-      input.identity.sessionId,
-      input.budget.maxSessionBytes
-    )
-    snapshotPublished = true
-    state.oldestSequence = compacted.oldestSequence
-    publishedLoad = {
-      state,
-      tailRows: compacted.tailRows,
-      compactedThrough: compacted.compactedThrough,
-      readOnly: false,
-      corrupt: false,
-      malformedRows: 0,
-      sizeBytes: 0
-    }
-    await publishPreparedFile(
-      stagingDir,
-      input.journalDir,
-      JOURNAL_LOG_FILE,
-      input.identity.sessionId,
-      input.budget.maxSessionBytes
-    )
-    await pruneJournalBlobs(
-      input.journalDir,
-      replacementRetainedBlobDigests(state, compacted.tailRows)
-    )
-  } finally {
-    if (!snapshotPublished) {
-      for (const digest of publishedBlobDigests) {
-        await removeJournalBlob(input.journalDir, digest)
-      }
-    }
-    await rm(stagingDir, { recursive: true, force: true })
-    if (snapshotPublished && publishedLoad && !adoptionReported) {
-      adoptionReported = true
-      input.onSnapshotPublished({
-        ...publishedLoad,
-        sizeBytes: await journalDirectoryBytes(input.journalDir)
-      })
+    deleteAllJournalRows(input.db)
+    clearJournalRepairMarker(input.db, input.identity.sessionId)
+    for (const row of rows) {
+      insertJournalRow(input.db, input.identity.sessionId, row)
     }
+    upsertJournalSessionRow(input.db, input.identity.sessionId, epoch, epochRow.ts)
+    input.db.exec('COMMIT')
+  } catch (error) {
+    input.db.exec('ROLLBACK')
+    throw error
   }
-}
 
-function replacementRetainedBlobDigests(
-  state: JournalReducerState,
-  tailRows: readonly JournalRow[]
-): Set<string> {
-  const retained = referencedBlobDigests(state)
-  for (const row of tailRows) {
-    if (row.kind === 'item') {
-      blobDigestsInBody(row.body, retained)
-    } else if (row.kind === 'lifecycle-batch') {
-      for (const mutation of row.mutations) {
-        if (mutation.kind === 'item') {
-          blobDigestsInBody(mutation.body, retained)
-        }
-      }
-    }
-  }
-  return retained
-}
-
-async function stageReplacementBlobs(input: {
-  journalDir: string
-  stagingDir: string
-  identity: AgentSessionJournalIdentity
-  budget: JournalAppendBudget
-  stagedBlobDigests: Set<string>
-  blobs: readonly { digest: string; payload: string }[]
-}): Promise<number> {
-  const toStage: { digest: string; payload: string; bytes: number }[] = []
-  const unique = new Map(input.blobs.map((blob) => [blob.digest, blob]))
-  for (const blob of unique.values()) {
-    if (input.stagedBlobDigests.has(blob.digest)) {
-      continue
-    }
-    if ((await journalBlobFileSize(input.journalDir, blob.digest)) !== null) {
-      continue
-    }
-    const bytes = Buffer.byteLength(blob.payload, 'utf8')
-    toStage.push({ ...blob, bytes })
-  }
-  // Reserve all new payloads together. The staging directory lives under the
-  // journal root, so the capacity check includes existing session bytes and
-  // every other .epoch-replacement-* directory already present.
-  const stagedBytes = toStage.reduce((total, blob) => total + blob.bytes, 0)
-  await assertStagingCapacity(input, stagedBytes)
-  for (const blob of toStage) {
-    await putJournalBlob(input.stagingDir, blob.digest, blob.payload)
-    input.stagedBlobDigests.add(blob.digest)
-  }
-  return stagedBytes
-}
-
-function assertStagingCapacity(
-  input: {
-    journalDir: string
-    identity: AgentSessionJournalIdentity
-    budget: JournalAppendBudget
-  },
-  additionalBytes: number
-): Promise<number> {
-  return assertJournalPhysicalCapacity({
-    journalDir: input.journalDir,
-    sessionId: input.identity.sessionId,
-    maxBytes: input.budget.maxSessionBytes,
-    peakAdditionalBytes: additionalBytes
-  })
-}
-
-async function publishPreparedFile(
-  stagingDir: string,
-  journalDir: string,
-  fileName: string,
-  sessionId: string,
-  maxBytes: number
-): Promise<void> {
-  await assertJournalPhysicalCapacity({
-    journalDir,
-    sessionId,
-    maxBytes,
-    peakAdditionalBytes: (await stat(join(stagingDir, fileName))).size
-  })
-  const copied = await copyFileDurable(join(stagingDir, fileName), join(journalDir, fileName))
-  if (!copied) {
-    throw new Error(`prepared journal file disappeared before publish: ${fileName}`)
-  }
-}
-
-async function publishPreparedBlob(
-  stagingDir: string,
-  journalDir: string,
-  digest: string,
-  sessionId: string,
-  maxBytes: number
-): Promise<boolean> {
-  if ((await journalBlobFileSize(journalDir, digest)) !== null) {
-    return false
-  }
-  const size = await journalBlobFileSize(stagingDir, digest)
-  if (size === null) {
-    throw new Error(`prepared journal blob disappeared before publish: ${digest}`)
-  }
-  await assertJournalPhysicalCapacity({
-    journalDir,
-    sessionId,
-    maxBytes,
-    peakAdditionalBytes: size
-  })
-  await mkdir(join(journalDir, JOURNAL_BLOB_DIR), { recursive: true })
-  const copied = await copyFileDurable(
-    join(stagingDir, JOURNAL_BLOB_DIR, digest),
-    join(journalDir, JOURNAL_BLOB_DIR, digest)
-  )
-  if (!copied) {
-    throw new Error(`prepared journal blob disappeared before publish: ${digest}`)
-  }
-  return true
+  // COMMIT landed: on disk the superseded rows are gone and this epoch is the
+  // live one. The caller adopts that immediately, or a later failure leaves the
+  // live store writing into an epoch whose rows were just deleted.
+  state.oldestSequence = 1
+  input.onPublished({ state, readOnly: false, corrupt: false, malformedRows: 0 })
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts b/src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts
index 40e1bc3a542..e95ff821058 100644
--- a/src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts
+++ b/src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts
@@ -1,29 +1,34 @@
 // Opening a new epoch.
 //
-// The snapshot is what names the live epoch, so it is published BEFORE the log
-// is reset. A crash mid-rollover therefore leaves stale-epoch rows behind the
-// new snapshot, which `loadJournal` drops — the reverse order would leave a
-// journal whose log no longer matches any epoch anyone can name.
+// One transaction: discard every row of the superseded epoch, insert the new
+// epoch row at sequence 1, move the session projection onto it, and retire any
+// repair marker the superseded epoch was carrying. Superseded rows are DELETED
+// rather than retained — nothing would ever shed them.
 
 import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionProviderHandle } from '../../../shared/agent-session-journal-types'
-import { compactJournal } from './journal-compaction'
-import { applyJournalRow, createJournalReducerState } from './journal-reducer'
-import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
-import { journalRowByteLength } from './journal-row-schema'
+import type Database from '../../sqlite/sync-database'
 import type { JournalLoad } from './journal-open'
-import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
+import { clearJournalRepairMarker } from './journal-repair-marker'
+import { applyJournalRow, createJournalReducerState } from './journal-reducer'
+import {
+  deleteAllJournalRows,
+  insertJournalRow,
+  upsertJournalSessionRow
+} from './journal-row-table'
+import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
 
-export async function publishNewEpoch(input: {
-  journalDir: string
+export function publishNewEpoch(input: {
+  db: Database.Database
   sessionId: string
   providerHandle: AgentSessionProviderHandle
   epoch: string
   reason: AgentJournalEpochReason
   fence: number
   now: number
-  maxSessionBytes?: number
-}): Promise<JournalLoad> {
+  /** Called the instant the transaction commits, before any fallible follow-up. */
+  onPublished: (loaded: JournalLoad) => void
+}): void {
   const row: JournalRow = {
     kind: 'epoch',
     reason: input.reason,
@@ -34,25 +39,24 @@ export async function publishNewEpoch(input: {
     fence: input.fence,
     ts: input.now
   }
+
+  input.db.exec('BEGIN IMMEDIATE')
+  try {
+    deleteAllJournalRows(input.db)
+    clearJournalRepairMarker(input.db, input.sessionId)
+    insertJournalRow(input.db, input.sessionId, row)
+    upsertJournalSessionRow(input.db, input.sessionId, input.epoch, input.now)
+    input.db.exec('COMMIT')
+  } catch (error) {
+    input.db.exec('ROLLBACK')
+    throw error
+  }
+
+  // COMMIT landed: on disk the superseded prefix is gone and this epoch is the
+  // live one. The caller adopts that immediately, or a later failure leaves the
+  // store writing into an epoch that no longer exists.
   const state = createJournalReducerState(input.sessionId, input.epoch)
-  await compactJournal({
-    journalDir: input.journalDir,
-    state,
-    tailRows: [row],
-    policy: { minTailRows: 1, retainTailMs: Number.POSITIVE_INFINITY },
-    now: input.now,
-    maxSessionBytes: input.maxSessionBytes ?? DEFAULT_JOURNAL_PAYLOAD_LIMITS.maxSessionBytes,
-    sessionId: input.sessionId
-  })
   applyJournalRow(state, row)
   state.oldestSequence = 1
-  return {
-    state,
-    tailRows: [row],
-    compactedThrough: 0,
-    readOnly: false,
-    corrupt: false,
-    malformedRows: 0,
-    sizeBytes: journalRowByteLength(row)
-  }
+  input.onPublished({ state, readOnly: false, corrupt: false, malformedRows: 0 })
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts b/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts
new file mode 100644
index 00000000000..592f7471c5c
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts
@@ -0,0 +1,161 @@
+// Every path that can open a SQLite connection releases it.
+//
+// Asserting that the happy path closes cleanly proves nothing: these sites are
+// reached only when something has already gone wrong. On POSIX a leak is
+// SILENT — the unlink succeeds — so each case asserts BOTH that the sidecars
+// are gone and that the directory renames and removes, which is the half that
+// actually fails on Windows.
+
+import { access, mkdtemp, rename, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import Database from '../../sqlite/sync-database'
+import { openJournalDatabase } from './journal-database'
+import { JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+import { loadJournal } from './journal-open'
+import { journalDatabaseFile } from './journal-paths'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: 'thread-1' }
+}
+
+let base: string
+let root: string
+const journals = createTrackedJournalOpener()
+
+function item(ordinal: number): AgentJournalItemIdentity {
+  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
+}
+
+function runningTool(): AgentJournalItemBody {
+  return { kind: 'tool-call', name: 'command', input: {}, state: 'running' }
+}
+
+async function exists(path: string): Promise<boolean> {
+  return access(path)
+    .then(() => true)
+    .catch(() => false)
+}
+
+/** The platform-independent proof: an open handle blocks both of these on
+ *  Windows, where every leak in this file actually shows up. */
+async function expectNothingHoldsTheDirectory(): Promise<void> {
+  const dbPath = journalDatabaseFile(root)
+  expect(await exists(`${dbPath}-wal`)).toBe(false)
+  expect(await exists(`${dbPath}-shm`)).toBe(false)
+  const moved = `${root}-recovered-vtest`
+  await rename(root, moved)
+  await rm(moved, { recursive: true })
+  root = join(base, `journal-${Math.random().toString(36).slice(2)}`)
+}
+
+beforeEach(async () => {
+  base = await mkdtemp(join(tmpdir(), 'orca-journal-handles-'))
+  root = join(base, 'journal')
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(base, { recursive: true, force: true })
+})
+
+describe('the standalone probe owns its own connection', () => {
+  it('leaves no handle behind after fifty repeated loads', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.appendItem(item(1), { kind: 'message', role: 'user', blocks: [] }, { fence: 1 })
+    await journal.close()
+
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+      const loaded = await loadJournal(root, IDENTITY.sessionId)
+      expect(loaded?.readOnly).toBe(false)
+    }
+    await expectNothingHoldsTheDirectory()
+  })
+
+  it('leaves no handle behind after fifty loads of a latched future schema', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.close()
+    const seeded = openJournalDatabase(journalDatabaseFile(root))
+    seeded.db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 3}`)
+    seeded.db.close()
+
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+      // The latched open closes the probe connection and returns the read-only
+      // reopen, so probing repeatedly leaves nothing on a file we must not touch.
+      expect((await loadJournal(root, IDENTITY.sessionId))?.readOnly).toBe(true)
+    }
+    // A read-only connection cannot remove the sidecars it materialized, so only
+    // the rename/remove half is expected to hold here.
+    const moved = `${root}-recovered-vtest`
+    await rename(root, moved)
+    await rm(moved, { recursive: true })
+    root = join(base, 'journal-after-latched')
+  })
+
+  it('returns null for a session with no journal, without creating one', async () => {
+    expect(await loadJournal(root, IDENTITY.sessionId)).toBeNull()
+    expect(await exists(journalDatabaseFile(root))).toBe(false)
+  })
+})
+
+describe('failure paths inside the open call', () => {
+  // Site 1: the raw connection is owned by `openJournalDatabase` until it returns.
+  it('closes the raw connection when the version read cannot run', async () => {
+    await journals.open({ identity: IDENTITY, journalDir: root }).then((journal) => journal.close())
+    await writeFile(journalDatabaseFile(root), 'this is not a database', 'utf8')
+
+    expect(() => openJournalDatabase(journalDatabaseFile(root))).toThrow()
+    await expectNothingHoldsTheDirectory()
+  })
+
+  it('closes the raw connection when the migration cannot start', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.close()
+    const blocker = openJournalDatabase(journalDatabaseFile(root))
+    // Roll the stored version back so the migration runs, then hold the write
+    // lock it needs: the throw lands after the connection already exists.
+    blocker.db.pragma('user_version = 0')
+    blocker.db.exec('BEGIN IMMEDIATE')
+    blocker.db.exec("INSERT INTO journal_sessions VALUES ('other', 'e', 1)")
+    try {
+      expect(() => openJournalDatabase(journalDatabaseFile(root))).toThrow()
+    } finally {
+      blocker.db.exec('ROLLBACK')
+      blocker.db.close()
+    }
+    await expectNothingHoldsTheDirectory()
+  }, 60_000)
+
+  // Sites 2 and 3: `open()` closes its own connection on any throw after the
+  // connection exists, which is what lets the factory need no `finally`.
+  it('leaves nothing open when a post-connection step of open() throws', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
+    await journal.appendItem(item(1), runningTool(), { fence: 1 })
+    await journal.close()
+
+    // Replay runs after the connection is open, so a read it cannot serve
+    // throws with the handle already held.
+    const exec = vi.spyOn(Database.prototype, 'prepare').mockImplementation(() => {
+      throw new Error('replay cannot read this journal')
+    })
+    try {
+      await expect(journals.open({ identity: IDENTITY, journalDir: root })).rejects.toThrow(
+        'replay cannot read this journal'
+      )
+    } finally {
+      exec.mockRestore()
+    }
+    await expectNothingHoldsTheDirectory()
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-item-appender.ts b/src/main/native-chat/agent-session-journal/journal-item-appender.ts
index 3ed2b58b230..1bbc3d4fab3 100644
--- a/src/main/native-chat/agent-session-journal/journal-item-appender.ts
+++ b/src/main/native-chat/agent-session-journal/journal-item-appender.ts
@@ -5,23 +5,16 @@ import type {
 } from '../../../shared/agent-session-journal-types'
 import { journalItemRowBuilder } from './journal-row-builders'
 import type { JournalReducerState } from './journal-reducer'
-import type { AgentSessionJournal } from './journal-store'
 import type { JournalAppendResult } from './journal-store-contracts'
 import type { JournalRow } from './journal-row-schema'
-import { appendToolOutputFallback } from './journal-tool-output-fallback'
 
 type ItemAppendOptions = { fence: number; observedAt?: number; recovered?: true }
-type JournalBlob = { digest: string; payload: string }
 
 export class JournalItemAppender {
   constructor(
     private readonly deps: {
-      journal: () => AgentSessionJournal
       state: () => JournalReducerState
-      enqueue: (
-        build: (seq: number, ts: number) => JournalRow,
-        blobs?: readonly JournalBlob[]
-      ) => Promise<JournalRow>
+      enqueue: (build: (seq: number, ts: number) => JournalRow) => Promise<JournalRow>
     }
   ) {}
 
@@ -33,37 +26,10 @@ export class JournalItemAppender {
     const itemId = agentJournalItemKey(identity)
     return this.deps
       .enqueue(journalItemRowBuilder(this.deps.state, identity, body, options))
-      .then((row) => itemAppendResult(row, itemId))
-  }
-
-  appendWithBlobs(
-    identity: AgentJournalItemIdentity,
-    body: AgentJournalItemBody,
-    blobs: readonly JournalBlob[],
-    options: ItemAppendOptions
-  ): Promise<JournalAppendResult> {
-    const itemId = agentJournalItemKey(identity)
-    return this.deps
-      .enqueue(journalItemRowBuilder(this.deps.state, identity, body, options), blobs)
-      .then((row) => itemAppendResult(row, itemId))
-      .catch((error: unknown) =>
-        appendToolOutputFallback({
-          journal: this.deps.journal(),
-          error,
-          identity,
-          body,
-          blobs,
-          itemId,
-          fence: options.fence
-        })
-      )
-  }
-}
-
-function itemAppendResult(row: JournalRow, itemId: string): JournalAppendResult {
-  return {
-    cursor: { epoch: row.epoch, sequence: row.seq },
-    itemId,
-    revision: (row as Extract<JournalRow, { kind: 'item' }>).revision
+      .then((row) => ({
+        cursor: { epoch: row.epoch, sequence: row.seq },
+        itemId,
+        revision: (row as Extract<JournalRow, { kind: 'item' }>).revision
+      }))
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts b/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts
index a5a3e2be852..ed86d81861e 100644
--- a/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts
@@ -2,19 +2,21 @@
 // results by identity read off the same raw lines. Fixtures are shaped like the
 // files the providers actually write.
 
-import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
-import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
-import { JOURNAL_BLOB_DIR, readJournalBlob } from './journal-blob-store'
+import type {
+  AgentSessionJournalIdentity,
+  AgentSessionProviderHandle
+} from '../../../shared/agent-session-journal-types'
 import { createLegacyIdentityTracker } from './journal-legacy-identity'
 import {
   appendLegacyTranscriptMessages,
   importLegacyTranscriptIntoJournal
 } from './journal-legacy-import'
-import { boundPayload, DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
+import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
 import { openAgentSessionJournal } from './journal-store-factory'
 import type { AgentSessionJournal } from './journal-store'
 
@@ -29,21 +31,29 @@ function tick(): number {
   return clock
 }
 
-function identity(agent: 'claude' | 'codex', sessionId: string): AgentSessionJournalIdentity {
+type ImportAgent = 'claude' | 'codex' | 'grok' | 'omp'
+
+function providerHandle(agent: ImportAgent, sessionId: string): AgentSessionProviderHandle {
+  if (agent === 'claude') {
+    return { kind: 'claude', sessionId, leafUuid: null }
+  }
+  return agent === 'codex'
+    ? { kind: 'codex', threadId: sessionId }
+    : { kind: 'opaque', agent, value: sessionId }
+}
+
+function identity(agent: ImportAgent, sessionId: string): AgentSessionJournalIdentity {
   return {
     sessionId,
     workspaceId: 'ws-1',
     hostId: 'host-1',
     agent,
-    providerHandle:
-      agent === 'claude'
-        ? { kind: 'claude', sessionId, leafUuid: null }
-        : { kind: 'codex', threadId: sessionId }
+    providerHandle: providerHandle(agent, sessionId)
   }
 }
 
 async function open(
-  agent: 'claude' | 'codex',
+  agent: ImportAgent,
   sessionId: string,
   overrides: Partial<Parameters<typeof openAgentSessionJournal>[0]> = {}
 ): Promise<AgentSessionJournal> {
@@ -387,7 +397,7 @@ describe('codex import', () => {
 })
 
 describe('payload bounds on import', () => {
-  it('marks a clipped tool result and parks the remainder in the blob store', async () => {
+  it('marks a clipped tool result and discards the remainder', async () => {
     const output = 'y'.repeat(64 * 1024)
     const filePath = await writeFixture('claude-big.jsonl', [
       {
@@ -421,167 +431,13 @@ describe('payload bounds on import', () => {
     expect(body.output.truncated).toBe(true)
     expect(body.output.byteLength).toBe(64 * 1024)
     expect(body.output.head).toHaveLength(1_024)
-    expect(await readJournalBlob(root, body.output.digest)).toBe(output)
-  })
-
-  it('deduplicates staged blobs while importing a replacement epoch', async () => {
-    const journalDir = join(root, 'dedupe-journal')
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 512,
-      maxSessionBytes: 512 * 1024
-    }
-    const output = 'd'.repeat(32 * 1024)
-    const bounded = boundPayload(output, limits)
-    const toolResultLine = (uuid: string) => ({
-      parentUuid: null,
-      isSidechain: false,
-      type: 'user',
-      message: {
-        role: 'user',
-        content: [{ type: 'tool_result', tool_use_id: `toolu_${uuid}`, content: output }]
-      },
-      uuid,
-      timestamp: '2026-08-05T10:00:09.000Z',
-      sessionId: CLAUDE_SESSION
-    })
-    const filePath = await writeFixture('claude-duplicate-blobs.jsonl', [
-      toolResultLine('aa11bb22-cc33-4d44-8e55-6f7788990011'),
-      toolResultLine('bb22cc33-dd44-4e55-8f66-778899001122')
-    ])
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
-
-    await importLegacyTranscriptIntoJournal({
-      journal,
-      agent: 'claude',
-      sessionId: CLAUDE_SESSION,
-      fence: 1,
-      options: { filePath, limits }
-    })
-
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBe(output)
-    expect(await readdir(join(journalDir, JOURNAL_BLOB_DIR))).toEqual([bounded.digest])
-    expect(
-      journal
-        .snapshot()
-        .items.map((item) => (item.body.kind === 'tool-call' ? item.body.output?.digest : null))
-    ).toEqual([bounded.digest, bounded.digest])
-  })
-
-  it('prunes root-level blobs made stale by a later legacy import', async () => {
-    const journalDir = join(root, 'prune-journal')
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 512,
-      maxSessionBytes: 512 * 1024
-    }
-    const output = 's'.repeat(32 * 1024)
-    const bounded = boundPayload(output, limits)
-    const first = await writeFixture('claude-stale-blob.jsonl', [
-      {
-        parentUuid: null,
-        isSidechain: false,
-        type: 'user',
-        message: {
-          role: 'user',
-          content: [{ type: 'tool_result', tool_use_id: 'toolu_stale', content: output }]
-        },
-        uuid: 'aa11bb22-cc33-4d44-8e55-6f7788990011',
-        timestamp: '2026-08-05T10:00:09.000Z',
-        sessionId: CLAUDE_SESSION
-      }
-    ])
-    const second = await writeFixture('claude-without-blob.jsonl', [
-      {
-        parentUuid: null,
-        isSidechain: false,
-        type: 'assistant',
-        message: { role: 'assistant', content: [{ type: 'text', text: 'replacement' }] },
-        uuid: 'cc33dd44-ee55-4666-8777-889900112233',
-        timestamp: '2026-08-05T10:00:10.000Z',
-        sessionId: CLAUDE_SESSION
-      }
-    ])
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
-
-    await importLegacyTranscriptIntoJournal({
-      journal,
-      agent: 'claude',
-      sessionId: CLAUDE_SESSION,
-      fence: 1,
-      options: { filePath: first, limits }
-    })
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBe(output)
-
-    await importLegacyTranscriptIntoJournal({
-      journal,
-      agent: 'claude',
-      sessionId: CLAUDE_SESSION,
-      fence: 2,
-      options: { filePath: second, limits }
-    })
-
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBeNull()
-    expect(journal.snapshot().items[0]?.body).toMatchObject({
-      kind: 'message',
-      blocks: [{ type: 'text', text: 'replacement' }]
-    })
-  })
-
-  it('uses managed catch-up appends when a tool-result blob exceeds quota', async () => {
-    const journalDir = join(root, 'catchup-journal')
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 128,
-      maxSessionBytes: 8_000
-    }
-    const journal = await open('codex', CODEX_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
-    const output = 'z'.repeat(12_000)
-    const bounded = boundPayload(output, limits)
-
-    await expect(
-      appendLegacyTranscriptMessages({
-        journal,
-        agent: 'codex',
-        sessionId: CODEX_SESSION,
-        fence: 1,
-        messages: [
-          {
-            id: 'catchup-tool-output',
-            role: 'tool',
-            blocks: [{ type: 'tool-result', output }],
-            timestamp: 1_800_000_000_000,
-            source: 'transcript'
-          }
-        ]
-      })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBeNull()
-    expect(journal.snapshot().items).toEqual([])
   })
 })
 
 describe('import failures', () => {
   it('rejects a legacy source above the fixed 16 MiB import cap before decoding', async () => {
     const journalDir = join(root, 'oversized-source-journal')
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 256 * 1024 * 1024 },
-      autoCompact: false
-    })
+    const journal = await open('claude', CLAUDE_SESSION, { journalDir })
     const filePath = join(root, 'oversized-source.jsonl')
     await writeFile(filePath, 'x'.repeat(16 * 1024 * 1024 + 1), 'utf8')
     const epoch = journal.epoch
@@ -602,115 +458,10 @@ describe('import failures', () => {
     expect(journal.snapshot().items).toEqual([])
   })
 
-  it('keeps the live epoch intact when a staged rebuild runs out of budget', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 2_000 }
-    const journal = await open('codex', CODEX_SESSION, { limits })
-    await appendLegacyTranscriptMessages({
-      journal,
-      agent: 'codex',
-      sessionId: CODEX_SESSION,
-      fence: 1,
-      messages: [
-        {
-          id: 'durable-prefix',
-          role: 'assistant',
-          blocks: [{ type: 'text', text: 'keep me' }],
-          timestamp: 1_800_000_000_000,
-          source: 'transcript'
-        }
-      ]
-    })
-    const filePath = await writeFixture('oversized-rollout.jsonl', [
-      CODEX_LINES[0],
-      CODEX_LINES[1],
-      CODEX_LINES[2],
-      {
-        type: 'event_msg',
-        timestamp: '2026-08-05T10:00:03.000Z',
-        payload: { type: 'agent_message', message: 'x'.repeat(2_000) }
-      }
-    ])
-    const epoch = journal.epoch
-    const snapshotPath = join(root, 'snapshot.json')
-    const logPath = join(root, 'log.jsonl')
-    const before = {
-      snapshot: await readFile(snapshotPath, 'utf-8'),
-      log: await readFile(logPath, 'utf-8')
-    }
-
-    await expect(
-      importLegacyTranscriptIntoJournal({
-        journal,
-        agent: 'codex',
-        sessionId: CODEX_SESSION,
-        fence: 1,
-        options: { filePath, limits }
-      })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-    expect(journal.epoch).toBe(epoch)
-    expect(await readFile(snapshotPath, 'utf-8')).toBe(before.snapshot)
-    expect(await readFile(logPath, 'utf-8')).toBe(before.log)
-    expect(journal.snapshot().items[0]?.body).toMatchObject({
-      kind: 'message',
-      blocks: [{ type: 'text', text: 'keep me' }]
-    })
-  })
-
-  it('cleans staged replacement blobs when legacy import exceeds physical quota', async () => {
-    const journalDir = join(root, 'replacement-journal')
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 128,
-      maxSessionBytes: 8_000
-    }
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
-    const output = 'q'.repeat(12_000)
-    const bounded = boundPayload(output, limits)
-    const filePath = await writeFixture('oversized-tool-result.jsonl', [
-      {
-        parentUuid: null,
-        isSidechain: false,
-        type: 'user',
-        message: {
-          role: 'user',
-          content: [{ type: 'tool_result', tool_use_id: 'toolu_oversized', content: output }]
-        },
-        uuid: 'ba11ad00-1111-4222-8333-444455556666',
-        timestamp: '2026-08-05T10:00:09.000Z',
-        sessionId: CLAUDE_SESSION
-      }
-    ])
-    const epoch = journal.epoch
-
-    await expect(
-      importLegacyTranscriptIntoJournal({
-        journal,
-        agent: 'claude',
-        sessionId: CLAUDE_SESSION,
-        fence: 1,
-        options: { filePath, limits }
-      })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(journal.epoch).toBe(epoch)
-    expect(await readJournalBlob(journalDir, bounded.digest)).toBeNull()
-    expect((await readdir(journalDir)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(
-      false
-    )
-  })
-
   it('bounds oversized legacy tool-call input before journal publication', async () => {
     const journalDir = join(root, 'bounded-tool-input-journal')
     const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 64 }
-    const journal = await open('claude', CLAUDE_SESSION, {
-      journalDir,
-      limits,
-      autoCompact: false
-    })
+    const journal = await open('claude', CLAUDE_SESSION, { journalDir })
     const filePath = await writeFixture('oversized-tool-input.jsonl', [
       {
         parentUuid: null,
@@ -768,6 +519,39 @@ describe('import failures', () => {
     expect(journal.epoch).toBe(before)
   })
 
+  // A transcript with no decodable messages recovers nothing. Publishing an
+  // empty replacement would roll the epoch and drop whatever the journal held —
+  // including a repair's own anchor and disclosure.
+  it('leaves the epoch untouched when the transcript decodes to no messages', async () => {
+    const journal = await open('codex', CODEX_SESSION)
+    await journal.appendItem(
+      { provider: 'codex', threadId: CODEX_SESSION, turnId: 'turn-1', ordinal: 1 },
+      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'kept' }] },
+      { fence: 1 }
+    )
+    const before = journal.epoch
+    const metadataOnly = await writeFixture('metadata-only.jsonl', [
+      {
+        type: 'session_meta',
+        timestamp: '2026-08-05T10:00:00.000Z',
+        payload: { id: CODEX_SESSION, session_id: CODEX_SESSION, cwd: '/Users/dev/project' }
+      }
+    ])
+
+    const result = await importLegacyTranscriptIntoJournal({
+      journal,
+      agent: 'codex',
+      sessionId: CODEX_SESSION,
+      fence: 1,
+      options: { filePath: metadataOnly }
+    })
+
+    expect(result).toMatchObject({ ok: true, imported: 0, replaced: false })
+    expect(journal.epoch).toBe(before)
+    expect(journal.snapshot().items).toHaveLength(1)
+    await journal.close()
+  })
+
   it('rejects an agent with no transcript decoder', async () => {
     const journal = await open('claude', CLAUDE_SESSION)
     const result = await importLegacyTranscriptIntoJournal({
@@ -780,3 +564,132 @@ describe('import failures', () => {
     expect(result).toMatchObject({ ok: false })
   })
 })
+
+// A tool call is only the SOLE block of its message when the provider wrote it
+// that way. Claude interleaves it with narration, Grok hangs `tool_calls` off a
+// row that also has text, and omp's execution cells always pair the invocation
+// with its output — so the multi-block path carries untrusted tool input too.
+describe('multi-block legacy messages', () => {
+  const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, inlineHeadBytes: 64 }
+  const oversized = 'x'.repeat(10_000)
+
+  /** The tool-call block of the first imported multi-block message. */
+  function importedToolCallBlock(journal: AgentSessionJournal): unknown {
+    for (const entry of journal.snapshot().items) {
+      if (entry.body.kind !== 'message') {
+        continue
+      }
+      const block = entry.body.blocks.find((candidate) => candidate.type === 'tool-call')
+      if (block) {
+        return block.input
+      }
+    }
+    return null
+  }
+
+  it('bounds a Claude tool call that shares its message with narration', async () => {
+    const journal = await open('claude', CLAUDE_SESSION, {
+      journalDir: join(root, 'claude-mixed-journal')
+    })
+    const filePath = await writeFixture('claude-mixed.jsonl', [
+      {
+        parentUuid: null,
+        isSidechain: false,
+        type: 'assistant',
+        message: {
+          role: 'assistant',
+          content: [
+            { type: 'text', text: 'Editing the file.' },
+            {
+              type: 'tool_use',
+              id: 'toolu_mixed',
+              name: 'Edit',
+              input: { file_path: 'a.ts', patch: oversized }
+            }
+          ]
+        },
+        uuid: 'dd22be00-1111-4222-8333-444455556666',
+        timestamp: '2026-08-05T10:00:09.000Z',
+        sessionId: CLAUDE_SESSION
+      }
+    ])
+
+    const result = await importLegacyTranscriptIntoJournal({
+      journal,
+      agent: 'claude',
+      sessionId: CLAUDE_SESSION,
+      fence: 1,
+      options: { filePath, limits }
+    })
+
+    expect(result.ok).toBe(true)
+    expect(importedToolCallBlock(journal)).toMatchObject({
+      truncated: true,
+      byteLength: expect.any(Number),
+      digest: expect.stringMatching(/^[0-9a-f]{64}$/),
+      head: expect.any(String)
+    })
+    expect(JSON.stringify(journal.snapshot().items)).not.toContain('x'.repeat(1_000))
+    await journal.close()
+  })
+
+  it('bounds a Grok tool call that shares its row with assistant text', async () => {
+    const journal = await open('grok', CODEX_SESSION, {
+      journalDir: join(root, 'grok-mixed-journal')
+    })
+    const filePath = await writeFixture('grok-mixed.jsonl', [
+      {
+        type: 'assistant',
+        id: 'asst-mixed',
+        timestamp: '2026-08-05T10:00:09.000Z',
+        content: [{ type: 'text', text: 'Searching.' }],
+        tool_calls: [{ id: 'c1', name: 'grep', arguments: JSON.stringify({ pattern: oversized }) }]
+      }
+    ])
+
+    const result = await importLegacyTranscriptIntoJournal({
+      journal,
+      agent: 'grok',
+      sessionId: CODEX_SESSION,
+      fence: 1,
+      options: { filePath, limits }
+    })
+
+    expect(result.ok).toBe(true)
+    expect(importedToolCallBlock(journal)).toMatchObject({ truncated: true })
+    expect(JSON.stringify(journal.snapshot().items)).not.toContain('x'.repeat(1_000))
+    await journal.close()
+  })
+
+  it('bounds an omp execution cell, whose invocation always ships with its output', async () => {
+    const journal = await open('omp', CODEX_SESSION, {
+      journalDir: join(root, 'omp-mixed-journal')
+    })
+    const filePath = await writeFixture('omp-mixed.jsonl', [
+      {
+        type: 'message',
+        id: 'omp-mixed-1',
+        timestamp: '2026-08-05T10:00:09.000Z',
+        message: {
+          role: 'bashExecution',
+          command: `echo ${oversized}`,
+          output: 'done',
+          exitCode: 0
+        }
+      }
+    ])
+
+    const result = await importLegacyTranscriptIntoJournal({
+      journal,
+      agent: 'omp',
+      sessionId: CODEX_SESSION,
+      fence: 1,
+      options: { filePath, limits }
+    })
+
+    expect(result.ok).toBe(true)
+    expect(importedToolCallBlock(journal)).toMatchObject({ truncated: true })
+    expect(JSON.stringify(journal.snapshot().items)).not.toContain('x'.repeat(1_000))
+    await journal.close()
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-legacy-import.ts b/src/main/native-chat/agent-session-journal/journal-legacy-import.ts
index 126196af38e..6a2ff099dbc 100644
--- a/src/main/native-chat/agent-session-journal/journal-legacy-import.ts
+++ b/src/main/native-chat/agent-session-journal/journal-legacy-import.ts
@@ -49,7 +49,14 @@ export type LegacyImportOptions = ResolveSessionFileOptions & {
 const MAX_LEGACY_IMPORT_SOURCE_BYTES = 16 * 1024 * 1024
 
 export type LegacyImportResult =
-  | { ok: true; epoch: string; cursor: AgentJournalCursor; imported: number }
+  | {
+      ok: true
+      epoch: string
+      cursor: AgentJournalCursor
+      imported: number
+      /** False when the transcript held no messages and the epoch was left as it stood. */
+      replaced: boolean
+    }
   | { ok: false; error: string }
 
 export async function appendLegacyTranscriptMessages(input: {
@@ -61,16 +68,14 @@ export async function appendLegacyTranscriptMessages(input: {
 }): Promise<number> {
   let appended = 0
   for (const message of input.messages) {
-    const mapped = legacyItemBody(message, DEFAULT_JOURNAL_PAYLOAD_LIMITS)
-    await input.journal.appendItemWithBlobs(
+    await input.journal.appendItem(
       {
         provider: 'legacy',
         agent: input.agent,
         sessionId: input.sessionId,
         recordId: message.id
       },
-      mapped.body,
-      mapped.blobs,
+      legacyItemBody(message, DEFAULT_JOURNAL_PAYLOAD_LIMITS),
       { fence: input.fence, observedAt: message.timestamp ?? undefined }
     )
     appended += 1
@@ -134,16 +139,28 @@ export async function importLegacyTranscriptIntoJournal(input: {
     if (!identity) {
       continue
     }
-    const mapped = legacyItemBody(message, limits)
     replacement.push({
       identity,
-      body: mapped.body,
-      blobs: mapped.blobs,
+      body: legacyItemBody(message, limits),
       observedAt: message.timestamp ?? undefined
     })
   }
+  // A transcript that decodes to nothing reconstructs nothing, and an empty
+  // replacement is not a harmless no-op: it would delete the repair's anchor and
+  // its disclosure, leaving nothing to ask for the history again. The epoch
+  // stands so a later read can still rebuild it.
+  if (replacement.length === 0) {
+    const current = input.journal.cursor()
+    return { ok: true, epoch: current.epoch, cursor: current, imported: 0, replaced: false }
+  }
   const cursor = await input.journal.replaceEpochItems('legacy_import', input.fence, replacement)
-  return { ok: true, epoch: cursor.epoch, cursor, imported: decoded.messages.length }
+  return {
+    ok: true,
+    epoch: cursor.epoch,
+    cursor,
+    imported: decoded.messages.length,
+    replaced: true
+  }
 }
 
 const TRANSCRIPT_DECODERS = {
@@ -199,11 +216,6 @@ async function decodeWithIdentities(input: {
   return { messages, identities }
 }
 
-type MappedLegacyItem = {
-  body: AgentJournalItemBody
-  blobs: { digest: string; payload: string }[]
-}
-
 /**
  * A message whose only content is a tool invocation becomes a tool-call item so
  * the reducer renders it as one. Everything else stays a message item with its
@@ -212,49 +224,40 @@ type MappedLegacyItem = {
 function legacyItemBody(
   message: NativeChatMessage,
   limits: JournalPayloadLimits
-): MappedLegacyItem {
+): AgentJournalItemBody {
   const only = message.blocks.length === 1 ? message.blocks[0] : undefined
   if (only?.type === 'tool-call') {
+    // Legacy transcripts are untrusted and can contain arbitrarily large tool
+    // arguments. Keep them on the same bounded path as live events before the
+    // replacement epoch is published.
     return {
-      // Legacy transcripts are untrusted and can contain arbitrarily large
-      // tool arguments. Keep them on the same bounded path as live events
-      // before the replacement epoch is staged or published.
-      body: {
-        kind: 'tool-call',
-        name: only.name,
-        input: boundToolInput(only.input, limits),
-        state: 'completed'
-      },
-      blobs: []
+      kind: 'tool-call',
+      name: only.name,
+      input: boundToolInput(only.input, limits),
+      state: 'completed'
     }
   }
   if (only?.type === 'tool-result') {
-    const output = boundPayload(only.output, limits)
     return {
-      body: {
-        kind: 'tool-call',
-        name: 'tool-result',
-        input: null,
-        state: only.isError ? 'failed' : 'completed',
-        output
-      },
-      blobs: output.truncated ? [{ digest: output.digest, payload: only.output }] : []
+      kind: 'tool-call',
+      name: 'tool-result',
+      input: null,
+      state: only.isError ? 'failed' : 'completed',
+      output: boundPayload(only.output, limits)
     }
   }
   return {
-    body: {
-      kind: 'message',
-      role: message.role,
-      blocks: message.blocks.map((block) => boundBlock(block, limits))
-    },
-    blobs: []
+    kind: 'message',
+    role: message.role,
+    blocks: message.blocks.map((block) => boundBlock(block, limits))
   }
 }
 
-/** Inline block text keeps only a bounded head plus an explicit marker. No blob
- *  is written: the marker carries the digest and byte length, and the source
- *  transcript remains the full copy — a blob here would be unreferenced by the
- *  render model and pruned at the next compaction. */
+/** Every block that can carry untrusted bulk is bounded here, tool calls
+ *  included: a provider decoder is free to put one alongside narration, and the
+ *  sole-block path above never sees those. The remainder is discarded rather
+ *  than stored elsewhere — the marker keeps its digest and byte length, and the
+ *  source transcript remains the full copy. */
 function boundBlock(block: NativeChatBlock, limits: JournalPayloadLimits): NativeChatBlock {
   if (block.type === 'text') {
     return { ...block, text: boundInlineText(block.text, limits).text }
@@ -262,5 +265,8 @@ function boundBlock(block: NativeChatBlock, limits: JournalPayloadLimits): Nativ
   if (block.type === 'tool-result') {
     return { ...block, output: boundInlineText(block.output, limits).text }
   }
+  if (block.type === 'tool-call') {
+    return { ...block, input: boundToolInput(block.input, limits) }
+  }
   return block
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-lifecycle-admission.ts b/src/main/native-chat/agent-session-journal/journal-lifecycle-admission.ts
deleted file mode 100644
index 063e807038e..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-lifecycle-admission.ts
+++ /dev/null
@@ -1,160 +0,0 @@
-import type {
-  AgentJournalItemBody,
-  AgentJournalSnapshot
-} from '../../../shared/agent-session-journal-types'
-import {
-  dispatchReservationId,
-  JournalLifecycleCapacity,
-  lifecycleReservationIdForItem,
-  requiresTerminalSettlement,
-  terminalReservationBytes,
-  type JournalLifecycleReservation
-} from './journal-lifecycle-capacity'
-import type { JournalRow } from './journal-row-schema'
-import { journalRowByteLength } from './journal-row-schema'
-import { AgentSessionJournalError } from './journal-write-guards'
-
-export type JournalLifecycleRowAdmission = {
-  releaseAfter: string[]
-  protectedBytes: number
-  lifecycleCovered: boolean
-  proposedCapacity: JournalLifecycleCapacity
-}
-
-export class JournalLifecycleAdmission {
-  private readonly capacity = new JournalLifecycleCapacity()
-
-  constructor(
-    private readonly sessionId: string,
-    private readonly maxBytes: number,
-    private readonly canonicalItemId: (itemId: string) => string,
-    private readonly maxAppendSlots = Number.MAX_SAFE_INTEGER
-  ) {}
-
-  get state(): { reservedBytes: number; reservedAppendSlots: number } {
-    return {
-      reservedBytes: this.capacity.reservedBytes,
-      reservedAppendSlots: this.capacity.reservedAppendSlots
-    }
-  }
-
-  rebuild(snapshot: AgentJournalSnapshot, currentPhysicalBytes: number): void {
-    if (
-      !this.capacity.rebuild(snapshot, this.maxBytes, currentPhysicalBytes, this.maxAppendSlots)
-    ) {
-      throw this.capacityError('cannot rebuild lifecycle capacity')
-    }
-  }
-
-  reserve(token: JournalLifecycleReservation, currentPhysicalBytes: number): boolean {
-    return this.capacity.reserve(token, currentPhysicalBytes, this.maxBytes, this.maxAppendSlots)
-  }
-
-  transfer(fromId: string, toId: string): boolean {
-    return this.capacity.transfer(fromId, toId)
-  }
-
-  release(id: string): void {
-    this.capacity.release(id)
-  }
-
-  prepare(row: JournalRow, currentPhysicalBytes: number): JournalLifecycleRowAdmission {
-    const proposedCapacity = this.capacity.clone()
-    this.ensureActionable(row, currentPhysicalBytes, proposedCapacity)
-    const releaseAfter = this.reservationsSettledBy(row, proposedCapacity)
-    const releasedBytes = releaseAfter.reduce(
-      (total, id) => total + (proposedCapacity.token(id)?.bytes ?? 0),
-      0
-    )
-    return {
-      releaseAfter,
-      protectedBytes: proposedCapacity.reservedBytes - releasedBytes,
-      lifecycleCovered: proposedCapacity.covers(releaseAfter, journalRowByteLength(row), 1),
-      proposedCapacity
-    }
-  }
-
-  commit(admission: JournalLifecycleRowAdmission): void {
-    this.capacity.replaceFrom(admission.proposedCapacity)
-    for (const id of admission.releaseAfter) {
-      this.capacity.release(id)
-    }
-  }
-
-  private ensureActionable(
-    row: JournalRow,
-    currentPhysicalBytes: number,
-    capacity: JournalLifecycleCapacity
-  ): void {
-    if (row.kind === 'item') {
-      this.ensureActionableItem(row.itemId, row.body, currentPhysicalBytes, capacity)
-      return
-    }
-    if (row.kind !== 'lifecycle-batch') {
-      return
-    }
-    for (const mutation of row.mutations) {
-      if (mutation.kind === 'item') {
-        this.ensureActionableItem(mutation.itemId, mutation.body, currentPhysicalBytes, capacity)
-      }
-    }
-  }
-
-  private ensureActionableItem(
-    itemId: string,
-    body: AgentJournalItemBody,
-    currentPhysicalBytes: number,
-    capacity: JournalLifecycleCapacity
-  ): void {
-    if (!requiresTerminalSettlement(body)) {
-      return
-    }
-    const id = lifecycleReservationIdForItem(this.canonicalItemId(itemId))
-    if (body.kind === 'status' && body.turnLifecycle?.state === 'running' && !capacity.has(id)) {
-      capacity.claimFirst('tentative-turn:', id)
-    }
-    if (
-      !capacity.reserve(
-        { id, bytes: terminalReservationBytes(body), appendSlots: 1 },
-        currentPhysicalBytes,
-        this.maxBytes,
-        this.maxAppendSlots
-      )
-    ) {
-      throw this.capacityError('cannot reserve terminal capacity')
-    }
-  }
-
-  private reservationsSettledBy(row: JournalRow, capacity: JournalLifecycleCapacity): string[] {
-    if (row.kind === 'dispatch') {
-      const id = dispatchReservationId(row.clientMessageId)
-      return capacity.has(id) ? [id] : []
-    }
-    const itemIds =
-      row.kind === 'item'
-        ? requiresTerminalSettlement(row.body)
-          ? []
-          : [row.itemId]
-        : row.kind === 'tombstone'
-          ? [row.itemId]
-          : row.kind === 'lifecycle-batch'
-            ? row.mutations.flatMap((mutation) =>
-                mutation.kind === 'item' && requiresTerminalSettlement(mutation.body)
-                  ? []
-                  : [mutation.itemId]
-              )
-            : []
-    return [
-      ...new Set(
-        itemIds.map((itemId) => lifecycleReservationIdForItem(this.canonicalItemId(itemId)))
-      )
-    ].filter((id) => capacity.has(id))
-  }
-
-  private capacityError(detail: string): AgentSessionJournalError {
-    return new AgentSessionJournalError(
-      'journal_bound_exceeded',
-      `agent-session journal for ${this.sessionId} ${detail}`
-    )
-  }
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.test.ts b/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.test.ts
deleted file mode 100644
index 331bc63c9dc..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.test.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import type { AgentJournalSnapshot } from '../../../shared/agent-session-journal-types'
-import { JournalLifecycleCapacity } from './journal-lifecycle-capacity'
-
-describe('JournalLifecycleCapacity', () => {
-  it('enforces append-slot limits for both rebuilt submission reservations', () => {
-    const snapshot: AgentJournalSnapshot = {
-      sessionId: 'session-1',
-      cursor: { epoch: 'epoch-1', sequence: 1 },
-      items: [],
-      submissions: [
-        {
-          clientMessageId: 'message-1',
-          fence: 0,
-          payloadFingerprint: 'fingerprint',
-          dispatchState: 'pending',
-          providerItemId: null,
-          reason: null,
-          submittedAt: 1,
-          resolvedAt: null
-        }
-      ]
-    }
-
-    const capacity = new JournalLifecycleCapacity()
-
-    expect(capacity.rebuild(snapshot, Number.MAX_SAFE_INTEGER, 0, 1)).toBe(false)
-    expect(capacity.reservedAppendSlots).toBe(1)
-  })
-})
diff --git a/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.ts b/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.ts
deleted file mode 100644
index 0c99070b1e4..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-lifecycle-capacity.ts
+++ /dev/null
@@ -1,193 +0,0 @@
-import type {
-  AgentJournalItemBody,
-  AgentJournalSnapshot
-} from '../../../shared/agent-session-journal-types'
-
-export type JournalLifecycleReservation = {
-  id: string
-  bytes: number
-  appendSlots: number
-}
-
-export const JOURNAL_TURN_TERMINAL_RESERVATION_BYTES = 128 * 1024
-export const JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES = 64 * 1024
-export const JOURNAL_DISPATCH_RESERVATION_BYTES = 32 * 1024
-
-export class JournalLifecycleCapacity {
-  private readonly reservations = new Map<string, JournalLifecycleReservation>()
-
-  get reservedBytes(): number {
-    return [...this.reservations.values()].reduce((total, token) => total + token.bytes, 0)
-  }
-
-  get reservedAppendSlots(): number {
-    return [...this.reservations.values()].reduce((total, token) => total + token.appendSlots, 0)
-  }
-
-  has(id: string): boolean {
-    return this.reservations.has(id)
-  }
-
-  token(id: string): JournalLifecycleReservation | null {
-    return this.reservations.get(id) ?? null
-  }
-
-  clone(): JournalLifecycleCapacity {
-    const copy = new JournalLifecycleCapacity()
-    for (const token of this.reservations.values()) {
-      copy.reservations.set(token.id, { ...token })
-    }
-    return copy
-  }
-
-  replaceFrom(source: JournalLifecycleCapacity): void {
-    this.reservations.clear()
-    for (const token of source.reservations.values()) {
-      this.reservations.set(token.id, { ...token })
-    }
-  }
-
-  reserve(
-    token: JournalLifecycleReservation,
-    currentPhysicalBytes: number,
-    maxBytes: number,
-    maxAppendSlots = Number.MAX_SAFE_INTEGER
-  ): boolean {
-    if (this.reservations.has(token.id)) {
-      return true
-    }
-    if (currentPhysicalBytes + this.reservedBytes + token.bytes > maxBytes) {
-      return false
-    }
-    if (this.reservedAppendSlots + token.appendSlots > maxAppendSlots) {
-      return false
-    }
-    this.reservations.set(token.id, token)
-    return true
-  }
-
-  transfer(fromId: string, toId: string): boolean {
-    const existing = this.reservations.get(fromId)
-    if (!existing) {
-      return false
-    }
-    this.reservations.delete(fromId)
-    this.reservations.set(toId, { ...existing, id: toId })
-    return true
-  }
-
-  claimFirst(prefix: string, toId: string): boolean {
-    const fromId = [...this.reservations.keys()].find((id) => id.startsWith(prefix))
-    return fromId ? this.transfer(fromId, toId) : false
-  }
-
-  release(id: string): void {
-    this.reservations.delete(id)
-  }
-
-  covers(ids: readonly string[], bytes: number, appendSlots: number): boolean {
-    const tokens = ids.flatMap((id) => {
-      const token = this.reservations.get(id)
-      return token ? [token] : []
-    })
-    return (
-      tokens.length > 0 &&
-      tokens.reduce((total, token) => total + token.bytes, 0) >= bytes &&
-      tokens.reduce((total, token) => total + token.appendSlots, 0) >= appendSlots
-    )
-  }
-
-  rebuild(
-    snapshot: AgentJournalSnapshot,
-    maxBytes: number,
-    currentPhysicalBytes: number,
-    maxAppendSlots = Number.MAX_SAFE_INTEGER
-  ): boolean {
-    this.reservations.clear()
-    for (const item of snapshot.items) {
-      if (!requiresTerminalSettlement(item.body)) {
-        continue
-      }
-      if (
-        !this.reserve(
-          {
-            id: lifecycleReservationIdForItem(item.itemId),
-            bytes: terminalReservationBytes(item.body),
-            appendSlots: 1
-          },
-          currentPhysicalBytes,
-          maxBytes,
-          maxAppendSlots
-        )
-      ) {
-        return false
-      }
-    }
-    for (const submission of snapshot.submissions) {
-      if (submission.dispatchState !== 'pending' && submission.dispatchState !== 'unknown') {
-        continue
-      }
-      // A write-ahead submission owns both its dispatch attempt and the
-      // terminal turn settlement. Rebuild both reservations after restart;
-      // restoring only the tentative turn token would let a new send consume
-      // the dispatch headroom still owed to this unresolved submission.
-      if (
-        !this.reserve(
-          {
-            id: dispatchReservationId(submission.clientMessageId),
-            bytes: JOURNAL_DISPATCH_RESERVATION_BYTES,
-            appendSlots: 1
-          },
-          currentPhysicalBytes,
-          maxBytes,
-          maxAppendSlots
-        )
-      ) {
-        return false
-      }
-      if (
-        !this.reserve(
-          {
-            id: tentativeTurnReservationId(submission.clientMessageId),
-            bytes: JOURNAL_TURN_TERMINAL_RESERVATION_BYTES,
-            appendSlots: 1
-          },
-          currentPhysicalBytes,
-          maxBytes,
-          maxAppendSlots
-        )
-      ) {
-        return false
-      }
-    }
-    return true
-  }
-}
-
-export function lifecycleReservationIdForItem(itemId: string): string {
-  return `item:${itemId}`
-}
-
-export function dispatchReservationId(clientMessageId: string): string {
-  return `dispatch:${clientMessageId}`
-}
-
-export function tentativeTurnReservationId(clientMessageId: string): string {
-  return `tentative-turn:${clientMessageId}`
-}
-
-export function requiresTerminalSettlement(body: AgentJournalItemBody): boolean {
-  if (body.kind === 'tool-call') {
-    return body.state === 'running'
-  }
-  if (body.kind === 'approval' || body.kind === 'question') {
-    return body.resolution.state === 'pending'
-  }
-  return body.kind === 'status' && body.turnLifecycle?.state === 'running'
-}
-
-export function terminalReservationBytes(body: AgentJournalItemBody): number {
-  return body.kind === 'status' && body.turnLifecycle?.state === 'running'
-    ? JOURNAL_TURN_TERMINAL_RESERVATION_BYTES
-    : JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-log-file.test.ts b/src/main/native-chat/agent-session-journal/journal-log-file.test.ts
deleted file mode 100644
index 98c0b5029d3..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-log-file.test.ts
+++ /dev/null
@@ -1,374 +0,0 @@
-import { mkdtemp, readdir, rm, writeFile } from 'node:fs/promises'
-import type * as FsPromises from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { appendJournalRows, JOURNAL_SNAPSHOT_FILE, readJournalSnapshot } from './journal-log-file'
-import type { JournalSnapshotFile } from './journal-log-file'
-import type { JournalRow } from './journal-row-schema'
-import { openAgentSessionJournal } from './journal-store-factory'
-import {
-  projectStructuredAgentSessionStatus,
-  projectStructuredItemsToNativeChat
-} from '../../../shared/structured-agent-session-projection'
-
-type FakeDirectoryHandle = { sync: ReturnType<typeof vi.fn>; close: ReturnType<typeof vi.fn> }
-
-let openDirectoryHook: ((path: unknown, flags: unknown) => FakeDirectoryHandle | undefined) | null =
-  null
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const actual = await importOriginal<typeof FsPromises>()
-  return {
-    ...actual,
-    open: (async (...args: Parameters<typeof actual.open>) => {
-      const fake = openDirectoryHook?.(args[0], args[1])
-      return fake ?? actual.open(...args)
-    }) as typeof actual.open
-  }
-})
-
-let root: string
-
-beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-journal-log-file-'))
-  openDirectoryHook = null
-})
-
-afterEach(async () => {
-  openDirectoryHook = null
-  await rm(root, { recursive: true, force: true })
-})
-
-function validSnapshot(): JournalSnapshotFile {
-  return {
-    v: 1,
-    epoch: 'epoch-A',
-    compactedThrough: 2,
-    highestFence: 1,
-    items: [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'hi' }] },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ],
-    submissions: [],
-    receipts: [],
-    aliases: [],
-    tombstones: [{ itemId: 'codex:thread-1:turn-1:2', revision: 3 }],
-    tail: []
-  }
-}
-
-async function writeSnapshot(snapshot: unknown): Promise<void> {
-  await writeFile(join(root, JOURNAL_SNAPSHOT_FILE), JSON.stringify(snapshot), 'utf-8')
-}
-
-describe('readJournalSnapshot validation', () => {
-  it('accepts a well-formed snapshot, with and without the tombstones collection', async () => {
-    await writeSnapshot(validSnapshot())
-    expect((await readJournalSnapshot(root)).status).toBe('valid')
-
-    const { tombstones: _tombstones, ...withoutTombstones } = validSnapshot()
-    await writeSnapshot(withoutTombstones)
-    expect((await readJournalSnapshot(root)).status).toBe('valid')
-  })
-
-  it('accepts every canonical item kind and a fully-formed submission', async () => {
-    const snapshot = validSnapshot()
-    const payload = { head: 'x', byteLength: 4, digest: 'd'.repeat(64), truncated: true }
-    snapshot.items = [
-      { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] },
-      {
-        kind: 'tool-call',
-        name: 'Read',
-        input: { path: 'a' },
-        state: 'completed',
-        output: payload
-      },
-      { kind: 'diff', path: 'a.ts', patch: payload },
-      {
-        kind: 'approval',
-        title: 'Run?',
-        detail: null,
-        options: [{ id: 'a', label: 'Yes' }],
-        resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
-      },
-      {
-        kind: 'question',
-        question: 'Deploy?',
-        options: [{ id: 'a', label: 'Yes' }],
-        freeTextQuestionId: 'q-free',
-        resolution: { state: 'resolved', selectedOptionId: 'a', resolvedBy: 'c', resolvedAt: 5 }
-      },
-      {
-        kind: 'status',
-        text: 'working',
-        turnLifecycle: { turnId: 'turn-1', state: 'running' },
-        providerFrame: { provider: 'codex', kind: 'raw', payload }
-      }
-    ].map((body, index) => ({
-      itemId: `codex:thread-1:turn-1:${index + 1}`,
-      revision: 1,
-      body: body as JournalSnapshotFile['items'][number]['body'],
-      sequence: index + 1,
-      observedAt: 1_000,
-      ...(index === 0 ? { recovered: true as const } : {})
-    }))
-    snapshot.compactedThrough = snapshot.items.length
-    snapshot.submissions = [
-      {
-        clientMessageId: 'm-1',
-        fence: 1,
-        payloadFingerprint: 'a'.repeat(64),
-        dispatchState: 'accepted',
-        providerItemId: 'codex:thread-1:turn-1:1',
-        reason: null,
-        submittedAt: 1_000,
-        resolvedAt: 1_001
-      }
-    ]
-    await writeSnapshot(snapshot)
-    expect((await readJournalSnapshot(root)).status).toBe('valid')
-  })
-
-  it('classifies a JSON-valid non-array tombstones collection as invalid instead of valid', async () => {
-    await writeSnapshot({ ...validSnapshot(), tombstones: {} })
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-
-  it('rejects tombstone entries that would poison seeding', async () => {
-    for (const tombstones of [
-      [{ itemId: 42, revision: 1 }],
-      [{ itemId: 'codex:thread-1:turn-1:1', revision: 'one' }],
-      [{ itemId: 'codex:thread-1:turn-1:1', revision: Number.NaN }],
-      ['codex:thread-1:turn-1:1']
-    ]) {
-      await writeSnapshot({ ...validSnapshot(), tombstones })
-      expect((await readJournalSnapshot(root)).status).toBe('invalid')
-    }
-  })
-
-  it('rejects JSON-valid nested item corruption instead of admitting it', async () => {
-    // A resolved question with `options: null` used to pass shallow admission and
-    // then throw `TypeError` in the shared projection's `options.map`.
-    const poisonedQuestion = validSnapshot()
-    poisonedQuestion.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: {
-          kind: 'question',
-          question: 'Deploy?',
-          options: null,
-          resolution: { state: 'resolved', selectedOptionId: 'a', resolvedBy: 'c', resolvedAt: 1 }
-        },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ] as unknown as JournalSnapshotFile['items']
-    await writeSnapshot(poisonedQuestion)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-
-    // Pending-prompt surfaces read `resolution.state` before anything else.
-    const nullResolution = validSnapshot()
-    nullResolution.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'question', question: 'Deploy?', options: [], resolution: null },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ] as unknown as JournalSnapshotFile['items']
-    await writeSnapshot(nullResolution)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-
-  it('rejects a JSON-valid nested corruption in the retained tail', async () => {
-    const poisonedTail = validSnapshot()
-    poisonedTail.tail = [
-      {
-        v: 1,
-        epoch: 'epoch-A',
-        seq: 3,
-        fence: 1,
-        ts: 1_000,
-        kind: 'item',
-        itemId: 'codex:thread-1:turn-1:3',
-        revision: 1,
-        body: {
-          kind: 'question',
-          question: 'Deploy?',
-          options: null,
-          resolution: { state: 'resolved', selectedOptionId: 'a', resolvedBy: 'c', resolvedAt: 1 }
-        }
-      }
-    ] as unknown as JournalSnapshotFile['tail']
-    await writeSnapshot(poisonedTail)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-
-  it('rejects a submission that only carries a client message id', async () => {
-    const shallowSubmission = validSnapshot()
-    shallowSubmission.submissions = [
-      { clientMessageId: 'm-1' }
-    ] as unknown as JournalSnapshotFile['submissions']
-    await writeSnapshot(shallowSubmission)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-
-  it('rejects items and counters that only look shallowly plausible', async () => {
-    const missingSequence = validSnapshot()
-    missingSequence.items = [
-      { itemId: 'codex:thread-1:turn-1:1', revision: 1, body: { kind: 'status', text: 'x' } }
-    ] as unknown as JournalSnapshotFile['items']
-    await writeSnapshot(missingSequence)
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-
-    await writeSnapshot({ ...validSnapshot(), compactedThrough: Number.NaN })
-    expect((await readJournalSnapshot(root)).status).toBe('invalid')
-  })
-})
-
-describe('future-version snapshot classification', () => {
-  it('classifies a future version before shape validation so unknown bodies stay unreadable', async () => {
-    // The version can only advance because bodies changed, so a future snapshot
-    // legitimately carries kinds this build cannot parse. That is the
-    // schema-unreadable contract, not corruption.
-    const future = validSnapshot() as unknown as Record<string, unknown>
-    future.v = 99
-    future.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'future-render-kind', payload: { anything: true } },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ]
-    await writeSnapshot(future)
-    expect((await readJournalSnapshot(root)).status).toBe('unreadable')
-  })
-
-  it('classifies a future version as unreadable even when its shapes still parse today', async () => {
-    await writeSnapshot({ ...validSnapshot(), v: 99 })
-    expect((await readJournalSnapshot(root)).status).toBe('unreadable')
-  })
-
-  it('treats a non-integer or sub-1 version as invalid, matching row admission', async () => {
-    for (const v of [0, 1.5]) {
-      await writeSnapshot({ ...validSnapshot(), v })
-      expect((await readJournalSnapshot(root)).status).toBe('invalid')
-    }
-  })
-})
-
-describe('journal startup isolation from a malformed snapshot', () => {
-  it('quarantines a JSON-valid malformed snapshot instead of throwing through open', async () => {
-    await writeSnapshot({ ...validSnapshot(), tombstones: {} })
-
-    const journal = await openAgentSessionJournal({
-      identity: {
-        sessionId: 'session-1',
-        workspaceId: 'ws-1',
-        hostId: 'host-1',
-        agent: 'codex',
-        providerHandle: { kind: 'codex', threadId: 'thread-1' }
-      },
-      journalDir: root
-    })
-
-    // Degraded exactly like other corrupt snapshots: quarantined on disk, never
-    // silently deleted, and the session does not adopt state it cannot trust.
-    const entries = await readdir(root)
-    expect(entries.some((entry) => entry.startsWith('quarantine-snapshot-'))).toBe(true)
-    expect(entries.includes(JOURNAL_SNAPSHOT_FILE)).toBe(false)
-    expect(journal.snapshot().items).toEqual([])
-  })
-})
-
-describe('reopen after a persisted JSON-valid poisoned question', () => {
-  it('quarantines the snapshot so reopen-to-render cannot throw in projection', async () => {
-    const poisoned = validSnapshot()
-    poisoned.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: {
-          kind: 'question',
-          question: 'Deploy?',
-          options: null,
-          resolution: { state: 'resolved', selectedOptionId: 'a', resolvedBy: 'c', resolvedAt: 1 }
-        },
-        sequence: 2,
-        observedAt: 1_000
-      }
-    ] as unknown as JournalSnapshotFile['items']
-    await writeSnapshot(poisoned)
-
-    const journal = await openAgentSessionJournal({
-      identity: {
-        sessionId: 'session-1',
-        workspaceId: 'ws-1',
-        hostId: 'host-1',
-        agent: 'codex',
-        providerHandle: { kind: 'codex', threadId: 'thread-1' }
-      },
-      journalDir: root
-    })
-
-    // The poisoned item must land in quarantine, not in the reopened state:
-    // pre-fix it was admitted and the render path below threw
-    // `TypeError: Cannot read properties of null (reading 'map')`.
-    const entries = await readdir(root)
-    expect(entries.some((entry) => entry.startsWith('quarantine-snapshot-'))).toBe(true)
-    const items = journal.snapshot().items
-    expect(() => projectStructuredItemsToNativeChat(items)).not.toThrow()
-    expect(() => projectStructuredAgentSessionStatus(items)).not.toThrow()
-    expect(items).toEqual([])
-  })
-})
-
-describe('appendJournalRows directory fsync', () => {
-  const ROW: JournalRow = {
-    kind: 'epoch',
-    reason: 'session_created',
-    providerHandle: { kind: 'codex', threadId: 'thread-1' },
-    v: 1,
-    epoch: 'epoch-A',
-    seq: 1,
-    fence: 0,
-    ts: 1_000
-  }
-
-  function hookDirectoryOpen(sync: ReturnType<typeof vi.fn>): FakeDirectoryHandle {
-    const fake: FakeDirectoryHandle = { sync, close: vi.fn(async () => undefined) }
-    openDirectoryHook = (path, flags) => (path === root && flags === 'r' ? fake : undefined)
-    return fake
-  }
-
-  it('closes the directory handle when directory fsync fails', async () => {
-    const fake = hookDirectoryOpen(
-      vi.fn(async () => {
-        throw new Error('EINVAL: sync')
-      })
-    )
-
-    // Tolerating unsupported directory fsync must not turn into a leak.
-    await expect(appendJournalRows(root, [ROW])).resolves.toBeUndefined()
-    expect(fake.sync).toHaveBeenCalledTimes(1)
-    expect(fake.close).toHaveBeenCalledTimes(1)
-  })
-
-  it('closes the directory handle when directory fsync succeeds', async () => {
-    const fake = hookDirectoryOpen(vi.fn(async () => undefined))
-
-    await expect(appendJournalRows(root, [ROW])).resolves.toBeUndefined()
-    expect(fake.sync).toHaveBeenCalledTimes(1)
-    expect(fake.close).toHaveBeenCalledTimes(1)
-  })
-})
diff --git a/src/main/native-chat/agent-session-journal/journal-log-file.ts b/src/main/native-chat/agent-session-journal/journal-log-file.ts
deleted file mode 100644
index 44cbc26d0d5..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-log-file.ts
+++ /dev/null
@@ -1,365 +0,0 @@
-// On-disk layout for one session's journal.
-//
-//   <journal dir>/log.jsonl    append-only rows, fsynced before the caller is told the write landed
-//   <journal dir>/snapshot.json  folded state at a compaction boundary PLUS the retained tail
-//   <journal dir>/blobs/<sha256> bounded-payload remainders
-//
-// The snapshot carries its own tail so compaction is one atomic write. A crash
-// between publishing the snapshot and truncating the log leaves the log a
-// superset of the tail, and recovery unions the two by sequence — never a hole.
-
-import { appendFile, mkdir, open, readFile, stat, type FileHandle } from 'node:fs/promises'
-import { randomUUID } from 'node:crypto'
-import { join } from 'node:path'
-import { durableWriteTempPath, renameDurable, writeFileDurable } from '../../durable-file-write'
-import {
-  AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-  type AgentJournalRenderItem,
-  type AgentJournalSubmission
-} from '../../../shared/agent-session-journal-types'
-import {
-  isAdmissibleAgentJournalRenderItem,
-  isAdmissibleAgentJournalSubmission
-} from '../../../shared/agent-session-journal-schemas'
-import { parseJournalRow, serializeJournalRow, type JournalRow } from './journal-row-schema'
-import { assertJournalPhysicalCapacity } from './journal-physical-quota'
-
-export const JOURNAL_LOG_FILE = 'log.jsonl'
-export const JOURNAL_SNAPSHOT_FILE = 'snapshot.json'
-
-export type JournalSnapshotFile = {
-  v: number
-  epoch: string
-  /** Highest sequence folded into `items`; the tail starts after it. */
-  compactedThrough: number
-  /** Fence monotonicity survives compaction and restart. */
-  highestFence: number
-  items: AgentJournalRenderItem[]
-  submissions: AgentJournalSubmission[]
-  /** Receipts outlive the rows that minted them: a client reconnecting after
-   *  compaction must still get the same answer instead of re-sending. */
-  receipts: {
-    clientMessageId: string
-    providerItemId: string
-    epoch: string
-    sequence: number
-    acceptedAt: number
-  }[]
-  /** Provider item id → submission slot, preserved so a post-compaction echo
-   *  still reconciles into the bubble it belongs to. */
-  aliases: { providerItemId: string; itemId: string }[]
-  tombstones: { itemId: string; revision: number }[]
-  /** Bounded by compaction retention; used to deduplicate a replayed settlement. */
-  appliedSettlementIds?: string[]
-  tail: JournalRow[]
-}
-
-export type JournalReadResult = {
-  rows: JournalRow[]
-  /** True when a line used a schema version this build cannot read. Reading
-   *  STOPS there — the row must not be skipped — and the host degrades to
-   *  read-only: no writes, no compaction, no deletion. */
-  unreadable: boolean
-  /** Lines that failed to parse for reasons other than schema version. */
-  malformed: number
-  /** Raw suffix beginning at the first malformed line, if any. */
-  remainder?: string
-  /** Distinguishes an absent/empty log from bytes that could not name an epoch. */
-  hasBytes: boolean
-}
-
-export type JournalSnapshotReadResult =
-  | { status: 'missing' }
-  | { status: 'valid'; snapshot: JournalSnapshotFile }
-  | { status: 'invalid' }
-  /** A future schema version: unreadable by this build, not corrupt. The file
-   *  stays authoritative in place and the caller degrades to read-only. */
-  | { status: 'unreadable' }
-
-const NEWLINE_BYTE = 0x0a
-
-export async function ensureJournalDir(journalDir: string): Promise<void> {
-  await mkdir(journalDir, { recursive: true })
-}
-
-export async function readJournalSnapshot(journalDir: string): Promise<JournalSnapshotReadResult> {
-  try {
-    const raw = await readFile(join(journalDir, JOURNAL_SNAPSHOT_FILE), 'utf-8')
-    const parsed: unknown = JSON.parse(raw)
-    const version = snapshotSchemaVersion(parsed)
-    if (version === null) {
-      return { status: 'invalid' }
-    }
-    // Version is classified BEFORE shape validation, matching row admission: a
-    // version only advances because bodies changed, so a valid newer snapshot
-    // carries kinds this build cannot parse — unreadable, never corruption.
-    if (version > AGENT_SESSION_JOURNAL_SCHEMA_VERSION) {
-      return { status: 'unreadable' }
-    }
-    return isJournalSnapshotFile(parsed)
-      ? { status: 'valid', snapshot: parsed }
-      : { status: 'invalid' }
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return { status: 'missing' }
-    }
-    if (error instanceof SyntaxError) {
-      return { status: 'invalid' }
-    }
-    throw error
-  }
-}
-
-export async function quarantineInvalidJournalSnapshot(
-  journalDir: string,
-  quota?: { sessionId: string; maxBytes: number }
-): Promise<string> {
-  // Rename is normally same-filesystem and size-neutral, but admission must
-  // happen before retaining evidence so a full journal never creates an
-  // unbounded quarantine artifact (or relies on a copy fallback).
-  if (quota) {
-    const source = join(journalDir, JOURNAL_SNAPSHOT_FILE)
-    // Account for the complete source bytes: rename is usually neutral, but a
-    // cross-device/filesystem fallback may briefly retain both inodes.
-    const sourceBytes = await stat(source)
-      .then((info) => info.size)
-      .catch((error) => {
-        if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-          return 0
-        }
-        throw error
-      })
-    await assertJournalPhysicalCapacity({
-      journalDir,
-      ...quota,
-      peakAdditionalBytes: sourceBytes
-    })
-  }
-  const source = join(journalDir, JOURNAL_SNAPSHOT_FILE)
-  const target = join(journalDir, `quarantine-snapshot-${Date.now()}-${randomUUID()}.json`)
-  await renameDurable(source, target)
-  return target
-}
-
-export async function writeJournalSnapshotFile(
-  journalDir: string,
-  snapshot: JournalSnapshotFile
-): Promise<void> {
-  const target = join(journalDir, JOURNAL_SNAPSHOT_FILE)
-  await writeFileDurable(durableWriteTempPath(target), target, JSON.stringify(snapshot))
-}
-
-export async function readJournalLog(journalDir: string): Promise<JournalReadResult> {
-  let raw: string
-  try {
-    raw = await readFile(join(journalDir, JOURNAL_LOG_FILE), 'utf-8')
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return { rows: [], unreadable: false, malformed: 0, hasBytes: false }
-    }
-    throw error
-  }
-  const rows: JournalRow[] = []
-  let unreadable = false
-  let malformed = 0
-  const lines = raw.split('\n')
-  let offset = 0
-  for (const line of lines) {
-    if (!line.trim()) {
-      offset += line.length + 1
-      continue
-    }
-    const parsed = parseJournalRow(line)
-    if (parsed.ok) {
-      rows.push(parsed.row)
-      offset += line.length + 1
-      continue
-    }
-    if (parsed.unreadable) {
-      unreadable = true
-      return { rows, unreadable, malformed, remainder: raw.slice(offset), hasBytes: raw.length > 0 }
-    }
-    malformed += 1
-    return { rows, unreadable, malformed, remainder: raw.slice(offset), hasBytes: raw.length > 0 }
-  }
-  return { rows, unreadable, malformed, hasBytes: raw.length > 0 }
-}
-
-/** Row admission requires an integer version of at least 1; a snapshot whose
- *  version cannot even be read is malformed, not a schema statement. */
-function snapshotSchemaVersion(value: unknown): number | null {
-  const snapshot = recordOf(value)
-  const version = snapshot?.v
-  return typeof version === 'number' && Number.isInteger(version) && version >= 1 ? version : null
-}
-
-function isJournalSnapshotFile(value: unknown): value is JournalSnapshotFile {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    return false
-  }
-  const snapshot = value as Record<string, unknown>
-  return (
-    typeof snapshot.v === 'number' &&
-    typeof snapshot.epoch === 'string' &&
-    snapshot.epoch.length > 0 &&
-    Number.isInteger(snapshot.compactedThrough) &&
-    (snapshot.compactedThrough as number) >= 0 &&
-    Number.isInteger(snapshot.highestFence) &&
-    // Deep discriminated admission: a JSON-valid item with a corrupt nested
-    // shape (e.g. a question whose options are null) must land this snapshot
-    // in quarantine rather than throw later in projection or prompt render.
-    arrayOf(snapshot.items, isAdmissibleAgentJournalRenderItem) &&
-    arrayOf(snapshot.submissions, isAdmissibleAgentJournalSubmission) &&
-    arrayOf(snapshot.receipts, isReceipt) &&
-    arrayOf(snapshot.aliases, isAlias) &&
-    // Older snapshots predate tombstones; absence is fine, a non-array is not —
-    // seeding iterates this collection, so a JSON-valid wrong shape must land
-    // in quarantine rather than throw through startup restoration.
-    (snapshot.tombstones === undefined || arrayOf(snapshot.tombstones, isTombstone)) &&
-    (snapshot.appliedSettlementIds === undefined ||
-      arrayOf(snapshot.appliedSettlementIds, (entry) => typeof entry === 'string')) &&
-    arrayOf(snapshot.tail, (row) => parseJournalRow(JSON.stringify(row)).ok)
-  )
-}
-
-function arrayOf(value: unknown, predicate: (entry: unknown) => boolean): value is unknown[] {
-  return Array.isArray(value) && value.every(predicate)
-}
-
-function recordOf(value: unknown): Record<string, unknown> | null {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : null
-}
-
-function isTombstone(value: unknown): boolean {
-  const tombstone = recordOf(value)
-  return Boolean(
-    tombstone && typeof tombstone.itemId === 'string' && Number.isInteger(tombstone.revision)
-  )
-}
-
-function isReceipt(value: unknown): boolean {
-  const receipt = recordOf(value)
-  return Boolean(
-    receipt &&
-    typeof receipt.clientMessageId === 'string' &&
-    typeof receipt.providerItemId === 'string' &&
-    typeof receipt.epoch === 'string' &&
-    typeof receipt.sequence === 'number' &&
-    typeof receipt.acceptedAt === 'number'
-  )
-}
-
-function isAlias(value: unknown): boolean {
-  const alias = recordOf(value)
-  return Boolean(
-    alias && typeof alias.providerItemId === 'string' && typeof alias.itemId === 'string'
-  )
-}
-
-/**
- * Append rows and fsync before returning. The caller treats a resolved promise
- * as "this row survives a power loss" — the write-ahead submission row depends
- * on exactly that, so this must never be relaxed to a buffered write.
- */
-export async function appendJournalRows(
-  journalDir: string,
-  rows: readonly JournalRow[]
-): Promise<void> {
-  if (rows.length === 0) {
-    return
-  }
-  const path = join(journalDir, JOURNAL_LOG_FILE)
-  // A process death can leave a final JSON fragment without its newline. Never
-  // concatenate a new durable row onto that fragment: truncate the torn tail
-  // first, then fsync the repair before acknowledging this append.
-  try {
-    await repairJournalLogTail(path)
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
-      throw error
-    }
-    // The append below creates a missing log.
-  }
-  const payload = `${rows.map(serializeJournalRow).join('\n')}\n`
-  await appendFile(path, payload, 'utf-8')
-  const handle = await open(path, 'r+')
-  try {
-    await handle.sync()
-  } finally {
-    await handle.close()
-  }
-  let directory: FileHandle | undefined
-  try {
-    directory = await open(journalDir, 'r')
-    await directory.sync()
-  } catch {
-    // Directory fsync is unavailable on some platforms (notably Windows).
-  } finally {
-    // The tolerance above must not leak the descriptor when open succeeded
-    // but sync failed — one leaked handle per append adds up fast.
-    await directory?.close().catch(() => undefined)
-  }
-}
-
-/** Repair only a torn final row. The normal append path reads one byte; scanning
- * backward is reserved for the crash-recovery case and never rereads the log. */
-async function repairJournalLogTail(path: string): Promise<void> {
-  const handle = await open(path, 'r+')
-  try {
-    const { size } = await handle.stat()
-    if (size === 0) {
-      return
-    }
-    const lastByte = Buffer.alloc(1)
-    await handle.read(lastByte, 0, 1, size - 1)
-    if (lastByte[0] === NEWLINE_BYTE) {
-      return
-    }
-
-    const scanChunkBytes = 64 * 1024
-    let scanEnd = size
-    let boundary = -1
-    while (scanEnd > 0 && boundary === -1) {
-      const scanStart = Math.max(0, scanEnd - scanChunkBytes)
-      const chunk = Buffer.alloc(scanEnd - scanStart)
-      await handle.read(chunk, 0, chunk.length, scanStart)
-      const newline = chunk.lastIndexOf(NEWLINE_BYTE)
-      if (newline !== -1) {
-        boundary = scanStart + newline
-      }
-      scanEnd = scanStart
-    }
-
-    const lineStart = boundary + 1
-    const finalLine = Buffer.alloc(size - lineStart)
-    await handle.read(finalLine, 0, finalLine.length, lineStart)
-    // A whole row that merely lost its newline is kept; a real fragment goes.
-    const complete = parseJournalRow(finalLine.toString('utf-8')).ok
-    await (complete ? handle.write('\n', size) : handle.truncate(lineStart))
-    await handle.sync()
-  } finally {
-    await handle.close()
-  }
-}
-
-export async function quarantineJournalRemainder(
-  journalDir: string,
-  remainder: string
-): Promise<string> {
-  const path = join(journalDir, `quarantine-${Date.now()}-${randomUUID()}.jsonl`)
-  await writeFileDurable(durableWriteTempPath(path), path, remainder)
-  return path
-}
-
-/** Replace the log with exactly the retained tail. Runs only after the snapshot
- *  carrying that tail is durable, so a crash here loses nothing. */
-export async function rewriteJournalLog(
-  journalDir: string,
-  rows: readonly JournalRow[]
-): Promise<void> {
-  const target = join(journalDir, JOURNAL_LOG_FILE)
-  const payload = rows.length ? `${rows.map(serializeJournalRow).join('\n')}\n` : ''
-  await writeFileDurable(durableWriteTempPath(target), target, payload)
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-open.ts b/src/main/native-chat/agent-session-journal/journal-open.ts
index 94fb3137f26..350d2e9cfb9 100644
--- a/src/main/native-chat/agent-session-journal/journal-open.ts
+++ b/src/main/native-chat/agent-session-journal/journal-open.ts
@@ -1,194 +1,205 @@
-// Loading a journal from disk: snapshot + log → folded state.
+// Loading a journal: the session projection names the live epoch, and that
+// epoch's rows are folded through the reducer in sequence order.
 //
-// The snapshot is authoritative for the current epoch. Log rows belonging to a
-// superseded epoch are dropped rather than merged — a crash between publishing
-// a rollover snapshot and rewriting the log is the ordinary way that happens.
-// A gap in the surviving sequence is corruption, and the caller rolls the epoch
+// There is no snapshot to anchor to and no superseded-epoch rows to drop — a
+// roll deletes them in the same transaction that publishes the new epoch. A gap
+// in the surviving sequence is corruption, and the caller rolls the epoch
 // rather than rendering a partial timeline.
 
-import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { existsSync } from 'node:fs'
+import type Database from '../../sqlite/sync-database'
 import { findSequenceGap } from './journal-cursor'
-import {
-  quarantineInvalidJournalSnapshot,
-  readJournalLog,
-  readJournalSnapshot,
-  type JournalSnapshotFile
-} from './journal-log-file'
+import { openJournalDatabase } from './journal-database'
+import { journalDatabaseFile } from './journal-paths'
 import {
   applyJournalRow,
   createJournalReducerState,
-  rememberAppliedSettlementId,
   type JournalReducerState
 } from './journal-reducer'
-import { journalRowByteLength, type JournalRow } from './journal-row-schema'
+import {
+  readJournalEpochRows,
+  readJournalRowsAfter,
+  readJournalSessionEpoch
+} from './journal-row-table'
+import { JOURNAL_REPAIR_DISCLOSURE_ITEM_ID } from './journal-repair-disclosure'
+import { pendingJournalRepairSequence } from './journal-repair-marker'
+import { parseJournalRow, type JournalRow } from './journal-row-schema'
+
+/** Every epoch row is sequence 1, and no compaction moves that floor. */
+const FIRST_JOURNAL_SEQUENCE = 1
 
 export type JournalLoad = {
   state: JournalReducerState
-  /** Rows still individually replayable, oldest first. */
-  tailRows: JournalRow[]
-  /** Highest sequence folded into the snapshot; the tail starts after it. */
-  compactedThrough: number
-  /** A future schema version was met: no writes, no compaction, no deletion. */
+  /** A future schema version was met: no writes, no deletion. */
   readOnly: boolean
   /** Set when the surviving prefix is unusable and the caller must roll the epoch. */
   corrupt: boolean
-  /** Log lines skipped because they failed to parse (schema-version rows are
+  /** Rows skipped because their body failed to parse (future-version rows are
    *  `readOnly`, never counted here). The store discloses these in the timeline. */
   malformedRows: number
-  sizeBytes: number
-  /** Raw unreadable suffix retained for quarantine instead of deletion. */
-  quarantineRemainder?: string
+  /** Directory-internal: the first sequence of an unusable suffix. The store
+   *  deletes from here before it accepts a write; a probe leaves it alone. */
+  truncateFrom?: number
 }
 
-/** Returns null when no journal exists yet for this session. */
-export async function loadJournal(
-  journalDir: string,
-  sessionId: string,
-  quota?: { maxBytes: number }
-): Promise<JournalLoad | null> {
-  const snapshotRead = await readJournalSnapshot(journalDir)
-  if (snapshotRead.status === 'unreadable') {
-    // Written by a newer schema: not corrupt, so never quarantined. The file
-    // stays authoritative in place, and this build must not write, compact,
-    // delete, or render a partial timeline from rows it cannot anchor to the
-    // snapshot it cannot read.
+/**
+ * Replay on a connection this function does NOT own. Returns null when the
+ * session has no journal yet.
+ */
+export function replayJournal(
+  db: Database.Database,
+  readOnly: boolean,
+  sessionId: string
+): JournalLoad | null {
+  if (readOnly) {
     return emptyReadOnlyLoad(sessionId)
   }
-  if (snapshotRead.status === 'invalid') {
-    await quarantineInvalidJournalSnapshot(
-      journalDir,
-      quota ? { sessionId, maxBytes: quota.maxBytes } : undefined
-    )
-  }
-  const snapshot = snapshotRead.status === 'valid' ? snapshotRead.snapshot : null
-  const log = await readJournalLog(journalDir)
-  const epoch = resolveEpoch(snapshot, log.rows)
+  const epoch = readJournalSessionEpoch(db, sessionId)
   if (!epoch) {
-    return snapshotRead.status === 'invalid' || log.hasBytes ? emptyReadOnlyLoad(sessionId) : null
+    return null
+  }
+  const state = createJournalReducerState(sessionId, epoch)
+  const stored = readJournalEpochRows(db, sessionId, epoch)
+  // A partial repair keeps its prefix, so the surviving rows look contiguous and
+  // anchored however much of the timeline it deleted. Its marker is what still
+  // says otherwise, naming the sequence past which the epoch would be its own
+  // history again.
+  const repairedFrom = pendingJournalRepairSequence(db, sessionId, epoch)
+  const rows: JournalRow[] = []
+  let malformedRows = 0
+  let latched = false
+  let truncateFrom: number | undefined
+  for (const entry of stored) {
+    const parsed = parseJournalRow(entry.rowJson)
+    if (parsed.ok) {
+      rows.push(parsed.row)
+      continue
+    }
+    // Reading STOPS at the first row this build cannot represent. A future
+    // version latches read-only; anything else is one skipped row, disclosed.
+    truncateFrom = entry.seq
+    if (parsed.unreadable) {
+      latched = true
+    } else {
+      malformedRows = 1
+    }
+    break
   }
 
-  const compactedThrough = snapshot?.epoch === epoch ? snapshot.compactedThrough : 0
-  const state = seedState(sessionId, epoch, snapshot?.epoch === epoch ? snapshot : null)
-  const liveRows = log.rows.filter((row) => row.epoch === epoch)
-  let tailRows = unionBySequence(snapshot?.epoch === epoch ? snapshot.tail : [], liveRows, epoch)
-
-  const oldest = tailRows[0]?.seq ?? compactedThrough + 1
+  // Anchored at 1, never at the first row that HAPPENS to remain: nothing trims
+  // a prefix, so a missing epoch row is a hole like any other and everything
+  // behind it is unanchored. Validating from `rows[0].seq` would call the
+  // leftovers contiguous and leave them out of the repair that runs before
+  // provider history replaces the epoch.
   const gap = findSequenceGap(
-    tailRows.map((row) => row.seq),
-    oldest
+    rows.map((row) => row.seq),
+    FIRST_JOURNAL_SEQUENCE
   )
-  // A hole below the snapshot boundary is unrecoverable too: the snapshot only
-  // covers `compactedThrough`, so a tail that starts above it lost rows.
-  let corrupt = Boolean(gap) || oldest > compactedThrough + 1 || log.malformed > 0
-  let quarantineRemainder = log.remainder
   if (gap) {
-    const firstBad = tailRows.findIndex((row, index) => {
-      const expected = (tailRows[0]?.seq ?? compactedThrough + 1) + index
-      return row.seq !== expected
-    })
+    const firstBad = rows.findIndex((row, index) => row.seq !== FIRST_JOURNAL_SEQUENCE + index)
     if (firstBad !== -1) {
-      const suffix = tailRows.slice(firstBad)
-      tailRows = tailRows.slice(0, firstBad)
-      quarantineRemainder ??= `${suffix.map((row) => JSON.stringify(row)).join('\n')}\n`
+      truncateFrom = rows[firstBad]?.seq ?? truncateFrom
+      rows.length = firstBad
     }
   }
-
-  for (const row of tailRows) {
-    if (row.seq > compactedThrough) {
-      applyJournalRow(state, row)
-    }
+  // Contiguity from 1 is not the whole invariant: sequence 1 has to BE the epoch
+  // row. An ordinary row there is an epoch nothing anchors, and replaying it as
+  // clean is how a repaired journal silently adopts a timeline whose real
+  // history was never rebuilt.
+  if (rows.length > 0 && rows[0]?.kind !== 'epoch') {
+    truncateFrom = rows[0]?.seq ?? truncateFrom
+    rows.length = 0
   }
-  state.oldestSequence = oldest
-  state.lastSequence = Math.max(state.lastSequence, compactedThrough)
+  for (const row of rows) {
+    applyJournalRow(state, row)
+  }
+  state.oldestSequence = FIRST_JOURNAL_SEQUENCE
 
+  // A latched journal reduces to nothing by design; only a writable one can be
+  // held to the anchor.
+  const unanchored = !latched && rows[0]?.kind !== 'epoch'
   return {
     state,
-    tailRows,
-    compactedThrough,
-    // A future-version snapshot never reaches here: it is classified
-    // unreadable above, so `valid` implies a version this build can write.
-    readOnly: log.unreadable,
-    corrupt,
-    malformedRows: log.malformed,
-    sizeBytes: tailRows.reduce((total, row) => total + journalRowByteLength(row), 0),
-    quarantineRemainder
+    readOnly: latched,
+    corrupt:
+      Boolean(gap) ||
+      malformedRows > 0 ||
+      unanchored ||
+      (repairedFrom !== null && awaitsRebuild(rows, repairedFrom)) ||
+      awaitsProviderHistory(rows),
+    malformedRows,
+    ...(truncateFrom !== undefined && !latched ? { truncateFrom } : {})
+  }
+}
+
+/**
+ * The epoch a total repair published, still holding nothing but its own anchor
+ * and disclosure. The rows it dropped were never reconstructed, so provider
+ * history has to be retried rather than this being called a clean timeline.
+ */
+function awaitsProviderHistory(rows: readonly JournalRow[]): boolean {
+  const anchor = rows[0]
+  if (anchor?.kind !== 'epoch' || anchor.reason !== 'unreconcilable_prefix') {
+    return false
+  }
+  // The anchor sits at sequence 1, so content of the epoch's own starts at 2.
+  return awaitsRebuild(rows, FIRST_JOURNAL_SEQUENCE + 1)
+}
+
+/**
+ * True while everything at or above `contentFrom` is the repair's own
+ * bookkeeping: the deleted history was never rebuilt, so the provider has to be
+ * asked again. The moment the session writes content of its own past that
+ * sequence the epoch IS its own history, and the retry stops rather than a
+ * later import replacing rows the user has since seen.
+ */
+function awaitsRebuild(rows: readonly JournalRow[], contentFrom: number): boolean {
+  return rows.every(
+    (row) =>
+      row.seq < contentFrom ||
+      (row.kind === 'item' && row.itemId === JOURNAL_REPAIR_DISCLOSURE_ITEM_ID)
+  )
+}
+
+/** Rows after a cursor, in sequence order. Stops at the first row this build
+ *  cannot parse, exactly as replay does. */
+export function readJournalRowsAfterCursor(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string,
+  afterSequence: number
+): JournalRow[] {
+  const rows: JournalRow[] = []
+  for (const stored of readJournalRowsAfter(db, sessionId, epoch, afterSequence)) {
+    const parsed = parseJournalRow(stored.rowJson)
+    if (!parsed.ok) {
+      break
+    }
+    rows.push(parsed.row)
+  }
+  return rows
+}
+
+/** Standalone probe. Opens its own connection and closes it before returning,
+ *  so a caller holding only the returned value holds no handle. */
+export function loadJournal(journalDir: string, sessionId: string): JournalLoad | null {
+  const dbPath = journalDatabaseFile(journalDir)
+  if (!existsSync(dbPath)) {
+    return null
+  }
+  const opened = openJournalDatabase(dbPath)
+  try {
+    return replayJournal(opened.db, opened.readOnly, sessionId)
+  } finally {
+    opened.db.close()
   }
 }
 
 function emptyReadOnlyLoad(sessionId: string): JournalLoad {
-  const state = createJournalReducerState(sessionId, '')
   return {
-    state,
-    tailRows: [],
-    compactedThrough: 0,
+    state: createJournalReducerState(sessionId, ''),
     readOnly: true,
     corrupt: false,
-    malformedRows: 0,
-    sizeBytes: 0
+    malformedRows: 0
   }
 }
-
-/** The snapshot names the live epoch; without one, the newest valid row does. */
-function resolveEpoch(snapshot: JournalSnapshotFile | null, rows: JournalRow[]): string | null {
-  if (snapshot?.epoch) {
-    return snapshot.epoch
-  }
-  return rows.at(-1)?.epoch ?? null
-}
-
-function seedState(
-  sessionId: string,
-  epoch: string,
-  snapshot: JournalSnapshotFile | null
-): JournalReducerState {
-  const state = createJournalReducerState(sessionId, epoch)
-  if (!snapshot) {
-    return state
-  }
-  for (const item of snapshot.items) {
-    state.items.set(item.itemId, item)
-  }
-  for (const submission of snapshot.submissions) {
-    state.submissions.set(submission.clientMessageId, { ...submission } as AgentJournalSubmission)
-  }
-  for (const receipt of snapshot.receipts) {
-    state.receipts.set(receipt.clientMessageId, {
-      clientMessageId: receipt.clientMessageId,
-      providerItemId: receipt.providerItemId,
-      cursor: { epoch: receipt.epoch, sequence: receipt.sequence },
-      acceptedAt: receipt.acceptedAt
-    })
-  }
-  for (const alias of snapshot.aliases) {
-    state.aliases.set(alias.providerItemId, alias.itemId)
-  }
-  for (const tombstone of snapshot.tombstones ?? []) {
-    state.tombstones.set(tombstone.itemId, tombstone.revision)
-  }
-  for (const settlementId of snapshot.appliedSettlementIds ?? []) {
-    rememberAppliedSettlementId(state, settlementId)
-  }
-  state.highestFence = snapshot.highestFence ?? 0
-  state.lastSequence = snapshot.compactedThrough
-  state.oldestSequence = snapshot.compactedThrough + 1
-  return state
-}
-
-/** Merge the snapshot's retained tail with the live log, preferring the log's
- *  copy of any sequence both hold, and dropping rows from a superseded epoch. */
-function unionBySequence(
-  retained: readonly JournalRow[],
-  live: readonly JournalRow[],
-  epoch: string
-): JournalRow[] {
-  const bySequence = new Map<number, JournalRow>()
-  for (const row of retained) {
-    if (row.epoch === epoch) {
-      bySequence.set(row.seq, row)
-    }
-  }
-  for (const row of live) {
-    bySequence.set(row.seq, row)
-  }
-  return [...bySequence.values()].sort((a, b) => a.seq - b.seq)
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-paths.ts b/src/main/native-chat/agent-session-journal/journal-paths.ts
index 87616b25b96..c21a7675f00 100644
--- a/src/main/native-chat/agent-session-journal/journal-paths.ts
+++ b/src/main/native-chat/agent-session-journal/journal-paths.ts
@@ -40,3 +40,10 @@ export function journalDirectoryFor(
 export function defaultJournalRoot(): Promise<string> {
   return Promise.resolve(getAppEnvironment().getPath('userData'))
 }
+
+export const JOURNAL_DATABASE_FILE = 'journal.db'
+
+/** The session's SQLite database, inside the directory `journalDirectoryFor` names. */
+export function journalDatabaseFile(journalDir: string): string {
+  return join(journalDir, JOURNAL_DATABASE_FILE)
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-payload-bounds.ts b/src/main/native-chat/agent-session-journal/journal-payload-bounds.ts
index b47d1a1511c..ea09ecf6df3 100644
--- a/src/main/native-chat/agent-session-journal/journal-payload-bounds.ts
+++ b/src/main/native-chat/agent-session-journal/journal-payload-bounds.ts
@@ -1,11 +1,9 @@
 // Payload bounds for tool output and diffs.
 //
-// A looping agent must not be able to fill the host disk, and a 40 MB tool
-// result must not be inlined into a row that every reconnecting client
-// replays. A bounded payload keeps a head plus the original byte length and
-// digest; the remainder lives in the content-addressed blob store under the
-// same retention as its epoch. Crossing a bound is always marked — never a
-// silent drop.
+// A 40 MB tool result must not be inlined into a row that every reconnecting
+// client replays. A bounded payload keeps a head plus the original byte length
+// and digest; the remainder is discarded. Crossing a bound is always marked —
+// never a silent drop.
 
 import { createHash } from 'node:crypto'
 import type { AgentJournalBoundedPayload } from '../../../shared/agent-session-journal-types'
@@ -13,18 +11,10 @@ import type { AgentJournalBoundedPayload } from '../../../shared/agent-session-j
 export type JournalPayloadLimits = {
   /** Bytes of the payload kept inline on the row. */
   inlineHeadBytes: number
-  /** Total bytes of journal rows one session may hold before appends are refused. */
-  maxSessionBytes: number
-  /** Appends allowed inside `appendWindowMs`, bounding a runaway agent's rate. */
-  maxAppendsPerWindow: number
-  appendWindowMs: number
 }
 
 export const DEFAULT_JOURNAL_PAYLOAD_LIMITS: JournalPayloadLimits = {
-  inlineHeadBytes: 16 * 1024,
-  maxSessionBytes: 256 * 1024 * 1024,
-  maxAppendsPerWindow: 5000,
-  appendWindowMs: 60_000
+  inlineHeadBytes: 16 * 1024
 }
 
 /** Marker appended to a clipped inline string so the UI never presents a
@@ -38,10 +28,8 @@ export function digestPayload(payload: string): string {
   return createHash('sha256').update(payload, 'utf8').digest('hex')
 }
 
-/**
- * Clip `payload` to the inline head. `truncated` means the remainder must be
- * written to the blob store under `digest` before the row is appended.
- */
+/** Clip `payload` to the inline head. `truncated` means the remainder was
+ *  discarded; `digest` and `byteLength` describe the original. */
 export function boundPayload(
   payload: string,
   limits: JournalPayloadLimits
@@ -60,7 +48,7 @@ export function boundPayload(
 }
 
 /** Bound a plain string that must stay a string (a tool-result block's output),
- *  keeping the explicit marker inline. Returns the blob payload to persist. */
+ *  keeping the explicit marker inline. */
 export function boundInlineText(
   payload: string,
   limits: JournalPayloadLimits
@@ -75,7 +63,7 @@ export function boundInlineText(
   }
 }
 
-/** Keep arbitrary tool input JSON bounded before lifecycle admission. */
+/** Keep arbitrary tool input JSON bounded before it reaches a row. */
 export function boundToolInput(input: unknown, limits: JournalPayloadLimits): unknown {
   let encoded: string
   try {
diff --git a/src/main/native-chat/agent-session-journal/journal-physical-quota.test.ts b/src/main/native-chat/agent-session-journal/journal-physical-quota.test.ts
deleted file mode 100644
index b3ee4699fc0..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-physical-quota.test.ts
+++ /dev/null
@@ -1,125 +0,0 @@
-import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import type {
-  AgentJournalItemBody,
-  AgentJournalItemIdentity,
-  AgentSessionJournalIdentity
-} from '../../../shared/agent-session-journal-types'
-import { JOURNAL_SNAPSHOT_FILE } from './journal-log-file'
-import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import { openAgentSessionJournal } from './journal-store-factory'
-
-const IDENTITY: AgentSessionJournalIdentity = {
-  sessionId: 'session-1',
-  workspaceId: 'ws-1',
-  hostId: 'host-1',
-  agent: 'codex',
-  providerHandle: { kind: 'codex', threadId: 'thread-1' }
-}
-
-let root: string
-
-function item(ordinal: number): AgentJournalItemIdentity {
-  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
-}
-
-function body(value: string): AgentJournalItemBody {
-  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
-}
-
-beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-journal-quota-'))
-})
-
-afterEach(async () => {
-  await rm(root, { recursive: true, force: true })
-})
-
-describe('journal physical quota peaks', () => {
-  it('refuses an epoch replacement whose staging peak exceeds the quota', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 8_000 }
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits,
-      autoCompact: false
-    })
-    await journal.appendItem(item(1), body('old'.repeat(500)), { fence: 1 })
-    const epoch = journal.epoch
-
-    await expect(
-      journal.replaceEpochItems('handle_forked', 2, [
-        { identity: item(2), body: body('replacement'.repeat(250)) }
-      ])
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(journal.epoch).toBe(epoch)
-    expect((await readdir(root)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(false)
-    expect(await journalDirectoryBytes(root)).toBeLessThanOrEqual(limits.maxSessionBytes)
-  })
-
-  it('refuses schema quarantine when its peak copy would exceed the quota', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 7_000 }
-    await openAgentSessionJournal({ identity: IDENTITY, journalDir: root, limits })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    snapshot.items = [{ body: { kind: 'future', payload: 'x'.repeat(4_000) } }]
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-    const reopened = await openAgentSessionJournal({ identity: IDENTITY, journalDir: root, limits })
-
-    await expect(reopened.rollEpoch('schema_unreadable', 2)).rejects.toMatchObject({
-      code: 'journal_bound_exceeded'
-    })
-
-    expect(reopened.isReadOnly).toBe(true)
-    expect((await readdir(root)).some((name) => name.startsWith('quarantine-'))).toBe(false)
-    expect(await journalDirectoryBytes(root)).toBeLessThanOrEqual(limits.maxSessionBytes)
-  })
-
-  it('does not rename an invalid snapshot when the directory is already full', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 2_000 }
-    await openAgentSessionJournal({ identity: IDENTITY, journalDir: root, limits })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    await writeFile(snapshotPath, '{"invalid":', 'utf8')
-    const current = await journalDirectoryBytes(root)
-    await writeFile(
-      join(root, 'quota-filler'),
-      'x'.repeat(Math.max(0, limits.maxSessionBytes - current)),
-      'utf8'
-    )
-
-    await expect(
-      openAgentSessionJournal({ identity: IDENTITY, journalDir: root, limits })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-    expect(await readFile(snapshotPath, 'utf8')).toBe('{"invalid":')
-    expect((await readdir(root)).some((name) => name.startsWith('quarantine-snapshot-'))).toBe(
-      false
-    )
-  })
-
-  it('counts pre-existing durable-write temps while staging an epoch replacement', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 8_000 }
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits,
-      autoCompact: false
-    })
-    await journal.appendItem(item(1), body('old'), { fence: 1 })
-    // Simulate a temp left by a crash. Replacement must refuse before writing
-    // its epoch row or creating a staging blob beside this file.
-    await writeFile(join(root, 'snapshot.json.crashed-write.tmp'), 'x'.repeat(7_500), 'utf8')
-    const epoch = journal.epoch
-
-    await expect(
-      journal.replaceEpochItems('handle_forked', 2, [{ identity: item(2), body: body('new') }])
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-
-    expect(journal.epoch).toBe(epoch)
-    expect((await readdir(root)).some((name) => name.startsWith('.epoch-replacement-'))).toBe(false)
-  })
-})
diff --git a/src/main/native-chat/agent-session-journal/journal-physical-quota.ts b/src/main/native-chat/agent-session-journal/journal-physical-quota.ts
deleted file mode 100644
index 478451b615c..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-physical-quota.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import { lstat, readdir } from 'node:fs/promises'
-import type { Dirent } from 'node:fs'
-import { join } from 'node:path'
-import { AgentSessionJournalError } from './journal-write-guards'
-
-/** Counts every physical file owned by one session, including blobs, durable
- * write temps, and retained quarantine evidence. Symlinks are charged as files
- * but never followed outside the journal directory. */
-export async function journalDirectoryBytes(directory: string): Promise<number> {
-  let entries: Dirent<string>[]
-  try {
-    entries = await readdir(directory, { withFileTypes: true, encoding: 'utf8' })
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
-      return 0
-    }
-    throw error
-  }
-  let total = 0
-  for (const entry of entries) {
-    const path = join(directory, entry.name)
-    total += entry.isDirectory() ? await journalDirectoryBytes(path) : (await lstat(path)).size
-  }
-  return total
-}
-
-export async function assertJournalPhysicalCapacity(input: {
-  journalDir: string
-  sessionId: string
-  maxBytes: number
-  peakAdditionalBytes?: number
-}): Promise<number> {
-  const current = await journalDirectoryBytes(input.journalDir)
-  if (current + (input.peakAdditionalBytes ?? 0) > input.maxBytes) {
-    throw new AgentSessionJournalError(
-      'journal_bound_exceeded',
-      `agent-session journal for ${input.sessionId} reached its ${input.maxBytes}-byte physical bound`
-    )
-  }
-  return current
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-prompt-body-bounds.ts b/src/main/native-chat/agent-session-journal/journal-prompt-body-bounds.ts
index fb8243b6926..58d12dfcf89 100644
--- a/src/main/native-chat/agent-session-journal/journal-prompt-body-bounds.ts
+++ b/src/main/native-chat/agent-session-journal/journal-prompt-body-bounds.ts
@@ -12,10 +12,7 @@ import {
 
 export const MAX_JOURNAL_PROMPT_OPTIONS = 64
 
-const JOURNAL_PROMPT_OPTION_LIMITS = {
-  ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-  inlineHeadBytes: 1024
-}
+const JOURNAL_PROMPT_OPTION_LIMITS = { inlineHeadBytes: 1024 }
 const JOURNAL_PROMPT_ID_MAX_BYTES = 1024
 
 export function cancelledJournalPromptBody(
@@ -78,11 +75,6 @@ function boundPromptIdentifier(value: string): string {
   if (Buffer.byteLength(value, 'utf8') <= JOURNAL_PROMPT_ID_MAX_BYTES) {
     return value
   }
-  const bounded = boundPayload(value, {
-    inlineHeadBytes: JOURNAL_PROMPT_ID_MAX_BYTES - 33,
-    maxSessionBytes: Number.MAX_SAFE_INTEGER,
-    maxAppendsPerWindow: Number.MAX_SAFE_INTEGER,
-    appendWindowMs: Number.MAX_SAFE_INTEGER
-  })
+  const bounded = boundPayload(value, { inlineHeadBytes: JOURNAL_PROMPT_ID_MAX_BYTES - 33 })
   return `${bounded.head}#${bounded.digest.slice(0, 32)}`
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer.test.ts b/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
index cbdc35a4698..676a37f63a7 100644
--- a/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
@@ -11,7 +11,6 @@ import {
   applyJournalRow,
   createJournalReducerState,
   MAX_JOURNAL_APPLIED_SETTLEMENT_IDS,
-  referencedBlobDigests,
   renderJournalState,
   type JournalReducerState
 } from './journal-reducer'
@@ -379,58 +378,6 @@ describe('lifecycle settlement deduplication', () => {
   })
 })
 
-describe('blob retention', () => {
-  it('reports the digests live rows still reference', () => {
-    const state = fold([
-      {
-        kind: 'item',
-        itemId: 'tool',
-        revision: 1,
-        body: {
-          kind: 'tool-call',
-          name: 'bash',
-          input: {},
-          state: 'completed',
-          output: { head: 'x', byteLength: 999, digest: 'digest-a', truncated: true }
-        },
-        ...base(1)
-      },
-      {
-        kind: 'item',
-        itemId: 'inline',
-        revision: 1,
-        body: {
-          kind: 'tool-call',
-          name: 'bash',
-          input: {},
-          state: 'completed',
-          output: { head: 'y', byteLength: 1, digest: 'digest-b', truncated: false }
-        },
-        ...base(2)
-      }
-    ])
-    expect([...referencedBlobDigests(state)]).toEqual(['digest-a'])
-  })
-
-  it('stops referencing a digest once its item is tombstoned', () => {
-    const state = fold([
-      {
-        kind: 'item',
-        itemId: 'tool',
-        revision: 1,
-        body: {
-          kind: 'diff',
-          path: 'a.ts',
-          patch: { head: 'x', byteLength: 999, digest: 'digest-a', truncated: true }
-        },
-        ...base(1)
-      },
-      { kind: 'tombstone', itemId: 'tool', revision: 2, ...base(2) }
-    ])
-    expect(referencedBlobDigests(state).size).toBe(0)
-  })
-})
-
 describe('malformed persisted item keys', () => {
   it('degrades a malformed-percent item id to an opaque key instead of throwing', () => {
     // A user-message body drives identity resolution through the key parser;
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer.ts b/src/main/native-chat/agent-session-journal/journal-reducer.ts
index c660f80611f..3dc4385d797 100644
--- a/src/main/native-chat/agent-session-journal/journal-reducer.ts
+++ b/src/main/native-chat/agent-session-journal/journal-reducer.ts
@@ -9,7 +9,6 @@
 
 import type {
   AgentJournalAcceptanceReceipt,
-  AgentJournalItemBody,
   AgentJournalRenderItem,
   AgentJournalSnapshot,
   AgentJournalSubmission
@@ -272,26 +271,3 @@ export function renderJournalState(state: JournalReducerState): AgentJournalSnap
     submissions: [...state.submissions.values()].sort((a, b) => a.submittedAt - b.submittedAt)
   }
 }
-
-/** Blob digests one body points at. A retained row can outlive its render item
- *  (a tombstone drops the item), so compaction reads rows through this too. */
-export function blobDigestsInBody(body: AgentJournalItemBody, into: Set<string>): void {
-  if (body.kind === 'tool-call' && body.output?.truncated) {
-    into.add(body.output.digest)
-  }
-  if (body.kind === 'diff' && body.patch.truncated) {
-    into.add(body.patch.digest)
-  }
-  if (body.kind === 'status' && body.providerFrame?.payload.truncated) {
-    into.add(body.providerFrame.payload.digest)
-  }
-}
-
-/** Digests referenced by live rows, so compaction knows which blobs to keep. */
-export function referencedBlobDigests(state: JournalReducerState): Set<string> {
-  const digests = new Set<string>()
-  for (const item of state.items.values()) {
-    blobDigestsInBody(item.body, digests)
-  }
-  return digests
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-repair-disclosure.ts b/src/main/native-chat/agent-session-journal/journal-repair-disclosure.ts
new file mode 100644
index 00000000000..fee5edf142b
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-repair-disclosure.ts
@@ -0,0 +1,32 @@
+// What a repair tells the user it did.
+//
+// The identity is a constant because replay reads it back: an epoch holding
+// nothing but its anchor and this row is a repair that has not been
+// reconstructed yet, not a timeline.
+
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import type { AgentJournalItemIdentity } from '../../../shared/agent-session-journal-types'
+
+/** One stable identity, so a reopen upserts the same row instead of adding one. */
+export const JOURNAL_REPAIR_DISCLOSURE_IDENTITY: AgentJournalItemIdentity = {
+  provider: 'orca',
+  clientMessageId: 'journal-malformed-lines'
+}
+
+export const JOURNAL_REPAIR_DISCLOSURE_ITEM_ID = agentJournalItemKey(
+  JOURNAL_REPAIR_DISCLOSURE_IDENTITY
+)
+
+export type JournalRepairDisclosure = {
+  identity: AgentJournalItemIdentity
+  body: { kind: 'status'; text: string }
+}
+
+/** Disclosed when a repair skipped a row it could not read. */
+export function journalRepairDisclosure(input: { malformedRows: number }): JournalRepairDisclosure {
+  const lines = `${input.malformedRows} journal line${input.malformedRows === 1 ? '' : 's'}`
+  return {
+    identity: JOURNAL_REPAIR_DISCLOSURE_IDENTITY,
+    body: { kind: 'status', text: `${lines} could not be read` }
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-repair-marker.ts b/src/main/native-chat/agent-session-journal/journal-repair-marker.ts
new file mode 100644
index 00000000000..f9ef09e688d
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-repair-marker.ts
@@ -0,0 +1,69 @@
+// The standing demand for a rebuild that a repair leaves behind.
+//
+// A repair that empties the epoch republishes an `unreconcilable_prefix` anchor,
+// and replay reads that back as history still owed. A repair that KEEPS a prefix
+// has no such anchor to publish and — for a plain sequence gap — no malformed
+// row to disclose either, so nothing on disk would record that the deleted
+// suffix was never reconstructed. This marker is that record, written in the
+// SAME transaction as the deletion: a crash between the two would otherwise
+// leave the rows gone with nothing left asking for them back.
+//
+// It records the first sequence at which the epoch would hold content of its
+// own again, because it retires under exactly the rule the emptied-epoch anchor
+// takes: a fresh epoch carries the rebuild, and a session that writes past that
+// sequence owns the epoch and stops the retry.
+
+import type Database from '../../sqlite/sync-database'
+import { deleteJournalRowSuffix } from './journal-row-table'
+
+const SELECT_REPAIR = 'SELECT epoch, content_from FROM journal_repairs WHERE session_id = ?'
+const UPSERT_REPAIR = `INSERT INTO journal_repairs (session_id, epoch, content_from, repaired_at)
+VALUES (?, ?, ?, ?)
+ON CONFLICT(session_id) DO UPDATE SET
+  epoch = excluded.epoch, content_from = excluded.content_from, repaired_at = excluded.repaired_at`
+const DELETE_REPAIR = 'DELETE FROM journal_repairs WHERE session_id = ?'
+
+/**
+ * The sequence a pending repair on THIS epoch left free, or null when none is
+ * pending. Epoch-scoped: a marker raised on an epoch that has since been
+ * superseded says nothing about the live one.
+ */
+export function pendingJournalRepairSequence(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string
+): number | null {
+  const row = db.prepare(SELECT_REPAIR).get(sessionId) as
+    | { epoch?: string; content_from?: number }
+    | undefined
+  return row?.epoch === epoch ? (row.content_from ?? null) : null
+}
+
+/** Retires the marker. Called from inside the epoch transactions, whose new
+ *  epoch is the rebuilt history the marker was holding out for. */
+export function clearJournalRepairMarker(db: Database.Database, sessionId: string): void {
+  db.prepare(DELETE_REPAIR).run(sessionId)
+}
+
+/** Drop the rejected suffix and record that it is owed, atomically. */
+export function deleteJournalRepairedSuffix(input: {
+  db: Database.Database
+  sessionId: string
+  epoch: string
+  /** First sequence of the rejected suffix. */
+  fromSeq: number
+  /** First sequence left free once the suffix is gone. */
+  contentFrom: number
+  now: number
+}): number {
+  input.db.exec('BEGIN IMMEDIATE')
+  try {
+    const deleted = deleteJournalRowSuffix(input.db, input.sessionId, input.epoch, input.fromSeq)
+    input.db.prepare(UPSERT_REPAIR).run(input.sessionId, input.epoch, input.contentFrom, input.now)
+    input.db.exec('COMMIT')
+    return deleted
+  } catch (error) {
+    input.db.exec('ROLLBACK')
+    throw error
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-row-table.ts b/src/main/native-chat/agent-session-journal/journal-row-table.ts
new file mode 100644
index 00000000000..306b3b300f2
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-row-table.ts
@@ -0,0 +1,92 @@
+// Every statement the journal issues against `journal_rows` / `journal_sessions`.
+//
+// Each one is a prefix or range scan on the `(session_id, epoch, seq)` primary
+// key; there is no secondary index, and no `max(seq)` tip query — replay folds
+// the epoch to obtain `lastSequence`, so nothing needs the tip from SQL.
+// Columns are always named: `SELECT *` is uncacheable and can drop a column.
+
+import type Database from '../../sqlite/sync-database'
+import { serializeJournalRow, type JournalRow } from './journal-row-schema'
+
+export type JournalStoredRow = { epoch: string; seq: number; ts: number; rowJson: string }
+
+const SELECT_SESSION = 'SELECT epoch FROM journal_sessions WHERE session_id = ?'
+const UPSERT_SESSION = `INSERT INTO journal_sessions (session_id, epoch, updated_at)
+VALUES (?, ?, ?)
+ON CONFLICT(session_id) DO UPDATE SET epoch = excluded.epoch, updated_at = excluded.updated_at`
+const INSERT_ROW =
+  'INSERT INTO journal_rows (session_id, epoch, seq, ts, row_json) VALUES (?, ?, ?, ?, ?)'
+const SELECT_EPOCH_ROWS = `SELECT epoch, seq, ts, row_json FROM journal_rows
+WHERE session_id = ? AND epoch = ? ORDER BY seq ASC`
+const SELECT_ROWS_AFTER = `SELECT epoch, seq, ts, row_json FROM journal_rows
+WHERE session_id = ? AND epoch = ? AND seq > ? ORDER BY seq ASC`
+const DELETE_SUFFIX = 'DELETE FROM journal_rows WHERE session_id = ? AND epoch = ? AND seq >= ?'
+
+export function readJournalSessionEpoch(db: Database.Database, sessionId: string): string | null {
+  const row = db.prepare(SELECT_SESSION).get(sessionId) as { epoch?: string } | undefined
+  return row?.epoch ?? null
+}
+
+export function upsertJournalSessionRow(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string,
+  updatedAt: number
+): void {
+  db.prepare(UPSERT_SESSION).run(sessionId, epoch, updatedAt)
+}
+
+export function insertJournalRow(
+  db: Database.Database,
+  sessionId: string,
+  row: JournalRow
+): number {
+  const rowJson = serializeJournalRow(row)
+  db.prepare(INSERT_ROW).run(sessionId, row.epoch, row.seq, row.ts, rowJson)
+  return Buffer.byteLength(rowJson, 'utf8')
+}
+
+export function readJournalEpochRows(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string
+): JournalStoredRow[] {
+  return toStoredRows(db.prepare(SELECT_EPOCH_ROWS).all(sessionId, epoch))
+}
+
+export function readJournalRowsAfter(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string,
+  afterSeq: number
+): JournalStoredRow[] {
+  return toStoredRows(db.prepare(SELECT_ROWS_AFTER).all(sessionId, epoch, afterSeq))
+}
+
+/**
+ * Unqualified on purpose. One database per session means every row here belongs
+ * to this session, and the unqualified form takes SQLite's truncate
+ * optimization: measured at 0.26% of the database in WAL bytes where the
+ * `WHERE session_id = ?` form rewrote every emptied leaf at up to 99%.
+ */
+export function deleteAllJournalRows(db: Database.Database): void {
+  db.exec('DELETE FROM journal_rows')
+}
+
+/** Drop the rejected suffix a repair found, from `fromSeq` to the tip. */
+export function deleteJournalRowSuffix(
+  db: Database.Database,
+  sessionId: string,
+  epoch: string,
+  fromSeq: number
+): number {
+  const deleted = db.prepare(DELETE_SUFFIX).run(sessionId, epoch, fromSeq)
+  return Number(deleted.changes ?? 0)
+}
+
+function toStoredRows(rows: readonly unknown[]): JournalStoredRow[] {
+  return rows.map((entry) => {
+    const record = entry as { epoch: string; seq: number; ts: number; row_json: string }
+    return { epoch: record.epoch, seq: record.seq, ts: record.ts, rowJson: record.row_json }
+  })
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-row-writer-read-only-latch.test.ts b/src/main/native-chat/agent-session-journal/journal-row-writer-read-only-latch.test.ts
deleted file mode 100644
index 2b318bc5320..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-row-writer-read-only-latch.test.ts
+++ /dev/null
@@ -1,362 +0,0 @@
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import type { AgentJournalItemBody } from '../../../shared/agent-session-journal-types'
-import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
-import { readJournalBlob } from './journal-blob-store'
-import { appendJournalRows } from './journal-log-file'
-import { JournalLifecycleAdmission } from './journal-lifecycle-admission'
-import { JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES } from './journal-lifecycle-capacity'
-import { loadJournal } from './journal-open'
-import { boundPayload, DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
-import { journalRowByteLength, type JournalRow } from './journal-row-schema'
-import { JournalRowWriter } from './journal-row-writer'
-import { JournalAppendBudget } from './journal-write-guards'
-
-const SESSION_ID = 'session-1'
-
-function row(seq: number, ts: number): JournalRow {
-  return {
-    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-    epoch: 'epoch-1',
-    seq,
-    fence: 0,
-    ts,
-    kind: 'item',
-    itemId: 'item-1',
-    revision: 1,
-    body: { kind: 'status', text: 'ambiguous append' }
-  }
-}
-
-function rowWithBlob(seq: number, ts: number, output: ReturnType<typeof boundPayload>): JournalRow {
-  return {
-    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-    epoch: 'epoch-1',
-    seq,
-    fence: 0,
-    ts,
-    kind: 'item',
-    itemId: 'item-with-blob',
-    revision: 1,
-    body: {
-      kind: 'tool-call',
-      name: 'shell',
-      input: {},
-      state: 'completed',
-      output
-    }
-  }
-}
-
-function runningToolRow(seq: number, ts: number, itemId = 'running-tool'): JournalRow {
-  return {
-    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
-    epoch: 'epoch-1',
-    seq,
-    fence: 0,
-    ts,
-    kind: 'item',
-    itemId,
-    revision: 1,
-    body: runningToolBody()
-  }
-}
-
-function runningToolBody(): AgentJournalItemBody {
-  return { kind: 'tool-call', name: 'shell', input: {}, state: 'running' }
-}
-
-describe('journal row writer read-only latch', () => {
-  let root: string
-  let readOnly = false
-
-  beforeEach(async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-journal-row-writer-'))
-    readOnly = false
-  })
-
-  afterEach(async () => {
-    await rm(root, { recursive: true, force: true })
-  })
-
-  it('enforces the lifecycle append rate and allows a retry after the window', () => {
-    const appendWindowMs = 100
-    const budget = new JournalAppendBudget(SESSION_ID, {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      maxAppendsPerWindow: 1,
-      appendWindowMs
-    })
-
-    budget.assertLifecycle(row(1, 1), 0)
-    expect(() => budget.assertLifecycle(row(2, 1), 0)).toThrow(
-      expect.objectContaining({ code: 'journal_rate_exceeded' })
-    )
-    expect(() => budget.assertLifecycle(row(2, appendWindowMs + 1), 0)).not.toThrow()
-  })
-
-  it('refuses lifecycle reservations once aggregate append capacity is saturated', () => {
-    const admission = new JournalLifecycleAdmission(SESSION_ID, 1_000_000, (itemId) => itemId, 2)
-    expect(admission.reserve({ id: 'first', bytes: 1, appendSlots: 1 }, 0)).toBe(true)
-    expect(admission.reserve({ id: 'second', bytes: 1, appendSlots: 1 }, 0)).toBe(true)
-    expect(admission.reserve({ id: 'third', bytes: 1, appendSlots: 1 }, 0)).toBe(false)
-  })
-
-  function writerHarness(
-    overrides: {
-      limits?: typeof DEFAULT_JOURNAL_PAYLOAD_LIMITS
-      physicalBytes?: number
-      appendRows?: (journalDir: string, rows: readonly JournalRow[]) => Promise<void>
-      commit?: (row: JournalRow, physicalBytes: number) => void
-    } = {}
-  ) {
-    const limits = overrides.limits ?? DEFAULT_JOURNAL_PAYLOAD_LIMITS
-    const lifecycleAdmission = new JournalLifecycleAdmission(
-      SESSION_ID,
-      limits.maxSessionBytes,
-      (itemId) => itemId
-    )
-    let physicalBytes = overrides.physicalBytes ?? 0
-    let nextSequence = 1
-    const committedRows: JournalRow[] = []
-    const writer = new JournalRowWriter({
-      journalDir: root,
-      sessionId: SESSION_ID,
-      budget: new JournalAppendBudget(SESSION_ID, limits),
-      lifecycleAdmission,
-      autoCompact: false,
-      compaction: { minTailRows: 0, retainTailMs: 0 },
-      now: () => 1,
-      serialize: (run) => run(),
-      readOnly: () => readOnly,
-      setReadOnly: (value) => {
-        readOnly = value
-      },
-      physicalBytes: () => physicalBytes,
-      highestFence: () => 0,
-      nextSequence: () => nextSequence,
-      tailRows: () => committedRows,
-      referencedBlobDigests: () => new Set(),
-      compact: async () => undefined,
-      commit: (row, nextPhysicalBytes) => {
-        overrides.commit?.(row, nextPhysicalBytes)
-        committedRows.push(row)
-        physicalBytes = nextPhysicalBytes
-        nextSequence = row.seq + 1
-      },
-      ...(overrides.appendRows ? { appendRows: overrides.appendRows } : {})
-    })
-    return { writer, lifecycleAdmission, committedRows }
-  }
-
-  it('latches read-only when a post-append failure makes durability ambiguous', async () => {
-    let committed = false
-    const writer = new JournalRowWriter({
-      journalDir: root,
-      sessionId: 'session-1',
-      budget: new JournalAppendBudget('session-1', DEFAULT_JOURNAL_PAYLOAD_LIMITS),
-      lifecycleAdmission: new JournalLifecycleAdmission(
-        'session-1',
-        DEFAULT_JOURNAL_PAYLOAD_LIMITS.maxSessionBytes,
-        (itemId) => itemId
-      ),
-      autoCompact: false,
-      compaction: { minTailRows: 0, retainTailMs: 0 },
-      now: () => 1,
-      serialize: (run) => run(),
-      readOnly: () => readOnly,
-      setReadOnly: (value) => {
-        readOnly = value
-      },
-      physicalBytes: () => 0,
-      highestFence: () => 0,
-      nextSequence: () => 1,
-      tailRows: () => [],
-      referencedBlobDigests: () => new Set(),
-      compact: async () => undefined,
-      commit: () => {
-        committed = true
-      },
-      appendRows: async (journalDir, rows) => {
-        await appendJournalRows(journalDir, rows)
-        throw new Error('fsync failed after append')
-      }
-    })
-
-    await expect(writer.enqueue(row)).rejects.toThrow('fsync failed after append')
-
-    expect(readOnly).toBe(true)
-    expect(committed).toBe(false)
-    await expect(writer.enqueue(row)).rejects.toMatchObject({ code: 'journal_read_only' })
-  })
-
-  it('keeps blobs for a durable row when a post-append crash is reported', async () => {
-    const payload = 'durable blob payload'.repeat(2_000)
-    const bounded = boundPayload(payload, {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 32
-    })
-    const writer = new JournalRowWriter({
-      journalDir: root,
-      sessionId: 'session-1',
-      budget: new JournalAppendBudget('session-1', DEFAULT_JOURNAL_PAYLOAD_LIMITS),
-      lifecycleAdmission: new JournalLifecycleAdmission(
-        'session-1',
-        DEFAULT_JOURNAL_PAYLOAD_LIMITS.maxSessionBytes,
-        (itemId) => itemId
-      ),
-      autoCompact: false,
-      compaction: { minTailRows: 0, retainTailMs: 0 },
-      now: () => 1,
-      serialize: (run) => run(),
-      readOnly: () => readOnly,
-      setReadOnly: (value) => {
-        readOnly = value
-      },
-      physicalBytes: () => 0,
-      highestFence: () => 0,
-      nextSequence: () => 1,
-      tailRows: () => [],
-      referencedBlobDigests: () => new Set(),
-      compact: async () => undefined,
-      commit: () => undefined,
-      appendRows: async (journalDir, rows) => {
-        await appendJournalRows(journalDir, rows)
-        throw new Error('crash after row append')
-      }
-    })
-
-    await expect(
-      writer.enqueue(
-        (seq, ts) => rowWithBlob(seq, ts, bounded),
-        [{ digest: bounded.digest, payload }]
-      )
-    ).rejects.toThrow('crash after row append')
-
-    expect(readOnly).toBe(true)
-    await expect(writer.enqueue(row)).rejects.toMatchObject({ code: 'journal_read_only' })
-    expect(await readJournalBlob(root, bounded.digest)).toBe(payload)
-    const reopened = await loadJournal(root, 'session-1')
-    const item = reopened?.state.items.get('item-with-blob')
-    expect(item?.body).toMatchObject({
-      kind: 'tool-call',
-      output: { digest: bounded.digest, truncated: true }
-    })
-  })
-
-  it('does not leak a lifecycle reservation after budget refusal', async () => {
-    const probe = runningToolRow(1, 1)
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      maxSessionBytes: JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES + journalRowByteLength(probe) - 1
-    }
-    const { writer, lifecycleAdmission, committedRows } = writerHarness({ limits })
-
-    await expect(writer.enqueue((seq, ts) => runningToolRow(seq, ts))).rejects.toMatchObject({
-      code: 'journal_bound_exceeded'
-    })
-
-    expect(lifecycleAdmission.state).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-    await expect(writer.enqueue(row)).resolves.toMatchObject({ kind: 'item', itemId: 'item-1' })
-    expect(
-      committedRows.map((entry) => (entry.kind === 'item' ? entry.itemId : 'non-item'))
-    ).toEqual(['item-1'])
-  })
-
-  it('preflights existing durable-write temps before creating a blob or row', async () => {
-    const tempBytes = 512
-    const tempPath = join(root, 'log.jsonl.existing-write.tmp')
-    await writeFile(tempPath, 't'.repeat(tempBytes), 'utf8')
-    const probe = row(1, 1)
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      maxSessionBytes: tempBytes + journalRowByteLength(probe) - 1
-    }
-    const { writer, committedRows } = writerHarness({ limits })
-
-    await expect(writer.enqueue((seq, ts) => row(seq, ts))).rejects.toMatchObject({
-      code: 'journal_bound_exceeded'
-    })
-    expect(committedRows).toHaveLength(0)
-    expect(await readJournalBlob(root, 'a'.repeat(64))).toBeNull()
-  })
-
-  it('does not leak a lifecycle reservation after blob lookup failure', async () => {
-    const { writer, lifecycleAdmission } = writerHarness()
-    const digest = 'a'.repeat(64)
-    await writeFile(join(root, 'blobs'), 'not a directory', 'utf8')
-
-    await expect(
-      writer.enqueue((seq, ts) => runningToolRow(seq, ts), [{ digest, payload: 'payload' }])
-    ).rejects.toThrow()
-
-    expect(lifecycleAdmission.state).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-    await rm(join(root, 'blobs'), { force: true })
-    await expect(writer.enqueue((seq, ts) => runningToolRow(seq, ts))).resolves.toMatchObject({
-      kind: 'item',
-      itemId: 'running-tool'
-    })
-    expect(lifecycleAdmission.state).toEqual({
-      reservedBytes: JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES,
-      reservedAppendSlots: 1
-    })
-  })
-
-  it('rolls back ordinary append-rate reservation after blob preflight failure', async () => {
-    const limits = {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      maxAppendsPerWindow: 1,
-      appendWindowMs: 100
-    }
-    const { writer, committedRows } = writerHarness({ limits })
-    const payload = 'retryable blob payload'.repeat(100)
-    const bounded = boundPayload(payload, limits)
-    await writeFile(join(root, 'blobs'), 'not a directory', 'utf8')
-
-    await expect(
-      writer.enqueue(
-        (seq, ts) => rowWithBlob(seq, ts, bounded),
-        [{ digest: bounded.digest, payload }]
-      )
-    ).rejects.toThrow()
-
-    await rm(join(root, 'blobs'), { force: true })
-    await expect(
-      writer.enqueue(
-        (seq, ts) => rowWithBlob(seq, ts, bounded),
-        [{ digest: bounded.digest, payload }]
-      )
-    ).resolves.toMatchObject({ kind: 'item', itemId: 'item-with-blob' })
-    expect(committedRows).toHaveLength(1)
-  })
-
-  it('does not leak a lifecycle reservation after durable append failure', async () => {
-    const { writer, lifecycleAdmission } = writerHarness({
-      appendRows: async () => {
-        throw new Error('append failed before a durable row existed')
-      }
-    })
-
-    await expect(writer.enqueue((seq, ts) => runningToolRow(seq, ts))).rejects.toThrow(
-      'append failed before a durable row existed'
-    )
-
-    expect(readOnly).toBe(true)
-    expect(lifecycleAdmission.state).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-  })
-
-  it('does not leak a lifecycle reservation after reducer commit failure', async () => {
-    const { writer, lifecycleAdmission } = writerHarness({
-      commit: () => {
-        throw new Error('commit failed after durable append')
-      }
-    })
-
-    await expect(writer.enqueue((seq, ts) => runningToolRow(seq, ts))).rejects.toThrow(
-      'commit failed after durable append'
-    )
-
-    expect(lifecycleAdmission.state).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-  })
-})
diff --git a/src/main/native-chat/agent-session-journal/journal-row-writer.test.ts b/src/main/native-chat/agent-session-journal/journal-row-writer.test.ts
new file mode 100644
index 00000000000..dc08739a8bc
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-row-writer.test.ts
@@ -0,0 +1,94 @@
+// The write path's transaction.
+//
+// A transaction either commits or does not, so the old "a post-append failure
+// makes durability ambiguous" latch has nothing left to latch on: the case that
+// used to assert the latch asserts the rollback instead.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+import { openJournalDatabase, type OpenJournalDatabase } from './journal-database'
+import { journalDatabaseFile } from './journal-paths'
+import {
+  insertJournalRow,
+  readJournalEpochRows,
+  upsertJournalSessionRow
+} from './journal-row-table'
+import type { JournalRow } from './journal-row-schema'
+import { JournalRowWriter } from './journal-row-writer'
+
+const SESSION_ID = 'session-1'
+const EPOCH = 'epoch-1'
+
+function row(seq: number, ts: number): JournalRow {
+  return {
+    v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
+    epoch: EPOCH,
+    seq,
+    fence: 0,
+    ts,
+    kind: 'item',
+    itemId: 'item-1',
+    revision: 1,
+    body: { kind: 'status', text: 'plain append' }
+  }
+}
+
+describe('journal row writer', () => {
+  let root: string
+  let database: OpenJournalDatabase
+  let readOnly = false
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-journal-row-writer-'))
+    database = openJournalDatabase(journalDatabaseFile(root))
+    upsertJournalSessionRow(database.db, SESSION_ID, EPOCH, 1)
+    readOnly = false
+  })
+
+  afterEach(async () => {
+    try {
+      database.db.close()
+    } catch {
+      // Already closed by the case.
+    }
+    await rm(root, { recursive: true, force: true })
+  })
+
+  function writerHarness() {
+    const committedRows: JournalRow[] = []
+    let sequence = 1
+    const writer = new JournalRowWriter({
+      sessionId: SESSION_ID,
+      now: () => 1,
+      serialize: (run) => run(),
+      database: () => database,
+      readOnly: () => readOnly,
+      highestFence: () => 0,
+      nextSequence: () => sequence,
+      commit: (committed) => {
+        committedRows.push(committed)
+        sequence = committed.seq + 1
+      }
+    })
+    return { writer, committedRows }
+  }
+
+  it('rolls the transaction back and sets no latch when the insert fails', async () => {
+    const { writer, committedRows } = writerHarness()
+    // A row already occupies sequence 1, so the insert violates the primary key.
+    insertJournalRow(database.db, SESSION_ID, row(1, 1))
+
+    await expect(writer.enqueue(row)).rejects.toThrow()
+
+    expect(readOnly).toBe(false)
+    expect(committedRows).toHaveLength(0)
+    expect(readJournalEpochRows(database.db, SESSION_ID, EPOCH)).toHaveLength(1)
+    // Still writable: there is no ambiguity for a latch to protect against.
+    await expect(writer.enqueue((seq, ts) => row(seq + 1, ts))).resolves.toMatchObject({
+      kind: 'item'
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-row-writer.ts b/src/main/native-chat/agent-session-journal/journal-row-writer.ts
index 980275d4c72..85ff7da7a3f 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-writer.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-writer.ts
@@ -1,188 +1,42 @@
-import {
-  budgetPressurePolicy,
-  journalTailCanShedRows,
-  journalTailIsReadyToCompact,
-  type JournalCompactionPolicy
-} from './journal-compaction'
-import { journalBlobFileSize, putJournalBlob, removeJournalBlob } from './journal-blob-store'
-import { appendJournalRows } from './journal-log-file'
-import { blobDigestsInBody } from './journal-reducer'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import type { JournalLifecycleAdmission } from './journal-lifecycle-admission'
-import { journalRowByteLength, type JournalRow } from './journal-row-schema'
-import {
-  AgentSessionJournalError,
-  assertJournalFence,
-  assertJournalWritable,
-  type JournalAppendBudget
-} from './journal-write-guards'
-
-type JournalBlob = { digest: string; payload: string }
+import type Database from '../../sqlite/sync-database'
+import { insertJournalRow, upsertJournalSessionRow } from './journal-row-table'
+import type { JournalRow } from './journal-row-schema'
+import { assertJournalFence, assertJournalWritable } from './journal-write-guards'
 
 export type JournalRowWriterDeps = {
-  journalDir: string
   sessionId: string
-  budget: JournalAppendBudget
-  lifecycleAdmission: JournalLifecycleAdmission
-  autoCompact: boolean
-  compaction: JournalCompactionPolicy
   now: () => number
   serialize: <T>(run: () => Promise<T>) => Promise<T>
+  database: () => { db: Database.Database }
   readOnly: () => boolean
-  setReadOnly: (readOnly: boolean) => void
-  physicalBytes: () => number
   highestFence: () => number
   nextSequence: () => number
-  tailRows: () => readonly JournalRow[]
-  referencedBlobDigests: () => ReadonlySet<string>
-  compact: (now: number, policy: JournalCompactionPolicy) => Promise<void>
-  commit: (row: JournalRow, physicalBytes: number) => void
-  appendRows?: (journalDir: string, rows: readonly JournalRow[]) => Promise<void>
+  commit: (row: JournalRow) => void
 }
 
 export class JournalRowWriter {
   constructor(private readonly deps: JournalRowWriterDeps) {}
 
-  enqueue(
-    build: (seq: number, ts: number) => JournalRow,
-    blobs: readonly JournalBlob[] = []
-  ): Promise<JournalRow> {
+  enqueue(build: (seq: number, ts: number) => JournalRow): Promise<JournalRow> {
     return this.deps.serialize(async () => {
       assertJournalWritable(this.deps.readOnly(), this.deps.sessionId)
-      const ts = this.deps.now()
-      const row = build(this.deps.nextSequence(), ts)
+      const row = build(this.deps.nextSequence(), this.deps.now())
       assertJournalFence(row.fence, this.deps.highestFence())
-      // The in-memory counter is an optimization, not the quota source of
-      // truth: a prior crash may have left a durable-write temp beside the
-      // finals, and a concurrent/retried opener may have materialized files
-      // after the last commit callback. Recount before any speculative write
-      // so the peak check includes those bytes.
-      let physicalBytes = Math.max(
-        this.deps.physicalBytes(),
-        await journalDirectoryBytes(this.deps.journalDir)
-      )
-      const admission = this.deps.lifecycleAdmission.prepare(row, physicalBytes)
-      const newBlobs = await uniqueNewBlobs(this.deps.journalDir, blobs)
-      const blobBytes = newBlobs.reduce(
-        (total, blob) => total + Buffer.byteLength(blob.payload, 'utf8'),
-        0
-      )
-      const budgetCompaction = budgetPressurePolicy(this.deps.compaction)
-      let effectiveSize = physicalBytes + blobBytes + admission.protectedBytes
-      if (
-        this.deps.autoCompact &&
-        this.deps.budget.wouldExceedSize(row, effectiveSize) &&
-        journalTailCanShedRows(this.deps.tailRows(), budgetCompaction, ts)
-      ) {
-        await this.deps.compact(ts, budgetCompaction)
-        physicalBytes = this.deps.physicalBytes()
-        effectiveSize = physicalBytes + blobBytes + admission.protectedBytes
-      }
-      const lifecycleRateCheckpoint = admission.lifecycleCovered
-        ? this.deps.budget.checkpoint()
-        : null
-      const appendRateCheckpoint = this.deps.budget.checkpoint()
-      let committed = false
-      let appendMayHaveLanded = false
+      const { db } = this.deps.database()
+      db.exec('BEGIN IMMEDIATE')
       try {
-        if (admission.lifecycleCovered) {
-          this.deps.budget.assertReservedLifecycle(row, effectiveSize)
-        } else {
-          this.deps.budget.assert(row, ts, effectiveSize)
-        }
-        const appendedBytes = blobBytes + journalRowByteLength(row)
-        if (
-          physicalBytes + appendedBytes >
-          this.deps.budget.maxSessionBytes - admission.protectedBytes
-        ) {
-          throw new AgentSessionJournalError(
-            'journal_bound_exceeded',
-            `agent-session journal for ${this.deps.sessionId} reached its ${this.deps.budget.maxSessionBytes}-byte physical bound`
-          )
-        }
-        await this.commitFiles(row, newBlobs, () => {
-          appendMayHaveLanded = true
-        })
-        physicalBytes += appendedBytes
-        this.deps.commit(row, physicalBytes)
-        this.deps.lifecycleAdmission.commit(admission)
-        committed = true
+        insertJournalRow(db, this.deps.sessionId, row)
+        upsertJournalSessionRow(db, this.deps.sessionId, row.epoch, row.ts)
+        db.exec('COMMIT')
       } catch (error) {
-        if (!committed && lifecycleRateCheckpoint) {
-          this.deps.budget.restore(lifecycleRateCheckpoint)
-        }
-        if (!committed && !appendMayHaveLanded) {
-          this.deps.budget.restore(appendRateCheckpoint)
-        }
+        db.exec('ROLLBACK')
         throw error
       }
-      if (
-        this.deps.autoCompact &&
-        journalTailIsReadyToCompact(this.deps.tailRows(), this.deps.compaction, ts)
-      ) {
-        await this.deps.compact(ts, this.deps.compaction)
-      }
+      // COMMIT landed, so the row is durable: adopt it before anything that can
+      // fail. Rejecting here instead would leave the next append reusing a
+      // sequence the table already holds.
+      this.deps.commit(row)
       return row
     })
   }
-
-  private async commitFiles(
-    row: JournalRow,
-    blobs: readonly JournalBlob[],
-    markAppendLanded: () => void
-  ): Promise<void> {
-    const persisted: string[] = []
-    let appendMayHaveLanded = false
-    try {
-      for (const blob of blobs) {
-        await putJournalBlob(this.deps.journalDir, blob.digest, blob.payload)
-        persisted.push(blob.digest)
-      }
-      appendMayHaveLanded = true
-      markAppendLanded()
-      await (this.deps.appendRows ?? appendJournalRows)(this.deps.journalDir, [row])
-    } catch (error) {
-      if (appendMayHaveLanded) {
-        this.deps.setReadOnly(true)
-        throw error
-      }
-      const retained = this.referencedBlobDigestsIncludingTail()
-      for (const digest of persisted) {
-        if (!retained.has(digest)) {
-          await removeJournalBlob(this.deps.journalDir, digest)
-        }
-      }
-      throw error
-    }
-  }
-
-  private referencedBlobDigestsIncludingTail(): Set<string> {
-    const retained = new Set(this.deps.referencedBlobDigests())
-    for (const row of this.deps.tailRows()) {
-      if (row.kind === 'item') {
-        blobDigestsInBody(row.body, retained)
-      } else if (row.kind === 'lifecycle-batch') {
-        for (const mutation of row.mutations) {
-          if (mutation.kind === 'item') {
-            blobDigestsInBody(mutation.body, retained)
-          }
-        }
-      }
-    }
-    return retained
-  }
-}
-
-async function uniqueNewBlobs(
-  journalDir: string,
-  blobs: readonly JournalBlob[]
-): Promise<JournalBlob[]> {
-  const unique = new Map(blobs.map((blob) => [blob.digest, blob]))
-  const result: JournalBlob[] = []
-  for (const blob of unique.values()) {
-    if ((await journalBlobFileSize(journalDir, blob.digest)) === null) {
-      result.push(blob)
-    }
-  }
-  return result
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-store-close.test.ts b/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
new file mode 100644
index 00000000000..960c65a638a
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
@@ -0,0 +1,259 @@
+// `close()`: enqueue-time admission, and the fulfilled/rejected split.
+//
+// The two failures this file exists to prevent: an append enqueued in the same
+// turn as `close()` being rejected AFTER the queue accepted it, and a rejected
+// close leaving a connection live but permanently unreachable through the API.
+
+import { access, mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalItemIdentity,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import { journalDatabaseFile } from './journal-paths'
+import type { AgentSessionJournal } from './journal-store'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: 'thread-1' }
+}
+
+let root: string
+const journals = createTrackedJournalOpener()
+
+function item(ordinal: number): AgentJournalItemIdentity {
+  return { provider: 'codex', threadId: 'thread-1', turnId: 'turn-1', ordinal }
+}
+
+function body(value: string): AgentJournalItemBody {
+  return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
+}
+
+function openJournal(): Promise<AgentSessionJournal> {
+  return journals.open({ identity: IDENTITY, journalDir: root })
+}
+
+/** Replaces the store's own release step, which is the only step that can
+ *  reject the attempt in production. */
+function injectReleaseFailure(journal: AgentSessionJournal): {
+  calls: () => number
+  stopFailing: () => void
+} {
+  const internals = journal as unknown as { database: { db: { close: () => void } } }
+  const release = internals.database.db.close.bind(internals.database.db)
+  let calls = 0
+  let failing = true
+  internals.database.db.close = () => {
+    calls += 1
+    if (failing) {
+      throw new Error('injected release failure')
+    }
+    release()
+  }
+  return { calls: () => calls, stopFailing: () => (failing = false) }
+}
+
+async function exists(path: string): Promise<boolean> {
+  return access(path)
+    .then(() => true)
+    .catch(() => false)
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-close-'))
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('closed-state admission happens at enqueue', () => {
+  it('completes a write enqueued in the same turn as the close', async () => {
+    const journal = await openJournal()
+    const append = journal.appendItem(item(1), body('before'), { fence: 1 })
+    const closed = journal.close()
+
+    await expect(append).resolves.toBeDefined()
+    await expect(closed).resolves.toBeUndefined()
+    const reopened = await openJournal()
+    expect(reopened.snapshot().items).toHaveLength(1)
+  })
+
+  it('refuses a write offered while the close is still in flight, without queueing it', async () => {
+    const journal = await openJournal()
+    const closing = journal.close()
+    const refused = journal.appendItem(item(1), body('during'), { fence: 1 })
+
+    // The rejection is available before the close step has run: it never joined
+    // the queue, so nothing is ever chained behind a close.
+    await expect(refused).rejects.toMatchObject({ code: 'journal_closed' })
+    await expect(closing).resolves.toBeUndefined()
+  })
+
+  it('refuses every write entry point after the close has settled', async () => {
+    const journal = await openJournal()
+    await journal.close()
+    const settle = (attempt: Promise<unknown>): Promise<unknown> =>
+      attempt.then(
+        () => new Error('resolved instead of refusing'),
+        (error: unknown) => error
+      )
+    const refusals = [
+      settle(journal.appendItem(item(1), body('after'), { fence: 1 })),
+      settle(journal.appendTombstone(item(3), { fence: 1 })),
+      settle(
+        journal.appendSubmission({
+          clientMessageId: 'cm_1',
+          payloadFingerprint: 'f',
+          body: { kind: 'message', role: 'user', blocks: [] },
+          fence: 1
+        })
+      ),
+      settle(journal.resolveDispatch({ clientMessageId: 'cm_1', state: 'rejected', fence: 1 })),
+      settle(
+        journal.appendLifecycleBatch({
+          settlementId: 'settle',
+          fence: 1,
+          mutations: [{ kind: 'item', identity: item(4), body: body('x') }]
+        })
+      ),
+      settle(journal.rollEpoch('handle_forked', 1)),
+      settle(journal.replaceEpochItems('handle_forked', 1, []))
+    ]
+    for (const refusal of refusals) {
+      expect(await refusal).toMatchObject({ code: 'journal_closed' })
+    }
+  })
+
+  // The property part 1 rests on: every entry point reaches the gate in the
+  // caller's own turn, so a refusal never advances the queue.
+  it('rejects without waiting for the queue to advance', async () => {
+    const journal = await openJournal()
+    const inFlight = journal.appendItem(item(1), body('admitted'), { fence: 1 })
+    const closing = journal.close()
+
+    // Settles while the admitted append is still running: it reached the gate in
+    // the caller's own turn and never joined the queue behind it.
+    await expect(journal.appendItem(item(2), body('later'), { fence: 1 })).rejects.toMatchObject({
+      code: 'journal_closed'
+    })
+    await expect(inFlight).resolves.toBeDefined()
+    await expect(closing).resolves.toBeUndefined()
+  })
+
+  it('resolves a second close as a no-op without running the routine again', async () => {
+    const journal = await openJournal()
+    const injected = injectReleaseFailure(journal)
+    injected.stopFailing()
+    await journal.close()
+    expect(injected.calls()).toBe(1)
+
+    await expect(journal.close()).resolves.toBeUndefined()
+    expect(injected.calls()).toBe(1)
+  })
+})
+
+describe('a rejected close is a real retry', () => {
+  it('retries the release, releases the handle, and then goes terminal', async () => {
+    const journal = await openJournal()
+    await journal.appendItem(item(1), body('durable'), { fence: 1 })
+    const injected = injectReleaseFailure(journal)
+
+    await expect(journal.close()).rejects.toThrow('injected release failure')
+    expect(injected.calls()).toBe(1)
+
+    // Write-closed anyway: retry exists to release the OS handle, never to
+    // resurrect the store.
+    await expect(journal.appendItem(item(2), body('after'), { fence: 1 })).rejects.toMatchObject({
+      code: 'journal_closed'
+    })
+
+    injected.stopFailing()
+    await expect(journal.close()).resolves.toBeUndefined()
+    // The retry RE-ENTERED the release. A completion flag on it would skip the
+    // one step that had not succeeded, and the handle would never be released.
+    expect(injected.calls()).toBe(2)
+    const dbPath = journalDatabaseFile(root)
+    expect(await exists(`${dbPath}-wal`)).toBe(false)
+    expect(await exists(`${dbPath}-shm`)).toBe(false)
+
+    // Fulfilment is terminal: a third call must not issue a second db.close(),
+    // which `node:sqlite` answers with ERR_INVALID_STATE.
+    await expect(journal.close()).resolves.toBeUndefined()
+    expect(injected.calls()).toBe(2)
+  })
+
+  it('hands concurrent callers the same outcome', async () => {
+    const journal = await openJournal()
+    const injected = injectReleaseFailure(journal)
+    const first = journal.close()
+    const second = journal.close()
+    await expect(first).rejects.toThrow('injected release failure')
+    await expect(second).rejects.toThrow('injected release failure')
+    expect(injected.calls()).toBe(1)
+  })
+})
+
+// The two rejected readings of the contract, as models, because a green run on
+// the real store proves nothing about what the alternatives would have done.
+describe('negative controls', () => {
+  class UnconditionalNoOpClose {
+    calls = 0
+    private called = false
+    constructor(private readonly release: () => void) {}
+    async close(): Promise<void> {
+      if (this.called) {
+        return
+      }
+      this.called = true
+      this.calls += 1
+      this.release()
+    }
+  }
+
+  class AlwaysReentrantClose {
+    calls = 0
+    async close(release: () => void): Promise<void> {
+      this.calls += 1
+      release()
+    }
+  }
+
+  it('an unconditional second-call no-op leaves a failed close unreleasable', async () => {
+    let failing = true
+    let released = false
+    const model = new UnconditionalNoOpClose(() => {
+      if (failing) {
+        throw new Error('injected release failure')
+      }
+      released = true
+    })
+    await expect(model.close()).rejects.toThrow('injected release failure')
+    failing = false
+    await expect(model.close()).resolves.toBeUndefined()
+    // Fulfilled without the routine running: the handle is still held.
+    expect(model.calls).toBe(1)
+    expect(released).toBe(false)
+  })
+
+  it('an always-reentrant close issues the second db.close() that throws', async () => {
+    let open = true
+    const release = (): void => {
+      if (!open) {
+        throw new Error('ERR_INVALID_STATE: database is not open')
+      }
+      open = false
+    }
+    const model = new AlwaysReentrantClose()
+    await model.close(release)
+    await expect(model.close(release)).rejects.toThrow('database is not open')
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-store-close.ts b/src/main/native-chat/agent-session-journal/journal-store-close.ts
new file mode 100644
index 00000000000..f1b56d6a0db
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-close.ts
@@ -0,0 +1,106 @@
+// Releasing the one SQLite connection a store holds for its lifetime.
+//
+// The contract, in five parts:
+//
+//  1. Closed-state admission happens at ENQUEUE, once, and is permanent. The
+//     flag lives on the store's write gate; it is never cleared, not by a
+//     rejection and not by a retry. A store that failed to close is still a
+//     store nobody may write to.
+//  2. The close step shares the write queue and BYPASSES that gate — a close
+//     that consulted the flag it had just set would refuse itself. Same queue
+//     orders the release behind admitted work; separate gate lets it run.
+//  3. One in-flight attempt, shared: concurrent callers get the same outcome.
+//  4. Fulfilled is TERMINAL; rejected is not. A later call after fulfilment is a
+//     genuine no-op — `DatabaseSync.close()` throws `ERR_INVALID_STATE` on a
+//     second call, so re-entering after success is the bug, not the fix.
+//  5. The release is deliberately unguarded. There is no way to ask whether a
+//     `db.close()` that threw released the handle first, and guarding the step
+//     would skip it on retry — guaranteeing a permanent leak in exactly the case
+//     where it did not release.
+
+import { AgentSessionJournalError } from './journal-write-guards'
+import type Database from '../../sqlite/sync-database'
+
+/**
+ * The write queue and its closed gate. Admission is checked at ENQUEUE and is
+ * permanent; the close step reaches the same queue through `serializePastGate`,
+ * because a close that consulted the flag it had just set would refuse itself.
+ */
+export class JournalWriteQueue {
+  private writes: Promise<unknown> = Promise.resolve()
+  private closed = false
+
+  constructor(private readonly sessionId: string) {}
+
+  markClosed(): void {
+    this.closed = true
+  }
+
+  serialize<T>(run: () => Promise<T>): Promise<T> {
+    if (this.closed) {
+      return Promise.reject(
+        new AgentSessionJournalError(
+          'journal_closed',
+          `agent-session journal for ${this.sessionId} is closed`
+        )
+      )
+    }
+    return this.serializePastGate(run)
+  }
+
+  serializePastGate<T>(run: () => Promise<T>): Promise<T> {
+    const started = this.writes.then(run)
+    this.writes = started.catch(() => undefined)
+    return started
+  }
+}
+
+export class JournalConnectionCloser {
+  private released = false
+  private inFlight: Promise<void> | null = null
+
+  constructor(
+    private readonly deps: {
+      connection: () => Database.Database | null
+      /** Chains onto the store's write queue past the closed gate. */
+      enqueue: (run: () => Promise<void>) => Promise<void>
+    }
+  ) {}
+
+  get isReleased(): boolean {
+    return this.released
+  }
+
+  close(): Promise<void> {
+    if (this.released) {
+      return Promise.resolve()
+    }
+    if (this.inFlight) {
+      return this.inFlight
+    }
+    const attempt = this.deps
+      .enqueue(() => this.release())
+      .then(
+        () => {
+          this.released = true
+          this.inFlight = null
+        },
+        (error: unknown) => {
+          this.inFlight = null
+          throw error
+        }
+      )
+    this.inFlight = attempt
+    return attempt
+  }
+
+  private async release(): Promise<void> {
+    const db = this.deps.connection()
+    if (!db) {
+      return
+    }
+    // SQLite checkpoints and removes the WAL itself when the last connection to
+    // the database closes.
+    db.close()
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts b/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
new file mode 100644
index 00000000000..a4ff455b31f
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
@@ -0,0 +1,88 @@
+// Wiring for the store's collaborators.
+//
+// Split out of the store itself so the class stays a description of the public
+// surface rather than sixty lines of constructor plumbing.
+
+import type {
+  AgentJournalCursor,
+  AgentSessionJournalIdentity
+} from '../../../shared/agent-session-journal-types'
+import type { OpenJournalDatabase } from './journal-database'
+import { JournalEpochController } from './journal-epoch-controller'
+import { JournalItemAppender } from './journal-item-appender'
+import { JournalLifecycleBatchAppender } from './journal-lifecycle-batch-appender'
+import type { JournalLoad } from './journal-open'
+import type { JournalReducerState } from './journal-reducer'
+import { JournalRowWriter } from './journal-row-writer'
+import { restoreJournalStore } from './journal-store-restore'
+import type { JournalRow } from './journal-row-schema'
+import type { AgentSessionJournal } from './journal-store'
+
+export type JournalStoreHost = {
+  identity: AgentSessionJournalIdentity
+  journalDir: string
+  now: () => number
+  mintEpoch: () => string
+  serialize: <T>(run: () => Promise<T>) => Promise<T>
+  database: () => OpenJournalDatabase
+  state: () => JournalReducerState
+  readOnly: () => boolean
+  setReadOnly: (readOnly: boolean) => void
+  cursor: () => AgentJournalCursor
+  adopt: (loaded: JournalLoad) => void
+  commit: (row: JournalRow) => void
+  /** A caller-supplied load, which suppresses replay entirely when present. */
+  loaded: () => JournalLoad | null | undefined
+  malformedRows: () => number
+  setMalformedRows: (count: number) => void
+  journal: () => AgentSessionJournal
+  enqueue: (build: (seq: number, ts: number) => JournalRow) => Promise<JournalRow>
+}
+
+export type JournalStoreCollaborators = {
+  rowWriter: JournalRowWriter
+  epochController: JournalEpochController
+  itemAppender: JournalItemAppender
+  lifecycleBatchAppender: JournalLifecycleBatchAppender
+  /** Restores the store's state from disk. Owned here because it needs the same
+   *  collaborators the constructor just built. */
+  restore: () => Promise<void>
+}
+
+export function createJournalStoreCollaborators(host: JournalStoreHost): JournalStoreCollaborators {
+  const epochController = new JournalEpochController({
+    identity: host.identity,
+    now: host.now,
+    mintEpoch: host.mintEpoch,
+    serialize: host.serialize,
+    database: host.database,
+    readOnly: host.readOnly,
+    setReadOnly: host.setReadOnly,
+    highestFence: () => host.state().highestFence,
+    cursor: host.cursor,
+    adopt: host.adopt
+  })
+  return {
+    epochController,
+    restore: () => restoreJournalStore(host, { epochController }),
+    rowWriter: new JournalRowWriter({
+      sessionId: host.identity.sessionId,
+      now: host.now,
+      serialize: host.serialize,
+      database: host.database,
+      readOnly: host.readOnly,
+      highestFence: () => host.state().highestFence,
+      nextSequence: () => host.state().lastSequence + 1,
+      commit: host.commit
+    }),
+    itemAppender: new JournalItemAppender({
+      state: host.state,
+      enqueue: host.enqueue
+    }),
+    lifecycleBatchAppender: new JournalLifecycleBatchAppender({
+      state: host.state,
+      cursor: host.cursor,
+      enqueue: host.enqueue
+    })
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store-contracts.ts b/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
index 45a723a0f23..22e3a4c7cca 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
@@ -6,19 +6,13 @@ import type {
   AgentJournalResetReason,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import type { JournalCompactionPolicy } from './journal-compaction'
 import type { JournalLoad } from './journal-open'
-import type { JournalPayloadLimits } from './journal-payload-bounds'
 import type { JournalLifecycleMutationInput } from './journal-row-builders'
 import type { JournalRow } from './journal-row-schema'
 
 export type AgentSessionJournalOptions = {
   identity: AgentSessionJournalIdentity
   journalDir: string
-  limits?: JournalPayloadLimits
-  compaction?: JournalCompactionPolicy
-  /** Compact as the tail grows. Defaults on: without it the log never sheds. */
-  autoCompact?: boolean
   now?: () => number
   mintEpoch?: () => string
   /** A caller that already loaded the journal can avoid reading the same files again. */
@@ -45,7 +39,6 @@ export type JournalAppendResult = {
 }
 
 export type JournalItemAppendOptions = { fence: number; observedAt?: number; recovered?: true }
-export type JournalBlobInput = { digest: string; payload: string }
 export type JournalTombstoneInput = { fence: number }
 
 export type JournalLifecycleBatchInput = {
diff --git a/src/main/native-chat/agent-session-journal/journal-store-open.ts b/src/main/native-chat/agent-session-journal/journal-store-open.ts
index 67d05c0b0c3..e002048a094 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-open.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-open.ts
@@ -1,16 +1,14 @@
-import type { AgentJournalSnapshot } from '../../../shared/agent-session-journal-types'
-import { malformedRowsDisclosure, quarantineCorruptSuffix } from './journal-corruption-quarantine'
-import { ensureJournalDir } from './journal-log-file'
-import { loadJournal, type JournalLoad } from './journal-open'
-import { assertJournalPhysicalCapacity, journalDirectoryBytes } from './journal-physical-quota'
-import type { JournalRow } from './journal-row-schema'
+import { mkdir } from 'node:fs/promises'
+import type { JournalLoad } from './journal-open'
+import { journalRepairDisclosure, type JournalRepairDisclosure } from './journal-repair-disclosure'
+
+export async function ensureJournalDir(journalDir: string): Promise<void> {
+  await mkdir(journalDir, { recursive: true })
+}
 
 export function journalStoreLoadedFields(loaded: JournalLoad) {
   return {
     state: loaded.state,
-    tailRows: loaded.tailRows,
-    compactedThrough: loaded.compactedThrough,
-    sizeBytes: loaded.sizeBytes,
     readOnly: loaded.readOnly,
     malformedRows: loaded.malformedRows
   }
@@ -18,60 +16,47 @@ export function journalStoreLoadedFields(loaded: JournalLoad) {
 
 export async function openJournalStoreState(input: {
   journalDir: string
-  sessionId: string
-  maxBytes: number
   loaded: JournalLoad | null | undefined
-  start: () => Promise<void>
+  replay: () => JournalLoad | null
+  /** Drops the rejected suffix and records the rebuild it owes, in ONE
+   *  transaction. Corruption is not preserved; replay keeps reporting `corrupt`
+   *  until provider history republishes the epoch or the session writes past
+   *  `contentFrom`, the first sequence the repair left free. */
+  deleteSuffix: (fromSeq: number, contentFrom: number) => number
+  start: () => void
   adopt: (loaded: JournalLoad) => void
-  tailRows: () => readonly JournalRow[]
-  snapshot: () => AgentJournalSnapshot
-  rebuildLifecycle: (snapshot: AgentJournalSnapshot, physicalBytes: number) => void
+  /** Republishes an anchor row for an epoch a repair emptied. */
+  publishRepairEpoch: () => void
   appendDisclosure: (
-    identity: ReturnType<typeof malformedRowsDisclosure>['identity'],
-    body: ReturnType<typeof malformedRowsDisclosure>['body'],
+    identity: JournalRepairDisclosure['identity'],
+    body: JournalRepairDisclosure['body'],
     fence: number
   ) => Promise<unknown>
   highestFence: () => number
   malformedRows: () => number
+  setMalformedRows: (count: number) => void
   readOnly: () => boolean
-  setPhysicalBytes: (bytes: number) => void
 }): Promise<void> {
-  await ensureJournalDir(input.journalDir)
-  input.setPhysicalBytes(
-    await assertJournalPhysicalCapacity({
-      journalDir: input.journalDir,
-      sessionId: input.sessionId,
-      maxBytes: input.maxBytes
-    })
-  )
-  const loaded =
-    input.loaded !== undefined
-      ? input.loaded
-      : await loadJournal(input.journalDir, input.sessionId, { maxBytes: input.maxBytes })
+  const loaded = input.loaded !== undefined ? input.loaded : input.replay()
   if (!loaded) {
-    await input.start()
-    input.setPhysicalBytes(await journalDirectoryBytes(input.journalDir))
+    input.start()
     return
   }
   input.adopt(loaded)
-  if (loaded.corrupt && !loaded.readOnly) {
-    await quarantineCorruptSuffix(input.journalDir, input.tailRows(), loaded.quarantineRemainder, {
-      sessionId: input.sessionId,
-      maxBytes: input.maxBytes
-    })
+  if (loaded.truncateFrom !== undefined && !loaded.readOnly) {
+    input.deleteSuffix(loaded.truncateFrom, loaded.state.lastSequence + 1)
   }
-  let physicalBytes = await journalDirectoryBytes(input.journalDir)
-  input.setPhysicalBytes(physicalBytes)
-  // A future-schema/read-only journal is inspection-only. Its reduced state is
-  // intentionally empty, and rebuilding reservations from it would mutate the
-  // in-memory quota model (and could influence later admission decisions).
-  if (!loaded.readOnly) {
-    input.rebuildLifecycle(input.snapshot(), physicalBytes)
+  // A repair that took every live row leaves the epoch with no anchor. Publish
+  // one before anything can append into it: an ordinary row at sequence 1 would
+  // replay as a clean timeline and hide that the history was never rebuilt.
+  if (!loaded.readOnly && loaded.state.lastSequence === 0) {
+    input.publishRepairEpoch()
+    // The replacement epoch adopts a clean load; what this open's repair did is
+    // still the answer `repair` and the disclosure below owe the caller.
+    input.setMalformedRows(loaded.malformedRows)
   }
   if (input.malformedRows() > 0 && !input.readOnly()) {
-    const disclosure = malformedRowsDisclosure(input.malformedRows())
+    const disclosure = journalRepairDisclosure({ malformedRows: input.malformedRows() })
     await input.appendDisclosure(disclosure.identity, disclosure.body, input.highestFence())
   }
-  physicalBytes = await journalDirectoryBytes(input.journalDir)
-  input.setPhysicalBytes(physicalBytes)
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-store-restore.ts b/src/main/native-chat/agent-session-journal/journal-store-restore.ts
new file mode 100644
index 00000000000..53683a797d1
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-restore.ts
@@ -0,0 +1,49 @@
+// Bringing a store's in-memory state up from disk.
+//
+// Split out of the store for the same reason its collaborators were: this is the
+// ORDERING between replay, suffix repair and disclosure, and none of it belongs
+// to the store's public surface. Every step here reads or writes through the
+// same host the collaborators use, so the store keeps the state and this owns
+// the sequence.
+
+import type { JournalEpochController } from './journal-epoch-controller'
+import { replayJournal } from './journal-open'
+import type { JournalStoreHost } from './journal-store-collaborators'
+import { openJournalStoreState } from './journal-store-open'
+import { deleteJournalRepairedSuffix } from './journal-repair-marker'
+
+export function restoreJournalStore(
+  host: JournalStoreHost,
+  collaborators: { epochController: JournalEpochController }
+): Promise<void> {
+  return openJournalStoreState({
+    journalDir: host.journalDir,
+    loaded: host.loaded(),
+    replay: () => {
+      const opened = host.database()
+      return replayJournal(opened.db, opened.readOnly, host.identity.sessionId)
+    },
+    deleteSuffix: (fromSeq, contentFrom) =>
+      deleteJournalRepairedSuffix({
+        db: host.database().db,
+        sessionId: host.identity.sessionId,
+        epoch: host.state().epoch,
+        fromSeq,
+        contentFrom,
+        now: host.now()
+      }),
+    start: () => collaborators.epochController.start('session_created', 0),
+    // `unreconcilable_prefix` is the durable statement that this epoch exists
+    // because a repair emptied one: replay reads it back and keeps asking for
+    // provider history until the timeline is rebuilt or the session writes.
+    publishRepairEpoch: () =>
+      collaborators.epochController.start('unreconcilable_prefix', host.state().highestFence),
+    adopt: host.adopt,
+    appendDisclosure: (identity, body, fence) =>
+      host.journal().appendItem(identity, body, { fence }),
+    highestFence: () => host.state().highestFence,
+    malformedRows: host.malformedRows,
+    setMalformedRows: host.setMalformedRows,
+    readOnly: host.readOnly
+  })
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts b/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts
index d78adeb30f5..df34ef73e73 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-schema.test.ts
@@ -1,4 +1,11 @@
-import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+// Two independent version axes, both fail closed.
+//
+//   `PRAGMA user_version`  the DB SHAPE, known before the first read
+//   the row's `v` field    the row BODY shape, met during replay
+//
+// A newer build can change either alone, so both are needed.
+
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -7,8 +14,12 @@ import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import { JOURNAL_LOG_FILE, JOURNAL_SNAPSHOT_FILE } from './journal-log-file'
-import { openAgentSessionJournal } from './journal-store-factory'
+import type Database from '../../sqlite/sync-database'
+import { openJournalDatabase } from './journal-database'
+import { JOURNAL_DB_SCHEMA_VERSION } from './journal-database-schema'
+import { journalDatabaseFile } from './journal-paths'
+import type { AgentSessionJournal } from './journal-store'
+import { createTrackedJournalOpener } from './journal-store-test-open'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -20,6 +31,7 @@ const IDENTITY: AgentSessionJournalIdentity = {
 
 let root: string
 let clock = 1_000
+const journals = createTrackedJournalOpener()
 
 function tick(): number {
   clock += 1
@@ -34,87 +46,139 @@ function body(value: string): AgentJournalItemBody {
   return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
 }
 
-async function open(overrides: Partial<Parameters<typeof openAgentSessionJournal>[0]> = {}) {
-  return openAgentSessionJournal({
+function open(): Promise<AgentSessionJournal> {
+  return journals.open({
     identity: IDENTITY,
     journalDir: root,
     now: tick,
-    mintEpoch: () => `epoch-${clock}`,
-    ...overrides
+    mintEpoch: () => `epoch-${clock}`
+  })
+}
+
+async function withDatabase(run: (db: Database.Database) => void): Promise<void> {
+  const opened = openJournalDatabase(journalDatabaseFile(root))
+  try {
+    run(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** Appends a raw `row_json` the way a newer build or a bad write would leave it. */
+async function appendRawRow(epoch: string, seq: number, rowJson: string): Promise<void> {
+  await withDatabase((db) => {
+    db.prepare(
+      'INSERT INTO journal_rows (session_id, epoch, seq, ts, row_json) VALUES (?, ?, ?, ?, ?)'
+    ).run(IDENTITY.sessionId, epoch, seq, 1, rowJson)
   })
 }
 
 beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-journal-'))
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-schema-'))
   clock = 1_000
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
-describe('schema', () => {
-  it('quarantines an invalid compacted snapshot without replacing its tail', async () => {
-    const journal = await open({ compaction: { minTailRows: 2, retainTailMs: 0 } })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    await journal.compact()
-    const epoch = journal.epoch
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const invalidSnapshot = '{"folded history":'
-    await writeFile(snapshotPath, invalidSnapshot, 'utf-8')
-    const retainedTail = await readFile(logPath, 'utf-8')
-    expect(retainedTail).not.toContain('"kind":"epoch"')
-
-    const reopened = await open()
-    expect(reopened.epoch).toBe(epoch)
-    expect(await readFile(logPath, 'utf-8')).toBe(retainedTail)
-    const quarantined = (await readdir(root)).find((name) =>
-      name.startsWith('quarantine-snapshot-')
-    )
-    expect(quarantined).toBeDefined()
-    expect(await readFile(join(root, quarantined!), 'utf-8')).toBe(invalidSnapshot)
-  })
-
-  it('degrades to read-only on a row from a newer build, without skipping or deleting it', async () => {
+describe('axis 1: the database shape', () => {
+  it('latches read-only on a newer user_version and writes nothing', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const future = JSON.stringify({
-      v: 99,
-      kind: 'item',
-      epoch: journal.epoch,
-      seq: 99,
-      fence: 1,
-      ts: 1,
-      itemId: 'future',
-      revision: 1,
-      body: { kind: 'status', text: 'from a newer host' }
-    })
-    const before = await readFile(logPath, 'utf-8')
-    await writeFile(logPath, `${before}${future}\n`, 'utf-8')
+    await journal.close()
+    await withDatabase((db) => db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 1}`))
+    const before = await stat(journalDatabaseFile(root))
 
     const reopened = await open()
     expect(reopened.isReadOnly).toBe(true)
     await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
       code: 'journal_read_only'
     })
-    await expect(reopened.compact()).rejects.toMatchObject({ code: 'journal_read_only' })
-    expect(reopened.readSince({ epoch: reopened.epoch, sequence: 0 })).toEqual({
-      ok: false,
-      reset: 'schema_unreadable'
+    // The file this build must not touch is byte-identical afterwards.
+    await reopened.close()
+    expect((await stat(journalDatabaseFile(root))).size).toBe(before.size)
+    await withDatabase((db) => {
+      expect(db.pragma('user_version', { simple: true })).toBe(JOURNAL_DB_SCHEMA_VERSION + 1)
     })
-    // The unreadable row is still on disk, and nothing was compacted past it.
-    expect(await readFile(logPath, 'utf-8')).toContain('"v":99')
   })
 
-  it('skips a malformed line without giving up the journal, and discloses the skip', async () => {
+  it('refuses the schema escape hatch on a latched store', async () => {
+    const journal = await open()
+    await journal.close()
+    await withDatabase((db) => db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 1}`))
+
+    const reopened = await open()
+    // With byte-copy quarantine gone there is nothing for `schema_unreadable` to
+    // do differently, so it takes the same writable guard as every other reason.
+    await expect(reopened.rollEpoch('schema_unreadable', 2)).rejects.toMatchObject({
+      code: 'journal_read_only'
+    })
+    expect(reopened.isReadOnly).toBe(true)
+  })
+
+  it('migrates an older user_version forward on reopen', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    await writeFile(logPath, `${await readFile(logPath, 'utf-8')}{not json\n`, 'utf-8')
+    await journal.close()
+    await withDatabase((db) => db.pragma('user_version = 0'))
+
+    const reopened = await open()
+    expect(reopened.isReadOnly).toBe(false)
+    expect(reopened.snapshot().items).toHaveLength(1)
+    await reopened.close()
+    await withDatabase((db) => {
+      expect(db.pragma('user_version', { simple: true })).toBe(JOURNAL_DB_SCHEMA_VERSION)
+    })
+  })
+})
+
+describe('axis 2: the row body shape', () => {
+  it('degrades to read-only on a row from a newer build, without skipping it', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    const epoch = journal.epoch
+    const nextSeq = journal.cursor().sequence + 1
+    await journal.close()
+    await appendRawRow(
+      epoch,
+      nextSeq,
+      JSON.stringify({
+        v: 99,
+        kind: 'item',
+        epoch,
+        seq: nextSeq,
+        fence: 1,
+        ts: 1,
+        itemId: 'future',
+        revision: 1,
+        body: { kind: 'status', text: 'from a newer build' }
+      })
+    )
+
+    const reopened = await open()
+    expect(reopened.isReadOnly).toBe(true)
+    await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
+      code: 'journal_read_only'
+    })
+    await reopened.close()
+    // Never skipped, never deleted: the row this build cannot read is still there.
+    await withDatabase((db) => {
+      const stored = db.prepare('SELECT row_json FROM journal_rows WHERE seq = ?').get(nextSeq) as {
+        row_json: string
+      }
+      expect(stored.row_json).toContain('"v":99')
+    })
+  })
+
+  it('skips a malformed row without giving up the journal, and discloses the skip', async () => {
+    const journal = await open()
+    await journal.appendItem(item(0), body('a'), { fence: 1 })
+    const epoch = journal.epoch
+    const nextSeq = journal.cursor().sequence + 1
+    await journal.close()
+    await appendRawRow(epoch, nextSeq, '{not json')
 
     const reopened = await open()
     expect(reopened.isReadOnly).toBe(false)
@@ -132,10 +196,12 @@ describe('schema', () => {
   it('keeps one disclosure row across reopens instead of stacking duplicates', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    await writeFile(logPath, `${await readFile(logPath, 'utf-8')}{not json\n`, 'utf-8')
+    const epoch = journal.epoch
+    const nextSeq = journal.cursor().sequence + 1
+    await journal.close()
+    await appendRawRow(epoch, nextSeq, '{not json')
 
-    await open()
+    await open().then((first) => first.close())
     const reopened = await open()
     expect(
       reopened
@@ -146,168 +212,32 @@ describe('schema', () => {
     ).toHaveLength(1)
   })
 
-  it('repairs a torn tail before acknowledging the next append', async () => {
+  it('reopens a journal holding an admitted malformed-percent item id without throwing', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const intact = await readFile(logPath, 'utf-8')
-    await writeFile(logPath, intact.slice(0, -1), 'utf-8')
-
-    await journal.appendItem(item(1), body('b'), { fence: 1 })
-    const reopened = await open()
-    expect(reopened.snapshot().items.map((entry) => entry.body)).toEqual([body('a'), body('b')])
-  })
-
-  // Transcripts are full of emoji and CJK, so the repair's file offsets must be
-  // bytes: string indices would truncate mid-character and corrupt the prefix.
-  it('repairs a torn tail whose rows contain multi-byte characters', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('안녕하세요 🌊 café'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const intact = await readFile(logPath)
-    // Kill mid-row: keep the complete first row plus a fragment of the second.
-    const torn = Buffer.concat([intact, Buffer.from('{"seq":2,"kind":"it', 'utf-8')])
-    await writeFile(logPath, torn)
-
-    await journal.appendItem(item(1), body('b'), { fence: 1 })
-    const reopened = await open()
-    expect(reopened.snapshot().items.map((entry) => entry.body)).toEqual([
-      body('안녕하세요 🌊 café'),
-      body('b')
-    ])
-  })
-
-  it('degrades to read-only when the snapshot comes from a newer schema', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-
-    const reopened = await open()
-    expect(reopened.isReadOnly).toBe(true)
-    await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
-      code: 'journal_read_only'
-    })
-  })
-
-  it('preserves a future-version snapshot with an unknown body kind in place instead of quarantining it', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    // The version advances because bodies changed: a valid newer snapshot
-    // carries kinds this build cannot parse and must stay unreadable in place.
-    snapshot.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'future-render-kind', payload: { anything: true } },
-        sequence: 1,
-        observedAt: 1_000
-      }
-    ]
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-
-    const reopened = await open()
-    const entries = await readdir(root)
-    expect(entries.some((name) => name.startsWith('quarantine-'))).toBe(false)
-    expect(entries.includes(JOURNAL_SNAPSHOT_FILE)).toBe(true)
-    expect(reopened.isReadOnly).toBe(true)
-    expect(reopened.snapshot().items).toHaveLength(0)
-    await expect(reopened.appendItem(item(1), body('b'), { fence: 1 })).rejects.toMatchObject({
-      code: 'journal_read_only'
-    })
-  })
-
-  it('keeps the future-version snapshot bytes when the schema escape hatch rolls the epoch', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    snapshot.items = [
-      {
-        itemId: 'codex:thread-1:turn-1:1',
-        revision: 1,
-        body: { kind: 'future-render-kind', payload: { anything: true } },
-        sequence: 1,
-        observedAt: 1_000
-      }
-    ]
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-    const reopened = await open()
-    // Still live in place before the explicit escape hatch runs.
-    expect((await readdir(root)).some((name) => name.startsWith('quarantine-'))).toBe(false)
-
-    await reopened.rollEpoch('schema_unreadable', 2)
-    expect(reopened.isReadOnly).toBe(false)
-    const quarantine = (await readdir(root)).find((name) => name.startsWith('quarantine-'))
-    expect(quarantine).toBeDefined()
-    expect(await readFile(join(root, quarantine!), 'utf-8')).toContain('future-render-kind')
-  })
-
-  it('reopens a log holding an admitted malformed-percent item id without throwing', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const logPath = join(root, JOURNAL_LOG_FILE)
+    const epoch = journal.epoch
+    const nextSeq = journal.cursor().sequence + 1
+    await journal.close()
     // `parseJournalRow` admits any string itemId, so replay must degrade a
     // malformed percent key to an opaque id instead of throwing URIError.
-    const malformedKeyRow = JSON.stringify({
-      v: 1,
-      epoch: journal.epoch,
-      seq: journal.cursor().sequence + 1,
-      fence: 1,
-      ts: 1,
-      kind: 'item',
-      itemId: '%',
-      revision: 1,
-      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] }
-    })
-    await writeFile(logPath, `${await readFile(logPath, 'utf-8')}${malformedKeyRow}\n`, 'utf-8')
+    await appendRawRow(
+      epoch,
+      nextSeq,
+      JSON.stringify({
+        v: 1,
+        epoch,
+        seq: nextSeq,
+        fence: 1,
+        ts: 1,
+        kind: 'item',
+        itemId: '%',
+        revision: 1,
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] }
+      })
+    )
 
     const reopened = await open()
     expect(reopened.isReadOnly).toBe(false)
     expect(reopened.snapshot().items.some((entry) => entry.itemId === '%')).toBe(true)
   })
-
-  it('allows the explicit schema-unreadable epoch escape hatch while preserving the old files', async () => {
-    const journal = await open()
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    const snapshotPath = join(root, JOURNAL_SNAPSHOT_FILE)
-    const snapshot = JSON.parse(await readFile(snapshotPath, 'utf-8')) as Record<string, unknown>
-    snapshot.v = 99
-    await writeFile(snapshotPath, JSON.stringify(snapshot), 'utf-8')
-    const reopened = await open()
-
-    await reopened.rollEpoch('schema_unreadable', 2)
-    expect(reopened.isReadOnly).toBe(false)
-    expect(reopened.snapshot().items).toHaveLength(0)
-    expect((await readdir(root)).some((name) => name.startsWith('quarantine-'))).toBe(true)
-  })
-
-  it('keeps the unreadable log suffix in the schema escape quarantine', async () => {
-    const journal = await open()
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const future = JSON.stringify({
-      v: 99,
-      kind: 'item',
-      epoch: journal.epoch,
-      seq: 2,
-      fence: 1,
-      ts: 1,
-      itemId: 'future',
-      revision: 1,
-      body: { kind: 'status', text: 'preserve these bytes' }
-    })
-    await writeFile(logPath, `${await readFile(logPath, 'utf-8')}${future}\n`, 'utf-8')
-    const reopened = await open()
-
-    await reopened.rollEpoch('schema_unreadable', 2)
-    const quarantine = (await readdir(root)).find((name) => name.startsWith('quarantine-'))
-    expect(quarantine).toBeDefined()
-    expect(await readFile(join(root, quarantine!), 'utf-8')).toContain('preserve these bytes')
-  })
 })
diff --git a/src/main/native-chat/agent-session-journal/journal-store-test-open.ts b/src/main/native-chat/agent-session-journal/journal-store-test-open.ts
new file mode 100644
index 00000000000..fc8bce5af39
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-store-test-open.ts
@@ -0,0 +1,34 @@
+// Shared tracked-open helper for journal tests.
+//
+// Tracking every opened INSTANCE rather than a variable is the point: `close()`
+// is idempotent, a module-level `journal` binding can be reassigned to a second
+// store mid-suite, and `allSettled` means one failing close cannot skip the rest
+// or the directory removal behind it.
+
+import type { AgentSessionJournal } from './journal-store'
+import type { AgentSessionJournalOptions } from './journal-store-contracts'
+import { openAgentSessionJournal } from './journal-store-factory'
+
+export type TrackedJournalOpener = {
+  open: (options: AgentSessionJournalOptions) => Promise<AgentSessionJournal>
+  track: <T extends AgentSessionJournal>(journal: T) => T
+  closeAll: () => Promise<void>
+}
+
+export function createTrackedJournalOpener(): TrackedJournalOpener {
+  const opened: AgentSessionJournal[] = []
+  return {
+    open: async (options) => {
+      const journal = await openAgentSessionJournal(options)
+      opened.push(journal)
+      return journal
+    },
+    track: (journal) => {
+      opened.push(journal)
+      return journal
+    },
+    closeAll: async () => {
+      await Promise.allSettled(opened.splice(0).map((journal) => journal.close()))
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store.test.ts b/src/main/native-chat/agent-session-journal/journal-store.test.ts
index 9ff37774d27..97eac02fe75 100644
--- a/src/main/native-chat/agent-session-journal/journal-store.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store.test.ts
@@ -1,4 +1,4 @@
-import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, readdir, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -11,24 +11,17 @@ import {
   boundJournalKeyComponent,
   MAX_JOURNAL_KEY_COMPONENT_CHARS
 } from '../../../shared/agent-session-journal-item-key'
-import { readJournalBlob } from './journal-blob-store'
-import { JOURNAL_LOG_FILE, JOURNAL_SNAPSHOT_FILE } from './journal-log-file'
 import { loadJournal } from './journal-open'
 import {
   boundInlineText,
   boundPayload,
   DEFAULT_JOURNAL_PAYLOAD_LIMITS
 } from './journal-payload-bounds'
-import { journalDirectoryFor, journalPathSegment } from './journal-paths'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import type { JournalLifecycleMutationInput } from './journal-row-builders'
+import { journalDatabaseFile, journalDirectoryFor, journalPathSegment } from './journal-paths'
 import { AgentSessionJournalError, type AgentSessionJournal } from './journal-store'
-import { openAgentSessionJournal } from './journal-store-factory'
-import {
-  JOURNAL_DISPATCH_RESERVATION_BYTES,
-  JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES,
-  JOURNAL_TURN_TERMINAL_RESERVATION_BYTES
-} from './journal-lifecycle-capacity'
+import type { openAgentSessionJournal } from './journal-store-factory'
+import { createTrackedJournalOpener } from './journal-store-test-open'
+import type Database from '../../sqlite/sync-database'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -54,8 +47,10 @@ function body(value: string): AgentJournalItemBody {
   return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: value }] }
 }
 
+const journals = createTrackedJournalOpener()
+
 async function open(overrides: Partial<Parameters<typeof openAgentSessionJournal>[0]> = {}) {
-  return openAgentSessionJournal({
+  return journals.open({
     identity: IDENTITY,
     journalDir: root,
     now: tick,
@@ -70,6 +65,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -151,14 +147,12 @@ describe('fences', () => {
 })
 
 describe('replay', () => {
-  it('adopts a caller-provided load without reading the journal files again', async () => {
+  it('adopts a caller-provided load without replaying the rows again', async () => {
     const journal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
     const loaded = await loadJournal(root, IDENTITY.sessionId)
     expect(loaded).not.toBeNull()
-
-    await rm(join(root, JOURNAL_LOG_FILE), { force: true })
-    await rm(join(root, JOURNAL_SNAPSHOT_FILE), { force: true })
+    await journal.close()
 
     const reopened = await open({ loaded })
     expect(reopened.snapshot()).toEqual(journal.snapshot())
@@ -200,208 +194,27 @@ describe('replay', () => {
     expect(reopened.snapshot().items).toHaveLength(0)
   })
 
-  it('preserves the intact prefix and quarantines a corrupt suffix', async () => {
+  it('keeps the intact prefix and drops the rejected suffix', async () => {
     const journal = await open()
     for (let index = 0; index < 4; index += 1) {
       await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
     }
     const before = journal.epoch
-    const logPath = join(root, JOURNAL_LOG_FILE)
-    const lines = (await readFile(logPath, 'utf-8')).split('\n').filter(Boolean)
-    await writeFile(logPath, `${[...lines.slice(0, 2), ...lines.slice(3)].join('\n')}\n`, 'utf-8')
+    await journal.close()
+    await withJournalDatabase(root, (db) => {
+      db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(3)
+    })
 
     const reopened = await open()
     expect(reopened.epoch).toBe(before)
     expect(reopened.snapshot().items.map((entry) => entry.body)).toEqual([body('m0')])
-    const files = await readdir(root)
-    expect(files.some((name) => name.startsWith('quarantine-'))).toBe(true)
-  })
-})
-
-describe('automatic compaction', () => {
-  // Production passes no policy and never called compact(), so the log only
-  // ever grew — until the size bound refused every append for good.
-  it('compacts on append once the retention window has rows to shed', async () => {
-    const policy = { minTailRows: 2, retainTailMs: 0 }
-    const journal = await open({ compaction: policy })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    expect(journal.compactionBoundary).toBeGreaterThan(0)
-    // The log sheds instead of growing with every append (7 = epoch row + 6).
-    const log = await readFile(join(root, JOURNAL_LOG_FILE), 'utf-8')
-    expect(log.trim().split('\n').length).toBeLessThan(7)
-    // Nothing is lost: the folded prefix is served from the snapshot.
-    expect(journal.snapshot().items).toHaveLength(6)
-  })
-
-  it('does not rewrite the log while every row is inside the retention window', async () => {
-    const journal = await open({ compaction: { minTailRows: 2, retainTailMs: 60_000 } })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    expect(journal.compactionBoundary).toBe(0)
-  })
-
-  it('can be turned off explicitly', async () => {
-    const journal = await open({
-      autoCompact: false,
-      compaction: { minTailRows: 2, retainTailMs: 0 }
+    // Sequences 4 and 5 are VALID rows that the gap at 3 made unreplayable.
+    // Nothing preserves them; recovery rebuilds the epoch from provider history.
+    await withJournalDatabase(root, (db) => {
+      const rows = db.prepare('SELECT seq FROM journal_rows ORDER BY seq').all()
+      expect(rows.map((row) => (row as { seq: number }).seq)).toEqual([1, 2])
     })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    expect(journal.compactionBoundary).toBe(0)
-  })
-
-  it('refuses an append when a tail shorter than the row floor cannot make room', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 900 },
-      // The tail never reaches the floor, so honouring it would shed nothing.
-      compaction: { minTailRows: 512, retainTailMs: 10_000 }
-    })
-    let rejected = 0
-    for (let index = 0; index < 20; index += 1) {
-      try {
-        await journal.appendItem(item(index), body('x'.repeat(96)), { fence: 1 })
-      } catch (error) {
-        expect(error).toMatchObject({ code: 'journal_bound_exceeded' })
-        rejected += 1
-      }
-    }
-    expect(rejected).toBeGreaterThan(0)
-  })
-
-  it('refuses once the retained snapshot itself reaches the session bound', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 10_000 },
-      compaction: { minTailRows: 10, retainTailMs: 2 * 60 * 60 * 1000 }
-    })
-    let rejected = 0
-    for (let index = 0; index < 30; index += 1) {
-      try {
-        await journal.appendItem(item(index), body('x'.repeat(128)), { fence: 1 })
-      } catch (error) {
-        expect(error).toMatchObject({ code: 'journal_bound_exceeded' })
-        rejected += 1
-      }
-    }
-
-    expect(rejected).toBeGreaterThan(0)
-    expect(journal.snapshot().items.length).toBeLessThan(30)
-  })
-
-  it('keeps the newest rows resumable while shedding under budget pressure', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 10_000 },
-      compaction: { minTailRows: 10, retainTailMs: 2 * 60 * 60 * 1000 }
-    })
-    for (let index = 0; index < 30; index += 1) {
-      await journal.appendItem(item(index), body('x'.repeat(64)), { fence: 1 })
-    }
-
-    // The window yields oldest-first, never wholesale: the latest append is
-    // still in the log, so a client resuming from it does not reload.
-    const log = (await readFile(join(root, JOURNAL_LOG_FILE), 'utf-8')).trim().split('\n')
-    expect(log.length).toBeGreaterThan(0)
-    expect(log.at(-1)).toContain('"seq"')
-  })
-})
-
-describe('compaction and retention', () => {
-  it('preserves the highest fence across compaction and reopen', async () => {
-    const journal = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    await journal.appendItem(item(0), body('a'), { fence: 7 })
-    await journal.compact()
-    const reopened = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    await expect(reopened.appendItem(item(1), body('stale'), { fence: 6 })).rejects.toMatchObject({
-      code: 'journal_stale_fence'
-    })
-  })
-
-  it('preserves tombstones across compaction and reopen', async () => {
-    const journal = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    await journal.appendItem(item(0), body('a'), { fence: 1 })
-    await journal.appendTombstone(item(0), { fence: 1 })
-    await journal.compact()
-    const reopened = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    await reopened.appendItem(item(0), body('stale'), { fence: 1 })
-    expect(reopened.snapshot().items).toHaveLength(0)
-  })
-
-  it('folds the prefix into the snapshot and keeps serving the retained tail', async () => {
-    const journal = await open({ compaction: { minTailRows: 2, retainTailMs: 0 } })
-    for (let index = 0; index < 6; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    const rendered = journal.snapshot()
-    const tip = journal.cursor()
-    await journal.compact()
-
-    expect(journal.snapshot()).toEqual(rendered)
-    expect(journal.readSince({ epoch: tip.epoch, sequence: 1 })).toEqual({
-      ok: false,
-      reset: 'cursor_compacted'
-    })
-    const nearTip = journal.readSince({ epoch: tip.epoch, sequence: tip.sequence - 1 })
-    expect(nearTip.ok && nearTip.rows).toHaveLength(1)
-
-    const reopened = await open({ compaction: { minTailRows: 2, retainTailMs: 0 } })
-    expect(reopened.snapshot()).toEqual(rendered)
-    expect(reopened.compactionBoundary).toBe(tip.sequence)
-  })
-
-  it('publishes the snapshot and its tail as one write, so a crash before the log rewrite loses nothing', async () => {
-    const journal = await open({ compaction: { minTailRows: 2, retainTailMs: 0 } })
-    for (let index = 0; index < 5; index += 1) {
-      await journal.appendItem(item(index), body(`m${index}`), { fence: 1 })
-    }
-    const rendered = journal.snapshot()
-    const logBefore = await readFile(join(root, JOURNAL_LOG_FILE), 'utf-8')
-    await journal.compact()
-    const persistedSnapshot = JSON.parse(
-      await readFile(join(root, JOURNAL_SNAPSHOT_FILE), 'utf-8')
-    ) as { tail: unknown[] }
-    expect(persistedSnapshot.tail).toHaveLength(2)
-    // Simulate the crash: the snapshot landed, the truncation did not.
-    await writeFile(join(root, JOURNAL_LOG_FILE), logBefore, 'utf-8')
-
-    const reopened = await open()
-    expect(reopened.snapshot()).toEqual(rendered)
-    expect(reopened.snapshot().items).toHaveLength(5)
-  })
-
-  it('prunes blobs no live row references and keeps the ones that survive', async () => {
-    const journal = await open({ compaction: { minTailRows: 1, retainTailMs: 0 } })
-    const kept = boundPayload('k'.repeat(64), {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 8
-    })
-    const dropped = boundPayload('d'.repeat(64), {
-      ...DEFAULT_JOURNAL_PAYLOAD_LIMITS,
-      inlineHeadBytes: 8
-    })
-    const { putJournalBlob } = await import('./journal-blob-store')
-    await putJournalBlob(root, kept.digest, 'k'.repeat(64))
-    await putJournalBlob(root, dropped.digest, 'd'.repeat(64))
-    await journal.appendItem(
-      item(0),
-      { kind: 'tool-call', name: 'bash', input: {}, state: 'completed', output: kept },
-      { fence: 1 }
-    )
-    await journal.compact()
-
-    expect(await readJournalBlob(root, kept.digest)).toBe('k'.repeat(64))
-    expect(await readJournalBlob(root, dropped.digest)).toBeNull()
-  })
-
-  it('refuses a blob name that is not a bare digest, on either slash', async () => {
-    const { putJournalBlob } = await import('./journal-blob-store')
-    // A corrupt or crafted row must not steer a read or a write out of the store.
-    for (const name of ['../../escape', '..\\..\\escape', 'nested/name', 'NOTHEX']) {
-      expect(await readJournalBlob(root, name)).toBeNull()
-      await expect(putJournalBlob(root, name, 'payload')).rejects.toThrow('sha256 digest')
-    }
+    expect(reopened.repair).toEqual({ malformedRows: 0 })
   })
 })
 
@@ -429,244 +242,9 @@ describe('bounds', () => {
     expect(bounded.head).toBe('small')
     expect(boundInlineText('small', DEFAULT_JOURNAL_PAYLOAD_LIMITS).text).toBe('small')
   })
-
-  it('refuses a single row larger than the per-session size bound', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 2_000 }
-    })
-    // Shedding the whole tail still cannot make room, so the bound holds.
-    await expect(
-      journal.appendItem(item(0), body('x'.repeat(4_096)), { fence: 1 })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-  })
-
-  it('refuses an append past the per-session size bound when compaction is off', async () => {
-    const journal = await open({
-      autoCompact: false,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 2_000 }
-    })
-    await expect(
-      (async () => {
-        for (let index = 0; index < 50; index += 1) {
-          await journal.appendItem(item(index), body('x'.repeat(64)), { fence: 1 })
-        }
-      })()
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-  })
-
-  it('refuses an append past the per-window rate bound', async () => {
-    const journal = await open({
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxAppendsPerWindow: 3, appendWindowMs: 60_000 }
-    })
-    await expect(
-      (async () => {
-        for (let index = 0; index < 10; index += 1) {
-          await journal.appendItem(item(index), body('x'), { fence: 1 })
-        }
-      })()
-    ).rejects.toMatchObject({ code: 'journal_rate_exceeded' })
-  })
-
-  it('charges unique blobs and abandoned staging files to one physical quota', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 8_000 }
-    const journal = await open({ limits, autoCompact: false })
-    const payload = 'z'.repeat(1_200)
-    const bounded = boundPayload(payload, { ...limits, inlineHeadBytes: 8 })
-    const toolBody: AgentJournalItemBody = {
-      kind: 'tool-call',
-      name: 'command',
-      input: {},
-      state: 'completed',
-      output: bounded
-    }
-
-    await journal.appendItemWithBlobs(item(1), toolBody, [{ digest: bounded.digest, payload }], {
-      fence: 1
-    })
-    const afterFirst = await journalDirectoryBytes(root)
-    await journal.appendItemWithBlobs(item(2), toolBody, [{ digest: bounded.digest, payload }], {
-      fence: 1
-    })
-    const afterDuplicate = await journalDirectoryBytes(root)
-
-    expect(afterDuplicate - afterFirst).toBeLessThan(payload.length)
-    expect(await readdir(join(root, 'blobs'))).toEqual([bounded.digest])
-    expect(afterDuplicate).toBeLessThanOrEqual(limits.maxSessionBytes)
-
-    await writeFile(join(root, 'log.jsonl.abandoned.tmp'), 's'.repeat(2_000), 'utf8')
-    const physical = await journalDirectoryBytes(root)
-    await expect(
-      open({ limits: { ...limits, maxSessionBytes: physical - 1 } })
-    ).rejects.toMatchObject({ code: 'journal_bound_exceeded' })
-  })
-
-  it('uses a running tool reservation when its authoritative blob cannot fit', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 220 * 1024 }
-    const journal = await open({ limits, autoCompact: false })
-    await journal.appendItem(
-      item(1),
-      { kind: 'tool-call', name: 'command', input: {}, state: 'running' },
-      { fence: 1 }
-    )
-    for (let ordinal = 10; ordinal < 100; ordinal += 1) {
-      try {
-        await journal.appendItem(item(ordinal), body('f'.repeat(4_000)), { fence: 1 })
-      } catch (error) {
-        expect(error).toMatchObject({ code: 'journal_bound_exceeded' })
-        break
-      }
-    }
-    const payload = 'o'.repeat(100 * 1024)
-    const bounded = boundPayload(payload, { ...limits, inlineHeadBytes: 16 * 1024 })
-
-    await journal.appendItemWithBlobs(
-      item(1),
-      {
-        kind: 'tool-call',
-        name: 'command',
-        input: {},
-        state: 'completed',
-        output: bounded
-      },
-      [{ digest: bounded.digest, payload }],
-      { fence: 1 }
-    )
-
-    const tool = journal.snapshot().items.find((entry) => entry.itemId.includes('turn-1:1'))
-    expect(tool?.body).toEqual({
-      kind: 'tool-call',
-      name: 'command',
-      input: {},
-      state: 'completed'
-    })
-    expect(
-      journal
-        .snapshot()
-        .items.some(
-          (entry) =>
-            entry.body.kind === 'status' && entry.body.text.includes('could not be retained')
-        )
-    ).toBe(true)
-    expect(await readJournalBlob(root, bounded.digest)).toBeNull()
-    expect(journal.lifecycleCapacityState()).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-  })
-
-  it('keeps cached physical bytes aligned after blob dedupe and compaction', async () => {
-    const limits = { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 45_000 }
-    const journal = await open({
-      limits,
-      autoCompact: false,
-      compaction: { minTailRows: 0, retainTailMs: 0 }
-    })
-    const payload = 'p'.repeat(20_000)
-    const bounded = boundPayload(payload, { ...limits, inlineHeadBytes: 8 })
-    const toolBody: AgentJournalItemBody = {
-      kind: 'tool-call',
-      name: 'command',
-      input: {},
-      state: 'completed',
-      output: bounded
-    }
-
-    await journal.appendItemWithBlobs(item(1), toolBody, [{ digest: bounded.digest, payload }], {
-      fence: 1
-    })
-    await journal.appendItemWithBlobs(item(2), toolBody, [{ digest: bounded.digest, payload }], {
-      fence: 1
-    })
-    await journal.compact(tick() + 10, { minTailRows: 0, retainTailMs: 0 })
-    const compactedBytes = await journalDirectoryBytes(root)
-    expect(compactedBytes).toBeLessThan(limits.maxSessionBytes)
-
-    await journal.appendItem(item(3), body('after compaction'), { fence: 1 })
-
-    expect(await journalDirectoryBytes(root)).toBeLessThanOrEqual(limits.maxSessionBytes)
-    expect(await readdir(join(root, 'blobs'))).toEqual([bounded.digest])
-  })
 })
 
 describe('lifecycle batches', () => {
-  it('uses a reserved append slot after ordinary rate pressure', async () => {
-    const journal = await open({
-      autoCompact: false,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxAppendsPerWindow: 1, appendWindowMs: 60_000 }
-    })
-    const identity: AgentJournalItemIdentity = {
-      provider: 'orca',
-      clientMessageId: 'reserved-prompt'
-    }
-    const pending: AgentJournalItemBody = {
-      kind: 'approval',
-      title: 'Run a command?',
-      detail: null,
-      options: [{ id: 'accept', label: 'Allow' }],
-      resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
-    }
-
-    // The pending row spends the only ordinary slot while reserving its
-    // terminal append slot for recovery.
-    await journal.appendLifecycleBatch({
-      settlementId: 'reserved-start',
-      fence: 1,
-      mutations: [{ kind: 'item', identity, body: pending }]
-    })
-    await expect(
-      journal.appendItem(
-        identity,
-        {
-          ...pending,
-          resolution: {
-            state: 'resolved',
-            selectedOptionId: 'accept',
-            resolvedBy: 'test',
-            resolvedAt: 1
-          }
-        },
-        { fence: 1 }
-      )
-    ).resolves.toBeDefined()
-  })
-
-  it('rate-limits an unreserved lifecycle batch', async () => {
-    const journal = await open({
-      autoCompact: false,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxAppendsPerWindow: 1, appendWindowMs: 60_000 }
-    })
-    const mutation = (id: string): JournalLifecycleMutationInput => ({
-      kind: 'item',
-      identity: { provider: 'orca', clientMessageId: id },
-      body: { kind: 'status', text: 'provider diagnostic' }
-    })
-    await journal.appendLifecycleBatch({
-      settlementId: 'unreserved-1',
-      fence: 1,
-      mutations: [mutation('one')]
-    })
-    await expect(
-      journal.appendLifecycleBatch({
-        settlementId: 'unreserved-2',
-        fence: 1,
-        mutations: [mutation('two')]
-      })
-    ).rejects.toMatchObject({ code: 'journal_rate_exceeded' })
-  })
-
-  it('rebuilds dispatch and turn reservations for pending submissions after reopen', async () => {
-    const journal = await open({ autoCompact: false })
-    await journal.appendSubmission({
-      clientMessageId: 'pending-send',
-      payloadFingerprint: 'fingerprint',
-      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
-      fence: 1
-    })
-
-    const reopened = await open({ autoCompact: false })
-    expect(reopened.lifecycleCapacityState()).toEqual({
-      reservedBytes: JOURNAL_DISPATCH_RESERVATION_BYTES + JOURNAL_TURN_TERMINAL_RESERVATION_BYTES,
-      reservedAppendSlots: 2
-    })
-  })
-
   it('deduplicates concurrent submissions before appending a second row', async () => {
     const journal = await open()
     const input = {
@@ -684,7 +262,7 @@ describe('lifecycle batches', () => {
   })
 
   it('applies every mutation at one sequence and deduplicates a replay across reopen', async () => {
-    const journal = await open({ autoCompact: false })
+    const journal = await open()
     const turn: AgentJournalItemIdentity = {
       provider: 'legacy',
       agent: 'codex',
@@ -715,9 +293,9 @@ describe('lifecycle batches', () => {
         .snapshot()
         .items.some((entry) => entry.body.kind === 'status' && entry.body.text === 'working')
     ).toBe(false)
-    await journal.compact(tick() + 10, { minTailRows: 0, retainTailMs: 0 })
+    await journal.close()
 
-    const reopened = await open({ autoCompact: false })
+    const reopened = await open()
     const beforeReplay = reopened.cursor()
     const replay = await reopened.appendLifecycleBatch({
       settlementId: 'exit:turn-1',
@@ -737,53 +315,6 @@ describe('lifecycle batches', () => {
         )
     ).toBe(false)
   })
-
-  it('reserves and releases terminal prompts created inside lifecycle batches', async () => {
-    const journal = await open()
-    const identity: AgentJournalItemIdentity = { provider: 'orca', clientMessageId: 'prompt-1' }
-    const pending: AgentJournalItemBody = {
-      kind: 'approval',
-      title: 'Run a command?',
-      detail: null,
-      options: [{ id: 'accept', label: 'Allow' }],
-      resolution: {
-        state: 'pending',
-        selectedOptionId: null,
-        resolvedBy: null,
-        resolvedAt: null
-      }
-    }
-
-    await journal.appendLifecycleBatch({
-      settlementId: 'prompt-start',
-      fence: 1,
-      mutations: [{ kind: 'item', identity, body: pending }]
-    })
-
-    expect(journal.lifecycleCapacityState()).toEqual({
-      reservedBytes: JOURNAL_ITEM_TERMINAL_RESERVATION_BYTES,
-      reservedAppendSlots: 1
-    })
-
-    await journal.appendItem(
-      identity,
-      {
-        ...pending,
-        resolution: {
-          state: 'resolved',
-          selectedOptionId: 'accept',
-          resolvedBy: 'test',
-          resolvedAt: tick()
-        }
-      },
-      { fence: 1 }
-    )
-
-    expect(journal.lifecycleCapacityState()).toEqual({
-      reservedBytes: 0,
-      reservedAppendSlots: 0
-    })
-  })
 })
 
 describe('journal location', () => {
@@ -808,12 +339,32 @@ describe('journal location', () => {
 })
 
 describe('on-disk layout', () => {
-  it('writes the log and snapshot beside each other', async () => {
+  it('keeps the session database and its projection in one directory', async () => {
     const journal: AgentSessionJournal = await open()
     await journal.appendItem(item(0), body('a'), { fence: 1 })
-    await expect(readFile(join(root, JOURNAL_LOG_FILE), 'utf-8')).resolves.toContain(
-      '"kind":"item"'
-    )
-    await expect(readFile(join(root, JOURNAL_SNAPSHOT_FILE), 'utf-8')).resolves.toContain('"epoch"')
+    expect(await readdir(root)).toContain('journal.db')
+    await journal.close()
+    await withJournalDatabase(root, (db) => {
+      const row = db.prepare('SELECT row_json FROM journal_rows WHERE seq = 2').get()
+      expect((row as { row_json: string }).row_json).toContain('"kind":"item"')
+      expect(db.prepare('SELECT epoch FROM journal_sessions').get()).toMatchObject({
+        epoch: journal.epoch
+      })
+    })
   })
 })
+
+/** Opens the session database directly, so a case can stage a fault or read
+ *  back what a commit actually stored. */
+async function withJournalDatabase(
+  journalDir: string,
+  run: (db: Database.Database) => void
+): Promise<void> {
+  const { openJournalDatabase } = await import('./journal-database')
+  const opened = openJournalDatabase(journalDatabaseFile(journalDir))
+  try {
+    run(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-store.ts b/src/main/native-chat/agent-session-journal/journal-store.ts
index 33f9be0c2e4..ab2715d0d86 100644
--- a/src/main/native-chat/agent-session-journal/journal-store.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store.ts
@@ -11,20 +11,16 @@ import type {
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
-import {
-  compactJournal,
-  DEFAULT_JOURNAL_COMPACTION_POLICY,
-  type JournalCompactionPolicy
-} from './journal-compaction'
+import { agentSessionJournalCloseRetries } from './journal-close-retry'
+import { openJournalDatabase, type OpenJournalDatabase } from './journal-database'
 import type { JournalReplacementItem } from './journal-epoch-replacement'
 import { readJournalSince } from './journal-cursor'
-import type { JournalLoad } from './journal-open'
-import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
+import { readJournalRowsAfterCursor, type JournalLoad } from './journal-open'
+import { journalDatabaseFile } from './journal-paths'
 import { markJournalPendingSubmissionsUnknown } from './journal-pending-submission-recovery'
 import {
   applyJournalRow,
   createJournalReducerState,
-  referencedBlobDigests,
   renderJournalState,
   resolveJournalItemId,
   type JournalReducerState
@@ -37,7 +33,6 @@ import {
 import type {
   AgentSessionJournalOptions,
   JournalAppendResult,
-  JournalBlobInput,
   JournalItemAppendOptions,
   JournalLifecycleBatchInput,
   JournalReadSince,
@@ -46,112 +41,79 @@ import type {
   ResolveDispatchInput
 } from './journal-store-contracts'
 import type { AgentJournalEpochReason, JournalRow } from './journal-row-schema'
-import { assertJournalWritable, JournalAppendBudget } from './journal-write-guards'
-import { journalDirectoryBytes } from './journal-physical-quota'
-import type { JournalLifecycleReservation } from './journal-lifecycle-capacity'
-import { JournalLifecycleAdmission } from './journal-lifecycle-admission'
-import { JournalRowWriter } from './journal-row-writer'
-import { JournalEpochController } from './journal-epoch-controller'
-import { journalStoreLoadedFields, openJournalStoreState } from './journal-store-open'
-import { JournalItemAppender } from './journal-item-appender'
-import { JournalLifecycleBatchAppender } from './journal-lifecycle-batch-appender'
+import { AgentSessionJournalError } from './journal-write-guards'
+import type { JournalRowWriter } from './journal-row-writer'
+import type { JournalEpochController } from './journal-epoch-controller'
+import { JournalConnectionCloser, JournalWriteQueue } from './journal-store-close'
+import { createJournalStoreCollaborators } from './journal-store-collaborators'
+import { ensureJournalDir, journalStoreLoadedFields } from './journal-store-open'
+import type { JournalItemAppender } from './journal-item-appender'
+import type { JournalLifecycleBatchAppender } from './journal-lifecycle-batch-appender'
 
 export { AgentSessionJournalError } from './journal-write-guards'
 
 export class AgentSessionJournal {
   private readonly identity: AgentSessionJournalIdentity
   private readonly journalDir: string
-  private readonly budget: JournalAppendBudget
-  private readonly compaction: JournalCompactionPolicy
-  private readonly autoCompact: boolean
+  private readonly dbPath: string
   private readonly now: () => number
   private readonly mintEpoch: () => string
   private readonly loaded: JournalLoad | null | undefined
 
   private state: JournalReducerState
-  private tailRows: JournalRow[] = []
-  private compactedThrough = 0
-  private sizeBytes = 0
   private readOnly = false
   private malformedRows = 0
-  private readonly lifecycleAdmission: JournalLifecycleAdmission
+  private database: OpenJournalDatabase | null = null
+  private readonly queue: JournalWriteQueue
+  private readonly closer: JournalConnectionCloser
   private readonly rowWriter: JournalRowWriter
   private readonly epochController: JournalEpochController
   private readonly itemAppender: JournalItemAppender
   private readonly lifecycleBatchAppender: JournalLifecycleBatchAppender
-  /** Serializes sequence assignment with the durable write behind it. */
-  private writes: Promise<unknown> = Promise.resolve()
+  private readonly restore: () => Promise<void>
 
   constructor(options: AgentSessionJournalOptions) {
     this.identity = options.identity
     this.journalDir = options.journalDir
-    this.budget = new JournalAppendBudget(
-      options.identity.sessionId,
-      options.limits ?? DEFAULT_JOURNAL_PAYLOAD_LIMITS
-    )
-    this.autoCompact = options.autoCompact ?? true
-    this.compaction = options.compaction ?? DEFAULT_JOURNAL_COMPACTION_POLICY
+    this.dbPath = journalDatabaseFile(options.journalDir)
     this.now = options.now ?? (() => Date.now())
     this.mintEpoch = options.mintEpoch ?? randomUUID
     this.loaded = options.loaded
     this.state = createJournalReducerState(options.identity.sessionId, '')
-    this.lifecycleAdmission = new JournalLifecycleAdmission(
-      options.identity.sessionId,
-      this.budget.maxSessionBytes,
-      (itemId) => resolveJournalItemId(this.state, itemId),
-      this.budget.maxAppendsPerWindow
-    )
-    this.rowWriter = new JournalRowWriter({
-      journalDir: this.journalDir,
-      sessionId: options.identity.sessionId,
-      budget: this.budget,
-      lifecycleAdmission: this.lifecycleAdmission,
-      autoCompact: this.autoCompact,
-      compaction: this.compaction,
-      now: this.now,
-      serialize: (run) => this.serializeWrite(run),
-      readOnly: () => this.readOnly,
-      setReadOnly: (readOnly) => {
-        this.readOnly = readOnly
-      },
-      physicalBytes: () => this.sizeBytes,
-      highestFence: () => this.state.highestFence,
-      nextSequence: () => this.state.lastSequence + 1,
-      tailRows: () => this.tailRows,
-      referencedBlobDigests: () => referencedBlobDigests(this.state),
-      compact: (now, policy) => this.compact(now, policy),
-      commit: (row, physicalBytes) => {
-        applyJournalRow(this.state, row)
-        this.tailRows.push(row)
-        this.sizeBytes = physicalBytes
-      }
+    // Serializes sequence assignment with the durable write behind it.
+    this.queue = new JournalWriteQueue(options.identity.sessionId)
+    this.closer = new JournalConnectionCloser({
+      connection: () => this.database?.db ?? null,
+      enqueue: (run) => this.queue.serializePastGate(run)
     })
-    this.epochController = new JournalEpochController({
+    const collaborators = createJournalStoreCollaborators({
       identity: this.identity,
       journalDir: this.journalDir,
-      budget: this.budget,
-      compaction: this.compaction,
       now: this.now,
       mintEpoch: this.mintEpoch,
-      serialize: (run) => this.serializeWrite(run),
+      serialize: (run) => this.queue.serialize(run),
+      database: () => this.requireDatabase(),
+      state: () => this.state,
       readOnly: () => this.readOnly,
       setReadOnly: (readOnly) => {
         this.readOnly = readOnly
       },
-      highestFence: () => this.state.highestFence,
       cursor: this.cursor,
-      adopt: (loaded) => this.adoptLoadedJournal(loaded)
-    })
-    this.itemAppender = new JournalItemAppender({
+      adopt: (loaded) => this.adoptLoadedJournal(loaded),
+      commit: (row) => applyJournalRow(this.state, row),
+      loaded: () => this.loaded,
+      malformedRows: () => this.malformedRows,
+      setMalformedRows: (count) => {
+        this.malformedRows = count
+      },
       journal: () => this,
-      state: () => this.state,
-      enqueue: (build, blobs) => this.enqueue(build, blobs)
-    })
-    this.lifecycleBatchAppender = new JournalLifecycleBatchAppender({
-      state: () => this.state,
-      cursor: this.cursor,
       enqueue: (build) => this.enqueue(build)
     })
+    this.rowWriter = collaborators.rowWriter
+    this.epochController = collaborators.epochController
+    this.itemAppender = collaborators.itemAppender
+    this.lifecycleBatchAppender = collaborators.lifecycleBatchAppender
+    this.restore = collaborators.restore
   }
 
   get isReadOnly(): boolean {
@@ -166,31 +128,31 @@ export class AgentSessionJournal {
     return this.journalDir
   }
 
-  /** Highest sequence folded into the snapshot; rows at or below it are no
-   *  longer individually replayable. */
-  get compactionBoundary(): number {
-    return this.compactedThrough
+  /** What the last open's repair did. */
+  get repair(): { malformedRows: number } {
+    return { malformedRows: this.malformedRows }
   }
 
   async open(): Promise<void> {
-    await openJournalStoreState({
-      journalDir: this.journalDir,
-      sessionId: this.identity.sessionId,
-      maxBytes: this.budget.maxSessionBytes,
-      loaded: this.loaded,
-      start: () => this.epochController.start('session_created', 0),
-      adopt: (loaded) => this.adoptLoadedJournal(loaded),
-      tailRows: () => this.tailRows,
-      snapshot: this.snapshot,
-      rebuildLifecycle: (snapshot, bytes) => this.lifecycleAdmission.rebuild(snapshot, bytes),
-      appendDisclosure: (identity, body, fence) => this.appendItem(identity, body, { fence }),
-      highestFence: () => this.state.highestFence,
-      malformedRows: () => this.malformedRows,
-      readOnly: () => this.readOnly,
-      setPhysicalBytes: (bytes) => {
-        this.sizeBytes = bytes
-      }
-    })
+    await ensureJournalDir(this.journalDir)
+    this.database = openJournalDatabase(this.dbPath)
+    try {
+      await this.restore()
+    } catch (error) {
+      // Nothing else holds a reference to this connection, so a throw here is
+      // the leak site unless the store releases it itself — and a close that
+      // REJECTS has not released it, so the store is retained for a later retry
+      // instead of being dropped with its handle open.
+      await agentSessionJournalCloseRetries.closeOrRetain(this)
+      throw error
+    }
+  }
+
+  /** Releases the session's SQLite handle. Idempotent on success, a real retry
+   *  after a failure, and permanently closed to writes either way (§ close). */
+  close(): Promise<void> {
+    this.queue.markClosed()
+    return this.closer.close()
   }
 
   cursor = (): AgentJournalCursor => ({
@@ -212,27 +174,19 @@ export class AgentSessionJournal {
 
   canonicalItemId = (itemId: string): string => resolveJournalItemId(this.state, itemId)
 
-  reserveLifecycleCapacity(token: JournalLifecycleReservation): Promise<boolean> {
-    return this.serializeCapacityMutation(async () => {
-      this.sizeBytes = await journalDirectoryBytes(this.journalDir)
-      return this.lifecycleAdmission.reserve(token, this.sizeBytes)
-    })
-  }
-
-  transferLifecycleCapacity(fromId: string, toId: string): Promise<boolean> {
-    return this.serializeCapacityMutation(() => this.lifecycleAdmission.transfer(fromId, toId))
-  }
-
-  releaseLifecycleCapacity(id: string): Promise<void> {
-    return this.serializeCapacityMutation(() => this.lifecycleAdmission.release(id))
-  }
-
-  lifecycleCapacityState = (): { reservedBytes: number; reservedAppendSlots: number } =>
-    this.lifecycleAdmission.state
-
   readSince(cursor: AgentJournalCursor): JournalReadSince {
     return readJournalSince(
-      { state: this.state, tailRows: this.tailRows, readOnly: this.readOnly },
+      {
+        state: this.state,
+        rowsAfter: (afterSequence) =>
+          readJournalRowsAfterCursor(
+            this.requireDatabase().db,
+            this.identity.sessionId,
+            this.state.epoch,
+            afterSequence
+          ),
+        readOnly: this.readOnly
+      },
       cursor,
       () => this.cursor()
     )
@@ -248,16 +202,6 @@ export class AgentSessionJournal {
     return this.itemAppender.append(identity, body, options)
   }
 
-  /** Blob-before-row admission on the same serialized path as sequence assignment. */
-  appendItemWithBlobs(
-    identity: AgentJournalItemIdentity,
-    body: AgentJournalItemBody,
-    blobs: readonly JournalBlobInput[],
-    options: JournalItemAppendOptions = { fence: 0 }
-  ): Promise<JournalAppendResult> {
-    return this.itemAppender.appendWithBlobs(identity, body, blobs, options)
-  }
-
   appendTombstone(
     identity: AgentJournalItemIdentity,
     options: JournalTombstoneInput
@@ -303,26 +247,6 @@ export class AgentSessionJournal {
     return markJournalPendingSubmissionsUnknown(this, fence)
   }
 
-  async compact(
-    now = this.now(),
-    policy: JournalCompactionPolicy = this.compaction
-  ): Promise<void> {
-    assertJournalWritable(this.readOnly, this.identity.sessionId)
-    const result = await compactJournal({
-      journalDir: this.journalDir,
-      state: this.state,
-      tailRows: this.tailRows,
-      policy,
-      now,
-      maxSessionBytes: this.budget.maxSessionBytes,
-      sessionId: this.identity.sessionId
-    })
-    this.tailRows = result.tailRows
-    this.compactedThrough = result.compactedThrough
-    this.state.oldestSequence = result.oldestSequence
-    this.sizeBytes = await journalDirectoryBytes(this.journalDir)
-  }
-
   /** The escape hatch for corruption, an unreconcilable prefix, a forked handle,
    *  and an unreadable schema. It invalidates every cursor; clients reload. */
   async rollEpoch(reason: AgentJournalEpochReason, fence: number): Promise<AgentJournalCursor> {
@@ -341,24 +265,22 @@ export class AgentSessionJournal {
     Object.assign(this, journalStoreLoadedFields(loaded))
   }
 
+  private requireDatabase(): OpenJournalDatabase {
+    if (!this.database) {
+      throw new AgentSessionJournalError(
+        'journal_closed',
+        `agent-session journal for ${this.identity.sessionId} is not open`
+      )
+    }
+    return this.database
+  }
+
   /**
    * Assign the next sequence, make the row durable, and fold it through the
    * SAME reducer replay uses — all inside one serialized step, so concurrent
    * callers cannot interleave and mint the same sequence.
    */
-  private enqueue(
-    build: (seq: number, ts: number) => JournalRow,
-    blobs: readonly JournalBlobInput[] = []
-  ): Promise<JournalRow> {
-    return this.rowWriter.enqueue(build, blobs)
-  }
-
-  private serializeCapacityMutation = <T>(runMutation: () => Promise<T> | T): Promise<T> =>
-    this.serializeWrite(async () => runMutation())
-
-  private serializeWrite<T>(runWrite: () => Promise<T>): Promise<T> {
-    const run = this.writes.then(runWrite)
-    this.writes = run.catch(() => undefined)
-    return run
+  private enqueue(build: (seq: number, ts: number) => JournalRow): Promise<JournalRow> {
+    return this.rowWriter.enqueue(build)
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-terminal-settlement.ts b/src/main/native-chat/agent-session-journal/journal-terminal-settlement.ts
new file mode 100644
index 00000000000..ade04667174
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-terminal-settlement.ts
@@ -0,0 +1,13 @@
+import type { AgentJournalItemBody } from '../../../shared/agent-session-journal-types'
+
+/** True while an item is still awaiting the row that settles it, so a sink can
+ *  treat that row as lifecycle-critical rather than sheddable under pressure. */
+export function requiresTerminalSettlement(body: AgentJournalItemBody): boolean {
+  if (body.kind === 'tool-call') {
+    return body.state === 'running'
+  }
+  if (body.kind === 'approval' || body.kind === 'question') {
+    return body.resolution.state === 'pending'
+  }
+  return body.kind === 'status' && body.turnLifecycle?.state === 'running'
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-tool-output-fallback.ts b/src/main/native-chat/agent-session-journal/journal-tool-output-fallback.ts
deleted file mode 100644
index 5b3209ea594..00000000000
--- a/src/main/native-chat/agent-session-journal/journal-tool-output-fallback.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-import type {
-  AgentJournalItemBody,
-  AgentJournalItemIdentity
-} from '../../../shared/agent-session-journal-types'
-import type { AgentSessionJournal } from './journal-store'
-import type { JournalAppendResult } from './journal-store-contracts'
-import { AgentSessionJournalError } from './journal-write-guards'
-import { boundToolInput, DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
-
-export async function appendToolOutputFallback(input: {
-  journal: AgentSessionJournal
-  error: unknown
-  identity: AgentJournalItemIdentity
-  body: AgentJournalItemBody
-  blobs: readonly { digest: string; payload: string }[]
-  itemId: string
-  fence: number
-}): Promise<JournalAppendResult> {
-  if (
-    !(input.error instanceof AgentSessionJournalError) ||
-    input.error.code !== 'journal_bound_exceeded' ||
-    input.body.kind !== 'tool-call' ||
-    input.body.state === 'running' ||
-    input.blobs.length === 0
-  ) {
-    throw input.error
-  }
-  const digest = input.blobs[0]?.digest ?? 'unknown'
-  const cursor = await input.journal.appendLifecycleBatch({
-    settlementId: `tool-output-unavailable:${input.itemId}:${digest}`,
-    fence: input.fence,
-    mutations: [
-      {
-        kind: 'item',
-        identity: input.identity,
-        body: {
-          kind: 'tool-call',
-          name: input.body.name,
-          input: boundToolInput(input.body.input, DEFAULT_JOURNAL_PAYLOAD_LIMITS),
-          state: input.body.state
-        }
-      },
-      {
-        kind: 'item',
-        identity: { provider: 'orca', clientMessageId: `output-unavailable:${input.itemId}` },
-        body: {
-          kind: 'status',
-          text: 'The tool completed, but its output could not be retained within the session storage limit.'
-        }
-      }
-    ]
-  })
-  const item = input.journal.snapshot().items.find((entry) => entry.itemId === input.itemId)
-  if (!item) {
-    throw new Error('journal_tool_output_fallback_lost')
-  }
-  return { cursor, itemId: input.itemId, revision: item.revision }
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-write-guards.ts b/src/main/native-chat/agent-session-journal/journal-write-guards.ts
index 9f76de55745..e1869ae0c73 100644
--- a/src/main/native-chat/agent-session-journal/journal-write-guards.ts
+++ b/src/main/native-chat/agent-session-journal/journal-write-guards.ts
@@ -1,18 +1,11 @@
 // Guards an append clears before it becomes durable.
 //
-// All four refuse loudly rather than degrade: a silent drop here is a message
+// Both refuse loudly rather than degrade: a silent drop here is a message
 // missing from the transcript with nothing to explain it.
 
-import type { JournalPayloadLimits } from './journal-payload-bounds'
-import { journalRowByteLength, type JournalRow } from './journal-row-schema'
-
 export class AgentSessionJournalError extends Error {
   constructor(
-    readonly code:
-      | 'journal_read_only'
-      | 'journal_stale_fence'
-      | 'journal_bound_exceeded'
-      | 'journal_rate_exceeded',
+    readonly code: 'journal_read_only' | 'journal_stale_fence' | 'journal_closed',
     message: string
   ) {
     super(message)
@@ -41,94 +34,3 @@ export function assertJournalFence(fence: number, highestFence: number): void {
     )
   }
 }
-
-/** Total size and append rate for one session, bounding a runaway agent. */
-export class JournalAppendBudget {
-  private windowStart = 0
-  private appendsInWindow = 0
-
-  constructor(
-    private readonly sessionId: string,
-    private readonly limits: JournalPayloadLimits
-  ) {}
-
-  fork(): JournalAppendBudget {
-    return new JournalAppendBudget(this.sessionId, this.limits)
-  }
-
-  get maxSessionBytes(): number {
-    return this.limits.maxSessionBytes
-  }
-
-  get maxAppendsPerWindow(): number {
-    return this.limits.maxAppendsPerWindow
-  }
-
-  /** Capture rate state so a speculative append can be rolled back safely. */
-  checkpoint(): { windowStart: number; appendsInWindow: number } {
-    return { windowStart: this.windowStart, appendsInWindow: this.appendsInWindow }
-  }
-
-  restore(checkpoint: { windowStart: number; appendsInWindow: number }): void {
-    this.windowStart = checkpoint.windowStart
-    this.appendsInWindow = checkpoint.appendsInWindow
-  }
-
-  wouldExceedSize(row: JournalRow, sizeBytes: number): boolean {
-    return sizeBytes + journalRowByteLength(row) > this.limits.maxSessionBytes
-  }
-
-  assert(row: JournalRow, ts: number, sizeBytes: number): void {
-    if (this.wouldExceedSize(row, sizeBytes)) {
-      throw new AgentSessionJournalError(
-        'journal_bound_exceeded',
-        `agent-session journal for ${this.sessionId} reached its ${this.limits.maxSessionBytes}-byte bound`
-      )
-    }
-    this.assertRate(ts)
-  }
-
-  /** Lifecycle capacity cannot bypass the session-wide append rate. */
-  assertLifecycle(row: JournalRow, sizeBytes: number): void {
-    if (this.wouldExceedSize(row, sizeBytes)) {
-      throw new AgentSessionJournalError(
-        'journal_bound_exceeded',
-        `agent-session journal for ${this.sessionId} reached its ${this.limits.maxSessionBytes}-byte bound`
-      )
-    }
-    this.assertRate(row.ts)
-  }
-
-  /**
-   * Consume a lifecycle row covered by a pre-reserved append slot. Reserved
-   * rows still observe the physical quota, but do not spend ordinary window
-   * rate headroom that may be needed by unrelated traffic.
-   */
-  assertReservedLifecycle(row: JournalRow, sizeBytes: number): void {
-    if (this.wouldExceedSize(row, sizeBytes)) {
-      throw new AgentSessionJournalError(
-        'journal_bound_exceeded',
-        `agent-session journal for ${this.sessionId} reached its ${this.limits.maxSessionBytes}-byte bound`
-      )
-    }
-  }
-
-  private assertRate(ts: number): void {
-    let windowStart = this.windowStart
-    let appendsInWindow = this.appendsInWindow
-    if (ts - windowStart >= this.limits.appendWindowMs) {
-      windowStart = ts
-      appendsInWindow = 0
-    }
-    appendsInWindow += 1
-    if (appendsInWindow > this.limits.maxAppendsPerWindow) {
-      // A refusal must not consume a slot, so a later retry can succeed.
-      throw new AgentSessionJournalError(
-        'journal_rate_exceeded',
-        `agent-session journal for ${this.sessionId} exceeded ${this.limits.maxAppendsPerWindow} appends per ${this.limits.appendWindowMs}ms`
-      )
-    }
-    this.windowStart = windowStart
-    this.appendsInWindow = appendsInWindow
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts b/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts
index 3930abb6fe8..cda878f5a01 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts
@@ -1,4 +1,4 @@
-import { appendFile, mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -19,15 +19,16 @@ import {
   serializeRemoteRuntimePayload
 } from '../../../shared/remote-runtime-memory-limits'
 import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
-import { JOURNAL_LOG_FILE } from '../agent-session-journal/journal-log-file'
-import {
-  serializeJournalRow,
-  type JournalItemRow,
-  type JournalRow,
-  type JournalTombstoneRow
+import { openJournalDatabase } from '../agent-session-journal/journal-database'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import { insertJournalRow } from '../agent-session-journal/journal-row-table'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import type {
+  JournalItemRow,
+  JournalRow,
+  JournalTombstoneRow
 } from '../agent-session-journal/journal-row-schema'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
 import { projectJournalBatch } from './agent-session-journal-batch'
 import { readAgentSessionHistory, resolveHistoryLimit } from './agent-session-history-page'
 
@@ -39,6 +40,7 @@ const IDENTITY: AgentSessionJournalIdentity = {
   providerHandle: { kind: 'codex', threadId: 'thread-1' }
 }
 
+const journals = createTrackedJournalOpener()
 let root: string
 let clock = 1_000
 let epochs = 0
@@ -67,7 +69,7 @@ beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-wire-history-'))
   clock = 1_000
   epochs = 0
-  journal = await openAgentSessionJournal({
+  journal = await journals.open({
     identity: IDENTITY,
     journalDir: root,
     now: tick,
@@ -79,6 +81,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -477,12 +480,20 @@ async function reopenWithRawRows(rows: readonly RawSeedRow[]): Promise<AgentSess
         ts: tick()
       }) as JournalRow
   )
-  await appendFile(
-    join(root, JOURNAL_LOG_FILE),
-    `${full.map(serializeJournalRow).join('\n')}\n`,
-    'utf-8'
-  )
-  return openAgentSessionJournal({ identity: IDENTITY, journalDir: root, now: tick })
+  // Rows are staged straight into the session database: the reopen below has to
+  // see them exactly as a previous writer would have committed them.
+  await journal.close()
+  const opened = openJournalDatabase(journalDatabaseFile(root))
+  try {
+    opened.db.exec('BEGIN IMMEDIATE')
+    for (const row of full) {
+      insertJournalRow(opened.db, IDENTITY.sessionId, row)
+    }
+    opened.db.exec('COMMIT')
+  } finally {
+    opened.db.close()
+  }
+  return journals.open({ identity: IDENTITY, journalDir: root, now: tick })
 }
 
 describe('pre-existing oversized identities', () => {
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
index 2efcc08cde9..214c889b5c9 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
@@ -1,7 +1,9 @@
 // Recovery drives the real journal loader against real on-disk damage: a hole
-// punched in the log, and a row stamped with a schema this host cannot read.
+// punched in the row sequence, and a row stamped with a schema this host cannot
+// read — on both version axes, because only one of them is detectable before a
+// read.
 
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -9,7 +11,13 @@ import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { openJournalDatabase } from '../agent-session-journal/journal-database'
+import { JOURNAL_DB_SCHEMA_VERSION } from '../agent-session-journal/journal-database-schema'
+import { loadJournal } from '../agent-session-journal/journal-open'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import { readJournalEpochRows } from '../agent-session-journal/journal-row-table'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import type Database from '../../sqlite/sync-database'
 import {
   openAgentSessionJournalWithRecovery,
   providerHistoryId,
@@ -53,14 +61,15 @@ const CODEX_LINES = [
 let root: string
 let journalDir: string
 let historyFilePath: string
+const journals = createTrackedJournalOpener()
 
 function item(ordinal: number): AgentJournalItemIdentity {
   return { provider: 'codex', threadId: CODEX_SESSION, turnId: 'turn-1', ordinal }
 }
 
-/** Fills a journal with `count` items and hands back the raw log lines. */
-async function seedJournal(count: number): Promise<string[]> {
-  const journal = await openAgentSessionJournal({ identity: IDENTITY, journalDir })
+/** Fills a journal with `count` items and hands back its epoch. */
+async function seedJournal(count: number): Promise<string> {
+  const journal = await journals.open({ identity: IDENTITY, journalDir })
   for (let ordinal = 1; ordinal <= count; ordinal += 1) {
     await journal.appendItem(
       item(ordinal),
@@ -68,8 +77,48 @@ async function seedJournal(count: number): Promise<string[]> {
       { fence: 1 }
     )
   }
-  const raw = await readFile(join(journalDir, 'log.jsonl'), 'utf-8')
-  return raw.split('\n').filter((line) => line.trim().length > 0)
+  const epoch = journal.epoch
+  await journal.close()
+  return epoch
+}
+
+/** A journal whose epoch row is gone: every surviving row is unanchored, so a
+ *  repair has to set aside the whole range. */
+async function seedRepairableSession(): Promise<void> {
+  const journal = await journals.open({ identity: IDENTITY, journalDir })
+  await journal.appendSubmission({
+    clientMessageId: 'client-message-1',
+    payloadFingerprint: 'fingerprint-1',
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'add a retry' }] },
+    fence: 1
+  })
+  await journal.resolveDispatch({
+    clientMessageId: 'client-message-1',
+    state: 'accepted',
+    providerIdentity: item(1),
+    fence: 1
+  })
+  await journal.close()
+  await deleteRow(1)
+}
+
+async function withJournalDatabase(
+  directory: string,
+  run: (db: Database.Database) => void
+): Promise<void> {
+  const opened = openJournalDatabase(journalDatabaseFile(directory))
+  try {
+    run(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** The same logical hole `findSequenceGap` detects at replay. */
+async function deleteRow(seq: number): Promise<void> {
+  await withJournalDatabase(journalDir, (db) => {
+    db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(seq)
+  })
 }
 
 beforeEach(async () => {
@@ -84,6 +133,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -99,20 +149,20 @@ describe('providerHistoryId', () => {
 describe('openAgentSessionJournalWithRecovery', () => {
   it('opens a healthy journal untouched', async () => {
     await seedJournal(2)
-    const opened = await openAgentSessionJournalWithRecovery({
-      identity: IDENTITY,
-      journalDir,
-      fence: 1,
-      historyFilePath
-    })
-    expect(opened.recovery).toBeNull()
-    expect(opened.journal.snapshot().items).toHaveLength(2)
+    const opened = journals.track(
+      await openAgentSessionJournalWithRecovery({
+        identity: IDENTITY,
+        journalDir,
+        fence: 1,
+        historyFilePath
+      }).then((result) => result.journal)
+    )
+    expect(opened.snapshot().items).toHaveLength(2)
   })
 
   it('rebuilds a holed journal in place on a fresh epoch', async () => {
-    const lines = await seedJournal(3)
-    const holed = lines.filter((_line, index) => index !== 1)
-    await writeFile(join(journalDir, 'log.jsonl'), `${holed.join('\n')}\n`, 'utf-8')
+    await seedJournal(3)
+    await deleteRow(3)
 
     const opened = await openAgentSessionJournalWithRecovery({
       identity: IDENTITY,
@@ -120,6 +170,7 @@ describe('openAgentSessionJournalWithRecovery', () => {
       fence: 1,
       historyFilePath
     })
+    journals.track(opened.journal)
     expect(opened.recovery).toMatchObject({ trigger: 'journal_corrupt', reset: 'epoch_changed' })
     expect(opened.recovery?.imported).toBeGreaterThan(0)
     expect(opened.journal.isReadOnly).toBe(false)
@@ -130,12 +181,46 @@ describe('openAgentSessionJournalWithRecovery', () => {
     expect(texts.some((text) => text.includes('add a retry'))).toBe(true)
   })
 
-  it('reconstructs a future-schema journal into a schema-scoped sibling, never in place', async () => {
-    const lines = await seedJournal(1)
-    await writeFile(
-      join(journalDir, 'log.jsonl'),
-      `${lines.join('\n')}\n${JSON.stringify({ v: 99, seq: 2, epoch: 'e', kind: 'item' })}\n`,
-      'utf-8'
+  it('reconstructs a future row-body version into a sibling, never in place', async () => {
+    const epoch = await seedJournal(1)
+    await withJournalDatabase(journalDir, (db) => {
+      db.prepare(
+        'INSERT INTO journal_rows (session_id, epoch, seq, ts, row_json) VALUES (?, ?, ?, ?, ?)'
+      ).run(
+        CODEX_SESSION,
+        epoch,
+        3,
+        1,
+        JSON.stringify({ v: 99, seq: 3, epoch, kind: 'item', fence: 1, ts: 1 })
+      )
+    })
+
+    const opened = journals.track(
+      await openAgentSessionJournalWithRecovery({
+        identity: IDENTITY,
+        journalDir,
+        fence: 1,
+        historyFilePath
+      }).then((result) => result.journal)
+    )
+
+    // The unreadable journal is left exactly as found; a newer host still owns it.
+    await withJournalDatabase(journalDir, (db) => {
+      const rows = readJournalEpochRows(db, CODEX_SESSION, epoch)
+      expect(rows.some((entry) => entry.rowJson.includes('"v":99'))).toBe(true)
+      expect(rows).toHaveLength(3)
+    })
+    await opened.close()
+    await withJournalDatabase(recoveryJournalDir(journalDir), (db) => {
+      const sibling = db.prepare('SELECT row_json FROM journal_rows').all()
+      expect(JSON.stringify(sibling)).toContain('add a retry')
+    })
+  })
+
+  it('reconstructs a future database version into a sibling, never in place', async () => {
+    await seedJournal(1)
+    await withJournalDatabase(journalDir, (db) =>
+      db.pragma(`user_version = ${JOURNAL_DB_SCHEMA_VERSION + 1}`)
     )
 
     const opened = await openAgentSessionJournalWithRecovery({
@@ -144,23 +229,71 @@ describe('openAgentSessionJournalWithRecovery', () => {
       fence: 1,
       historyFilePath
     })
+    journals.track(opened.journal)
     expect(opened.recovery).toMatchObject({
       trigger: 'schema_unreadable',
       reset: 'schema_unreadable'
     })
     expect(opened.recovery?.imported).toBeGreaterThan(0)
+    // No schema change, no row written, no row deleted.
+    await withJournalDatabase(journalDir, (db) => {
+      expect(db.pragma('user_version', { simple: true })).toBe(JOURNAL_DB_SCHEMA_VERSION + 1)
+      expect(db.prepare('SELECT count(*) AS total FROM journal_rows').get()).toMatchObject({
+        total: 2
+      })
+    })
+  })
 
-    // The unreadable journal is left exactly as found; a newer host still owns it.
-    const untouched = await readFile(join(journalDir, 'log.jsonl'), 'utf-8')
-    expect(untouched).toContain('"v":99')
-    const sibling = await readFile(join(recoveryJournalDir(journalDir), 'log.jsonl'), 'utf-8')
-    expect(sibling).toContain('add a retry')
+  // The rehydrate deletes every live row to publish its replacement epoch, so
+  // everything replay rejected is gone for good by the time the import runs.
+  // Orca minted the submission, receipt and lifecycle identities; no provider
+  // transcript can hand them back.
+  it('rebuilds from provider history when the epoch row itself is gone', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir })
+    await journal.appendSubmission({
+      clientMessageId: 'client-message-1',
+      payloadFingerprint: 'fingerprint-1',
+      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'add a retry' }] },
+      fence: 1
+    })
+    await journal.resolveDispatch({
+      clientMessageId: 'client-message-1',
+      state: 'accepted',
+      providerIdentity: item(1),
+      fence: 1
+    })
+    await journal.appendLifecycleBatch({
+      settlementId: 'settlement-1',
+      fence: 1,
+      mutations: [
+        {
+          kind: 'item',
+          identity: { provider: 'orca', clientMessageId: 'approval-1' },
+          body: { kind: 'status', text: 'approved' }
+        }
+      ]
+    })
+    await journal.close()
+    // Sequence 1 is the epoch row: everything behind it is valid but unanchored.
+    await deleteRow(1)
+
+    const opened = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath
+    })
+    journals.track(opened.journal)
+    expect(opened.recovery).toMatchObject({ trigger: 'journal_corrupt' })
+    expect(opened.recovery?.imported).toBeGreaterThan(0)
+    expect(JSON.stringify(opened.journal.snapshot().items.map((entry) => entry.body))).toContain(
+      'add a retry'
+    )
   })
 
   it('still opens the session when provider history cannot be read', async () => {
-    const lines = await seedJournal(3)
-    const holed = lines.filter((_line, index) => index !== 2)
-    await writeFile(join(journalDir, 'log.jsonl'), `${holed.join('\n')}\n`, 'utf-8')
+    await seedJournal(3)
+    await deleteRow(3)
 
     const opened = await openAgentSessionJournalWithRecovery({
       identity: IDENTITY,
@@ -168,9 +301,170 @@ describe('openAgentSessionJournalWithRecovery', () => {
       fence: 1,
       historyFilePath: join(root, 'missing.jsonl')
     })
+    journals.track(opened.journal)
     expect(opened.recovery).toMatchObject({ trigger: 'journal_corrupt', imported: 0 })
     expect(opened.recovery?.error).toBeTruthy()
     // A missing provider transcript must not clear the intact journal prefix.
-    expect(opened.journal.snapshot().items).toHaveLength(1)
+    expect(opened.journal.snapshot().items.map((entry) => entry.body.kind)).toEqual(['message'])
+  })
+
+  // A repair that KEEPS a prefix has no emptied epoch to anchor, so nothing
+  // about the surviving rows records that the deleted suffix was never rebuilt.
+  // Unmarked, the next probe reads a contiguous anchored prefix, calls it clean,
+  // and the dropped stretch of timeline is gone for good.
+  it('keeps a partially repaired journal corrupt until provider history replaces it', async () => {
+    await seedJournal(3)
+    await deleteRow(3)
+    const empty = join(root, 'empty.jsonl')
+    await writeFile(empty, '', 'utf-8')
+
+    const first = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: empty
+    })
+    journals.track(first.journal)
+    expect(first.recovery).toMatchObject({ trigger: 'journal_corrupt', imported: 0 })
+    expect(first.recovery?.error).toBeTruthy()
+    // Only the unanchored suffix went; the prefix the repair kept is still live.
+    expect(first.journal.snapshot().items.map((entry) => entry.body.kind)).toEqual(['message'])
+    await first.journal.close()
+
+    // The deletion is durable, so the demand for a rebuild has to be too.
+    expect(await loadJournal(journalDir, CODEX_SESSION)).toMatchObject({ corrupt: true })
+
+    // A readable transcript rebuilds the epoch, and THAT is what retires it.
+    const retried = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath
+    })
+    journals.track(retried.journal)
+    expect(retried.recovery?.imported).toBeGreaterThan(0)
+    await retried.journal.close()
+    expect(await loadJournal(journalDir, CODEX_SESSION)).toMatchObject({ corrupt: false })
+  })
+
+  // The reproduced path. Deleting sequence 1 leaves every surviving row
+  // unanchored, so the repair drops ALL of them — and provider history is not
+  // there to publish a replacement. A journal in that state used to reopen as
+  // clean: an append took sequence 1 as an ordinary row, replay accepted it,
+  // and recovery never asked the provider for the timeline again.
+  it('does not normalize an epoch a repair emptied while provider history was unavailable', async () => {
+    await seedRepairableSession()
+    const missing = join(root, 'missing.jsonl')
+
+    const first = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: missing
+    })
+    journals.track(first.journal)
+    expect(first.recovery?.error).toBeTruthy()
+    expect(first.recovery?.imported).toBe(0)
+    await first.journal.close()
+
+    // Reopen: the epoch still holds nothing but the repair, so recovery runs again.
+    expect(await loadJournal(journalDir, CODEX_SESSION)).toMatchObject({ corrupt: true })
+    const reopened = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: missing
+    })
+    journals.track(reopened.journal)
+    expect(reopened.recovery).toMatchObject({ trigger: 'journal_corrupt', imported: 0 })
+    // Nothing but the anchor: the repair rebuilt no history of its own.
+    expect(reopened.journal.snapshot().items).toEqual([])
+
+    // The append lands ABOVE the epoch anchor, never on top of it.
+    await reopened.journal.appendItem(
+      item(2),
+      { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'typed later' }] },
+      { fence: 1 }
+    )
+    const epoch = reopened.journal.epoch
+    await reopened.journal.close()
+    await withJournalDatabase(journalDir, (db) => {
+      const rows = readJournalEpochRows(db, CODEX_SESSION, epoch)
+      expect(JSON.parse(rows[0]?.rowJson ?? '{}')).toMatchObject({ kind: 'epoch', seq: 1 })
+    })
+  })
+
+  // An empty transcript is a plausible transient provider state, and it used to
+  // end recovery for good: the import published an empty replacement epoch that
+  // deleted the repair's anchor, the next probe called that clean, and the user's
+  // timeline was never rebuilt.
+  it('does not retire the repair marker when provider history exists but holds no messages', async () => {
+    await seedRepairableSession()
+    const empty = join(root, 'empty.jsonl')
+    await writeFile(empty, '', 'utf-8')
+
+    const first = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: empty
+    })
+    journals.track(first.journal)
+    expect(first.recovery).toMatchObject({ trigger: 'journal_corrupt', imported: 0 })
+    expect(first.recovery?.error).toBeTruthy()
+    // The anchor the repair published is still the epoch; the empty import did
+    // not replace it with a clean one.
+    expect(first.journal.snapshot().items).toEqual([])
+    const epoch = first.journal.epoch
+    await first.journal.close()
+    await withJournalDatabase(journalDir, (db) => {
+      const rows = readJournalEpochRows(db, CODEX_SESSION, epoch)
+      expect(JSON.parse(rows[0]?.rowJson ?? '{}')).toMatchObject({
+        kind: 'epoch',
+        seq: 1,
+        reason: 'unreconcilable_prefix'
+      })
+    })
+
+    // The session still reports corrupt, so the next attach retries.
+    expect(await loadJournal(journalDir, CODEX_SESSION)).toMatchObject({ corrupt: true })
+
+    // And a transcript that DOES have content still rebuilds the timeline.
+    const retried = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath
+    })
+    journals.track(retried.journal)
+    expect(retried.recovery?.imported).toBeGreaterThan(0)
+    expect(JSON.stringify(retried.journal.snapshot().items.map((entry) => entry.body))).toContain(
+      'add a retry'
+    )
+  })
+
+  it('rebuilds the emptied epoch once provider history is readable again', async () => {
+    await seedRepairableSession()
+
+    const first = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath: join(root, 'missing.jsonl')
+    })
+    journals.track(first.journal)
+    await first.journal.close()
+
+    const retried = await openAgentSessionJournalWithRecovery({
+      identity: IDENTITY,
+      journalDir,
+      fence: 1,
+      historyFilePath
+    })
+    journals.track(retried.journal)
+    expect(retried.recovery?.imported).toBeGreaterThan(0)
+    expect(JSON.stringify(retried.journal.snapshot().items.map((entry) => entry.body))).toContain(
+      'add a retry'
+    )
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
index 05f58a25afe..6e771a31809 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
@@ -14,6 +14,7 @@ import {
   type AgentSessionJournalIdentity,
   type AgentSessionProviderHandle
 } from '../../../shared/agent-session-journal-types'
+import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import { importLegacyTranscriptIntoJournal } from '../agent-session-journal/journal-legacy-import'
 import { loadJournal } from '../agent-session-journal/journal-open'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
@@ -25,7 +26,8 @@ export type AgentSessionJournalRecovery = {
   reset: AgentJournalResetReason
   epoch: string
   imported: number
-  /** Set when provider history could not be read; the intact journal prefix remains live. */
+  /** Set when provider history could not be read, or held nothing to restore; the
+   *  intact journal prefix remains live. */
   error?: string
 }
 
@@ -55,16 +57,13 @@ export async function openAgentSessionJournalWithRecovery(input: {
   /** Resolve directly to a transcript instead of discovering it by session id. */
   historyFilePath?: string | null
 }): Promise<AgentSessionJournalOpened> {
-  const probe = await loadJournal(input.journalDir, input.identity.sessionId)
+  const probe = loadJournal(input.journalDir, input.identity.sessionId)
   if (probe?.readOnly) {
     const journal = await openAgentSessionJournal({
       identity: input.identity,
       journalDir: recoveryJournalDir(input.journalDir)
     })
-    return {
-      journal,
-      recovery: await rehydrate({ ...input, journal, trigger: 'schema_unreadable' })
-    }
+    return { journal, recovery: await rehydrateOrClose(input, journal, 'schema_unreadable') }
   }
   const journal = await openAgentSessionJournal({
     identity: input.identity,
@@ -73,9 +72,30 @@ export async function openAgentSessionJournalWithRecovery(input: {
   if (!probe?.corrupt) {
     return { journal, recovery: null }
   }
-  // `open()` quarantines the unusable suffix; a successful import rolls once
-  // more so the rebuilt timeline is the only content of its epoch.
-  return { journal, recovery: await rehydrate({ ...input, journal, trigger: 'journal_corrupt' }) }
+  // `open()` drops the unusable suffix; a successful import rolls once more so
+  // the rebuilt timeline is the only content of its epoch.
+  return { journal, recovery: await rehydrateOrClose(input, journal, 'journal_corrupt') }
+}
+
+/** `importLegacyTranscriptIntoJournal` can THROW rather than report `ok: false`
+ *  — a journal write failure, for instance — and nothing else holds a reference
+ *  to the journal this function just opened. A close that rejects is retryable,
+ *  so the journal is retained rather than dropped with its handle still open. */
+async function rehydrateOrClose(
+  input: {
+    identity: AgentSessionJournalIdentity
+    fence: number
+    historyFilePath?: string | null
+  },
+  journal: AgentSessionJournal,
+  trigger: AgentSessionJournalRecovery['trigger']
+): Promise<AgentSessionJournalRecovery> {
+  try {
+    return await rehydrate({ ...input, journal, trigger })
+  } catch (error) {
+    await agentSessionJournalCloseRetries.closeOrRetain(journal)
+    throw error
+  }
 }
 
 async function rehydrate(input: {
@@ -94,13 +114,16 @@ async function rehydrate(input: {
     fence: input.fence,
     ...(input.historyFilePath ? { options: { filePath: input.historyFilePath } } : {})
   })
-  if (!result.ok) {
+  // A transcript that held nothing is the same outcome as one that could not be
+  // read: nothing was restored, so the repair's marker has to stand and be
+  // retried on a later attach rather than being retired as a completed recovery.
+  if (!result.ok || !result.replaced) {
     return {
       trigger: input.trigger,
       reset,
       epoch: input.journal.epoch,
       imported: 0,
-      error: result.error
+      error: result.ok ? 'Provider history held no messages to restore' : result.error
     }
   }
   return {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
index 5be2d8ed09e..a21edcee35c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
@@ -58,8 +58,9 @@ export type AttachFlowInput = {
   onAcquiring?: () => Promise<void> | void
   /** Settles writes already captured by the superseded journal before opening another. */
   beforeJournalOpen?: () => Promise<void> | void
-  /** Removes any partial host publication after journal attachment fails. */
-  onAttachFailed?: () => void
+  /** Removes any partial host publication after journal attachment fails, and
+   *  closes the journal handle of the map entry it drops. Awaited: see eviction. */
+  onAttachFailed?: () => Promise<void>
 }
 
 export async function performAttach(
@@ -216,7 +217,9 @@ async function settlePostAcquisitionAttachFailure(
     exitProof =
       error instanceof AgentSessionAcquisitionExitUnprovenError ? 'unproven' : 'exit-proven'
   }
-  input.onAttachFailed?.()
+  // Why: the close is awaited so the map entry is gone only once its handle is
+  // released, but a failed close must not also cost the store settlement below.
+  await Promise.resolve(input.onAttachFailed?.()).catch(() => undefined)
   try {
     await input.store.settleFailedPostAcquisitionAttachment({
       sessionId: record.sessionId,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
index bd79bb1bb45..f4551ef9313 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
@@ -18,6 +18,9 @@ import {
 } from './structured-agent-session-launch-env'
 import { refuseAgentSessionMutation } from './structured-agent-session-mutation-admission'
 import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
+import type { DeferredStructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
+import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 
 export function attachStructuredAgentSession(
   context: StructuredAgentSessionAttachContext,
@@ -71,7 +74,10 @@ export function attachStructuredAgentSession(
       callerKey,
       params,
       now: () => context.now(),
-      onAttachFailed: () => {
+      // Site 9: this closes the PRIOR map entry it drops, never the provisional
+      // journal — it has no reference to that one. `onAttached` owns that.
+      onAttachFailed: async () => {
+        await context.sessions.get(sessionId)?.journal.close()
         context.sessions.delete(sessionId)
         eventSink.close()
         context.runtimeState.discardEventSink(sessionId)
@@ -80,14 +86,27 @@ export function attachStructuredAgentSession(
         const fence = context.deps.store.getRecord(sessionId)?.lease.runtimeFence ?? 0
         const previous = context.sessions.get(sessionId)
         const previousFence = previous?.fence
-        eventSink.bind({
-          journal: attached.journal,
-          fence,
-          publish: () => context.subscribers.publish(sessionId, attached.journal)
-        })
-        const barrier = await eventSink.drained()
-        if (!barrier.ok) {
-          throw barrier.error
+        // Site 8: the provisional journal has no owner until the map takes it,
+        // and the barrier below throws by design.
+        try {
+          await bindAndDrain(eventSink, attached.journal, fence, () =>
+            context.subscribers.publish(sessionId, attached.journal)
+          )
+        } catch (error) {
+          await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
+          throw error
+        }
+        // Site 10: a `set` over a live entry would orphan its handle — and a
+        // close that REJECTED did not release it. The replacement is therefore
+        // ABORTED rather than completed over a handle nothing can reach again:
+        // `previous` stays indexed, so teardown still owns it and can retry.
+        if (previous && previous.journal !== attached.journal) {
+          try {
+            await previous.journal.close()
+          } catch (error) {
+            await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
+            throw error
+          }
         }
         context.sessions.set(sessionId, {
           journal: attached.journal,
@@ -115,3 +134,18 @@ export function attachStructuredAgentSession(
   })
   return context.tasks.trackAttach(attaching)
 }
+
+/** Binds the sink to the journal and waits for the barrier the host publishes
+ *  behind. It throws by design when a sink barrier fails. */
+async function bindAndDrain(
+  eventSink: DeferredStructuredAgentSessionEventSink,
+  journal: AgentSessionJournal,
+  fence: number,
+  publish: () => void
+): Promise<void> {
+  eventSink.bind({ journal, fence, publish })
+  const barrier = await eventSink.drained()
+  if (!barrier.ok) {
+    throw barrier.error
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
index cfdbf786e14..83766f25fc5 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
@@ -32,6 +32,7 @@ import {
 } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { agentSessionProviderHandleChainHead } from '../../../shared/agent-session-provider-handle'
+import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import {
@@ -162,9 +163,18 @@ export async function attachJournal(input: {
     fence,
     historyFilePath
   })
-  return {
-    ...opened,
-    unconfirmedClientMessageIds: await opened.journal.markPendingSubmissionsUnknown(fence)
+  try {
+    // That await is a WRITE. A failure in it leaves the journal with no caller
+    // holding a reference to close it.
+    return {
+      ...opened,
+      unconfirmedClientMessageIds: await opened.journal.markPendingSubmissionsUnknown(fence)
+    }
+  } catch (error) {
+    // A rejected close leaves the handle open, so the journal is retained for a
+    // later retry rather than dropped along with the only reference to it.
+    await agentSessionJournalCloseRetries.closeOrRetain(opened.journal)
+    throw error
   }
 }
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
new file mode 100644
index 00000000000..a4666b4f045
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
@@ -0,0 +1,257 @@
+// A close that REJECTED did not release the handle.
+//
+// `AgentSessionJournal.close()` is retryable by design: the release step is
+// unguarded precisely so a second call is a second attempt. Callers that did
+// `close().catch(() => undefined)` and then threw or overwrote their map entry
+// turned that retryable failure into a permanent orphan — on POSIX a silent
+// leak, on Windows a handle that blocks renaming or removing the directory.
+//
+// These drive the REAL callers: the attach orchestration's `onAttached`, and
+// host teardown, which is what runtime stop calls. Only the lease/record
+// machinery around them is stubbed.
+
+import { access, mkdtemp, rename, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
+import {
+  agentSessionJournalCloseRetries,
+  JournalCloseRetryRegistry
+} from '../agent-session-journal/journal-close-retry'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { attachStructuredAgentSession } from './structured-agent-session-attach-orchestration'
+import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
+import { tearDownStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+const attachFlow = vi.hoisted(() => ({
+  journal: null as AgentSessionJournal | null
+}))
+
+// The lease reservation, the record store and the provider child are not what
+// these cases are about; `onAttached` is, and it is the real one.
+vi.mock('./structured-agent-session-attach-flow', () => ({
+  performAttach: async (input: {
+    onAttached: (
+      attached: { journal: AgentSessionJournal; recovery: null },
+      generation: string | null
+    ) => Promise<void>
+  }) => {
+    await input.onAttached({ journal: attachFlow.journal!, recovery: null }, null)
+    return { ok: true, value: {} }
+  }
+}))
+
+const SESSION = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: SESSION,
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: SESSION }
+}
+
+let root: string
+const journals = createTrackedJournalOpener()
+
+async function exists(path: string): Promise<boolean> {
+  return access(path)
+    .then(() => true)
+    .catch(() => false)
+}
+
+async function expectNothingHoldsTheDirectory(directory: string): Promise<void> {
+  const dbPath = journalDatabaseFile(directory)
+  expect(await exists(`${dbPath}-wal`)).toBe(false)
+  expect(await exists(`${dbPath}-shm`)).toBe(false)
+  // The half that actually fails on Windows when a handle is still open.
+  const moved = `${directory}-moved`
+  await rename(directory, moved)
+  await rm(moved, { recursive: true })
+}
+
+function hostSession(journal: AgentSessionJournal): StructuredAgentSessionHostSession {
+  return {
+    journal,
+    params: {} as StructuredAgentSessionHostSession['params'],
+    fence: 1,
+    hasProviderChild: false,
+    acquisitionGeneration: null
+  }
+}
+
+/** A journal whose close rejects until `failures` is exhausted, wrapping a real
+ *  store so the handle it holds is a real one. */
+function flakyClose(journal: AgentSessionJournal, failures: number): AgentSessionJournal {
+  let remaining = failures
+  return new Proxy(journal, {
+    get(target, property, receiver) {
+      if (property !== 'close') {
+        return Reflect.get(target, property, receiver)
+      }
+      return async () => {
+        if (remaining > 0) {
+          remaining -= 1
+          throw new Error('close rejected')
+        }
+        await target.close()
+      }
+    }
+  })
+}
+
+function attachContext(
+  sessions: Map<string, StructuredAgentSessionHostSession>
+): StructuredAgentSessionAttachContext {
+  const eventSink = {
+    sink: {},
+    drained: async () => ({ ok: true }) as const,
+    unbind: () => undefined,
+    bind: () => undefined,
+    close: () => undefined
+  }
+  return {
+    deps: { store: { getRecord: () => null }, claimKeyId: 'key-1', journalRoot: root },
+    runtimeState: {
+      resolveRecovery: async () => undefined,
+      eventSinkFor: () => eventSink,
+      probeOwner: async () => ({ outcome: 'pid-absent' }),
+      discardEventSink: () => undefined
+    },
+    sessions,
+    subscribers: {
+      reset: () => undefined,
+      snapshot: () => undefined,
+      publish: () => undefined
+    },
+    tasks: { trackAttach: <T>(task: Promise<T>) => task },
+    reconcileLeases: async () => null,
+    serialize: <T>(_sessionId: string, task: () => Promise<T>) => task(),
+    now: () => 1
+  } as unknown as StructuredAgentSessionAttachContext
+}
+
+const attachParams = {
+  envelope: { sessionId: SESSION, clientOperationId: 'op-1' }
+} as unknown as Parameters<typeof attachStructuredAgentSession>[2]
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-close-retry-'))
+  // The registry is process-wide; drain it so one case cannot see another's.
+  await agentSessionJournalCloseRetries.retryAll()
+})
+
+afterEach(async () => {
+  await agentSessionJournalCloseRetries.retryAll()
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('the registry', () => {
+  it('retains a journal whose close rejected and releases it on the retry', async () => {
+    const directory = join(root, 'retained')
+    const registry = new JournalCloseRetryRegistry()
+    const journal = flakyClose(
+      await journals.open({ identity: IDENTITY, journalDir: directory }),
+      1
+    )
+
+    const first = await registry.closeOrRetain(journal)
+    expect(first.closed).toBe(false)
+    expect(registry.pendingDirectories).toEqual([directory])
+
+    expect(await registry.retryAll()).toEqual([])
+    expect(registry.pendingDirectories).toEqual([])
+    await expectNothingHoldsTheDirectory(directory)
+  })
+})
+
+describe('the attach orchestration', () => {
+  it('ABORTS the map replacement when the previous journal will not close', async () => {
+    const previousDir = join(root, 'previous')
+    const provisionalDir = join(root, 'provisional')
+    const previous = flakyClose(
+      await journals.open({ identity: IDENTITY, journalDir: previousDir }),
+      1
+    )
+    const provisional = await journals.open({
+      identity: IDENTITY,
+      journalDir: provisionalDir
+    })
+    attachFlow.journal = provisional
+    const sessions = new Map([[SESSION, hostSession(previous)]])
+
+    await expect(
+      attachStructuredAgentSession(attachContext(sessions), 'caller-1', attachParams)
+    ).rejects.toThrow('close rejected')
+
+    // The live entry is UNTOUCHED: overwriting it would have left its handle
+    // open with nothing able to reach it again.
+    expect(sessions.get(SESSION)?.journal).toBe(previous)
+    // And the provisional journal is owned by the registry, not orphaned.
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
+    await expectNothingHoldsTheDirectory(provisionalDir)
+  })
+
+  it('retains the provisional journal when its own close rejects on the barrier path', async () => {
+    const provisionalDir = join(root, 'provisional-barrier')
+    const provisional = flakyClose(
+      await journals.open({ identity: IDENTITY, journalDir: provisionalDir }),
+      1
+    )
+    attachFlow.journal = provisional
+    const sessions = new Map<string, StructuredAgentSessionHostSession>()
+    const context = attachContext(sessions)
+    const failing = {
+      sink: {},
+      drained: async () => ({ ok: false, error: new Error('sink barrier failed') }) as const,
+      unbind: () => undefined,
+      bind: () => undefined,
+      close: () => undefined
+    }
+    context.runtimeState.eventSinkFor = (() =>
+      failing) as unknown as typeof context.runtimeState.eventSinkFor
+
+    await expect(attachStructuredAgentSession(context, 'caller-1', attachParams)).rejects.toThrow(
+      'sink barrier failed'
+    )
+
+    expect(sessions.size).toBe(0)
+    // Retained rather than dropped, so teardown can still release the handle.
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([provisionalDir])
+  })
+})
+
+describe('teardown, which is what runtime stop calls', () => {
+  it('retries the journals earlier failure paths could not close', async () => {
+    const orphanDir = join(root, 'orphan')
+    const orphan = flakyClose(await journals.open({ identity: IDENTITY, journalDir: orphanDir }), 1)
+    expect((await agentSessionJournalCloseRetries.closeOrRetain(orphan)).closed).toBe(false)
+
+    // The first teardown reports the still-failing close instead of hiding it.
+    await tearDownStructuredAgentSessionHost({ phases: [], sessions: new Map() })
+
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
+    await expectNothingHoldsTheDirectory(orphanDir)
+  })
+
+  it('surfaces a retained close that still rejects, and keeps it for the next stop', async () => {
+    const orphanDir = join(root, 'stubborn')
+    const orphan = flakyClose(await journals.open({ identity: IDENTITY, journalDir: orphanDir }), 2)
+    await agentSessionJournalCloseRetries.closeOrRetain(orphan)
+
+    await expect(
+      tearDownStructuredAgentSessionHost({ phases: [], sessions: new Map() })
+    ).rejects.toMatchObject({ errors: [expect.objectContaining({ message: 'close rejected' })] })
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([orphanDir])
+
+    // A later stop is a real retry, not a no-op.
+    await tearDownStructuredAgentSessionHost({ phases: [], sessions: new Map() })
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
+    await expectNothingHoldsTheDirectory(orphanDir)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-estimate.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-estimate.ts
index 4aed742f51d..e16f6a63c9d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-estimate.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-estimate.ts
@@ -2,16 +2,10 @@ import type {
   AgentJournalItemBody,
   AgentJournalItemIdentity
 } from '../../../shared/agent-session-journal-types'
-import type { StructuredAgentSessionJournalBlob } from './structured-agent-session-event-sink'
 
 export function estimateStructuredAgentSessionItemBytes(
   identity: AgentJournalItemIdentity,
-  body: AgentJournalItemBody,
-  blobs: readonly StructuredAgentSessionJournalBlob[]
+  body: AgentJournalItemBody
 ): number {
-  return (
-    Buffer.byteLength(JSON.stringify({ identity, body }), 'utf8') +
-    blobs.reduce((total, blob) => total + Buffer.byteLength(blob.payload, 'utf8'), 0) +
-    512
-  )
+  return Buffer.byteLength(JSON.stringify({ identity, body }), 'utf8') + 512
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
index 6befa3b0b62..c97161ce3dd 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
@@ -287,13 +287,13 @@ describe('deferred structured agent-session event sink', () => {
     releaseSecond?.()
   })
 
-  it('replaces a queued same-item checkpoint before any blob is created', async () => {
+  it('replaces a queued same-item checkpoint before it runs', async () => {
     const log: Recorded[] = []
     const deferred = createDeferredStructuredAgentSessionEventSink()
     const options = { coalescingKey: 'checkpoint:item-1' }
 
-    deferred.sink.appendItem(identity(0), BODY, [], options)
-    deferred.sink.appendItem(identity(1), BODY, [], options)
+    deferred.sink.appendItem(identity(0), BODY, options)
+    deferred.sink.appendItem(identity(1), BODY, options)
     expect(deferred.state().queuedOperations).toBe(1)
 
     deferred.bind(target(6, log))
@@ -306,9 +306,9 @@ describe('deferred structured agent-session event sink', () => {
     const deferred = createDeferredStructuredAgentSessionEventSink()
     const options = { coalescingKey: 'checkpoint:item-1' }
 
-    deferred.sink.appendItem(identity(0), BODY, [], options)
+    deferred.sink.appendItem(identity(0), BODY, options)
     deferred.sink.appendItem(identity(1), BODY)
-    deferred.sink.appendItem(identity(2), BODY, [], options)
+    deferred.sink.appendItem(identity(2), BODY, options)
     deferred.bind(target(6, log))
     await deferred.drained()
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
index e0d91f93b71..7e0192f179c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
@@ -8,8 +8,6 @@ import type { JournalLifecycleMutationInput } from '../agent-session-journal/jou
 import { estimateStructuredAgentSessionItemBytes } from './structured-agent-session-event-sink-estimate'
 import { StructuredAgentSessionSinkQueue } from './structured-agent-session-event-sink-queue'
 
-export type StructuredAgentSessionJournalBlob = { digest: string; payload: string }
-
 export type StructuredAgentSessionSinkAdmission =
   | { accepted: true }
   | { accepted: false; reason: 'backpressure' | 'failed' | 'closed' }
@@ -24,7 +22,7 @@ export type StructuredAgentSessionSinkState = {
 export type StructuredAgentSessionSinkBarrier = { ok: true } | { ok: false; error: unknown }
 
 export type StructuredAgentSessionAppendOptions = {
-  /** Pending checkpoints with this key replace one another before blob writes. */
+  /** Pending checkpoints with this key replace one another before they run. */
   coalescingKey?: string
   /** Marks a critical lifecycle operation for lifecycle barriers and diagnostics. */
   lifecycle?: boolean
@@ -34,7 +32,6 @@ export type StructuredAgentSessionEventSink = {
   appendItem(
     identity: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
-    blobs?: readonly StructuredAgentSessionJournalBlob[],
     options?: StructuredAgentSessionAppendOptions
   ): void
   appendTombstone(
@@ -49,7 +46,6 @@ export type StructuredAgentSessionEventSink = {
   tryAppendItem?(
     identity: AgentJournalItemIdentity,
     body: AgentJournalItemBody,
-    blobs?: readonly StructuredAgentSessionJournalBlob[],
     options?: StructuredAgentSessionAppendOptions
   ): StructuredAgentSessionSinkAdmission
   appendLifecycleBatch?(
@@ -159,32 +155,22 @@ export function createDeferredStructuredAgentSessionEventSink(
 
   return {
     sink: {
-      appendItem: (identity, body, blobs = [], options = {}) => {
+      appendItem: (identity, body, options = {}) => {
         queue.submit(
           {
-            bytes: estimateStructuredAgentSessionItemBytes(identity, body, blobs),
+            bytes: estimateStructuredAgentSessionItemBytes(identity, body),
             coalescingKey: options.coalescingKey,
-            run: (bound) =>
-              blobs.length > 0 && typeof bound.journal.appendItemWithBlobs === 'function'
-                ? bound.journal.appendItemWithBlobs(identity, body, blobs, {
-                    fence: bound.fence
-                  })
-                : bound.journal.appendItem(identity, body, { fence: bound.fence })
+            run: (bound) => bound.journal.appendItem(identity, body, { fence: bound.fence })
           },
           options
         )
       },
-      tryAppendItem: (identity, body, blobs = [], options = {}) =>
+      tryAppendItem: (identity, body, options = {}) =>
         queue.submit(
           {
-            bytes: estimateStructuredAgentSessionItemBytes(identity, body, blobs),
+            bytes: estimateStructuredAgentSessionItemBytes(identity, body),
             coalescingKey: options.coalescingKey,
-            run: (bound) =>
-              blobs.length > 0 && typeof bound.journal.appendItemWithBlobs === 'function'
-                ? bound.journal.appendItemWithBlobs(identity, body, blobs, {
-                    fence: bound.fence
-                  })
-                : bound.journal.appendItem(identity, body, { fence: bound.fence })
+            run: (bound) => bound.journal.appendItem(identity, body, { fence: bound.fence })
           },
           options
         ),
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
index d1430ac237c..0d2c693c75f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
@@ -26,7 +26,9 @@ function context(): StructuredAgentSessionEvictionContext & { order: string[] }
         return true
       })
     } as unknown as StructuredAgentSessionEvictionContext['adapter'],
-    forget: vi.fn(() => order.push('forget')),
+    forget: vi.fn(async () => {
+      order.push('forget')
+    }),
     discardSink: vi.fn(() => order.push('discardSink')),
     releaseLease: vi.fn(async () => {
       order.push('releaseLease')
@@ -122,7 +124,7 @@ describe('rows the provider emits while closing', () => {
           return true
         }
       } as never,
-      forget: () => {},
+      forget: async () => {},
       discardSink: () => state.discardEventSink(sessionId),
       releaseLease: async () => {}
     })
@@ -171,7 +173,7 @@ describe('eviction against the real sink cache', () => {
       sessionId,
       eventSink: state.eventSinkFor(sessionId),
       adapter: { closeSession: async () => true } as never,
-      forget: () => {},
+      forget: async () => {},
       discardSink: () => state.discardEventSink(sessionId),
       releaseLease: async () => {}
     })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
index 5d1bcaf180c..c2591bba567 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
@@ -25,7 +25,10 @@ export type StructuredAgentSessionEvictionContext = {
   hasProviderChild?: boolean
   eventSink: DeferredStructuredAgentSessionEventSink
   adapter: StructuredAgentSessionAdapter
-  forget: () => void
+  /** Closes the session's journal handle and drops the map entry. Async and
+   *  awaited: `close()` is ordered behind queued writes, and a delete that
+   *  returns while the close is still queued leaves nothing to retry. */
+  forget: () => Promise<void>
   /** Drops the cached sink so a later attach mints a fresh one. */
   discardSink: () => void
   /** Hands the lease back now that this host's child is proven gone. No-ops when the record is
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts
index e125d3e49ae..f0f410b66aa 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts
@@ -12,7 +12,8 @@ import {
   setStoredAgentSessionHandoffStage,
   stopStoredAgentSessionOwnerForHandoff
 } from '../../runtime/agent-session-handoff-record-transitions'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import type { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { StructuredAgentSessionHandoffCoordinator } from './structured-agent-session-handoff'
 import { createStructuredHandoffFlowContext } from './structured-agent-session-handoff-flow-context'
 import { handoffStructuredSessionToTui } from './structured-agent-session-handoff-forward'
@@ -21,6 +22,8 @@ import type {
   StructuredTuiOwner
 } from './structured-agent-session-handoff-types'
 
+const journals = createTrackedJournalOpener()
+
 const NOW = 1_800_000_000_000
 const SESSION = 'session-handoff'
 const PLAIN_RESIDUE = 'session-plain-residue'
@@ -211,7 +214,7 @@ beforeEach(async () => {
   stopRecoveredOwner = vi.fn(async () => undefined)
   store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
   await establishNativeOwner()
-  journal = await openAgentSessionJournal({
+  journal = await journals.open({
     identity: {
       sessionId: SESSION,
       workspaceId: 'workspace-1',
@@ -232,6 +235,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -426,7 +430,7 @@ describe('structured session ownership recovery on restore', () => {
           : { outcome: 'pid-absent' },
       now: NOW + 1_000
     })
-    journal = await openAgentSessionJournal({
+    journal = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts
index 1828807f887..4c807d879b6 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts
@@ -8,13 +8,15 @@ import type {
 } from '../../../shared/agent-session-record'
 import { LOCAL_EXECUTION_HOST_ID } from '../../../shared/execution-host'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { createDeferredStructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
 import {
   acquireNativeHandoffOwner,
   structuredTuiTranscriptImportOptions
 } from './structured-agent-session-host-handoff'
 
+const journals = createTrackedJournalOpener()
+
 function importRecord(provider: 'claude' | 'codex', accountHome: string): AgentSessionRecord {
   return {
     provider,
@@ -54,6 +56,7 @@ describe('native handoff acquisition', () => {
   })
 
   afterEach(async () => {
+    await journals.closeAll()
     await rm(root, { recursive: true, force: true })
   })
 
@@ -82,7 +85,7 @@ describe('native handoff acquisition', () => {
       },
       now
     })
-    const journal = await openAgentSessionJournal({
+    const journal = await journals.open({
       identity: {
         sessionId,
         workspaceId: location.workspaceId,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
index 5f3bbc5c731..2afd94ba128 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
@@ -48,7 +48,10 @@ export async function evictHeldStructuredAgentSession(
     hasProviderChild: hasProviderChild(context, sessionId),
     eventSink: context.runtimeState.eventSinkFor(sessionId),
     adapter: context.deps.adapter,
-    forget: () => context.sessions.delete(sessionId),
+    forget: async () => {
+      await context.sessions.get(sessionId)?.journal.close()
+      context.sessions.delete(sessionId)
+    },
     discardSink: () => context.runtimeState.discardEventSink(sessionId),
     releaseLease: () =>
       releaseStoredStructuredAgentSessionOwner({
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
new file mode 100644
index 00000000000..2b230db1357
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
@@ -0,0 +1,53 @@
+// Host teardown, made failure-complete.
+//
+// A trailing "close every journal" statement is skipped on exactly the path
+// that leaks: `flushAllEventSinks` throws BY DESIGN when a sink barrier fails,
+// and the attach drain can reject too. Every connection would then be left open
+// with the global runtime reference already cleared — the one state from which
+// nothing can ever close them.
+
+import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+export type StructuredAgentSessionTeardownPhase = {
+  name: string
+  run: () => Promise<void> | void
+}
+
+export async function tearDownStructuredAgentSessionHost(input: {
+  phases: readonly StructuredAgentSessionTeardownPhase[]
+  sessions: Map<string, StructuredAgentSessionHostSession>
+}): Promise<void> {
+  const failures: unknown[] = []
+  for (const phase of input.phases) {
+    try {
+      await phase.run()
+    } catch (error) {
+      failures.push(error)
+    }
+  }
+
+  const entries = [...input.sessions.entries()]
+  // `allSettled`, so one rejected close cannot skip the others.
+  const closed = await Promise.allSettled(entries.map(([, session]) => session.journal.close()))
+  closed.forEach((result, index) => {
+    const sessionId = entries[index]?.[0]
+    if (result.status === 'fulfilled') {
+      // Only a FULFILLED close drops the entry. One that rejected stays indexed,
+      // which is what makes a later close a real retry rather than a no-op.
+      if (sessionId !== undefined) {
+        input.sessions.delete(sessionId)
+      }
+      return
+    }
+    failures.push(result.reason)
+  })
+
+  // Journals an earlier failure path could not close are retried HERE, which is
+  // the only place that owns them once their caller has unwound.
+  failures.push(...(await agentSessionJournalCloseRetries.retryAll()))
+
+  if (failures.length > 0) {
+    throw new AggregateError(failures, 'agent session host teardown failed')
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
index 8de64e3f419..5354670fa0b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
@@ -13,7 +13,7 @@ import type {
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type {
   AgentSessionDispatchOutcome,
   StructuredAgentSessionAdapter
@@ -30,6 +30,8 @@ import {
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
 
+const journals = createTrackedJournalOpener()
+
 const CALLER = { callerKey: 'client-1' }
 
 function envelope(
@@ -97,7 +99,7 @@ async function attach(): Promise<AgentSessionRecord | null> {
 async function seedApproval(optionId = 'allow'): Promise<{ itemId: string; revision: number }> {
   const identity = { provider: 'codex' as const, threadId: THREAD, turnId: 'turn-1', ordinal: 99 }
   const journalDir = journalDirectoryFor(root, { workspaceId: 'workspace-1', sessionId: SESSION })
-  const journal = await openAgentSessionJournal({
+  const journal = await journals.open({
     identity: {
       sessionId: SESSION,
       workspaceId: 'workspace-1',
@@ -157,6 +159,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await host.flushAllStreamedEvents()
   await rm(root, { recursive: true, force: true })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
index 3c5256cece0..99d6c212c10 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
@@ -49,6 +49,7 @@ import {
   type StructuredAgentSessionMutationContext
 } from './structured-agent-session-host-mutations'
 import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
+import { tearDownStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
 import type {
   StructuredAgentSessionCaller,
   StructuredAgentSessionHostDeps,
@@ -108,6 +109,8 @@ export class StructuredAgentSessionHost {
       resolveRecovery: (sessionId) => this.runtimeState.resolveRecovery(sessionId),
       serialize: (sessionId, task) => this.serialize(sessionId, task),
       hasSession: (sessionId) => this.sessions.has(sessionId),
+      // Site 10: cannot overwrite a live entry — the restorer returns early on
+      // `hasSession` inside the same serialized step as this `set`.
       onReadable: (sessionId, restored) => this.sessions.set(sessionId, restored),
       restoreHandoff: (sessionId) => this.handoffs.restore(sessionId)
     })
@@ -249,11 +252,16 @@ export class StructuredAgentSessionHost {
     this.runtimeState.flushEventSink(sessionId)
 
   async flushAllStreamedEvents(): Promise<void> {
-    this.holds.dispose()
-    this.runtimeState.stopLeaseRenewal()
-    this.handoffs.stopTuiHistoryCatchup()
-    await this.tasks.drainAttaches()
-    await this.runtimeState.flushAllEventSinks()
+    await tearDownStructuredAgentSessionHost({
+      phases: [
+        { name: 'dispose-holds', run: () => this.holds.dispose() },
+        { name: 'stop-lease-renewal', run: () => this.runtimeState.stopLeaseRenewal() },
+        { name: 'stop-tui-catchup', run: () => this.handoffs.stopTuiHistoryCatchup() },
+        { name: 'drain-attaches', run: () => this.tasks.drainAttaches() },
+        { name: 'flush-event-sinks', run: () => this.runtimeState.flushAllEventSinks() }
+      ],
+      sessions: this.sessions
+    })
   }
 
   private mutationContext(): StructuredAgentSessionMutationContext {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
new file mode 100644
index 00000000000..b1cfd81b2a5
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
@@ -0,0 +1,250 @@
+// Journal handle ownership across the wire layer.
+//
+// Every one of these sites is reached only when something has already gone
+// wrong, so a happy-path assertion proves nothing about them. On POSIX a leak
+// is silent; the rename/remove pair below is the half that actually fails on
+// Windows.
+
+import { access, mkdtemp, rename, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
+import type * as JournalLegacyImport from '../agent-session-journal/journal-legacy-import'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { openAgentSessionJournalWithRecovery } from './agent-session-journal-recovery'
+import {
+  evictStructuredAgentSession,
+  STRUCTURED_AGENT_SESSION_EVICTION_STEPS,
+  type StructuredAgentSessionEvictionContext
+} from './structured-agent-session-eviction'
+import { tearDownStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+const legacyImport = vi.hoisted(() => ({ throws: false }))
+
+vi.mock('../agent-session-journal/journal-legacy-import', async (importOriginal) => {
+  const actual = await importOriginal<typeof JournalLegacyImport>()
+  return {
+    ...actual,
+    importLegacyTranscriptIntoJournal: async (
+      input: Parameters<typeof actual.importLegacyTranscriptIntoJournal>[0]
+    ) => {
+      if (legacyImport.throws) {
+        throw new Error('legacy import threw instead of reporting a failure')
+      }
+      return actual.importLegacyTranscriptIntoJournal(input)
+    }
+  }
+})
+
+const SESSION = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: SESSION,
+  workspaceId: 'ws-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: SESSION }
+}
+
+let root: string
+let journalDir: string
+const journals = createTrackedJournalOpener()
+
+async function exists(path: string): Promise<boolean> {
+  return access(path)
+    .then(() => true)
+    .catch(() => false)
+}
+
+async function expectNothingHoldsTheDirectory(directory: string): Promise<void> {
+  const dbPath = journalDatabaseFile(directory)
+  expect(await exists(`${dbPath}-wal`)).toBe(false)
+  expect(await exists(`${dbPath}-shm`)).toBe(false)
+  const moved = `${directory}-moved`
+  await rename(directory, moved)
+  await rm(moved, { recursive: true })
+}
+
+function hostSession(journal: AgentSessionJournal): StructuredAgentSessionHostSession {
+  return {
+    journal,
+    params: {} as StructuredAgentSessionHostSession['params'],
+    fence: 1,
+    hasProviderChild: false,
+    acquisitionGeneration: null
+  }
+}
+
+function evictionContext(
+  overrides: Partial<StructuredAgentSessionEvictionContext>
+): StructuredAgentSessionEvictionContext {
+  return {
+    sessionId: SESSION,
+    hasProviderChild: false,
+    eventSink: {
+      drained: async () => ({ ok: true }) as const,
+      unbind: () => undefined,
+      close: () => undefined
+    } as unknown as StructuredAgentSessionEvictionContext['eventSink'],
+    adapter: {} as StructuredAgentSessionEvictionContext['adapter'],
+    forget: async () => undefined,
+    discardSink: () => undefined,
+    releaseLease: async () => undefined,
+    ...overrides
+  }
+}
+
+beforeEach(async () => {
+  legacyImport.throws = false
+  root = await mkdtemp(join(tmpdir(), 'orca-wire-handles-'))
+  journalDir = join(root, 'journal')
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('site 6: recovery rehydration', () => {
+  it('closes the journal it opened when the legacy import throws', async () => {
+    const seeded = await journals.open({ identity: IDENTITY, journalDir })
+    for (let ordinal = 1; ordinal <= 3; ordinal += 1) {
+      await seeded.appendItem(
+        { provider: 'codex', threadId: SESSION, turnId: 'turn-1', ordinal },
+        { kind: 'status', text: `seed-${ordinal}` },
+        { fence: 1 }
+      )
+    }
+    await seeded.close()
+    // Punch a hole in the middle so recovery takes the `journal_corrupt` branch.
+    const { openJournalDatabase } = await import('../agent-session-journal/journal-database')
+    const opened = openJournalDatabase(journalDatabaseFile(journalDir))
+    opened.db.prepare('DELETE FROM journal_rows WHERE seq = ?').run(3)
+    opened.db.close()
+    legacyImport.throws = true
+
+    await expect(
+      openAgentSessionJournalWithRecovery({
+        identity: IDENTITY,
+        journalDir,
+        fence: 1,
+        historyFilePath: join(root, 'missing.jsonl')
+      })
+    ).rejects.toThrow('legacy import threw')
+    await expectNothingHoldsTheDirectory(journalDir)
+  })
+})
+
+describe('sites 9 and 10: the delete and overwrite callbacks', () => {
+  it('awaits the journal close before dropping the map entry', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir })
+    const sessions = new Map([[SESSION, hostSession(journal)]])
+    const order: string[] = []
+
+    await evictStructuredAgentSession(
+      evictionContext({
+        forget: async () => {
+          order.push('close-started')
+          await sessions.get(SESSION)?.journal.close()
+          order.push('closed')
+          sessions.delete(SESSION)
+          order.push('forgotten')
+        }
+      }),
+      STRUCTURED_AGENT_SESSION_EVICTION_STEPS
+    )
+
+    expect(order).toEqual(['close-started', 'closed', 'forgotten'])
+    expect(sessions.size).toBe(0)
+    await expectNothingHoldsTheDirectory(journalDir)
+  })
+
+  it('aborts the eviction with the session still indexed when the close rejects', async () => {
+    const journal = await journals.open({ identity: IDENTITY, journalDir })
+    const sessions = new Map([[SESSION, hostSession(journal)]])
+
+    await expect(
+      evictStructuredAgentSession(
+        evictionContext({
+          forget: async () => {
+            await Promise.reject(new Error('close rejected'))
+          }
+        }),
+        STRUCTURED_AGENT_SESSION_EVICTION_STEPS
+      )
+    ).rejects.toMatchObject({ step: 'forget-session' })
+    // Still indexed, so the next close is a real retry.
+    expect(sessions.has(SESSION)).toBe(true)
+  })
+})
+
+describe('site 11: host teardown is failure-complete', () => {
+  async function twoSessions(): Promise<Map<string, StructuredAgentSessionHostSession>> {
+    const first = await journals.open({ identity: IDENTITY, journalDir })
+    const second = await journals.open({
+      identity: { ...IDENTITY, sessionId: `${SESSION}-b` },
+      journalDir: join(root, 'journal-b')
+    })
+    return new Map([
+      [SESSION, hostSession(first)],
+      [`${SESSION}-b`, hostSession(second)]
+    ])
+  }
+
+  it('closes every journal and clears the map on the happy path', async () => {
+    const sessions = await twoSessions()
+    await tearDownStructuredAgentSessionHost({ phases: [], sessions })
+
+    expect(sessions.size).toBe(0)
+    await expectNothingHoldsTheDirectory(journalDir)
+    await expectNothingHoldsTheDirectory(join(root, 'journal-b'))
+  })
+
+  // Against a trailing-statement design this case fails: `flushAllEventSinks`
+  // throws by design, so the close would be skipped on exactly the leaking path.
+  it('still closes every journal when a teardown phase throws', async () => {
+    const sessions = await twoSessions()
+    const barrierError = new Error('sink barrier failed')
+
+    await expect(
+      tearDownStructuredAgentSessionHost({
+        phases: [
+          {
+            name: 'flush-event-sinks',
+            run: () => {
+              throw barrierError
+            }
+          }
+        ],
+        sessions
+      })
+    ).rejects.toMatchObject({ errors: [barrierError] })
+
+    expect(sessions.size).toBe(0)
+    await expectNothingHoldsTheDirectory(journalDir)
+    await expectNothingHoldsTheDirectory(join(root, 'journal-b'))
+  })
+
+  it('keeps the entry whose close rejected, and surfaces the rejection', async () => {
+    const sessions = await twoSessions()
+    const failing = sessions.get(SESSION)
+    const closeError = new Error('close rejected')
+    if (failing) {
+      failing.journal = {
+        close: () => Promise.reject(closeError)
+      } as unknown as AgentSessionJournal
+    }
+
+    await expect(
+      tearDownStructuredAgentSessionHost({ phases: [], sessions })
+    ).rejects.toMatchObject({ errors: [closeError] })
+
+    // Only the failure stays indexed — `status === 'fulfilled'`, not "settled".
+    expect([...sessions.keys()]).toEqual([SESSION])
+    await expectNothingHoldsTheDirectory(join(root, 'journal-b'))
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
index 5f2589de4f2..5bed8f2920e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
@@ -39,7 +39,7 @@ export async function restoreStructuredAgentSessionRead(
     workspaceId: record.location.workspaceId,
     sessionId
   })
-  const loaded = await loadJournal(journalDir, sessionId)
+  const loaded = loadJournal(journalDir, sessionId)
   if (!loaded || loaded.corrupt) {
     return null
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
index b06ec51018f..581743633c0 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
@@ -4,17 +4,19 @@ import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
 import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { performSend, type AgentSessionTurnContext } from './structured-agent-session-turns'
 
+const journals = createTrackedJournalOpener()
+
 let root: string
 let journal: AgentSessionJournal
 
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-send-idempotency-'))
-  journal = await openAgentSessionJournal({
+  journal = await journals.open({
     identity: {
       sessionId: 'session-1',
       workspaceId: 'workspace-1',
@@ -27,6 +29,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
index bd4dd1958ef..6b627726f98 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
@@ -1,4 +1,4 @@
-import { appendFile, mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -11,26 +11,30 @@ import {
   REMOTE_RUNTIME_MAX_OUTBOUND_JSON_BYTES,
   serializeRemoteRuntimePayload
 } from '../../../shared/remote-runtime-memory-limits'
-import { JOURNAL_LOG_FILE } from '../agent-session-journal/journal-log-file'
-import { serializeJournalRow, type JournalRow } from '../agent-session-journal/journal-row-schema'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { openJournalDatabase } from '../agent-session-journal/journal-database'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import { insertJournalRow } from '../agent-session-journal/journal-row-table'
+import type { JournalRow } from '../agent-session-journal/journal-row-schema'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { AgentSessionSubscribers } from './structured-agent-session-subscribers'
 
 const SESSION = 'subscriber-session'
 
 let root: string
+const journals = createTrackedJournalOpener()
 
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-agent-subscribers-'))
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
 describe('AgentSessionSubscribers', () => {
   it('publishes the current fence when a resumed cursor is already caught up', async () => {
-    const journal = await openAgentSessionJournal({
+    const journal = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
@@ -67,7 +71,7 @@ describe('AgentSessionSubscribers', () => {
   })
 
   it('publishes handoff-only changes without serializing a transcript snapshot', async () => {
-    const journal = await openAgentSessionJournal({
+    const journal = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
@@ -112,7 +116,7 @@ describe('AgentSessionSubscribers', () => {
 
   it('catches a subscriber up past a pre-existing unsendable removal with a bounded reset', async () => {
     const journalDir = join(root, 'oversized-removal-journal')
-    const seeded = await openAgentSessionJournal({
+    const seeded = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
@@ -150,12 +154,20 @@ describe('AgentSessionSubscribers', () => {
         ts: 2_001
       }
     ]
-    await appendFile(
-      join(journalDir, JOURNAL_LOG_FILE),
-      `${rows.map(serializeJournalRow).join('\n')}\n`,
-      'utf-8'
-    )
-    const journal = await openAgentSessionJournal({
+    // Staged straight into the session database, exactly as a previous writer
+    // would have committed them.
+    await seeded.close()
+    const opened = openJournalDatabase(journalDatabaseFile(journalDir))
+    try {
+      opened.db.exec('BEGIN IMMEDIATE')
+      for (const row of rows) {
+        insertJournalRow(opened.db, SESSION, row)
+      }
+      opened.db.exec('COMMIT')
+    } finally {
+      opened.db.close()
+    }
+    const journal = await journals.open({
       identity: {
         sessionId: SESSION,
         workspaceId: 'workspace-1',
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
index 47edf3470e6..5222f9557f9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
@@ -3,14 +3,9 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
-import {
-  performCancel,
-  performSend,
-  type AgentSessionTurnContext
-} from './structured-agent-session-turns'
-import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from '../agent-session-journal/journal-payload-bounds'
+import { performCancel, type AgentSessionTurnContext } from './structured-agent-session-turns'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -21,8 +16,10 @@ const IDENTITY: AgentSessionJournalIdentity = {
 }
 
 let root: string | null = null
+const journals = createTrackedJournalOpener()
 
 afterEach(async () => {
+  await journals.closeAll()
   if (root) {
     await rm(root, { recursive: true, force: true })
     root = null
@@ -32,7 +29,7 @@ afterEach(async () => {
 describe('performCancel', () => {
   it('acknowledges only the request and leaves the running lifecycle row intact', async () => {
     root = await mkdtemp(join(tmpdir(), 'orca-turn-cancel-'))
-    const journal = await openAgentSessionJournal({ identity: IDENTITY, journalDir: root })
+    const journal = await journals.open({ identity: IDENTITY, journalDir: root })
     const lifecycleIdentity = {
       provider: 'legacy' as const,
       agent: 'codex' as const,
@@ -77,190 +74,3 @@ describe('performCancel', () => {
     ])
   })
 })
-
-describe('performSend lifecycle capacity', () => {
-  it('refuses before provider contact when dispatch plus terminal capacity cannot fit', async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-turn-capacity-'))
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 100 * 1024 }
-    })
-    const dispatch = vi.fn()
-    const ctx = turnContext(journal, { dispatch } as unknown as StructuredAgentSessionAdapter)
-
-    const result = await performSend(ctx, {
-      clientMessageId: 'message-1',
-      payloadFingerprint: 'a'.repeat(64),
-      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run' }] }
-    })
-
-    expect(result).toMatchObject({ ok: false })
-    expect(dispatch).not.toHaveBeenCalled()
-    expect(journal.submissions()).toEqual([])
-    expect(journal.lifecycleCapacityState()).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-  })
-
-  it('binds a synchronous turn start to tentative capacity and releases only on terminality', async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-turn-capacity-'))
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 400 * 1024 }
-    })
-    const turnIdentity = {
-      provider: 'legacy' as const,
-      agent: 'codex' as const,
-      sessionId: 'session-1',
-      recordId: 'turn-lifecycle:turn-1'
-    }
-    const dispatch = vi.fn(async () => {
-      await journal.appendItem(
-        turnIdentity,
-        {
-          kind: 'status',
-          text: 'Agent is working…',
-          turnLifecycle: { turnId: 'turn-1', state: 'running' }
-        },
-        { fence: 1 }
-      )
-      return {
-        state: 'accepted' as const,
-        providerIdentity: {
-          provider: 'codex' as const,
-          threadId: 'thread-1',
-          turnId: 'turn-1',
-          ordinal: 0
-        }
-      }
-    })
-    const ctx = turnContext(journal, { dispatch } as unknown as StructuredAgentSessionAdapter)
-
-    const result = await performSend(ctx, {
-      clientMessageId: 'message-1',
-      payloadFingerprint: 'a'.repeat(64),
-      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run' }] }
-    })
-
-    expect(result).toMatchObject({ ok: true })
-    expect(journal.lifecycleCapacityState()).toEqual({
-      reservedBytes: 128 * 1024,
-      reservedAppendSlots: 1
-    })
-    await journal.appendLifecycleBatch({
-      settlementId: 'turn-completed:turn-1',
-      fence: 1,
-      mutations: [{ kind: 'tombstone', identity: turnIdentity }]
-    })
-    expect(journal.lifecycleCapacityState()).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-  })
-
-  it('keeps response-before-start capacity on the Codex turn lifecycle identity', async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-turn-capacity-'))
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 220 * 1024 }
-    })
-    const turnIdentity = {
-      provider: 'legacy' as const,
-      agent: 'codex' as const,
-      sessionId: 'session-1',
-      recordId: 'turn-lifecycle:turn-1'
-    }
-    const ctx = turnContext(journal, {
-      dispatch: vi.fn(async () => ({
-        state: 'accepted' as const,
-        providerIdentity: {
-          provider: 'codex' as const,
-          threadId: 'thread-1',
-          turnId: 'turn-1',
-          ordinal: 0
-        }
-      }))
-    } as unknown as StructuredAgentSessionAdapter)
-
-    await expect(
-      performSend(ctx, {
-        clientMessageId: 'message-1',
-        payloadFingerprint: 'a'.repeat(64),
-        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run' }] }
-      })
-    ).resolves.toMatchObject({ ok: true })
-    await expect(
-      journal.appendItem(
-        turnIdentity,
-        {
-          kind: 'status',
-          text: 'Agent is working…',
-          turnLifecycle: { turnId: 'turn-1', state: 'running' }
-        },
-        { fence: 1 }
-      )
-    ).resolves.toBeDefined()
-    expect(
-      journal
-        .snapshot()
-        .items.some(
-          (item) =>
-            item.body.kind === 'status' &&
-            item.body.turnLifecycle?.turnId === 'turn-1' &&
-            item.body.turnLifecycle.state === 'running'
-        )
-    ).toBe(true)
-  })
-
-  it('transfers non-Codex reservations so repeated sends can settle without leaking capacity', async () => {
-    root = await mkdtemp(join(tmpdir(), 'orca-turn-capacity-'))
-    const journal = await openAgentSessionJournal({
-      identity: IDENTITY,
-      journalDir: root,
-      limits: { ...DEFAULT_JOURNAL_PAYLOAD_LIMITS, maxSessionBytes: 220 * 1024 }
-    })
-    const dispatch = vi.fn(async ({ clientMessageId }: { clientMessageId: string }) => ({
-      state: 'accepted' as const,
-      providerIdentity: {
-        provider: 'claude' as const,
-        sessionId: 'claude-session',
-        uuid: `turn-${clientMessageId}`
-      }
-    }))
-    const ctx = turnContext(journal, { dispatch } as unknown as StructuredAgentSessionAdapter)
-
-    for (let index = 0; index < 6; index += 1) {
-      const clientMessageId = `message-${index}`
-      const result = await performSend(ctx, {
-        clientMessageId,
-        payloadFingerprint: 'a'.repeat(64),
-        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'run' }] }
-      })
-      expect(result).toMatchObject({ ok: true })
-      await journal.appendItem(
-        {
-          provider: 'claude',
-          sessionId: 'claude-session',
-          uuid: `turn-${clientMessageId}`
-        },
-        { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'done' }] },
-        { fence: 1 }
-      )
-      expect(journal.lifecycleCapacityState()).toEqual({ reservedBytes: 0, reservedAppendSlots: 0 })
-    }
-  })
-})
-
-function turnContext(
-  journal: Awaited<ReturnType<typeof openAgentSessionJournal>>,
-  adapter: StructuredAgentSessionAdapter
-): AgentSessionTurnContext {
-  return {
-    sessionId: 'session-1',
-    journal,
-    fence: 1,
-    adapter,
-    persistOptions: async () => undefined,
-    resolvedBy: 'client-1',
-    publish: vi.fn(),
-    now: () => 1
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
index 0c8f43efe1b..f1717027b8b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
@@ -7,7 +7,6 @@
 // turn the provider already accepted.
 
 import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
-import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
 import type {
   AgentSessionCancelResult,
   AgentSessionSendResult,
@@ -18,14 +17,6 @@ import type {
   AgentSessionDispatchOutcome,
   StructuredAgentSessionAdapter
 } from './structured-agent-session-adapter'
-import {
-  dispatchReservationId,
-  JOURNAL_DISPATCH_RESERVATION_BYTES,
-  JOURNAL_TURN_TERMINAL_RESERVATION_BYTES,
-  lifecycleReservationIdForItem,
-  tentativeTurnReservationId
-} from '../agent-session-journal/journal-lifecycle-capacity'
-
 export { performSetOption } from './structured-agent-session-turns-options'
 export { performPrompt } from './structured-agent-session-turns-prompt'
 
@@ -104,42 +95,8 @@ export async function performSend(
     }
   }
   if (!(input.retryUnknown && existing?.dispatchState === 'unknown')) {
-    const dispatchReservation = dispatchReservationId(input.clientMessageId)
-    const tentativeReservation = tentativeTurnReservationId(input.clientMessageId)
-    const dispatchReserved = await ctx.journal.reserveLifecycleCapacity({
-      id: dispatchReservation,
-      bytes: JOURNAL_DISPATCH_RESERVATION_BYTES,
-      appendSlots: 1
-    })
-    const turnReserved =
-      dispatchReserved &&
-      (await ctx.journal.reserveLifecycleCapacity({
-        id: tentativeReservation,
-        bytes: JOURNAL_TURN_TERMINAL_RESERVATION_BYTES,
-        appendSlots: 1
-      }))
-    if (!dispatchReserved || !turnReserved) {
-      await ctx.journal.releaseLifecycleCapacity(dispatchReservation)
-      await ctx.journal.releaseLifecycleCapacity(tentativeReservation)
-      return invalid('The session does not have enough durable capacity to start another turn.')
-    }
-    try {
-      await ctx.journal.appendSubmission({ ...input, fence: ctx.fence })
-    } catch (error) {
-      await ctx.journal.releaseLifecycleCapacity(dispatchReservation)
-      await ctx.journal.releaseLifecycleCapacity(tentativeReservation)
-      throw error
-    }
+    await ctx.journal.appendSubmission({ ...input, fence: ctx.fence })
     ctx.publish()
-  } else {
-    const retryReserved = await ctx.journal.reserveLifecycleCapacity({
-      id: dispatchReservationId(input.clientMessageId),
-      bytes: JOURNAL_DISPATCH_RESERVATION_BYTES,
-      appendSlots: 1
-    })
-    if (!retryReserved) {
-      return invalid('The session does not have enough durable capacity to retry this turn.')
-    }
   }
 
   const outcome = await dispatchSafely(ctx, input.clientMessageId, input.body)
@@ -161,7 +118,7 @@ export async function performSend(
     )
   } catch (error) {
     // A failed resolution must not strand a pending row; an unknown result is
-    // explicitly replayable and keeps tentative capacity for that retry.
+    // explicitly replayable.
     try {
       await ctx.journal.resolveDispatch({
         clientMessageId: input.clientMessageId,
@@ -171,34 +128,11 @@ export async function performSend(
         recovered: true
       })
     } catch {
-      await ctx.journal.releaseLifecycleCapacity(dispatchReservationId(input.clientMessageId))
+      // Nothing further to record; the pending row is settled on the next attach.
     }
     ctx.publish()
     throw error
   }
-  if (outcome.state === 'accepted') {
-    // Codex publishes its running lifecycle row under the legacy turn identity,
-    // while the dispatch response identifies the user's message item.  Bind the
-    // tentative turn reservation to the lifecycle identity so a response that
-    // wins the race with turn/started cannot strand that row at the quota edge.
-    const reservationTarget =
-      outcome.providerIdentity.provider === 'codex'
-        ? {
-            provider: 'legacy' as const,
-            agent: 'codex' as const,
-            sessionId: ctx.sessionId,
-            recordId: `turn-lifecycle:${outcome.providerIdentity.turnId}`
-          }
-        : outcome.providerIdentity
-    await ctx.journal.transferLifecycleCapacity(
-      tentativeTurnReservationId(input.clientMessageId),
-      lifecycleReservationIdForItem(
-        ctx.journal.canonicalItemId(agentJournalItemKey(reservationTarget))
-      )
-    )
-  } else if (outcome.state === 'rejected') {
-    await ctx.journal.releaseLifecycleCapacity(tentativeTurnReservationId(input.clientMessageId))
-  }
   ctx.publish()
 
   const submission = ctx.journal
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts
index f1b127c3fd4..fcd5625a48a 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts
@@ -9,8 +9,13 @@ import type {
 import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
 import { REMOTE_RUNTIME_MAX_OUTBOUND_JSON_BYTES } from '../../../shared/remote-runtime-memory-limits'
 import { mobileE2EETextPayloadAdmissionBytes } from '../../runtime/rpc/mobile-e2ee-outbound-admission'
+import { AGENT_SESSION_JOURNAL_SCHEMA_VERSION } from '../../../shared/agent-session-journal-types'
+import { openJournalDatabase } from '../agent-session-journal/journal-database'
+import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
+import { insertJournalRow } from '../agent-session-journal/journal-row-table'
+import type { JournalRow } from '../agent-session-journal/journal-row-schema'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { readAgentSessionHistory } from './agent-session-history-page'
 import { AgentSessionSubscribers } from './structured-agent-session-subscribers'
 
@@ -19,10 +24,11 @@ const LARGE_TEXT = 'x'.repeat(250 * 1024)
 
 let root: string
 let journal: AgentSessionJournal
+const journals = createTrackedJournalOpener()
 
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-wire-admission-'))
-  journal = await openAgentSessionJournal({
+  journal = await journals.open({
     identity: {
       sessionId: SESSION,
       workspaceId: 'workspace-1',
@@ -30,8 +36,7 @@ beforeEach(async () => {
       agent: 'codex',
       providerHandle: { kind: 'codex', threadId: 'thread-1' }
     },
-    journalDir: root,
-    autoCompact: false
+    journalDir: root
   })
   for (let ordinal = 1; ordinal <= 20; ordinal += 1) {
     await journal.appendItem(item(ordinal), body(`${ordinal}:${LARGE_TEXT}`), { fence: 1 })
@@ -39,6 +44,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -91,23 +97,16 @@ describe('structured agent-session outbound admission', () => {
     expect(epochHistory).toMatchObject({ ok: false, reset: 'epoch_changed' })
     expectAdmitted(epochHistory)
 
-    await journal.compact(Date.now() + 1, { minTailRows: 0, retainTailMs: 0 })
-    const compactedReset: AgentSessionSubscribeEvent[] = []
-    subscribers.open({
-      id: 'compacted',
-      sessionId: SESSION,
-      journal,
-      fence: 2,
-      cursor: { epoch: journal.epoch, sequence: 0 },
-      emit: (event) => compactedReset.push(event)
-    })
-    expect(compactedReset[0]).toMatchObject({ type: 'reset', reset: 'cursor_compacted' })
-    expectAdmitted(compactedReset[0])
-
-    const history = readAgentSessionHistory(journal, {
+    // The store can no longer produce a `cursor_compacted` reset — with no row
+    // shedding inside an epoch, `oldestSequence` is always 1. The reset reason
+    // stays in the wire vocabulary through the over-budget page path, which is
+    // where this file's subject — is such a frame admitted outbound? — now lives.
+    const cursorBefore = journal.cursor()
+    const overBudget = await reopenWithOversizedRemoval(cursorBefore.sequence)
+    const history = readAgentSessionHistory(overBudget, {
       sessionId: SESSION,
       direction: 'after',
-      cursor: { epoch: journal.epoch, sequence: 0 }
+      cursor: cursorBefore
     })
     expect(history).toMatchObject({ ok: false, reset: 'cursor_compacted' })
     expectAdmitted(history)
@@ -156,3 +155,42 @@ function item(ordinal: number): AgentJournalItemIdentity {
 function body(text: string): AgentJournalItemBody {
   return { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text }] }
 }
+
+/** Stages a pre-bounding oversized removal id — the one remaining producer of a
+ *  `cursor_compacted` reset — straight into the session database. */
+async function reopenWithOversizedRemoval(afterSequence: number): Promise<AgentSessionJournal> {
+  const hugeItemId = `codex:thread-1:${'h'.repeat(5 * 1024 * 1024)}:1`
+  const base = { v: AGENT_SESSION_JOURNAL_SCHEMA_VERSION, epoch: journal.epoch, fence: 1, ts: 1 }
+  const rows: JournalRow[] = [
+    {
+      ...base,
+      kind: 'item',
+      itemId: hugeItemId,
+      revision: 1,
+      seq: afterSequence + 1,
+      body: { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'big' }] }
+    },
+    { ...base, kind: 'tombstone', itemId: hugeItemId, revision: 2, seq: afterSequence + 2 }
+  ]
+  await journal.close()
+  const opened = openJournalDatabase(journalDatabaseFile(root))
+  try {
+    opened.db.exec('BEGIN IMMEDIATE')
+    for (const row of rows) {
+      insertJournalRow(opened.db, SESSION, row)
+    }
+    opened.db.exec('COMMIT')
+  } finally {
+    opened.db.close()
+  }
+  return journals.open({
+    identity: {
+      sessionId: SESSION,
+      workspaceId: 'workspace-1',
+      hostId: 'local',
+      agent: 'codex',
+      providerHandle: { kind: 'codex', threadId: 'thread-1' }
+    },
+    journalDir: root
+  })
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts b/src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts
index 956e8a0eaa8..6e4cf64b5bf 100644
--- a/src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts
@@ -3,9 +3,11 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { StructuredTuiTranscriptCatchup } from './structured-tui-transcript-catchup'
 
+const journals = createTrackedJournalOpener()
+
 const NOW = 1_800_000_000_000
 const SESSION = 'session-catchup'
 const THREAD = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
@@ -27,6 +29,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await rm(root, { recursive: true, force: true })
 })
 
@@ -83,7 +86,7 @@ async function createCatchupFixture() {
     },
     now: NOW
   })
-  const journal = await openAgentSessionJournal({
+  const journal = await journals.open({
     identity: {
       sessionId: SESSION,
       workspaceId: 'workspace-1',
diff --git a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts
index d287838a13c..e389b30aba2 100644
--- a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts
+++ b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts
@@ -8,12 +8,7 @@ describe('unhandled provider frame journal fallback', () => {
       'future-provider',
       'notification:new/event',
       { body: 'abcdefghij' },
-      {
-        inlineHeadBytes: 8,
-        maxSessionBytes: 1024,
-        maxAppendsPerWindow: 10,
-        appendWindowMs: 1000
-      }
+      { inlineHeadBytes: 8 }
     )
 
     expect(item).not.toBeNull()
@@ -32,12 +27,6 @@ describe('unhandled provider frame journal fallback', () => {
     expect(
       Buffer.byteLength(item.body.providerFrame?.payload.head ?? '', 'utf8')
     ).toBeLessThanOrEqual(8)
-    expect(item.blobs).toEqual([
-      {
-        digest: item.body.providerFrame?.payload.digest,
-        payload: '{"body":"abcdefghij"}'
-      }
-    ])
   })
 
   it('turns an unserializable message-shaped payload into an explicit visible value', () => {
@@ -198,12 +187,7 @@ describe('unhandled provider frame journal fallback', () => {
       'codex',
       'notification:warning',
       { message },
-      {
-        inlineHeadBytes: 8,
-        maxSessionBytes: 1024,
-        maxAppendsPerWindow: 10,
-        appendWindowMs: 1000
-      }
+      { inlineHeadBytes: 8 }
     )
 
     expect(row?.body.text).toContain('abcdefgh')
diff --git a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
index b4651cfc952..804d2900a22 100644
--- a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
+++ b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
@@ -9,7 +9,6 @@ import { classifyProviderFrame } from './provider-frame-disposition'
 
 export type UnhandledProviderFrameJournalItem = {
   body: AgentJournalStatusItem
-  blobs: { digest: string; payload: string }[]
   /** Why the frame surfaced. Error frames are exempt from generic-row caps. */
   classification: 'timeline-substantive' | 'error-surface'
 }
@@ -98,7 +97,6 @@ export function unhandledProviderFrameJournalItem(
       text: display?.text ?? `${provider} · ${kind}`,
       providerFrame: { provider, kind, payload: bounded }
     },
-    blobs: bounded.truncated ? [{ digest: bounded.digest, payload: serialized }] : [],
     classification: classification === 'error-surface' ? 'error-surface' : 'timeline-substantive'
   }
 }
diff --git a/src/main/runtime/orchestration/db/database-file-permissions.ts b/src/main/runtime/orchestration/db/database-file-permissions.ts
index 1bbd640ba77..dd2e49e77a5 100644
--- a/src/main/runtime/orchestration/db/database-file-permissions.ts
+++ b/src/main/runtime/orchestration/db/database-file-permissions.ts
@@ -1,17 +1,5 @@
-import { chmodSync, existsSync } from 'node:fs'
+import { hardenSqliteDatabaseFiles } from '../../../sqlite/harden-database-files'
 
 export function hardenOrchestrationDatabaseFiles(dbPath: (string & {}) | ':memory:'): void {
-  if (dbPath === ':memory:' || process.platform === 'win32') {
-    // Why: Windows protects these files through Orca's current-user-only userData DACL; POSIX mode bits are inert there.
-    return
-  }
-  for (const path of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
-    try {
-      if (existsSync(path)) {
-        chmodSync(path, 0o600)
-      }
-    } catch {
-      // Why: best-effort — a mount that rejects chmod (SSHFS, some network shares) must not fail DB startup.
-    }
-  }
+  hardenSqliteDatabaseFiles(dbPath)
 }
diff --git a/src/main/runtime/structured-agent-session-integration-replay.test.ts b/src/main/runtime/structured-agent-session-integration-replay.test.ts
index 7bc5e66dc45..4edec30499b 100644
--- a/src/main/runtime/structured-agent-session-integration-replay.test.ts
+++ b/src/main/runtime/structured-agent-session-integration-replay.test.ts
@@ -21,7 +21,7 @@ import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../shared/protoc
 import type { AgentJournalRenderItem } from '../../shared/agent-session-journal-types'
 import { attachFingerprintFields } from '../native-chat/agent-session-wire/structured-agent-session-attach'
 import { journalDirectoryFor } from '../native-chat/agent-session-journal/journal-paths'
-import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
 import type { OrcaRuntimeService } from './orca-runtime'
 import type { RpcRequest, RpcResponse } from './rpc/core'
 import { RpcDispatcher } from './rpc/dispatcher'
@@ -31,6 +31,8 @@ import {
   stopStructuredAgentSessionRuntime
 } from './structured-agent-session-runtime'
 
+const journals = createTrackedJournalOpener()
+
 const SESSION = 'session-integration-1'
 const THREAD = 'thread-integration'
 const TURN = 'turn-1'
@@ -285,6 +287,7 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
+  await journals.closeAll()
   await stopStructuredAgentSessionRuntime()
   await rm(root, { recursive: true, force: true })
 })
@@ -364,7 +367,7 @@ describe('a structured codex session over agentSession.*', () => {
       agent: 'codex' as const,
       providerHandle: { kind: 'codex' as const, threadId: THREAD }
     }
-    const reopened = await openAgentSessionJournal({
+    const reopened = await journals.open({
       identity,
       journalDir: journalDirectoryFor(root, identity)
     })
diff --git a/src/main/runtime/structured-agent-session-integration.test.ts b/src/main/runtime/structured-agent-session-integration.test.ts
index 582bd225b40..aa5f819e1fb 100644
--- a/src/main/runtime/structured-agent-session-integration.test.ts
+++ b/src/main/runtime/structured-agent-session-integration.test.ts
@@ -25,10 +25,9 @@ import type {
 import { attachFingerprintFields } from '../native-chat/agent-session-wire/structured-agent-session-attach'
 import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
 import { journalDirectoryFor } from '../native-chat/agent-session-journal/journal-paths'
-import { readJournalBlob } from '../native-chat/agent-session-journal/journal-blob-store'
 import { appendLegacyTranscriptMessages } from '../native-chat/agent-session-journal/journal-legacy-import'
 import type { AgentSessionJournal } from '../native-chat/agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
 import type { OrcaRuntimeService } from './orca-runtime'
 import type { RpcRequest, RpcResponse } from './rpc/core'
 import { RpcDispatcher } from './rpc/dispatcher'
@@ -38,6 +37,8 @@ import {
   stopStructuredAgentSessionRuntime
 } from './structured-agent-session-runtime'
 
+const journals = createTrackedJournalOpener()
+
 const SESSION = 'session-integration-1'
 const THREAD = 'thread-integration'
 const TURN = 'turn-1'
@@ -363,6 +364,7 @@ function cursorOf(frames: AgentSessionSubscribeEvent[]): { epoch: string; sequen
 }
 
 afterEach(async () => {
+  await journals.closeAll()
   await stopStructuredAgentSessionRuntime()
   await rm(root, { recursive: true, force: true })
 })
@@ -376,7 +378,7 @@ describe('a structured codex session over agentSession.*', () => {
       agent: 'codex' as const,
       providerHandle: { kind: 'codex' as const, threadId: THREAD }
     }
-    const journal = await openAgentSessionJournal({
+    const journal = await journals.open({
       identity,
       journalDir: journalDirectoryFor(root, identity)
     })
@@ -761,7 +763,7 @@ describe('a structured codex session over agentSession.*', () => {
       agent: 'codex' as const,
       providerHandle: { kind: 'codex' as const, threadId: THREAD }
     }
-    const reopened = await openAgentSessionJournal({
+    const reopened = await journals.open({
       identity,
       journalDir: journalDirectoryFor(root, identity)
     })
@@ -800,7 +802,6 @@ describe('a structured codex session over agentSession.*', () => {
     const item = journal.snapshot().items.find((candidate) => candidate.body?.kind === 'tool-call')
     const bounded = item?.body?.kind === 'tool-call' ? item.body.output : undefined
     expect(bounded).toMatchObject({ truncated: true, byteLength: Buffer.byteLength(output) })
-    expect(await readJournalBlob(journal.directory, bounded?.digest ?? '')).toBe(output)
   })
 
   it('keeps an answered prompt resolved after the provider exits', async () => {
diff --git a/src/main/runtime/structured-agent-session-runtime.test.ts b/src/main/runtime/structured-agent-session-runtime.test.ts
index 6adf5d368fd..b03d17cdb3f 100644
--- a/src/main/runtime/structured-agent-session-runtime.test.ts
+++ b/src/main/runtime/structured-agent-session-runtime.test.ts
@@ -2,6 +2,10 @@ import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../shared/agent-session-journal-types'
+import { agentSessionJournalCloseRetries } from '../native-chat/agent-session-journal/journal-close-retry'
+import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
+import type { AgentSessionJournal } from '../native-chat/agent-session-journal/journal-store'
 import type {
   AgentSessionClaimStatus,
   AgentSessionProcessIdentity,
@@ -263,3 +267,68 @@ describe('structured agent-session runtime install', () => {
     )
   })
 })
+
+// A stop whose teardown fails must not forget the runtime it was tearing down.
+// `installing` is cleared either way so nothing new attaches, but the host keeps
+// every journal whose close rejected, and this module slot is the only handle
+// onto that host once it is gone.
+describe('a teardown that fails is retried by the next stop', () => {
+  const JOURNAL_IDENTITY: AgentSessionJournalIdentity = {
+    sessionId: 'session-teardown-retry',
+    workspaceId: 'ws-1',
+    hostId: HOST_ID,
+    agent: 'codex',
+    providerHandle: { kind: 'codex', threadId: 'thread-1' }
+  }
+  const journals = createTrackedJournalOpener()
+  let directory: string | null = null
+
+  afterEach(async () => {
+    await agentSessionJournalCloseRetries.retryAll()
+    await journals.closeAll()
+    await stopStructuredAgentSessionRuntime().catch(() => undefined)
+    if (directory) {
+      await rm(directory, { recursive: true, force: true })
+      directory = null
+    }
+  })
+
+  it('reports the failure, then releases the handle on the following stop', async () => {
+    directory = await mkdtemp(join(tmpdir(), 'orca-structured-runtime-'))
+    await ensureStructuredAgentSessionHost({
+      stateDirectory: directory,
+      hostId: HOST_ID,
+      claimKeyId: 'key-1',
+      resolveWorkspacePath: async () => directory!,
+      resolveEnvironment: async () => ({}),
+      reapOrphanChildren: async () => []
+    })
+
+    const journalDir = join(directory, 'stubborn-journal')
+    const real = await journals.open({ identity: JOURNAL_IDENTITY, journalDir })
+    let closeFailures = 2
+    const flaky = new Proxy(real, {
+      get(target, property, receiver) {
+        if (property !== 'close') {
+          return Reflect.get(target, property, receiver)
+        }
+        return async () => {
+          if (closeFailures > 0) {
+            closeFailures -= 1
+            throw new Error('close rejected')
+          }
+          await target.close()
+        }
+      }
+    }) as AgentSessionJournal
+    await agentSessionJournalCloseRetries.closeOrRetain(flaky)
+
+    // The host's teardown runs the registry retry, so this stop surfaces it.
+    await expect(stopStructuredAgentSessionRuntime()).rejects.toThrow()
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([journalDir])
+
+    // The retained runtime is what makes this a retry rather than a no-op.
+    await stopStructuredAgentSessionRuntime()
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
+  })
+})
diff --git a/src/main/runtime/structured-agent-session-runtime.ts b/src/main/runtime/structured-agent-session-runtime.ts
index ce916bc6769..52a3bd81818 100644
--- a/src/main/runtime/structured-agent-session-runtime.ts
+++ b/src/main/runtime/structured-agent-session-runtime.ts
@@ -78,6 +78,15 @@ type InstalledRuntime = {
 
 let installing: Promise<InstalledRuntime> | null = null
 
+/**
+ * Runtimes whose teardown did not finish. `installing` is cleared regardless so
+ * nothing new attaches, but dropping the runtime as well would strand every
+ * journal the host retained for a retry: `tearDownStructuredAgentSessionHost`
+ * deliberately keeps a failed close indexed, and only a later stop through this
+ * same runtime can reach those entries again.
+ */
+const pendingTeardown = new Set<InstalledRuntime>()
+
 export function ensureStructuredAgentSessionHost(
   deps: StructuredAgentSessionRuntimeDeps
 ): Promise<StructuredAgentSessionHost> {
@@ -90,19 +99,40 @@ export function ensureStructuredAgentSessionHost(
 }
 
 /** Drops the host and reaps every Codex child under it. Runtime teardown and
- *  test isolation take the same path, so neither can leave a live app-server. */
+ *  test isolation take the same path, so neither can leave a live app-server.
+ *
+ *  A teardown that fails is RETRIED by the next stop rather than forgotten: the
+ *  host keeps every journal whose close rejected, and this is the only handle
+ *  onto that host once the module slot is cleared. */
 export async function stopStructuredAgentSessionRuntime(): Promise<void> {
   const pending = installing
   installing = null
   setStructuredAgentSessionHost(null)
   agentSessionPtyWriteGate.detachRecordLookup()
-  if (!pending) {
-    return
+  const outstanding = [...pendingTeardown]
+  pendingTeardown.clear()
+  const installed = pending ? await pending.catch(() => null) : null
+  if (installed) {
+    outstanding.push(installed)
   }
-  const installed = await pending.catch(() => null)
-  if (!installed) {
-    return
+  const failures: unknown[] = []
+  for (const runtime of outstanding) {
+    try {
+      await tearDownRuntime(runtime)
+    } catch (error) {
+      pendingTeardown.add(runtime)
+      failures.push(error)
+    }
   }
+  if (failures.length === 1) {
+    throw failures[0]
+  }
+  if (failures.length > 1) {
+    throw new AggregateError(failures, 'structured agent-session runtime teardown failed')
+  }
+}
+
+async function tearDownRuntime(installed: InstalledRuntime): Promise<void> {
   // Drain an in-flight recovery before stopping children; recovery may still
   // be writing lifecycle rows or acquiring a replacement child.
   await installed.waitForRecovery()
diff --git a/src/main/sqlite/harden-database-files.ts b/src/main/sqlite/harden-database-files.ts
new file mode 100644
index 00000000000..2183f87700e
--- /dev/null
+++ b/src/main/sqlite/harden-database-files.ts
@@ -0,0 +1,18 @@
+import { chmodSync, existsSync } from 'node:fs'
+
+/** Restrict a SQLite database and its sidecars to the owning user. */
+export function hardenSqliteDatabaseFiles(dbPath: (string & {}) | ':memory:'): void {
+  if (dbPath === ':memory:' || process.platform === 'win32') {
+    // Why: Windows protects these files through Orca's current-user-only userData DACL; POSIX mode bits are inert there.
+    return
+  }
+  for (const path of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
+    try {
+      if (existsSync(path)) {
+        chmodSync(path, 0o600)
+      }
+    } catch {
+      // Why: best-effort — a mount that rejects chmod (SSHFS, some network shares) must not fail DB startup.
+    }
+  }
+}
diff --git a/src/shared/agent-session-journal-schemas.ts b/src/shared/agent-session-journal-schemas.ts
index 2b1ab5404fc..505aa22c82f 100644
--- a/src/shared/agent-session-journal-schemas.ts
+++ b/src/shared/agent-session-journal-schemas.ts
@@ -1,11 +1,12 @@
 // ─── Canonical runtime schemas for the journal render model ─────────────────
-// The journal admits JSON it did not just write — snapshot files and log rows
-// re-enter from disk and are republished to clients — while the reducer, the
+// The journal admits JSON it did not just write — persisted rows re-enter from
+// SQLite on replay and are republished to clients — while the reducer, the
 // shared projection, and the prompt surfaces dereference nested fields without
 // guards. These schemas are the single deep validators for that render model:
 // admission must reject a JSON-valid but structurally wrong item (a question
-// whose `options` are null, a prompt without its `resolution`) so corruption
-// lands in quarantine instead of throwing mid-render.
+// whose `options` are null, a prompt without its `resolution`) so the row is
+// rejected at replay, where a repair can delete it, instead of throwing
+// mid-render.
 //
 // Discriminants (`kind`, known block `type`s) are validated deeply. Open string
 // fields (roles, dispatch/tool states) stay type-checked, never enum-checked,
@@ -154,8 +155,8 @@ export function isAdmissibleAgentJournalSubmission(
   return AgentJournalSubmissionSchema.safeParse(value).success
 }
 
-/** Compile-time proof that every canonical value is admissible, so admission
- *  can never quarantine a row a writer in this build produced. The schemas are
+/** Compile-time proof that every canonical value is admissible, so replay can
+ *  never reject a row a writer in this build produced. The schemas are
  *  deliberately wider on open string fields, so only this direction holds. */
 type Admits<T extends true> = T
 export type CanonicalJournalShapesAreAdmissible = [
diff --git a/src/shared/agent-session-journal-types.ts b/src/shared/agent-session-journal-types.ts
index f5dabfdec23..f37547b7e79 100644
--- a/src/shared/agent-session-journal-types.ts
+++ b/src/shared/agent-session-journal-types.ts
@@ -58,13 +58,15 @@ export type AgentJournalItemIdentity =
 
 // ─── Bounded payloads ───────────────────────────────────────────────────────
 
-/** A tool output or diff body clipped to a head plus a content-addressed
- *  remainder. Crossing a bound sets `truncated`; it never silently drops. */
+/** A tool output or diff body clipped to a head. The remainder is DISCARDED,
+ *  never stored: crossing a bound sets `truncated` and the two fields below
+ *  describe what was dropped, so it is marked rather than silently lost. */
 export type AgentJournalBoundedPayload = {
   head: string
   /** Byte length of the ORIGINAL payload, not of `head`. */
   byteLength: number
-  /** sha256 of the original payload, and the blob store key when `truncated`. */
+  /** sha256 of the original payload — identification only; nothing stores or
+   *  retrieves the discarded remainder by it. */
   digest: string
   truncated: boolean
 }

From 8f1e64471ed12b7aef6d15aa6218cf28842ea450 Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 18:13:01 -0400
Subject: [PATCH 54/58] fix(relay-ops): a thrown health fetch is not a health
 reading; auth probe does not require /ready (#18723)

The active probe recorded a network-layer failure as `false`, so a single
thrown fetch on the runner froze the production monitor at `auth.health=0`
while the service answered 200 throughout. It also required `/ready` on the
auth endpoint, which serves no such path, forcing every auth sample onto the
11s retry.

A thrown fetch now means "no reading" and is re-asked once after 1s; only a
second throw, or a non-ok response, yields false. `requiresReady` is threaded
per endpoint (director and cells true, auth false). Latency now measures the
answering round trip rather than probe wall time, so retry delays are not
reported as serving latency.
---
 .../relay-ops/src/resource-inventory.test.ts  | 129 +++++++++++++++++-
 .../apps/relay-ops/src/resource-inventory.ts  |  81 ++++++++---
 2 files changed, 184 insertions(+), 26 deletions(-)

diff --git a/cloud/apps/relay-ops/src/resource-inventory.test.ts b/cloud/apps/relay-ops/src/resource-inventory.test.ts
index 6d8b3070c98..4bf43fe9a7a 100644
--- a/cloud/apps/relay-ops/src/resource-inventory.test.ts
+++ b/cloud/apps/relay-ops/src/resource-inventory.test.ts
@@ -23,8 +23,10 @@ describe('readResourceInventory', () => {
         calls += 1
         return new Response(null, { status: 200 })
       },
-      async () => {
-        waits += 1
+      {
+        wait: async () => {
+          waits += 1
+        }
       }
     )
 
@@ -45,8 +47,10 @@ describe('readResourceInventory', () => {
         calls.set(path, call)
         return new Response(null, { status: path === '/ready' && call === 1 ? 503 : 200 })
       },
-      async (ms) => {
-        waits.push(ms)
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
       }
     )
 
@@ -65,17 +69,130 @@ describe('readResourceInventory', () => {
         calls += 1
         return new Response(null, { status: 503 })
       },
-      async (ms) => {
-        waits.push(ms)
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
       }
     )
 
     expect(result.health).toBe(false)
     expect(result.ready).toBe(false)
     expect(calls).toBe(4)
+    // A refusing endpoint is a reading, so only the independent retry runs.
     expect(waits).toEqual([11_000])
   })
 
+  it('treats a thrown fetch as no reading and re-asks that path once', async () => {
+    const calls: string[] = []
+    const waits: number[] = []
+    const result = await probeEndpointHealth(
+      'https://c9.relay.onorca.dev',
+      async (input) => {
+        const path = new URL(String(input)).pathname
+        calls.push(path)
+        if (path === '/health' && calls.filter((call) => call === '/health').length === 1) {
+          throw new TypeError('fetch failed')
+        }
+        return new Response(null, { status: 200 })
+      },
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
+      }
+    )
+
+    expect(result.health).toBe(true)
+    expect(result.ready).toBe(true)
+    expect(calls.filter((call) => call === '/health')).toEqual(['/health', '/health'])
+    expect(waits).toEqual([1_000])
+  })
+
+  it('fails closed when both attempts of a path throw', async () => {
+    const calls: string[] = []
+    const waits: number[] = []
+    const result = await probeEndpointHealth(
+      'https://c9.relay.onorca.dev',
+      async (input) => {
+        const path = new URL(String(input)).pathname
+        calls.push(path)
+        if (path === '/health') throw new TypeError('fetch failed')
+        return new Response(null, { status: 200 })
+      },
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
+      }
+    )
+
+    expect(result.health).toBe(false)
+    expect(calls.filter((call) => call === '/health')).toHaveLength(4)
+    expect(waits).toEqual([1_000, 11_000, 1_000])
+  })
+
+  it('accepts an auth-shaped endpoint that serves no readiness path', async () => {
+    const calls: string[] = []
+    const waits: number[] = []
+    const result = await probeEndpointHealth(
+      'https://login.onorca.dev',
+      async (input) => {
+        const path = new URL(String(input)).pathname
+        calls.push(path)
+        return new Response(null, { status: path === '/ready' ? 404 : 200 })
+      },
+      {
+        requiresReady: false,
+        wait: async (ms) => {
+          waits.push(ms)
+        }
+      }
+    )
+
+    expect(result.health).toBe(true)
+    expect(result.ready).toBeNull()
+    expect(calls).toEqual(['/health'])
+    expect(waits).toEqual([])
+  })
+
+  it('still requires readiness for the director and cells', async () => {
+    const waits: number[] = []
+    const result = await probeEndpointHealth(
+      'https://relay.onorca.dev',
+      async (input) => new Response(null, {
+        status: new URL(String(input)).pathname === '/ready' ? 503 : 200
+      }),
+      {
+        wait: async (ms) => {
+          waits.push(ms)
+        }
+      }
+    )
+
+    expect(result.health).toBe(true)
+    expect(result.ready).toBe(false)
+    expect(waits).toEqual([11_000])
+  })
+
+  it('measures latency as the answering round trip, not the retry delay', async () => {
+    let healthCalls = 0
+    const result = await probeEndpointHealth(
+      'https://c9.relay.onorca.dev',
+      async (input) => {
+        if (new URL(String(input)).pathname !== '/health') return new Response(null, { status: 200 })
+        healthCalls += 1
+        if (healthCalls === 1) throw new TypeError('fetch failed')
+        return new Response(null, { status: 200 })
+      },
+      { wait: async (ms) => await new Promise((resolve) => setTimeout(resolve, Math.min(ms, 60))) }
+    )
+
+    expect(result.health).toBe(true)
+    expect(result.latencyMs).not.toBeNull()
+    expect(result.latencyMs!).toBeLessThan(60)
+  })
+
   it('uses aggregate REST inventory without probing sleeping staging endpoints', async () => {
     const gcloud: GcloudClient = { accessToken: async () => 'a'.repeat(40) }
     let publicProbeCalls = 0
diff --git a/cloud/apps/relay-ops/src/resource-inventory.ts b/cloud/apps/relay-ops/src/resource-inventory.ts
index 62ed3fd862b..c1d01191baf 100644
--- a/cloud/apps/relay-ops/src/resource-inventory.ts
+++ b/cloud/apps/relay-ops/src/resource-inventory.ts
@@ -102,6 +102,7 @@ export type ResourceInventory = {
 
 const unavailableEndpoint = (): EndpointHealth => ({ health: null, ready: null, latencyMs: null })
 const independentEndpointRetryDelayMs = 11_000
+const transientProbeRetryDelayMs = 1_000
 
 function finalSegment(value: string): string {
   return value.split('/').at(-1) ?? value
@@ -138,41 +139,80 @@ async function googleRequest(
   return await response.json()
 }
 
-async function endpointProbe(origin: string, fetchImpl: typeof fetch): Promise<EndpointHealth> {
-  const startedAt = performance.now()
-  const check = async (path: '/health' | '/ready'): Promise<boolean> => {
+// A reading the endpoint actually produced: ok is its answer, latencyMs is that answer's round trip.
+type PathReading = { ok: boolean; latencyMs: number | null }
+
+async function probePath(
+  origin: string,
+  path: '/health' | '/ready',
+  fetchImpl: typeof fetch,
+  wait: (ms: number) => Promise<void>
+): Promise<PathReading> {
+  // null means the request never produced an answer (DNS/TCP/TLS failure or the 8s abort).
+  const attempt = async (): Promise<PathReading | null> => {
+    const startedAt = performance.now()
     try {
       const response = await fetchImpl(`${origin}${path}`, {
         redirect: 'error',
         signal: AbortSignal.timeout(8_000)
       })
-      return response.ok
+      return { ok: response.ok, latencyMs: Math.round(performance.now() - startedAt) }
     } catch {
-      return false
+      return null
     }
   }
-  const [health, ready] = await Promise.all([check('/health'), check('/ready')])
-  return { health, ready, latencyMs: Math.round(performance.now() - startedAt) }
+  const first = await attempt()
+  if (first) return first
+  // A thrown fetch is the absence of a reading, not an unhealthy answer, so re-ask before concluding.
+  await wait(transientProbeRetryDelayMs)
+  return (await attempt()) ?? { ok: false, latencyMs: null }
+}
+
+async function endpointProbe(
+  origin: string,
+  fetchImpl: typeof fetch,
+  requiresReady: boolean,
+  wait: (ms: number) => Promise<void>
+): Promise<EndpointHealth> {
+  const [health, ready] = await Promise.all([
+    probePath(origin, '/health', fetchImpl, wait),
+    requiresReady ? probePath(origin, '/ready', fetchImpl, wait) : null
+  ])
+  // Latency is the slowest answering round trip in this probe; retry delays are not serving latency.
+  const latencies = [health.latencyMs, ready?.latencyMs ?? null].filter(
+    (value): value is number => value !== null
+  )
+  return {
+    health: health.ok,
+    ready: ready ? ready.ok : null,
+    latencyMs: latencies.length > 0 ? Math.max(...latencies) : null
+  }
+}
+
+export type EndpointProbeOptions = {
+  // Auth serves no /ready by design, so it is judged on /health and latency alone.
+  requiresReady?: boolean
+  wait?: (ms: number) => Promise<void>
 }
 
 export async function probeEndpointHealth(
   origin: string,
   fetchImpl: typeof fetch,
-  wait: (ms: number) => Promise<void> = async (ms) =>
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, ms))
+  options: EndpointProbeOptions = {}
 ): Promise<EndpointHealth> {
-  const first = await endpointProbe(origin, fetchImpl)
-  if (
-    first.health &&
-    first.ready &&
-    first.latencyMs !== null &&
-    first.latencyMs <= INCIDENT_MONITOR_THRESHOLDS.endpointLatencyMs
-  ) {
-    return first
-  }
+  const requiresReady = options.requiresReady ?? true
+  const wait = options.wait ??
+    (async (ms: number) => await new Promise((resolvePromise) => setTimeout(resolvePromise, ms)))
+  const accepted = (probe: EndpointHealth): boolean =>
+    probe.health === true &&
+    (!requiresReady || probe.ready === true) &&
+    probe.latencyMs !== null &&
+    probe.latencyMs <= INCIDENT_MONITOR_THRESHOLDS.endpointLatencyMs
+  const first = await endpointProbe(origin, fetchImpl, requiresReady, wait)
+  if (accepted(first)) return first
   // Outwait Relay's ten-second readiness cache before treating the retry as independent.
   await wait(independentEndpointRetryDelayMs)
-  return await endpointProbe(origin, fetchImpl)
+  return await endpointProbe(origin, fetchImpl, requiresReady, wait)
 }
 
 function imageDigest(template: z.infer<typeof TemplateSchema>): string | null {
@@ -338,7 +378,8 @@ export async function readResourceInventory(
     ? [unavailableEndpoint(), unavailableEndpoint()]
     : await Promise.all([
         probeEndpointHealth(environment.directorOrigin, fetchImpl),
-        probeEndpointHealth(environment.authOrigin, fetchImpl)
+        // The auth service exposes no /ready, so requiring it would fail every first probe.
+        probeEndpointHealth(environment.authOrigin, fetchImpl, { requiresReady: false })
       ])
   const cells = await Promise.all(environment.cells.map((cell, index) =>
     readCell(environment, cell, migValues[index] ?? null, token, fetchImpl)

From 901c6771ff5b8655e953c0b80e828e80f25e5409 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:18:07 -0700
Subject: [PATCH 55/58] fix(agents): detect agent CLIs installed outside a
 version manager (#18336)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(agents): detect agent CLIs installed outside a version manager

The install-dir fallback that answers "is this agent installed?" when the
login-shell PATH probe fails listed only version-manager bin dirs, so
codex/opencode/cursor-agent installed by Homebrew, npm's default global
prefix, snap, nix, or the CLI's own installer read as not installed.

Where this is decisive, corrected from the previous message: the `orca` CLI,
whose detectSkillsCliAgentKeys (src/cli/handlers/skills.ts) calls
detectCommandsInInstallDirs directly and whose entry point seeds no PATH, plus
unpackaged/dev runs. NOT the packaged desktop app: patchPackagedProcessPath
(configure-process.ts:114) appends /opt/homebrew/bin, /usr/local/bin,
~/.opencode/bin and the Linux/nix prefixes onto process.env.PATH at
main-process-preflight.ts:147, before any detection, and mergePathSegments
preserves them, so the PATH scan reaches those dirs first and this fallback
never fires for them. That means this does NOT explain the packaged macOS
v1.4.194 report of codex/cursor-agent/opencode all undetected -- that report
stays open and uninvestigated.

Second correction: the fallback now carries the prefixes Homebrew actually
uses on Linux (/home/linuxbrew/.linuxbrew/bin), plus /snap/bin and the two nix
profile dirs, matching what patchPackagedProcessPath already seeds. The WSL
guest prelude gains the same entries. Leaving them out closed the native/WSL
asymmetry on darwin only, on the platforms where the fallback is decisive.

Appended last so a version-manager install still wins, and kept out of
getVersionManagerBinPaths, whose result is PREPENDED to PATH (#18234). Lives in
its own module so node-cli-command-resolution.ts stays under max-lines.

The test stages every path through `join` and asserts via
detectCommandsInInstallDirs as well as resolveCliCommands, so it holds on a
Windows dev machine and pins the "absolute path means installed" contract.

* fix(agents): align system install-dir order across the three PATH lists

Round-2 review remediation. The blocking finding was about the handoff
artifact, not the code: the summary handed to review described a 2-file/+38
change with 3 new macOS dirs, while HEAD is 4 files/+227 with 6 lookup dirs
plus 5 new WSL-guest prelude entries, and the quoted failing test names never
existed. Restated against HEAD in the handoff; no rebuttal, the reviewer was
right.

Justification for the entries the summary never described: the fallback exists
to close the native/WSL asymmetry for a CLI no version manager installed, and
patchPackagedProcessPath already seeds Linuxbrew, /snap/bin and both nix
profile dirs (configure-process.ts:141-158). Shipping only the darwin subset
would have left a Linux or WSL user with a snap/nix install still reading as
not installed while the packaged macOS user did not -- the asymmetry the change
is for.

Code changes, all from the non-blocking list:

- The three lists disagreed on order while claiming to be kept in step, so a
  CLI in both /usr/local/bin and /snap/bin could resolve to a different binary
  than the seeded PATH scan or the WSL guest probe found. All three now use the
  seed's relative order, pinned by a new duplicate-install test and an offset
  assertion on the prelude. The prelude's system block also moved after the nvm
  glob so a version manager still wins in the guest, as it does natively.
- The parity docstring asserted "the same set patchPackagedProcessPath appends,
  minus the sbin dirs and the generic ~/bin", which was false: it also omits
  ~/.vite-plus/bin (seeded by configure-process.ts:156, but no probed agent
  command maps to it) and /opt/homebrew off darwin. All three gaps are now
  named as deliberate.
- win32 returns [] and stays that way, but the branch now says why:
  %USERPROFILE%\.opencode\bin has never had install-dir coverage in either
  list, and the seed's system block is POSIX-only too. Pre-existing, unchanged.
- The detectCommandsInInstallDirs case read the ambient process.env.PATH, so on
  a box with /usr/local/bin on PATH only the opencode assertion exercised the
  fallback. It now stubs the GUI-launch PATH, so both do.

Unchanged and restated: this does NOT explain the packaged macOS v1.4.194
report of codex/cursor-agent/opencode all undetected, and must not close G6
report #3. patchPackagedProcessPath returns early unless app.isPackaged and
seeds all six dirs before any detection, and mergePathSegments never deletes
them, so the packaged PATH scan reaches them first and this fallback never
fires there. Decisive only for the `orca` CLI's detectSkillsCliAgentKeys and
unpackaged/dev runs.

Verification: the suite is red without the production hunks (5 failed/3 passed)
and green with them (8 passed); 11 related suites pass (197 tests); tc:node,
tc:cli, oxlint, oxfmt and the max-lines ratchet are clean.

* fix(agents): correct the ordering-parity claims and widen the seed-leak guard

Round-3 review found two docstring claims that are false as written and one
guard that only asserted a third of its list.

- system-cli-install-dirs.ts claimed a CLI in two of these dirs resolves the
  same here as in the packaged PATH seed. True inside the system block, false
  across it: `claude` in both ~/.local/bin and /opt/homebrew/bin resolves to
  ~/.local/bin via the fallback (getBaseVersionManagerDirectories leads) and to
  /opt/homebrew/bin via the seed, which appends ~/.local/bin last. Scope the
  claim to the block and name the gap instead of asserting it away. No behavior
  change: closing it would hoist a system dir over a version-manager one
  (#18234).
- posix-version-manager-bin-dirs.ts justified moving "/usr/local/bin" after the
  nvm glob with "a version manager still wins in the guest, as it does
  natively". The glob expands lexicographically; native orders nvm dirs
  default-alias-first (#10932), so that is not parity. Record the move as the
  one behavior change in the file and bound it: entries are appended behind a
  resolved login PATH, and both consumers only test presence.
- The #18234 seed-leak guard asserted only /opt/homebrew/bin and /usr/local/bin
  were absent from getVersionManagerBinPaths, leaving the four other new dirs
  unpinned. It now spells out all seven across darwin and linux -- spelled out
  rather than derived from getSystemCliInstallDirectories, which would pass
  vacuously against exactly the refactor it guards.

Tests 8 passed (8); 5 failed / 3 passed with the production hunks reverted to
origin/main. tsc node + cli clean, oxlint clean.

* fix(agents): find Pi's own installer dir in the CLI install-dir fallback

The fallback added `~/.opencode/bin` but skipped `~/.vite-plus/bin` on the
claim that no probed agent command maps to it. False: `pi` is a probed detect
command on every runtime (`tui-agent-config.ts`, no `detectUnsupportedRuntimes`)
and `~/.vite-plus/bin` is the Pi installer's default — the two dirs #829 named
and `patchPackagedProcessPath` seeds together. Added to both the native
fallback and the WSL guest prelude, so a Pi installed by its own script is
found by the `orca` CLI and in WSL, not just on a seeded packaged PATH.

Also, all narrower:
- `/snap/bin` + Linuxbrew now gate on `linux` like the seed does, instead of
  every non-darwin posix.
- Docstring: `/opt/homebrew` off darwin is the one remaining seed gap and says
  why; the "lookup-only" paragraph names the `withCliRuntimeOnPath` exception.
- New seed-order test derives the expected order from
  `getSystemCliInstallDirectories`, so reordering either list fails.

The PR body's claim that SSH hosts benefit is dropped: they answer
`preflight.detectAgents` from `src/relay/preflight-handler.ts` via
`isCommandOnPathForRelay`, a separate bundle that never reaches this module.

* fix(agents): build the CLI install-dir fallback order once and pin it on both resolvers

resolveCliCommand (every spawn site) and resolveCliCommands (detection) each
spelled the nvm -> version-manager -> system-dir order by hand, which is how
the native and WSL lists drifted apart before. One getCliInstallDirectories
now feeds both, and the test pins system dirs LAST on both resolvers, on
darwin and linux, plus a derived check that the WSL guest prelude keeps every
native version-manager dir ahead of the native system block.
---
 src/main/startup/configure-process.test.ts    |  23 ++
 .../agent-cli-install-dir-fallback.test.ts    | 276 ++++++++++++++++++
 src/shared/node-cli-command-resolution.ts     |  30 +-
 src/shared/posix-version-manager-bin-dirs.ts  |  25 +-
 src/shared/system-cli-install-dirs.ts         |  60 ++++
 5 files changed, 397 insertions(+), 17 deletions(-)
 create mode 100644 src/shared/agent-cli-install-dir-fallback.test.ts
 create mode 100644 src/shared/system-cli-install-dirs.ts

diff --git a/src/main/startup/configure-process.test.ts b/src/main/startup/configure-process.test.ts
index 9d97dda6dae..7d7e2b0cc1a 100644
--- a/src/main/startup/configure-process.test.ts
+++ b/src/main/startup/configure-process.test.ts
@@ -137,6 +137,29 @@ describe('patchPackagedProcessPath', () => {
     expect(segments).toContain('/usr/local/bin')
   })
 
+  // Why derived, not a second literal: system-cli-install-dirs.ts documents its
+  // order as matching this seed's system block, and hardcoding the order in the
+  // fallback's own test lets a reorder here break that parity while both stay green.
+  it('seeds the system block in the order the install-dir fallback expects', async () => {
+    const { app } = await import('electron')
+    const { patchPackagedProcessPath } = await import('./configure-process')
+    const { getSystemCliInstallDirectories } = await import('../../shared/system-cli-install-dirs')
+
+    setPlatform('linux')
+    Object.defineProperty(app, 'isPackaged', { configurable: true, value: true })
+    process.env.HOME = '/home/tester'
+    process.env.PATH = '/usr/bin:/bin'
+
+    patchPackagedProcessPath()
+
+    const segments = (process.env.PATH ?? '').split(':')
+    const offsets = getSystemCliInstallDirectories('linux', '/home/tester').map((directory) =>
+      segments.indexOf(directory)
+    )
+    expect(offsets.every((offset) => offset >= 0)).toBe(true)
+    expect([...offsets].sort((a, b) => a - b)).toEqual(offsets)
+  })
+
   // Why this ordering is load-bearing (#18234): a seed exists so a GUI-launched
   // Electron can *find* a tool, not to re-rank tools the user already has.
   // `~/.local/bin` is user-writable and can hold a wrapper for any system tool.
diff --git a/src/shared/agent-cli-install-dir-fallback.test.ts b/src/shared/agent-cli-install-dir-fallback.test.ts
new file mode 100644
index 00000000000..793c0861453
--- /dev/null
+++ b/src/shared/agent-cli-install-dir-fallback.test.ts
@@ -0,0 +1,276 @@
+import { delimiter, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { detectCommandsInInstallDirs } from './local-agent-install-dir-detection'
+import {
+  getVersionManagerBinPaths,
+  resolveCliCommand,
+  resolveCliCommands
+} from './node-cli-command-resolution'
+import { buildPosixFallbackPathPrelude } from './posix-version-manager-bin-dirs'
+import { getSystemCliInstallDirectories } from './system-cli-install-dirs'
+
+/**
+ * The install-dir fallback answers "is this agent CLI installed?" whenever the
+ * login-shell PATH probe does not land. Homebrew, npm's default global prefix
+ * and opencode's own installer are absolute paths, so they cannot be staged
+ * under a temp home -- hence a synthetic fs rather than a fixture tree.
+ *
+ * Every staged path goes through `join`, because the lookup builds candidates
+ * with the host's `join`: a literal `/opt/homebrew/bin/codex` would never match
+ * on a Windows dev machine.
+ */
+const fsFixture = vi.hoisted(() => ({ executables: new Set<string>() }))
+
+const MOCK_HOME = '/home/tester'
+
+vi.mock('node:os', () => ({ homedir: () => MOCK_HOME }))
+
+vi.mock('node:fs', () => ({
+  constants: { X_OK: 1 },
+  statSync: (target: string) => {
+    if (!fsFixture.executables.has(target)) {
+      throw new Error(`ENOENT: ${target}`)
+    }
+    return { isFile: () => true }
+  },
+  accessSync: (target: string) => {
+    if (!fsFixture.executables.has(target)) {
+      throw new Error(`EACCES: ${target}`)
+    }
+  },
+  // No nvm install in any of these cases; the nvm walk is covered by nvm-default-alias.test.ts.
+  existsSync: () => false,
+  readdirSync: () => {
+    throw new Error('ENOENT')
+  },
+  readFileSync: () => {
+    throw new Error('ENOENT')
+  }
+}))
+
+// The PATH a Finder/Dock-launched macOS app inherits with no login shell.
+const GUI_LAUNCH_PATH = ['/usr/bin', '/bin', '/usr/sbin', '/sbin'].join(delimiter)
+
+function stage(...paths: string[]): void {
+  for (const path of paths) {
+    fsFixture.executables.add(path)
+  }
+}
+
+function resolveAll(
+  commands: string[],
+  options: { platform: NodeJS.Platform; homePath: string }
+): Record<string, string> {
+  return Object.fromEntries(
+    resolveCliCommands(commands, { ...options, pathEnv: GUI_LAUNCH_PATH })
+  ) as Record<string, string>
+}
+
+beforeEach(() => {
+  fsFixture.executables.clear()
+  // Why: the no-options entry point reads the ambient PATH, where a dev box's
+  // real /usr/local/bin would answer before the fallback ever runs.
+  vi.stubEnv('PATH', GUI_LAUNCH_PATH)
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe('agent CLI install-dir fallback', () => {
+  it('finds macOS CLIs installed outside a version manager', () => {
+    const home = '/Users/tester'
+    stage(
+      join(home, '.local', 'bin', 'claude'),
+      join('/opt/homebrew/bin', 'codex'),
+      join('/usr/local/bin', 'cursor-agent'),
+      join(home, '.opencode', 'bin', 'opencode')
+    )
+    expect(
+      resolveAll(['claude', 'codex', 'cursor-agent', 'opencode'], {
+        platform: 'darwin',
+        homePath: home
+      })
+    ).toEqual({
+      claude: join(home, '.local', 'bin', 'claude'),
+      codex: join('/opt/homebrew/bin', 'codex'),
+      'cursor-agent': join('/usr/local/bin', 'cursor-agent'),
+      opencode: join(home, '.opencode', 'bin', 'opencode')
+    })
+  })
+
+  it('finds Linux CLIs in Linuxbrew, snap and nix prefixes, not the macOS brew prefix', () => {
+    const home = '/home/tester'
+    stage(
+      join('/home/linuxbrew/.linuxbrew/bin', 'codex'),
+      join('/snap/bin', 'cursor-agent'),
+      join(home, '.nix-profile', 'bin', 'opencode'),
+      join('/opt/homebrew/bin', 'claude')
+    )
+    expect(
+      resolveAll(['codex', 'cursor-agent', 'opencode', 'claude'], {
+        platform: 'linux',
+        homePath: home
+      })
+    ).toEqual({
+      codex: join('/home/linuxbrew/.linuxbrew/bin', 'codex'),
+      'cursor-agent': join('/snap/bin', 'cursor-agent'),
+      opencode: join(home, '.nix-profile', 'bin', 'opencode'),
+      // Why unresolved: /opt/homebrew is an Apple Silicon prefix; Linuxbrew uses another.
+      claude: 'claude'
+    })
+  })
+
+  it('leaves the win32 branch on its own install dirs', () => {
+    const home = 'C:/Users/tester'
+    stage(join(home, 'AppData', 'Roaming', 'npm', 'codex.cmd'), join('/usr/local/bin', 'claude'))
+    expect(resolveAll(['codex', 'claude'], { platform: 'win32', homePath: home })).toEqual({
+      codex: join(home, 'AppData', 'Roaming', 'npm', 'codex.cmd'),
+      claude: 'claude'
+    })
+  })
+
+  // Why pinned: patchPackagedProcessPath seeds these onto PATH in this order and
+  // the POSIX guest prelude appends them in it, so a divergence here would spawn
+  // a different binary than the packaged PATH scan for the same install.
+  it('ranks system install dirs in the same order as the PATH seed', () => {
+    const home = '/home/tester'
+    const dirs = [
+      '/usr/local/bin',
+      '/snap/bin',
+      '/home/linuxbrew/.linuxbrew/bin',
+      '/nix/var/nix/profiles/default/bin',
+      join(home, '.nix-profile', 'bin'),
+      join(home, '.opencode', 'bin'),
+      join(home, '.vite-plus', 'bin')
+    ]
+    stage(...dirs.map((dir) => join(dir, 'opencode')))
+    for (const expected of dirs) {
+      expect(resolveAll(['opencode'], { platform: 'linux', homePath: home })).toEqual({
+        opencode: join(expected, 'opencode')
+      })
+      fsFixture.executables.delete(join(expected, 'opencode'))
+    }
+  })
+
+  // Why both resolvers and both platforms: resolveCliCommand is what every
+  // spawn site (codex login, app-server, session-index heal) calls, and its
+  // list was once spelled separately from resolveCliCommands'. A same-named
+  // binary in /usr/local/bin must never shadow the one a version manager owns.
+  describe.each([
+    { platform: 'darwin' as const, home: '/Users/tester', systemDir: '/opt/homebrew/bin' },
+    {
+      platform: 'linux' as const,
+      home: '/home/tester',
+      systemDir: '/home/linuxbrew/.linuxbrew/bin'
+    }
+  ])('$platform: system dirs stay last', ({ platform, home, systemDir }) => {
+    it('lets a version-manager install outrank a system one', () => {
+      const managed = join(home, '.volta', 'bin', 'codex')
+      stage(managed, join(systemDir, 'codex'), join('/usr/local/bin', 'codex'))
+      expect(resolveCliCommand('codex', { platform, homePath: home })).toBe(managed)
+      expect(resolveAll(['codex'], { platform, homePath: home })).toEqual({ codex: managed })
+    })
+
+    it('lets an npm --user (~/.local/bin) install outrank a system one', () => {
+      const managed = join(home, '.local', 'bin', 'codex')
+      stage(managed, join(systemDir, 'codex'))
+      expect(resolveCliCommand('codex', { platform, homePath: home })).toBe(managed)
+      expect(resolveAll(['codex'], { platform, homePath: home })).toEqual({ codex: managed })
+    })
+
+    it('lets a copy already on PATH outrank every install dir', () => {
+      const onPath = join('/custom/bin', 'codex')
+      const pathEnv = [GUI_LAUNCH_PATH, '/custom/bin'].join(delimiter)
+      stage(onPath, join(home, '.volta', 'bin', 'codex'), join(systemDir, 'codex'))
+      expect(resolveCliCommand('codex', { platform, homePath: home, pathEnv })).toBe(onPath)
+      expect(resolveCliCommands(['codex'], { platform, homePath: home, pathEnv })).toEqual(
+        new Map([['codex', onPath]])
+      )
+    })
+  })
+
+  // Why this guard: getVersionManagerBinPaths is PREPENDED onto PATH by
+  // patchPackagedProcessPath and the CLI's addAgentNodePaths, so a system dir
+  // leaking into it would re-rank binaries the user already has (#18234).
+  it('keeps system install dirs out of the PATH seed list', () => {
+    for (const platform of ['darwin', 'linux'] as const) {
+      const home = platform === 'darwin' ? '/Users/tester' : '/home/tester'
+      const seeded = getVersionManagerBinPaths({ platform, homePath: home })
+      // Spelled out, not derived from the list under test: a guard that iterates
+      // getSystemCliInstallDirectories passes vacuously if that list is emptied
+      // into getBaseVersionManagerDirectories, which is the leak it guards.
+      for (const directory of [
+        '/opt/homebrew/bin',
+        '/usr/local/bin',
+        '/snap/bin',
+        '/home/linuxbrew/.linuxbrew/bin',
+        '/nix/var/nix/profiles/default/bin',
+        join(home, '.nix-profile', 'bin'),
+        join(home, '.opencode', 'bin'),
+        join(home, '.vite-plus', 'bin')
+      ]) {
+        expect(seeded).not.toContain(directory)
+      }
+    }
+  })
+
+  // Why through this entry point: it is what the `orca` CLI's agent detection
+  // calls, and the "absolute path means installed" contract lives here.
+  it.skipIf(process.platform === 'win32')(
+    'reports a system-installed CLI as detected, not just resolved',
+    () => {
+      stage(
+        join('/usr/local/bin', 'codex'),
+        join(MOCK_HOME, '.opencode', 'bin', 'opencode'),
+        // Why pi: it is a probed detect command on every runtime (tui-agent-config.ts,
+        // no detectUnsupportedRuntimes) and its installer defaults to ~/.vite-plus/bin,
+        // the second dir #829 named and seeded alongside ~/.opencode/bin.
+        join(MOCK_HOME, '.vite-plus', 'bin', 'pi')
+      )
+      // All three come from the fallback: the stubbed PATH holds no system dir.
+      expect(detectCommandsInInstallDirs(['codex', 'opencode', 'pi', 'cursor-agent'])).toEqual(
+        new Set(['codex', 'opencode', 'pi'])
+      )
+    }
+  )
+
+  it('carries the system install dirs into the POSIX guest fallback prelude', () => {
+    const prelude = buildPosixFallbackPathPrelude()
+    const systemDirs = [
+      '"/usr/local/bin"',
+      '"/snap/bin"',
+      '"/home/linuxbrew/.linuxbrew/bin"',
+      '"/nix/var/nix/profiles/default/bin"',
+      '"$HOME/.nix-profile/bin"',
+      '"$HOME/.opencode/bin"',
+      '"$HOME/.vite-plus/bin"'
+    ]
+    const offsets = systemDirs.map((dir) => prelude.indexOf(dir))
+    expect(offsets.every((offset) => offset >= 0)).toBe(true)
+    expect([...offsets].sort((a, b) => a - b)).toEqual(offsets)
+    // Why after: the guest prelude appends, so a version manager must still win.
+    expect(prelude.indexOf('.nvm/versions/node/*/bin')).toBeLessThan(offsets[0])
+    // Why absent: a WSL guest is Linux, so /opt/homebrew is never its brew prefix.
+    expect(prelude).not.toContain('/opt/homebrew')
+  })
+
+  // Why derived: the native and guest lists drifted apart once by hand. Every
+  // version-manager dir the native resolver knows must precede the guest's
+  // first system dir, and the guest's system block must be the native one.
+  it('keeps the WSL guest prelude in step with the native Linux lists', () => {
+    const prelude = buildPosixFallbackPathPrelude()
+    const asGuest = (dir: string): string => `"${dir.split('\\').join('/')}"`
+    const systemDirs = getSystemCliInstallDirectories('linux', '$HOME').map(asGuest)
+    const firstSystemOffset = prelude.indexOf(systemDirs[0])
+    expect(firstSystemOffset).toBeGreaterThan(0)
+    for (const dir of getVersionManagerBinPaths({ platform: 'linux', homePath: '$HOME' })) {
+      const offset = prelude.indexOf(asGuest(dir))
+      expect(offset, dir).toBeGreaterThanOrEqual(0)
+      expect(offset, dir).toBeLessThan(firstSystemOffset)
+    }
+    const systemOffsets = systemDirs.map((dir) => prelude.indexOf(dir))
+    expect(systemOffsets.every((offset) => offset >= firstSystemOffset)).toBe(true)
+    expect([...systemOffsets].sort((a, b) => a - b)).toEqual(systemOffsets)
+  })
+})
diff --git a/src/shared/node-cli-command-resolution.ts b/src/shared/node-cli-command-resolution.ts
index 6931cc8fc7e..c7407ac5eb1 100644
--- a/src/shared/node-cli-command-resolution.ts
+++ b/src/shared/node-cli-command-resolution.ts
@@ -1,6 +1,7 @@
 import { accessSync, constants, existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { delimiter, dirname, isAbsolute, join } from 'node:path'
+import { getSystemCliInstallDirectories } from './system-cli-install-dirs'
 
 type ResolveCommandOptions = {
   pathEnv?: string | null
@@ -245,6 +246,17 @@ function getVersionManagerDirectories(
   return directories
 }
 
+// Why one list for both resolvers: the system block must stay LAST so a
+// version-manager install always outranks a Homebrew/npm/snap one, and two
+// hand-spelled spreads is how the native and WSL lists drifted apart before.
+function getCliInstallDirectories(platform: NodeJS.Platform, homePath: string): string[] {
+  return [
+    ...getNvmVersionDirectories(homePath),
+    ...getBaseVersionManagerDirectories(platform, homePath),
+    ...getSystemCliInstallDirectories(platform, homePath)
+  ]
+}
+
 export function resolveCliCommand(
   commandName: string,
   options: ResolveCommandOptions = {}
@@ -258,19 +270,12 @@ export function resolveCliCommand(
   }
 
   const homePath = options.homePath ?? homedir()
-  const nvmCandidate = findFirstExecutable(
+  const installCandidate = findFirstExecutable(
     platform,
-    getNvmVersionDirectories(homePath),
+    getCliInstallDirectories(platform, homePath),
     executableNames
   )
-  const versionManagerCandidate =
-    nvmCandidate ??
-    findFirstExecutable(
-      platform,
-      getBaseVersionManagerDirectories(platform, homePath),
-      executableNames
-    )
-  return versionManagerCandidate ?? commandName
+  return installCandidate ?? commandName
 }
 
 export function resolveCliCommands(
@@ -281,10 +286,7 @@ export function resolveCliCommands(
   const pathEnv = options.pathEnv ?? process.env.PATH ?? process.env.Path ?? null
   const pathDirectories = splitPath(pathEnv)
   const homePath = options.homePath ?? homedir()
-  const installDirectories = [
-    ...getNvmVersionDirectories(homePath),
-    ...getBaseVersionManagerDirectories(platform, homePath)
-  ]
+  const installDirectories = getCliInstallDirectories(platform, homePath)
   const resolved = new Map<string, string>()
 
   for (const commandName of new Set(commandNames)) {
diff --git a/src/shared/posix-version-manager-bin-dirs.ts b/src/shared/posix-version-manager-bin-dirs.ts
index 698b0f7f5b1..85eb581ccb1 100644
--- a/src/shared/posix-version-manager-bin-dirs.ts
+++ b/src/shared/posix-version-manager-bin-dirs.ts
@@ -8,8 +8,20 @@
  * installed, which is #9725.
  *
  * Kept in step with `getBaseVersionManagerDirectories` in
- * node-cli-command-resolution.ts: a WSL user on asdf, mise, volta or fnm would
- * otherwise still hit #9725 while the same user on native does not.
+ * node-cli-command-resolution.ts and `getSystemCliInstallDirectories` in
+ * system-cli-install-dirs.ts: a WSL user on asdf, mise, volta or fnm -- or on
+ * Linuxbrew, snap or nix -- would otherwise still hit #9725 while the same user
+ * on native does not. `/opt/homebrew` stays out because a WSL guest is Linux,
+ * where Homebrew installs to the Linuxbrew prefix below.
+ *
+ * Version-manager dirs lead and the system block trails, which took the one
+ * behavior change here: `/usr/local/bin` moved from before the nvm glob to
+ * after it, so the guest ranks a version manager over a system install the way
+ * native does. Bounded, not free: every entry is APPENDED behind a resolved
+ * login PATH, so this can only re-rank a command that BOTH consumers would
+ * otherwise miss, and both only test presence. Not full parity either -- the
+ * glob expands lexicographically, while native orders nvm dirs
+ * default-alias-first (#10932).
  *
  * Each entry is quoted so a `$HOME` containing a space cannot word-split into
  * a relative path -- except the nvm glob, where only the prefix is quoted so
@@ -24,8 +36,15 @@ const POSIX_VERSION_MANAGER_BIN_DIRS = [
   '"$HOME/.asdf/shims"',
   '"$HOME/.fnm/aliases/default/bin"',
   '"$HOME/.local/share/mise/shims"',
+  '"$HOME"/.nvm/versions/node/*/bin',
   '"/usr/local/bin"',
-  '"$HOME"/.nvm/versions/node/*/bin'
+  '"/snap/bin"',
+  '"/home/linuxbrew/.linuxbrew/bin"',
+  '"/nix/var/nix/profiles/default/bin"',
+  '"$HOME/.nix-profile/bin"',
+  // Why both: the opencode and Pi installers' own defaults, which no version manager owns (#829).
+  '"$HOME/.opencode/bin"',
+  '"$HOME/.vite-plus/bin"'
 ].join(' ')
 
 /**
diff --git a/src/shared/system-cli-install-dirs.ts b/src/shared/system-cli-install-dirs.ts
new file mode 100644
index 00000000000..fe070e761e0
--- /dev/null
+++ b/src/shared/system-cli-install-dirs.ts
@@ -0,0 +1,60 @@
+import { join } from 'node:path'
+
+/**
+ * Where an agent CLI lands when no version manager installed it: Homebrew (both
+ * prefixes), npm's default global prefix, snap, nix, or the CLI's own installer
+ * (#829 named `~/.opencode/bin` and `~/.vite-plus/bin` as the motivating cases,
+ * but only for the login-shell probe; the fallback used when that probe fails
+ * never gained either).
+ *
+ * Ordered to match the system block `patchPackagedProcessPath` appends to PATH,
+ * so a CLI present in two of *these* dirs resolves to the same binary here, in
+ * the packaged PATH scan, and in `POSIX_VERSION_MANAGER_BIN_DIRS`. That parity
+ * stops at the block boundary and is not claimed across it: the seed appends
+ * `~/.local/bin` after this block, while here it arrives ahead of it from
+ * `getBaseVersionManagerDirectories`, so a `claude` installed in both
+ * `~/.local/bin` and `/opt/homebrew/bin` resolves to the former via this
+ * fallback and the latter via the seeded PATH. Pre-existing, and left alone
+ * because closing it means hoisting a system dir over a version-manager one.
+ *
+ * Deliberate gaps vs that seed: the `sbin` dirs, the generic `~/bin`, and
+ * `/opt/homebrew` off darwin -- the seed does push that prefix on every posix,
+ * but Linux Homebrew installs to the Linuxbrew prefix below, so off darwin it
+ * is a directory no brew install can occupy.
+ *
+ * Lookup-only, deliberately outside `getBaseVersionManagerDirectories`: that
+ * list is PREPENDED to PATH by `getVersionManagerBinPaths` callers, and hoisting
+ * a system dir over the inherited PATH re-ranks binaries the user already has
+ * (#18234). One bounded exception: when a hit here ships a sibling `node`,
+ * `withCliRuntimeOnPath` prepends that dir onto the *spawned child's* PATH
+ * (#10932 runtime pairing) -- only for a command PATH did not contain at all.
+ */
+export function getSystemCliInstallDirectories(
+  platform: NodeJS.Platform,
+  homePath: string
+): string[] {
+  // Why nothing here: the PATH seed's system block is POSIX-only too, so
+  // Windows installs outside a version manager (`%USERPROFILE%\.opencode\bin`)
+  // have never had install-dir coverage in either list. Unchanged, not fixed.
+  if (platform === 'win32') {
+    return []
+  }
+  const directories: string[] = []
+  if (platform === 'darwin') {
+    // Apple Silicon Homebrew; Intel Homebrew shares /usr/local with npm's prefix.
+    directories.push('/opt/homebrew/bin')
+  }
+  directories.push('/usr/local/bin')
+  if (platform === 'linux') {
+    // Gated like the seed: snap and Linuxbrew ship on Linux only, so elsewhere they are phantom stats.
+    directories.push('/snap/bin', '/home/linuxbrew/.linuxbrew/bin')
+  }
+  directories.push(
+    '/nix/var/nix/profiles/default/bin',
+    join(homePath, '.nix-profile', 'bin'),
+    // Why both: the opencode and Pi installers' own defaults, which no version manager owns (#829).
+    join(homePath, '.opencode', 'bin'),
+    join(homePath, '.vite-plus', 'bin')
+  )
+  return directories
+}

From b6f453df06e7de31640e8d9c0dd1521a24ff45f1 Mon Sep 17 00:00:00 2001
From: Jinwoo Hong <73622457+Jinwoo-H@users.noreply.github.com>
Date: Fri, 4 Sep 2026 18:18:46 -0400
Subject: [PATCH 56/58] perf(relay): per-cell inventory locks, delta counters,
 and a pool statement timeout (#18722)

The sticky refresh path and reservation reconciliation both took the fleet-wide
`relay_cells ... FOR UPDATE` scan to mutate one or two rows, so one busy cell
queued unrelated reconnects and migration completions behind it. Both now lock
only the rows they touch, in the same ascending cell_id order, and the sticky
grant moves its counter by a delta instead of writing back a snapshot value.

Placement keeps the ordered inventory lock: choosing the least-loaded cell is a
genuinely fleet-wide decision, and dynamically locking only the selected target
is what allowed cross-cell cycles before.

The pool's statement_timeout becomes env-configurable and a 57014 now reaches
the bounded transaction retry instead of surfacing as a terminal failure.
Schema DDL moves to its own `max: 1`, statement_timeout-free pool that is ended
before the serving pool opens, so a slow CREATE INDEX cannot inherit a request
deadline it will never fit inside.
---
 cloud/apps/relay/src/assignment-store.ts      |  80 +++++--
 .../src/cell-inventory-lock-census.test.ts    |   9 +-
 ...nventory-per-cell-locking-postgres.test.ts | 206 ++++++++++++++++++
 .../src/database-postgres-timeout.test.ts     | 133 ++++++++++-
 ...atabase-statement-timeout-postgres.test.ts |  98 +++++++++
 cloud/apps/relay/src/database.ts              |  68 +++++-
 .../src/postgres-transaction-recovery.test.ts |  14 +-
 7 files changed, 571 insertions(+), 37 deletions(-)
 create mode 100644 cloud/apps/relay/src/cell-inventory-per-cell-locking-postgres.test.ts
 create mode 100644 cloud/apps/relay/src/database-statement-timeout-postgres.test.ts

diff --git a/cloud/apps/relay/src/assignment-store.ts b/cloud/apps/relay/src/assignment-store.ts
index 9d240e304a7..226df9b3984 100644
--- a/cloud/apps/relay/src/assignment-store.ts
+++ b/cloud/apps/relay/src/assignment-store.ts
@@ -645,9 +645,17 @@ export class RelayAssignmentStore {
   ): Promise<RelayAssignment | null> {
     const now = this.now()
     return await this.database.transaction(async (transaction) => {
-      const lockedCells = inventoryFirst
-        ? await this.lockCellInventory(transaction, lockMode)
+      // Why: the retry exists to take a cell row before the assignment row, the
+      // order placement uses. It only ever needs the one cell this host is
+      // pinned to, so read the pin unlocked and lock that row alone; taking all
+      // 23 queued every sticky refresh in the fleet behind every other one.
+      const pinnedCellId = inventoryFirst
+        ? await this.pinnedCellId(transaction, identity)
         : undefined
+      const lockedCells =
+        pinnedCellId === undefined
+          ? undefined
+          : await this.lockCellRows(transaction, [pinnedCellId], lockMode)
       const existing = await this.assignmentRow(transaction, identity, inventoryFirst)
       if (!existing) return null
       const activityLeases = await this.lockAssignmentActivities(transaction, identity, true)
@@ -661,6 +669,11 @@ export class RelayAssignmentStore {
       }
 
       const currentCellId = text(existing, 'cell_id')
+      // The pin moved between the unlocked read and the assignment lock, so the
+      // row held is the wrong one. Same recovery as losing the lock: retry.
+      if (pinnedCellId !== undefined && pinnedCellId !== currentCellId) {
+        throw new Error('database_lock_unavailable')
+      }
       const hadControl = holdsControlLease(
         activityLeases,
         currentCellId,
@@ -701,14 +714,9 @@ export class RelayAssignmentStore {
       if (hadControl) {
         await this.touchAssignment(transaction, identity, leaseExpiresAt, now)
       } else {
-        const nextReservation = integer(currentRow, 'reserved_requests') + 1
-        if (nextReservation > integer(currentRow, 'capacity_requests')) {
-          throw new Error('relay_capacity_exhausted')
-        }
-        await transaction.query(
-          `UPDATE relay_cells SET reserved_requests = ?, updated_at = ? WHERE cell_id = ?`,
-          [nextReservation, now, currentCellId]
-        )
+        // Delta, not the value read from the snapshot: an absolute write here
+        // would clobber any concurrent movement of the same counter.
+        await this.adjustCellReservationAtomically(transaction, currentCellId, 1)
         await this.adjustActivityCount(transaction, identity, 'control', 1, leaseExpiresAt, now)
         await this.insertPendingControlLease(
           transaction,
@@ -6864,13 +6872,24 @@ export class RelayAssignmentStore {
           targetCellId
         ]
       )
-      const cells = await this.lockCellInventory(transaction, 'pool-default')
+      // Only the two cells this repairs need holding. The id set below is an
+      // existence check against a table that only reconcileCells writes, so it
+      // reads unlocked instead of dragging the other 21 rows into the section.
+      const cellIds = new Set(
+        (await transaction.query(`SELECT cell_id FROM relay_cells`)).map((row) =>
+          text(row, 'cell_id')
+        )
+      )
+      const cells = await this.lockCellRows(
+        transaction,
+        [sourceCellId, targetCellId],
+        'pool-default'
+      )
       const assignmentKeys = new Set(
         assignments.map((row) =>
           assignmentKey(text(row, 'user_id'), text(row, 'relay_host_id'))
         )
       )
-      const cellIds = new Set(cells.map((row) => text(row, 'cell_id')))
       const assignmentCounts = new Map<
         string,
         { counts: Record<AssignmentActivityKind, number>; leaseExpiresAt: number }
@@ -6924,9 +6943,7 @@ export class RelayAssignmentStore {
         )
       }
 
-      for (const row of cells.filter((cell) =>
-        [sourceCellId, targetCellId].includes(text(cell, 'cell_id'))
-      )) {
+      for (const row of cells) {
         const cellId = text(row, 'cell_id')
         const expected = cellUnits.get(cellId) ?? 0
         if (expected > integer(row, 'capacity_requests')) {
@@ -6958,16 +6975,40 @@ export class RelayAssignmentStore {
   // Per-connection paths touch one or two cells. Locking exactly those rows,
   // in the same ascending order the inventory lock uses (ORDER BY fixes the
   // row-lock order), keeps them off the fleet-wide lock without a cycle.
-  private async lockCellRows(database: RelayDatabase, cellIds: string[]): Promise<SqlRow[]> {
+  // The wait policy follows the caller for the same reason the inventory lock's
+  // does: a sweep must not fail terminally on ordinary contention. Hold time is
+  // deliberately not sampled here — the metric tracks the fleet-wide lock these
+  // rows replace, and mixing in short single-row holds would flatter it.
+  private async lockCellRows(
+    database: RelayDatabase,
+    cellIds: string[],
+    mode: CellInventoryLockMode = 'request'
+  ): Promise<SqlRow[]> {
     const distinct = [...new Set(cellIds)]
+    const { measureHoldMs: _sampled, ...wait } = cellInventoryLockOptions(mode)
     return await database.queryLocked(
       `SELECT * FROM relay_cells WHERE cell_id IN (${distinct.map(() => '?').join(', ')})
        ORDER BY cell_id ASC`,
       distinct,
-      { lockTimeoutMs: CELL_INVENTORY_LOCK_TIMEOUT_MS }
+      wait
     )
   }
 
+  // Unlocked on purpose: this only names the row to lock next, and the caller
+  // re-checks the pin once the assignment row is held.
+  private async pinnedCellId(
+    database: RelayDatabase,
+    identity: AssignmentIdentity
+  ): Promise<string | undefined> {
+    const row = (
+      await database.query(
+        `SELECT cell_id FROM relay_assignments WHERE user_id = ? AND relay_host_id = ?`,
+        [identity.userId, identity.relayHostId]
+      )
+    )[0]
+    return row ? text(row, 'cell_id') : undefined
+  }
+
   private async lockGeneralCellInventory(
     database: RelayDatabase,
     mode: CellInventoryLockMode
@@ -6986,10 +7027,11 @@ export class RelayAssignmentStore {
 
   private async leastLoadedCell(
     database: RelayDatabase,
-    lockedCells: SqlRow[] | undefined,
+    // Required: the one caller has already locked the inventory it selects from,
+    // and an optional parameter left a second fleet-wide lock reachable here.
+    rows: SqlRow[],
     preferredRegion: RelayRegion
   ): Promise<CellRow | null> {
-    const rows = lockedCells ?? (await this.lockCellInventory(database, 'pool-default'))
     const regions = new Map(
       (await database.query(`SELECT cell_id, region FROM relay_cell_regions`)).map((row) => [
         text(row, 'cell_id'),
diff --git a/cloud/apps/relay/src/cell-inventory-lock-census.test.ts b/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
index a26e15f8e1d..0ac4c8225e3 100644
--- a/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
+++ b/cloud/apps/relay/src/cell-inventory-lock-census.test.ts
@@ -18,7 +18,9 @@ type CensusEntry = { method: string; mode: CensusMode; reach: Reachability }
 // assignment-store.ts, in source order. A new site fails this test until it is
 // classified here, which is the point.
 const CENSUS: CensusEntry[] = [
-  { method: 'assignStickyOnce', mode: 'caller', reach: 'both' },
+  // assignStickyOnce is gone from this list: its retry now locks only the row
+  // the host is pinned to (lockCellRows), which is what a sticky refresh
+  // touches. Placement below is the one genuinely fleet-wide decision left.
   { method: 'assignOnce', mode: 'caller', reach: 'both' },
   { method: 'assignOnce', mode: 'caller', reach: 'both' },
   { method: 'assignOnce', mode: 'nowait', reach: 'both' },
@@ -49,8 +51,9 @@ const CENSUS: CensusEntry[] = [
   { method: 'abortExpiredEvacuations', mode: 'nowait', reach: 'sweep' },
   { method: 'releaseExpiredActivityLeases', mode: 'nowait', reach: 'sweep' },
   { method: 'releaseExpiredActivity', mode: 'nowait', reach: 'sweep' },
-  { method: 'reconcileReservationAccounting', mode: 'pool-default', reach: 'both' },
-  { method: 'leastLoadedCell', mode: 'pool-default', reach: 'both' }
+  // reconcileReservationAccounting and leastLoadedCell are gone too: the first
+  // repairs exactly two cells' counters and now holds only those rows, and the
+  // second selects from the inventory its single caller has already locked.
 ]
 
 // Every inline `FROM relay_cells ... FOR UPDATE` outside the named lock helpers,
diff --git a/cloud/apps/relay/src/cell-inventory-per-cell-locking-postgres.test.ts b/cloud/apps/relay/src/cell-inventory-per-cell-locking-postgres.test.ts
new file mode 100644
index 00000000000..8c0ebd73f32
--- /dev/null
+++ b/cloud/apps/relay/src/cell-inventory-per-cell-locking-postgres.test.ts
@@ -0,0 +1,206 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { RelayAssignmentStore } from './assignment-store.js'
+import { openRelayDatabase, type RelayDatabase } from './database.js'
+
+const databaseUrl = process.env.ORCA_RELAY_TEST_POSTGRES_URL
+const describePostgres = databaseUrl ? describe : describe.skip
+
+// Sorted ascending, and the host is pinned to the LAST id on purpose: the
+// fleet-wide lock is one ordered scan, so it holds every earlier row while it
+// waits on the pinned one. Pinning to the first id would make the two locking
+// models indistinguishable.
+const cells = ['a', 'b', 'c'].map((suffix) => ({
+  id: `percell-postgres-${suffix}`,
+  url: `https://percell-postgres-${suffix}.example.com`,
+  capacityRequests: 1_000,
+  connectionHardCap: 600 as const,
+  connectionUnobservedBound: 50
+}))
+const [cellA, cellB, cellC] = cells as [(typeof cells)[0], (typeof cells)[0], (typeof cells)[0]]
+const identity = { userId: 'percell-postgres-user', relayHostId: 'percellhost00001' }
+
+function heartbeat(cell: (typeof cells)[number]) {
+  return {
+    cellId: cell.id,
+    cellUrl: cell.url,
+    cellIncarnation: '11111111-1111-4111-8111-111111111111',
+    startedAt: 50,
+    ready: true,
+    observedRequests: 0,
+    totalConnections: 0,
+    inFlightConnections: 0,
+    reservedConnectionUnits: 0,
+    enforcedConnectionUnits: 0,
+    connectionInclusionWatermark: 1,
+    connectionHardCap: 600 as const,
+    connectionUnobservedBound: 50
+  }
+}
+
+describePostgres('PostgreSQL per-cell inventory locking', () => {
+  const databases: RelayDatabase[] = []
+
+  beforeAll(async () => {
+    for (let index = 0; index < 3; index++) {
+      databases.push(await openRelayDatabase({ databaseUrl, dataDir: '' }))
+    }
+  })
+
+  async function removeTestRows(database: RelayDatabase): Promise<void> {
+    await database.query(
+      `DELETE FROM relay_control_connection_reservations WHERE user_id LIKE 'percell-postgres-%'`
+    )
+    for (const table of [
+      'relay_assignment_activity_leases',
+      'relay_post_drain_migration_pins',
+      'relay_assignment_migration_incarnations',
+      'relay_assignment_migrations',
+      'relay_assignment_region_preferences',
+      'relay_assignments'
+    ]) {
+      await database.query(`DELETE FROM ${table} WHERE user_id LIKE 'percell-postgres-%'`)
+    }
+    for (const cell of cells) {
+      for (const table of [
+        'relay_cell_connection_snapshots',
+        'relay_cell_connection_runtime',
+        'relay_cell_connection_limits',
+        'relay_cell_runtime',
+        'relay_cells'
+      ]) {
+        await database.query(`DELETE FROM ${table} WHERE cell_id = ?`, [cell.id])
+      }
+    }
+  }
+
+  afterAll(async () => {
+    if (databases[0]) await removeTestRows(databases[0])
+    for (const connection of databases) await connection.close()
+  })
+
+  async function pinHostToLastCell(store: RelayAssignmentStore): Promise<void> {
+    await store.reconcileCells(cells)
+    for (const cell of cells) await store.recordCellHeartbeat(heartbeat(cell))
+    await store.setCellEnabled(cellA.id, false)
+    await store.setCellEnabled(cellB.id, false)
+    const assignment = await store.assign(identity)
+    expect(assignment.cellId).toBe(cellC.id)
+    await store.setCellEnabled(cellA.id, true)
+    await store.setCellEnabled(cellB.id, true)
+  }
+
+  async function lockWaiterAppeared(database: RelayDatabase): Promise<boolean> {
+    const deadline = Date.now() + 4_000
+    while (Date.now() < deadline) {
+      const rows = await database.query(
+        `SELECT count(*) AS waiting FROM pg_stat_activity
+         WHERE datname = current_database() AND wait_event_type = 'Lock'`
+      )
+      if (Number(rows[0]!.waiting) > 0) return true
+      await new Promise((resolve) => setTimeout(resolve, 10))
+    }
+    return false
+  }
+
+  // Why: a sticky refresh whose first NOWAIT probe loses retries by taking a
+  // cell row before the assignment row. That retry used to take the whole
+  // inventory, so one busy cell stalled every other cell's reconnects.
+  it('waits only on the pinned cell row while refreshing a sticky assignment', async () => {
+    await removeTestRows(databases[0]!)
+    const store = new RelayAssignmentStore(databases[0]!, () => 100)
+    await pinHostToLastCell(store)
+    // A host whose control lease was already reaped still holds its pin; that
+    // is the shape that reaches the cell-row probe instead of touchAssignment.
+    await databases[0]!.query(
+      `DELETE FROM relay_assignment_activity_leases WHERE user_id = ?`,
+      [identity.userId]
+    )
+
+    let releaseRow!: () => void
+    const rowReleased = new Promise<void>((resolve) => {
+      releaseRow = resolve
+    })
+    let rowHeld!: () => void
+    const rowHeldPromise = new Promise<void>((resolve) => {
+      rowHeld = resolve
+    })
+    const holder = databases[1]!.transaction(async (transaction) => {
+      await transaction.queryLocked(`SELECT * FROM relay_cells WHERE cell_id = ?`, [cellC.id])
+      rowHeld()
+      await rowReleased
+    })
+    await rowHeldPromise
+
+    const refresh = store.assign(identity)
+    expect(await lockWaiterAppeared(databases[2]!)).toBe(true)
+    // The refresh is blocked on cell C. Every earlier row must still be free:
+    // the ordered fleet-wide scan would be holding both of them by now.
+    const heldWhileRefreshWaits: string[] = []
+    await databases[2]!.transaction(async (transaction) => {
+      for (const cell of [cellA, cellB]) {
+        try {
+          await transaction.queryLocked(
+            `SELECT * FROM relay_cells WHERE cell_id = ?`,
+            [cell.id],
+            { failIfUnavailable: true }
+          )
+        } catch {
+          heldWhileRefreshWaits.push(cell.id)
+        }
+      }
+    })
+    releaseRow()
+    await holder
+
+    expect(heldWhileRefreshWaits).toEqual([])
+    expect((await refresh).cellId).toBe(cellC.id)
+  }, 15_000)
+
+  // Why: the counter moves by a delta now instead of an absolute value read
+  // from a snapshot, so concurrent movement on the same cell must still sum.
+  it('keeps a cell reservation exact under concurrent same-cell activity', async () => {
+    await removeTestRows(databases[0]!)
+    const store = new RelayAssignmentStore(databases[0]!, () => 100)
+    await store.reconcileCells(cells)
+    for (const cell of cells) await store.recordCellHeartbeat(heartbeat(cell))
+    await store.setCellEnabled(cellA.id, false)
+    await store.setCellEnabled(cellB.id, false)
+
+    const hosts = Array.from({ length: 6 }, (_, index) => ({
+      userId: `percell-postgres-user-${index}`,
+      relayHostId: `percellhost0000${index}`
+    }))
+    const stores = databases.map((database) => new RelayAssignmentStore(database, () => 100))
+    await Promise.all(hosts.map((host, index) => stores[index % stores.length]!.assign(host)))
+
+    // One splice each (2 units) on the same cell, from three connections at once.
+    await Promise.all(
+      hosts.map((host, index) =>
+        stores[index % stores.length]!.acquireActivity(host, {
+          activityId: `splice:percell-${index}`,
+          kind: 'splice',
+          cellId: cellC.id
+        })
+      )
+    )
+    const afterAcquire = await databases[0]!.query(
+      `SELECT reserved_requests FROM relay_cells WHERE cell_id = ?`,
+      [cellC.id]
+    )
+    // 6 pending control grants + 6 splices at 2 units each.
+    expect(Number(afterAcquire[0]!.reserved_requests)).toBe(6 + 12)
+
+    await Promise.all(
+      hosts.map((host, index) =>
+        stores[index % stores.length]!.releaseActivity(host, `splice:percell-${index}`)
+      )
+    )
+    const afterRelease = await databases[0]!.query(
+      `SELECT reserved_requests FROM relay_cells WHERE cell_id = ?`,
+      [cellC.id]
+    )
+    expect(Number(afterRelease[0]!.reserved_requests)).toBe(6)
+    await store.setCellEnabled(cellA.id, true)
+    await store.setCellEnabled(cellB.id, true)
+  }, 15_000)
+})
diff --git a/cloud/apps/relay/src/database-postgres-timeout.test.ts b/cloud/apps/relay/src/database-postgres-timeout.test.ts
index 7aba1234f7f..c9021a9ef18 100644
--- a/cloud/apps/relay/src/database-postgres-timeout.test.ts
+++ b/cloud/apps/relay/src/database-postgres-timeout.test.ts
@@ -2,7 +2,10 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const fakes = vi.hoisted(() => ({
   configs: [] as Array<Record<string, unknown>>,
-  query: vi.fn(async () => ({ rows: [], rowCount: 0 })),
+  // Pool construction and pool shutdown interleaved, so "the schema pool is
+  // gone before the serving pool opens" is checkable rather than assumed.
+  lifecycle: [] as string[],
+  query: vi.fn(async (_sql: string) => ({ rows: [], rowCount: 0 })),
   release: vi.fn(),
   end: vi.fn(async () => undefined)
 }))
@@ -13,20 +16,37 @@ vi.mock('pg', () => ({
       totalCount = 1
       idleCount = 1
       waitingCount = 0
-      end = fakes.end
       on = vi.fn()
       connect = vi.fn(async () => ({ query: fakes.query, release: fakes.release }))
+      private readonly label: string
 
       constructor(config: Record<string, unknown>) {
         fakes.configs.push(config)
+        this.label = `max=${String(config.max)} statement_timeout=${String(config.statement_timeout)}`
+        fakes.lifecycle.push(`open ${this.label}`)
+      }
+
+      async end(): Promise<void> {
+        fakes.lifecycle.push(`end ${this.label}`)
+        await fakes.end()
       }
     }
   }
 }))
 
-import { openRelayDatabase } from './database.js'
+import { openRelayDatabase, relayPostgresStatementTimeoutMs } from './database.js'
 import { applyPostgresSchema } from './postgres-schema-startup.js'
 
+const SCHEMA_POOL = {
+  max: 1,
+  application_name: 'orca-relay/director/director/schema',
+  connectionTimeoutMillis: 2_000,
+  // Why: DDL must not inherit the request deadline.
+  statement_timeout: 0,
+  lock_timeout: 1_000,
+  idle_in_transaction_session_timeout: 5_000
+}
+
 afterEach(() => {
   vi.restoreAllMocks()
 })
@@ -34,9 +54,11 @@ afterEach(() => {
 describe('PostgreSQL relay deadlines', () => {
   beforeEach(() => {
     fakes.configs.length = 0
+    fakes.lifecycle.length = 0
     fakes.query.mockClear()
     fakes.release.mockClear()
     fakes.end.mockClear()
+    delete process.env.ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS
   })
 
   it('bounds pool acquisition, statements, locks, and abandoned transactions', async () => {
@@ -48,6 +70,7 @@ describe('PostgreSQL relay deadlines', () => {
     })
 
     expect(fakes.configs).toEqual([
+      expect.objectContaining(SCHEMA_POOL),
       expect.objectContaining({
         max: 3,
         application_name: 'orca-relay/director/director',
@@ -59,6 +82,110 @@ describe('PostgreSQL relay deadlines', () => {
     ])
     await database.close()
   })
+
+  // Why: an untimed session left open would be a standing way for request work
+  // to escape the deadline this whole pool config exists to enforce.
+  it('closes the untimed schema pool before the serving pool opens', async () => {
+    const database = await openRelayDatabase({
+      databaseUrl: 'postgresql://relay:secret@127.0.0.1:5432/relay',
+      dataDir: './unused',
+      poolMax: 3,
+      applicationName: 'orca-relay/director/director'
+    })
+
+    expect(fakes.lifecycle).toEqual([
+      'open max=1 statement_timeout=0',
+      'end max=1 statement_timeout=0',
+      'open max=3 statement_timeout=5000'
+    ])
+    await database.close()
+  })
+
+  it('applies the schema on the untimed pool, never on the serving one', async () => {
+    fakes.query.mockClear()
+    const ddl: string[] = []
+    fakes.query.mockImplementation(async (sql: string) => {
+      // Every statement issued before the serving pool exists is schema work.
+      if (fakes.lifecycle.length === 1) ddl.push(sql)
+      return { rows: [], rowCount: 0 }
+    })
+    const database = await openRelayDatabase({
+      databaseUrl: 'postgresql://relay:secret@127.0.0.1:5432/relay',
+      dataDir: './unused'
+    })
+
+    expect(ddl.length).toBeGreaterThan(0)
+    // Statements can open with a leading `--` rationale comment.
+    const body = (statement: string): string =>
+      statement.replace(/^(?:\s*--[^\n]*\n)*\s*/, '')
+    expect(ddl.every((statement) => /^CREATE\b/i.test(body(statement)))).toBe(true)
+    // The backfill is DML, so it stays on the deadline-bearing serving pool.
+    expect(ddl.some((statement) => statement.includes('INSERT INTO'))).toBe(false)
+    await database.close()
+  })
+
+  it('takes the serving statement deadline from the environment', async () => {
+    process.env.ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS = '2500'
+
+    const database = await openRelayDatabase({
+      databaseUrl: 'postgresql://relay:secret@127.0.0.1:5432/relay',
+      dataDir: './unused'
+    })
+
+    expect(fakes.configs).toEqual([
+      expect.objectContaining({ statement_timeout: 0 }),
+      expect.objectContaining({ statement_timeout: 2_500 })
+    ])
+    await database.close()
+  })
+
+  it.each(['0', '-1', '2.5', 'soon', ' '])(
+    'refuses %s as a statement deadline instead of running unbounded',
+    (value) => {
+      expect(() =>
+        relayPostgresStatementTimeoutMs({ ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS: value })
+      ).toThrow('invalid_statement_timeout')
+    }
+  )
+
+  it.each([undefined, ''])('defaults to 5s when the environment says %s', (value) => {
+    expect(
+      relayPostgresStatementTimeoutMs(
+        value === undefined ? {} : { ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS: value }
+      )
+    ).toBe(5_000)
+  })
+
+  // Why: a statement deadline that reaches the caller as a crash converts a
+  // transient stall into a failed assignment. It aborts the transaction exactly
+  // as a lock timeout does, so it belongs on the same bounded retry.
+  it('retries a statement timeout on a fresh client', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+    const database = await openRelayDatabase({
+      databaseUrl: 'postgresql://relay:secret@127.0.0.1:5432/relay',
+      dataDir: './unused'
+    })
+    let attempts = 0
+
+    const result = await database.transaction(async (transaction) => {
+      attempts += 1
+      if (attempts === 1) {
+        await transaction.query('SELECT 1')
+        throw Object.assign(new Error('canceling statement due to statement timeout'), {
+          code: '57014'
+        })
+      }
+      return 'committed'
+    })
+
+    expect(result).toBe('committed')
+    expect(attempts).toBe(2)
+    expect(console.warn).toHaveBeenCalledWith(
+      expect.stringContaining('"event":"orca_relay_postgres_transaction_retry"')
+    )
+    expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('"code":"57014"'))
+    await database.close()
+  })
 })
 
 describe('PostgreSQL schema startup', () => {
diff --git a/cloud/apps/relay/src/database-statement-timeout-postgres.test.ts b/cloud/apps/relay/src/database-statement-timeout-postgres.test.ts
new file mode 100644
index 00000000000..6b7ebb0334e
--- /dev/null
+++ b/cloud/apps/relay/src/database-statement-timeout-postgres.test.ts
@@ -0,0 +1,98 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { openRelayDatabase, type RelayDatabase } from './database.js'
+
+const databaseUrl = process.env.ORCA_RELAY_TEST_POSTGRES_URL
+const describePostgres = databaseUrl ? describe : describe.skip
+const applicationName = 'orca-relay/statement-timeout-postgres'
+
+describePostgres('PostgreSQL statement deadline', () => {
+  const databases: RelayDatabase[] = []
+
+  beforeAll(async () => {
+    databases.push(await openRelayDatabase({ databaseUrl, dataDir: '' }))
+  })
+
+  afterAll(async () => {
+    for (const database of databases) await database.close()
+  })
+
+  it('serves requests under the configured deadline', async () => {
+    const database = await openRelayDatabase({ databaseUrl, dataDir: '', statementTimeoutMs: 300 })
+    databases.push(database)
+
+    expect(await database.query(`SELECT current_setting('statement_timeout') AS statement_timeout`)).toEqual([
+      { statement_timeout: '300ms' }
+    ])
+  })
+
+  // Why: a real 57014 aborts the transaction exactly as a lock timeout does. If
+  // it escapes the bounded retry it becomes a failed assignment instead of a
+  // slow one.
+  it('retries a real statement timeout on a fresh client', async () => {
+    const database = await openRelayDatabase({ databaseUrl, dataDir: '', statementTimeoutMs: 300 })
+    databases.push(database)
+    let attempts = 0
+
+    const result = await database.transaction(async (transaction) => {
+      attempts += 1
+      if (attempts === 1) await transaction.query(`SELECT pg_sleep(2)`)
+      return attempts
+    })
+
+    expect(result).toBe(2)
+  }, 15_000)
+
+  // Why: DDL runs on its own untimed connection. relay_invites carries a
+  // CREATE INDEX IF NOT EXISTS, which (unlike CREATE TABLE IF NOT EXISTS)
+  // really does queue behind an ACCESS EXCLUSIVE lock on the table.
+  it('applies the schema behind a held ACCESS EXCLUSIVE lock', async () => {
+    let releaseTable!: () => void
+    const tableReleased = new Promise<void>((resolve) => {
+      releaseTable = resolve
+    })
+    let tableHeld!: () => void
+    const tableHeldPromise = new Promise<void>((resolve) => {
+      tableHeld = resolve
+    })
+    const holder = databases[0]!.transaction(async (transaction) => {
+      await transaction.query(`LOCK TABLE relay_invites IN ACCESS EXCLUSIVE MODE`)
+      tableHeld()
+      await tableReleased
+    })
+    await tableHeldPromise
+
+    const opening = openRelayDatabase({
+      databaseUrl,
+      dataDir: '',
+      applicationName,
+      // Far too short for a blocked DDL; the serving pool wears it, the schema
+      // connection must not.
+      statementTimeoutMs: 200
+    })
+    const blockedOnSchemaConnection = async (): Promise<boolean> => {
+      const deadline = Date.now() + 4_000
+      while (Date.now() < deadline) {
+        const rows = await databases[0]!.query(
+          `SELECT count(*) AS waiting FROM pg_stat_activity
+           WHERE datname = current_database() AND wait_event_type = 'Lock'
+             AND application_name = ?`,
+          [`${applicationName}/schema`]
+        )
+        if (Number(rows[0]!.waiting) > 0) return true
+        await new Promise((resolve) => setTimeout(resolve, 10))
+      }
+      return false
+    }
+    const blocked = await blockedOnSchemaConnection()
+    releaseTable()
+    await holder
+
+    const database = await opening
+    databases.push(database)
+    expect(blocked).toBe(true)
+    // The serving pool still carries the short deadline it was opened with.
+    expect(await database.query(`SELECT current_setting('statement_timeout') AS statement_timeout`)).toEqual([
+      { statement_timeout: '200ms' }
+    ])
+  }, 15_000)
+})
diff --git a/cloud/apps/relay/src/database.ts b/cloud/apps/relay/src/database.ts
index 326ab010ccb..2558831ca64 100644
--- a/cloud/apps/relay/src/database.ts
+++ b/cloud/apps/relay/src/database.ts
@@ -796,12 +796,34 @@ class PostgresTransaction implements RelayDatabase {
 const POSTGRES_TRANSACTION_ATTEMPTS = 3
 const POSTGRES_RETRY_MAX_DELAY_MS = 25
 const POSTGRES_CONNECTION_TIMEOUT_MS = 2_000
-const POSTGRES_STATEMENT_TIMEOUT_MS = 5_000
+// Derivation: a control renewal must land inside its own 30s tick
+// (RELAY_PROTOCOL_LIMITS.controlPingIntervalMs * 2), and a transaction gets
+// POSTGRES_TRANSACTION_ATTEMPTS tries, so the worst case a renewal can spend in
+// Postgres is attempts * timeout. 5s keeps that at 15s, half the tick, and still
+// leaves room for the connect timeout above.
+export const POSTGRES_STATEMENT_TIMEOUT_MS = 5_000
 const POSTGRES_IDLE_TRANSACTION_TIMEOUT_MS = 5_000
 
+export function relayPostgresStatementTimeoutMs(
+  env: NodeJS.ProcessEnv = process.env
+): number {
+  const configured = env.ORCA_RELAY_POSTGRES_STATEMENT_TIMEOUT_MS
+  if (configured === undefined || configured === '') return POSTGRES_STATEMENT_TIMEOUT_MS
+  const milliseconds = Number(configured)
+  // 0 is PostgreSQL's "no timeout"; refusing it keeps the deadline this exists
+  // to enforce from being disabled by a typo in an environment variable.
+  if (!Number.isInteger(milliseconds) || milliseconds < 1) {
+    throw new Error('invalid_statement_timeout')
+  }
+  return milliseconds
+}
+
 function retryablePostgresTransactionError(error: unknown): boolean {
   const code = String((error as { code?: unknown }).code)
-  return code === '40P01' || code === '40001' || code === '55P03'
+  // 57014 is the pool statement_timeout firing. It aborts the transaction the
+  // same way a lock timeout does, so it belongs on the bounded retry path
+  // rather than surfacing as a terminal failure to the caller.
+  return code === '40P01' || code === '40001' || code === '55P03' || code === '57014'
 }
 
 export function isRelayDatabaseTransientError(error: unknown): boolean {
@@ -963,11 +985,36 @@ async function applySchema(database: RelayDatabase): Promise<void> {
   }
 }
 
-async function applySchemaWithPostgresRetries(database: RelayDatabase): Promise<void> {
-  await applyPostgresSchema(
-    SCHEMA.split(';').filter((statement) => statement.trim()),
-    async (statement) => await database.query(statement)
-  )
+// Why: DDL is not a request. A CREATE INDEX on a grown table legitimately runs
+// longer than the request statement_timeout, and inheriting that timeout would
+// make every startup fail at the same statement instead of finishing once. One
+// short-lived connection of its own, ended before the serving pool opens, keeps
+// the untimed session off the request path entirely.
+async function applySchemaOnUntimedPool(
+  databaseUrl: string,
+  applicationName: string | undefined
+): Promise<void> {
+  const pool = new pg.Pool({
+    connectionString: databaseUrl,
+    max: 1,
+    application_name: applicationName ? `${applicationName}/schema` : undefined,
+    connectionTimeoutMillis: POSTGRES_CONNECTION_TIMEOUT_MS,
+    statement_timeout: 0,
+    // Kept: a DDL blocked behind another director's ACCESS EXCLUSIVE lock must
+    // yield to the bounded schema retry instead of holding the connection.
+    lock_timeout: POSTGRES_LOCK_TIMEOUT_MS,
+    idle_in_transaction_session_timeout: POSTGRES_IDLE_TRANSACTION_TIMEOUT_MS
+  })
+  absorbPostgresIdleClientErrors(pool)
+  const database = new PostgresDatabase(pool)
+  try {
+    await applyPostgresSchema(
+      SCHEMA.split(';').filter((statement) => statement.trim()),
+      async (statement) => await database.query(statement)
+    )
+  } finally {
+    await database.close().catch(() => undefined)
+  }
 }
 
 async function backfillRelayCellRegions(database: RelayDatabase): Promise<void> {
@@ -983,15 +1030,17 @@ export async function openRelayDatabase(input: {
   dataDir: string
   poolMax?: number
   applicationName?: string
+  statementTimeoutMs?: number
 }): Promise<RelayDatabase> {
   let database: RelayDatabase
   if (input.databaseUrl) {
+    await applySchemaOnUntimedPool(input.databaseUrl, input.applicationName)
     const pool = new pg.Pool({
       connectionString: input.databaseUrl,
       max: input.poolMax ?? 10,
       application_name: input.applicationName,
       connectionTimeoutMillis: POSTGRES_CONNECTION_TIMEOUT_MS,
-      statement_timeout: POSTGRES_STATEMENT_TIMEOUT_MS,
+      statement_timeout: input.statementTimeoutMs ?? relayPostgresStatementTimeoutMs(),
       lock_timeout: POSTGRES_LOCK_TIMEOUT_MS,
       idle_in_transaction_session_timeout: POSTGRES_IDLE_TRANSACTION_TIMEOUT_MS
     })
@@ -1004,8 +1053,7 @@ export async function openRelayDatabase(input: {
     database = new SqliteDatabase(sqlite)
   }
   try {
-    if (input.databaseUrl) await applySchemaWithPostgresRetries(database)
-    else await applySchema(database)
+    if (!input.databaseUrl) await applySchema(database)
     await backfillRelayCellRegions(database)
     return database
   } catch (error) {
diff --git a/cloud/apps/relay/src/postgres-transaction-recovery.test.ts b/cloud/apps/relay/src/postgres-transaction-recovery.test.ts
index a49c07d2e7d..ae9d52a7c86 100644
--- a/cloud/apps/relay/src/postgres-transaction-recovery.test.ts
+++ b/cloud/apps/relay/src/postgres-transaction-recovery.test.ts
@@ -503,12 +503,19 @@ describePostgres('PostgreSQL transaction recovery', () => {
     const directorLockOrder: string[] = []
     const assignmentDatabase = new TransactionProbeDatabase(database, async (phase, sql) => {
       if (phase === 'before') {
-        if (sql.includes('FROM relay_assignments WHERE user_id = ?')) {
+        // Only locked statements reach this hook, so classifying the pin read
+        // is what proves it stays unlocked: if it ever grows a FOR UPDATE it
+        // shows up in the order below instead of silently joining the queue.
+        if (sql.includes('SELECT cell_id FROM relay_assignments')) {
+          directorLockOrder.push('pin-read')
+        } else if (sql.includes('FROM relay_assignments WHERE user_id = ?')) {
           directorLockOrder.push('assignment')
         } else if (sql.includes('FROM relay_assignment_activity_leases')) {
           directorLockOrder.push('activity')
         } else if (sql.includes('FROM relay_cells ORDER BY')) {
           directorLockOrder.push('cell-inventory')
+        } else if (sql.includes('FROM relay_cells WHERE cell_id IN')) {
+          directorLockOrder.push('cell-rows')
         } else if (sql.includes('FROM relay_cells WHERE cell_id = ?')) {
           directorLockOrder.push('cell')
         }
@@ -530,11 +537,14 @@ describePostgres('PostgreSQL transaction recovery', () => {
     })
     await expect(legacyTransaction).resolves.toBeUndefined()
     expect(assignmentDatabase.attempts).toBe(2)
+    // The retry still takes a cell row before the assignment row — the order
+    // that avoids the legacy cycle — but only the pinned row, never the
+    // inventory.
     expect(directorLockOrder).toEqual([
       'assignment',
       'activity',
       'cell',
-      'cell-inventory',
+      'cell-rows',
       'assignment',
       'activity'
     ])

From d3501f7ad6cd5e9feeaaf101a430c2b278c839d6 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:23:09 -0700
Subject: [PATCH 57/58] fix(worktrees): stop a failed worktree scan from being
 recorded as an authoritative empty listing (#18456)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(worktrees): stop a failed worktree scan from pruning as an authoritative empty listing

A `git worktree list` that could not run at all — a WSL distro that stopped
resolving, a hung mount, a git binary that errored — was softened to `[]` by the
lenient listing path, so the detected scan published it as
`authoritative: true, worktrees: []`. That disables the #1158 retention guard,
drops every persisted tab for the repo, and the pruned session is written back to
disk on the next launch. The loss is permanent, not a transient glitch.

Route the detected scan through a strict listing that still reports the two
genuinely empty states (repo path gone, not a Git repo) as `[]`. Everything else
rejects, so the existing catch answers `authoritative: false` and the destructive
halves (`rememberLocalWorktreeRoots`, `pruneLineageForMissingRepoWorktrees`)
never see a failed scan.

Also make the failure readable: wsl.exe reports its own launch failures as exit
0xFFFFFFFF with an EMPTY stderr and the `Wsl/Service/WSL_E_*` line on stdout as
UTF-16LE, which is why the field bundle carried a git error with no text. Set
WSL_UTF8 for WSL-routed git (matching the wsl runner, #9010) and attach that
stdout diagnostic to the error so `git.exec` spans name the cause.

* fix(worktrees): surface a failed worktree scan's cause on the repo header with a retry

A failed scan now travels with its reason (optional unavailableReason on
DetectedWorktreeListResult), the repo header shows it with click-to-retry,
and the WSL deleted-guest-directory shape measured on a real Windows host is
pinned as retained-not-pruned.
---
 src/main/git/command-runner/git-exec-file.ts  |   7 +-
 .../git/command-runner/git-process-env.ts     |   5 +
 .../command-runner/wsl-host-failure.test.ts   | 143 +++++++++++++++
 .../git/command-runner/wsl-host-failure.ts    |  55 ++++++
 src/main/git/worktree-listing.ts              |  64 ++++---
 src/main/git/worktree-scan-cache.ts           |  22 ++-
 src/main/git/worktree.ts                      |   3 +-
 src/main/ipc/worktrees-test-module-mocks.ts   |   1 +
 src/main/ipc/worktrees-windows.test.ts        |   1 +
 .../listing/detected-provider-listing.ts      |  19 +-
 .../detected-scan-failure-authority.test.ts   | 166 ++++++++++++++++++
 .../listing/detected-worktree-scan-cache.ts   |   6 +-
 ...etected-worktree-scan-hygiene-gate.test.ts |   4 +-
 .../listing/worktree-listing-diagnostics.ts   |  20 +++
 src/main/repo-worktrees.ts                    |  34 +++-
 .../RepoScanUnavailableIndicator.test.tsx     | 102 +++++++++++
 .../rows/RepoScanUnavailableIndicator.tsx     |  75 ++++++++
 .../worktree-list/rows/SectionHeader.tsx      |   2 +
 src/renderer/src/i18n/locales/en.json         |   5 +
 .../listing/detected-worktree-host-merge.ts   |   1 +
 ...tected-worktree-unavailable-reason.test.ts |  31 ++++
 .../listing/worktree-catalog-visibility.ts    |   1 +
 src/shared/worktree/types.ts                  |   2 +
 23 files changed, 733 insertions(+), 36 deletions(-)
 create mode 100644 src/main/git/command-runner/wsl-host-failure.test.ts
 create mode 100644 src/main/git/command-runner/wsl-host-failure.ts
 create mode 100644 src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
 create mode 100644 src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx
 create mode 100644 src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.tsx
 create mode 100644 src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts

diff --git a/src/main/git/command-runner/git-exec-file.ts b/src/main/git/command-runner/git-exec-file.ts
index dbd861d4897..acfeb9f8a3e 100644
--- a/src/main/git/command-runner/git-exec-file.ts
+++ b/src/main/git/command-runner/git-exec-file.ts
@@ -10,6 +10,7 @@ import {
   prepareWslLinkedWorktreeGitRouting
 } from '../wsl-linked-worktree-git-routing'
 import { resolveCommand, type ResolvedCommand } from './wsl-command-resolution'
+import { annotateWslHostFailure } from './wsl-host-failure'
 import type { GitAdmissionTier, GitExecOptions } from './git-exec-options'
 import { execFileCapture, execFileCaptureToTermination } from './exec-file-capture'
 import {
@@ -96,7 +97,7 @@ async function gitExecFileAsyncUnlocked(
             ? {}
             : { createTimeoutError: () => new GitCommandTimeoutError(timeoutMs) })
         }
-        return options.terminationBarrier
+        const captured = options.terminationBarrier
           ? execFileCaptureToTermination(
               command.binary,
               command.args,
@@ -104,6 +105,10 @@ async function gitExecFileAsyncUnlocked(
               command.termination
             )
           : execFileCapture(command.binary, command.args, captureOptions)
+        // Why: a dead WSL distro fails with an empty stderr, so the span would carry no cause at all.
+        return captured.catch((error: unknown) => {
+          throw annotateWslHostFailure(error, command)
+        })
       }
       const runCapturedCommand = async (): Promise<{ stdout: string; stderr: string }> => {
         let result: { stdout: string | Buffer; stderr: string | Buffer }
diff --git a/src/main/git/command-runner/git-process-env.ts b/src/main/git/command-runner/git-process-env.ts
index 6154364e5ab..9064f5ed900 100644
--- a/src/main/git/command-runner/git-process-env.ts
+++ b/src/main/git/command-runner/git-process-env.ts
@@ -63,6 +63,11 @@ export function nonInteractiveGitEnv(
   platform: NodeJS.Platform = process.platform
 ): NodeJS.ProcessEnv {
   const next = promptGuardGitEnv(env, platform)
+  if (platform === 'win32') {
+    // Why: without it wsl.exe writes its OWN failures ("no distribution with the supplied name") as
+    // UTF-16LE (#9010), which is how a dead distro reached telemetry as an error with no text.
+    next.WSL_UTF8 = '1'
+  }
   if (!next.GIT_SSH_COMMAND) {
     next.GIT_SSH_COMMAND = 'ssh -o BatchMode=yes'
     if (platform === 'win32') {
diff --git a/src/main/git/command-runner/wsl-host-failure.test.ts b/src/main/git/command-runner/wsl-host-failure.test.ts
new file mode 100644
index 00000000000..4b495817f6f
--- /dev/null
+++ b/src/main/git/command-runner/wsl-host-failure.test.ts
@@ -0,0 +1,143 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { execFileMock } = vi.hoisted(() => ({ execFileMock: vi.fn() }))
+
+vi.mock('node:child_process', () => ({
+  execFile: execFileMock,
+  execFileSync: vi.fn(),
+  spawn: vi.fn()
+}))
+vi.mock('../../observability/instrumentation', () => ({
+  withGitSpan: (_attributes: unknown, run: (span: unknown) => unknown) =>
+    run({ setAttribute: () => {} })
+}))
+vi.mock('../../diagnostics/main-thread-churn-probe', () => ({ recordSubprocessSpawn: vi.fn() }))
+
+import { gitExecFileAsync } from '../runner'
+import { _resetGitAdmissionForTests } from './git-subprocess-admission'
+import { nonInteractiveGitEnv } from './git-process-env'
+import { annotateWslHostFailure, readWslHostFailureDiagnostic } from './wsl-host-failure'
+import type { ResolvedCommand } from './wsl-command-resolution'
+
+const WSL_COMMAND: ResolvedCommand = {
+  binary: 'wsl.exe',
+  args: ['-d', 'kali-linux', '--exec', 'sh', '-lc', 'git worktree list'],
+  cwd: 'C:\\Users\\paulius',
+  wsl: { distro: 'kali-linux', linuxPath: '/home/paulius/bugbounty' },
+  wslMode: 'login-shell'
+}
+
+const WSL_DIAGNOSTIC =
+  'There is no distribution with the supplied name.\r\nError code: Wsl/Service/WSL_E_DISTRO_NOT_FOUND\r\n'
+
+/** wsl.exe without WSL_UTF8 writes its own diagnostic as UTF-16LE, which reaches Node as NUL-riddled text. */
+function asUtf16Mojibake(text: string): string {
+  return [...text].map((character) => `${character}\u0000`).join('')
+}
+
+function hostFailure(stdout: string): Error {
+  return Object.assign(new Error('Command failed: wsl.exe -d kali-linux --exec sh -lc ...'), {
+    code: 4294967295,
+    stdout,
+    stderr: ''
+  })
+}
+
+async function withPlatform<T>(platform: NodeJS.Platform, run: () => Promise<T>): Promise<T> {
+  const original = process.platform
+  Object.defineProperty(process, 'platform', { configurable: true, value: platform })
+  try {
+    return await run()
+  } finally {
+    Object.defineProperty(process, 'platform', { configurable: true, value: original })
+  }
+}
+
+describe('wsl.exe host failure classification', () => {
+  it('reads the diagnostic wsl.exe left on stdout, including UTF-16 output', () => {
+    expect(readWslHostFailureDiagnostic(hostFailure(WSL_DIAGNOSTIC), WSL_COMMAND)).toContain(
+      'Wsl/Service/WSL_E_DISTRO_NOT_FOUND'
+    )
+    expect(
+      readWslHostFailureDiagnostic(hostFailure(asUtf16Mojibake(WSL_DIAGNOSTIC)), WSL_COMMAND)
+    ).toContain('Wsl/Service/WSL_E_DISTRO_NOT_FOUND')
+  })
+
+  it('leaves a guest failure and a non-WSL command alone', () => {
+    const guestFailure = Object.assign(new Error('Command failed'), {
+      code: 1,
+      stdout: '',
+      stderr: 'fatal: not a git repository\n'
+    })
+    expect(readWslHostFailureDiagnostic(guestFailure, WSL_COMMAND)).toBeNull()
+    // Same exit code, but wsl.exe was never involved.
+    expect(
+      readWslHostFailureDiagnostic(hostFailure(WSL_DIAGNOSTIC), {
+        binary: 'git',
+        args: ['status'],
+        cwd: '/repo',
+        wsl: null,
+        wslMode: null
+      })
+    ).toBeNull()
+  })
+
+  it('moves the diagnostic into the message the span records', () => {
+    const error = annotateWslHostFailure(hostFailure(WSL_DIAGNOSTIC), WSL_COMMAND) as Error & {
+      wslHostFailure?: boolean
+      wslDistro?: string
+      code?: number
+    }
+    expect(error.message).toContain('Wsl/Service/WSL_E_DISTRO_NOT_FOUND')
+    expect(error.message).toContain('kali-linux')
+    expect(error.wslHostFailure).toBe(true)
+    expect(error.wslDistro).toBe('kali-linux')
+    // The original failure detail must survive for callers that classify on it.
+    expect(error.code).toBe(4294967295)
+    expect(error.message).toContain('Command failed: wsl.exe')
+  })
+})
+
+describe('WSL-routed git subprocess', () => {
+  beforeEach(() => {
+    execFileMock.mockReset()
+  })
+
+  afterEach(() => {
+    _resetGitAdmissionForTests()
+  })
+
+  it('sets WSL_UTF8 so wsl.exe explains itself in UTF-8', () => {
+    expect(nonInteractiveGitEnv({}, 'win32').WSL_UTF8).toBe('1')
+    expect(nonInteractiveGitEnv({}, 'darwin').WSL_UTF8).toBeUndefined()
+  })
+
+  it('reports a dead distro instead of an empty git error', async () => {
+    execFileMock.mockImplementation((_command, _args, _options, callback) => {
+      const child = new EventEmitter() as EventEmitter & { pid: number; kill: () => void }
+      child.pid = 4321
+      child.kill = () => {}
+      queueMicrotask(() =>
+        callback?.(
+          hostFailure(asUtf16Mojibake(WSL_DIAGNOSTIC)),
+          asUtf16Mojibake(WSL_DIAGNOSTIC),
+          ''
+        )
+      )
+      return child
+    })
+
+    const failure = await withPlatform('win32', () =>
+      gitExecFileAsync(['worktree', 'list', '--porcelain', '-z'], {
+        cwd: '\\\\wsl.localhost\\kali-linux\\home\\paulius\\bugbounty'
+      }).then(
+        () => null,
+        (error: unknown) => error as Error
+      )
+    )
+
+    expect(failure?.message).toContain('Wsl/Service/WSL_E_DISTRO_NOT_FOUND')
+    expect(execFileMock.mock.calls.at(-1)?.[2]?.env?.WSL_UTF8).toBe('1')
+  })
+})
diff --git a/src/main/git/command-runner/wsl-host-failure.ts b/src/main/git/command-runner/wsl-host-failure.ts
new file mode 100644
index 00000000000..74f98509d0b
--- /dev/null
+++ b/src/main/git/command-runner/wsl-host-failure.ts
@@ -0,0 +1,55 @@
+import type { ResolvedCommand } from './wsl-command-resolution'
+
+/** wsl.exe's own launch-failure exit, distinct from any status the guest process can return. */
+export const WSL_HOST_FAILURE_EXIT_CODE = 0xffffffff
+
+function outputText(value: unknown): string {
+  if (typeof value === 'string') {
+    return value
+  }
+  return Buffer.isBuffer(value) ? value.toString('utf8') : ''
+}
+
+/**
+ * The message wsl.exe prints when it — not the guest — failed: a distro that was renamed or
+ * removed, or a VM that would not start.
+ *
+ * Why this needs decoding at all: wsl.exe exits 0xFFFFFFFF, leaves stderr EMPTY, and writes
+ * `Error code: Wsl/Service/WSL_E_*` to stdout, so every caller that reports stderr reports nothing.
+ * NULs are stripped because a wsl.exe that ignores WSL_UTF8 writes that line as UTF-16LE (#9010).
+ */
+export function readWslHostFailureDiagnostic(
+  error: unknown,
+  command: ResolvedCommand
+): string | null {
+  if (!command.wsl || !error || typeof error !== 'object') {
+    return null
+  }
+  const { code, status, stdout, stderr } = error as {
+    code?: unknown
+    status?: unknown
+    stdout?: unknown
+    stderr?: unknown
+  }
+  const exitCode = typeof code === 'number' ? code : typeof status === 'number' ? status : null
+  // A guest failure always explains itself on stderr; an empty one plus this exit is the host.
+  if (exitCode !== WSL_HOST_FAILURE_EXIT_CODE || outputText(stderr).trim().length > 0) {
+    return null
+  }
+  const diagnostic = outputText(stdout).replaceAll('\u0000', '').trim()
+  return diagnostic.length > 0 ? diagnostic : 'wsl.exe reported no diagnostic.'
+}
+
+/**
+ * Move a wsl.exe host failure into the error's message, which is what `git.exec` spans record ahead
+ * of the stack. Left untouched when the failure came from git itself.
+ */
+export function annotateWslHostFailure(error: unknown, command: ResolvedCommand): unknown {
+  const diagnostic = readWslHostFailureDiagnostic(error, command)
+  if (diagnostic === null || !(error instanceof Error) || !command.wsl) {
+    return error
+  }
+  const distro = command.wsl.distro
+  error.message = `wsl.exe host failure (distro "${distro}"): ${diagnostic}\n${error.message}`
+  return Object.assign(error, { wslHostFailure: true, wslDistro: distro })
+}
diff --git a/src/main/git/worktree-listing.ts b/src/main/git/worktree-listing.ts
index a60819181d4..f027bac4bc1 100644
--- a/src/main/git/worktree-listing.ts
+++ b/src/main/git/worktree-listing.ts
@@ -35,17 +35,7 @@ export async function listWorktreeGraph(
       ? worktrees
       : worktrees.filter((worktree) => !isWorktreeCreatePreparation(worktree))
   } catch (err) {
-    if (getErrorCode(err) === 'ENOENT') {
-      try {
-        await stat(repoPath)
-      } catch (statErr) {
-        if (getErrorCode(statErr) === 'ENOENT') {
-          console.warn(`[git/worktree] repo path missing; skipping worktree list: ${repoPath}`)
-          return []
-        }
-      }
-    }
-    if (isNotGitRepositoryError(err)) {
+    if (await isTrueEmptyWorktreeListing(repoPath, err)) {
       return []
     }
     console.warn(`[git/worktree] listWorktreeGraph failed for ${repoPath}:`, err)
@@ -64,17 +54,7 @@ export async function listWorktreesUnshared(
       : worktrees.filter((worktree) => !isWorktreeCreatePreparation(worktree))
     return annotateSparseCheckoutStatus(repoPath, visibleWorktrees, options)
   } catch (err) {
-    if (getErrorCode(err) === 'ENOENT') {
-      try {
-        await stat(repoPath)
-      } catch (statErr) {
-        if (getErrorCode(statErr) === 'ENOENT') {
-          console.warn(`[git/worktree] repo path missing; skipping worktree list: ${repoPath}`)
-          return []
-        }
-      }
-    }
-    if (isNotGitRepositoryError(err)) {
+    if (await isTrueEmptyWorktreeListing(repoPath, err)) {
       return []
     }
     // Why: don't swallow git-compat/repo-state failures — else they resurface as opaque "created but not found in listing" errors.
@@ -83,6 +63,24 @@ export async function listWorktreesUnshared(
   }
 }
 
+/**
+ * The two failures where an empty listing is the repo's true answer, not a broken scan: the repo
+ * path is gone, or it is not a Git repo. Every other failure means the scan could not read Git.
+ */
+async function isTrueEmptyWorktreeListing(repoPath: string, err: unknown): Promise<boolean> {
+  if (getErrorCode(err) === 'ENOENT') {
+    try {
+      await stat(repoPath)
+    } catch (statErr) {
+      if (getErrorCode(statErr) === 'ENOENT') {
+        console.warn(`[git/worktree] repo path missing; skipping worktree list: ${repoPath}`)
+        return true
+      }
+    }
+  }
+  return isNotGitRepositoryError(err)
+}
+
 export async function listWorktreesStrict(
   repoPath: string,
   options: GitWorktreeExecOptions = {}
@@ -97,6 +95,28 @@ export async function listWorktreesStrict(
   return annotateSparseCheckoutStatus(repoPath, visibleWorktrees, options)
 }
 
+/**
+ * Strict except for the two true empties above.
+ *
+ * Why: a Git or host failure (dead WSL distro, hung mount) softened to `[]` reaches the detected
+ * listing as an *authoritative* empty scan, which then permanently prunes the repo's worktrees and
+ * the agent tabs attached to them. Rejecting keeps that listing non-authoritative, while a deleted
+ * repo still reports empty so real removals prune.
+ */
+export async function listWorktreesStrictAllowingTrueEmpty(
+  repoPath: string,
+  options: GitWorktreeExecOptions = {}
+): Promise<GitWorktreeInfo[]> {
+  try {
+    return await listWorktreesStrict(repoPath, options)
+  } catch (err) {
+    if (await isTrueEmptyWorktreeListing(repoPath, err)) {
+      return []
+    }
+    throw err
+  }
+}
+
 export async function annotateSparseCheckoutStatus(
   repoPath: string,
   worktrees: GitWorktreeInfo[],
diff --git a/src/main/git/worktree-scan-cache.ts b/src/main/git/worktree-scan-cache.ts
index 59a7691fe7f..a35f0a4f275 100644
--- a/src/main/git/worktree-scan-cache.ts
+++ b/src/main/git/worktree-scan-cache.ts
@@ -2,7 +2,8 @@ import type { GitWorktreeInfo } from '../../shared/worktree/types'
 import {
   annotateSparseCheckoutStatus,
   listWorktreeGraph as listWorktreeGraphUnshared,
-  listWorktreesStrict as listWorktreesStrictUnshared
+  listWorktreesStrict as listWorktreesStrictUnshared,
+  listWorktreesStrictAllowingTrueEmpty as listWorktreesStrictAllowingTrueEmptyUnshared
 } from './worktree-listing'
 import type { GitWorktreeExecOptions } from './worktree-operation-options'
 import { WORKTREE_LIST_TIMEOUT_MS } from './worktree-operation-options'
@@ -10,7 +11,7 @@ import { WORKTREE_LIST_TIMEOUT_MS } from './worktree-operation-options'
 // Why: share concurrent `git worktree list` scans, which are expensive on Windows.
 const inFlightWorktreeScans = new Map<string, Promise<GitWorktreeInfo[]>>()
 
-type WorktreeScanKind = 'graph' | 'lenient' | 'strict'
+type WorktreeScanKind = 'graph' | 'lenient' | 'strict' | 'strict-true-empty'
 
 // Why: mutation generations prevent listings from joining stale scans.
 const worktreeScanGenerations = new Map<string, number>()
@@ -139,3 +140,20 @@ export function listWorktreesSharedStrict(
 ): Promise<GitWorktreeInfo[]> {
   return shareWorktreeScan(repoPath, options, 'strict', listWorktreesStrictUnshared)
 }
+
+/**
+ * The detected scan's discipline: reject a Git/host failure so it cannot publish as an
+ * authoritative empty listing, but still answer `[]` for a repo that is gone or not a repo.
+ * Its own kind because neither a strict nor a lenient joiner may inherit that middle contract.
+ */
+export function listWorktreesSharedStrictAllowingTrueEmpty(
+  repoPath: string,
+  options: GitWorktreeExecOptions = {}
+): Promise<GitWorktreeInfo[]> {
+  return shareWorktreeScan(
+    repoPath,
+    options,
+    'strict-true-empty',
+    listWorktreesStrictAllowingTrueEmptyUnshared
+  )
+}
diff --git a/src/main/git/worktree.ts b/src/main/git/worktree.ts
index 18e92e2873a..024485b6981 100644
--- a/src/main/git/worktree.ts
+++ b/src/main/git/worktree.ts
@@ -32,7 +32,8 @@ export {
   _resetWorktreeScanCacheForTests,
   listWorktreeGraph,
   listWorktrees,
-  listWorktreesSharedStrict
+  listWorktreesSharedStrict,
+  listWorktreesSharedStrictAllowingTrueEmpty
 } from './worktree-scan-cache'
 export { bumpWorktreeScanGeneration as notifyPreparedWorktreeMutation } from './worktree-scan-cache'
 export { addSparseWorktree } from './worktree-sparse-add'
diff --git a/src/main/ipc/worktrees-test-module-mocks.ts b/src/main/ipc/worktrees-test-module-mocks.ts
index f31f6ae1dd6..a1925d1ce72 100644
--- a/src/main/ipc/worktrees-test-module-mocks.ts
+++ b/src/main/ipc/worktrees-test-module-mocks.ts
@@ -115,6 +115,7 @@ export const gitWorktreeModuleMock = () => ({
   listWorktrees: listWorktreesMock,
   listWorktreesStrict: listWorktreesMock,
   listWorktreesSharedStrict: listWorktreesMock,
+  listWorktreesSharedStrictAllowingTrueEmpty: listWorktreesMock,
   describeCreatedWorktree: describeCreatedWorktreeMock,
   parseWorktreeList: parseWorktreeListMock,
   assertWorktreeCleanForRemoval: assertWorktreeCleanForRemovalMock,
diff --git a/src/main/ipc/worktrees-windows.test.ts b/src/main/ipc/worktrees-windows.test.ts
index 4d4115264a3..7a54200d9f8 100644
--- a/src/main/ipc/worktrees-windows.test.ts
+++ b/src/main/ipc/worktrees-windows.test.ts
@@ -74,6 +74,7 @@ vi.mock('../git/worktree', () => ({
   listWorktrees: listWorktreesMock,
   listWorktreesStrict: listWorktreesMock,
   listWorktreesSharedStrict: listWorktreesMock,
+  listWorktreesSharedStrictAllowingTrueEmpty: listWorktreesMock,
   describeCreatedWorktree: vi.fn().mockResolvedValue(undefined),
   assertWorktreeCleanForRemoval: assertWorktreeCleanForRemovalMock,
   addWorktree: addWorktreeMock,
diff --git a/src/main/ipc/worktrees/listing/detected-provider-listing.ts b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
index 388c825530f..ec5e7606e45 100644
--- a/src/main/ipc/worktrees/listing/detected-provider-listing.ts
+++ b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
@@ -25,7 +25,11 @@ import {
   type DetectedWorktreeMetadataPrune,
   type DetectedWorktreeSideEffectToken
 } from './detected-worktree-scan-cache'
-import { loggedWorktreeListFailures, warnOnce } from './worktree-listing-diagnostics'
+import {
+  describeWorktreeScanFailure,
+  loggedWorktreeListFailures,
+  warnOnce
+} from './worktree-listing-diagnostics'
 import { readAllWorktreeMetaForRepo } from '../../../persistence/host-qualified-worktree-meta'
 
 export async function listDetectedWorktreesForCapturedRepo(
@@ -157,16 +161,25 @@ export async function listDetectedWorktreesForCapturedRepo(
       `[worktrees] failed to list detected worktrees for repo "${repo.displayName}" (${repo.id}) at ${repo.path}`,
       err
     )
+    // Why: retention alone leaves inert rows with no explanation; the cause rides with the listing.
+    const unavailableReason = describeWorktreeScanFailure(err)
     if (repo.connectionId) {
       const worktrees = listDisconnectedSshWorktrees(store, repo, sshWorktreeMetaIndex())
       return {
         repoId: repo.id,
         authoritative: false,
         source: 'metadata-fallback',
-        worktrees: buildDisconnectedDetectedWorktrees(store, repo, worktrees)
+        worktrees: buildDisconnectedDetectedWorktrees(store, repo, worktrees),
+        unavailableReason
       }
     }
-    return { repoId: repo.id, authoritative: false, source: 'metadata-fallback', worktrees: [] }
+    return {
+      repoId: repo.id,
+      authoritative: false,
+      source: 'metadata-fallback',
+      worktrees: [],
+      unavailableReason
+    }
   }
 }
 
diff --git a/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts b/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
new file mode 100644
index 00000000000..4e436b8dcf1
--- /dev/null
+++ b/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
@@ -0,0 +1,166 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../../shared/repo-types'
+import type { DetectedWorktreeListResult } from '../../../../shared/worktree/types'
+
+const gitExecFileAsyncMock = vi.hoisted(() => vi.fn())
+
+vi.mock('electron', () => ({
+  ipcMain: { handle: vi.fn(), removeHandler: vi.fn() },
+  app: { getPath: () => '/tmp/orca-test' }
+}))
+vi.mock('../../../git/runner', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  gitExecFileAsync: gitExecFileAsyncMock
+}))
+
+const { listDetectedWorktreesForCapturedRepo } = await import('./detected-provider-listing')
+const { __resetDetectedWorktreeScanCacheForTests } = await import('./detected-worktree-scan-cache')
+const { _resetWorktreeScanCacheForTests } = await import('../../../git/worktree-scan-cache')
+const { isRegisteredWorktreePath, invalidateAuthorizedRootsCache } =
+  await import('../../registered-worktree-roots-cache')
+
+const REPO_PATH = '/workspace/repo'
+const repo = {
+  id: 'repo-1',
+  path: REPO_PATH,
+  displayName: 'repo',
+  badgeColor: '#000',
+  addedAt: 0
+} as Repo
+
+const removeWorktreeLineage = vi.fn()
+
+function createStore() {
+  return {
+    getRepo: () => repo,
+    getRepos: () => [repo],
+    getProjects: () => [],
+    getSettings: () => ({}),
+    getAllWorktreeMeta: () => ({}),
+    getProjectHostSetups: () => [],
+    getWorktreeMeta: () => undefined,
+    setWorktreeMeta: vi.fn(),
+    getAllWorktreeLineage: () => ({}),
+    getAllWorkspaceLineage: () => ({}),
+    removeWorktreeLineage,
+    captureNativeLocalWorktreeMetadataScanExpectation: () => undefined
+  } as never
+}
+
+/** The field failure: wsl.exe exits 0xFFFFFFFF, says nothing on stderr, and git never ran. */
+function wslHostFailure(): Error {
+  return Object.assign(new Error('Command failed: wsl.exe -d kali-linux --exec sh -lc ...'), {
+    code: 4294967295,
+    stdout: 'Error code: Wsl/Service/WSL_E_DISTRO_NOT_FOUND\r\n',
+    stderr: ''
+  })
+}
+
+async function listDetected(): Promise<DetectedWorktreeListResult> {
+  const result = await listDetectedWorktreesForCapturedRepo(createStore(), repo, () => true)
+  return result as DetectedWorktreeListResult
+}
+
+describe('detected worktree listing authority', () => {
+  beforeEach(() => {
+    gitExecFileAsyncMock.mockReset()
+    removeWorktreeLineage.mockReset()
+    __resetDetectedWorktreeScanCacheForTests()
+    _resetWorktreeScanCacheForTests()
+    invalidateAuthorizedRootsCache()
+  })
+
+  it('reports a failed scan as non-authoritative and prunes nothing', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(wslHostFailure())
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(false)
+    expect(result.source).toBe('metadata-fallback')
+    expect(result.worktrees).toEqual([])
+    // Why: the retained rows must carry the cause, or the user sees inert worktrees with no explanation.
+    expect(result.unavailableReason).toContain('Command failed: wsl.exe')
+    // The destructive halves of a fresh scan must not run against a listing that failed.
+    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+    expect(removeWorktreeLineage).not.toHaveBeenCalled()
+  })
+
+  it('surfaces the annotated wsl.exe diagnostic as the unavailable reason', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(
+      Object.assign(
+        new Error(
+          'wsl.exe host failure (distro "kali-linux"): There is no distribution with the supplied name.\r\nError code: Wsl/Service/WSL_E_DISTRO_NOT_FOUND\nCommand failed: wsl.exe -d kali-linux --exec sh -lc ...'
+        ),
+        { code: 4294967295, stdout: '', stderr: '' }
+      )
+    )
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(false)
+    expect(result.unavailableReason).toBe(
+      'wsl.exe host failure (distro "kali-linux"): There is no distribution with the supplied name. Error code: Wsl/Service/WSL_E_DISTRO_NOT_FOUND'
+    )
+  })
+
+  // Why (measured on a real Windows host): under WSL the spawn cwd is the interop directory, so a
+  // deleted guest repo fails as `bash: cd` exit 1 — not ENOENT — and must stay retained, not pruned.
+  it('retains a WSL repo whose guest directory is gone, and says why', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(
+      Object.assign(new Error('bash: line 1: cd: /home/neil/repo: No such file or directory'), {
+        code: 1,
+        stdout: '',
+        stderr: 'bash: line 1: cd: /home/neil/repo: No such file or directory\n'
+      })
+    )
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(false)
+    expect(result.unavailableReason).toContain('No such file or directory')
+    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+    expect(removeWorktreeLineage).not.toHaveBeenCalled()
+  })
+
+  it('keeps an empty listing authoritative when the path is not a Git repo', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(
+      Object.assign(new Error('Command failed: git worktree list'), {
+        code: 128,
+        stderr: 'fatal: not a git repository (or any of the parent directories): .git\n'
+      })
+    )
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(true)
+    expect(result.source).toBe('git')
+    expect(result.worktrees).toEqual([])
+    expect(result.unavailableReason).toBeUndefined()
+    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(true)
+  })
+
+  it('keeps an empty listing authoritative when the repo path is gone', async () => {
+    gitExecFileAsyncMock.mockRejectedValue(
+      Object.assign(new Error('spawn git ENOENT'), { code: 'ENOENT', stderr: '' })
+    )
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(true)
+    expect(result.source).toBe('git')
+    expect(result.worktrees).toEqual([])
+  })
+
+  it('stays authoritative for a healthy scan', async () => {
+    gitExecFileAsyncMock.mockResolvedValue({
+      stdout: `worktree ${REPO_PATH}\u0000HEAD abc\u0000branch refs/heads/main\u0000\u0000`,
+      stderr: ''
+    })
+
+    const result = await listDetected()
+
+    expect(result.authoritative).toBe(true)
+    expect(result.worktrees.map((worktree) => worktree.path)).toEqual([REPO_PATH])
+    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(true)
+  })
+})
diff --git a/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts b/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
index b694bfbf11d..09b0156cb54 100644
--- a/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
+++ b/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
@@ -3,7 +3,7 @@ import type { Store } from '../../../persistence/loading-store/store'
 import type { Repo } from '../../../../shared/repo-types'
 import { getLocalProjectWorktreeGitOptions } from '../../../project-runtime-git-options'
 import { isFolderRepo } from '../../../../shared/repo-kind'
-import { listRepoWorktrees } from '../../../repo-worktrees'
+import { listRepoWorktreesForDetectedScan } from '../../../repo-worktrees'
 import {
   getRegisteredWorktreeRootsRevision,
   registerWorktreeRootsForRepo
@@ -111,7 +111,7 @@ export async function listDetectedGitWorktrees(
   const localWorktreeGitOptions = getLocalProjectWorktreeGitOptions(store, repo)
   if (repo.connectionId || isFolderRepo(repo)) {
     return {
-      gitWorktrees: await listRepoWorktrees(repo, localWorktreeGitOptions),
+      gitWorktrees: await listRepoWorktreesForDetectedScan(repo, localWorktreeGitOptions),
       fresh: true
     }
   }
@@ -144,7 +144,7 @@ export async function listDetectedGitWorktrees(
       : undefined
   const scan: DetectedWorktreeScan = {
     invalidated: false,
-    promise: listRepoWorktrees(repo, localWorktreeGitOptions),
+    promise: listRepoWorktreesForDetectedScan(repo, localWorktreeGitOptions),
     sideEffectToken: { generation, authorizedRootsRevision },
     hygieneDue,
     ...(metadataPruneExpectation
diff --git a/src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts b/src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts
index cb8c48833ef..655cca4fa77 100644
--- a/src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts
+++ b/src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts
@@ -10,7 +10,9 @@ const { listRepoWorktreesMock, pruneLineageMock, pruneMetadataMock, registerWork
     registerWorktreeRootsMock: vi.fn()
   }))
 
-vi.mock('../../../repo-worktrees', () => ({ listRepoWorktrees: listRepoWorktreesMock }))
+vi.mock('../../../repo-worktrees', () => ({
+  listRepoWorktreesForDetectedScan: listRepoWorktreesMock
+}))
 vi.mock('../../../project-runtime-git-options', () => ({
   getLocalProjectWorktreeGitOptions: () => ({})
 }))
diff --git a/src/main/ipc/worktrees/listing/worktree-listing-diagnostics.ts b/src/main/ipc/worktrees/listing/worktree-listing-diagnostics.ts
index 128bb46dd28..56bbe5d4ad2 100644
--- a/src/main/ipc/worktrees/listing/worktree-listing-diagnostics.ts
+++ b/src/main/ipc/worktrees/listing/worktree-listing-diagnostics.ts
@@ -14,3 +14,23 @@ export function warnOnce(keySet: Set<string>, key: string, message: string, erro
     console.warn(message)
   }
 }
+
+const SCAN_FAILURE_REASON_MAX_CHARS = 240
+
+/**
+ * The cause a retained-but-unscannable repo shows the user. The first two lines carry the
+ * classifier's summary plus its `Wsl/Service/WSL_E_*` code; everything after is the raw command.
+ */
+export function describeWorktreeScanFailure(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error)
+  const summary = message
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0)
+    .slice(0, 2)
+    .join(' ')
+  const reason = summary.length > 0 ? summary : 'Worktree scan failed with no diagnostic.'
+  return reason.length > SCAN_FAILURE_REASON_MAX_CHARS
+    ? `${reason.slice(0, SCAN_FAILURE_REASON_MAX_CHARS - 1)}…`
+    : reason
+}
diff --git a/src/main/repo-worktrees.ts b/src/main/repo-worktrees.ts
index 228f303bfa2..f5d67523286 100644
--- a/src/main/repo-worktrees.ts
+++ b/src/main/repo-worktrees.ts
@@ -1,6 +1,11 @@
 import type { Repo } from '../shared/repo-types'
 import type { GitWorktreeInfo } from '../shared/worktree/types'
-import { listWorktreeGraph, listWorktrees, listWorktreesStrict } from './git/worktree'
+import {
+  listWorktreeGraph,
+  listWorktrees,
+  listWorktreesSharedStrictAllowingTrueEmpty,
+  listWorktreesStrict
+} from './git/worktree'
 import { isFolderRepo } from '../shared/repo-kind'
 import { getRepoExecutionHostId, LOCAL_EXECUTION_HOST_ID } from '../shared/execution-host'
 import { resolveGitRouteForHost } from './providers/execution-host-provider-dispatch'
@@ -42,6 +47,29 @@ export function createFolderWorktree(repo: Repo): GitWorktreeInfo {
 export async function listRepoWorktrees(
   repo: Repo,
   options?: LocalRepoWorktreeListOptions
+): Promise<GitWorktreeInfo[]> {
+  return listRoutedRepoWorktrees(repo, options, listWorktrees)
+}
+
+/**
+ * The detected scan's listing: a Git or host failure rejects instead of softening to `[]`, so a
+ * failed scan cannot be published as an authoritative empty listing and prune the repo's worktrees
+ * (#1158's retention guard only fires when the listing admits it failed).
+ */
+export async function listRepoWorktreesForDetectedScan(
+  repo: Repo,
+  options?: LocalRepoWorktreeListOptions
+): Promise<GitWorktreeInfo[]> {
+  return listRoutedRepoWorktrees(repo, options, listWorktreesSharedStrictAllowingTrueEmpty)
+}
+
+async function listRoutedRepoWorktrees(
+  repo: Repo,
+  options: LocalRepoWorktreeListOptions | undefined,
+  listLocal: (
+    repoPath: string,
+    options?: LocalRepoWorktreeListOptions
+  ) => Promise<GitWorktreeInfo[]>
 ): Promise<GitWorktreeInfo[]> {
   if (isFolderRepo(repo)) {
     return [createFolderWorktree(repo)]
@@ -66,8 +94,8 @@ export async function listRepoWorktrees(
     return await route.provider.listWorktrees(repo.path)
   }
   return hasLocalRepoWorktreeListOptions(options)
-    ? await listWorktrees(repo.path, options)
-    : await listWorktrees(repo.path)
+    ? await listLocal(repo.path, options)
+    : await listLocal(repo.path)
 }
 
 /**
diff --git a/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx b/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx
new file mode 100644
index 00000000000..5ce0c7a950b
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx
@@ -0,0 +1,102 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { useAppStore } from '@/store'
+import type { Repo } from '../../../../../../shared/repo-types'
+import { makeDetectedResult } from '@/store/slices/worktrees-detected-listing-fixtures'
+import { RepoScanUnavailableIndicator } from './RepoScanUnavailableIndicator'
+
+const repo = {
+  id: 'repo-1',
+  path: 'C:\\repo',
+  displayName: 'repo',
+  badgeColor: '#000',
+  addedAt: 0
+} as Repo
+
+const initialState = useAppStore.getInitialState()
+const roots: Root[] = []
+
+async function render(): Promise<HTMLDivElement> {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const root = createRoot(container)
+  roots.push(root)
+  await act(async () => {
+    root.render(
+      <TooltipProvider>
+        <RepoScanUnavailableIndicator repo={repo} />
+      </TooltipProvider>
+    )
+  })
+  return container
+}
+
+describe('RepoScanUnavailableIndicator', () => {
+  beforeEach(() => {
+    globalThis.IS_REACT_ACT_ENVIRONMENT = true
+    useAppStore.setState(initialState, true)
+  })
+
+  afterEach(async () => {
+    for (const root of roots.splice(0)) {
+      await act(async () => root.unmount())
+    }
+    document.body.innerHTML = ''
+    useAppStore.setState(initialState, true)
+  })
+
+  it('renders nothing for an authoritative listing', async () => {
+    useAppStore.setState({
+      detectedWorktreesByRepo: { [repo.id]: makeDetectedResult(repo.id, []) }
+    })
+
+    const container = await render()
+
+    expect(container.querySelector('button')).toBeNull()
+  })
+
+  // Why: a non-authoritative listing without a reason is the disconnected-SSH shape, which the
+  // host header already explains; this marker is only for a scan that failed with a cause.
+  it('renders nothing for a non-authoritative listing that carries no reason', async () => {
+    useAppStore.setState({
+      detectedWorktreesByRepo: {
+        [repo.id]: makeDetectedResult(repo.id, [], {
+          authoritative: false,
+          source: 'metadata-fallback'
+        })
+      }
+    })
+
+    const container = await render()
+
+    expect(container.querySelector('button')).toBeNull()
+  })
+
+  it('marks a failed scan and re-runs it on click', async () => {
+    const fetchWorktrees = vi.fn(async () => true)
+    useAppStore.setState({
+      fetchWorktrees: fetchWorktrees as never,
+      detectedWorktreesByRepo: {
+        [repo.id]: makeDetectedResult(repo.id, [], {
+          authoritative: false,
+          source: 'metadata-fallback',
+          unavailableReason: 'wsl.exe host failure (distro "kali-linux"): WSL_E_DISTRO_NOT_FOUND'
+        })
+      }
+    })
+
+    const container = await render()
+    const button = container.querySelector('button')
+
+    expect(button?.getAttribute('aria-label')).toContain('Worktree scan failed for repo')
+    expect(button?.className).toContain('text-destructive')
+    await act(async () => {
+      button?.click()
+    })
+    expect(fetchWorktrees).toHaveBeenCalledWith(repo.id, { executionHostId: 'local' })
+  })
+})
diff --git a/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.tsx b/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.tsx
new file mode 100644
index 00000000000..a956598140e
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.tsx
@@ -0,0 +1,75 @@
+import React from 'react'
+import { TriangleAlert } from 'lucide-react'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { cn } from '@/lib/utils'
+import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
+import type { Repo } from '../../../../../../shared/repo-types'
+import { getRepoExecutionHostId } from '../../../../../../shared/execution-host'
+import {
+  handleRepoHeaderActionPointerDown,
+  stopRepoHeaderKeyboardToggle
+} from './header-event-guards'
+
+/**
+ * Marks a repo whose worktree scan failed, so its rows are retained but cannot be trusted.
+ * Click re-runs the scan: the failure is otherwise re-tried only by the next incidental refresh.
+ */
+export function RepoScanUnavailableIndicator({ repo }: { repo: Repo }): React.JSX.Element | null {
+  const detected = useAppStore((s) => s.detectedWorktreesByRepo[repo.id])
+  const fetchWorktrees = useAppStore((s) => s.fetchWorktrees)
+  const [pending, setPending] = React.useState(false)
+  if (!detected || detected.authoritative || !detected.unavailableReason) {
+    return null
+  }
+  const title = translate(
+    'auto.components.sidebar.RepoScanUnavailableIndicator.title',
+    'Worktree scan failed for {{value0}}',
+    { value0: repo.displayName }
+  )
+  const retryLabel = translate(
+    'auto.components.sidebar.RepoScanUnavailableIndicator.retry',
+    'Retry scan'
+  )
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <button
+          type="button"
+          data-repo-header-action=""
+          className={cn(
+            'inline-flex size-4 shrink-0 items-center justify-center rounded-[4px] text-destructive',
+            pending && 'opacity-60'
+          )}
+          aria-label={`${title}. ${retryLabel}`}
+          aria-busy={pending}
+          disabled={pending}
+          onKeyDown={stopRepoHeaderKeyboardToggle}
+          onPointerDown={handleRepoHeaderActionPointerDown}
+          onClick={(event) => {
+            event.preventDefault()
+            event.stopPropagation()
+            setPending(true)
+            void fetchWorktrees(repo.id, {
+              executionHostId: getRepoExecutionHostId(repo)
+            }).finally(() => setPending(false))
+          }}
+        >
+          <TriangleAlert className="size-3.5" aria-hidden="true" />
+        </button>
+      </TooltipTrigger>
+      <TooltipContent side="bottom" sideOffset={6} className="max-w-72">
+        <div className="space-y-1">
+          <div className="font-medium">{title}</div>
+          <div className="break-words text-muted-foreground">{detected.unavailableReason}</div>
+          <div className="text-muted-foreground">
+            {translate(
+              'auto.components.sidebar.RepoScanUnavailableIndicator.retained',
+              'Existing worktrees are kept until a scan succeeds. Click to retry.'
+            )}
+          </div>
+        </div>
+      </TooltipContent>
+    </Tooltip>
+  )
+}
diff --git a/src/renderer/src/components/sidebar/worktree-list/rows/SectionHeader.tsx b/src/renderer/src/components/sidebar/worktree-list/rows/SectionHeader.tsx
index b4ed149712a..db0c7ec1371 100644
--- a/src/renderer/src/components/sidebar/worktree-list/rows/SectionHeader.tsx
+++ b/src/renderer/src/components/sidebar/worktree-list/rows/SectionHeader.tsx
@@ -26,6 +26,7 @@ import {
   WORKTREE_SECTION_HEADER_PADDING_LEFT
 } from './indentation'
 import { FolderPathStatusIndicator } from './FolderPathStatusIndicator'
+import { RepoScanUnavailableIndicator } from './RepoScanUnavailableIndicator'
 import {
   ProjectGroupCreateWorkspaceButton,
   ProjectGroupHeaderMenu
@@ -334,6 +335,7 @@ export function renderWorktreeSectionHeaderRow(args: {
               </div>
               <RepoForkIndicator upstream={row.repo?.upstream} />
               <FolderPathStatusIndicator status={projectGroupPathStatus} />
+              {isRepoHeader ? <RepoScanUnavailableIndicator repo={row.repo!} /> : null}
             </div>
           </div>
         </div>
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index e8bc924f64e..3c468d20929 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -6231,6 +6231,11 @@
           "projectOnly": "Added in this project only.",
           "useGlobalFor": "Use global for {{value0}}",
           "useGlobal": "Use global"
+        },
+        "RepoScanUnavailableIndicator": {
+          "title": "Worktree scan failed for {{value0}}",
+          "retry": "Retry scan",
+          "retained": "Existing worktrees are kept until a scan succeeds. Click to retry."
         }
       },
       "shared": {
diff --git a/src/renderer/src/store/slices/worktrees/listing/detected-worktree-host-merge.ts b/src/renderer/src/store/slices/worktrees/listing/detected-worktree-host-merge.ts
index 073bd712f32..f8078a9925c 100644
--- a/src/renderer/src/store/slices/worktrees/listing/detected-worktree-host-merge.ts
+++ b/src/renderer/src/store/slices/worktrees/listing/detected-worktree-host-merge.ts
@@ -22,6 +22,7 @@ export function mergeDetectedWorktreesForHost(
     current.repoId === refreshed.repoId &&
     current.authoritative === refreshed.authoritative &&
     current.source === refreshed.source &&
+    current.unavailableReason === refreshed.unavailableReason &&
     current.worktrees === worktrees
   ) {
     return current
diff --git a/src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts b/src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts
new file mode 100644
index 00000000000..da44f24c0d3
--- /dev/null
+++ b/src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest'
+import { makeDetectedResult } from '../../worktrees-detected-listing-fixtures'
+import { mergeDetectedWorktreesForHost } from './detected-worktree-host-merge'
+import { areDetectedWorktreeResultsEqual } from './worktree-catalog-visibility'
+
+const failed = (unavailableReason?: string) =>
+  makeDetectedResult('repo-1', [], {
+    authoritative: false,
+    source: 'metadata-fallback',
+    ...(unavailableReason ? { unavailableReason } : {})
+  })
+
+// Why: two failed scans differ only by cause; dropping that from equality would freeze the first
+// reason on the header until the listing's rows or authority changed.
+describe('detected listing unavailable reason', () => {
+  it('is part of listing equality', () => {
+    expect(areDetectedWorktreeResultsEqual(failed('distro gone'), failed('distro gone'))).toBe(true)
+    expect(areDetectedWorktreeResultsEqual(failed('distro gone'), failed('mount hung'))).toBe(false)
+    expect(areDetectedWorktreeResultsEqual(failed('distro gone'), failed())).toBe(false)
+  })
+
+  it('survives the host merge when only the reason changed', () => {
+    const merged = mergeDetectedWorktreesForHost(
+      failed('distro gone'),
+      failed('mount hung'),
+      'local'
+    )
+
+    expect(merged.unavailableReason).toBe('mount hung')
+  })
+})
diff --git a/src/renderer/src/store/slices/worktrees/listing/worktree-catalog-visibility.ts b/src/renderer/src/store/slices/worktrees/listing/worktree-catalog-visibility.ts
index ce7a13c4b25..c6d3a9636f7 100644
--- a/src/renderer/src/store/slices/worktrees/listing/worktree-catalog-visibility.ts
+++ b/src/renderer/src/store/slices/worktrees/listing/worktree-catalog-visibility.ts
@@ -14,6 +14,7 @@ export function areDetectedWorktreeResultsEqual(
     current.repoId === next.repoId &&
     current.authoritative === next.authoritative &&
     current.source === next.source &&
+    current.unavailableReason === next.unavailableReason &&
     catalogRowsEqual(current.worktrees, next.worktrees)
   )
 }
diff --git a/src/shared/worktree/types.ts b/src/shared/worktree/types.ts
index 3e5c05a65bc..e368716dc01 100644
--- a/src/shared/worktree/types.ts
+++ b/src/shared/worktree/types.ts
@@ -221,4 +221,6 @@ export type DetectedWorktreeListResult = {
   authoritative: boolean
   source: DetectedWorktreeListSource
   worktrees: DetectedWorktree[]
+  /** Why a non-authoritative listing could not be scanned; additive, older hosts omit it. */
+  unavailableReason?: string
 }

From c16913ab659ca3482fc77dda0698240f7c3fb22e Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:29:36 -0700
Subject: [PATCH 58/58] fix(native-chat): clarify active progress (#18705)

Co-authored-by: Merge Sim <sim@local>
---
 .../NativeChatMessageList.test.tsx            |  8 ++---
 .../native-chat/NativeChatToolRun.test.tsx    |  4 ++-
 .../native-chat/NativeChatToolRun.tsx         |  2 +-
 .../native-chat/NativeChatWorkingStatus.tsx   | 23 ++++++++++---
 ...-chat-working-status-shared-clock.test.tsx | 34 ++++++++++++++-----
 src/renderer/src/i18n/locales/en.json         |  4 +--
 6 files changed, 54 insertions(+), 21 deletions(-)

diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx
index 9695317f3af..860464ac65b 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx
@@ -215,7 +215,7 @@ describe('NativeChatMessageList assistant messages', () => {
     )
 
     const user = screen.getByText('Run the checks')
-    const status = screen.getByText('Working for 0 seconds')
+    const status = screen.getByText('Working for 0s')
     const assistant = screen.getByText('I am checking now.')
     expect(user.compareDocumentPosition(status)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
     expect(status.compareDocumentPosition(assistant)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
@@ -252,7 +252,7 @@ describe('NativeChatMessageList assistant messages', () => {
       />
     )
 
-    expect(screen.getByText('Working for 3 seconds')).toBeInTheDocument()
+    expect(screen.getByText('Working for 3s')).toBeInTheDocument()
   })
 
   it('keeps the completed duration below the user message', () => {
@@ -298,7 +298,7 @@ describe('NativeChatMessageList assistant messages', () => {
     )
 
     const user = screen.getByText('Complete this task')
-    const status = screen.getByText('Worked for 3 seconds')
+    const status = screen.getByText('Worked for 3s')
     const assistant = screen.getByText('Task complete.')
     expect(user.compareDocumentPosition(status)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
     expect(status.compareDocumentPosition(assistant)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
@@ -326,7 +326,7 @@ describe('NativeChatMessageList assistant messages', () => {
       />
     )
 
-    expect(screen.getByText('Worked for 3 seconds')).toBeInTheDocument()
+    expect(screen.getByText('Worked for 3s')).toBeInTheDocument()
     expect(screen.getByText('Thinking')).toBeInTheDocument()
   })
 
diff --git a/src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx b/src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx
index 41a70a8457d..965ed0ad176 100644
--- a/src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx
@@ -99,7 +99,9 @@ describe('NativeChatToolRun', () => {
 
     const { container } = render(<NativeChatToolRun blocks={blocks} expandSignal={false} />)
 
-    expect(screen.getByText('Running cat package.json')).toBeInTheDocument()
+    const activeLabel = screen.getByText('Running cat package.json')
+    expect(activeLabel).toBeInTheDocument()
+    expect(activeLabel).toHaveClass('animate-pulse', 'motion-reduce:animate-none')
     expect(screen.queryByText('Running date')).toBeNull()
     expect(screen.queryByText('Running pwd')).toBeNull()
     expect(screen.queryByText('Ran 3 commands and used 1 tool')).toBeNull()
diff --git a/src/renderer/src/components/native-chat/NativeChatToolRun.tsx b/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
index 716d293838e..f16d01331f8 100644
--- a/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
@@ -227,7 +227,7 @@ export function NativeChatToolRun({
           <span className="flex size-6 shrink-0 items-center justify-center text-muted-foreground">
             <ActiveToolIcon className="size-4" />
           </span>
-          <span className="min-w-0 flex-1 truncate text-foreground/85">
+          <span className="min-w-0 flex-1 animate-pulse truncate text-foreground/85 motion-reduce:animate-none">
             {activeToolLabel(latestActiveCall)}
           </span>
           {open ? <ChevronRight className="size-3.5 rotate-90 text-muted-foreground" /> : null}
diff --git a/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx b/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
index a883429f658..21145e94c94 100644
--- a/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
@@ -3,6 +3,21 @@ import { ChevronRight } from 'lucide-react'
 import { translate } from '@/i18n/i18n'
 import { useNow } from '@/hooks/use-now'
 
+/** Format turn time without exposing an ever-growing raw seconds count. */
+export function formatNativeChatDuration(seconds: number): string {
+  const totalSeconds = Number.isFinite(seconds) ? Math.max(0, Math.floor(seconds)) : 0
+  if (totalSeconds < 60) {
+    return `${totalSeconds}s`
+  }
+  const minutes = Math.floor(totalSeconds / 60)
+  const remainingSeconds = totalSeconds % 60
+  if (minutes < 60) {
+    return `${minutes}m ${remainingSeconds}s`
+  }
+  const hours = Math.floor(minutes / 60)
+  return `${hours}h ${minutes % 60}m ${remainingSeconds}s`
+}
+
 export function NativeChatWorkingStatus({
   startedAt,
   thinking,
@@ -30,13 +45,13 @@ export function NativeChatWorkingStatus({
 
   const label =
     workedSeconds != null
-      ? translate('components.native-chat.status.workedFor', 'Worked for {{value0}} seconds', {
-          value0: workedSeconds
+      ? translate('components.native-chat.status.workedFor', 'Worked for {{value0}}', {
+          value0: formatNativeChatDuration(workedSeconds)
         })
       : thinking
         ? translate('components.native-chat.status.thinking', 'Thinking')
-        : translate('components.native-chat.status.workingFor', 'Working for {{value0}} seconds', {
-            value0: elapsedSeconds
+        : translate('components.native-chat.status.workingFor', 'Working for {{value0}}', {
+            value0: formatNativeChatDuration(elapsedSeconds)
           })
 
   const className = `flex min-h-8 items-center gap-1 text-sm text-muted-foreground${thinking ? '' : ' border-b border-border'}`
diff --git a/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx b/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
index dfea16ae0e4..e4bae292004 100644
--- a/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
+++ b/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
@@ -3,7 +3,7 @@
 import { act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { NativeChatWorkingStatus } from './NativeChatWorkingStatus'
+import { formatNativeChatDuration, NativeChatWorkingStatus } from './NativeChatWorkingStatus'
 
 let container: HTMLDivElement
 let root: Root
@@ -49,34 +49,50 @@ afterEach(() => {
 })
 
 describe('native chat working status elapsed clock', () => {
+  it.each([
+    [0, '0s'],
+    [59, '59s'],
+    [60, '1m 0s'],
+    [69, '1m 9s'],
+    [3_725, '1h 2m 5s']
+  ])('formats %s seconds as %s', (seconds, expected) => {
+    expect(formatNativeChatDuration(seconds)).toBe(expected)
+  })
+
+  it('renders the compact duration in the completed status label', () => {
+    act(() => {
+      root.render(
+        <NativeChatWorkingStatus startedAt={1_000_000} thinking={false} workedSeconds={69} />
+      )
+    })
+
+    expect(elapsedLabels()).toEqual(['Worked for 1m 9s'])
+  })
+
   it('collapses every in-flight turn onto one shared visibility-gated timer', () => {
     renderTurns(3, 1_000_000)
 
     // One shared 1s clock for all three turns, not one interval per turn.
     expect(vi.getTimerCount()).toBe(1)
     act(() => vi.advanceTimersByTime(3_000))
-    expect(elapsedLabels()).toEqual([
-      'Working for 3 seconds',
-      'Working for 3 seconds',
-      'Working for 3 seconds'
-    ])
+    expect(elapsedLabels()).toEqual(['Working for 3s', 'Working for 3s', 'Working for 3s'])
   })
 
   it('stops ticking while hidden and re-syncs the elapsed value on return', () => {
     renderTurns(1, 1_000_000)
     act(() => vi.advanceTimersByTime(3_000))
-    expect(elapsedLabels()).toEqual(['Working for 3 seconds'])
+    expect(elapsedLabels()).toEqual(['Working for 3s'])
 
     setDocumentVisibility('hidden')
     expect(vi.getTimerCount()).toBe(0)
 
     // A minute of hidden wall-clock: no callbacks, no commits, label frozen.
     act(() => vi.advanceTimersByTime(60_000))
-    expect(elapsedLabels()).toEqual(['Working for 3 seconds'])
+    expect(elapsedLabels()).toEqual(['Working for 3s'])
 
     // Returning re-derives elapsed from startedAt, so nothing was lost.
     setDocumentVisibility('visible')
-    expect(elapsedLabels()).toEqual(['Working for 63 seconds'])
+    expect(elapsedLabels()).toEqual(['Working for 1m 3s'])
     expect(vi.getTimerCount()).toBe(1)
   })
 
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index 3c468d20929..8a6e54d2d11 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -16957,8 +16957,8 @@
         "responding": "Agent is responding",
         "working": "Working…",
         "thinking": "Thinking",
-        "workingFor": "Working for {{value0}} seconds",
-        "workedFor": "Worked for {{value0}} seconds",
+        "workingFor": "Working for {{value0}}",
+        "workedFor": "Worked for {{value0}}",
         "toggleDetails": "Toggle turn details"
       },
       "jumpToLatest": "Jump to latest",