From 45c84c500f7e8eaff3697716a0faea0a8a29ec21 Mon Sep 17 00:00:00 2001
From: Dmitry Ng <19asdek91@gmail.com>
Date: Wed, 29 Jul 2026 16:34:29 +0400
Subject: [PATCH] test(frontend): make the e2e suite falsifiable, and fix what
 it found (#380)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The e2e suite and CI gates could report green without checking anything: the
lint/codegen gate never ran on fork PRs, the codegen freshness check diffed the
wrong range, the sticky comment claimed passes it never read, and several
visual/palette/contrast/a11y gates were written so they could not fail. Closing
those gates then exposed real defects.

**E2E and CI.** New coverage for the assistant lifecycle, flow interrupt, live
panels, tab deep links, the report route and its exports, session expiry, and
uploads/downloads (59 → 125 spec cases). Gates now fail on real regressions:
absolute pixel budget, per-tab panel sweeps, scoped a11y waivers, page-error
assertions. CI runs on `pull_request`, ranges from the PR base, routes comments
by PR identity, and redacts stand secrets from the public artifact.

**Markdown editor.** ~20 round-trip and toolbar fixes: table pipe escaping
(nested lists, Go template pipelines, headerless tables), fence validity,
setext and line-leading escapes, inline code containing a backtick, block
toggles under select-all, controls disabled where the command is unavailable or
a table cell cannot hold the block, theme-aware code surface. Two perf fixes cut
1 MB document load from 69s to 4s.

**Accessibility and UI.** Focus returns to whatever opened a dialog, sheet or
menu; icon-only buttons named; `aria-sort` on table columns; syntax tokens
retuned to clear AA in both themes; a dedicated link token. Detail and settings
pages now distinguish authz denials and partial errors from missing records,
survive background refetches without blanking or discarding unsaved edits, and
stop naming exported PDFs `*.pdf.pdf`.

**Backend.** Passwords capped at the 72 bytes bcrypt can hash (over-long ones
previously 500'd after passing validation); four agent options the GraphQL round
trip silently dropped are carried through; a flow whose worker fails to start is
no longer left in the listing; the Graphiti health check retries before
permanently disabling the client.

---------

Co-authored-by: Sergey Kozyrenko <sirozha_blr@tut.by>
---
 .dockerignore                                 |   7 +
 .github/scripts/codegen-inputs-changed.sh     |  57 ++
 .github/workflows/ci.yml                      |  51 +-
 .github/workflows/e2e-report.yml              |  56 +-
 .github/workflows/e2e-stand.yml               |  57 +-
 .github/workflows/e2e.yml                     |  31 +-
 CLAUDE.md                                     |   2 +-
 README.md                                     |   6 +-
 backend/pkg/config/config.go                  |   7 -
 backend/pkg/controller/aslog.go               |   2 +-
 backend/pkg/controller/assistant.go           |   2 +-
 backend/pkg/controller/flow.go                |  25 +-
 backend/pkg/csum/chain_summary.go             |  10 -
 backend/pkg/database/converter/analytics.go   |   1 -
 backend/pkg/database/converter/converter.go   |  32 +-
 .../pkg/database/converter/converter_test.go  |  75 ++
 backend/pkg/database/database.go              |   4 +-
 backend/pkg/graph/generated.go                | 338 +++++++-
 backend/pkg/graph/model/models_gen.go         |   4 +
 backend/pkg/graph/schema.graphqls             |   8 +
 backend/pkg/graph/schema.resolvers.go         |  10 -
 backend/pkg/graphiti/client.go                |  21 +-
 backend/pkg/graphiti/client_test.go           |  42 +
 backend/pkg/providers/custom/custom.go        |   2 -
 backend/pkg/providers/gemini/gemini_test.go   |   4 -
 backend/pkg/providers/pconfig/config.go       |   3 -
 backend/pkg/providers/performer.go            |   1 -
 backend/pkg/providers/performers.go           |   1 -
 backend/pkg/providers/provider.go             |   1 -
 backend/pkg/providers/provider/agents.go      |   7 -
 backend/pkg/providers/subtask_patch.go        |   1 -
 backend/pkg/server/auth/api_token_cache.go    |  10 -
 backend/pkg/server/auth/auth_middleware.go    |   1 -
 backend/pkg/server/auth/session.go            |   2 -
 backend/pkg/server/auth/users_cache.go        |   6 -
 backend/pkg/server/models/init.go             |  17 +
 backend/pkg/server/models/users.go            |   4 +-
 backend/pkg/server/models/users_test.go       |  65 ++
 backend/pkg/server/services/api_tokens.go     |  16 -
 backend/pkg/terminal/output.go                |   5 -
 backend/pkg/tools/browser.go                  |   3 -
 backend/pkg/tools/code.go                     |   4 -
 backend/pkg/tools/executor.go                 |   4 -
 backend/pkg/tools/flow_manager.go             |   2 -
 backend/pkg/tools/graphiti_search.go          |   3 -
 backend/pkg/tools/guide.go                    |   4 -
 backend/pkg/tools/memory.go                   |   3 -
 backend/pkg/tools/memory_utils.go             |   4 -
 backend/pkg/tools/search.go                   |   4 -
 backend/pkg/tools/terminal.go                 |   3 -
 backend/pkg/tools/tools.go                    |   1 -
 docker-compose.yml                            |   2 +-
 frontend/.gitignore                           |   1 +
 frontend/docs/e2e.md                          |  59 +-
 frontend/docs/list_detail_pages.md            |  50 +-
 frontend/e2e/affected-routes.ts               |  12 +-
 frontend/e2e/affected-routes.unit.test.ts     |   9 +
 frontend/e2e/ci-codegen-gate.unit.test.ts     |  91 +++
 frontend/e2e/fixtures/auth.ts                 |  11 +-
 frontend/e2e/fixtures/backend.ts              |   4 +-
 frontend/e2e/fixtures/test.ts                 |  17 +-
 frontend/e2e/helpers/a11y.ts                  |   9 +
 frontend/e2e/helpers/contrast.ts              | 216 +++--
 frontend/e2e/helpers/contrast.unit.test.ts    |  57 ++
 frontend/e2e/helpers/pdf.ts                   |  68 ++
 frontend/e2e/helpers/subscriptions.ts         |   6 +-
 frontend/e2e/mock-llm/scenario.mjs            |   7 +-
 frontend/e2e/mock-llm/server.mjs              |   5 +-
 frontend/e2e/mocks/cassette.ts                |  15 +
 frontend/e2e/mocks/cassettes/assistants.ts    |  72 ++
 .../mocks/cassettes/assistants.unit.test.ts   |  28 +
 frontend/e2e/mocks/cassettes/base.ts          |   5 +-
 frontend/e2e/mocks/cassettes/flows.ts         | 174 +++-
 frontend/e2e/mocks/cassettes/knowledges.ts    |  21 +-
 frontend/e2e/mocks/cassettes/resources.ts     |  38 +
 .../e2e/mocks/cassettes/settings-prompts.ts   |  49 +-
 .../e2e/mocks/cassettes/settings-providers.ts | 246 ++++--
 frontend/e2e/mocks/install.ts                 |  25 +-
 frontend/e2e/mocks/world.ts                   |  48 +-
 frontend/e2e/mocks/world.unit.test.ts         |  80 ++
 frontend/e2e/mocks/ws-graphql.ts              |   8 +-
 frontend/e2e/mocks/ws-graphql.unit.test.ts    |   6 +-
 frontend/e2e/playwright.config.ts             |  26 +-
 frontend/e2e/route-manifest.unit.test.ts      |  47 ++
 frontend/e2e/routes.ts                        |  77 +-
 frontend/e2e/specs/cross/a11y.spec.ts         |  59 +-
 frontend/e2e/specs/cross/contrast.spec.ts     | 134 +++-
 frontend/e2e/specs/cross/palette.spec.ts      | 130 ++-
 frontend/e2e/specs/cross/responsive.spec.ts   |  16 +
 .../e2e/specs/cross/session-expiry.spec.ts    | 143 ++++
 frontend/e2e/specs/cross/themes.spec.ts       |  22 +-
 frontend/e2e/specs/crud/api-tokens.spec.ts    |  18 +
 frontend/e2e/specs/crud/knowledges.spec.ts    | 106 ++-
 .../e2e/specs/crud/resources-upload.spec.ts   | 134 ++++
 frontend/e2e/specs/crud/resources.spec.ts     | 181 ++++-
 .../e2e/specs/crud/template-detail.spec.ts    |  71 +-
 .../e2e/specs/dashboard/dashboard.spec.ts     |   8 +-
 frontend/e2e/specs/flows/assistants.spec.ts   | 265 +++++++
 frontend/e2e/specs/flows/interrupt.spec.ts    | 118 +++
 frontend/e2e/specs/flows/live-panels.spec.ts  |  78 ++
 frontend/e2e/specs/flows/messages.spec.ts     |   8 +-
 frontend/e2e/specs/flows/pager.spec.ts        |  63 +-
 frontend/e2e/specs/flows/reconnect.spec.ts    |  25 +-
 frontend/e2e/specs/flows/report.spec.ts       | 123 +++
 .../e2e/specs/flows/subscriptions.spec.ts     |  58 +-
 frontend/e2e/specs/flows/tab-deeplink.spec.ts |  70 ++
 frontend/e2e/specs/flows/tabs.spec.ts         |  24 +-
 .../e2e/specs/real/account-password.spec.ts   | 135 ++++
 frontend/e2e/specs/real/flow-run.spec.ts      |  15 +-
 .../e2e/specs/real/resources-download.spec.ts |  67 ++
 .../real/resources-upload-limits.spec.ts      | 116 +++
 frontend/e2e/specs/real/stand-smoke.spec.ts   |   8 +-
 frontend/e2e/specs/settings/account.spec.ts   | 193 +++++
 .../e2e/specs/settings/prompt-detail.spec.ts  | 156 +++-
 frontend/e2e/specs/settings/providers.spec.ts | 307 ++++++-
 frontend/e2e/specs/smoke.spec.ts              |   8 +-
 .../flows-5-dark-visual-linux.png             | Bin 59926 -> 59943 bytes
 .../flows-5-light-visual-linux.png            | Bin 56794 -> 56786 bytes
 frontend/e2e/tools/review-sandbox.sh          | 187 +++++
 .../e2e/tools/review-sandbox.unit.test.ts     | 148 ++++
 frontend/e2e/tools/run-local-tier.sh          |   5 +-
 frontend/graphql-schema.graphql               |   4 +
 .../detail-navigation/use-navigation.ts       |   2 +-
 .../shared/file-manager/file-manager.tsx      |   2 +-
 .../inline-edit/inline-edit-input.test.tsx    |  57 ++
 .../shared/inline-edit/inline-edit-input.tsx  |   9 +-
 .../markdown-editor-code-fence.test.ts        | 120 ++-
 .../markdown-editor-extensions.test.ts        | 746 +++++++++++++++++-
 .../markdown-editor-extensions.ts             | 447 ++++++++++-
 .../markdown-editor/markdown-editor-focus.ts  |  17 +
 ...markdown-editor-heading-autoformat.test.ts |  12 +
 .../markdown-editor-heading-autoformat.ts     |   3 +-
 .../markdown-editor-image-handle.tsx          |   6 +-
 .../markdown-editor-image-src.test.ts         |  43 +
 .../markdown-editor-link-edit-form.tsx        |  12 +-
 .../markdown-editor-link-handle.tsx           |  33 +-
 .../markdown-editor/markdown-editor-marked.ts | 120 ++-
 .../markdown-editor-table-handles.tsx         |  11 +-
 .../markdown-editor-table-pipes.test.ts       | 290 ++++++-
 .../markdown-editor-table-pipes.ts            |  59 +-
 .../markdown-editor-toolbar-heading.tsx       |  79 +-
 .../markdown-editor-toolbar-image.tsx         |   6 +-
 .../markdown-editor-toolbar-link.tsx          |   7 +-
 .../markdown-editor-toolbar-list.tsx          |  75 +-
 .../markdown-editor-toolbar-url.ts            |  18 +-
 .../markdown-editor-toolbar.test.tsx          | 214 +++++
 .../markdown-editor-toolbar.tsx               |  71 +-
 .../markdown-editor/markdown-editor.tsx       |   2 -
 frontend/src/components/shared/markdown.tsx   |   1 -
 frontend/src/components/ui/button.tsx         |   4 +-
 frontend/src/components/ui/context-menu.tsx   |   2 +
 .../src/components/ui/data-table.test.tsx     |  80 +-
 frontend/src/components/ui/data-table.tsx     |  36 +-
 frontend/src/components/ui/dialog.test.tsx    | 142 ++++
 frontend/src/components/ui/dialog.tsx         |  45 ++
 frontend/src/components/ui/empty.tsx          |   2 +-
 frontend/src/components/ui/sheet.test.tsx     |  96 +++
 frontend/src/components/ui/sheet.tsx          |   2 +
 .../authentication/password-change-form.tsx   |   5 +-
 .../src/features/flows/agents/flow-agents.tsx |   2 +
 .../flow-files-attach-resources-dialog.tsx    |   1 +
 .../flows/files/flow-files-pull-dialog.tsx    |   2 +
 .../src/features/flows/files/flow-files.tsx   |   6 +-
 .../src/features/flows/flow-form.test.tsx     | 127 +++
 frontend/src/features/flows/flow-form.tsx     |  17 +-
 .../flows/flow-scroll-to-latest.test.tsx      | 101 +++
 .../messages/flow-assistant-messages.tsx      |   4 +
 .../messages/flow-automation-messages.tsx     |   2 +
 .../features/flows/messages/flow-message.tsx  |   2 +-
 .../flows/screenshots/flow-screenshots.tsx    |   2 +
 .../src/features/flows/tasks/flow-tasks.tsx   |   2 +
 .../features/flows/terminal/flow-terminal.tsx |   1 +
 .../src/features/flows/tools/flow-tools.tsx   |   2 +
 .../vector-stores/flow-vector-stores.tsx      |   2 +
 .../features/knowledges/knowledge-form.tsx    |   7 +-
 .../features/knowledges/knowledge-header.tsx  |  16 +-
 frontend/src/graphql/types.ts                 |  44 ++
 frontend/src/lib/apollo.test.ts               |  49 ++
 frontend/src/lib/errors.test.ts               |  27 +
 frontend/src/lib/errors.ts                    |  16 +
 .../text-filter.test.ts                       |   0
 .../detail-navigation => lib}/text-filter.ts  |   8 +-
 frontend/src/lib/upload-validation.test.ts    |  54 +-
 frontend/src/lib/upload-validation.ts         |  15 +-
 frontend/src/pages/flows/flow-report.test.tsx |  51 ++
 frontend/src/pages/flows/flow-report.tsx      |  17 +-
 frontend/src/pages/flows/flow.tsx             |  26 +-
 .../src/pages/knowledges/knowledge.test.tsx   |  78 ++
 frontend/src/pages/knowledges/knowledge.tsx   |  39 +-
 frontend/src/pages/resources/resources.tsx    |   3 +-
 .../pages/settings/settings-api-tokens.tsx    |   2 +-
 .../src/pages/settings/settings-prompt.tsx    |  27 +-
 .../src/pages/settings/settings-prompts.tsx   |  32 +-
 .../pages/settings/settings-provider.test.tsx | 187 ++++-
 .../src/pages/settings/settings-provider.tsx  |  47 +-
 .../settings/settings-providers.test.tsx      | 105 ++-
 .../src/pages/settings/settings-providers.tsx |   2 +-
 frontend/src/pages/templates/template.tsx     |  74 +-
 frontend/src/providers/flow-provider.test.ts  |  30 +
 frontend/src/providers/flow-provider.tsx      |  18 +-
 frontend/src/styles/index.css                 | 143 +++-
 201 files changed, 9166 insertions(+), 921 deletions(-)
 create mode 100755 .github/scripts/codegen-inputs-changed.sh
 create mode 100644 frontend/e2e/ci-codegen-gate.unit.test.ts
 create mode 100644 frontend/e2e/helpers/contrast.unit.test.ts
 create mode 100644 frontend/e2e/helpers/pdf.ts
 create mode 100644 frontend/e2e/mocks/cassettes/assistants.ts
 create mode 100644 frontend/e2e/mocks/cassettes/assistants.unit.test.ts
 create mode 100644 frontend/e2e/specs/cross/session-expiry.spec.ts
 create mode 100644 frontend/e2e/specs/crud/resources-upload.spec.ts
 create mode 100644 frontend/e2e/specs/flows/assistants.spec.ts
 create mode 100644 frontend/e2e/specs/flows/interrupt.spec.ts
 create mode 100644 frontend/e2e/specs/flows/live-panels.spec.ts
 create mode 100644 frontend/e2e/specs/flows/report.spec.ts
 create mode 100644 frontend/e2e/specs/flows/tab-deeplink.spec.ts
 create mode 100644 frontend/e2e/specs/real/account-password.spec.ts
 create mode 100644 frontend/e2e/specs/real/resources-download.spec.ts
 create mode 100644 frontend/e2e/specs/real/resources-upload-limits.spec.ts
 create mode 100644 frontend/e2e/specs/settings/account.spec.ts
 create mode 100755 frontend/e2e/tools/review-sandbox.sh
 create mode 100644 frontend/e2e/tools/review-sandbox.unit.test.ts
 create mode 100644 frontend/src/components/shared/inline-edit/inline-edit-input.test.tsx
 create mode 100644 frontend/src/components/shared/markdown-editor/markdown-editor-focus.ts
 create mode 100644 frontend/src/components/shared/markdown-editor/markdown-editor-toolbar.test.tsx
 create mode 100644 frontend/src/components/ui/dialog.test.tsx
 create mode 100644 frontend/src/components/ui/sheet.test.tsx
 create mode 100644 frontend/src/features/flows/flow-form.test.tsx
 create mode 100644 frontend/src/features/flows/flow-scroll-to-latest.test.tsx
 create mode 100644 frontend/src/lib/errors.test.ts
 create mode 100644 frontend/src/lib/errors.ts
 rename frontend/src/{components/shared/detail-navigation => lib}/text-filter.test.ts (100%)
 rename frontend/src/{components/shared/detail-navigation => lib}/text-filter.ts (87%)
 create mode 100644 frontend/src/pages/flows/flow-report.test.tsx
 create mode 100644 frontend/src/pages/knowledges/knowledge.test.tsx
 create mode 100644 frontend/src/providers/flow-provider.test.ts

diff --git a/.dockerignore b/.dockerignore
index 5c3616dc..48c900a5 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,9 +1,16 @@
 frontend/coverage
 frontend/dist
 frontend/node_modules
+frontend/e2e/test-results
+frontend/e2e/playwright-report
+frontend/e2e/blob-report
+frontend/e2e/.auth
+**/*.tsbuildinfo
 frontend/ssl
 
 **/*.log
 **/*.env
+**/.env.*
+!**/.env.example
 **/.DS_Store
 **/Thumbs.db
diff --git a/.github/scripts/codegen-inputs-changed.sh b/.github/scripts/codegen-inputs-changed.sh
new file mode 100755
index 00000000..0efa1041
--- /dev/null
+++ b/.github/scripts/codegen-inputs-changed.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Decide whether a run has to re-check that frontend/src/graphql/types.ts is fresh.
+# Echoes `changed=true|false`. Split out of ci.yml so the range selection is testable
+# (frontend/e2e/ci-codegen-gate.unit.test.ts drives it over real git fixtures).
+#
+# Usage: codegen-inputs-changed.sh <event_name> <before_sha> <base_sha> <head_sha>
+set -uo pipefail
+
+EVENT="${1:-}"
+BEFORE="${2:-}"
+BASE_SHA="${3:-}"
+HEAD_SHA="${4:-}"
+
+# On pull_request, `before` is the PR's PREVIOUS HEAD, so a follow-up push diffs a range
+# that no longer contains the commit that edited the schema — the gate would skip itself
+# on every push after the first. The PR's base is the range that always spans the change.
+if [ "$EVENT" = "pull_request" ]; then
+    base="$BASE_SHA"
+else
+    base="$BEFORE"
+fi
+
+# When the range can't be resolved (new branch, force-push, tag), check anyway.
+# stdout is consumed verbatim as a workflow output, so diagnostics go to stderr.
+if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ] \
+    || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
+    echo "reason=unresolvable-base" >&2
+    echo "changed=true"
+    exit 0
+fi
+
+# The generated file is in the list too: a push that edits only it would otherwise skip
+# the check, and the drift surfaces later on someone else's unrelated codegen push.
+INPUTS=(
+    backend/pkg/graph/schema.graphqls
+    frontend/graphql-schema.graphql
+    frontend/graphql-codegen.ts
+    frontend/pnpm-lock.yaml
+    frontend/src/graphql/types.ts
+)
+
+if ! files=$(git diff --name-only "$base" "$HEAD_SHA"); then
+    echo "reason=diff-failed" >&2
+    echo "changed=true"
+    exit 0
+fi
+
+for input in "${INPUTS[@]}"; do
+    case $'\n'"$files"$'\n' in
+        *$'\n'"$input"$'\n'*)
+            echo "changed=true"
+            exit 0
+            ;;
+    esac
+done
+
+echo "changed=false"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 346cdcfb..558d4c44 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,13 +1,23 @@
 name: Docker build and push
 
 on:
+  # pull_request so the lint/codegen/test gate runs on fork PRs too: a fork's commits never push to
+  # this repo, so a push-only trigger let a fork edit the schema without regenerating types.ts (or
+  # ship a lint/test failure) and merge green, since e2e.yml's tsc build cannot see stale codegen.
+  # lint-and-test uses no secrets and is fork-safe; docker-build stays gated to main/tags below.
+  pull_request:
+    types: [opened, synchronize, reopened]
   push:
     branches:
-      - "**"
+      - main
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"
   workflow_dispatch:
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -32,7 +42,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version: "1.24"
           cache: true
           cache-dependency-path: backend/go.sum
 
@@ -47,8 +57,8 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version-file: frontend/.nvmrc
-          cache: 'pnpm'
-          cache-dependency-path: 'frontend/pnpm-lock.yaml'
+          cache: "pnpm"
+          cache-dependency-path: "frontend/pnpm-lock.yaml"
 
       # Frontend lint and test
       - name: Frontend - Install dependencies
@@ -70,21 +80,14 @@ jobs:
       # Only when a codegen input moved. The lockfile is included on purpose: a codegen
       # version bump can change the output, and skipping it there would let types.ts go
       # stale and fail the next schema push for something its author did not do.
-      # When the range can't be resolved (new branch, force-push, tag), check anyway.
       - name: Frontend - Detect GraphQL codegen input changes
         id: codegen-inputs
         run: |
-          base='${{ github.event.before }}'
-          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ] \
-             || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          if git diff --name-only "$base" "${{ github.sha }}" | grep -qE '^(backend/pkg/graph/schema\.graphqls|frontend/graphql-schema\.graphql|frontend/graphql-codegen\.ts|frontend/pnpm-lock\.yaml)$'; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          fi
+          .github/scripts/codegen-inputs-changed.sh \
+            '${{ github.event_name }}' \
+            '${{ github.event.before }}' \
+            '${{ github.event.pull_request.base.sha }}' \
+            '${{ github.sha }}' >> "$GITHUB_OUTPUT"
 
       # The app ships the operations compiled into src/graphql/types.ts; regenerate and
       # diff so it can't drift from graphql-schema.graphql (the codegen input the stand's
@@ -133,17 +136,17 @@ jobs:
           PACKAGE_VER=${LATEST_TAG#v}
           CURRENT_COMMIT=$(git rev-parse HEAD)
           TAG_COMMIT=$(git rev-list -n 1 "$LATEST_TAG" 2>/dev/null || echo "")
-          
+
           if [ "$CURRENT_COMMIT" != "$TAG_COMMIT" ]; then
             PACKAGE_REV=$(git rev-parse --short HEAD)
           else
             PACKAGE_REV=""
           fi
-          
+
           LDFLAGS="-X pentagi/pkg/version.PackageName=pentagi -X pentagi/pkg/version.PackageVer=${PACKAGE_VER} -X pentagi/pkg/version.PackageRev=${PACKAGE_REV}"
-          
+
           echo "Building with version: ${PACKAGE_VER}${PACKAGE_REV:+-$PACKAGE_REV}"
-          
+
           # Build for AMD64
           GOOS=linux GOARCH=amd64 go build -trimpath -ldflags "$LDFLAGS" -o /tmp/pentagi-amd64 ./cmd/pentagi
           echo "✓ Successfully built for linux/amd64"
@@ -179,13 +182,13 @@ jobs:
           # Get latest tag version (without 'v' prefix)
           LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
           VERSION=${LATEST_TAG#v}
-          
+
           # Get current commit hash
           CURRENT_COMMIT=$(git rev-parse HEAD)
-          
+
           # Get commit hash of the latest tag
           TAG_COMMIT=$(git rev-list -n 1 "$LATEST_TAG" 2>/dev/null || echo "")
-          
+
           # Set revision only if current commit differs from tag commit
           if [ "$CURRENT_COMMIT" != "$TAG_COMMIT" ]; then
             PACKAGE_REV=$(git rev-parse --short HEAD)
@@ -205,7 +208,7 @@ jobs:
             echo "patch=${VERSION}" >> $GITHUB_OUTPUT
             echo "  Docker tags: latest, ${major}, ${major}.${minor}, ${VERSION}"
           fi
-          
+
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
       - name: Generate Docker metadata
diff --git a/.github/workflows/e2e-report.yml b/.github/workflows/e2e-report.yml
index 24aa7e79..d28ea491 100644
--- a/.github/workflows/e2e-report.yml
+++ b/.github/workflows/e2e-report.yml
@@ -28,6 +28,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Download results
+        id: results
         continue-on-error: true
         uses: actions/download-artifact@v4
         with:
@@ -55,15 +56,25 @@ jobs:
             const fs = require('fs');
             const run = context.payload.workflow_run;
 
-            // workflow_run.pull_requests is empty for fork PRs — resolve by head SHA.
-            let prNumber = run.pull_requests[0]?.number;
+            // Match the PR whose head is still this run's — one commit can belong to several PRs, so
+            // taking the first association (either source) could hand the report to a stale or
+            // foreign one. Same filter on both paths: workflow_run.pull_requests (empty for forks)
+            // and the head-SHA lookup that covers them.
+            // workflow_run.pull_requests carries head.repo.name but no full_name, unlike the API
+            // lookup — enforce the repo only when it is present, so the primary path still matches.
+            const isThisRun = (pr) =>
+              pr.head?.sha === run.head_sha &&
+              pr.head?.ref === run.head_branch &&
+              (pr.head?.repo?.full_name == null || pr.head.repo.full_name === run.head_repository?.full_name);
+
+            let prNumber = run.pull_requests.find(isThisRun)?.number;
             if (!prNumber) {
               const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 commit_sha: run.head_sha,
               });
-              prNumber = prs[0]?.number;
+              prNumber = prs.find(isThisRun)?.number;
             }
             if (!prNumber) {
               core.info(`No PR found for ${run.head_sha}; skipping comment.`);
@@ -94,7 +105,15 @@ jobs:
               return;
             }
 
-            let statsLine = 'The run produced no results file (it likely failed before the tests started).';
+            // e2e.yml uploads results.json with `if-no-files-found: ignore`, so a run that never
+            // wrote one publishes no artifact at all: a failed download means the file is absent,
+            // a successful download with unreadable stats means it is corrupt.
+            const resultsDownloaded = '${{ steps.results.outcome }}' === 'success';
+
+            let statsLine = resultsDownloaded
+              ? 'The results file could not be parsed, so no test counts are available.'
+              : 'No results artifact was produced for this run.';
+            let statsRead = false;
             let noFailures = false;
             try {
               const report = JSON.parse(fs.readFileSync('results/results.json', 'utf8'));
@@ -102,24 +121,39 @@ jobs:
               const { expected, unexpected, flaky, skipped } = report.stats ?? {};
               statsLine = `**${n(expected)} passed**, ${n(unexpected)} failed, ${n(flaky)} flaky, ${n(skipped)} skipped.`;
               noFailures = n(unexpected) === 0;
+              statsRead = true;
             } catch (error) {
               core.info(`results.json unavailable: ${error}`);
             }
 
-            // Both halves are required: results.json is written before an abort can be
-            // observed, so a run killed by the global timeout still reports zero failures.
-            // When the jobs API was unreachable, fall back to results.json alone.
-            const mockPassed = noFailures && (jobsFetched ? mockJob?.conclusion === 'success' : true);
+            // The job conclusion is load-bearing, not a nicety: results.json is written before a
+            // global-timeout abort can be observed (its un-run tests land in `skipped`, so
+            // `unexpected` stays 0), and only the job's own conclusion reflects the abort. So a
+            // green needs BOTH zero failures AND a successful job; whenever either source is
+            // unreadable the verdict is unknown — never a green, and never a red.
+            const jobFailed = jobsFetched && mockJob?.conclusion !== 'success';
+            const mockStatus = jobFailed || (statsRead && !noFailures)
+              ? 'fail'
+              : statsRead && jobsFetched
+                ? 'pass'
+                : 'unknown';
 
             // Key the advisory on the e2e-visual-diffs artifact (uploaded only when the snapshot
             // step itself failed), not on the visual job's conclusion — a tag-guard, install or
             // build failure would otherwise read as "snapshots differ".
             const visualDiffers = '${{ steps.visualdiffs.outcome }}' === 'success';
 
-            const conclusion = !mockPassed ? '❌' : visualDiffers ? '⚠️' : '✅';
+            const conclusion = mockStatus === 'fail' ? '❌' : mockStatus === 'unknown' || visualDiffers ? '⚠️' : '✅';
             const marker = '<!-- e2e-report -->';
-            const advisoryLine = visualDiffers
-              ? '⚠️ **Visual snapshots differ** — advisory only, does not block merge. Download the `e2e-visual-diffs` artifact to compare expected / actual / diff.'
+            const unconfirmedReason = !jobsFetched && !statsRead
+              ? 'neither the workflow jobs API nor `results.json` could be read'
+              : !jobsFetched
+              ? 'the workflow jobs API was unreachable, so this reflects `results.json` alone, which cannot distinguish a clean pass from a run killed mid-flight'
+              : '`results.json` could not be read, so this reflects the job conclusion alone and no test counts were checked';
+            const advisoryLine = mockStatus === 'unknown'
+              ? `⚠️ **Result unconfirmed** — ${unconfirmedReason}. Check the run before merging.`
+              : visualDiffers
+              ? '⚠️ **Visual snapshots differ** — advisory only, does not block merge. Download the `e2e-visual-diffs` artifact to compare expected / actual / diff (a missing baseline uploads actual only).'
               : null;
             const body = [
               marker,
diff --git a/.github/workflows/e2e-stand.yml b/.github/workflows/e2e-stand.yml
index b7058167..ccc3dfb5 100644
--- a/.github/workflows/e2e-stand.yml
+++ b/.github/workflows/e2e-stand.yml
@@ -10,27 +10,26 @@ on:
   pull_request:
     types: [labeled]
   workflow_dispatch:
-    inputs:
-      tier:
-        description: "Run the stand tier"
-        type: choice
-        options:
-          - stand
-          - all
-        default: stand
 
 permissions:
   contents: read
 
+# Keyed on the label too: concurrency is evaluated for the whole run before the job's `if`, so a run
+# started by an unrelated label would share this group and cancel an approved stand run mid-flight.
 concurrency:
-  group: e2e-stand-${{ github.event.pull_request.number || github.run_id }}
+  group: e2e-stand-${{ github.event.pull_request.number || github.run_id }}-${{ github.event.label.name }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   e2e-stand:
+    # GitHub withholds secrets from fork `pull_request` runs: without the fork check a labelled fork
+    # PR holds reviewers for an environment approval and then fails on empty credentials. Assert repo
+    # identity rather than negating `head.repo.fork`: a deleted fork sends `head.repo: null`, and
+    # GitHub coerces null and false alike to 0, so the negation lets that PR through.
     if: >
       github.event_name == 'workflow_dispatch' ||
-      contains(github.event.pull_request.labels.*.name, 'e2e:stand')
+      (github.event.label.name == 'e2e:stand' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: e2e-stand
@@ -78,11 +77,41 @@ jobs:
           E2E_USER: ${{ secrets.E2E_STAND_USER }}
           E2E_PASSWORD: ${{ secrets.E2E_STAND_PASSWORD }}
 
-      # Traces, videos and screenshots are all disabled on this tier — they would
-      # embed the live session cookie, the stand URL or the login into a
-      # public-repo artifact. results.json carries none of those.
-      - name: Upload report
+      # Traces, videos and screenshots are disabled on this tier. results.json still
+      # embeds the stand URL (baseURL in navigation/locator error messages) and the
+      # user (in locator text) on a failing run, so redact the secrets before the
+      # public-repo upload — GitHub masks secrets in logs, never in artifacts.
+      - name: Redact secrets from report
+        id: redact
         if: always()
+        working-directory: frontend
+        run: |
+          node -e '
+            const fs = require("fs");
+            const f = "e2e/test-results/results.json";
+            if (!fs.existsSync(f)) process.exit(0);
+            let s = fs.readFileSync(f, "utf8");
+            // Derived forms too, not just the raw value: auth.setup.ts builds a locator name from
+            // the regex-escaped user, so a failed login writes `user@host\.com` into the error —
+            // and since this redacts the JSON text, that backslash is itself encoded as `\\`.
+            const regexEscaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const jsonEncoded = (v) => JSON.stringify(v).slice(1, -1);
+            for (const v of [process.env.E2E_BASE_URL, process.env.E2E_USER, process.env.E2E_PASSWORD]) {
+              if (!v) continue;
+              const forms = [v, regexEscaped(v), encodeURIComponent(v)];
+              for (const form of new Set([...forms, ...forms.map(jsonEncoded)])) {
+                s = s.split(form).join("<redacted>");
+              }
+            }
+            fs.writeFileSync(f, s);
+          '
+        env:
+          E2E_BASE_URL: ${{ secrets.E2E_STAND_URL }}
+          E2E_USER: ${{ secrets.E2E_STAND_USER }}
+          E2E_PASSWORD: ${{ secrets.E2E_STAND_PASSWORD }}
+
+      - name: Upload report
+        if: always() && steps.redact.outcome == 'success'
         uses: actions/upload-artifact@v4
         with:
           name: e2e-stand-report
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index e2d0f898..98d54fe9 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -117,11 +117,14 @@ jobs:
 
       # Compare the container's own Playwright build to @playwright/test rather than a
       # hardcoded literal, so bumping the package without re-tagging the image (or vice
-      # versa) fails here instead of drifting the pixel baselines.
+      # versa) fails here instead of drifting the pixel baselines. Read the version from
+      # the image's own /ms-playwright/.docker-info: this image ships no global
+      # playwright, so `npx playwright --version` (before pnpm install) would fetch the
+      # registry latest and compare the package against that, not against the container.
       - name: Verify container image matches @playwright/test
         run: |
           pkg="$(node -p "require('./frontend/package.json').devDependencies['@playwright/test'].replace(/[^0-9.]/g, '')")"
-          container="$(npx playwright --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
+          container="$(node -p "JSON.parse(require('fs').readFileSync('/ms-playwright/.docker-info','utf8')).driverVersion")"
           if [ "$pkg" != "$container" ]; then
             echo "::error::e2e-visual container ships Playwright $container but @playwright/test is $pkg — bump the container tag to v$pkg-noble and regenerate baselines"
             exit 1
@@ -153,10 +156,25 @@ jobs:
         working-directory: frontend
         run: E2E_VISUAL=1 E2E_VISUAL_CONTAINER=1 npx playwright test -c e2e/playwright.config.ts
 
-      # Only on a real snapshot diff (not a tag-guard/install/build failure), so its
-      # presence is the precise "snapshots differ" signal the report keys the advisory on.
-      - name: Upload diffs
+      # The step failing is not the same signal as a snapshot differing: a webServer or build
+      # failure inside it also exits non-zero and still leaves results.json behind, which would
+      # publish the artifact and make the report say "snapshots differ". Look for the diff images.
+      - name: Detect snapshot diffs
+        id: diffs
         if: failure() && steps.snapshots.outcome == 'failure'
+        working-directory: frontend
+        run: |
+          # -actual.png too: a missing baseline fails the test but writes no diff image, and only the
+          # snapshot matcher writes either name — a non-snapshot failure leaves test-failed-N.png.
+          if find e2e/test-results \( -name '*-diff.png' -o -name '*-actual.png' \) -print -quit | grep -q .; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Its presence is the precise "snapshots differ" signal the report keys the advisory on.
+      - name: Upload diffs
+        if: always() && steps.diffs.outputs.found == 'true'
         uses: actions/upload-artifact@v4
         with:
           name: e2e-visual-diffs
@@ -169,8 +187,7 @@ jobs:
   e2e-local:
     if: >
       github.event_name == 'schedule' ||
-      (github.event_name == 'workflow_dispatch' &&
-       contains(fromJSON('["local", "all"]'), inputs.tier))
+      (github.event_name == 'workflow_dispatch' && inputs.tier == 'local')
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:
diff --git a/CLAUDE.md b/CLAUDE.md
index b92e1953..3a6da8ad 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -6,7 +6,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 1. **Always use English** for all interactions, responses, explanations, and questions with users.
 2. **Password Complexity Requirements**: For all password-related development (registration, password reset, API token generation, etc.), enforce the same policy in **both** backend and frontend — never rely on frontend validation alone. Source of truth, keep the two in sync: `backend/pkg/server/models/init.go` → `strongPasswordValidatorString` and `frontend/src/features/authentication/password-change-form.tsx` (zod schema). The policy:
-   - Length 8–100 characters.
+   - Length 8–72 characters (72 **bytes**, the most bcrypt will hash — a longer value fails inside `bcrypt.GenerateFromPassword`, after validation).
    - A password is valid if it is **either** 16+ characters (any composition), **or** 8–15 characters containing at least 1 lowercase letter, 1 uppercase letter, 1 number, and 1 special character from `!@#$&*`.
 
 ## Project Overview
diff --git a/README.md b/README.md
index 44e6cf11..f9b315d9 100644
--- a/README.md
+++ b/README.md
@@ -1943,7 +1943,7 @@ PROXY_URL=http://your-proxy:8080
 
 #### Custom Provider Config and Models (advanced)
 
-By default the Bedrock provider uses a per-agent config and model catalog compiled into the binary. Two optional paths override them without rebuilding:
+By default the Bedrock provider uses a per-agent config and model catalog compiled into the binary. One optional path overrides them without rebuilding:
 
 - `BEDROCK_CONFIG_PATH` — a YAML file (same shape as the other provider configs) that **replaces** the built-in per-agent model/price assignments. See [`examples/configs/bedrock-glm-flash.provider.yml`](examples/configs/bedrock-glm-flash.provider.yml).
 
@@ -1952,9 +1952,9 @@ This is useful to expose a Bedrock model newer than the compiled-in catalog —
 With Docker Compose, set the host-side mount source and the in-container path together:
 
 ```bash
-# host files mounted into the container
+# host file mounted into the container at /opt/pentagi/conf/bedrock.provider.yml
 PENTAGI_BEDROCK_CONFIG_PATH=./examples/configs/bedrock-glm-flash.provider.yml
-# tell the backend to read the mounted files
+# tell the backend to read the mounted file
 BEDROCK_CONFIG_PATH=/opt/pentagi/conf/bedrock.provider.yml
 ```
 
diff --git a/backend/pkg/config/config.go b/backend/pkg/config/config.go
index 1c50af77..bd2c0ec2 100644
--- a/backend/pkg/config/config.go
+++ b/backend/pkg/config/config.go
@@ -257,7 +257,6 @@ type Config struct {
 }
 
 func NewConfig() (*Config, error) {
-	// Attempt to load .env file (silently ignore if not present)
 	_ = godotenv.Load()
 
 	var config Config
@@ -282,12 +281,10 @@ func NewConfig() (*Config, error) {
 }
 
 func ensureInstallationID(config *Config) {
-	// validate current installation ID from environment
 	if config.InstallationID != "" && uuid.Validate(config.InstallationID) == nil {
 		return
 	}
 
-	// check local file for installation ID
 	installationIDPath := filepath.Join(config.DataDir, "installation_id")
 	installationID, err := os.ReadFile(installationIDPath)
 	if err != nil {
@@ -298,17 +295,14 @@ func ensureInstallationID(config *Config) {
 		config.InstallationID = uuid.New().String()
 	}
 
-	// write installation ID to local file
 	_ = os.WriteFile(installationIDPath, []byte(config.InstallationID), 0644)
 }
 
 func ensureLicenseKey(config *Config) {
-	// validate current license key from environment
 	if config.LicenseKey == "" {
 		return
 	}
 
-	// check license key validity, if invalid, set to empty
 	info, err := sdk.IntrospectLicenseKey(config.LicenseKey)
 	if err != nil {
 		config.LicenseKey = ""
@@ -364,7 +358,6 @@ func (c *Config) GetSecretPatterns() []patterns.Pattern {
 			continue
 		}
 
-		// escape regex special characters
 		escaped := regexp.QuoteMeta(trimmed)
 		pattern := patterns.Pattern{
 			Name:  s.name,
diff --git a/backend/pkg/controller/aslog.go b/backend/pkg/controller/aslog.go
index ab1a48ef..ff19e8cd 100644
--- a/backend/pkg/controller/aslog.go
+++ b/backend/pkg/controller/aslog.go
@@ -287,7 +287,7 @@ func (aslw *flowAssistantLogWorker) workerMsgUpdater(
 	contentBuf := bytes.NewBuffer(contentData)
 	thinkingData := make([]byte, 0, defaultMaxMessageLength)
 	thinkingBuf := bytes.NewBuffer(thinkingData)
-	wasUpdated := false // track if we actually updated the record
+	wasUpdated := false
 
 	msgLog, err := aslw.db.GetFlowAssistantLog(ctx, msgID)
 	if err != nil {
diff --git a/backend/pkg/controller/assistant.go b/backend/pkg/controller/assistant.go
index d32b0aee..d2d3cdab 100644
--- a/backend/pkg/controller/assistant.go
+++ b/backend/pkg/controller/assistant.go
@@ -559,7 +559,7 @@ func (aw *assistantWorker) PutInput(ctx context.Context, input string, useAgents
 
 		select {
 		case err := <-ain.done:
-			return err // nil or error
+			return err
 		case <-timer.C:
 			return nil // no early error
 		case <-aw.ctx.Done():
diff --git a/backend/pkg/controller/flow.go b/backend/pkg/controller/flow.go
index 8cf3a5b5..7b0d684f 100644
--- a/backend/pkg/controller/flow.go
+++ b/backend/pkg/controller/flow.go
@@ -124,7 +124,7 @@ type flowInput struct {
 func NewFlowWorker(
 	ctx context.Context,
 	fwc newFlowWorkerCtx,
-) (FlowWorker, error) {
+) (_ FlowWorker, err error) {
 	ctx, span := obs.Observer.NewSpan(ctx, obs.SpanKindInternal, "controller.NewFlowWorker")
 	defer span.End()
 
@@ -152,6 +152,25 @@ func NewFlowWorker(
 	})
 	logger.Info("flow created in DB")
 
+	// Held separately because `flow` is reassigned below by UpdateFlow, which — like every sqlc query —
+	// returns a zero-valued row alongside an error, and a cleanup aimed at id 0 deletes nothing.
+	flowID := flow.ID
+
+	// DeleteFlow is a soft delete and the listings filter on deleted_at, so this is what keeps a flow
+	// the caller was told it never got out of the UI. Disarmed once the worker goroutine owns the flow —
+	// from there a failure is the worker's to unwind, not ours.
+	cleanupFlow := true
+	defer func() {
+		if err == nil || !cleanupFlow {
+			return
+		}
+
+		// The caller's context is usually already cancelled by whatever failed.
+		if _, cerr := fwc.db.DeleteFlow(context.WithoutCancel(ctx), flowID); cerr != nil {
+			logger.WithError(cerr).Error("failed to drop the flow left behind by a failed start")
+		}
+	}()
+
 	user, err := fwc.db.GetUser(ctx, fwc.userID)
 	if err != nil {
 		logger.WithError(err).Error("failed to get user")
@@ -282,6 +301,8 @@ func NewFlowWorker(
 
 	fw.flowCtx.Publisher.FlowCreated(ctx, flow, containers)
 
+	cleanupFlow = false
+
 	fw.wg.Add(1)
 	go fw.worker()
 
@@ -630,7 +651,7 @@ func (fw *flowWorker) PutInput(
 
 		select {
 		case err := <-flin.done:
-			return err // nil or error
+			return err
 		case <-timer.C:
 			return nil // no early error
 		case <-fw.ctx.Done():
diff --git a/backend/pkg/csum/chain_summary.go b/backend/pkg/csum/chain_summary.go
index bf9e1c78..32b078f2 100644
--- a/backend/pkg/csum/chain_summary.go
+++ b/backend/pkg/csum/chain_summary.go
@@ -110,7 +110,6 @@ func (s *summarizer) SummarizeChain(
 	chain []llms.MessageContent,
 	tcIDTemplate string,
 ) ([]llms.MessageContent, error) {
-	// Skip summarization for empty chains
 	if len(chain) == 0 {
 		return chain, nil
 	}
@@ -191,7 +190,6 @@ func summarizeSections(
 			continue
 		}
 
-		// Add human message if it exists
 		var humanMessages []llms.MessageContent
 		if section.Header.HumanMessage != nil {
 			humanMessages = append(humanMessages, *section.Header.HumanMessage)
@@ -201,7 +199,6 @@ func summarizeSections(
 		go func(section *cast.ChainSection, i int) {
 			defer wg.Done()
 
-			// Generate summary
 			summaryText, err := GenerateSummary(ctx, handler, humanMessages, messagesToSummarize)
 			if err != nil {
 				ch <- fmt.Errorf("section %d summary generation failed: %w", i, err)
@@ -286,13 +283,11 @@ func summarizeLastSection(
 			messagesToSummarize = append(messagesToSummarize, pair.Messages()...)
 		}
 
-		// Add human message if it exists
 		var humanMessages []llms.MessageContent
 		if lastSection.Header.HumanMessage != nil {
 			humanMessages = append(humanMessages, *lastSection.Header.HumanMessage)
 		}
 
-		// Generate summary
 		summaryText, err := GenerateSummary(ctx, handler, humanMessages, messagesToSummarize)
 		if err != nil {
 			// If summary generation fails, just keep the most recent messages
@@ -405,7 +400,6 @@ func summarizeOversizedBodyPairs(
 			continue
 		}
 
-		// Add human message if it exists
 		var humanMessages []llms.MessageContent
 		if section.Header.HumanMessage != nil {
 			humanMessages = append(humanMessages, *section.Header.HumanMessage)
@@ -415,7 +409,6 @@ func summarizeOversizedBodyPairs(
 		go func(pair *cast.BodyPair, i int) {
 			defer wg.Done()
 
-			// Generate summary
 			summaryText, err := GenerateSummary(ctx, handler, humanMessages, pairMessages)
 			if err != nil {
 				return // It's should collected next step in summarizeLastSection function
@@ -549,7 +542,6 @@ func summarizeQAPairs(
 		}
 	}
 
-	// Generate summary
 	var (
 		err       error
 		aiSummary string
@@ -697,7 +689,6 @@ func convertSectionsHeadersToMessages(sections []*cast.ChainSection) []llms.Mess
 	var messages []llms.MessageContent
 
 	for _, section := range sections {
-		// Add human message if it exists
 		if section.Header.HumanMessage != nil {
 			messages = append(messages, *section.Header.HumanMessage)
 		}
@@ -715,7 +706,6 @@ func convertSectionsPairsToMessages(sections []*cast.ChainSection) []llms.Messag
 	var messages []llms.MessageContent
 
 	for _, section := range sections {
-		// Get all messages from each body pair using the Messages() method
 		for _, pair := range section.Body {
 			pairMessages := pair.Messages()
 			messages = append(messages, pairMessages...)
diff --git a/backend/pkg/database/converter/analytics.go b/backend/pkg/database/converter/analytics.go
index 809e4d40..546c449a 100644
--- a/backend/pkg/database/converter/analytics.go
+++ b/backend/pkg/database/converter/analytics.go
@@ -22,7 +22,6 @@ func CalculateSubtaskDuration(subtask database.Subtask, msgchains []database.Msg
 		return 0
 	}
 
-	// Calculate linear duration
 	var linearDuration float64
 	if subtask.Status == database.SubtaskStatusRunning {
 		// For running subtasks: from created_at to now
diff --git a/backend/pkg/database/converter/converter.go b/backend/pkg/database/converter/converter.go
index e24a5167..63ab9149 100644
--- a/backend/pkg/database/converter/converter.go
+++ b/backend/pkg/database/converter/converter.go
@@ -695,6 +695,18 @@ func ConvertAgentConfigToGqlModel(ac *pconfig.AgentConfig) *model.AgentConfig {
 	if ac.PresencePenalty != 0 {
 		result.PresencePenalty = &ac.PresencePenalty
 	}
+	if ac.MinP != 0 {
+		result.MinP = &ac.MinP
+	}
+	if ac.N != 0 {
+		result.N = &ac.N
+	}
+	if ac.JSON {
+		result.JSON = &ac.JSON
+	}
+	if ac.ResponseMIMEType != "" {
+		result.ResponseMimeType = &ac.ResponseMIMEType
+	}
 
 	if !ac.Reasoning.IsZero() {
 		reasoning := &model.ReasoningConfig{}
@@ -796,6 +808,21 @@ func ConvertAgentConfigFromGqlModel(ac *model.AgentConfig) *pconfig.AgentConfig
 	if ac.PresencePenalty != nil {
 		rawConfig["presence_penalty"] = *ac.PresencePenalty
 	}
+	// BuildOptions gates these on the key being present, not on its value, so a zero has to be
+	// written as an absent key — otherwise `json: false` would switch JSON mode on and `n: 0`
+	// would emit an invalid request parameter.
+	if ac.MinP != nil && *ac.MinP != 0 {
+		rawConfig["min_p"] = *ac.MinP
+	}
+	if ac.N != nil && *ac.N != 0 {
+		rawConfig["n"] = *ac.N
+	}
+	if ac.JSON != nil && *ac.JSON {
+		rawConfig["json"] = *ac.JSON
+	}
+	if ac.ResponseMimeType != nil && *ac.ResponseMimeType != "" {
+		rawConfig["response_mime_type"] = *ac.ResponseMimeType
+	}
 
 	if ac.Reasoning != nil {
 		reasoning := map[string]any{}
@@ -932,7 +959,6 @@ func ConvertUsageStats[T UsageStatsRow](stats T) *model.UsageStats {
 	var in, out, cacheIn, cacheOut int64
 	var costIn, costOut float64
 
-	// Extract fields based on type
 	switch v := any(stats).(type) {
 	case database.GetFlowUsageStatsRow:
 		in, out = v.TotalUsageIn, v.TotalUsageOut
@@ -1107,7 +1133,6 @@ func ConvertToolcallsStats[T ToolcallsStatsRow](stats T) *model.ToolcallsStats {
 	var count int64
 	var duration float64
 
-	// Extract fields based on type
 	switch v := any(stats).(type) {
 	case database.GetFlowToolcallsStatsRow:
 		count, duration = v.TotalCount, v.TotalDurationSeconds
@@ -1177,7 +1202,6 @@ func isAgentTool(functionName string) bool {
 	if !exists {
 		return false
 	}
-	// Agent tools include AgentToolType and StoreAgentResultToolType
 	return toolType == tools.AgentToolType || toolType == tools.StoreAgentResultToolType
 }
 
@@ -1217,7 +1241,6 @@ func ConvertFunctionToolcallsStatsForFlow(stats []database.GetToolcallsStatsByFu
 func ConvertFlowsStats[T FlowsStatsRow](stats T) *model.FlowsStats {
 	var flowsCount, tasksCount, subtasksCount, assistantsCount int64
 
-	// Extract fields based on type
 	switch v := any(stats).(type) {
 	case database.GetUserTotalFlowsStatsRow:
 		flowsCount, tasksCount, subtasksCount, assistantsCount = v.TotalFlowsCount, v.TotalTasksCount, v.TotalSubtasksCount, v.TotalAssistantsCount
@@ -1235,7 +1258,6 @@ func ConvertFlowsStats[T FlowsStatsRow](stats T) *model.FlowsStats {
 func ConvertFlowStats[T FlowStatsRow](stats T) *model.FlowStats {
 	var tasksCount, subtasksCount, assistantsCount int64
 
-	// Extract fields based on type
 	switch v := any(stats).(type) {
 	case database.GetFlowStatsRow:
 		tasksCount, subtasksCount, assistantsCount = v.TotalTasksCount, v.TotalSubtasksCount, v.TotalAssistantsCount
diff --git a/backend/pkg/database/converter/converter_test.go b/backend/pkg/database/converter/converter_test.go
index 5c7805d6..62ff707a 100644
--- a/backend/pkg/database/converter/converter_test.go
+++ b/backend/pkg/database/converter/converter_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"pentagi/pkg/graph/model"
+	"pentagi/pkg/providers/openai"
 	"pentagi/pkg/providers/pconfig"
 
 	"github.com/stretchr/testify/assert"
@@ -207,3 +208,77 @@ func TestConvertAgentConfigExtraBodyNilStaysNil(t *testing.T) {
 
 	assert.Nil(t, ConvertAgentConfigToGqlModel(from).ExtraBody)
 }
+
+func ptr[T any](value T) *T { return &value }
+
+func TestConvertAgentConfigCallOptionFieldsRoundTrip(t *testing.T) {
+	from := ConvertAgentConfigFromGqlModel(&model.AgentConfig{
+		Model:            "m",
+		MinP:             ptr(0.05),
+		N:                ptr(3),
+		JSON:             ptr(true),
+		ResponseMimeType: ptr("application/json"),
+	})
+	require.NotNil(t, from)
+	assert.Equal(t, 0.05, from.MinP)
+	assert.Equal(t, 3, from.N)
+	assert.True(t, from.JSON)
+	assert.Equal(t, "application/json", from.ResponseMIMEType)
+
+	back := ConvertAgentConfigToGqlModel(from)
+	require.NotNil(t, back)
+	require.NotNil(t, back.MinP)
+	require.NotNil(t, back.N)
+	require.NotNil(t, back.JSON)
+	require.NotNil(t, back.ResponseMimeType)
+	assert.Equal(t, 0.05, *back.MinP)
+	assert.Equal(t, 3, *back.N)
+	assert.True(t, *back.JSON)
+	assert.Equal(t, "application/json", *back.ResponseMimeType)
+}
+
+// pconfig gates each emitter on the raw key being PRESENT, not on its value, so a zero written
+// through would switch the option on: `json: false` must not reach the LLM as WithJSONMode().
+func TestConvertAgentConfigZeroCallOptionFieldsStayAbsent(t *testing.T) {
+	from := ConvertAgentConfigFromGqlModel(&model.AgentConfig{
+		Model:            "m",
+		MinP:             ptr(0.0),
+		N:                ptr(0),
+		JSON:             ptr(false),
+		ResponseMimeType: ptr(""),
+	})
+	require.NotNil(t, from)
+
+	options := from.BuildOptions()
+	call := llms.CallOptions{}
+	for _, option := range options {
+		option(&call)
+	}
+
+	assert.False(t, call.JSONMode, "json:false must not enable JSON mode")
+	assert.Nil(t, call.N, "n:0 must not reach the request as an explicit parameter")
+	assert.Empty(t, call.ResponseMIMEType)
+}
+
+// The shipped simple_json default carries `json: true`; saving a provider through the UI used to
+// strip it, so the reloaded config called the LLM without JSON mode while the built-in one did not.
+func TestShippedSimpleJSONKeepsJSONModeThroughTheGraphQLRoundTrip(t *testing.T) {
+	pc, err := openai.DefaultProviderConfig()
+	require.NoError(t, err)
+	require.NotNil(t, pc.SimpleJSON)
+	require.True(t, pc.SimpleJSON.JSON, "the shipped default is what makes this test meaningful")
+
+	gql := ConvertProviderConfigToGqlModel(pc)
+	require.NotNil(t, gql)
+
+	restored := ConvertAgentsConfigFromGqlModel(gql)
+	require.NotNil(t, restored)
+	require.NotNil(t, restored.SimpleJSON)
+
+	call := llms.CallOptions{}
+	for _, option := range restored.SimpleJSON.BuildOptions() {
+		option(&call)
+	}
+
+	assert.True(t, call.JSONMode, "the simple_json agent must still ask for JSON mode after a save")
+}
diff --git a/backend/pkg/database/database.go b/backend/pkg/database/database.go
index 96abc95a..1c4222d6 100644
--- a/backend/pkg/database/database.go
+++ b/backend/pkg/database/database.go
@@ -70,15 +70,13 @@ func SanitizeUTF8(msg string) string {
 	}
 
 	var builder strings.Builder
-	builder.Grow(len(msg)) // Pre-allocate for efficiency
+	builder.Grow(len(msg))
 
 	for i := 0; i < len(msg); {
-		// Explicitly skip null bytes
 		if msg[i] == '\x00' {
 			i++
 			continue
 		}
-		// Decode rune and check for errors
 		r, size := utf8.DecodeRuneInString(msg[i:])
 		if r == utf8.RuneError && size == 1 {
 			// Invalid UTF-8 byte, replace with Unicode replacement character
diff --git a/backend/pkg/graph/generated.go b/backend/pkg/graph/generated.go
index e6c1ac11..aac0cce2 100644
--- a/backend/pkg/graph/generated.go
+++ b/backend/pkg/graph/generated.go
@@ -78,14 +78,18 @@ type ComplexityRoot struct {
 	AgentConfig struct {
 		ExtraBody         func(childComplexity int) int
 		FrequencyPenalty  func(childComplexity int) int
+		JSON              func(childComplexity int) int
 		MaxLength         func(childComplexity int) int
 		MaxTokens         func(childComplexity int) int
 		MinLength         func(childComplexity int) int
+		MinP              func(childComplexity int) int
 		Model             func(childComplexity int) int
+		N                 func(childComplexity int) int
 		PresencePenalty   func(childComplexity int) int
 		Price             func(childComplexity int) int
 		Reasoning         func(childComplexity int) int
 		RepetitionPenalty func(childComplexity int) int
+		ResponseMimeType  func(childComplexity int) int
 		Temperature       func(childComplexity int) int
 		TopK              func(childComplexity int) int
 		TopP              func(childComplexity int) int
@@ -1035,6 +1039,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.AgentConfig.FrequencyPenalty(childComplexity), true
 
+	case "AgentConfig.json":
+		if e.complexity.AgentConfig.JSON == nil {
+			break
+		}
+
+		return e.complexity.AgentConfig.JSON(childComplexity), true
+
 	case "AgentConfig.maxLength":
 		if e.complexity.AgentConfig.MaxLength == nil {
 			break
@@ -1056,6 +1067,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.AgentConfig.MinLength(childComplexity), true
 
+	case "AgentConfig.minP":
+		if e.complexity.AgentConfig.MinP == nil {
+			break
+		}
+
+		return e.complexity.AgentConfig.MinP(childComplexity), true
+
 	case "AgentConfig.model":
 		if e.complexity.AgentConfig.Model == nil {
 			break
@@ -1063,6 +1081,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.AgentConfig.Model(childComplexity), true
 
+	case "AgentConfig.n":
+		if e.complexity.AgentConfig.N == nil {
+			break
+		}
+
+		return e.complexity.AgentConfig.N(childComplexity), true
+
 	case "AgentConfig.presencePenalty":
 		if e.complexity.AgentConfig.PresencePenalty == nil {
 			break
@@ -1091,6 +1116,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.AgentConfig.RepetitionPenalty(childComplexity), true
 
+	case "AgentConfig.responseMimeType":
+		if e.complexity.AgentConfig.ResponseMimeType == nil {
+			break
+		}
+
+		return e.complexity.AgentConfig.ResponseMimeType(childComplexity), true
+
 	case "AgentConfig.temperature":
 		if e.complexity.AgentConfig.Temperature == nil {
 			break
@@ -9776,6 +9808,170 @@ func (ec *executionContext) fieldContext_AgentConfig_presencePenalty(_ context.C
 	return fc, nil
 }
 
+func (ec *executionContext) _AgentConfig_minP(ctx context.Context, field graphql.CollectedField, obj *model.AgentConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_AgentConfig_minP(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.MinP, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*float64)
+	fc.Result = res
+	return ec.marshalOFloat2ᚖfloat64(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_AgentConfig_minP(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AgentConfig",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Float does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AgentConfig_n(ctx context.Context, field graphql.CollectedField, obj *model.AgentConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_AgentConfig_n(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.N, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*int)
+	fc.Result = res
+	return ec.marshalOInt2ᚖint(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_AgentConfig_n(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AgentConfig",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Int does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AgentConfig_json(ctx context.Context, field graphql.CollectedField, obj *model.AgentConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_AgentConfig_json(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.JSON, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*bool)
+	fc.Result = res
+	return ec.marshalOBoolean2ᚖbool(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_AgentConfig_json(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AgentConfig",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AgentConfig_responseMimeType(ctx context.Context, field graphql.CollectedField, obj *model.AgentConfig) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.ResponseMimeType, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*string)
+	fc.Result = res
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_AgentConfig_responseMimeType(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AgentConfig",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _AgentConfig_reasoning(ctx context.Context, field graphql.CollectedField, obj *model.AgentConfig) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_AgentConfig_reasoning(ctx, field)
 	if err != nil {
@@ -10684,6 +10880,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_simple(_ context.Context,
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -10756,6 +10960,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_simpleJson(_ context.Conte
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -10828,6 +11040,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_primaryAgent(_ context.Con
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -10900,6 +11120,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_assistant(_ context.Contex
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -10972,6 +11200,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_generator(_ context.Contex
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -11044,6 +11280,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_refiner(_ context.Context,
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -11116,6 +11360,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_adviser(_ context.Context,
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -11188,6 +11440,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_reflector(_ context.Contex
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -11260,6 +11520,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_searcher(_ context.Context
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -11332,6 +11600,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_enricher(_ context.Context
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -11404,6 +11680,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_coder(_ context.Context, f
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -11476,6 +11760,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_installer(_ context.Contex
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -11548,6 +11840,14 @@ func (ec *executionContext) fieldContext_AgentsConfig_pentester(_ context.Contex
 				return ec.fieldContext_AgentConfig_frequencyPenalty(ctx, field)
 			case "presencePenalty":
 				return ec.fieldContext_AgentConfig_presencePenalty(ctx, field)
+			case "minP":
+				return ec.fieldContext_AgentConfig_minP(ctx, field)
+			case "n":
+				return ec.fieldContext_AgentConfig_n(ctx, field)
+			case "json":
+				return ec.fieldContext_AgentConfig_json(ctx, field)
+			case "responseMimeType":
+				return ec.fieldContext_AgentConfig_responseMimeType(ctx, field)
 			case "reasoning":
 				return ec.fieldContext_AgentConfig_reasoning(ctx, field)
 			case "price":
@@ -36725,7 +37025,7 @@ func (ec *executionContext) unmarshalInputAgentConfigInput(ctx context.Context,
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"model", "maxTokens", "temperature", "topK", "topP", "minLength", "maxLength", "repetitionPenalty", "frequencyPenalty", "presencePenalty", "reasoning", "price", "extraBody"}
+	fieldsInOrder := [...]string{"model", "maxTokens", "temperature", "topK", "topP", "minLength", "maxLength", "repetitionPenalty", "frequencyPenalty", "presencePenalty", "minP", "n", "json", "responseMimeType", "reasoning", "price", "extraBody"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -36802,6 +37102,34 @@ func (ec *executionContext) unmarshalInputAgentConfigInput(ctx context.Context,
 				return it, err
 			}
 			it.PresencePenalty = data
+		case "minP":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("minP"))
+			data, err := ec.unmarshalOFloat2ᚖfloat64(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.MinP = data
+		case "n":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("n"))
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.N = data
+		case "json":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("json"))
+			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.JSON = data
+		case "responseMimeType":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("responseMimeType"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ResponseMimeType = data
 		case "reasoning":
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("reasoning"))
 			data, err := ec.unmarshalOReasoningConfigInput2ᚖpentagiᚋpkgᚋgraphᚋmodelᚐReasoningConfig(ctx, v)
@@ -37564,6 +37892,14 @@ func (ec *executionContext) _AgentConfig(ctx context.Context, sel ast.SelectionS
 			out.Values[i] = ec._AgentConfig_frequencyPenalty(ctx, field, obj)
 		case "presencePenalty":
 			out.Values[i] = ec._AgentConfig_presencePenalty(ctx, field, obj)
+		case "minP":
+			out.Values[i] = ec._AgentConfig_minP(ctx, field, obj)
+		case "n":
+			out.Values[i] = ec._AgentConfig_n(ctx, field, obj)
+		case "json":
+			out.Values[i] = ec._AgentConfig_json(ctx, field, obj)
+		case "responseMimeType":
+			out.Values[i] = ec._AgentConfig_responseMimeType(ctx, field, obj)
 		case "reasoning":
 			out.Values[i] = ec._AgentConfig_reasoning(ctx, field, obj)
 		case "price":
diff --git a/backend/pkg/graph/model/models_gen.go b/backend/pkg/graph/model/models_gen.go
index ebfb1370..37872d2b 100644
--- a/backend/pkg/graph/model/models_gen.go
+++ b/backend/pkg/graph/model/models_gen.go
@@ -45,6 +45,10 @@ type AgentConfig struct {
 	RepetitionPenalty *float64               `json:"repetitionPenalty,omitempty"`
 	FrequencyPenalty  *float64               `json:"frequencyPenalty,omitempty"`
 	PresencePenalty   *float64               `json:"presencePenalty,omitempty"`
+	MinP              *float64               `json:"minP,omitempty"`
+	N                 *int                   `json:"n,omitempty"`
+	JSON              *bool                  `json:"json,omitempty"`
+	ResponseMimeType  *string                `json:"responseMimeType,omitempty"`
 	Reasoning         *ReasoningConfig       `json:"reasoning,omitempty"`
 	Price             *ModelPrice            `json:"price,omitempty"`
 	ExtraBody         map[string]interface{} `json:"extraBody,omitempty"`
diff --git a/backend/pkg/graph/schema.graphqls b/backend/pkg/graph/schema.graphqls
index 7fb3f410..863d7011 100644
--- a/backend/pkg/graph/schema.graphqls
+++ b/backend/pkg/graph/schema.graphqls
@@ -815,6 +815,10 @@ type AgentConfig {
   repetitionPenalty: Float
   frequencyPenalty: Float
   presencePenalty: Float
+  minP: Float
+  n: Int
+  json: Boolean
+  responseMimeType: String
   reasoning: ReasoningConfig
   price: ModelPrice
   extraBody: Map
@@ -866,6 +870,10 @@ input AgentConfigInput {
   repetitionPenalty: Float
   frequencyPenalty: Float
   presencePenalty: Float
+  minP: Float
+  n: Int
+  json: Boolean
+  responseMimeType: String
   reasoning: ReasoningConfigInput
   price: ModelPriceInput
   extraBody: Map
diff --git a/backend/pkg/graph/schema.resolvers.go b/backend/pkg/graph/schema.resolvers.go
index d285d0ef..9eb0d6cf 100644
--- a/backend/pkg/graph/schema.resolvers.go
+++ b/backend/pkg/graph/schema.resolvers.go
@@ -257,7 +257,6 @@ func (r *mutationResolver) RenameFlow(ctx context.Context, flowID int64, title s
 
 	err = r.Controller.RenameFlow(ctx, flowID, title)
 	if errors.Is(err, controller.ErrFlowNotFound) {
-		// if flow worker not found, update flow title in DB and notify about it
 		flow, err := r.DB.UpdateFlowTitle(ctx, database.UpdateFlowTitleParams{
 			ID:    flowID,
 			Title: title,
@@ -1956,7 +1955,6 @@ func (r *queryResolver) FlowsExecutionStatsByPeriod(ctx context.Context, period
 		"period": period,
 	}).Debug("get flows execution stats by period")
 
-	// Step 1: Get flows for the period
 	type flowInfo struct {
 		ID    int64
 		Title string
@@ -1992,23 +1990,19 @@ func (r *queryResolver) FlowsExecutionStatsByPeriod(ctx context.Context, period
 		return nil, fmt.Errorf("unsupported period: %s", period)
 	}
 
-	// Step 2: Build stats for each flow using analytics functions
 	result := make([]*model.FlowExecutionStats, 0, len(flows))
 
 	for _, flow := range flows {
-		// Get raw data for this flow
 		tasks, err := r.DB.GetTasksForFlow(ctx, flow.ID)
 		if err != nil {
 			return nil, err
 		}
 
-		// Collect task IDs
 		taskIDs := make([]int64, len(tasks))
 		for i, task := range tasks {
 			taskIDs[i] = task.ID
 		}
 
-		// Get subtasks for all tasks
 		var subtasks []database.GetSubtasksForTasksRow
 		if len(taskIDs) > 0 {
 			subtasks, err = r.DB.GetSubtasksForTasks(ctx, taskIDs)
@@ -2017,25 +2011,21 @@ func (r *queryResolver) FlowsExecutionStatsByPeriod(ctx context.Context, period
 			}
 		}
 
-		// Get msgchains for the flow
 		msgchains, err := r.DB.GetMsgchainsForFlow(ctx, flow.ID)
 		if err != nil {
 			return nil, err
 		}
 
-		// Get toolcalls for the flow
 		toolcalls, err := r.DB.GetToolcallsForFlow(ctx, flow.ID)
 		if err != nil {
 			return nil, err
 		}
 
-		// Get assistants count for the flow
 		assistantsCount, err := r.DB.GetAssistantsCountForFlow(ctx, flow.ID)
 		if err != nil {
 			return nil, err
 		}
 
-		// Build execution stats using analytics functions
 		flowStats := converter.BuildFlowExecutionStats(flow.ID, flow.Title, tasks, subtasks, msgchains, toolcalls, int(assistantsCount))
 		result = append(result, flowStats)
 	}
diff --git a/backend/pkg/graphiti/client.go b/backend/pkg/graphiti/client.go
index 3b4c2a43..3e648c24 100644
--- a/backend/pkg/graphiti/client.go
+++ b/backend/pkg/graphiti/client.go
@@ -45,6 +45,13 @@ type Client struct {
 	timeout time.Duration
 }
 
+// The verdict is permanent for the process: on failure the caller keeps a disabled client for its whole
+// lifetime, so one timeout against a slow endpoint must not decide it.
+const (
+	healthCheckAttempts = 3
+	healthCheckBackoff  = 2 * time.Second
+)
+
 // NewClient creates a new Graphiti client wrapper
 func NewClient(url string, timeout time.Duration, enabled bool) (*Client, error) {
 	if !enabled {
@@ -53,9 +60,17 @@ func NewClient(url string, timeout time.Duration, enabled bool) (*Client, error)
 
 	client := graphiti.NewClient(url, graphiti.WithTimeout(timeout))
 
-	_, err := client.HealthCheck()
-	if err != nil {
-		return nil, fmt.Errorf("graphiti health check failed: %w", err)
+	var err error
+	for attempt := 1; ; attempt++ {
+		if _, err = client.HealthCheck(); err == nil {
+			break
+		}
+
+		if attempt == healthCheckAttempts {
+			return nil, fmt.Errorf("graphiti health check failed after %d attempts: %w", attempt, err)
+		}
+
+		time.Sleep(healthCheckBackoff)
 	}
 
 	return &Client{
diff --git a/backend/pkg/graphiti/client_test.go b/backend/pkg/graphiti/client_test.go
index 4e5cc439..23a8e303 100644
--- a/backend/pkg/graphiti/client_test.go
+++ b/backend/pkg/graphiti/client_test.go
@@ -1,6 +1,9 @@
 package graphiti
 
 import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -148,3 +151,42 @@ func TestSearchMethods_Disabled(t *testing.T) {
 		})
 	}
 }
+
+func TestNewClient_RetriesAFlakyHealthCheck(t *testing.T) {
+	t.Parallel()
+
+	var probes atomic.Int32
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		if probes.Add(1) == 1 {
+			w.WriteHeader(http.StatusServiceUnavailable)
+
+			return
+		}
+
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"status":"ok"}`))
+	}))
+	defer server.Close()
+
+	client, err := NewClient(server.URL, 5*time.Second, true)
+	require.NoError(t, err)
+	assert.True(t, client.IsEnabled())
+	assert.EqualValues(t, 2, probes.Load(), "the first probe failed, so a second one had to run")
+}
+
+func TestNewClient_GivesUpAfterEveryAttemptFails(t *testing.T) {
+	t.Parallel()
+
+	var probes atomic.Int32
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		probes.Add(1)
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	defer server.Close()
+
+	_, err := NewClient(server.URL, 5*time.Second, true)
+	require.Error(t, err)
+	assert.EqualValues(t, healthCheckAttempts, probes.Load())
+}
diff --git a/backend/pkg/providers/custom/custom.go b/backend/pkg/providers/custom/custom.go
index 327822a9..5e52e275 100644
--- a/backend/pkg/providers/custom/custom.go
+++ b/backend/pkg/providers/custom/custom.go
@@ -92,10 +92,8 @@ func New(
 		return nil, err
 	}
 
-	// Use centralized model loading with prefix filtering
 	models, err := provider.LoadModelsFromHTTP(baseURL, baseKey, httpClient, cfg.LLMServerProvider)
 	if err != nil {
-		// If loading fails, fallback to empty models list
 		models = pconfig.ModelsConfig{}
 	}
 
diff --git a/backend/pkg/providers/gemini/gemini_test.go b/backend/pkg/providers/gemini/gemini_test.go
index 04f81c44..bd95ffb6 100644
--- a/backend/pkg/providers/gemini/gemini_test.go
+++ b/backend/pkg/providers/gemini/gemini_test.go
@@ -250,7 +250,6 @@ func TestAPIKeyTransportRoundTrip(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// create mock round tripper that captures the request
 			var capturedReq *http.Request
 			mockRT := &mockRoundTripper{
 				roundTripFunc: func(req *http.Request) (*http.Response, error) {
@@ -270,7 +269,6 @@ func TestAPIKeyTransportRoundTrip(t *testing.T) {
 				ProxyURL:  "",
 			}
 
-			// create test request
 			reqURL := tt.requestURL
 			if tt.requestQuery != "" {
 				reqURL += "?" + tt.requestQuery
@@ -280,13 +278,11 @@ func TestAPIKeyTransportRoundTrip(t *testing.T) {
 				t.Fatalf("Failed to create request: %v", err)
 			}
 
-			// execute RoundTrip
 			_, err = transport.RoundTrip(req)
 			if err != nil {
 				t.Fatalf("RoundTrip failed: %v", err)
 			}
 
-			// verify captured request
 			if capturedReq == nil {
 				t.Fatal("Request was not captured")
 			}
diff --git a/backend/pkg/providers/pconfig/config.go b/backend/pkg/providers/pconfig/config.go
index fa5c6bdf..4e305e6b 100644
--- a/backend/pkg/providers/pconfig/config.go
+++ b/backend/pkg/providers/pconfig/config.go
@@ -432,7 +432,6 @@ func (mc *ModelConfig) UnmarshalJSON(data []byte) error {
 		return err
 	}
 
-	// Parse each field manually
 	if name, ok := raw["name"].(string); ok {
 		mc.Name = name
 	}
@@ -487,7 +486,6 @@ func (mc *ModelConfig) UnmarshalYAML(value *yaml.Node) error {
 		return err
 	}
 
-	// Parse each field manually
 	if name, ok := raw["name"].(string); ok {
 		mc.Name = name
 	}
@@ -763,7 +761,6 @@ func (ac *AgentConfig) marshalMap() map[string]any {
 		return nil
 	}
 
-	// use raw map if available, otherwise create a new one
 	if ac.raw != nil {
 		return ac.raw
 	}
diff --git a/backend/pkg/providers/performer.go b/backend/pkg/providers/performer.go
index 4e718e52..2ed993cf 100644
--- a/backend/pkg/providers/performer.go
+++ b/backend/pkg/providers/performer.go
@@ -70,7 +70,6 @@ func (fp *flowProvider) performAgentChain(
 		"msg_chain_id": chainID,
 	}))
 
-	// Track execution time for duration calculation
 	lastUpdateTime := time.Now()
 	rollLastUpdateTime := func() float64 {
 		durationDelta := time.Since(lastUpdateTime).Seconds()
diff --git a/backend/pkg/providers/performers.go b/backend/pkg/providers/performers.go
index d9748a82..1f35d34a 100644
--- a/backend/pkg/providers/performers.go
+++ b/backend/pkg/providers/performers.go
@@ -194,7 +194,6 @@ func (fp *flowProvider) performSubtasksRefiner(
 
 	logger.Debug("starting subtasks refiner")
 
-	// Track execution time for duration calculation
 	startTime := time.Now()
 
 	restoreChain := func(msgChain json.RawMessage) ([]llms.MessageContent, error) {
diff --git a/backend/pkg/providers/provider.go b/backend/pkg/providers/provider.go
index eb996c99..b1aab2ad 100644
--- a/backend/pkg/providers/provider.go
+++ b/backend/pkg/providers/provider.go
@@ -187,7 +187,6 @@ func (fp *flowProvider) SetProvider(ctx context.Context, newProvider provider.Pr
 	fp.mx.Lock()
 	defer fp.mx.Unlock()
 
-	// Update provider-specific fields
 	fp.Provider = newProvider
 
 	var err error
diff --git a/backend/pkg/providers/provider/agents.go b/backend/pkg/providers/provider/agents.go
index ba21fb40..3cd3f4f3 100644
--- a/backend/pkg/providers/provider/agents.go
+++ b/backend/pkg/providers/provider/agents.go
@@ -57,30 +57,23 @@ func testTemplate(
 	prompter templates.Prompter,
 	template string,
 ) bool {
-	// If no template provided, skip validation
 	if template == "" {
 		return false
 	}
 
-	// Collect one sample to validate the template
 	samples, err := runToolCallIDCollector(ctx, provider, opt, prompter)
 	if err != nil {
-		// Any error means validation failed
 		return false
 	}
 
-	// If no samples collected, validation failed
 	if len(samples) == 0 {
 		return false
 	}
 
-	// Validate the template against collected samples
 	if err := templates.ValidatePattern(template, samples); err != nil {
-		// Template doesn't match
 		return false
 	}
 
-	// Template validated successfully
 	return true
 }
 
diff --git a/backend/pkg/providers/subtask_patch.go b/backend/pkg/providers/subtask_patch.go
index ae468452..ae9baf57 100644
--- a/backend/pkg/providers/subtask_patch.go
+++ b/backend/pkg/providers/subtask_patch.go
@@ -24,7 +24,6 @@ func applySubtaskOperations(
 		"message":          patch.Message,
 	}).Debug("applying subtask operations")
 
-	// Fix the patch to ensure it is valid
 	patch = fixSubtaskPatch(planned, patch)
 
 	// Convert database.Subtask to tools.SubtaskInfo with IDs
diff --git a/backend/pkg/server/auth/api_token_cache.go b/backend/pkg/server/auth/api_token_cache.go
index 9f3d196f..fc5260a1 100644
--- a/backend/pkg/server/auth/api_token_cache.go
+++ b/backend/pkg/server/auth/api_token_cache.go
@@ -39,25 +39,20 @@ func (tc *TokenCache) SetTTL(ttl time.Duration) {
 
 // GetStatus retrieves token status and privileges from cache or database
 func (tc *TokenCache) GetStatus(tokenID string) (models.TokenStatus, []string, error) {
-	// check cache first
 	if entry, ok := tc.cache.Load(tokenID); ok {
 		cached := entry.(tokenCacheEntry)
 		if time.Now().Before(cached.expiresAt) {
-			// return cached "not found" error
 			if cached.notFound {
 				return "", nil, gorm.ErrRecordNotFound
 			}
 			return cached.status, cached.privileges, nil
 		}
-		// cache entry expired, remove it
 		tc.cache.Delete(tokenID)
 	}
 
-	// load from database with role privileges
 	var token models.APIToken
 	if err := tc.db.Where("token_id = ? AND deleted_at IS NULL", tokenID).First(&token).Error; err != nil {
 		if gorm.IsRecordNotFoundError(err) {
-			// cache negative result (token not found)
 			tc.cache.Store(tokenID, tokenCacheEntry{
 				notFound:  true,
 				expiresAt: time.Now().Add(tc.ttl),
@@ -67,13 +62,11 @@ func (tc *TokenCache) GetStatus(tokenID string) (models.TokenStatus, []string, e
 		return "", nil, err
 	}
 
-	// load privileges for the token's role
 	var privileges []models.Privilege
 	if err := tc.db.Where("role_id = ?", token.RoleID).Find(&privileges).Error; err != nil {
 		return "", nil, err
 	}
 
-	// extract privilege names
 	privNames := make([]string, len(privileges))
 	for i, priv := range privileges {
 		privNames[i] = priv.Name
@@ -82,7 +75,6 @@ func (tc *TokenCache) GetStatus(tokenID string) (models.TokenStatus, []string, e
 	// always add automation privilege for API tokens
 	privNames = append(privNames, PrivilegeAutomation)
 
-	// update cache with positive result
 	tc.cache.Store(tokenID, tokenCacheEntry{
 		status:     token.Status,
 		privileges: privNames,
@@ -100,13 +92,11 @@ func (tc *TokenCache) Invalidate(tokenID string) {
 
 // InvalidateUser removes all tokens for a specific user from cache
 func (tc *TokenCache) InvalidateUser(userID uint64) {
-	// load all tokens for this user
 	var tokens []models.APIToken
 	if err := tc.db.Where("user_id = ? AND deleted_at IS NULL", userID).Find(&tokens).Error; err != nil {
 		return
 	}
 
-	// invalidate each token in cache
 	for _, token := range tokens {
 		tc.cache.Delete(token.TokenID)
 	}
diff --git a/backend/pkg/server/auth/auth_middleware.go b/backend/pkg/server/auth/auth_middleware.go
index 266e907d..ab175614 100644
--- a/backend/pkg/server/auth/auth_middleware.go
+++ b/backend/pkg/server/auth/auth_middleware.go
@@ -123,7 +123,6 @@ func (p *AuthMiddleware) tryUserCookieAuthentication(c *gin.Context) (authResult
 		return authResultFail, errors.New("no permissions granted")
 	}
 
-	// Verify session expiration
 	expVal, ok := exp.(int64)
 	if !ok {
 		return authResultFail, errors.New("token claim invalid")
diff --git a/backend/pkg/server/auth/session.go b/backend/pkg/server/auth/session.go
index e7563c46..26cc9df6 100644
--- a/backend/pkg/server/auth/session.go
+++ b/backend/pkg/server/auth/session.go
@@ -22,7 +22,6 @@ const (
 
 // MakeCookieStoreKey is function to generate auth and encryption keys for cookie store
 func MakeCookieStoreKey(globalSalt string) [][]byte {
-	// Check cache for existing keys
 	if cached, ok := cookieStoreKeys.Load(globalSalt); ok {
 		return cached.([][]byte)
 	}
@@ -51,7 +50,6 @@ func MakeCookieStoreKey(globalSalt string) [][]byte {
 
 // MakeJWTSigningKey is function to generate signing key for JWT tokens
 func MakeJWTSigningKey(globalSalt string) []byte {
-	// Check cache for existing key
 	if cached, ok := jwtSigningKeys.Load(globalSalt); ok {
 		return cached.([]byte)
 	}
diff --git a/backend/pkg/server/auth/users_cache.go b/backend/pkg/server/auth/users_cache.go
index a3ec9dc0..7263dc8d 100644
--- a/backend/pkg/server/auth/users_cache.go
+++ b/backend/pkg/server/auth/users_cache.go
@@ -39,25 +39,20 @@ func (uc *UserCache) SetTTL(ttl time.Duration) {
 
 // GetUserHash retrieves user hash and status from cache or database
 func (uc *UserCache) GetUserHash(userID uint64) (string, models.UserStatus, error) {
-	// check cache first
 	if entry, ok := uc.cache.Load(userID); ok {
 		cached := entry.(userCacheEntry)
 		if time.Now().Before(cached.expiresAt) {
-			// return cached "not found" error
 			if cached.notFound {
 				return "", "", gorm.ErrRecordNotFound
 			}
 			return cached.hash, cached.status, nil
 		}
-		// cache entry expired, remove it
 		uc.cache.Delete(userID)
 	}
 
-	// load from database
 	var user models.User
 	if err := uc.db.Where("id = ?", userID).First(&user).Error; err != nil {
 		if gorm.IsRecordNotFoundError(err) {
-			// cache negative result (user not found)
 			uc.cache.Store(userID, userCacheEntry{
 				notFound:  true,
 				expiresAt: time.Now().Add(uc.ttl),
@@ -67,7 +62,6 @@ func (uc *UserCache) GetUserHash(userID uint64) (string, models.UserStatus, erro
 		return "", "", err
 	}
 
-	// update cache with positive result
 	uc.cache.Store(userID, userCacheEntry{
 		hash:      user.Hash,
 		status:    user.Status,
diff --git a/backend/pkg/server/models/init.go b/backend/pkg/server/models/init.go
index 1847252d..9db52973 100644
--- a/backend/pkg/server/models/init.go
+++ b/backend/pkg/server/models/init.go
@@ -87,6 +87,22 @@ func strongPasswordValidatorString() validator.Func {
 	}
 }
 
+// MaxPasswordBytes is the longest password bcrypt.GenerateFromPassword accepts.
+const MaxPasswordBytes = 72
+
+func passwordLengthValidatorString() validator.Func {
+	return func(fl validator.FieldLevel) bool {
+		field := fl.Field()
+
+		switch field.Kind() {
+		case reflect.String:
+			return len(field.String()) <= MaxPasswordBytes
+		default:
+			return false
+		}
+	}
+}
+
 var emailFormatRegex = regexp.MustCompile(`^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$`)
 
 func isRealEmail(email string) bool {
@@ -223,6 +239,7 @@ func init() {
 	_ = validate.RegisterValidation("semver", templateValidatorString(semverRegexString))
 	_ = validate.RegisterValidation("semverex", templateValidatorString(semverexRegexString))
 	_ = validate.RegisterValidation("stpass", strongPasswordValidatorString())
+	_ = validate.RegisterValidation("passlen", passwordLengthValidatorString())
 	_ = validate.RegisterValidation("vmail", emailValidatorString())
 	_ = validate.RegisterValidation("realemail", strictEmailValidatorString())
 	_ = validate.RegisterValidation("oauth_min_scope", oauthMinScope())
diff --git a/backend/pkg/server/models/users.go b/backend/pkg/server/models/users.go
index d5486e4a..f53698b5 100644
--- a/backend/pkg/server/models/users.go
+++ b/backend/pkg/server/models/users.go
@@ -103,7 +103,7 @@ func (u User) Validate(db *gorm.DB) {
 
 // UserPassword is model to contain user information
 type UserPassword struct {
-	Password string `form:"password" json:"password" validate:"max=100,required" gorm:"column:password;type:TEXT"`
+	Password string `form:"password" json:"password" validate:"passlen,required" gorm:"column:password;type:TEXT"`
 	User     `form:"" json:""`
 }
 
@@ -168,7 +168,7 @@ func (au AuthCallback) Valid() error {
 // nolint:lll
 type Password struct {
 	CurrentPassword string `form:"current_password" json:"current_password" validate:"nefield=Password,min=5,max=100,required" gorm:"-"`
-	Password        string `form:"password" json:"password" validate:"stpass,max=100,required" gorm:"type:TEXT"`
+	Password        string `form:"password" json:"password" validate:"stpass,passlen,required" gorm:"type:TEXT"`
 	ConfirmPassword string `form:"confirm_password" json:"confirm_password" validate:"eqfield=Password" gorm:"-"`
 }
 
diff --git a/backend/pkg/server/models/users_test.go b/backend/pkg/server/models/users_test.go
index 7c6fde29..55922957 100644
--- a/backend/pkg/server/models/users_test.go
+++ b/backend/pkg/server/models/users_test.go
@@ -1,6 +1,7 @@
 package models
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -196,6 +197,24 @@ func TestPasswordValid(t *testing.T) {
 			},
 			wantErr: true,
 		},
+		{
+			name: "new password at the bcrypt limit",
+			pw: Password{
+				CurrentPassword: "OldPass1!abc",
+				Password:        strings.Repeat("a", MaxPasswordBytes),
+				ConfirmPassword: strings.Repeat("a", MaxPasswordBytes),
+			},
+			wantErr: false,
+		},
+		{
+			name: "new password over the bcrypt limit",
+			pw: Password{
+				CurrentPassword: "OldPass1!abc",
+				Password:        strings.Repeat("a", MaxPasswordBytes+1),
+				ConfirmPassword: strings.Repeat("a", MaxPasswordBytes+1),
+			},
+			wantErr: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -309,6 +328,52 @@ func TestUserPasswordValid(t *testing.T) {
 		}
 		assert.Error(t, up.Valid())
 	})
+
+	for _, tc := range []struct {
+		name    string
+		length  int
+		wantErr bool
+	}{
+		{name: "password at the bcrypt limit", length: MaxPasswordBytes, wantErr: false},
+		{name: "password over the bcrypt limit", length: MaxPasswordBytes + 1, wantErr: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			up := UserPassword{
+				Password: strings.Repeat("a", tc.length),
+				User: User{
+					ID:     1,
+					Hash:   "abcdef1234567890abcdef1234567890",
+					Type:   UserTypeLocal,
+					Mail:   "test@example.com",
+					Status: UserStatusActive,
+					RoleID: RoleUser,
+				},
+			}
+			if tc.wantErr {
+				assert.Error(t, up.Valid())
+			} else {
+				assert.NoError(t, up.Valid())
+			}
+		})
+	}
+
+	t.Run("multibyte password within the rune count but over the byte limit", func(t *testing.T) {
+		t.Parallel()
+		up := UserPassword{
+			// 40 runes, 80 bytes: a rune-counting `max=72` would let this through.
+			Password: strings.Repeat("é", 40),
+			User: User{
+				ID:     1,
+				Hash:   "abcdef1234567890abcdef1234567890",
+				Type:   UserTypeLocal,
+				Mail:   "test@example.com",
+				Status: UserStatusActive,
+				RoleID: RoleUser,
+			},
+		}
+		assert.Error(t, up.Valid())
+	})
 }
 
 func TestUserPasswordTableName(t *testing.T) {
diff --git a/backend/pkg/server/services/api_tokens.go b/backend/pkg/server/services/api_tokens.go
index 653a1c42..75ace985 100644
--- a/backend/pkg/server/services/api_tokens.go
+++ b/backend/pkg/server/services/api_tokens.go
@@ -56,7 +56,6 @@ func NewTokenService(
 // @Failure 500 {object} response.errorResp "internal error on creating token"
 // @Router /tokens [post]
 func (s *TokenService) CreateToken(c *gin.Context) {
-	// check for default salt
 	if s.globalSalt == "" || s.globalSalt == "salt" {
 		logger.FromContext(c).Errorf("token creation attempted with default salt")
 		response.Error(c, response.ErrTokenCreationDisabled, errors.New("token creation is disabled with default salt"))
@@ -79,7 +78,6 @@ func (s *TokenService) CreateToken(c *gin.Context) {
 		return
 	}
 
-	// check if name is unique for this user (if provided)
 	if req.Name != nil && *req.Name != "" {
 		var existing models.APIToken
 		err := s.db.
@@ -93,7 +91,6 @@ func (s *TokenService) CreateToken(c *gin.Context) {
 		}
 	}
 
-	// generate token_id
 	tokenID, err := auth.GenerateTokenID()
 	if err != nil {
 		logger.FromContext(c).WithError(err).Errorf("error generating token ID")
@@ -101,10 +98,8 @@ func (s *TokenService) CreateToken(c *gin.Context) {
 		return
 	}
 
-	// create JWT claims
 	claims := auth.MakeAPITokenClaims(tokenID, uhash, uid, rid, req.TTL)
 
-	// sign token
 	token, err := auth.MakeAPIToken(s.globalSalt, claims)
 	if err != nil {
 		logger.FromContext(c).WithError(err).Errorf("error signing token")
@@ -112,7 +107,6 @@ func (s *TokenService) CreateToken(c *gin.Context) {
 		return
 	}
 
-	// save to database
 	apiToken := models.APIToken{
 		TokenID: tokenID,
 		UserID:  uid,
@@ -162,10 +156,8 @@ func (s *TokenService) ListTokens(c *gin.Context) {
 
 	query := s.db.Where("deleted_at IS NULL")
 
-	// check if user has admin privilege
 	hasAdmin := auth.LookupPerm(prms, "settings.tokens.admin")
 	if !hasAdmin {
-		// regular user sees only their own tokens
 		query = query.Where("user_id = ?", uid)
 	}
 
@@ -220,7 +212,6 @@ func (s *TokenService) GetToken(c *gin.Context) {
 		return
 	}
 
-	// check authorization
 	hasAdmin := auth.LookupPerm(prms, "settings.tokens.admin")
 	if !hasAdmin && token.UserID != uid {
 		logger.FromContext(c).Errorf("user %d attempted to access token of user %d", uid, token.UserID)
@@ -283,7 +274,6 @@ func (s *TokenService) UpdateToken(c *gin.Context) {
 		return
 	}
 
-	// check authorization
 	hasAdmin := auth.LookupPerm(prms, "settings.tokens.admin")
 	if !hasAdmin && token.UserID != uid {
 		logger.FromContext(c).Errorf("user %d attempted to update token of user %d", uid, token.UserID)
@@ -291,10 +281,8 @@ func (s *TokenService) UpdateToken(c *gin.Context) {
 		return
 	}
 
-	// update fields
 	updates := make(map[string]any)
 	if req.Name != nil {
-		// check uniqueness if name is changing
 		if token.Name == nil || *token.Name != *req.Name {
 			if *req.Name != "" {
 				var existing models.APIToken
@@ -327,14 +315,12 @@ func (s *TokenService) UpdateToken(c *gin.Context) {
 			return
 		}
 
-		// invalidate cache if status changed
 		if req.Status != "" {
 			s.tokenCache.Invalidate(tokenID)
 			// also invalidate all tokens for this user (in case of role change or security event)
 			s.tokenCache.InvalidateUser(token.UserID)
 		}
 
-		// reload token
 		if err := s.db.Where("token_id = ?", tokenID).First(&token).Error; err != nil {
 			logger.FromContext(c).WithError(err).Errorf("error reloading token")
 			response.Error(c, response.ErrInternal, err)
@@ -381,7 +367,6 @@ func (s *TokenService) DeleteToken(c *gin.Context) {
 		return
 	}
 
-	// check authorization
 	hasAdmin := auth.LookupPerm(prms, "settings.tokens.admin")
 	if !hasAdmin && token.UserID != uid {
 		logger.FromContext(c).Errorf("user %d attempted to delete token of user %d", uid, token.UserID)
@@ -396,7 +381,6 @@ func (s *TokenService) DeleteToken(c *gin.Context) {
 		return
 	}
 
-	// invalidate cache for this token and all user's tokens
 	s.tokenCache.Invalidate(tokenID)
 	s.tokenCache.InvalidateUser(token.UserID)
 
diff --git a/backend/pkg/terminal/output.go b/backend/pkg/terminal/output.go
index 51b9b077..75ddd631 100644
--- a/backend/pkg/terminal/output.go
+++ b/backend/pkg/terminal/output.go
@@ -151,14 +151,11 @@ func RenderMarkdown(markdown string) {
 
 // InteractivePromptContext prompts the user for input with support for context cancellation
 func InteractivePromptContext(ctx context.Context, message string, reader io.Reader) (string, error) {
-	// Display the prompt
 	infoColor.Printf("%s: ", message)
 
-	// Create a channel for the user input
 	inputCh := make(chan string, 1)
 	errCh := make(chan error, 1)
 
-	// Start a goroutine to read user input
 	go func() {
 		// Use a buffered reader to properly handle input
 		r, ok := reader.(*os.File)
@@ -186,7 +183,6 @@ func InteractivePromptContext(ctx context.Context, message string, reader io.Rea
 		}
 	}()
 
-	// Wait for input or context cancellation
 	select {
 	case input := <-inputCh:
 		return input, nil
@@ -228,7 +224,6 @@ func GetYesNoInputContext(ctx context.Context, message string, reader io.Reader)
 
 // IsMarkdownContent checks if the input string is likely markdown content
 func IsMarkdownContent(content string) bool {
-	// Determine if content is likely markdown by checking for common indicators
 	if strings.HasPrefix(content, "#") ||
 		strings.Contains(content, "\n#") ||
 		strings.Contains(content, "[") && strings.Contains(content, "](") ||
diff --git a/backend/pkg/tools/browser.go b/backend/pkg/tools/browser.go
index 4f5f7f31..a3f2932e 100644
--- a/backend/pkg/tools/browser.go
+++ b/backend/pkg/tools/browser.go
@@ -42,7 +42,6 @@ var nonHTMLExtensions = []string{
 // isBinaryURL returns true when the URL points to a known non-HTML resource.
 func isBinaryURL(rawURL string) bool {
 	lower := strings.ToLower(rawURL)
-	// strip query string for extension matching
 	if idx := strings.Index(lower, "?"); idx != -1 {
 		lower = lower[:idx]
 	}
@@ -303,7 +302,6 @@ func (b *browser) resolveUrl(targetURL string) (*url.URL, error) {
 		host = u.Host
 	}
 
-	// determine if target is private or public
 	isPrivate := false
 
 	hostIP := net.ParseIP(host)
@@ -328,7 +326,6 @@ func (b *browser) resolveUrl(targetURL string) (*url.URL, error) {
 		}
 	}
 
-	// select appropriate scraper URL with fallback
 	var scraperURL string
 	if isPrivate {
 		scraperURL = b.scPrvURL
diff --git a/backend/pkg/tools/code.go b/backend/pkg/tools/code.go
index 238860f2..7891cb58 100644
--- a/backend/pkg/tools/code.go
+++ b/backend/pkg/tools/code.go
@@ -126,7 +126,6 @@ func (c *code) Handle(ctx context.Context, name string, args json.RawMessage) (s
 			"filters":       filters,
 		})
 
-		// Execute multiple queries and collect all documents
 		var allDocs []schema.Document
 		for i, query := range action.Questions {
 			queryLogger := logger.WithFields(logrus.Fields{
@@ -154,7 +153,6 @@ func (c *code) Handle(ctx context.Context, name string, args json.RawMessage) (s
 			"total_docs_before_dedup": len(allDocs),
 		}).Debug("all queries completed")
 
-		// Merge, deduplicate, sort by score, and limit results
 		docs := MergeAndDeduplicateDocs(allDocs, codeVectorStoreResultLimit)
 
 		logger.WithFields(logrus.Fields{
@@ -202,7 +200,6 @@ func (c *code) Handle(ctx context.Context, name string, args json.RawMessage) (s
 				logger.WithError(err).Error("failed to marshal filters")
 				return "", fmt.Errorf("failed to marshal filters: %w", err)
 			}
-			// Join all queries for logging
 			queriesText := strings.Join(action.Questions, "\n--------------------------------\n")
 			_, _ = c.vslp.PutLog(
 				ctx,
@@ -256,7 +253,6 @@ func (c *code) Handle(ctx context.Context, name string, args json.RawMessage) (s
 			"code":  action.Code[:min(len(action.Code), 1000)],
 		})
 
-		// Build common metadata for the document.
 		metadata := map[string]any{
 			"user_id":     c.userID,
 			"flow_id":     c.flowID,
diff --git a/backend/pkg/tools/executor.go b/backend/pkg/tools/executor.go
index f9385adc..e63df479 100644
--- a/backend/pkg/tools/executor.go
+++ b/backend/pkg/tools/executor.go
@@ -126,7 +126,6 @@ func (w *noopObservationWrapper) ctx() context.Context {
 }
 
 func (w *noopObservationWrapper) end(result string, err error, durationSeconds float64) {
-	// no-op
 }
 
 type customExecutor struct {
@@ -258,7 +257,6 @@ func (ce *customExecutor) Execute(
 		return fmt.Sprintf("failed to unmarshal '%s' tool call arguments: %v: fix it", name, err), nil
 	}
 
-	// Create observation based on tool type
 	toolType := GetToolType(name)
 	var obsWrapper observationWrapper
 
@@ -273,11 +271,9 @@ func (ce *customExecutor) Execute(
 		// Skip - handlers create RETRIEVER internally
 		obsWrapper = &noopObservationWrapper{context: ctx}
 	default:
-		// Unknown type - use no-op wrapper
 		obsWrapper = &noopObservationWrapper{context: ctx}
 	}
 
-	// Use context from observation wrapper
 	ctx = obsWrapper.ctx()
 
 	var err error
diff --git a/backend/pkg/tools/flow_manager.go b/backend/pkg/tools/flow_manager.go
index 00845104..e8d02102 100644
--- a/backend/pkg/tools/flow_manager.go
+++ b/backend/pkg/tools/flow_manager.go
@@ -838,7 +838,6 @@ func (t *patchFlowSubtasksTool) Handle(ctx context.Context, name string, args js
 		}
 	}
 
-	// Verify task_id belongs to this flow.
 	taskBelongsToFlow := false
 	for _, task := range tasks {
 		if task.ID == action.TaskID {
@@ -853,7 +852,6 @@ func (t *patchFlowSubtasksTool) Handle(ctx context.Context, name string, args js
 			action.TaskID, GetFlowStatusToolName)
 	}
 
-	// Verify there are planned subtasks to patch.
 	planned, err := t.db.GetTaskPlannedSubtasks(ctx, action.TaskID)
 	if err != nil {
 		return "", fmt.Errorf("failed to get planned subtasks for task %d: %w", action.TaskID, err)
diff --git a/backend/pkg/tools/graphiti_search.go b/backend/pkg/tools/graphiti_search.go
index 7e5c8b8d..fb9a8eaf 100644
--- a/backend/pkg/tools/graphiti_search.go
+++ b/backend/pkg/tools/graphiti_search.go
@@ -159,7 +159,6 @@ func (t *graphitiSearchTool) Handle(ctx context.Context, name string, args json.
 
 	searchArgs.Query = strings.TrimSpace(searchArgs.Query)
 
-	// Validate required parameters
 	if searchArgs.Query == "" {
 		logger.Error("query parameter is required")
 		return "", fmt.Errorf("query parameter is required")
@@ -169,7 +168,6 @@ func (t *graphitiSearchTool) Handle(ctx context.Context, name string, args json.
 		return "", fmt.Errorf("search_type parameter is required")
 	}
 
-	// Get group ID from flow context
 	groupID := fmt.Sprintf("flow-%d", t.flowID)
 
 	ctx, observation := obs.Observer.NewObservation(ctx)
@@ -199,7 +197,6 @@ func (t *graphitiSearchTool) Handle(ctx context.Context, name string, args json.
 		Time:    time.Now().UTC(),
 	}
 
-	// Route to appropriate search method
 	var (
 		err    error
 		result string
diff --git a/backend/pkg/tools/guide.go b/backend/pkg/tools/guide.go
index a0d304c5..04b6f4a7 100644
--- a/backend/pkg/tools/guide.go
+++ b/backend/pkg/tools/guide.go
@@ -123,7 +123,6 @@ func (g *guide) Handle(ctx context.Context, name string, args json.RawMessage) (
 			"type":          action.Type,
 		})
 
-		// Execute multiple queries and collect all documents
 		var allDocs []schema.Document
 		for i, query := range action.Questions {
 			queryLogger := logger.WithFields(logrus.Fields{
@@ -151,7 +150,6 @@ func (g *guide) Handle(ctx context.Context, name string, args json.RawMessage) (
 			"total_docs_before_dedup": len(allDocs),
 		}).Debug("all queries completed")
 
-		// Merge, deduplicate, sort by score, and limit results
 		docs := MergeAndDeduplicateDocs(allDocs, guideVectorStoreResultLimit)
 
 		logger.WithFields(logrus.Fields{
@@ -199,7 +197,6 @@ func (g *guide) Handle(ctx context.Context, name string, args json.RawMessage) (
 				logger.WithError(err).Error("failed to marshal filters")
 				return "", fmt.Errorf("failed to marshal filters: %w", err)
 			}
-			// Join all queries for logging
 			queriesText := strings.Join(action.Questions, "\n--------------------------------\n")
 			_, _ = g.vslp.PutLog(
 				ctx,
@@ -252,7 +249,6 @@ func (g *guide) Handle(ctx context.Context, name string, args json.RawMessage) (
 			"guide": action.Guide[:min(len(action.Guide), 1000)],
 		})
 
-		// Build common metadata for the document.
 		metadata := map[string]any{
 			"user_id":    g.userID,
 			"flow_id":    g.flowID,
diff --git a/backend/pkg/tools/memory.go b/backend/pkg/tools/memory.go
index 04aca6a7..2b779b23 100644
--- a/backend/pkg/tools/memory.go
+++ b/backend/pkg/tools/memory.go
@@ -111,7 +111,6 @@ func (m *memory) Handle(ctx context.Context, name string, args json.RawMessage)
 
 		logger = logger.WithFields(fields)
 
-		// Execute multiple queries and collect all documents
 		var allDocs []schema.Document
 		for i, query := range action.Questions {
 			queryLogger := logger.WithFields(logrus.Fields{
@@ -168,7 +167,6 @@ func (m *memory) Handle(ctx context.Context, name string, args json.RawMessage)
 			"total_docs_before_dedup": len(allDocs),
 		}).Debug("all queries completed")
 
-		// Merge, deduplicate, sort by score, and limit results
 		docs := MergeAndDeduplicateDocs(allDocs, memoryVectorStoreResultLimit)
 
 		logger.WithFields(logrus.Fields{
@@ -224,7 +222,6 @@ func (m *memory) Handle(ctx context.Context, name string, args json.RawMessage)
 				logger.WithError(err).Error("failed to marshal filters")
 				return "", fmt.Errorf("failed to marshal filters: %w", err)
 			}
-			// Join all queries for logging
 			queriesText := strings.Join(action.Questions, "\n--------------------------------\n")
 			_, _ = m.vslp.PutLog(
 				ctx,
diff --git a/backend/pkg/tools/memory_utils.go b/backend/pkg/tools/memory_utils.go
index 5d1b2b5c..719ed5eb 100644
--- a/backend/pkg/tools/memory_utils.go
+++ b/backend/pkg/tools/memory_utils.go
@@ -28,7 +28,6 @@ func MergeAndDeduplicateDocs(docs []schema.Document, maxDocs int) []schema.Docum
 	for _, doc := range docs {
 		hash := hashContent(doc.PageContent)
 
-		// If document with this hash already exists, keep the one with higher score
 		if existing, found := docMap[hash]; found {
 			if doc.Score > existing.Score {
 				docMap[hash] = doc
@@ -38,18 +37,15 @@ func MergeAndDeduplicateDocs(docs []schema.Document, maxDocs int) []schema.Docum
 		}
 	}
 
-	// Convert map to slice
 	result := make([]schema.Document, 0, len(docMap))
 	for _, doc := range docMap {
 		result = append(result, doc)
 	}
 
-	// Sort by score in descending order (highest score first)
 	sort.Slice(result, func(i, j int) bool {
 		return result[i].Score > result[j].Score
 	})
 
-	// Limit to maxDocs
 	if len(result) > maxDocs {
 		result = result[:maxDocs]
 	}
diff --git a/backend/pkg/tools/search.go b/backend/pkg/tools/search.go
index ab852d89..6af9a482 100644
--- a/backend/pkg/tools/search.go
+++ b/backend/pkg/tools/search.go
@@ -121,7 +121,6 @@ func (s *search) Handle(ctx context.Context, name string, args json.RawMessage)
 			"answer_type":   action.Type,
 		})
 
-		// Execute multiple queries and collect all documents
 		var allDocs []schema.Document
 		for i, query := range action.Questions {
 			queryLogger := logger.WithFields(logrus.Fields{
@@ -149,7 +148,6 @@ func (s *search) Handle(ctx context.Context, name string, args json.RawMessage)
 			"total_docs_before_dedup": len(allDocs),
 		}).Debug("all queries completed")
 
-		// Merge, deduplicate, sort by score, and limit results
 		docs := MergeAndDeduplicateDocs(allDocs, searchVectorStoreResultLimit)
 
 		logger.WithFields(logrus.Fields{
@@ -197,7 +195,6 @@ func (s *search) Handle(ctx context.Context, name string, args json.RawMessage)
 				logger.WithError(err).Error("failed to marshal filters")
 				return "", fmt.Errorf("failed to marshal filters: %w", err)
 			}
-			// Join all queries for logging
 			queriesText := strings.Join(action.Questions, "\n--------------------------------\n")
 			_, _ = s.vslp.PutLog(
 				ctx,
@@ -247,7 +244,6 @@ func (s *search) Handle(ctx context.Context, name string, args json.RawMessage)
 			"answer":      action.Answer[:min(len(action.Answer), 1000)],
 		})
 
-		// Build common metadata for the document.
 		metadata := map[string]any{
 			"user_id":     s.userID,
 			"flow_id":     s.flowID,
diff --git a/backend/pkg/tools/terminal.go b/backend/pkg/tools/terminal.go
index c1d2e8dc..503feb4a 100644
--- a/backend/pkg/tools/terminal.go
+++ b/backend/pkg/tools/terminal.go
@@ -192,14 +192,12 @@ func (t *terminal) ExecCommand(
 ) (string, error) {
 	containerName := PrimaryTerminalName(t.flowID)
 
-	// create options for starting the exec process
 	cmd := []string{
 		"sh",
 		"-c",
 		command,
 	}
 
-	// verify container runtime status
 	isRunning, err := t.dockerClient.IsContainerRunning(ctx, t.containerLID)
 	if err != nil {
 		return "", fmt.Errorf("runtime verification failed: %w", err)
@@ -265,7 +263,6 @@ func (t *terminal) getExecResult(ctx context.Context, id string, timeout time.Du
 		defer cancel()
 	}
 
-	// attach to the exec process
 	resp, err := t.dockerClient.ContainerExecAttach(ctx, id, container.ExecAttachOptions{
 		Tty: true,
 	})
diff --git a/backend/pkg/tools/tools.go b/backend/pkg/tools/tools.go
index fa2cd322..1d18c137 100644
--- a/backend/pkg/tools/tools.go
+++ b/backend/pkg/tools/tools.go
@@ -657,7 +657,6 @@ func (fte *flowToolsExecutor) findMissingInContainer(ctx context.Context, entrie
 		return nil, fmt.Errorf("file-check exec failed with exit code %d: %s", inspect.ExitCode, strings.TrimSpace(string(output)))
 	}
 
-	// Build a lookup map for O(1) access.
 	byContainerPath := make(map[string]fileSyncEntry, len(entries))
 	for _, e := range entries {
 		byContainerPath[e.containerPath] = e
diff --git a/docker-compose.yml b/docker-compose.yml
index cb5f26ce..790d219e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -190,7 +190,7 @@ services:
       - ${PENTAGI_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
       - ${PENTAGI_LLM_SERVER_CONFIG_PATH:-./example.custom.provider.yml}:/opt/pentagi/conf/custom.provider.yml
       - ${PENTAGI_OLLAMA_SERVER_CONFIG_PATH:-./example.ollama.provider.yml}:/opt/pentagi/conf/ollama.provider.yml
-      - ${BEDROCK_CONFIG_PATH:-./example.bedrock.provider.yml}:/opt/pentagi/conf/bedrock.provider.yml
+      - ${PENTAGI_BEDROCK_CONFIG_PATH:-./example.bedrock.provider.yml}:/opt/pentagi/conf/bedrock.provider.yml
       - ${PENTAGI_DOCKER_CERT_PATH:-./docker-ssl}:/opt/pentagi/docker/ssl
     user: root:root # while using docker.sock
     networks:
diff --git a/frontend/.gitignore b/frontend/.gitignore
index 866f0df2..74607e0d 100644
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@@ -25,6 +25,7 @@ ssl
 
 # Playwright
 e2e/test-results/
+test-results/
 e2e/playwright-report/
 e2e/blob-report/
 e2e/.auth/
diff --git a/frontend/docs/e2e.md b/frontend/docs/e2e.md
index 0fe088be..fc14a6a9 100644
--- a/frontend/docs/e2e.md
+++ b/frontend/docs/e2e.md
@@ -100,8 +100,19 @@ Key conventions:
   types — schema or operation drift fails `pnpm typescript`, not the runtime.
 - **The clock is pinned** (UTC, fixed epoch) on the mock tier: keep cassette
   timestamps on the `CASSETTE_EPOCH` day or date renders change under you.
-- **Unmatched calls fail the test** — the mock tier is hermetic by design;
-  nothing ever leaks to a real backend.
+- **Unmatched HTTP calls fail the test** — every GraphQL POST and REST call needs
+  a cassette entry or teardown fails. An unmatched _subscription_ is legal (a flow
+  page opens ~15 and a cassette mocks only the ones it cares about): it gets ack'd
+  silence, so a typo'd subscription key surfaces as a UI timeout, with the missed
+  operations in the `unmatched-subscriptions` report attachment. Either way nothing
+  reaches a real backend: the WebSocket is routed too, and the HTTP route is re-armed
+  on every page the context opens, so a popup (the report tabs) is mocked like the
+  page that opened it — Playwright does not inherit a page's routes into its popups.
+- **Downloads are the one hole in that.** The browser performs an `<a download>`
+  transfer outside the page, so no route — page- or context-scoped — is ever offered
+  it: it goes to the `vite preview` proxy and out to whatever `VITE_API_URL` names. A
+  mock-tier spec must therefore never start one — assert the anchor's `href`/`download`
+  (see `specs/crud/resources.spec.ts`) and leave the bytes to `specs/real/**`.
 - Assert errors via `pageerror`/`unhandledrejection` (`expectCleanPage`): the
   production bundle strips app console output, so console-based asserts are
   meaningless on the mock tier.
@@ -133,14 +144,15 @@ Two conventions the gate reserves:
 ## Stand tier (Tier 3)
 
 Runs the LLM-independent `@stand` smoke against a real deployment. It lives in its
-own workflow (`e2e-stand.yml`) so the PR gate never subscribes to `labeled`. Label a
-PR `e2e:stand` (or dispatch the workflow with `tier: stand`); the job runs in a
-protected `e2e-stand` Environment whose required reviewers approve before any secret
-is exposed. That Environment gate — not the job's label condition — is what protects
-the secrets, so even a mislabeled or fork-PR run blocks on a human before it can reach
-them. The stand's URL and login come from the `E2E_STAND_URL` / `E2E_STAND_USER` /
-`E2E_STAND_PASSWORD` secrets (exposed to the tools as `E2E_BASE_URL` / `E2E_USER` /
-`E2E_PASSWORD`).
+own workflow (`e2e-stand.yml`) so the PR gate never subscribes to `labeled`. Trigger
+it by labelling a PR `e2e:stand`, or from **Actions → E2E Stand → Run workflow**
+(`workflow_dispatch` takes no inputs). The job's `if` is the first gate: it runs only
+for a `workflow_dispatch`, or a labelled PR whose head is **not** a fork — a
+mislabeled or fork-PR run skips the job entirely and never reaches the secrets. For a
+run that clears that gate, the protected `e2e-stand` Environment is the second gate:
+its required reviewers approve before any secret is exposed. The stand's URL and login
+come from the `E2E_STAND_URL` / `E2E_STAND_USER` / `E2E_STAND_PASSWORD` secrets
+(exposed to the tools as `E2E_BASE_URL` / `E2E_USER` / `E2E_PASSWORD`).
 
 Before the browser specs, a **schema-compat pre-flight**
 (`e2e/tools/schema-compat.mjs`) introspects the stand's live GraphQL schema and
@@ -163,6 +175,33 @@ prefix `NODE_TLS_REJECT_UNAUTHORIZED=0`; a real stand has a valid cert).
   substrate for scoping runs and the exploratory agent to the changed surface;
   the mapping logic is unit-tested (`e2e/affected-routes.unit.test.ts`).
 
+## Reviewing with agents
+
+Verifying a claim about a gate usually means breaking something on purpose — deleting a
+guard, injecting the regression it should catch, patching a fixture. Do that in a sandbox,
+never in your checkout:
+
+```bash
+SANDBOX=$(./e2e/tools/review-sandbox.sh create --dirty --with-deps)
+# …mutate and run anything inside $SANDBOX…
+./e2e/tools/review-sandbox.sh clean "$SANDBOX"
+```
+
+`--dirty` carries uncommitted work across (usually what you are reviewing); `--with-deps`
+hardlinks `node_modules` so pnpm, vitest and playwright run there — skip it for read-only
+work, it costs ~30s. `clean` takes a path under the sandbox root and refuses anything else,
+including the root itself; `clean --all` sweeps sandboxes untouched for two hours, so it
+cannot take out a concurrent agent's live one. A bare `clean` is an error, not a sweep.
+
+The sandbox is a `git worktree` under `$TMPDIR`, so a deleted file or an edited spec inside
+it cannot reach your tree. `--with-deps` needs the root to be on the repo's own filesystem —
+hardlinks cannot cross mounts — so where `$TMPDIR` is its own mount (tmpfs `/tmp`, a separate
+`/home`) the tool says so and falls back to `.pentagi-review-sandboxes` beside the repo;
+`PENTAGI_SANDBOX_ROOT` overrides both. Two caveats: an absolute path still escapes it, and a tool that
+rewrites a dependency **in place** would reach the shared inode — don't hand `--with-deps`
+to an agent whose job is patching libraries. Check `git status` in your own tree when a run
+finishes; that is the only proof nothing leaked.
+
 ## LLM advisory layer (Phase 3, opt-in)
 
 Deterministic specs are the gate; an LLM is only ever an advisory second
diff --git a/frontend/docs/list_detail_pages.md b/frontend/docs/list_detail_pages.md
index 6002e095..3fe58f47 100644
--- a/frontend/docs/list_detail_pages.md
+++ b/frontend/docs/list_detail_pages.md
@@ -4,9 +4,12 @@ Reusable surface for **list-and-detail** pages: a filterable/sortable table, a
 Prev/Next/Sheet toolbar that walks the _same_ filtered subset on detail pages,
 inline-rename inputs, and the URL-vs-storage state model that keeps them in
 lockstep. Every list page in the app (`/flows`, `/knowledges`, `/templates`,
-`/settings/prompts`, `/settings/providers`, `/settings/api-tokens`) is built
-from these pieces, as is each one's detail page — `/settings/api-tokens` is the
-exception, editing its rows in place with no detail route of its own.
+`/settings/prompts`, `/settings/providers`, `/settings/api-tokens`) renders a
+`<DataTable>`. The detail half applies to `/flows/:id`, `/knowledges/:id` and
+`/templates/:id` only. `/settings/api-tokens` has no detail route at all (it edits
+rows in place, through its own state rather than the inline-edit surface below),
+and `/settings/prompts/:name` and `/settings/providers/:id` are single-entity
+forms with no sibling navigation, so neither has a feature nav hook.
 
 > **Scope / how to trust this doc.** It describes code under `frontend/src`.
 > Signatures below are copied verbatim from source. If a signature and the code
@@ -46,8 +49,9 @@ Two rules make the whole thing predictable:
 
 1. **URL is authoritative** for filter + page, so a shared link reproduces the
    exact view.
-2. **Prev/Next walks the same subset** — the detail toolbar runs the same
-   matcher the list filter uses, so siblings stay in step with the table.
+2. **Prev/Next walks the same subset** — the detail toolbar filters on the same
+   `?q=` the table does, so siblings stay in step with the list. The two
+   matchers are close but not identical; see the caveat below.
 
 ## Mental model
 
@@ -152,11 +156,17 @@ The current page index and the ad-hoc `?q=` filter stay URL-only.
 ### Prev/Next walks the same subset
 
 `useDetailNavigation` subscribes to the URL filter via
-`useTableQueryFilterReader`, runs the same pure matcher the list uses, and
+`useTableQueryFilterReader`, applies a pure matcher over the same `?q=`, and
 resolves the Prev / Next siblings + a `"3/10"` position label over that filtered
-subset — so the toolbar is always in step with what the user saw in the table.
-It also threads the current `?q=` through every prev/next/select destination via
-`mergeHrefWithSearchParams`, so navigating siblings never drops the filter.
+subset. It also threads the current `?q=` through every prev/next/select
+destination via `mergeHrefWithSearchParams`, so navigating siblings never drops
+the filter.
+
+The two matchers are not the same function, and they disagree on diacritics:
+the toolbar folds them (`createTextMatcher` normalizes NFKD and strips combining
+marks), while `DataTable`'s `globalFilterFn` only lowercases. Searching `cafe`
+therefore hides a `café` row from the table while Prev/Next still steps onto it.
+Align the two before relying on the subsets being identical.
 
 ## Hooks
 
@@ -343,7 +353,7 @@ function DetailNavigationToolbar<T extends { id: string }>(props: {
     renderItem?: (item: T, isCurrent: boolean) => ReactNode;
     hasSearch?: boolean; // default true — in-sheet search input
     searchPlaceholder?: string;
-}): JSX.Element | null; // null when controller.itemsEmpty
+}): JSX.Element;
 ```
 
 The toolbar composes `<DetailNavigationButtons>` (Prev / position / Next) and
@@ -466,8 +476,13 @@ export function EntitiesPage() {
 
     const pageHeader = <AppHeader title="Entities" /* ...actions */ />;
 
-    // Canonical 4-branch render gate — pageHeader renders in ALL branches:
-    if (isLoading) {
+    // Canonical 4-branch render gate — pageHeader renders in ALL branches.
+    // Both loading and error gate on "nothing to show yet": the query is
+    // cache-and-network, so a background revalidation reports loading (and, on
+    // failure, error) with cached data still present. Without `&& !data` that
+    // refetch blanks a working list — or an edit form with unsaved changes —
+    // with the spinner/error for the round-trip.
+    if (isLoading && entities.length === 0) {
         return (
             <>
                 {pageHeader}
@@ -475,8 +490,6 @@ export function EntitiesPage() {
             </>
         );
     }
-    // Show the error surface only when there's no data — a failed background
-    // refetch must not blank a working list.
     if (error && entities.length === 0) {
         return (
             <>
@@ -619,9 +632,10 @@ legacy keys in on first mount and deletes them.
   filter (`?q=`, via `useTableState`) and a server-side semantic search (`?qs=`,
   via page-local `useSearchParams`) are independent — don't conflate them. A
   copied list recipe only needs the `?q=` one.
-- **`DetailNavigationToolbar` renders `null` when `controller.itemsEmpty`** (raw
-  items empty, pre-filter), so it can mount before the provider's list arrives
-  without flashing "–/0".
+- **`DetailNavigationToolbar` always renders.** It has no empty-list branch, so
+  it mounts before the provider's list arrives and shows the buttons' own
+  disabled/"–/0" state until items land. `controller.itemsEmpty` exists for a
+  caller that wants to skip rendering it, but nothing reads it today.
 
 ## Testing
 
@@ -661,3 +675,5 @@ not reintroduce them:
 | `toolbarProps` spread into `<DetailNavigationToolbar>` | No such object. Pass `controller={nav}` + discrete `renderItem`/`sheetIcon`/`sheetTitle`.                                               |
 | `hooks/use-inline-edit`                                | Wrong path. It lives at `components/shared/inline-edit/use-inline-edit.ts`.                                                             |
 | `components/shared/data-table`                         | Wrong path. It lives at `components/ui/data-table.tsx`.                                                                                 |
+| `features/providers/use-provider-detail-navigation.ts` | Never existed. `/settings/providers/:id` is a form with no sibling nav — only `flows`, `knowledges` and `templates` have nav hooks.     |
+| `features/prompts/use-prompt-detail-navigation.ts`     | Never existed. Same for `/settings/prompts/:name`.                                                                                      |
diff --git a/frontend/e2e/affected-routes.ts b/frontend/e2e/affected-routes.ts
index 5e493bd0..14f53b9c 100644
--- a/frontend/e2e/affected-routes.ts
+++ b/frontend/e2e/affected-routes.ts
@@ -7,15 +7,11 @@ const owns = (dir: string, file: string): boolean => file === dir || file.starts
 
 /**
  * Maps a set of changed repo files to the manifest routes they touch, by
- * prefix-matching each change against a route's owning source dirs. This is the
- * substrate for selective runs and for scoping the exploratory agent to the
- * changed surface. Pure — the CLI and the vitest unit test both drive it.
+ * prefix-matching each change against a route's owning source dirs.
  *
- * - no frontend change → no routes (a backend-only diff; the caller falls back
- *   to the full suite, and schema-compat covers the backend contract);
- * - a frontend change owned by no route → all routes (shared infra: the e2e
- *   engine, config, src/lib, a provider used everywhere) — conservative on
- *   purpose, since over-running is safe and under-running hides a regression;
+ * - no frontend change → no routes (the caller falls back to the full suite);
+ * - a frontend change owned by no route → all routes (shared infra: e2e engine,
+ *   config, src/lib, an everywhere-provider) — over-run rather than under-run;
  * - otherwise → the routes whose `sources` the changes fall under.
  *
  * Paths are repo-relative (`frontend/...`); `sources` are `frontend/`-relative.
diff --git a/frontend/e2e/affected-routes.unit.test.ts b/frontend/e2e/affected-routes.unit.test.ts
index 53e73d66..c8fbed50 100644
--- a/frontend/e2e/affected-routes.unit.test.ts
+++ b/frontend/e2e/affected-routes.unit.test.ts
@@ -3,6 +3,7 @@ import { describe, expect, it } from 'vitest';
 import type { RouteSource } from './affected-routes.ts';
 
 import { affectedRoutes } from './affected-routes.ts';
+import { ROUTE_MANIFEST } from './routes.ts';
 
 const MANIFEST: RouteSource[] = [
     {
@@ -58,4 +59,12 @@ describe('affectedRoutes', () => {
 
         expect(result.map((route) => route.path)).toEqual(['/flows']);
     });
+
+    // The fake manifest above cannot catch ownership drift in the real one: a shared provider claimed
+    // by a single route silently scopes a run away from the other routes that mount its consumers.
+    it('scopes a shared provider to every route that mounts a consumer', () => {
+        const result = affectedRoutes(['frontend/src/providers/templates-provider.tsx'], ROUTE_MANIFEST);
+
+        expect(result.map((route) => route.path).sort()).toEqual(['/flows/5', '/templates']);
+    });
 });
diff --git a/frontend/e2e/ci-codegen-gate.unit.test.ts b/frontend/e2e/ci-codegen-gate.unit.test.ts
new file mode 100644
index 00000000..0895da98
--- /dev/null
+++ b/frontend/e2e/ci-codegen-gate.unit.test.ts
@@ -0,0 +1,91 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const SCRIPT = join(__dirname, '..', '..', '.github', 'scripts', 'codegen-inputs-changed.sh');
+
+let repo = '';
+const sha = { base: '', merge: '', schema: '', unrelated: '' };
+
+// -c user.* is passed on every invocation (not just `commit`) because `commit-tree` also refuses
+// to run without an author identity, and CI runners have none configured globally.
+const git = (...args: string[]) =>
+    execFileSync('git', ['-C', repo, '-c', 'user.email=e2e@example.com', '-c', 'user.name=e2e', ...args], {
+        encoding: 'utf8',
+    }).trim();
+
+const commit = (path: string, body: string, message: string) => {
+    mkdirSync(join(repo, path.slice(0, path.lastIndexOf('/'))), { recursive: true });
+    writeFileSync(join(repo, path), body);
+    git('add', '-A');
+    git('commit', '-m', message);
+
+    return git('rev-parse', 'HEAD');
+};
+
+const run = (event: string, before: string, baseSha: string, headSha: string) =>
+    execFileSync(SCRIPT, [event, before, baseSha, headSha], { cwd: repo, encoding: 'utf8' }).trim();
+
+const runReason = (event: string, before: string, baseSha: string, headSha: string) =>
+    spawnSync(SCRIPT, [event, before, baseSha, headSha], { cwd: repo, encoding: 'utf8' }).stderr.trim();
+
+// The PR arrives as the merge commit GitHub builds, not as the branch head — the range the gate
+// picks has to span the whole PR, not the newest push.
+beforeAll(() => {
+    repo = mkdtempSync(join(tmpdir(), 'codegen-gate-'));
+    git('init', '-q', '-b', 'main');
+    sha.base = commit('README.md', 'base\n', 'base');
+    sha.schema = commit('backend/pkg/graph/schema.graphqls', 'type Query { a: Int }\n', 'edit the schema');
+    sha.unrelated = commit('README.md', 'base\nmore\n', 'unrelated follow-up');
+    sha.merge = git('commit-tree', `${sha.unrelated}^{tree}`, '-p', sha.base, '-p', sha.unrelated, '-m', 'merge');
+});
+
+afterAll(() => rmSync(repo, { force: true, recursive: true }));
+
+describe('codegen freshness gate — range selection', () => {
+    it('checks a follow-up push whose newest commit did not touch a codegen input', () => {
+        expect(run('pull_request', sha.schema, sha.base, sha.merge)).toBe('changed=true');
+    });
+
+    it('checks a freshly opened PR, where there is no previous head', () => {
+        expect(run('pull_request', '', sha.base, sha.merge)).toBe('changed=true');
+    });
+
+    // The answer alone cannot tell this branch from the diff-failed fallback below, which prints
+    // the same `changed=true`; only the reason distinguishes them.
+    it('checks a force-push, where the previous head no longer resolves', () => {
+        expect(run('push', 'b'.repeat(40), '', sha.schema)).toBe('changed=true');
+        expect(runReason('push', 'b'.repeat(40), '', sha.schema)).toContain('reason=unresolvable-base');
+    });
+
+    it('checks the first push of a branch, where there is no previous head at all', () => {
+        expect(run('push', '0'.repeat(40), '', sha.schema)).toBe('changed=true');
+        expect(runReason('push', '0'.repeat(40), '', sha.schema)).toContain('reason=unresolvable-base');
+    });
+
+    it('keeps checking a push by its own range', () => {
+        expect(run('push', sha.base, '', sha.schema)).toBe('changed=true');
+    });
+
+    it('still skips a PR that touches no codegen input', () => {
+        expect(run('pull_request', '', sha.schema, sha.unrelated)).toBe('changed=false');
+    });
+
+    it('checks a codegen input whose diff is larger than one pipe buffer', () => {
+        const pad = 'x'.repeat(180);
+        mkdirSync(join(repo, 'frontend', 'filler'), { recursive: true });
+
+        for (let i = 0; i < 1000; i += 1) {
+            writeFileSync(join(repo, 'frontend', 'filler', `${i}-${pad}.txt`), '');
+        }
+
+        const bulk = commit('backend/pkg/graph/schema.graphqls', 'type Query { a: Int, b: Int }\n', 'bulk');
+        const names = git('diff', '--name-only', sha.unrelated, bulk);
+
+        expect(names.split('\n')[0]).toBe('backend/pkg/graph/schema.graphqls');
+        expect(names.length).toBeGreaterThan(64 * 1024);
+        expect(run('push', sha.unrelated, '', bulk)).toBe('changed=true');
+    });
+});
diff --git a/frontend/e2e/fixtures/auth.ts b/frontend/e2e/fixtures/auth.ts
index ae74c3c9..bcb3de22 100644
--- a/frontend/e2e/fixtures/auth.ts
+++ b/frontend/e2e/fixtures/auth.ts
@@ -147,9 +147,16 @@ export const guestInfoEntry = (): RestCassetteEntry => ({
 
 export const seedAuthenticated = async (page: Page): Promise<void> => {
     await page.addInitScript(
-        ([key, value]) => {
+        ([key, value, sentinel]) => {
+            // Init scripts run on every document, so an unguarded seed would resurrect the session
+            // the app just cleared and no logout/expiry spec could observe the signed-out state.
+            if (window.sessionStorage.getItem(String(sentinel))) {
+                return;
+            }
+
+            window.sessionStorage.setItem(String(sentinel), '1');
             window.localStorage.setItem(String(key), String(value));
         },
-        [AUTH_STORAGE_KEY, JSON.stringify(seededAuthInfo())] as const,
+        [AUTH_STORAGE_KEY, JSON.stringify(seededAuthInfo()), 'e2e-auth-seeded'] as const,
     );
 };
diff --git a/frontend/e2e/fixtures/backend.ts b/frontend/e2e/fixtures/backend.ts
index e433c148..ed9f6c6e 100644
--- a/frontend/e2e/fixtures/backend.ts
+++ b/frontend/e2e/fixtures/backend.ts
@@ -33,7 +33,7 @@ export const test = base.extend<BackendFixtures & BackendOptions & { _installMoc
     // first 401 wipes it and hard-redirects to login. Real tiers authenticate
     // once in the setup project and reuse storageState.
     _installMocks: [
-        async ({ backend, isAuthSeeded, page, world }, use, testInfo) => {
+        async ({ backend, context, isAuthSeeded, page, world }, use, testInfo) => {
             if (!backend.installMocks) {
                 await use();
 
@@ -46,7 +46,7 @@ export const test = base.extend<BackendFixtures & BackendOptions & { _installMoc
                 await seedAuthenticated(page);
             }
 
-            await installMockRoutes(page, world);
+            await installMockRoutes(context, world);
             await use();
 
             // Silently-dead subscriptions are legal (cassettes mock only the
diff --git a/frontend/e2e/fixtures/test.ts b/frontend/e2e/fixtures/test.ts
index 69ec656b..c6b3be16 100644
--- a/frontend/e2e/fixtures/test.ts
+++ b/frontend/e2e/fixtures/test.ts
@@ -1,4 +1,4 @@
-import { test as base, mergeTests } from '@playwright/test';
+import { test as base, expect as baseExpect, mergeTests } from '@playwright/test';
 
 import type { PageErrorLog } from '../helpers/errors.ts';
 
@@ -6,9 +6,18 @@ import { watchPageErrors } from '../helpers/errors.ts';
 import { test as backendTest } from './backend.ts';
 
 const errorsTest = base.extend<{ pageErrorLog: PageErrorLog }>({
-    pageErrorLog: async ({ page }, use) => {
-        await use(watchPageErrors(page));
-    },
+    pageErrorLog: [
+        async ({ page }, use) => {
+            const log = watchPageErrors(page);
+
+            await use(log);
+
+            // Auto (not opt-in): a spec that never destructured this fixture would assert nothing.
+            // Console errors stay with `expectCleanPage` — several specs drive 4xx paths that log one.
+            baseExpect(log.pageErrors, 'no uncaught page errors').toEqual([]);
+        },
+        { auto: true },
+    ],
 });
 
 export const test = mergeTests(backendTest, errorsTest);
diff --git a/frontend/e2e/helpers/a11y.ts b/frontend/e2e/helpers/a11y.ts
index 433d48f6..688c5336 100644
--- a/frontend/e2e/helpers/a11y.ts
+++ b/frontend/e2e/helpers/a11y.ts
@@ -12,9 +12,18 @@ import { expect } from '@playwright/test';
  */
 export interface A11yWaiver {
     rule: string;
+    /**
+     * Flow-detail tab names whose panel owns this debt. Omitted = route-wide (applies to the base
+     * view and every tab). Scoped so a Files-tab waiver cannot silence the same rule on Assistant.
+     */
+    tabs?: string[];
     target: RegExp;
 }
 
+/** Waivers in force for one scan: route-wide ones always, tab-scoped ones only on their own tab. */
+export const waiversForScan = (waivers: A11yWaiver[] = [], tab?: string): A11yWaiver[] =>
+    waivers.filter((waiver) => !waiver.tabs || (tab !== undefined && waiver.tabs.includes(tab)));
+
 const BLOCKING_IMPACTS = new Set(['critical', 'serious']);
 
 export const scanA11y = async (page: Page, route: string, waivers: A11yWaiver[] = []): Promise<void> => {
diff --git a/frontend/e2e/helpers/contrast.ts b/frontend/e2e/helpers/contrast.ts
index a8e361d4..2716ee8d 100644
--- a/frontend/e2e/helpers/contrast.ts
+++ b/frontend/e2e/helpers/contrast.ts
@@ -82,68 +82,188 @@ export const mountEditorProbes = async (page: Page, probes: Record<string, Edito
     );
 };
 
-export const measureContrast = async (page: Page, probe: string): Promise<number> =>
-    page.evaluate((name) => {
-        const element = document.querySelector<HTMLElement>(`[data-contrast="${name}"]`);
+export const parseColorAlpha = (color: string): number => {
+    const value = color.trim().toLowerCase();
 
-        if (!element?.parentElement) {
-            throw new Error(`contrast probe "${name}" is not mounted`);
+    if (value === 'transparent') {
+        return 0;
+    }
+
+    if (value.startsWith('#')) {
+        const digits = value.slice(1);
+        const hex = digits.length === 4 ? digits.slice(3).repeat(2) : digits.length === 8 ? digits.slice(6) : '';
+
+        return hex ? parseInt(hex, 16) / 255 : 1;
+    }
+
+    const args = /^[a-z-]+\(([^)]*)\)$/.exec(value)?.[1];
+
+    if (args === undefined) {
+        return 1;
+    }
+
+    const raw = (args.includes('/') ? args.split('/').at(-1) : args.split(',').at(3))?.trim();
+
+    if (raw === undefined) {
+        return 1;
+    }
+
+    const alpha = raw.endsWith('%') ? Number(raw.slice(0, -1)) / 100 : Number(raw);
+
+    return Number.isFinite(alpha) ? Math.min(Math.max(alpha, 0), 1) : 1;
+};
+
+// Walk to the first opaque ancestor, not just the parent: a probe inside a code block sits on
+// `pre.hljs` through a transparent `code`, and stopping at the parent would measure it against
+// nothing. The stack is painted onto a cleared canvas, so a translucent layer with no opaque base
+// under it keeps its own colour and reads as a contrast it does not have.
+export const resolveGroundLayers = (ancestorBackgrounds: string[]): string[] => {
+    const stack: string[] = [];
+
+    for (const background of ancestorBackgrounds) {
+        const alpha = parseColorAlpha(background);
+
+        if (alpha === 0) {
+            continue;
         }
 
-        const canvas = document.createElement('canvas');
+        stack.unshift(background);
 
-        canvas.width = 1;
-        canvas.height = 1;
-
-        const context = canvas.getContext('2d', { willReadFrequently: true });
-
-        if (!context) {
-            throw new Error('2d canvas context unavailable');
+        if (alpha === 1) {
+            break;
         }
+    }
 
-        const paint = (...layers: string[]) => {
-            context.clearRect(0, 0, 1, 1);
+    return stack;
+};
 
-            for (const layer of layers) {
-                // An unparseable colour is a silent no-op on fillStyle, leaving the previous
-                // value — which measures as a spurious ~21:1 pass. Assign it against two
-                // different sentinels: a colour that applied lands on the same value both
-                // times, an invalid one keeps whichever sentinel preceded it.
-                context.fillStyle = '#000000';
-                context.fillStyle = layer;
-                const fromBlack = context.fillStyle;
+export const mountFenceProbes = async (page: Page, tokens: string[]): Promise<void> => {
+    await page.evaluate(
+        ({ classNames, hostId }) => {
+            const fence = document.querySelector('.tiptap-content .ProseMirror pre');
+            const code = fence?.querySelector('code');
 
-                context.fillStyle = '#ffffff';
-                context.fillStyle = layer;
-
-                if (context.fillStyle !== fromBlack) {
-                    throw new Error(`contrast: colour "${layer}" did not apply`);
-                }
-
-                context.fillRect(0, 0, 1, 1);
+            if (!fence || !code) {
+                throw new Error('no code fence mounted to probe');
             }
 
-            const [r = 0, g = 0, b = 0] = context.getImageData(0, 0, 1, 1).data;
+            document.getElementById(hostId)?.remove();
+            const host = document.createElement('div');
 
-            return { b, g, r };
-        };
+            host.id = hostId;
+            host.className = 'tiptap-content';
+            host.style.cssText = 'position:fixed;inset:0 auto auto 0;z-index:2147483647';
 
-        const luminance = ({ b, g, r }: { b: number; g: number; r: number }) => {
-            const channel = (value: number) => {
-                const ratio = value / 255;
+            const surface = document.createElement('div');
 
-                return ratio <= 0.03928 ? ratio / 12.92 : ((ratio + 0.055) / 1.055) ** 2.4;
+            surface.className = 'ProseMirror';
+
+            const pre = fence.cloneNode(false) as HTMLElement;
+            const holder = code.cloneNode(false) as HTMLElement;
+
+            for (const className of classNames) {
+                const probe = document.createElement('span');
+
+                probe.className = className;
+                probe.dataset.contrast = className;
+                probe.textContent = 'Sample';
+                holder.append(probe);
+            }
+
+            pre.append(holder);
+            surface.append(pre);
+            host.append(surface);
+            document.body.append(host);
+
+            const cloned = getComputedStyle(pre).backgroundColor;
+            const real = getComputedStyle(fence).backgroundColor;
+
+            if (cloned !== real) {
+                throw new Error(`fence clone sits on ${cloned}, the editor's fence on ${real}`);
+            }
+        },
+        { classNames: tokens, hostId: 'contrast-fence-probes' },
+    );
+};
+
+export const measureContrast = async (page: Page, probe: string): Promise<number> =>
+    measureContrastAt(page, `[data-contrast="${probe}"]`);
+
+export const measureContrastAt = async (page: Page, selector: string): Promise<number> => {
+    const { ancestors, backgroundColor, color } = await page.evaluate((target) => {
+        const element = document.querySelector<HTMLElement>(target);
+
+        if (!element?.parentElement) {
+            throw new Error(`contrast target "${target}" is not mounted`);
+        }
+
+        const chain: string[] = [];
+
+        for (let node: HTMLElement | null = element.parentElement; node; node = node.parentElement) {
+            chain.push(getComputedStyle(node).backgroundColor);
+        }
+
+        const own = getComputedStyle(element);
+
+        return { ancestors: chain, backgroundColor: own.backgroundColor, color: own.color };
+    }, selector);
+
+    return page.evaluate(
+        ({ ground, text }) => {
+            const canvas = document.createElement('canvas');
+
+            canvas.width = 1;
+            canvas.height = 1;
+
+            const context = canvas.getContext('2d', { willReadFrequently: true });
+
+            if (!context) {
+                throw new Error('2d canvas context unavailable');
+            }
+
+            const paint = (...layers: string[]) => {
+                context.clearRect(0, 0, 1, 1);
+
+                for (const layer of layers) {
+                    // An unparseable colour is a silent no-op on fillStyle, leaving the previous
+                    // value — which measures as a spurious ~21:1 pass. Assign it against two
+                    // different sentinels: a colour that applied lands on the same value both
+                    // times, an invalid one keeps whichever sentinel preceded it.
+                    context.fillStyle = '#000000';
+                    context.fillStyle = layer;
+                    const fromBlack = context.fillStyle;
+
+                    context.fillStyle = '#ffffff';
+                    context.fillStyle = layer;
+
+                    if (context.fillStyle !== fromBlack) {
+                        throw new Error(`contrast: colour "${layer}" did not apply`);
+                    }
+
+                    context.fillRect(0, 0, 1, 1);
+                }
+
+                const [r = 0, g = 0, b = 0] = context.getImageData(0, 0, 1, 1).data;
+
+                return { b, g, r };
             };
 
-            return 0.2126 * channel(r) + 0.7152 * channel(g) + 0.0722 * channel(b);
-        };
+            const luminance = ({ b, g, r }: { b: number; g: number; r: number }) => {
+                const channel = (value: number) => {
+                    const ratio = value / 255;
 
-        const surface = paint(
-            getComputedStyle(element.parentElement).backgroundColor,
-            getComputedStyle(element).backgroundColor,
-        );
-        const label = paint(getComputedStyle(element).color);
-        const [high = 0, low = 0] = [luminance(label), luminance(surface)].sort((a, b) => b - a);
+                    return ratio <= 0.03928 ? ratio / 12.92 : ((ratio + 0.055) / 1.055) ** 2.4;
+                };
 
-        return (high + 0.05) / (low + 0.05);
-    }, probe);
+                return 0.2126 * channel(r) + 0.7152 * channel(g) + 0.0722 * channel(b);
+            };
+
+            const surface = paint(...ground);
+            const label = paint(...ground, text);
+            const [high = 0, low = 0] = [luminance(label), luminance(surface)].sort((a, b) => b - a);
+
+            return (high + 0.05) / (low + 0.05);
+        },
+        { ground: [...resolveGroundLayers(ancestors), backgroundColor], text: color },
+    );
+};
diff --git a/frontend/e2e/helpers/contrast.unit.test.ts b/frontend/e2e/helpers/contrast.unit.test.ts
new file mode 100644
index 00000000..f55ce9b0
--- /dev/null
+++ b/frontend/e2e/helpers/contrast.unit.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest';
+
+import { parseColorAlpha, resolveGroundLayers } from './contrast.ts';
+
+// Every colour below is a verbatim `getComputedStyle(...).backgroundColor` reading from the
+// Chromium the e2e suite drives: Chrome leaves oklch/lab/color() in their own function.
+describe('parseColorAlpha', () => {
+    it('reads the alpha of the colour functions Chrome keeps unconverted', () => {
+        expect(parseColorAlpha('oklch(0.7 0.1 250 / 0.3)')).toBeCloseTo(0.3);
+        expect(parseColorAlpha('oklch(0.7 0.1 250)')).toBe(1);
+        expect(parseColorAlpha('oklch(0.216 0.006 56.043 / 0.3)')).toBeCloseTo(0.3);
+        expect(parseColorAlpha('color(srgb 1 0 0 / 0.4)')).toBeCloseTo(0.4);
+        expect(parseColorAlpha('color(srgb 1 0 0)')).toBe(1);
+        expect(parseColorAlpha('lab(50 40 59.5 / 0.5)')).toBeCloseTo(0.5);
+    });
+
+    it('reads the alpha of the legacy sRGB forms', () => {
+        expect(parseColorAlpha('rgba(255, 0, 0, 0.5)')).toBeCloseTo(0.5);
+        expect(parseColorAlpha('rgba(64, 149, 191, 0.25)')).toBeCloseTo(0.25);
+        expect(parseColorAlpha('rgba(0, 0, 0, 0)')).toBe(0);
+        expect(parseColorAlpha('transparent')).toBe(0);
+    });
+
+    it('treats an opaque rgb() as opaque instead of reading its blue channel as the alpha', () => {
+        expect(parseColorAlpha('rgb(255, 0, 0)')).toBe(1);
+        expect(parseColorAlpha('rgb(24, 24, 27)')).toBe(1);
+        expect(parseColorAlpha('rgb(0, 0, 0)')).toBe(1);
+    });
+
+    it('reads alpha out of hex and percentage forms', () => {
+        expect(parseColorAlpha('#ff0000')).toBe(1);
+        expect(parseColorAlpha('#ff000080')).toBeCloseTo(0.5, 2);
+        expect(parseColorAlpha('#f008')).toBeCloseTo(0.53, 2);
+        expect(parseColorAlpha('rgb(255 0 0 / 30%)')).toBeCloseTo(0.3);
+    });
+});
+
+describe('resolveGroundLayers', () => {
+    it('stops on an opaque rgb() ancestor instead of skipping it as invisible', () => {
+        expect(resolveGroundLayers(['rgba(0, 0, 0, 0)', 'rgb(255, 0, 0)', 'rgb(0, 0, 255)'])).toEqual([
+            'rgb(255, 0, 0)',
+        ]);
+    });
+
+    it('keeps walking under a translucent oklch ancestor instead of grounding on it', () => {
+        expect(resolveGroundLayers(['oklch(0.7 0.1 250 / 0.3)', 'oklch(0.985 0 0)', 'oklch(0.145 0 0)'])).toEqual([
+            'oklch(0.985 0 0)',
+            'oklch(0.7 0.1 250 / 0.3)',
+        ]);
+    });
+
+    it('skips a fully transparent ancestor and keeps the layers outermost first', () => {
+        expect(
+            resolveGroundLayers(['rgba(0, 0, 0, 0)', 'color(srgb 1 0 0 / 0.4)', 'rgba(0, 0, 0, 0)', '#101014']),
+        ).toEqual(['#101014', 'color(srgb 1 0 0 / 0.4)']);
+    });
+});
diff --git a/frontend/e2e/helpers/pdf.ts b/frontend/e2e/helpers/pdf.ts
new file mode 100644
index 00000000..a1560df4
--- /dev/null
+++ b/frontend/e2e/helpers/pdf.ts
@@ -0,0 +1,68 @@
+import { inflateSync } from 'node:zlib';
+
+export interface PdfShape {
+    /** Embedded font subsets — a document that drew no text embeds none. */
+    fonts: number;
+    isPdf: boolean;
+    pages: number;
+    /** Text-showing operators across every content stream. */
+    textRuns: number;
+    trailerComplete: boolean;
+}
+
+const inflateStreams = (pdf: Buffer): Buffer[] => {
+    const streams: Buffer[] = [];
+    const marker = Buffer.from('stream');
+    const end = Buffer.from('endstream');
+
+    let from = 0;
+
+    for (;;) {
+        const start = pdf.indexOf(marker, from);
+
+        if (start === -1) {
+            return streams;
+        }
+
+        const stop = pdf.indexOf(end, start);
+
+        if (stop === -1) {
+            return streams;
+        }
+
+        // Skip the EOL that must follow the `stream` keyword.
+        const body = pdf.subarray(start + marker.length, stop);
+
+        try {
+            streams.push(inflateSync(body.subarray(body[0] === 0x0d ? 2 : 1)));
+        } catch {
+            // Not every stream is Flate-encoded (font programs, images) — those are not text.
+        }
+
+        from = stop + end.length;
+    }
+};
+
+/**
+ * Structural read of a generated PDF. It deliberately does not decode the text: each font subset
+ * carries its own glyph map, so a merged decode garbles the result. The report's wording is checked
+ * on the markdown export instead, which is built from the same string and whose bytes are searched
+ * for the task and result text.
+ */
+export const inspectPdf = (pdf: Buffer): PdfShape => {
+    const head = pdf.subarray(0, 5).toString();
+    const tail = pdf.subarray(-1024).toString();
+    const body = pdf.toString('latin1');
+    const streams = inflateStreams(pdf);
+
+    return {
+        fonts: (body.match(/\/FontFile\d?/g) ?? []).length,
+        isPdf: head === '%PDF-',
+        pages: (body.match(/\/Type\s*\/Page[^s]/g) ?? []).length,
+        textRuns: streams.reduce(
+            (total, stream) => total + (stream.toString('latin1').match(/\bTJ\b|\bTj\b/g) ?? []).length,
+            0,
+        ),
+        trailerComplete: tail.includes('%%EOF'),
+    };
+};
diff --git a/frontend/e2e/helpers/subscriptions.ts b/frontend/e2e/helpers/subscriptions.ts
index 955fcf7d..3a7a8cf6 100644
--- a/frontend/e2e/helpers/subscriptions.ts
+++ b/frontend/e2e/helpers/subscriptions.ts
@@ -2,7 +2,9 @@ import type { Locator, TestInfo } from '@playwright/test';
 
 import { expect } from '@playwright/test';
 
-export const MESSAGE_ID_TESTID = 'flow-message-id';
+/** The message-id badge carries no accessible name, so it is addressed by its slot like every other
+ *  shadcn primitive in this codebase — `data-testid` is not used in product code. */
+export const MESSAGE_ID_SELECTOR = '[data-slot="flow-message-id"]';
 
 export const attachIdSet = async (testInfo: TestInfo, name: string, ids: string[]): Promise<void> => {
     await testInfo.attach(name, {
@@ -12,7 +14,7 @@ export const attachIdSet = async (testInfo: TestInfo, name: string, ids: string[
 };
 
 export const extractMessageIds = async (panel: Locator): Promise<string[]> => {
-    const raw = await panel.getByTestId(MESSAGE_ID_TESTID).allTextContents();
+    const raw = await panel.locator(MESSAGE_ID_SELECTOR).allTextContents();
 
     return raw.map((text) => text.replace(/\D/g, '')).filter(Boolean);
 };
diff --git a/frontend/e2e/mock-llm/scenario.mjs b/frontend/e2e/mock-llm/scenario.mjs
index c38dbdc4..f845d0de 100644
--- a/frontend/e2e/mock-llm/scenario.mjs
+++ b/frontend/e2e/mock-llm/scenario.mjs
@@ -35,8 +35,6 @@ export const RULES = [
         match: /get_number/,
         toolCalls: [{ args: { value: 1 }, name: 'get_number' }],
     },
-    // The task reporter summarizes the finished task and only accepts the
-    // report_result tool.
     {
         label: 'task-report',
         match: /report_result|TASK EXECUTION EVALUATOR AND REPORTER/,
@@ -51,8 +49,7 @@ export const RULES = [
             },
         ],
     },
-    // The refiner re-plans between subtasks and only accepts subtask_patch;
-    // an empty operations list means "plan unchanged".
+    // An empty operations list means "plan unchanged".
     {
         label: 'subtask-refine',
         match: /subtask_patch/,
@@ -81,7 +78,7 @@ export const RULES = [
     // matching that agent's turn.
     {
         label: 'subagent-terminal-report',
-        match: /(?=[\s\S]*"hack_result")(?=[\s\S]*E2E_TERMINAL_OK)/,
+        match: /^(?=[\s\S]*"hack_result")(?=[\s\S]*E2E_TERMINAL_OK)/,
         toolCalls: [
             {
                 args: {
diff --git a/frontend/e2e/mock-llm/server.mjs b/frontend/e2e/mock-llm/server.mjs
index a02f90f3..a8354ada 100644
--- a/frontend/e2e/mock-llm/server.mjs
+++ b/frontend/e2e/mock-llm/server.mjs
@@ -137,7 +137,10 @@ createServer(async (request, response) => {
         }
 
         const rule = pickAnswer(payload);
-        const toolNames = (payload.tools ?? []).map((tool) => tool.function?.name ?? tool.type).join(',');
+        // Defensive end to end because this runs outside the try/catch above, where a throw kills
+        // the process: the top-level guard admits {"tools":5} and {"tools":[null]} alike.
+        const toolList = Array.isArray(payload.tools) ? payload.tools : [];
+        const toolNames = toolList.map((tool) => tool?.function?.name ?? tool?.type ?? '?').join(',');
 
         console.log(`[mock-llm] ${rule.label}: ${payload.stream ? 'stream' : 'plain'} tools=[${toolNames}]`);
         respondCompletion(response, payload, rule);
diff --git a/frontend/e2e/mocks/cassette.ts b/frontend/e2e/mocks/cassette.ts
index 94577f60..8415051f 100644
--- a/frontend/e2e/mocks/cassette.ts
+++ b/frontend/e2e/mocks/cassette.ts
@@ -28,6 +28,14 @@ export const mergeCassettes = (base: Cassette, override: Cassette): Cassette =>
 });
 
 export interface GraphQLCassetteEntry extends GraphQLPayload, WorldFlagged {
+    /**
+     * Served verbatim in place of the `{ data, errors }` envelope. The GraphQL endpoint sits behind
+     * the same auth middleware as the REST ones, so a rejected request answers with the REST error
+     * body and never reaches gqlgen.
+     */
+    body?: unknown;
+    /** A transport-level status the client reads instead of the GraphQL `errors` array. */
+    status?: number;
     variables?: Record<string, unknown>;
 }
 
@@ -51,6 +59,13 @@ export interface RestCassetteEntry extends WorldFlagged {
      * a broken image while the request still counts as matched.
      */
     contentType?: string;
+    /**
+     * Subset match against the request's query string, the counterpart to `bodySubset` for
+     * endpoints that carry their payload there and send no body — a delete addressed by
+     * `?paths[]=…` is otherwise answered success whatever it names. Repeated keys are compared
+     * as the full list of values.
+     */
+    querySubset?: Record<string, string | string[]>;
     status?: number;
 }
 
diff --git a/frontend/e2e/mocks/cassettes/assistants.ts b/frontend/e2e/mocks/cassettes/assistants.ts
new file mode 100644
index 00000000..2f09258d
--- /dev/null
+++ b/frontend/e2e/mocks/cassettes/assistants.ts
@@ -0,0 +1,72 @@
+import type { ResultOf } from '@graphql-typed-document-node/core';
+
+import type { AssistantFragmentFragment, AssistantLogFragmentFragment, AssistantsDocument } from '@/graphql/types';
+
+import { MessageLogType, ResultFormat, StatusType } from '@/graphql/types';
+
+import type { Cassette } from '../cassette.ts';
+
+import { entity, mergeCassettes } from '../cassette.ts';
+import { flowsCassette, PROVIDER } from './flows.ts';
+
+const T = '2026-01-15T11:30:00Z';
+
+export const makeAssistant = (
+    id: string,
+    title: string,
+    status: StatusType = StatusType.Waiting,
+): AssistantFragmentFragment =>
+    entity('Assistant', {
+        createdAt: T,
+        flowId: '5',
+        id,
+        provider: PROVIDER,
+        status,
+        title,
+        updatedAt: T,
+        useAgents: false,
+    });
+
+export const WAITING_ASSISTANT = makeAssistant('11', 'E2E Assistant Waiting');
+export const RUNNING_ASSISTANT = makeAssistant('12', 'E2E Assistant Running', StatusType.Running);
+export const CREATED_ASSISTANT = makeAssistant('13', 'E2E Assistant Created');
+
+export const ASSISTANT_ANSWER = 'The scan found an open port on 8080.';
+
+const assistantLog = (id: string, assistantId: string, message: string): AssistantLogFragmentFragment =>
+    entity('AssistantLog', {
+        appendPart: false,
+        assistantId,
+        createdAt: T,
+        flowId: '5',
+        id,
+        message,
+        result: ASSISTANT_ANSWER,
+        resultFormat: ResultFormat.Markdown,
+        thinking: null,
+        type: MessageLogType.Answer,
+    });
+
+const seeded: ResultOf<typeof AssistantsDocument> = { assistants: [WAITING_ASSISTANT, RUNNING_ASSISTANT] };
+
+export const assistantsCassette = (override: Cassette = {}): Cassette =>
+    mergeCassettes(
+        flowsCassette({
+            queries: {
+                assistantLogs: [
+                    {
+                        data: { assistantLogs: [assistantLog('41', '11', 'what did the scan find?')] },
+                        variables: { assistantId: '11', flowId: '5' },
+                    },
+                    {
+                        data: { assistantLogs: [assistantLog('42', '12', 'keep going')] },
+                        variables: { assistantId: '12', flowId: '5' },
+                    },
+                    { data: { assistantLogs: [] }, variables: { assistantId: '13', flowId: '5' } },
+                ],
+                assistants: [{ data: seeded, variables: { flowId: '5' } }],
+                providers: [{ data: { providers: [PROVIDER] } }],
+            },
+        }),
+        override,
+    );
diff --git a/frontend/e2e/mocks/cassettes/assistants.unit.test.ts b/frontend/e2e/mocks/cassettes/assistants.unit.test.ts
new file mode 100644
index 00000000..0a33e04d
--- /dev/null
+++ b/frontend/e2e/mocks/cassettes/assistants.unit.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest';
+
+import { MockWorld } from '../world.ts';
+import { assistantsCassette, CREATED_ASSISTANT, RUNNING_ASSISTANT, WAITING_ASSISTANT } from './assistants.ts';
+
+const transcript = (world: MockWorld, assistantId: string): undefined | unknown[] =>
+    (
+        world.matchGraphQL('assistantLogs', { assistantId, flowId: '5' })?.data as
+            | undefined
+            | { assistantLogs: unknown[] }
+    )?.assistantLogs;
+
+describe('assistants cassette — assistantLogs', () => {
+    it('serves an assistant its own transcript on every read, not only the first', () => {
+        const world = new MockWorld(assistantsCassette());
+
+        expect(transcript(world, WAITING_ASSISTANT.id)).toHaveLength(1);
+        expect(transcript(world, WAITING_ASSISTANT.id)).toHaveLength(1);
+        expect(transcript(world, RUNNING_ASSISTANT.id)).toHaveLength(1);
+        expect(transcript(world, RUNNING_ASSISTANT.id)).toHaveLength(1);
+    });
+
+    it('answers the freshly created assistant with an empty transcript', () => {
+        const world = new MockWorld(assistantsCassette());
+
+        expect(transcript(world, CREATED_ASSISTANT.id)).toEqual([]);
+    });
+});
diff --git a/frontend/e2e/mocks/cassettes/base.ts b/frontend/e2e/mocks/cassettes/base.ts
index f7a26753..b6c2238b 100644
--- a/frontend/e2e/mocks/cassettes/base.ts
+++ b/frontend/e2e/mocks/cassettes/base.ts
@@ -18,9 +18,8 @@ const flows: ResultOf<typeof FlowsDocument> = { flows: [] };
 
 const flowTemplates: ResultOf<typeof FlowTemplatesDocument> = { flowTemplates: [] };
 
-// Live entry, not dead weight: after a websocket reconnect the app re-requests
-// resources on the wire with {recursive:true} (removing this red-lights the
-// reconnect spec on the 501 gate).
+// After a websocket reconnect the app re-requests resources on the wire with {recursive:true};
+// removing this entry red-lights the reconnect spec on the 501 gate.
 const resources: ResultOf<typeof ResourcesDocument> = { resources: [] };
 
 const providers: ResultOf<typeof ProvidersDocument> = { providers: [] };
diff --git a/frontend/e2e/mocks/cassettes/flows.ts b/frontend/e2e/mocks/cassettes/flows.ts
index 6ab4e314..0c697d27 100644
--- a/frontend/e2e/mocks/cassettes/flows.ts
+++ b/frontend/e2e/mocks/cassettes/flows.ts
@@ -5,6 +5,7 @@ import type {
     FlowDocument,
     FlowFilesDocument,
     FlowFragmentFragment,
+    FlowReportDocument,
     FlowStatsByFlowDocument,
     MessageLogFragmentFragment,
     TerminalLogFragmentFragment,
@@ -85,11 +86,13 @@ export const VARIED_MESSAGES = [
         resultFormat: ResultFormat.Markdown,
         type: MessageLogType.Report,
     }),
+    // Terminal, not Report: `getMessageType` pairs the terminal tool's output with the terminal
+    // type, so a Report carrying a Terminal body is a state the backend cannot emit.
     makeMessage('503', '5', {
         message: '',
         result: 'e2e-terminal-marker\nexit 0',
         resultFormat: ResultFormat.Terminal,
-        type: MessageLogType.Report,
+        type: MessageLogType.Terminal,
     }),
     makeMessage('504', '5', { message: 'run the smoke command', type: MessageLogType.Input }),
 ];
@@ -179,8 +182,8 @@ export const flowsCassette = (override: Cassette = {}): Cassette =>
                     {
                         frames: [
                             ...FLOW_A_STREAMED_IDS.map((id) => addedFrame(makeMessage(id, '5'), 80)),
-                            // Not a copy-paste: a resubscribe replays what the refetch already
-                            // delivered, and the sentinel after it proves the replay was received.
+                            // A resubscribe replays what the refetch already delivered; the sentinel
+                            // after it proves the replay was received.
                             {
                                 ...addedFrame(makeMessage(FLOW_A_RECONNECT_ID, '5'), 0),
                                 whenFlag: REPLAY_FLAG,
@@ -199,12 +202,38 @@ export const flowsCassette = (override: Cassette = {}): Cassette =>
         override,
     );
 
-export const variedMessagesCassette = (): Cassette =>
+export const FLOW_B_SENTINEL_ID = '205';
+export const PAGER_SWITCH_FLAG = 'pager-switched';
+
+/** Holds flow B a frame back so the spec can prove the new stream still delivers after the switch. */
+export const pagerStreamsCassette = (): Cassette =>
     flowsCassette({
-        queries: { flow: [{ data: flowQueryData(FLOW_A, VARIED_MESSAGES), variables: { id: '5' } }] },
-        subscriptions: { messageLogAdded: [{ frames: [], variables: { flowId: '5' } }] },
+        subscriptions: {
+            messageLogAdded: [
+                {
+                    frames: FLOW_A_STREAMED_IDS.map((id) => addedFrame(makeMessage(id, '5'), 80)),
+                    variables: { flowId: '5' },
+                },
+                {
+                    frames: [
+                        ...FLOW_B_STREAMED_IDS.map((id) => addedFrame(makeMessage(id, '6'), 80)),
+                        { ...addedFrame(makeMessage(FLOW_B_SENTINEL_ID, '6'), 0), whenFlag: PAGER_SWITCH_FLAG },
+                    ],
+                    variables: { flowId: '6' },
+                },
+            ],
+        },
     });
 
+export const variedMessagesCassette = (override: Cassette = {}): Cassette =>
+    mergeCassettes(
+        flowsCassette({
+            queries: { flow: [{ data: flowQueryData(FLOW_A, VARIED_MESSAGES), variables: { id: '5' } }] },
+            subscriptions: { messageLogAdded: [{ frames: [], variables: { flowId: '5' } }] },
+        }),
+        override,
+    );
+
 const TABS_TASK = entity('Task', {
     createdAt: T,
     flowId: '5',
@@ -371,6 +400,139 @@ const flowStatsByFlow: ResultOf<typeof FlowStatsByFlowDocument> = {
     flowStatsByFlow: entity('FlowStats', { totalAssistantsCount: 1, totalSubtasksCount: 3, totalTasksCount: 1 }),
 };
 
+/** Text that exists only in a streamed frame, so a panel that ignores its subscription stays blank. */
+export const STREAMED = {
+    agent: 'E2E streamed agent step',
+    search: 'E2E streamed search',
+    task: 'E2E Streamed Task',
+    taskRetitled: 'E2E Task Alpha (revised)',
+    terminal: 'e2e-streamed-terminal-line',
+    vector: 'E2E streamed recall',
+};
+
+const streamedFrame = (payload: Record<string, unknown>) => ({ delayMs: 60, payload: { data: payload } });
+
+export const livePanelsCassette = (): Cassette =>
+    mergeCassettes(flowTabsCassette(), {
+        subscriptions: {
+            agentLogAdded: [
+                {
+                    frames: [
+                        streamedFrame({
+                            agentLogAdded: entity('AgentLog', {
+                                createdAt: T,
+                                executor: AgentType.Pentester,
+                                flowId: '5',
+                                id: '42',
+                                initiator: AgentType.Adviser,
+                                result: 'Streamed step complete',
+                                subtaskId: null,
+                                task: STREAMED.agent,
+                                taskId: '11',
+                            }),
+                        }),
+                    ],
+                    variables: { flowId: '5' },
+                },
+            ],
+            searchLogAdded: [
+                {
+                    frames: [
+                        streamedFrame({
+                            searchLogAdded: entity('SearchLog', {
+                                createdAt: T,
+                                engine: 'duckduckgo',
+                                executor: AgentType.Searcher,
+                                flowId: '5',
+                                id: '52',
+                                initiator: AgentType.Pentester,
+                                query: STREAMED.search,
+                                result: 'Streamed advisories',
+                                subtaskId: null,
+                                taskId: '11',
+                            }),
+                        }),
+                    ],
+                    variables: { flowId: '5' },
+                },
+            ],
+            taskCreated: [
+                {
+                    frames: [
+                        streamedFrame({
+                            taskCreated: entity('Task', {
+                                createdAt: T,
+                                flowId: '5',
+                                id: '12',
+                                input: 'Exploit the open port',
+                                result: '',
+                                status: StatusType.Running,
+                                subtasks: [],
+                                title: STREAMED.task,
+                                updatedAt: T,
+                            }),
+                        }),
+                    ],
+                    variables: { flowId: '5' },
+                },
+            ],
+            taskUpdated: [
+                {
+                    frames: [
+                        streamedFrame({
+                            taskUpdated: { ...TABS_TASK, status: StatusType.Running, title: STREAMED.taskRetitled },
+                        }),
+                    ],
+                    variables: { flowId: '5' },
+                },
+            ],
+            terminalLogAdded: [
+                {
+                    frames: [
+                        streamedFrame({
+                            terminalLogAdded: terminalLog('303', TerminalLogType.Stdout, STREAMED.terminal),
+                        }),
+                    ],
+                    variables: { flowId: '5' },
+                },
+            ],
+            vectorStoreLogAdded: [
+                {
+                    frames: [
+                        streamedFrame({
+                            vectorStoreLogAdded: entity('VectorStoreLog', {
+                                action: VectorStoreAction.Retrieve,
+                                createdAt: T,
+                                executor: AgentType.Memorist,
+                                filter: '{}',
+                                flowId: '5',
+                                id: '62',
+                                initiator: AgentType.Pentester,
+                                query: STREAMED.vector,
+                                result: 'Streamed recall complete',
+                                subtaskId: null,
+                                taskId: '11',
+                            }),
+                        }),
+                    ],
+                    variables: { flowId: '5' },
+                },
+            ],
+        },
+    });
+
+const flowReportData: ResultOf<typeof FlowReportDocument> = { flow: FLOW_A, tasks: [TABS_TASK] };
+
+/** The Report menu only appears when the flow query returns tasks, so this overrides `flow` too. */
+export const flowReportCassette = (): Cassette =>
+    flowsCassette({
+        queries: {
+            flow: [{ data: flowTabsData, variables: { id: '5' } }],
+            flowReport: [{ data: flowReportData, variables: { id: '5' } }],
+        },
+        subscriptions: { messageLogAdded: [{ frames: [], variables: { flowId: '5' } }] },
+    });
+
 export const flowTabsCassette = (): Cassette =>
     flowsCassette({
         queries: {
diff --git a/frontend/e2e/mocks/cassettes/knowledges.ts b/frontend/e2e/mocks/cassettes/knowledges.ts
index e542a931..2ed91c41 100644
--- a/frontend/e2e/mocks/cassettes/knowledges.ts
+++ b/frontend/e2e/mocks/cassettes/knowledges.ts
@@ -1,6 +1,10 @@
 import type { ResultOf } from '@graphql-typed-document-node/core';
 
-import type { KnowledgeDocumentFragmentFragment, KnowledgeDocumentsDocument } from '@/graphql/types';
+import type {
+    KnowledgeDocumentDocument,
+    KnowledgeDocumentFragmentFragment,
+    KnowledgeDocumentsDocument,
+} from '@/graphql/types';
 
 import { KnowledgeAnswerType, KnowledgeDocType } from '@/graphql/types';
 
@@ -46,3 +50,18 @@ export const knowledgesCassette = (override: Cassette = {}): Cassette =>
         },
         override,
     );
+
+const knowledgeDocument: ResultOf<typeof KnowledgeDocumentDocument> = { knowledgeDocument: KNOWLEDGE_DOC };
+
+/** Adds the single-document query the detail route issues for KNOWLEDGE_DOC. */
+export const knowledgeDetailCassette = (override: Cassette = {}): Cassette =>
+    knowledgesCassette(
+        mergeCassettes(
+            {
+                queries: {
+                    knowledgeDocument: [{ data: knowledgeDocument, variables: { id: KNOWLEDGE_DOC.id } }],
+                },
+            },
+            override,
+        ),
+    );
diff --git a/frontend/e2e/mocks/cassettes/resources.ts b/frontend/e2e/mocks/cassettes/resources.ts
index b896e3d0..0e715432 100644
--- a/frontend/e2e/mocks/cassettes/resources.ts
+++ b/frontend/e2e/mocks/cassettes/resources.ts
@@ -33,6 +33,20 @@ export const CREATED_FOLDER: UserResourceFragmentFragment = entity('UserResource
     userId: '1',
 });
 
+export const UPLOADED_RESOURCE = makeRestResource(4, 'uploaded-notes.txt', 42, false);
+
+/** What the server broadcasts once the upload lands — the list only grows through this frame. */
+export const UPLOADED_FRAGMENT: UserResourceFragmentFragment = entity('UserResource', {
+    createdAt: '2026-01-15T12:00:00Z',
+    id: '4',
+    isDir: false,
+    name: UPLOADED_RESOURCE.name,
+    path: UPLOADED_RESOURCE.path,
+    size: UPLOADED_RESOURCE.size,
+    updatedAt: '2026-01-15T12:00:00Z',
+    userId: '1',
+});
+
 const seededList: RestResourceList = { items: [FOLDER_RESOURCE, FILE_RESOURCE], total: 2 };
 
 export const emptyResourcesCassette = (): Cassette => ({
@@ -40,6 +54,30 @@ export const emptyResourcesCassette = (): Cassette => ({
     rest: baseRest(),
 });
 
+export const RENAMED_PATH = 'renamed-notes.txt';
+export const COPY_DESTINATION = 'archive/notes.txt';
+
+/** The write verbs differ per action — move is a PUT, copy a POST, delete a DELETE with the paths in
+ *  the query string. A method mismatch does not 404 here: it falls through to the SPA and answers 200
+ *  with HTML, so each entry pins the method as well as the payload. */
+export const resourceWrites = (): Cassette['rest'] => ({
+    'DELETE /api/v1/resources/': [
+        { body: { data: {}, status: 'success' }, querySubset: { 'paths[]': FILE_RESOURCE.path } },
+    ],
+    'POST /api/v1/resources/copy': [
+        {
+            body: { data: {}, status: 'success' },
+            bodySubset: { destination: COPY_DESTINATION, sources: [FILE_RESOURCE.path] },
+        },
+    ],
+    'PUT /api/v1/resources/move': [
+        {
+            body: { data: {}, status: 'success' },
+            bodySubset: { destination: RENAMED_PATH, sources: [FILE_RESOURCE.path] },
+        },
+    ],
+});
+
 export const resourcesCassette = (override: Cassette = {}): Cassette =>
     mergeCassettes(
         {
diff --git a/frontend/e2e/mocks/cassettes/settings-prompts.ts b/frontend/e2e/mocks/cassettes/settings-prompts.ts
index b75b94b4..981a4fd5 100644
--- a/frontend/e2e/mocks/cassettes/settings-prompts.ts
+++ b/frontend/e2e/mocks/cassettes/settings-prompts.ts
@@ -1,6 +1,10 @@
 import type { ResultOf } from '@graphql-typed-document-node/core';
 
-import type { DefaultPromptFragmentFragment, SettingsPromptsDocument } from '@/graphql/types';
+import type {
+    DefaultPromptFragmentFragment,
+    SettingsPromptsDocument,
+    UserPromptFragmentFragment,
+} from '@/graphql/types';
 
 import { PromptType } from '@/graphql/types';
 
@@ -32,7 +36,7 @@ export const RICH_PROMPT_TEMPLATE = [
     '- report every finding with evidence',
     '',
     '```bash',
-    'nmap -sV {{.Target}}',
+    'nmap -sV {{.Target}} --script <default>',
     '```',
     '',
     '| Field | Value |',
@@ -48,6 +52,7 @@ const richPentesterSystem = entity('DefaultPrompt', {
 
 const makeSettingsPrompts = (
     pentesterSystem: DefaultPromptFragmentFragment = prompt(PromptType.Pentester),
+    userDefined: UserPromptFragmentFragment[] = [],
 ): ResultOf<typeof SettingsPromptsDocument> => ({
     settingsPrompts: entity('PromptsConfig', {
         default: entity('DefaultPrompts', {
@@ -86,7 +91,7 @@ const makeSettingsPrompts = (
                 wrapAgentTask: prompt(PromptType.TaskAssignmentWrapper),
             }),
         }),
-        userDefined: [],
+        userDefined,
     }),
 });
 
@@ -107,6 +112,44 @@ export const settingsPromptsCassette = (override: Cassette = {}): Cassette =>
 /** The agent key the prompt detail route resolves from its `:promptId` param. */
 export const PROMPT_DETAIL_AGENT = 'pentester';
 
+/** The operator's own copy of the pentester system prompt: its presence is what switches the editor
+ *  from the create branch to the update branch, and its id is what a save has to carry. */
+export const PROMPT_OVERRIDE = {
+    id: 'user-prompt-1',
+    // Shares no line with the default on purpose: an override that merely appends to it makes
+    // "the default came back" indistinguishable from "nothing happened".
+    template: ['# Operator override', '', 'This copy replaces the shipped prompt for {{.Target}}.'].join('\n'),
+};
+
+const promptOverride = (): UserPromptFragmentFragment =>
+    entity('UserPrompt', {
+        createdAt: '2026-01-15T09:00:00Z',
+        id: PROMPT_OVERRIDE.id,
+        template: PROMPT_OVERRIDE.template,
+        type: PromptType.Pentester,
+        updatedAt: '2026-01-15T09:00:00Z',
+    });
+
+/** Raised by a spec's deletePrompt entry so the refetch can answer without the override. */
+export const PROMPT_RESET_FLAG = 'prompt-override-deleted';
+
+/** The same agent, but already overridden — the branch where Save updates instead of creating. The
+ *  second answer models the row actually being gone, so a reset has a real post-state to observe. */
+export const promptOverrideCassette = (override: Cassette = {}): Cassette =>
+    mergeCassettes(
+        {
+            queries: {
+                ...baseQueries(),
+                settingsPrompts: [
+                    { data: makeSettingsPrompts(richPentesterSystem, [promptOverride()]) },
+                    { data: makeSettingsPrompts(richPentesterSystem), whenFlag: PROMPT_RESET_FLAG },
+                ],
+            },
+            rest: baseRest(),
+        },
+        override,
+    );
+
 /** Same config, but that agent's system prompt carries RICH_PROMPT_TEMPLATE. */
 export const promptDetailCassette = (override: Cassette = {}): Cassette =>
     mergeCassettes(
diff --git a/frontend/e2e/mocks/cassettes/settings-providers.ts b/frontend/e2e/mocks/cassettes/settings-providers.ts
index 7ca89a22..0eb56049 100644
--- a/frontend/e2e/mocks/cassettes/settings-providers.ts
+++ b/frontend/e2e/mocks/cassettes/settings-providers.ts
@@ -3,8 +3,12 @@ import type { ResultOf } from '@graphql-typed-document-node/core';
 import type {
     AgentConfigFragmentFragment,
     AgentsConfigFragmentFragment,
+    AgentTestResultFragmentFragment,
+    ModelConfigFragmentFragment,
     ProviderConfigFragmentFragment,
+    ProviderTestResultFragmentFragment,
     SettingsProvidersDocument,
+    TestResultFragmentFragment,
 } from '@/graphql/types';
 
 import { ProviderType } from '@/graphql/types';
@@ -16,65 +20,104 @@ import { baseQueries, baseRest } from './base.ts';
 
 const T = '2026-01-15T09:00:00Z';
 
-const agentConfig = (): AgentConfigFragmentFragment =>
+/** `n: 1` and `json: true` are the shipped simple_json defaults; they are pinned in the create payload
+ *  because dropping exactly these on the way to the wire is a regression this repo has already had. */
+const agentConfig = (model = 'e2e-model'): AgentConfigFragmentFragment =>
     entity('AgentConfig', {
         extraBody: null,
         frequencyPenalty: null,
+        json: true,
         maxLength: null,
-        maxTokens: null,
+        maxTokens: 4096,
         minLength: null,
-        model: 'e2e-model',
+        minP: null,
+        model,
+        n: 1,
         presencePenalty: null,
         price: null,
         reasoning: null,
         repetitionPenalty: null,
+        responseMimeType: null,
         temperature: null,
         topK: null,
         topP: null,
     });
 
-const agentsConfig = (): AgentsConfigFragmentFragment =>
+const agentsConfig = (model?: string): AgentsConfigFragmentFragment =>
     entity('AgentsConfig', {
-        adviser: agentConfig(),
-        assistant: agentConfig(),
-        coder: agentConfig(),
-        enricher: agentConfig(),
-        generator: agentConfig(),
-        installer: agentConfig(),
-        pentester: agentConfig(),
-        primaryAgent: agentConfig(),
-        refiner: agentConfig(),
-        reflector: agentConfig(),
-        searcher: agentConfig(),
-        simple: agentConfig(),
-        simpleJson: agentConfig(),
+        adviser: agentConfig(model),
+        assistant: agentConfig(model),
+        coder: agentConfig(model),
+        enricher: agentConfig(model),
+        generator: agentConfig(model),
+        installer: agentConfig(model),
+        pentester: agentConfig(model),
+        primaryAgent: agentConfig(model),
+        refiner: agentConfig(model),
+        reflector: agentConfig(model),
+        searcher: agentConfig(model),
+        simple: agentConfig(model),
+        simpleJson: agentConfig(model),
     });
 
-const defaultConfig = (id: string, type: ProviderType): ProviderConfigFragmentFragment =>
+/**
+ * Defaults are not database rows: the resolver builds them without an ID, so the wire carries the
+ * bare number `0` for every one. `ProviderConfig.keyFields`'s id-0 branch exists for that shape, and
+ * a distinct string id here leaves it unexercised.
+ */
+const defaultConfig = (type: ProviderType): ProviderConfigFragmentFragment =>
     entity('ProviderConfig', {
-        agents: agentsConfig(),
+        // Distinct per type, so two defaults collapsing onto one cache entry is observable.
+        agents: agentsConfig(`e2e-${type}-model`),
         createdAt: T,
-        id,
-        name: `default-${type}`,
+        id: 0 as unknown as string,
+        name: type,
         type,
         updatedAt: T,
     });
 
+const modelConfig = (name: string): ModelConfigFragmentFragment =>
+    entity('ModelConfig', { name, price: null, reasoning: null, thinking: null });
+
+// The backend fills a default config AND a model catalog for EVERY type, keyed or not (verified live:
+// gemini/deepseek/ollama all return a non-null default and a populated catalog with zero keys). A
+// cassette leaving them null/[] encodes a wire state the resolver never emits and leaves the
+// create-form's model-dropdown seeding path structurally unreachable.
+const allDefaults = () =>
+    entity('DefaultProvidersConfig', {
+        anthropic: defaultConfig(ProviderType.Anthropic),
+        bedrock: defaultConfig(ProviderType.Bedrock),
+        custom: defaultConfig(ProviderType.Custom),
+        deepseek: defaultConfig(ProviderType.Deepseek),
+        gemini: defaultConfig(ProviderType.Gemini),
+        glm: defaultConfig(ProviderType.Glm),
+        kimi: defaultConfig(ProviderType.Kimi),
+        minimax: defaultConfig(ProviderType.Minimax),
+        ollama: defaultConfig(ProviderType.Ollama),
+        openai: defaultConfig(ProviderType.Openai),
+        qwen: defaultConfig(ProviderType.Qwen),
+    });
+
+const catalog = (type: ProviderType) => [modelConfig(`e2e-${type}-model`), modelConfig(`e2e-${type}-model-mini`)];
+
+const allModels = () =>
+    entity('ProvidersModelsList', {
+        anthropic: catalog(ProviderType.Anthropic),
+        bedrock: catalog(ProviderType.Bedrock),
+        custom: catalog(ProviderType.Custom),
+        deepseek: catalog(ProviderType.Deepseek),
+        gemini: catalog(ProviderType.Gemini),
+        glm: catalog(ProviderType.Glm),
+        kimi: catalog(ProviderType.Kimi),
+        minimax: catalog(ProviderType.Minimax),
+        ollama: catalog(ProviderType.Ollama),
+        openai: catalog(ProviderType.Openai),
+        qwen: catalog(ProviderType.Qwen),
+    });
+
 const noProviders: ResultOf<typeof SettingsProvidersDocument> = {
     settingsProviders: entity('ProvidersConfig', {
-        default: entity('DefaultProvidersConfig', {
-            anthropic: defaultConfig('default-anthropic', ProviderType.Anthropic),
-            bedrock: null,
-            custom: null,
-            deepseek: null,
-            gemini: null,
-            glm: null,
-            kimi: null,
-            minimax: null,
-            ollama: null,
-            openai: defaultConfig('default-openai', ProviderType.Openai),
-            qwen: null,
-        }),
+        default: allDefaults(),
         enabled: entity('ProvidersReadinessStatus', {
             anthropic: false,
             bedrock: false,
@@ -88,19 +131,7 @@ const noProviders: ResultOf<typeof SettingsProvidersDocument> = {
             openai: false,
             qwen: false,
         }),
-        models: entity('ProvidersModelsList', {
-            anthropic: [],
-            bedrock: [],
-            custom: [],
-            deepseek: [],
-            gemini: [],
-            glm: [],
-            kimi: [],
-            minimax: [],
-            ollama: [],
-            openai: [],
-            qwen: [],
-        }),
+        models: allModels(),
         userDefined: [],
     }),
 };
@@ -117,21 +148,27 @@ export const settingsProvidersCassette = (override: Cassette = {}): Cassette =>
         override,
     );
 
-const populatedProviders: ResultOf<typeof SettingsProvidersDocument> = {
+export const SEEDED_PROVIDER = {
+    id: 'custom-1',
+    name: 'My Custom Endpoint',
+    type: ProviderType.Custom,
+};
+
+export const seededProviderRow = (): ProviderConfigFragmentFragment =>
+    entity('ProviderConfig', {
+        agents: agentsConfig(),
+        createdAt: T,
+        id: SEEDED_PROVIDER.id,
+        name: SEEDED_PROVIDER.name,
+        type: SEEDED_PROVIDER.type,
+        updatedAt: T,
+    });
+
+/** The whole settingsProviders answer with a chosen set of user-defined rows — a delete asserts against
+ *  the follow-up answer, so the list has to be expressible without the deleted row. */
+export const providersList = (...userDefined: ProviderConfigFragmentFragment[]) => ({
     settingsProviders: entity('ProvidersConfig', {
-        default: entity('DefaultProvidersConfig', {
-            anthropic: defaultConfig('default-anthropic', ProviderType.Anthropic),
-            bedrock: null,
-            custom: null,
-            deepseek: null,
-            gemini: null,
-            glm: null,
-            kimi: null,
-            minimax: null,
-            ollama: null,
-            openai: defaultConfig('default-openai', ProviderType.Openai),
-            qwen: null,
-        }),
+        default: allDefaults(),
         enabled: entity('ProvidersReadinessStatus', {
             anthropic: true,
             bedrock: false,
@@ -145,32 +182,73 @@ const populatedProviders: ResultOf<typeof SettingsProvidersDocument> = {
             openai: true,
             qwen: false,
         }),
-        models: entity('ProvidersModelsList', {
-            anthropic: [],
-            bedrock: [],
-            custom: [],
-            deepseek: [],
-            gemini: [],
-            glm: [],
-            kimi: [],
-            minimax: [],
-            ollama: [],
-            openai: [],
-            qwen: [],
-        }),
-        userDefined: [
-            entity('ProviderConfig', {
-                agents: agentsConfig(),
-                createdAt: T,
-                id: 'custom-1',
-                name: 'My Custom Endpoint',
-                type: ProviderType.Custom,
-                updatedAt: T,
-            }),
-        ],
+        models: allModels(),
+        userDefined,
     }),
+});
+
+/** A second row so a delete spec can operate a row that is not index 0, and prove the table survived. */
+export const OTHER_PROVIDER = {
+    id: 'custom-2',
+    name: 'Second Endpoint',
 };
 
+export const OTHER_PROVIDER_ROW = (): ProviderConfigFragmentFragment =>
+    entity('ProviderConfig', {
+        agents: agentsConfig(),
+        createdAt: T,
+        id: OTHER_PROVIDER.id,
+        name: OTHER_PROVIDER.name,
+        type: ProviderType.Custom,
+        updatedAt: T,
+    });
+
+/** updateProvider answers with ProviderConfig, and Apollo writes it straight onto the row the list
+ *  renders — returning the pre-edit name would make the list contradict the save. */
+export const renamedProviderRow = (name: string): ProviderConfigFragmentFragment =>
+    entity('ProviderConfig', {
+        agents: agentsConfig(),
+        createdAt: T,
+        id: SEEDED_PROVIDER.id,
+        name,
+        type: SEEDED_PROVIDER.type,
+        updatedAt: T,
+    });
+
+const populatedProviders: ResultOf<typeof SettingsProvidersDocument> = providersList(seededProviderRow());
+
+const testResult = (name: string, result: boolean): TestResultFragmentFragment =>
+    entity('TestResult', {
+        error: result ? null : 'e2e simulated failure',
+        latency: 42,
+        name,
+        reasoning: false,
+        result,
+        streaming: false,
+        type: 'chat',
+    });
+
+export const agentTestResult = (result = true): AgentTestResultFragmentFragment =>
+    entity('AgentTestResult', { tests: [testResult('chat completion', result)] });
+
+/** One agent fails on purpose: a dialog that renders only the passing rows would still look right. */
+export const providerTestResult = (): ProviderTestResultFragmentFragment =>
+    entity('ProviderTestResult', {
+        adviser: agentTestResult(),
+        assistant: agentTestResult(),
+        coder: agentTestResult(),
+        enricher: agentTestResult(),
+        generator: agentTestResult(),
+        installer: agentTestResult(),
+        pentester: agentTestResult(false),
+        primaryAgent: agentTestResult(),
+        refiner: agentTestResult(),
+        reflector: agentTestResult(),
+        searcher: agentTestResult(),
+        simple: agentTestResult(),
+        simpleJson: agentTestResult(),
+    });
+
 export const populatedSettingsProvidersCassette = (override: Cassette = {}): Cassette =>
     mergeCassettes(
         {
diff --git a/frontend/e2e/mocks/install.ts b/frontend/e2e/mocks/install.ts
index 0e766d4c..a374d73d 100644
--- a/frontend/e2e/mocks/install.ts
+++ b/frontend/e2e/mocks/install.ts
@@ -1,20 +1,21 @@
-import type { Page } from '@playwright/test';
+import type { BrowserContext, Route } from '@playwright/test';
 
 import type { MockWorld } from './world.ts';
 
 import { installWsMock } from './ws-graphql.ts';
 
+const API_GLOB = '**/api/v1/**';
 const GRAPHQL_PATH = '/api/v1/graphql';
 
-export const installMockRoutes = async (page: Page, world: MockWorld): Promise<void> => {
-    await installWsMock(page, world);
+export const installMockRoutes = async (context: BrowserContext, world: MockWorld): Promise<void> => {
+    await installWsMock(context, world);
 
     // Single catch-all over the whole API surface: anything without a cassette
     // entry fails fast (501 + recorded in world.unmatched, asserted at teardown)
     // instead of leaking through the vite preview proxy to a live backend.
-    await page.route('**/api/v1/**', async (route) => {
+    const serve = async (route: Route) => {
         const request = route.request();
-        const { pathname } = new URL(request.url());
+        const { pathname, searchParams } = new URL(request.url());
 
         if (pathname === GRAPHQL_PATH && request.method() === 'POST') {
             const body = request.postDataJSON() as {
@@ -26,10 +27,11 @@ export const installMockRoutes = async (page: Page, world: MockWorld): Promise<v
 
             if (entry) {
                 await route.fulfill({
-                    json: {
+                    json: entry.body ?? {
                         ...(entry.data === undefined ? {} : { data: entry.data }),
                         ...(entry.errors ? { errors: entry.errors } : {}),
                     },
+                    status: entry.status ?? 200,
                 });
 
                 return;
@@ -50,7 +52,7 @@ export const installMockRoutes = async (page: Page, world: MockWorld): Promise<v
         const body = contentType.includes('application/json')
             ? (request.postDataJSON() as Record<string, unknown> | undefined)
             : undefined;
-        const entry = world.matchRest(request.method(), pathname, body ?? undefined);
+        const entry = world.matchRest(request.method(), pathname, body ?? undefined, searchParams);
 
         if (entry) {
             await route.fulfill(
@@ -66,10 +68,15 @@ export const installMockRoutes = async (page: Page, world: MockWorld): Promise<v
             return;
         }
 
-        world.reportUnmatched(`${request.method()} ${pathname}`);
+        world.reportUnmatched(`${request.method()} ${pathname}${searchParams.size ? `?${searchParams}` : ''}`);
         await route.fulfill({
             json: { error: `e2e: no cassette entry for ${request.method()} ${pathname}`, status: 'error' },
             status: 501,
         });
-    });
+    };
+
+    // A page route is not inherited by the popups that page opens, so arm every page the context gets.
+    context.on('page', (opened) => void opened.route(API_GLOB, serve));
+
+    await Promise.all(context.pages().map((existing) => existing.route(API_GLOB, serve)));
 };
diff --git a/frontend/e2e/mocks/world.ts b/frontend/e2e/mocks/world.ts
index 81028d50..2688b4d1 100644
--- a/frontend/e2e/mocks/world.ts
+++ b/frontend/e2e/mocks/world.ts
@@ -39,6 +39,17 @@ const isSubsetMatch = (expected?: Record<string, unknown>, actual?: Record<strin
 
 const sleep = (delayMs: number) => new Promise<void>((resolve) => setTimeout(resolve, delayMs));
 
+/** Repeated keys (`paths[]=a&paths[]=b`) collapse to the full list, so a subset match sees both. */
+const queryRecord = (search?: URLSearchParams): Record<string, string | string[]> =>
+    Object.fromEntries(
+        [...(search?.keys() ?? [])]
+            .map((key) => [key, search!.getAll(key)])
+            .map(([key, values]) => [key, (values as string[]).length > 1 ? values : (values as string[])[0]]),
+    );
+
+export const subscriptionStreamKey = (operationName: string, variables?: Record<string, unknown>): string =>
+    `sub:${operationName}:${stableStringify(variables ?? {})}`;
+
 export interface MockSocket {
     close: (options?: { code?: number; reason?: string }) => unknown;
 }
@@ -100,29 +111,46 @@ export class MockWorld {
             const candidates = this.eligible(matching);
 
             if (matching && candidates?.length) {
-                return this.nextEntry(`gql:${operationName}:${stableStringify(variables ?? {})}`, candidates, matching);
+                // Same cursor rule as matchRest below: key on the selected entries' pins, so an
+                // operation whose variables carry a per-call volatile field still advances its
+                // sequence instead of re-serving step one.
+                const signature = matching.map((entry) => stableStringify(entry.variables ?? null)).join('|');
+
+                return this.nextEntry(`gql:${operationName}:${signature}`, candidates, matching);
             }
         }
 
         return undefined;
     }
 
-    matchRest(method: string, pathname: string, body?: Record<string, unknown>): RestCassetteEntry | undefined {
+    matchRest(
+        method: string,
+        pathname: string,
+        body?: Record<string, unknown>,
+        search?: URLSearchParams,
+    ): RestCassetteEntry | undefined {
         const normalized = pathname.replace(/\/+$/, '');
         const key = Object.keys(this.cassette.rest ?? {}).find((candidate) => {
             const [candidateMethod, candidatePath = ''] = candidate.split(' ');
 
             return candidateMethod === method && candidatePath.replace(/\/+$/, '') === normalized;
         });
-        const matching = (key ? this.cassette.rest?.[key] : undefined)?.filter((entry) =>
-            isSubsetMatch(entry.bodySubset, body),
+        const query = queryRecord(search);
+        const matching = (key ? this.cassette.rest?.[key] : undefined)?.filter(
+            (entry) => isSubsetMatch(entry.bodySubset, body) && isSubsetMatch(entry.querySubset, query),
         );
         const candidates = this.eligible(matching);
 
-        // Include the body in the cursor key (as the GraphQL half keys on variables): two
-        // body-differentiated sequences for one path must not reset each other's cursor.
+        // Key the cursor on which entries the request selected — their pins — not the raw body/query.
+        // Two payload-differentiated sequences still get distinct keys (their entries pin different
+        // subsets), but a request carrying a per-call volatile field (an idempotency key, a timestamp)
+        // no longer fragments its own cursor into a fresh sequence on every call.
+        const signature = matching
+            ?.map((entry) => stableStringify([entry.bodySubset ?? null, entry.querySubset ?? null]))
+            .join('|');
+
         return matching && candidates?.length
-            ? this.nextEntry(`rest:${method}:${normalized}:${stableStringify(body ?? {})}`, candidates, matching)
+            ? this.nextEntry(`rest:${method}:${normalized}:${signature}`, candidates, matching)
             : undefined;
     }
 
@@ -136,7 +164,7 @@ export class MockWorld {
 
         // Key on the request's variables, not the entry's: an entry written without variables would
         // otherwise merge every flow's subscribers onto one stream, and the second would join delta-only.
-        return entry ? { entry, streamKey: `sub:${operationName}:${stableStringify(variables ?? {})}` } : undefined;
+        return entry ? { entry, streamKey: subscriptionStreamKey(operationName, variables) } : undefined;
     }
 
     raiseFlag(flag: string): void {
@@ -157,6 +185,10 @@ export class MockWorld {
         this.unmatchedSubscriptions.push(description);
     }
 
+    subscriberCount(streamKey: string): number {
+        return this.streams.get(streamKey)?.subscribers.size ?? 0;
+    }
+
     subscribeStream(streamKey: string, entry: SubscriptionCassetteEntry, subscriber: StreamSubscriber): () => void {
         const state = this.streams.get(streamKey) ?? { cursor: 0, isDriving: false, subscribers: new Set() };
 
diff --git a/frontend/e2e/mocks/world.unit.test.ts b/frontend/e2e/mocks/world.unit.test.ts
index dba376e5..d0c6d6f4 100644
--- a/frontend/e2e/mocks/world.unit.test.ts
+++ b/frontend/e2e/mocks/world.unit.test.ts
@@ -56,6 +56,66 @@ describe('MockWorld matching', () => {
         expect(world.matchRest('POST', '/api/v1/resources/mkdir/', { path: 'new-folder' })).toBeDefined();
     });
 
+    it('pins a query-carrying request on querySubset, the way bodySubset pins a payload', () => {
+        const world = new MockWorld({
+            rest: {
+                'DELETE /api/v1/resources/': [
+                    { body: { deleted: 'notes' }, querySubset: { 'paths[]': 'notes.txt' } },
+                    { body: { deleted: 'both' }, querySubset: { 'paths[]': ['a.txt', 'b.txt'] } },
+                ],
+            },
+        });
+        const query = (search: string) => new URLSearchParams(search);
+
+        expect(world.matchRest('DELETE', '/api/v1/resources/', undefined, query('paths[]=notes.txt'))?.body).toEqual({
+            deleted: 'notes',
+        });
+        expect(
+            world.matchRest('DELETE', '/api/v1/resources/', undefined, query('paths[]=a.txt&paths[]=b.txt'))?.body,
+        ).toEqual({ deleted: 'both' });
+        // The path alone must not answer for a payload no entry describes.
+        expect(world.matchRest('DELETE', '/api/v1/resources/', undefined, query('paths[]=secret.txt'))).toBeUndefined();
+    });
+
+    it('advances a REST sequence even when each request carries a volatile body field', () => {
+        const world = new MockWorld({
+            rest: {
+                'POST /api/v1/resources/mkdir': [{ body: { step: 1 } }, { body: { step: 2 } }],
+            },
+        });
+        // Each call sends a fresh idempotency key — a field no entry pins. The cursor must key on the
+        // selected entries, not the raw body, or every call re-serves step 1.
+        const first = world.matchRest('POST', '/api/v1/resources/mkdir', { idempotencyKey: 'a1' });
+        const second = world.matchRest('POST', '/api/v1/resources/mkdir', { idempotencyKey: 'b2' });
+
+        expect(first?.body).toEqual({ step: 1 });
+        expect(second?.body).toEqual({ step: 2 });
+    });
+
+    it('advances a GraphQL sequence even when each request carries a volatile variable', () => {
+        const world = new MockWorld({
+            queries: { flows: [{ data: { step: 1 } }, { data: { step: 2 } }] },
+        });
+
+        expect(world.matchGraphQL('flows', { nonce: 'a' })?.data).toEqual({ step: 1 });
+        expect(world.matchGraphQL('flows', { nonce: 'b' })?.data).toEqual({ step: 2 });
+    });
+
+    it('keeps variable-pinned sequences apart from one another', () => {
+        const world = new MockWorld({
+            queries: {
+                stats: [
+                    { data: { period: 'week' }, variables: { period: 'week' } },
+                    { data: { period: 'month' }, variables: { period: 'month' } },
+                ],
+            },
+        });
+
+        expect(world.matchGraphQL('stats', { period: 'week' })?.data).toEqual({ period: 'week' });
+        expect(world.matchGraphQL('stats', { period: 'month' })?.data).toEqual({ period: 'month' });
+        expect(world.matchGraphQL('stats', { period: 'week' })?.data).toEqual({ period: 'week' });
+    });
+
     it('hides a flag-gated entry until the flag is raised, then lets it outrank the unflagged one', () => {
         const world = new MockWorld({
             mutations: { login: [{ data: { ok: true }, setFlag: 'logged-in' }] },
@@ -67,6 +127,26 @@ describe('MockWorld matching', () => {
         expect(world.matchGraphQL('info', {})?.data).toEqual({ role: 'user' });
     });
 
+    it('prefers the newly-enabled entry over the next unserved one, not merely the next in order', () => {
+        // Three candidates, so sequencing and the flag rule disagree: with the rule the raised flag
+        // jumps straight to `flagged`; without it the cursor would just hand out `second`. The
+        // two-entry cases above cannot tell the two apart.
+        const world = new MockWorld({
+            mutations: { go: [{ data: {}, setFlag: 'go' }] },
+            queries: {
+                stage: [
+                    { data: { stage: 'first' } },
+                    { data: { stage: 'second' } },
+                    { data: { stage: 'flagged' }, whenFlag: 'go' },
+                ],
+            },
+        });
+
+        expect(world.matchGraphQL('stage', {})?.data).toEqual({ stage: 'first' });
+        world.matchGraphQL('go', {});
+        expect(world.matchGraphQL('stage', {})?.data).toEqual({ stage: 'flagged' });
+    });
+
     it('advances to the newly-enabled entry after a second flag, without replaying the first', () => {
         const world = new MockWorld({
             mutations: { f1: [{ data: {}, setFlag: 'f1' }], f2: [{ data: {}, setFlag: 'f2' }] },
diff --git a/frontend/e2e/mocks/ws-graphql.ts b/frontend/e2e/mocks/ws-graphql.ts
index 8273b42e..c27a81ea 100644
--- a/frontend/e2e/mocks/ws-graphql.ts
+++ b/frontend/e2e/mocks/ws-graphql.ts
@@ -1,4 +1,4 @@
-import type { Page } from '@playwright/test';
+import type { BrowserContext } from '@playwright/test';
 
 import type { MockWorld } from './world.ts';
 
@@ -54,7 +54,7 @@ export const handleWsConnection = (
 
                 case 'connection_init': {
                     // Ack immediately; a frame sent before the ack is a graphql-ws protocol
-                    // violation that closes the socket. Ack-first ordering is pinned by the unit test.
+                    // violation that closes the socket.
                     send({ type: 'connection_ack' });
                     break;
                 }
@@ -98,8 +98,8 @@ export const handleWsConnection = (
     };
 };
 
-export const installWsMock = async (page: Page, world: MockWorld): Promise<void> => {
-    await page.routeWebSocket('**/api/v1/graphql', (ws) => {
+export const installWsMock = async (context: BrowserContext, world: MockWorld): Promise<void> => {
+    await context.routeWebSocket('**/api/v1/graphql', (ws) => {
         const connection = handleWsConnection(world, ws);
 
         ws.onMessage((raw) => connection.onMessage(String(raw)));
diff --git a/frontend/e2e/mocks/ws-graphql.unit.test.ts b/frontend/e2e/mocks/ws-graphql.unit.test.ts
index e622b7f2..2149958b 100644
--- a/frontend/e2e/mocks/ws-graphql.unit.test.ts
+++ b/frontend/e2e/mocks/ws-graphql.unit.test.ts
@@ -155,8 +155,12 @@ describe('graphql-ws mock protocol contract', () => {
 
         world.dropSockets();
 
-        // graphql-ws resubscribes active sinks after the retry connect.
+        // graphql-ws resubscribes active sinks in a microtask AFTER the retry connect, so gating on
+        // the reconnect alone races the resubscribe: raising the flag before the sink re-registers
+        // delivers seq:2 to an empty subscriber set and the no-replay contract loses it. Gate on the
+        // server-side resubscription instead.
         await vi.waitFor(() => expect(retries).toEqual([false, true]));
+        await vi.waitFor(() => expect(world.subscriberCount('sub:stream:{}')).toBe(1));
 
         world.matchGraphQL('raise');
 
diff --git a/frontend/e2e/playwright.config.ts b/frontend/e2e/playwright.config.ts
index 9f936482..fb5b7fc8 100644
--- a/frontend/e2e/playwright.config.ts
+++ b/frontend/e2e/playwright.config.ts
@@ -26,7 +26,7 @@ const here = (relative: string) => fileURLToPath(new URL(relative, import.meta.u
 export const AUTH_STATE_PATH = here('./.auth/user.json');
 
 const TIERS: Record<BackendTier, { baseURL: string; installMocks: boolean }> = {
-    local: { baseURL: process.env.E2E_BASE_URL ?? 'https://localhost:8443', installMocks: false },
+    local: { baseURL: process.env.E2E_BASE_URL ?? '', installMocks: false },
     mock: { baseURL: `http://localhost:${PREVIEW_PORT}`, installMocks: true },
     stand: { baseURL: process.env.E2E_BASE_URL ?? '', installMocks: false },
 };
@@ -37,19 +37,20 @@ if (!(rawTier in TIERS)) {
 
 const tier = rawTier as BackendTier;
 
-if (tier === 'stand' && !TIERS.stand.baseURL) {
-    throw new Error('E2E_TIER=stand requires E2E_BASE_URL');
+// Both stand and local hit a real backend and bake the real (paid) flow-run specs, so neither may
+// fall back to a default: a bare `E2E_TIER=local` must not silently target the dev stack. run-local-tier.sh
+// supplies E2E_BASE_URL for the legitimate path.
+if ((tier === 'stand' || tier === 'local') && !TIERS[tier].baseURL) {
+    throw new Error(`E2E_TIER=${tier} requires E2E_BASE_URL`);
 }
 
 export default defineConfig<BackendOptions>({
-    // A colour change must move enough pixels to fail. The baselines and the run both
-    // render in the pinned container (the host path is blocked above), so there is no
-    // host-vs-CI rasterisation noise to absorb — tighten the per-pixel threshold below
-    // Playwright's default 0.2 so a one-step palette shift is caught, with a small
-    // maxDiffPixelRatio for anti-aliasing at glyph edges. cross/contrast.spec.ts still
-    // measures colour numerically as the belt-and-suspenders check.
+    // Absolute, not a ratio: 1% of a 1280x720 baseline is 9,216 pixels, more than any one foreground
+    // token covers, so a token could change hue with every baseline still matching. Baselines and
+    // run both render in the pinned container (the host path is blocked above), so 200px absorbs the
+    // glyph anti-aliasing without host-vs-CI noise.
     expect: {
-        toHaveScreenshot: { maxDiffPixelRatio: 0.01, threshold: 0.02 },
+        toHaveScreenshot: { maxDiffPixels: 200, threshold: 0.02 },
     },
     forbidOnly: isCI,
     fullyParallel: true,
@@ -110,7 +111,10 @@ export default defineConfig<BackendOptions>({
         // Stand traces/videos embed the live session cookie and the setup
         // project's password fill; CI uploads test-results as a public-repo
         // artifact, so they must never be recorded on that tier.
-        trace: tier === 'stand' ? 'off' : 'on-first-retry',
+        // retain-on-failure, not on-first-retry: the mock PR gate runs retries:0,
+        // so on-first-retry would never write a trace — yet the docs and the PR
+        // comment tell you to open trace.zip from that tier's report.
+        trace: tier === 'stand' ? 'off' : 'retain-on-failure',
         video: tier === 'stand' ? 'off' : 'retain-on-failure',
     },
     // The gate must test the shipped artifact: keep this on the production build,
diff --git a/frontend/e2e/route-manifest.unit.test.ts b/frontend/e2e/route-manifest.unit.test.ts
index 9823a70d..d1380793 100644
--- a/frontend/e2e/route-manifest.unit.test.ts
+++ b/frontend/e2e/route-manifest.unit.test.ts
@@ -1,9 +1,17 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { describe, expect, it } from 'vitest';
 
 import { routes } from '@/lib/routes';
 
+import { affectedRoutes } from './affected-routes.ts';
 import { ROUTE_MANIFEST } from './routes.ts';
 
+const { RULES } = (await import(pathToFileURL(join(__dirname, 'mock-llm', 'scenario.mjs')).href)) as {
+    RULES: { label: string; match: RegExp }[];
+};
+
 /**
  * Routes deliberately outside the manifest sweeps (nav, visual, a11y,
  * diff-scoping), each with the reason. Adding a route to lib/routes forces a
@@ -75,3 +83,42 @@ describe('ROUTE_MANIFEST completeness', () => {
         expect(dynamicRouteKeys(routes).sort()).toEqual(Object.keys(DYNAMIC_ROUTES).sort());
     });
 });
+
+const SHELL_DIR = 'components/layouts/main';
+
+const shellImports = (): string[] => {
+    const dir = join(__dirname, '..', 'src', SHELL_DIR);
+
+    return readdirSync(dir)
+        .filter((file) => file.endsWith('.tsx') && !file.endsWith('.test.tsx'))
+        .flatMap((file) => [...readFileSync(join(dir, file), 'utf8').matchAll(/from '@\/([^']+)'/g)])
+        .flatMap(([, imported]) => (imported ? [`frontend/src/${imported}`] : []));
+};
+
+describe('ROUTE_MANIFEST ownership', () => {
+    it('never scopes a source the app shell imports to a subset of the swept routes', () => {
+        const underScoped = shellImports().filter(
+            (file) => affectedRoutes([file], ROUTE_MANIFEST).length < ROUTE_MANIFEST.length,
+        );
+
+        expect(underScoped).toEqual([]);
+    });
+});
+
+describe('mock-llm rule matching', () => {
+    const rule = RULES.find((entry) => entry.label === 'subagent-terminal-report');
+
+    it('answers only a request carrying both markers', () => {
+        expect(rule?.match.test('{"tools":["hack_result"],"text":"E2E_TERMINAL_OK"}')).toBe(true);
+        expect(rule?.match.test('{"tools":["hack_result"]}')).toBe(false);
+        expect(rule?.match.test('{"text":"E2E_TERMINAL_OK"}')).toBe(false);
+    });
+
+    it('rejects a marker-less request without re-scanning from every offset', () => {
+        const request = JSON.stringify({ messages: 'a'.repeat(120 * 1024) });
+        const started = performance.now();
+
+        expect(rule?.match.test(request)).toBe(false);
+        expect(performance.now() - started).toBeLessThan(500);
+    });
+});
diff --git a/frontend/e2e/routes.ts b/frontend/e2e/routes.ts
index dcccbb10..e20c2179 100644
--- a/frontend/e2e/routes.ts
+++ b/frontend/e2e/routes.ts
@@ -7,7 +7,7 @@ import type { Cassette } from './mocks/cassette.ts';
 
 import { apiTokensCassette } from './mocks/cassettes/api-tokens.ts';
 import { dashboardCassette } from './mocks/cassettes/dashboard.ts';
-import { flowsCassette, flowTabsCassette } from './mocks/cassettes/flows.ts';
+import { flowsCassette, flowTabsCassette, TABS_FILE_NAME, TABS_SCREENSHOT_URL } from './mocks/cassettes/flows.ts';
 import { knowledgesCassette } from './mocks/cassettes/knowledges.ts';
 import { resourcesCassette } from './mocks/cassettes/resources.ts';
 import { settingsPromptsCassette } from './mocks/cassettes/settings-prompts.ts';
@@ -27,9 +27,31 @@ export interface RouteManifestEntry {
      */
     sources: string[];
     /** Radix unmounts inactive tab panels, so one scan of the default view sees none of them. */
-    tabs?: string[];
+    tabs?: RouteTab[];
 }
 
+export interface RouteTab {
+    name: string;
+    /**
+     * Must be absent while the panel loads: a marker that also renders on the
+     * skeleton lets every per-tab scan pass on an empty panel.
+     */
+    ready: (page: Page) => Locator;
+}
+
+/** Order matters: the flow auto-opens Assistant, so tabs.spec pins that no entry is already open. */
+export const FLOW_DETAIL_TABS: RouteTab[] = [
+    { name: 'Dashboard', ready: (page) => page.getByText('Usage by Model & Provider') },
+    { name: 'Assistant', ready: (page) => page.getByText('New assistant', { exact: true }) },
+    { name: 'Automation', ready: (page) => page.getByText('No active tasks') },
+    { name: 'Tasks', ready: (page) => page.getByText('E2E Task Alpha') },
+    { name: 'Agents', ready: (page) => page.getByText('E2E agent reconnaissance') },
+    { name: 'Searches', ready: (page) => page.getByText('E2E search for the CVE') },
+    { name: 'Vector Store', ready: (page) => page.getByText('E2E recall prior findings') },
+    { name: 'Files', ready: (page) => page.getByText(TABS_FILE_NAME) },
+    { name: 'Screenshots', ready: (page) => page.getByText(TABS_SCREENSHOT_URL) },
+];
+
 /**
  * The routes swept by NAV/visual/a11y specs and CI diff-scoping. This is a
  * subset of the app's routes — route-manifest.unit.test.ts pins the excluded
@@ -47,18 +69,20 @@ export const ROUTE_MANIFEST: RouteManifestEntry[] = [
         sources: ['src/pages/flows/flows.tsx', 'src/features/flows', 'src/providers/flows-provider.tsx'],
     },
     {
-        // Message metadata (date + ID) renders at 50% opacity by design; revisit
-        // with the design pass.
+        // Message metadata (date + ID) is by design and route-wide; the rest are defects awaiting a
+        // fix, each scoped to the tab whose panel owns it so it cannot silence the rule elsewhere.
         a11yWaivers: [
             { rule: 'color-contrast', target: /text-muted-foreground\\?\/50/ },
-            // The tab-panel ones below are defects awaiting a fix, not accepted design.
-            { rule: 'aria-progressbar-name', target: /bg-primary/ },
-            { rule: 'button-name', target: /span\[data-slot|button\[aria-label/ },
-            { rule: 'target-size', target: /text-blue-400|button\[aria-label/ },
-            { rule: 'color-contrast', target: /font-semibold\.truncate/ },
-            // The same file-manager row metadata waived on /resources — this tab embeds it.
-            { rule: 'color-contrast', target: /text-muted-foreground\\?\/80/ },
-            { rule: 'scrollable-region-focusable', target: /table-container/ },
+            { rule: 'aria-progressbar-name', tabs: ['Tasks'], target: /\.bg-primary\\\/20/ },
+            { rule: 'button-name', tabs: ['Files'], target: /tooltip-trigger.*size-8\[data-slot="button"\]/ },
+            { rule: 'target-size', tabs: ['Files'], target: /text-blue-400|button\[aria-label="Select / },
+            // The same file-manager row metadata waived on /resources — the Files tab embeds it.
+            { rule: 'color-contrast', tabs: ['Files'], target: /text-muted-foreground\\?\/80/ },
+            {
+                rule: 'scrollable-region-focusable',
+                tabs: ['Dashboard', 'Files'],
+                target: /\[data-slot="table-container"\]/,
+            },
         ],
         // Must stay the populated cassette: the empty seed renders none of the sources below.
         cassette: flowTabsCassette,
@@ -73,21 +97,27 @@ export const ROUTE_MANIFEST: RouteManifestEntry[] = [
             'src/providers/flows-provider.tsx',
             'src/components/shared/file-manager',
             'src/components/dashboard',
-            'src/features/resources',
+            // Assistant-tab FlowForm reads useTemplates, so a provider change reaches this route too.
+            'src/providers/templates-provider.tsx',
         ],
-        tabs: ['Assistant', 'Dashboard', 'Tasks', 'Agents', 'Searches', 'Vector Store', 'Files', 'Screenshots'],
+        tabs: FLOW_DETAIL_TABS,
     },
     {
         cassette: templatesCassette,
         path: routes.templates,
         ready: (page) => page.getByRole('row', { name: /E2E Seed Template/ }),
-        sources: ['src/pages/templates', 'src/providers/templates-provider.tsx'],
+        // The list file, not the dir: template.tsx sits beside it and no manifest route renders it,
+        // so owning the dir scopes a detail-only diff here instead of to the run-everything path.
+        sources: ['src/pages/templates/templates.tsx', 'src/providers/templates-provider.tsx'],
     },
     {
         cassette: knowledgesCassette,
         path: routes.knowledges,
         ready: (page) => page.getByRole('row', { name: /E2E Seed Question/ }),
-        sources: ['src/pages/knowledges', 'src/features/knowledges', 'src/providers/knowledges-provider.tsx'],
+        // `src/features/knowledges` is left unowned deliberately: knowledge.tsx is its only importer
+        // and that route is not swept, so claiming it here would scope its diffs to a route that
+        // never renders it rather than to the run-everything fallback.
+        sources: ['src/pages/knowledges/knowledges.tsx', 'src/providers/knowledges-provider.tsx'],
     },
     {
         cassette: apiTokensCassette,
@@ -102,8 +132,9 @@ export const ROUTE_MANIFEST: RouteManifestEntry[] = [
         a11yWaivers: [{ rule: 'aria-valid-attr-value', target: /radix-.*-trigger-/ }],
         cassette: dashboardCassette,
         path: routes.dashboard,
-        ready: (page) => page.getByRole('heading', { name: 'Flows Activity Over Time' }),
+        ready: (page) => page.getByText('E2E Alpha'),
         sources: ['src/pages/dashboard', 'src/components/dashboard'],
+        tabs: [{ name: 'Overview', ready: (page) => page.getByRole('cell', { exact: true, name: 'e2e-provider' }) }],
     },
     {
         cassette: settingsPromptsCassette,
@@ -123,13 +154,17 @@ export const ROUTE_MANIFEST: RouteManifestEntry[] = [
         // target floor — widening them is a density decision for the file manager.
         a11yWaivers: [
             { rule: 'color-contrast', target: /text-muted-foreground\\?\/80/ },
-            // `.rounded` unanchored would also match every rounded-* utility, so a
-            // future under-sized control anywhere on the page would be waived too.
-            { rule: 'target-size', target: /\.rounded(?![-\w])|aria-label="Select / },
+            // `.rounded` is anchored with a boundary so it can't match every rounded-* utility. axe
+            // emits the row-select buttons as a bare `button[aria-label="Select <name>"]` with no
+            // parent path, so the label is the only available anchor — require the button tag at
+            // least, rather than a bare `aria-label="Select ` that would also waive a non-button.
+            { rule: 'target-size', target: /\.rounded(?![-\w])|button\[aria-label="Select / },
         ],
         cassette: resourcesCassette,
         path: routes.resources,
         ready: (page) => page.getByRole('treeitem', { name: /reports/ }),
-        sources: ['src/pages/resources', 'src/features/resources', 'src/components/shared/file-manager'],
+        // `src/features/resources` is left unowned deliberately: main-sidebar.tsx pulls its upload
+        // hook into every route's shell, so any per-route listing under-reports the rest.
+        sources: ['src/pages/resources', 'src/components/shared/file-manager'],
     },
 ];
diff --git a/frontend/e2e/specs/cross/a11y.spec.ts b/frontend/e2e/specs/cross/a11y.spec.ts
index 9e9fdb77..fb2539bd 100644
--- a/frontend/e2e/specs/cross/a11y.spec.ts
+++ b/frontend/e2e/specs/cross/a11y.spec.ts
@@ -1,5 +1,7 @@
 import { expect, test } from '../../fixtures/test.ts';
-import { scanA11y } from '../../helpers/a11y.ts';
+import { scanA11y, waiversForScan } from '../../helpers/a11y.ts';
+import { expectCleanPage } from '../../helpers/errors.ts';
+import { FILE_RESOURCE, resourcesCassette } from '../../mocks/cassettes/resources.ts';
 import { populatedSettingsProvidersCassette } from '../../mocks/cassettes/settings-providers.ts';
 import { loginJourneyCassette } from '../../mocks/cassettes/smoke.ts';
 import { ROUTE_MANIFEST } from '../../routes.ts';
@@ -48,19 +50,66 @@ for (const theme of THEMES) {
                     await expect(entry.ready(page)).toBeVisible();
                     // Not redundant: a theme seed that silently stops applying reruns light under a dark label.
                     await expect(page.locator('html')).toHaveClass(theme === 'dark' ? /dark/ : /light/);
-                    await scanA11y(page, entry.path, entry.a11yWaivers);
+                    await scanA11y(page, entry.path, waiversForScan(entry.a11yWaivers));
                 });
 
                 for (const tab of entry.tabs ?? []) {
-                    test(`tab "${tab}" has no axe violations`, async ({ page }) => {
+                    test(`tab "${tab.name}" has no axe violations`, async ({ page }) => {
                         await page.goto(entry.path);
                         await expect(entry.ready(page)).toBeVisible();
                         await expect(page.locator('html')).toHaveClass(theme === 'dark' ? /dark/ : /light/);
-                        await page.getByRole('tab', { name: tab }).click();
-                        await scanA11y(page, `${entry.path} [${tab}]`, entry.a11yWaivers);
+                        await page.getByRole('tab', { name: tab.name }).click();
+                        await expect(tab.ready(page)).toBeVisible();
+                        await scanA11y(
+                            page,
+                            `${entry.path} [${tab.name}]`,
+                            waiversForScan(entry.a11yWaivers, tab.name),
+                        );
                     });
                 }
             });
         }
     });
 }
+
+test.describe('dialog keyboard contract', { tag: '@cross' }, () => {
+    test.use({ cassette: resourcesCassette() });
+
+    // Closing a dialog must hand focus back to whatever opened it. Radix only does that for its own
+    // DialogTrigger, and this app opens dialogs from controlled state, so without help focus lands on
+    // <body> and a keyboard user starts again from the top of the page.
+    test('Escape returns focus to the control that opened the dialog', async ({ page, pageErrorLog }) => {
+        await page.goto('/resources');
+
+        const opener = page.getByRole('button', { name: 'New folder' });
+
+        await opener.focus();
+        await page.keyboard.press('Enter');
+        await expect(page.getByRole('dialog')).toBeVisible();
+
+        await page.keyboard.press('Escape');
+        await expect(page.getByRole('dialog')).toBeHidden();
+
+        await expect(opener).toBeFocused();
+        expectCleanPage(pageErrorLog);
+    });
+
+    // The other dialog family: ConfirmationDialog renders its DialogContent unconditionally, so a
+    // focus hook living on the wrapper would capture whatever had focus when the PAGE mounted and
+    // restore it on navigation instead. This case is what tells the two apart.
+    test('Escape returns focus for a dialog whose content is always mounted', async ({ page, pageErrorLog }) => {
+        await page.goto('/resources');
+        await page.getByRole('checkbox', { name: `Select ${FILE_RESOURCE.name}` }).click();
+
+        const opener = page.getByRole('button', { exact: true, name: 'Delete' });
+
+        await opener.click();
+        await expect(page.getByRole('dialog')).toBeVisible();
+
+        await page.keyboard.press('Escape');
+        await expect(page.getByRole('dialog')).toBeHidden();
+
+        await expect(opener).toBeFocused();
+        expectCleanPage(pageErrorLog);
+    });
+});
diff --git a/frontend/e2e/specs/cross/contrast.spec.ts b/frontend/e2e/specs/cross/contrast.spec.ts
index 0c1756ca..1ec0dec5 100644
--- a/frontend/e2e/specs/cross/contrast.spec.ts
+++ b/frontend/e2e/specs/cross/contrast.spec.ts
@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 
 import type { BadgeVariant } from '@/components/ui/badge';
+import type { ButtonVariant } from '@/components/ui/button';
 
 import { badgeVariants } from '@/components/ui/badge';
 import { buttonVariants } from '@/components/ui/button';
@@ -8,8 +9,39 @@ import { buttonVariants } from '@/components/ui/button';
 import type { EditorProbe } from '../../helpers/contrast.ts';
 
 import { expect, test } from '../../fixtures/test.ts';
-import { AA_NORMAL, measureContrast, mountContrastProbes, mountEditorProbes } from '../../helpers/contrast.ts';
+import {
+    AA_NORMAL,
+    measureContrast,
+    measureContrastAt,
+    mountContrastProbes,
+    mountEditorProbes,
+    mountFenceProbes,
+} from '../../helpers/contrast.ts';
 import { flowsCassette } from '../../mocks/cassettes/flows.ts';
+import { PROMPT_DETAIL_AGENT, promptDetailCassette } from '../../mocks/cassettes/settings-prompts.ts';
+
+const HLJS_TOKENS = [
+    'hljs-comment',
+    'hljs-keyword',
+    'hljs-section',
+    'hljs-literal',
+    'hljs-string',
+    'hljs-attr',
+    'hljs-symbol',
+    'hljs-built_in',
+];
+
+const SYNTAX_TOKEN_CLASS: Record<string, string> = {
+    'editor-syntax-attr': 'hljs-attr',
+    'editor-syntax-class': 'hljs-built_in',
+    'editor-syntax-comment': 'hljs-comment',
+    'editor-syntax-entity': 'hljs-section',
+    'editor-syntax-fg': 'fence text',
+    'editor-syntax-keyword': 'hljs-keyword',
+    'editor-syntax-literal': 'hljs-literal',
+    'editor-syntax-string': 'hljs-string',
+    'editor-syntax-symbol': 'hljs-symbol',
+};
 
 const EDITOR_PROBES = {
     'editor-accent': { tag: 'a' },
@@ -25,7 +57,16 @@ const declaredEditorTokens = (): string[] => {
     return [...new Set(css.match(/--editor-[\w-]+/g) ?? [])].map((token) => token.slice(2));
 };
 
-// Keyed off the union so a newly added variant fails to compile until it is probed.
+// Keyed off the unions so a newly added variant fails to compile until it is probed.
+const BUTTON_VARIANTS = Object.keys({
+    default: true,
+    destructive: true,
+    ghost: true,
+    link: true,
+    outline: true,
+    secondary: true,
+} satisfies Record<ButtonVariant, true>) as ButtonVariant[];
+
 const BADGE_VARIANTS = Object.keys({
     blue: true,
     default: true,
@@ -46,12 +87,23 @@ test('every editor colour token is probed', { tag: '@cross' }, () => {
     const probed = new Set(Object.keys(EDITOR_PROBES));
     // A `-bg` token is the paired ground of its base probe, measured with it.
     const uncovered = declaredEditorTokens().filter(
-        (token) => !probed.has(token) && !(token.endsWith('-bg') && probed.has(token.slice(0, -3))),
+        (token) =>
+            !probed.has(token) &&
+            !(token.endsWith('-bg') && probed.has(token.slice(0, -3))) &&
+            !(token in SYNTAX_TOKEN_CLASS),
     );
 
     expect(uncovered).toEqual([]);
 });
 
+test('every syntax token is measured through a mounted hljs class', { tag: '@cross' }, () => {
+    const measured = new Set([...HLJS_TOKENS, 'fence text']);
+    const declared = declaredEditorTokens().filter((token) => token.startsWith('editor-syntax-'));
+
+    expect(declared.filter((token) => !measured.has(SYNTAX_TOKEN_CLASS[token] ?? ''))).toEqual([]);
+    expect(declared.sort()).toEqual(Object.keys(SYNTAX_TOKEN_CLASS).sort());
+});
+
 for (const theme of THEMES) {
     test.describe(`contrast (${theme})`, { tag: '@cross' }, () => {
         test.use({ cassette: flowsCassette() });
@@ -84,19 +136,26 @@ for (const theme of THEMES) {
             }
         });
 
-        test('the destructive button clears AA at rest and on hover', async ({ page }) => {
+        test('every button variant clears AA at rest and on hover', async ({ page }) => {
             await page.goto('/flows');
             await expect(page.getByRole('row', { name: /E2E Alpha/ })).toBeVisible();
             await expect(page.locator('html')).toHaveClass(theme === 'dark' ? /dark/ : /light/);
 
-            await mountContrastProbes(page, { destructive: buttonVariants({ variant: 'destructive' }) });
+            await mountContrastProbes(
+                page,
+                Object.fromEntries(BUTTON_VARIANTS.map((variant) => [variant, buttonVariants({ variant })])),
+            );
 
-            expect.soft(await measureContrast(page, 'destructive'), 'button at rest').toBeGreaterThanOrEqual(AA_NORMAL);
+            for (const variant of BUTTON_VARIANTS) {
+                expect
+                    .soft(await measureContrast(page, variant), `button ${variant} at rest`)
+                    .toBeGreaterThanOrEqual(AA_NORMAL);
 
-            await page.locator('[data-contrast="destructive"]').hover();
-            expect
-                .soft(await measureContrast(page, 'destructive'), 'button on hover')
-                .toBeGreaterThanOrEqual(AA_NORMAL);
+                await page.locator(`[data-contrast="${variant}"]`).hover();
+                expect
+                    .soft(await measureContrast(page, variant), `button ${variant} on hover`)
+                    .toBeGreaterThanOrEqual(AA_NORMAL);
+            }
         });
 
         test('editor highlight tokens clear AA on the editor surface', async ({ page }) => {
@@ -113,4 +172,59 @@ for (const theme of THEMES) {
             }
         });
     });
+
+    test.describe(`contrast in a code block (${theme})`, { tag: '@cross' }, () => {
+        test.use({ cassette: promptDetailCassette() });
+
+        if (theme === 'dark') {
+            test.beforeEach(async ({ page }) => {
+                await page.addInitScript(() => window.localStorage.setItem('theme', 'dark'));
+            });
+        }
+
+        test('editor highlight tokens clear AA inside a fence', async ({ page }) => {
+            await page.goto(`/settings/prompts/${PROMPT_DETAIL_AGENT}`);
+
+            const fence = page.locator('.tiptap-content .ProseMirror pre');
+
+            await expect(fence).toBeVisible();
+            await expect(page.locator('html')).toHaveClass(theme === 'dark' ? /dark/ : /light/);
+
+            // Resolve the token through a probe, not getPropertyValue: the minifier rewrites the authored
+            // text (`oklch(0.94 …)` ships as `oklch(94% …)`), which never equals the computed colour.
+            const surface = await page.evaluate(() => {
+                const probe = document.createElement('div');
+
+                probe.style.backgroundColor = 'var(--editor-code-bg)';
+                document.body.append(probe);
+
+                const resolved = getComputedStyle(probe).backgroundColor;
+
+                probe.remove();
+
+                return resolved;
+            });
+
+            expect(surface).not.toBe('');
+            await expect(fence).toHaveCSS('background-color', surface);
+
+            await mountFenceProbes(page, HLJS_TOKENS);
+
+            for (const token of HLJS_TOKENS) {
+                expect
+                    .soft(await measureContrast(page, token), `${token} inside a code block (${theme})`)
+                    .toBeGreaterThanOrEqual(AA_NORMAL);
+            }
+
+            for (const token of ['variable', 'tag'] as const) {
+                await expect(fence.locator(`.template-${token}`).first()).toBeVisible();
+                expect
+                    .soft(
+                        await measureContrastAt(page, `.tiptap-content .ProseMirror pre .template-${token}`),
+                        `editor-${token} inside a code block (${theme})`,
+                    )
+                    .toBeGreaterThanOrEqual(AA_NORMAL);
+            }
+        });
+    });
 }
diff --git a/frontend/e2e/specs/cross/palette.spec.ts b/frontend/e2e/specs/cross/palette.spec.ts
index c4ed6574..ac0d1a89 100644
--- a/frontend/e2e/specs/cross/palette.spec.ts
+++ b/frontend/e2e/specs/cross/palette.spec.ts
@@ -1,9 +1,13 @@
+import type { Page } from '@playwright/test';
+
 import type { BadgeVariant } from '@/components/ui/badge';
 
 import { badgeVariants } from '@/components/ui/badge';
 import { buttonVariants } from '@/components/ui/button';
+import { routes } from '@/lib/routes';
 
 import { expect, test } from '../../fixtures/test.ts';
+import { populatedSettingsProvidersCassette } from '../../mocks/cassettes/settings-providers.ts';
 import { ROUTE_MANIFEST } from '../../routes.ts';
 
 const BADGE_VARIANTS = Object.keys({
@@ -22,27 +26,88 @@ const BADGE_VARIANTS = Object.keys({
 
 const BUTTON_VARIANTS = ['default', 'destructive', 'ghost', 'link', 'outline', 'secondary'] as const;
 
-const SANCTIONED = new Set(
-    [
-        ...BADGE_VARIANTS.map((variant) => badgeVariants({ variant })),
-        ...BUTTON_VARIANTS.map((variant) => buttonVariants({ variant })),
-    ]
-        .join(' ')
-        .split(/\s+/),
-);
-
-// A hard-coded hue (`text-green-800`, `bg-[#16a34a]`) rather than a semantic token
-// (`bg-primary`, `text-muted-foreground`) or a non-colour utility (`text-xs`).
+// A hard-coded colour (`text-green-800`, `bg-[#16a34a]`, `text-white`) rather than a semantic token
+// (`bg-primary`, `text-muted-foreground`) or a non-colour utility (`text-xs`). white/black/transparent
+// are absolute too: an overlay like `text-white` on a coloured badge is off-palette, not a token.
 const PALETTE_UTILITY =
-    /^(?:[a-z-]+:)*(?:bg|text|border|ring|from|via|to|fill|stroke|shadow|outline|decoration|divide|accent|caret|placeholder)-(?:\[[^\]]*\]|(?:slate|gray|zinc|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose)-\d{2,3}(?:\/\d{1,3})?)$/;
+    /^(?:[a-z-]+:)*(?:bg|text|border|ring|from|via|to|fill|stroke|shadow|outline|decoration|divide|accent|caret|placeholder)-(?:white|black|transparent|\[[^\]]*\]|(?:slate|gray|zinc|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose)-\d{2,3})(?:\/\d{1,3})?$/;
 
-/** Off-palette colours already on the page, by route. Exact strings: they waive one node, not a rule. */
+/**
+ * Per-variant, not one union: a flat union sanctions every variant's hue on every badge and button,
+ * so the wrong-variant reuse this gate exists for reads as legal.
+ */
+const paletteTokensOf = (classes: string) => classes.split(/\s+/).filter((token) => PALETTE_UTILITY.test(token));
+
+const SANCTIONED_VARIANTS = [
+    ...BADGE_VARIANTS.map((variant) => ({
+        slot: 'badge',
+        tokens: paletteTokensOf(badgeVariants({ variant })),
+        variant,
+    })),
+    ...BUTTON_VARIANTS.map((variant) => ({
+        slot: 'button',
+        tokens: paletteTokensOf(buttonVariants({ variant })),
+        variant,
+    })),
+];
+
+/**
+ * Off-palette colours already on the page, keyed by scan surface. A route's default view is keyed by
+ * its path; a tab panel by `${path} [${tab}]`. Exact strings: they waive one node, not a rule.
+ */
 const ACCEPTED: Record<string, string[]> = {
-    // file-manager.tsx expand-all control; changing it moves pixels, so it goes with the design pass.
+    // file-manager.tsx expand-all control, on /resources and embedded in the flow Files tab.
     '/resources': ['button: hover:text-blue-400'],
+    [`${routes.flow('5')} [Files]`]: ['button: hover:text-blue-400'],
 };
 
+const scanOffenders = (page: Page) =>
+    page.evaluate(
+        ({ pattern, variants }) => {
+            const palette = new RegExp(pattern);
+
+            return [...document.querySelectorAll('[data-slot="badge"],[data-slot="button"]')].flatMap((element) => {
+                const slot = element.getAttribute('data-slot') ?? '';
+                const used = [...element.classList].filter((token) => palette.test(token));
+
+                if (!used.length) {
+                    return [];
+                }
+
+                // Equality, not containment: a single token borrowed from another variant is a
+                // subset of that variant's set, so containment would wave through exactly the
+                // wrong-variant reuse this gate exists to catch.
+                const covered = variants.some(
+                    (candidate) =>
+                        candidate.slot === slot &&
+                        candidate.tokens.length === used.length &&
+                        used.every((token) => candidate.tokens.includes(token)),
+                );
+
+                return covered ? [] : used.map((token) => `${slot}: ${token}`);
+            });
+        },
+        { pattern: PALETTE_UTILITY.source, variants: SANCTIONED_VARIANTS },
+    );
+
 test.describe('palette compliance', { tag: '@cross' }, () => {
+    // The manifest sweeps this route with the empty seed, so the provider cards — the surface the
+    // shipped badge defect actually lived on — render nowhere in the loop below. The a11y and visual
+    // gates each carry the same dedicated populated sweep.
+    test.describe('settings providers (populated)', () => {
+        test.use({ cassette: populatedSettingsProvidersCassette() });
+
+        test('provider cards carry no off-palette colour', async ({ page }) => {
+            await page.goto(routes.settings.providers);
+            await expect(page.getByText('My Custom Endpoint')).toBeVisible();
+
+            const offenders = await scanOffenders(page);
+            const key = `${routes.settings.providers} (populated)`;
+
+            expect(offenders.sort(), `off-palette colours on ${key}`).toEqual([...(ACCEPTED[key] ?? [])].sort());
+        });
+    });
+
     for (const entry of ROUTE_MANIFEST) {
         test.describe(entry.path, () => {
             test.use({ cassette: entry.cassette() });
@@ -51,25 +116,30 @@ test.describe('palette compliance', { tag: '@cross' }, () => {
                 await page.goto(entry.path);
                 await expect(entry.ready(page)).toBeVisible();
 
-                const offenders = await page.evaluate(
-                    ({ pattern, sanctioned }) => {
-                        const palette = new RegExp(pattern);
-                        const allowed = new Set(sanctioned);
+                const offenders = await scanOffenders(page);
 
-                        return [...document.querySelectorAll('[data-slot="badge"],[data-slot="button"]')].flatMap(
-                            (element) =>
-                                [...element.classList]
-                                    .filter((token) => palette.test(token) && !allowed.has(token))
-                                    .map((token) => `${element.getAttribute('data-slot')}: ${token}`),
-                        );
-                    },
-                    { pattern: PALETTE_UTILITY.source, sanctioned: [...SANCTIONED] },
+                expect(offenders.sort(), `off-palette colours on ${entry.path}`).toEqual(
+                    [...(ACCEPTED[entry.path] ?? [])].sort(),
                 );
-
-                const accepted = ACCEPTED[entry.path] ?? [];
-
-                expect([...new Set(offenders)], `off-palette colours on ${entry.path}`).toEqual(accepted);
             });
+
+            // Tabs mount their panels lazily (Radix unmounts inactive ones), so the default-view scan
+            // above never sees them — sweep each panel like the a11y gate does.
+            for (const tab of entry.tabs ?? []) {
+                test(`tab "${tab.name}" carries no off-palette colour`, async ({ page }) => {
+                    await page.goto(entry.path);
+                    await expect(entry.ready(page)).toBeVisible();
+                    await page.getByRole('tab', { name: tab.name }).click();
+                    await expect(tab.ready(page)).toBeVisible();
+
+                    const offenders = await scanOffenders(page);
+                    const key = `${entry.path} [${tab.name}]`;
+
+                    expect(offenders.sort(), `off-palette colours on ${key}`).toEqual(
+                        [...(ACCEPTED[key] ?? [])].sort(),
+                    );
+                });
+            }
         });
     }
 });
diff --git a/frontend/e2e/specs/cross/responsive.spec.ts b/frontend/e2e/specs/cross/responsive.spec.ts
index 8d47f23b..4f29b24a 100644
--- a/frontend/e2e/specs/cross/responsive.spec.ts
+++ b/frontend/e2e/specs/cross/responsive.spec.ts
@@ -37,6 +37,22 @@ test.describe('responsive', { tag: '@cross' }, () => {
         });
     });
 
+    test.describe('sidebar boundary', () => {
+        test('768 keeps the sidebar inline, 767 collapses it to the mobile sheet', async ({ page, pageErrorLog }) => {
+            await page.setViewportSize({ height: 800, width: 768 });
+            await page.goto('/flows');
+            await expect(page.getByRole('link', { name: 'Dashboard' })).toBeVisible();
+
+            await page.setViewportSize({ height: 800, width: 767 });
+            // `hidden md:block` hides the desktop tree either way, so its absence — the closed mobile
+            // sheet renders nothing — is the only reading that tells the hook's answer from the CSS.
+            await expect(page.locator('[data-sidebar="sidebar"]')).toHaveCount(0);
+            await expect(page.getByRole('link', { name: 'Dashboard' })).toBeHidden();
+            expect(await page.evaluate(hasHorizontalOverflow)).toBe(false);
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
     test.describe('split boundary', () => {
         test('1280 shows the resizable split, 1279 merges into one tab row', async ({ page, pageErrorLog }) => {
             await page.setViewportSize({ height: 800, width: 1280 });
diff --git a/frontend/e2e/specs/cross/session-expiry.spec.ts b/frontend/e2e/specs/cross/session-expiry.spec.ts
new file mode 100644
index 00000000..007a4080
--- /dev/null
+++ b/frontend/e2e/specs/cross/session-expiry.spec.ts
@@ -0,0 +1,143 @@
+import type { Page } from '@playwright/test';
+
+import type { Cassette } from '../../mocks/cassette.ts';
+
+import { authenticatedInfoEntry, guestInfoEntry } from '../../fixtures/auth.ts';
+import { expect, test } from '../../fixtures/test.ts';
+import { baseQueries, baseRest } from '../../mocks/cassettes/base.ts';
+import { flowsCassette } from '../../mocks/cassettes/flows.ts';
+
+const EXPIRED = 'session-expired';
+
+const infoTurningGuest = (): Cassette['rest'] => ({
+    'GET /api/v1/info': [authenticatedInfoEntry(), { ...guestInfoEntry(), whenFlag: EXPIRED }],
+});
+
+const storedUser = (page: Page) =>
+    page.evaluate(() => JSON.parse(window.localStorage.getItem('auth') ?? 'null')?.user ?? null);
+
+test.describe('session expiry', { tag: '@cross' }, () => {
+    // A private endpoint answers an expired session with 403 + code AuthRequired, never 401 — pinning
+    // 401 here would drive an interceptor branch production never reaches.
+    test.describe('a REST 403', () => {
+        test.use({
+            cassette: {
+                queries: baseQueries(),
+                rest: {
+                    ...baseRest(),
+                    ...infoTurningGuest(),
+                    'GET /api/v1/resources/': [
+                        {
+                            body: { code: 'AuthRequired', msg: 'auth required', status: 'error' },
+                            setFlag: EXPIRED,
+                            status: 403,
+                        },
+                    ],
+                },
+            },
+        });
+
+        test('bounces to the login page with a way back and drops the stored session', async ({ page }) => {
+            const rejected: string[] = [];
+
+            page.on('request', (request) => {
+                if (new URL(request.url()).pathname === '/api/v1/resources/') {
+                    rejected.push(request.url());
+                }
+            });
+
+            await page.goto('/resources');
+
+            await expect(page).toHaveURL(/\/login\?returnUrl=%2Fresources/);
+            await expect(page.getByRole('button', { name: 'Sign in' })).toBeVisible();
+            // The login page's own /info rewrites the key, so only the identity inside it matters.
+            expect(await storedUser(page), 'the expired identity must not survive in storage').toBeNull();
+
+            // A login page that kept honouring the return URL would land back on the 403 and loop.
+            expect(rejected, 'the rejected endpoint is called once').toHaveLength(1);
+        });
+    });
+
+    // `/api/v1/graphql` is registered on the same private group as the REST endpoints, so an expired
+    // session is refused by the middleware and gqlgen never runs: the client sees a transport 403
+    // carrying the REST error body, not a GraphQL `errors` array.
+    test.describe('a GraphQL 403', () => {
+        test.use({
+            cassette: flowsCassette({
+                queries: {
+                    flows: [
+                        {
+                            body: { code: 'AuthRequired', msg: 'auth required', status: 'error' },
+                            setFlag: EXPIRED,
+                            status: 403,
+                        },
+                    ],
+                },
+                rest: { ...baseRest(), ...infoTurningGuest() },
+            }),
+        });
+
+        test('re-checks the session and sends the operator to login', async ({ page }) => {
+            await page.goto('/flows');
+
+            await expect(page).toHaveURL(/\/login\?returnUrl=%2Fflows/);
+            await expect(page.getByRole('button', { name: 'Sign in' })).toBeVisible();
+        });
+    });
+
+    test.describe('a GraphQL auth error', () => {
+        test.use({
+            cassette: flowsCassette({
+                queries: { flows: [{ errors: [{ message: 'auth required' }], setFlag: EXPIRED }] },
+                rest: { ...baseRest(), ...infoTurningGuest() },
+            }),
+        });
+
+        test('re-checks the session on an auth-worded resolver error too', async ({ page }) => {
+            await page.goto('/flows');
+
+            await expect(page).toHaveURL(/\/login\?returnUrl=%2Fflows/);
+            await expect(page.getByRole('button', { name: 'Sign in' })).toBeVisible();
+        });
+    });
+
+    test.describe('the interceptor itself', () => {
+        test.use({
+            cassette: {
+                queries: baseQueries(),
+                rest: {
+                    ...baseRest(),
+                    // The login page re-reads /info and would write the key back; failing that read is
+                    // the only way to observe what the interceptor left behind.
+                    'GET /api/v1/info': [
+                        authenticatedInfoEntry(),
+                        { body: { code: 'Internal', status: 'error' }, status: 500, whenFlag: EXPIRED },
+                    ],
+                    'GET /api/v1/resources/': [
+                        {
+                            body: { code: 'AuthRequired', msg: 'auth required', status: 'error' },
+                            setFlag: EXPIRED,
+                            status: 403,
+                        },
+                    ],
+                },
+            },
+        });
+
+        test('clears the stored session outright, not just its user', async ({ page, pageErrorLog }) => {
+            await page.goto('/resources');
+
+            await expect(page).toHaveURL(/\/login/);
+            expect(
+                await page.evaluate(() => window.localStorage.getItem('auth')),
+                'the key is removed, not overwritten',
+            ).toBeNull();
+
+            expect(pageErrorLog.pageErrors, 'no uncaught page errors').toEqual([]);
+            expect(
+                pageErrorLog.consoleErrors.filter((text) => !/403|500/.test(text)),
+                'only the rejected requests are logged',
+            ).toEqual([]);
+        });
+    });
+});
diff --git a/frontend/e2e/specs/cross/themes.spec.ts b/frontend/e2e/specs/cross/themes.spec.ts
index c3e916d3..743f9201 100644
--- a/frontend/e2e/specs/cross/themes.spec.ts
+++ b/frontend/e2e/specs/cross/themes.spec.ts
@@ -1,8 +1,12 @@
+import type { Page } from '@playwright/test';
+
 import { expect, test } from '../../fixtures/test.ts';
 import { expectCleanPage } from '../../helpers/errors.ts';
-import { MESSAGE_ID_TESTID } from '../../helpers/subscriptions.ts';
+import { MESSAGE_ID_SELECTOR } from '../../helpers/subscriptions.ts';
 import { flowsCassette } from '../../mocks/cassettes/flows.ts';
 
+const storedTheme = (page: Page) => page.evaluate(() => window.localStorage.getItem('theme'));
+
 test.describe('themes', { tag: '@cross' }, () => {
     test.use({ cassette: flowsCassette() });
 
@@ -12,12 +16,15 @@ test.describe('themes', { tag: '@cross' }, () => {
         await page.getByRole('row', { name: /E2E Alpha/ }).click();
 
         await expect(page.locator('html')).toHaveClass(/dark/);
-        await expect(page.getByTestId(MESSAGE_ID_TESTID).first()).toBeVisible();
+        await expect(page.locator(MESSAGE_ID_SELECTOR).first()).toBeVisible();
         await expect(page.locator('.xterm')).toBeVisible();
         expectCleanPage(pageErrorLog);
     });
 
-    test('switches themes from the sidebar user menu', async ({ page, pageErrorLog }) => {
+    test('switches themes from the sidebar user menu, and the pick outlives the page', async ({
+        page,
+        pageErrorLog,
+    }) => {
         await page.goto('/flows');
 
         await expect(page.locator('html')).toHaveClass(/light/);
@@ -25,9 +32,18 @@ test.describe('themes', { tag: '@cross' }, () => {
         await page.getByRole('button', { name: /admin@pentagi\.com/ }).click();
         await page.getByRole('tab', { name: 'Dark theme' }).click();
         await expect(page.locator('html')).toHaveClass(/dark/);
+        expect(await storedTheme(page), 'the pick is written, not only applied to the live document').toBe('dark');
 
+        await page.reload();
+        await expect(page.locator('html'), 'the reloaded page starts dark').toHaveClass(/dark/);
+
+        await page.getByRole('button', { name: /admin@pentagi\.com/ }).click();
         await page.getByRole('tab', { name: 'Light theme' }).click();
         await expect(page.locator('html')).toHaveClass(/light/);
+        expect(await storedTheme(page)).toBe('light');
+
+        await page.reload();
+        await expect(page.locator('html'), 'the reloaded page starts light').toHaveClass(/light/);
         expectCleanPage(pageErrorLog);
     });
 });
diff --git a/frontend/e2e/specs/crud/api-tokens.spec.ts b/frontend/e2e/specs/crud/api-tokens.spec.ts
index 9953bac9..d4d56f36 100644
--- a/frontend/e2e/specs/crud/api-tokens.spec.ts
+++ b/frontend/e2e/specs/crud/api-tokens.spec.ts
@@ -2,6 +2,7 @@ import type { ResultOf } from '@graphql-typed-document-node/core';
 
 import type { CreateApiTokenDocument, DeleteApiTokenDocument } from '@/graphql/types';
 
+import { CASSETTE_EPOCH } from '../../fixtures/backend.ts';
 import { expect, test } from '../../fixtures/test.ts';
 import { expectCleanPage } from '../../helpers/errors.ts';
 import {
@@ -40,6 +41,10 @@ test.describe('api tokens crud', { tag: '@crud' }, () => {
             }),
         });
 
+        // The picker's date and the pinned clock together fix what the form must put on the wire.
+        const EXPIRES_AT = new Date('2026-01-20T00:00:00Z');
+        const EXPECTED_TTL = Math.ceil((EXPIRES_AT.getTime() - CASSETTE_EPOCH.getTime()) / 1000);
+
         test('creates a token through the inline row and reveals the secret', async ({ page, pageErrorLog }) => {
             await page.goto('/settings/api-tokens');
 
@@ -57,8 +62,21 @@ test.describe('api tokens crud', { tag: '@crud' }, () => {
             await page.keyboard.press('Escape');
 
             await expect(submit).toBeEnabled();
+
+            // The cassette cannot pin a clock-derived value, so the expiry the operator picked is
+            // asserted on the request itself: without this the mutation matches with any ttl at all,
+            // including the 60s floor a broken calculateTTL would send.
+            const createRequest = page.waitForRequest(
+                (request) => request.method() === 'POST' && request.postDataJSON()?.operationName === 'createAPIToken',
+            );
+
             await submit.click();
 
+            const { variables } = (await createRequest).postDataJSON();
+
+            expect(variables.input.ttl).toBeLessThanOrEqual(EXPECTED_TTL);
+            expect(variables.input.ttl).toBeGreaterThan(EXPECTED_TTL - 1_000);
+
             const dialog = page.getByRole('dialog');
 
             await expect(dialog.getByText('API Token Created')).toBeVisible();
diff --git a/frontend/e2e/specs/crud/knowledges.spec.ts b/frontend/e2e/specs/crud/knowledges.spec.ts
index daf0da8e..56099557 100644
--- a/frontend/e2e/specs/crud/knowledges.spec.ts
+++ b/frontend/e2e/specs/crud/knowledges.spec.ts
@@ -12,7 +12,12 @@ import { ResultType } from '@/graphql/types';
 import { expect, test } from '../../fixtures/test.ts';
 import { typeIntoEditor } from '../../helpers/editor.ts';
 import { expectCleanPage } from '../../helpers/errors.ts';
-import { KNOWLEDGE_DOC, knowledgesCassette, makeKnowledge } from '../../mocks/cassettes/knowledges.ts';
+import {
+    KNOWLEDGE_DOC,
+    knowledgeDetailCassette,
+    knowledgesCassette,
+    makeKnowledge,
+} from '../../mocks/cassettes/knowledges.ts';
 
 const openNewKnowledgeForm = async (page: Page) => {
     await page.goto('/knowledges');
@@ -122,4 +127,103 @@ test.describe('knowledges crud', { tag: '@crud' }, () => {
             expectCleanPage(pageErrorLog);
         });
     });
+
+    // A real load failure on the detail route used to be mislabelled "not found" and bounced to
+    // the list with no way back in; it must keep the user on the route behind Retry instead.
+    test.describe('detail load failure', () => {
+        test.use({
+            cassette: knowledgesCassette({
+                queries: { knowledgeDocument: [{ errors: [{ message: 'e2e induced load failure' }] }] },
+            }),
+        });
+
+        test('shows an in-page error with Retry, not a bounce to the list', async ({ page }) => {
+            await page.goto(`/knowledges/${KNOWLEDGE_DOC.id}`);
+
+            await expect(page.getByRole('button', { name: 'Try again' })).toBeVisible();
+            await expect(page).toHaveURL(new RegExp(`/knowledges/${KNOWLEDGE_DOC.id}$`));
+        });
+    });
+
+    // The backend authz denial (graph/context.go) contains "not found", so a naive match would
+    // mistake it for a missing record and bounce a user who merely lacks access.
+    test.describe('detail authz denial', () => {
+        test.use({
+            cassette: knowledgesCassette({
+                queries: {
+                    knowledgeDocument: [{ errors: [{ message: "requested permission 'knowledge.read' not found" }] }],
+                },
+            }),
+        });
+
+        test('does not bounce a permission denial to the list', async ({ page }) => {
+            await page.goto(`/knowledges/${KNOWLEDGE_DOC.id}`);
+
+            await expect(page.getByRole('button', { name: 'Try again' })).toBeVisible();
+            await expect(page).toHaveURL(new RegExp(`/knowledges/${KNOWLEDGE_DOC.id}$`));
+        });
+    });
+
+    test.describe('save', () => {
+        test.use({
+            cassette: knowledgesCassette({
+                mutations: {
+                    updateKnowledgeDocument: [{ data: { updateKnowledgeDocument: KNOWLEDGE_DOC } as never }],
+                },
+                queries: {
+                    knowledgeDocument: [
+                        { data: { knowledgeDocument: KNOWLEDGE_DOC }, variables: { id: KNOWLEDGE_DOC.id } },
+                    ],
+                },
+            }),
+        });
+
+        // The write half of the editor: until now the suite proved the document loads and round-trips
+        // in memory, never that Save puts the edited bytes on the wire.
+        test('Save sends the edited content and keeps the document id', async ({ page, pageErrorLog }) => {
+            await page.goto(`/knowledges/${KNOWLEDGE_DOC.id}`);
+
+            await typeIntoEditor(page, 'Content', 'E2E-SAVE-MARK');
+
+            const request = page.waitForRequest(
+                (candidate) =>
+                    candidate.method() === 'POST' &&
+                    candidate.postDataJSON()?.operationName === 'updateKnowledgeDocument',
+            );
+
+            await page.getByRole('button', { exact: true, name: 'Save' }).click();
+
+            const { variables } = (await request).postDataJSON();
+
+            expect(variables.id).toBe(KNOWLEDGE_DOC.id);
+            expect(variables.input.content).toContain('E2E-SAVE-MARK');
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('detail header', () => {
+        test.use({ cassette: knowledgeDetailCassette() });
+
+        test('keeps the pager left of save and the actions menu', async ({ page }) => {
+            await page.goto(`/knowledges/${KNOWLEDGE_DOC.id}`);
+            await expect(page.getByRole('button', { name: 'Knowledge actions' })).toBeVisible();
+
+            const labels = await page
+                .locator('header button')
+                .evaluateAll((buttons) =>
+                    buttons.map((button) => button.getAttribute('aria-label') ?? button.textContent),
+                );
+            const positionOf = (label: string) => labels.findIndex((candidate) => (candidate ?? '').includes(label));
+
+            // findIndex returns -1 for an absent label, and -1 < any real index, so the ordering below
+            // passes vacuously when a button is missing. Require presence first.
+            for (const label of ['Save', 'Previous', 'Next', 'Knowledge actions']) {
+                expect(positionOf(label), `header is missing the "${label}" button`).toBeGreaterThanOrEqual(0);
+            }
+
+            expect(positionOf('Previous')).toBeLessThan(positionOf('Save'));
+            expect(positionOf('Next')).toBeLessThan(positionOf('Save'));
+            expect(positionOf('Save')).toBeLessThan(positionOf('Knowledge actions'));
+        });
+    });
 });
diff --git a/frontend/e2e/specs/crud/resources-upload.spec.ts b/frontend/e2e/specs/crud/resources-upload.spec.ts
new file mode 100644
index 00000000..55f06da2
--- /dev/null
+++ b/frontend/e2e/specs/crud/resources-upload.spec.ts
@@ -0,0 +1,134 @@
+import type { Page } from '@playwright/test';
+
+import { expect, test } from '../../fixtures/test.ts';
+import { expectCleanPage } from '../../helpers/errors.ts';
+import { resourcesCassette, UPLOADED_FRAGMENT, UPLOADED_RESOURCE } from '../../mocks/cassettes/resources.ts';
+
+const UPLOAD_ENDPOINT = '/api/v1/resources/';
+
+const pickFiles = (page: Page, files: Array<{ buffer: Buffer; mimeType: string; name: string }>) =>
+    // The sidebar's quick-upload mounts an input of its own; this is the library page's.
+    page.locator('main input[name="resource-upload"]').setInputFiles(files);
+
+const textFile = (name: string, body: string) => ({
+    buffer: Buffer.from(body),
+    mimeType: 'text/plain',
+    name,
+});
+
+test.describe('resources upload', { tag: '@crud' }, () => {
+    test.describe('accepted', () => {
+        test.use({
+            cassette: resourcesCassette({
+                rest: {
+                    'POST /api/v1/resources/': [
+                        {
+                            body: { data: { items: [UPLOADED_RESOURCE], total: 1 }, status: 'success' },
+                            setFlag: 'resource-uploaded',
+                        },
+                    ],
+                },
+                subscriptions: {
+                    resourceAdded: [
+                        {
+                            frames: [
+                                {
+                                    payload: { data: { resourceAdded: UPLOADED_FRAGMENT } },
+                                    whenFlag: 'resource-uploaded',
+                                },
+                            ],
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('sends the picked file as multipart and shows it in the library', async ({ page, pageErrorLog }) => {
+            await page.goto('/resources');
+            await expect(page.getByRole('treeitem', { name: /notes\.txt/ })).toBeVisible();
+
+            const posted = page.waitForRequest(
+                (request) => request.method() === 'POST' && new URL(request.url()).pathname === UPLOAD_ENDPOINT,
+            );
+
+            await pickFiles(page, [textFile(UPLOADED_RESOURCE.name, 'e2e upload payload')]);
+
+            const body = (await posted).postData() ?? '';
+
+            expect((await posted).headers()['content-type']).toMatch(/^multipart\/form-data; boundary=/);
+            // The field name is the contract with the Go handler: rename it and the server sees
+            // an upload with no files at all.
+            expect(body).toContain('name="files"');
+            expect(body).toContain(`filename="${UPLOADED_RESOURCE.name}"`);
+            expect(body).toContain('e2e upload payload');
+
+            await expect(page.getByText('File uploaded')).toBeVisible();
+            await expect(page.getByRole('treeitem', { name: new RegExp(UPLOADED_RESOURCE.name) })).toBeVisible();
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('a zero-byte file', () => {
+        test.use({
+            cassette: resourcesCassette({
+                rest: {
+                    'POST /api/v1/resources/': [
+                        { body: { data: { items: [UPLOADED_RESOURCE], total: 1 }, status: 'success' } },
+                    ],
+                },
+            }),
+        });
+
+        // The Go handler bounds a part only from above (UploadResources rejects fh.Size over the cap,
+        // never a zero one), so refusing an empty file here would make `.gitkeep` unuploadable through
+        // the UI while the API accepts it.
+        test('reaches the wire like any other', async ({ page, pageErrorLog }) => {
+            await page.goto('/resources');
+            await expect(page.getByRole('treeitem', { name: /notes\.txt/ })).toBeVisible();
+
+            const posted = page.waitForRequest(
+                (request) => request.method() === 'POST' && new URL(request.url()).pathname === UPLOAD_ENDPOINT,
+            );
+
+            await pickFiles(page, [textFile('hollow.txt', '')]);
+
+            expect((await posted).postData() ?? '').toContain('filename="hollow.txt"');
+            await expect(page.getByText('is empty')).toHaveCount(0);
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('refused by the backend', () => {
+        test.use({
+            cassette: resourcesCassette({
+                rest: {
+                    'POST /api/v1/resources/': [
+                        {
+                            // The Go response layer writes `msg` on every error, so this copy — not the
+                            // client's own 409 fallback — is what an operator reads.
+                            body: {
+                                code: 'Resources.AlreadyExists',
+                                msg: 'resource already exists',
+                                status: 'error',
+                            },
+                            status: 409,
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('a name clash is explained instead of failing silently', async ({ page, pageErrorLog }) => {
+            await page.goto('/resources');
+            await expect(page.getByRole('treeitem', { name: /notes\.txt/ })).toBeVisible();
+
+            await pickFiles(page, [textFile('notes.txt', 'same name, new bytes')]);
+
+            await expect(page.getByText('Upload failed')).toBeVisible();
+            await expect(page.getByText('resource already exists', { exact: true })).toBeVisible();
+
+            expect(pageErrorLog.pageErrors, 'no uncaught page errors').toEqual([]);
+            expect(pageErrorLog.consoleErrors.filter((text) => !text.includes('409'))).toEqual([]);
+        });
+    });
+});
diff --git a/frontend/e2e/specs/crud/resources.spec.ts b/frontend/e2e/specs/crud/resources.spec.ts
index e16bbe33..ae33e0a1 100644
--- a/frontend/e2e/specs/crud/resources.spec.ts
+++ b/frontend/e2e/specs/crud/resources.spec.ts
@@ -1,10 +1,25 @@
 import type { ResultOf } from '@graphql-typed-document-node/core';
+import type { Page } from '@playwright/test';
 
 import type { ResourceAddedDocument } from '@/graphql/types';
 
 import { expect, test } from '../../fixtures/test.ts';
 import { expectCleanPage } from '../../helpers/errors.ts';
-import { CREATED_FOLDER, emptyResourcesCassette, resourcesCassette } from '../../mocks/cassettes/resources.ts';
+import {
+    COPY_DESTINATION,
+    CREATED_FOLDER,
+    emptyResourcesCassette,
+    FILE_RESOURCE,
+    FOLDER_RESOURCE,
+    RENAMED_PATH,
+    resourcesCassette,
+    resourceWrites,
+} from '../../mocks/cassettes/resources.ts';
+
+interface DownloadClick {
+    download: string;
+    href: string;
+}
 
 test.describe('resources', { tag: '@coverage' }, () => {
     test.describe('listing', () => {
@@ -72,6 +87,170 @@ test.describe('resources', { tag: '@coverage' }, () => {
             await page.goto('/resources');
 
             await expect(page.getByText('No resources yet')).toBeVisible();
+            // Scope to the drop zone (its hint is unique) so the toolbar's Upload button is excluded.
+            const dropZone = page.locator('div').filter({ hasText: 'Up to 300 MB per file' }).last();
+
+            await expect(dropZone.getByRole('button', { name: 'Upload files' })).toBeVisible();
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    // Every write here is a different verb on a path that also serves the SPA: a wrong method answers
+    // 200 with HTML instead of 404, so these tests pin the method and the payload, not just the toast.
+    test.describe('write verbs', () => {
+        test.use({ cassette: resourcesCassette({ rest: resourceWrites() }) });
+
+        const rowActions = (page: Page, name: string) =>
+            page.getByRole('treeitem', { name: new RegExp(name) }).getByRole('button', { name: 'Row actions' });
+
+        test('rename issues a PUT to /resources/move carrying the typed destination', async ({
+            page,
+            pageErrorLog,
+        }) => {
+            await page.goto('/resources');
+
+            const request = page.waitForRequest(
+                (candidate) =>
+                    candidate.method() === 'PUT' && new URL(candidate.url()).pathname === '/api/v1/resources/move',
+            );
+
+            await rowActions(page, FILE_RESOURCE.name).click();
+            await page.getByRole('menuitem', { name: 'Rename or move' }).click();
+
+            const dialog = page.getByRole('dialog');
+
+            await dialog.getByLabel('New path').fill(RENAMED_PATH);
+            await dialog.getByRole('button', { exact: true, name: 'Move' }).click();
+
+            expect((await request).postDataJSON()).toMatchObject({
+                destination: RENAMED_PATH,
+                sources: [FILE_RESOURCE.path],
+            });
+            expectCleanPage(pageErrorLog);
+        });
+
+        test('copy issues a POST to /resources/copy', async ({ page, pageErrorLog }) => {
+            await page.goto('/resources');
+
+            const request = page.waitForRequest(
+                (candidate) =>
+                    candidate.method() === 'POST' && new URL(candidate.url()).pathname === '/api/v1/resources/copy',
+            );
+
+            await rowActions(page, FILE_RESOURCE.name).click();
+            await page.getByRole('menuitem', { name: 'Copy to…' }).click();
+
+            const dialog = page.getByRole('dialog');
+
+            await dialog.getByLabel('Destination path').fill(COPY_DESTINATION);
+            await dialog.getByRole('button', { exact: true, name: 'Copy' }).click();
+
+            expect((await request).postDataJSON()).toMatchObject({
+                destination: COPY_DESTINATION,
+                sources: [FILE_RESOURCE.path],
+            });
+            expectCleanPage(pageErrorLog);
+        });
+
+        // Copying onto an existing name must stop at a confirmation instead of overwriting silently:
+        // the request may not leave until the user takes the second decision.
+        test('a colliding destination raises the replace guard before any request', async ({ page }) => {
+            await page.goto('/resources');
+
+            let copyRequests = 0;
+
+            page.on('request', (candidate) => {
+                if (new URL(candidate.url()).pathname === '/api/v1/resources/copy') {
+                    copyRequests += 1;
+                }
+            });
+
+            await rowActions(page, FILE_RESOURCE.name).click();
+            await page.getByRole('menuitem', { name: 'Copy to…' }).click();
+            await page.getByRole('dialog').getByLabel('Destination path').fill(FOLDER_RESOURCE.name);
+            await page.getByRole('dialog').getByRole('button', { exact: true, name: 'Copy' }).click();
+
+            await expect(page.getByRole('dialog', { name: 'Replace existing item?' })).toBeVisible();
+            expect(copyRequests, 'nothing is sent while the guard is open').toBe(0);
+
+            await page.getByRole('button', { name: 'Cancel' }).click();
+            expect(copyRequests, 'cancelling the guard sends nothing at all').toBe(0);
+        });
+
+        test('delete issues a DELETE whose query carries the row path', async ({ page, pageErrorLog }) => {
+            await page.goto('/resources');
+
+            const request = page.waitForRequest(
+                (candidate) =>
+                    candidate.method() === 'DELETE' && new URL(candidate.url()).pathname === '/api/v1/resources/',
+            );
+
+            await rowActions(page, FILE_RESOURCE.name).click();
+            await page.getByRole('menuitem', { name: 'Delete' }).click();
+            await page.getByRole('dialog').getByRole('button', { exact: true, name: 'Delete' }).click();
+
+            expect(new URL((await request).url()).searchParams.getAll('paths[]')).toEqual([FILE_RESOURCE.path]);
+            expectCleanPage(pageErrorLog);
+        });
+
+        // An `<a download>` transfer is carried out by the browser outside the page, so no Playwright
+        // route — page- or context-scoped — is ever offered it: one started here leaves for whatever
+        // the preview proxy targets. The bytes are asserted in specs/real/resources-download.spec.ts.
+        test('the row download action links at the row, saved under its name', async ({ page, pageErrorLog }) => {
+            await page.goto('/resources');
+            await rowActions(page, FILE_RESOURCE.name).click();
+
+            const link = page.getByRole('menuitem', { name: 'Download' });
+
+            await expect(link).toHaveAttribute('download', FILE_RESOURCE.name);
+
+            const href = new URL((await link.getAttribute('href')) ?? '', page.url());
+
+            expect(href.pathname).toBe('/api/v1/resources/download');
+            expect(href.searchParams.getAll('paths[]')).toEqual([FILE_RESOURCE.path]);
+            expectCleanPage(pageErrorLog);
+        });
+
+        // Multi-select is a different code path: one transfer carrying every selected path, saved
+        // under an archive name. Neither is derivable from the single-row case.
+        test('the bulk action asks for every selected path in one archive', async ({ page, pageErrorLog }) => {
+            // Its anchor is created, clicked and dropped inside one handler, so nothing survives in
+            // the DOM to read — record the click and swallow it instead of starting a transfer.
+            await page.addInitScript(() => {
+                const recorded: DownloadClick[] = [];
+
+                (window as unknown as { e2eDownloads: DownloadClick[] }).e2eDownloads = recorded;
+
+                const { click } = HTMLAnchorElement.prototype;
+
+                HTMLAnchorElement.prototype.click = function (this: HTMLAnchorElement) {
+                    if (!this.hasAttribute('download')) {
+                        click.call(this);
+
+                        return;
+                    }
+
+                    recorded.push({ download: this.download, href: this.href });
+                };
+            });
+            await page.goto('/resources');
+            await page.getByRole('checkbox', { name: `Select ${FILE_RESOURCE.name}` }).click();
+            await page.getByRole('checkbox', { name: `Select ${FOLDER_RESOURCE.name}` }).click();
+            await page.getByRole('button', { exact: true, name: 'Download' }).click();
+
+            const clicks = await page.evaluate(
+                () => (window as unknown as { e2eDownloads: DownloadClick[] }).e2eDownloads,
+            );
+
+            expect(clicks, 'one transfer for the whole selection').toHaveLength(1);
+
+            const { download, href } = clicks[0]!;
+
+            expect(new URL(href).pathname).toBe('/api/v1/resources/download');
+            expect(new URL(href).searchParams.getAll('paths[]').sort()).toEqual(
+                [FILE_RESOURCE.path, FOLDER_RESOURCE.path].sort(),
+            );
+            expect(download).toMatch(/\.zip$/);
             expectCleanPage(pageErrorLog);
         });
     });
diff --git a/frontend/e2e/specs/crud/template-detail.spec.ts b/frontend/e2e/specs/crud/template-detail.spec.ts
index 39ec9403..7cbe1db0 100644
--- a/frontend/e2e/specs/crud/template-detail.spec.ts
+++ b/frontend/e2e/specs/crud/template-detail.spec.ts
@@ -5,7 +5,13 @@ import { expectCleanPage } from '../../helpers/errors.ts';
 import { RICH_TEMPLATE_TEXT, TEMPLATE_DETAIL, templateDetailCassette } from '../../mocks/cassettes/templates.ts';
 
 test.describe('template detail', { tag: '@coverage' }, () => {
-    test.use({ cassette: templateDetailCassette() });
+    test.use({
+        cassette: templateDetailCassette({
+            mutations: {
+                updateFlowTemplate: [{ data: { updateFlowTemplate: TEMPLATE_DETAIL } as never }],
+            },
+        }),
+    });
 
     const EDITOR = 'Template content';
 
@@ -16,7 +22,7 @@ test.describe('template detail', { tag: '@coverage' }, () => {
         await page.keyboard.press('Escape');
     };
 
-    test('keeps the pager between save and the actions menu', async ({ page }) => {
+    test('keeps the pager left of save and the actions menu', async ({ page }) => {
         await page.goto(`/templates/${TEMPLATE_DETAIL.id}`);
         await expect(page.getByRole('button', { name: 'Template actions' })).toBeVisible();
 
@@ -25,8 +31,15 @@ test.describe('template detail', { tag: '@coverage' }, () => {
             .evaluateAll((buttons) => buttons.map((button) => button.getAttribute('aria-label') ?? button.textContent));
         const positionOf = (label: string) => labels.findIndex((candidate) => (candidate ?? '').includes(label));
 
-        expect(positionOf('Save')).toBeLessThan(positionOf('Previous'));
-        expect(positionOf('Next')).toBeLessThan(positionOf('Template actions'));
+        // findIndex returns -1 for an absent label, and -1 < any real index, so the ordering below
+        // passes vacuously when a button is missing. Require presence first.
+        for (const label of ['Save', 'Previous', 'Next', 'Template actions']) {
+            expect(positionOf(label), `header is missing the "${label}" button`).toBeGreaterThanOrEqual(0);
+        }
+
+        expect(positionOf('Previous')).toBeLessThan(positionOf('Save'));
+        expect(positionOf('Next')).toBeLessThan(positionOf('Save'));
+        expect(positionOf('Save')).toBeLessThan(positionOf('Template actions'));
     });
 
     test('loads the template body into the editor byte-exact', async ({ page, pageErrorLog }) => {
@@ -66,4 +79,54 @@ test.describe('template detail', { tag: '@coverage' }, () => {
         expect(raw).toContain('E2E-MARK');
         expectCleanPage(pageErrorLog);
     });
+
+    // A real load failure must offer Retry in place, not the "Template not found" card that a
+    // genuine 404 shows — the two used to collapse into the same dead-end.
+
+    // Save is the only operation that can destroy a user's template, and no spec has ever let it reach
+    // the wire — the round-trip units stop at the editor boundary.
+    test('Save sends the edited body verbatim, placeholders intact', async ({ page, pageErrorLog }) => {
+        await page.goto(`/templates/${TEMPLATE_DETAIL.id}`);
+
+        const editor = page.getByRole('textbox', { name: EDITOR });
+
+        await expect(editor.getByRole('heading', { name: 'Recon' })).toBeVisible();
+        await editor.click();
+        await page.keyboard.press('ControlOrMeta+End');
+        await editor.pressSequentially(' E2E-SAVE-MARK');
+
+        const request = page.waitForRequest(
+            (candidate) =>
+                candidate.method() === 'POST' && candidate.postDataJSON()?.operationName === 'updateFlowTemplate',
+        );
+
+        await page.getByRole('button', { exact: true, name: 'Save' }).click();
+
+        const { variables } = (await request).postDataJSON();
+
+        expect(variables.templateId).toBe(TEMPLATE_DETAIL.id);
+        expect(variables.input.text).toContain('E2E-SAVE-MARK');
+
+        for (const atom of ['# Recon', '{{TARGET}}', 'nmap -sV']) {
+            expect(variables.input.text, `"${atom}" survived the save`).toContain(atom);
+        }
+
+        expectCleanPage(pageErrorLog);
+    });
+
+    test.describe('load failure', () => {
+        test.use({
+            cassette: templateDetailCassette({
+                queries: { flowTemplate: [{ errors: [{ message: 'e2e induced load failure' }] }] },
+            }),
+        });
+
+        test('shows an in-page error with Retry, not "not found"', async ({ page }) => {
+            await page.goto(`/templates/${TEMPLATE_DETAIL.id}`);
+
+            await expect(page.getByRole('button', { name: 'Try again' })).toBeVisible();
+            await expect(page.getByText('Template not found')).toBeHidden();
+            await expect(page).toHaveURL(new RegExp(`/templates/${TEMPLATE_DETAIL.id}$`));
+        });
+    });
 });
diff --git a/frontend/e2e/specs/dashboard/dashboard.spec.ts b/frontend/e2e/specs/dashboard/dashboard.spec.ts
index 66c2c2bd..b34d9c1c 100644
--- a/frontend/e2e/specs/dashboard/dashboard.spec.ts
+++ b/frontend/e2e/specs/dashboard/dashboard.spec.ts
@@ -26,8 +26,12 @@ test.describe('dashboard', { tag: '@coverage' }, () => {
 
         test('overview tab loads lazily and renders metrics and usage tables', async ({ page, pageErrorLog }) => {
             await page.goto('/dashboard');
-            // Lazy: the overview metrics are not mounted while the Analytics tab is active.
-            await expect(page.getByRole('heading', { exact: true, name: 'Total Flows' })).toBeHidden();
+            // The route is lazy, so this must wait for the Analytics panel first: a bare negative
+            // assert is satisfied by "nothing has rendered yet" and can never fail.
+            await expect(page.getByRole('heading', { name: 'Flows Activity Over Time' })).toBeVisible();
+            // not.toBeAttached, not toBeHidden — the latter also passes for a mounted-but-hidden node,
+            // so it would not catch the panel being eagerly mounted (all its queries firing).
+            await expect(page.getByRole('heading', { exact: true, name: 'Total Flows' })).not.toBeAttached();
             await page.getByRole('tab', { name: 'Overview' }).click();
 
             for (const title of ['Total Flows', 'Tool Calls', 'Total Tokens', 'Total Cost']) {
diff --git a/frontend/e2e/specs/flows/assistants.spec.ts b/frontend/e2e/specs/flows/assistants.spec.ts
new file mode 100644
index 00000000..5e667263
--- /dev/null
+++ b/frontend/e2e/specs/flows/assistants.spec.ts
@@ -0,0 +1,265 @@
+import type { ResultOf } from '@graphql-typed-document-node/core';
+import type { Page } from '@playwright/test';
+
+import type { CallAssistantDocument, DeleteAssistantDocument } from '@/graphql/types';
+
+import { ResultType, StatusType } from '@/graphql/types';
+
+import { expect, test } from '../../fixtures/test.ts';
+import { expectCleanPage } from '../../helpers/errors.ts';
+import {
+    assistantsCassette,
+    CREATED_ASSISTANT,
+    makeAssistant,
+    RUNNING_ASSISTANT,
+    WAITING_ASSISTANT,
+} from '../../mocks/cassettes/assistants.ts';
+import { PROVIDER } from '../../mocks/cassettes/flows.ts';
+
+const openAssistantTab = async (page: Page) => {
+    await page.goto('/flows/5');
+    await page.getByRole('tab', { name: 'Assistant' }).click();
+    await expect(page.getByPlaceholder('Search messages...')).toBeVisible();
+};
+
+const openPicker = async (page: Page) => {
+    await page.getByRole('button', { name: 'Select assistant' }).click();
+    await expect(page.getByPlaceholder('Search assistants...')).toBeVisible();
+};
+
+const operationRequest = (page: Page, operationName: string) =>
+    page.waitForRequest(
+        (request) => request.method() === 'POST' && request.postDataJSON()?.operationName === operationName,
+    );
+
+test.describe('flow assistants', { tag: '@flows' }, () => {
+    test.describe('create', () => {
+        test.use({
+            cassette: assistantsCassette({
+                mutations: {
+                    createAssistant: [
+                        {
+                            data: {
+                                createAssistant: {
+                                    assistant: CREATED_ASSISTANT,
+                                    flow: { __typename: 'Flow', id: '5' },
+                                },
+                            } as never,
+                            setFlag: 'assistant-created',
+                            variables: { flowId: '5', input: 'plan the recon', modelProvider: PROVIDER.name },
+                        },
+                    ],
+                },
+                subscriptions: {
+                    assistantCreated: [
+                        {
+                            frames: [
+                                {
+                                    payload: { data: { assistantCreated: CREATED_ASSISTANT } },
+                                    whenFlag: 'assistant-created',
+                                },
+                            ],
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('creates an assistant from the empty composer and selects it', async ({ page, pageErrorLog }) => {
+            await openAssistantTab(page);
+            await openPicker(page);
+            await page.getByRole('option', { name: 'Create new assistant' }).click();
+
+            const composer = page.getByPlaceholder('Type a message to create a new assistant...');
+            const picker = page.getByRole('button', { name: 'Select assistant' });
+
+            await expect(composer).toBeVisible();
+            await expect(picker).toHaveText('New');
+            await composer.fill('plan the recon');
+
+            // A brand-new assistant inherits no provider. The only one on offer is also the one the
+            // previously selected assistant used — the case a defaults-sync that ignores the picked
+            // value silently reverts.
+            await page.getByRole('button', { name: 'Select Provider' }).click();
+            await page.getByRole('menuitem', { name: PROVIDER.name }).click();
+
+            const request = operationRequest(page, 'createAssistant');
+
+            await page.getByRole('button', { name: 'Submit' }).click();
+
+            expect((await request).postDataJSON().variables).toEqual({
+                flowId: '5',
+                input: 'plan the recon',
+                modelProvider: PROVIDER.name,
+                useAgents: false,
+            });
+
+            // `Create new assistant` leaves the picker on an explicit "none" that the
+            // fall-back-to-first selection never overrides — only the create response does.
+            await expect(picker).toHaveText(/1$/);
+
+            await openPicker(page);
+            await expect(page.getByRole('option', { name: new RegExp(CREATED_ASSISTANT.title) })).toBeVisible();
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('call', () => {
+        const called: ResultOf<typeof CallAssistantDocument> = { callAssistant: ResultType.Success };
+
+        test.use({
+            cassette: assistantsCassette({
+                mutations: {
+                    callAssistant: [
+                        {
+                            data: called,
+                            variables: { assistantId: '11', flowId: '5', input: 'and the other ports?' },
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('sends a follow-up to the assistant the picker already selected', async ({ page, pageErrorLog }) => {
+            await openAssistantTab(page);
+
+            const composer = page.getByPlaceholder('Continue the conversation...');
+
+            await composer.fill('and the other ports?');
+
+            const request = operationRequest(page, 'callAssistant');
+
+            await page.getByRole('button', { name: 'Submit' }).click();
+
+            expect((await request).postDataJSON().variables).toEqual({
+                assistantId: WAITING_ASSISTANT.id,
+                flowId: '5',
+                input: 'and the other ports?',
+                useAgents: false,
+            });
+            await expect(composer).toHaveValue('');
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('stop', () => {
+        test.use({
+            cassette: assistantsCassette({
+                mutations: {
+                    stopAssistant: [
+                        {
+                            data: {
+                                stopAssistant: makeAssistant(
+                                    RUNNING_ASSISTANT.id,
+                                    RUNNING_ASSISTANT.title,
+                                    StatusType.Waiting,
+                                ),
+                            },
+                            setFlag: 'assistant-stopped',
+                            variables: { assistantId: '12', flowId: '5' },
+                        },
+                    ],
+                },
+                subscriptions: {
+                    assistantUpdated: [
+                        {
+                            frames: [
+                                {
+                                    payload: {
+                                        data: {
+                                            assistantUpdated: makeAssistant(
+                                                RUNNING_ASSISTANT.id,
+                                                RUNNING_ASSISTANT.title,
+                                                StatusType.Waiting,
+                                            ),
+                                        },
+                                    },
+                                    whenFlag: 'assistant-stopped',
+                                },
+                            ],
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('stops the running assistant and hands the composer back', async ({ page, pageErrorLog }) => {
+            await openAssistantTab(page);
+            await openPicker(page);
+            await page.getByRole('option', { name: new RegExp(RUNNING_ASSISTANT.title) }).click();
+
+            const stop = page.getByRole('button', { name: 'Cancel' });
+
+            await expect(stop).toBeVisible();
+
+            const request = operationRequest(page, 'stopAssistant');
+
+            await stop.click();
+
+            expect((await request).postDataJSON().variables).toEqual({
+                assistantId: RUNNING_ASSISTANT.id,
+                flowId: '5',
+            });
+            await expect(page.getByPlaceholder('Continue the conversation...')).toBeVisible();
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('delete', () => {
+        const deleted: ResultOf<typeof DeleteAssistantDocument> = { deleteAssistant: ResultType.Success };
+
+        test.use({
+            cassette: assistantsCassette({
+                mutations: {
+                    deleteAssistant: [
+                        {
+                            data: deleted,
+                            setFlag: 'assistant-deleted',
+                            variables: { assistantId: '12', flowId: '5' },
+                        },
+                    ],
+                },
+                subscriptions: {
+                    assistantDeleted: [
+                        {
+                            frames: [
+                                {
+                                    payload: { data: { assistantDeleted: RUNNING_ASSISTANT } },
+                                    whenFlag: 'assistant-deleted',
+                                },
+                            ],
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('deletes an assistant through the confirm dialog', async ({ page, pageErrorLog }) => {
+            await openAssistantTab(page);
+            await openPicker(page);
+
+            const doomed = page.getByRole('option', { name: new RegExp(RUNNING_ASSISTANT.title) });
+
+            await doomed.hover();
+            await doomed.getByRole('button').click();
+
+            const dialog = page.getByRole('dialog');
+
+            await expect(dialog.getByText('Delete Assistant')).toBeVisible();
+
+            const request = operationRequest(page, 'deleteAssistant');
+
+            await dialog.getByRole('button', { name: 'Delete' }).click();
+
+            expect((await request).postDataJSON().variables).toEqual({
+                assistantId: RUNNING_ASSISTANT.id,
+                flowId: '5',
+            });
+
+            await openPicker(page);
+            await expect(page.getByRole('option', { name: new RegExp(WAITING_ASSISTANT.title) })).toBeVisible();
+            await expect(page.getByRole('option', { name: new RegExp(RUNNING_ASSISTANT.title) })).toBeHidden();
+            expectCleanPage(pageErrorLog);
+        });
+    });
+});
diff --git a/frontend/e2e/specs/flows/interrupt.spec.ts b/frontend/e2e/specs/flows/interrupt.spec.ts
new file mode 100644
index 00000000..7aeaab2a
--- /dev/null
+++ b/frontend/e2e/specs/flows/interrupt.spec.ts
@@ -0,0 +1,118 @@
+import type { ResultOf } from '@graphql-typed-document-node/core';
+import type { Page } from '@playwright/test';
+
+import type { PutUserInputDocument, StopFlowDocument } from '@/graphql/types';
+
+import { ResultType, StatusType } from '@/graphql/types';
+
+import { expect, test } from '../../fixtures/test.ts';
+import { expectCleanPage } from '../../helpers/errors.ts';
+import {
+    FLOW_A_INITIAL_IDS,
+    FLOW_B,
+    flowQueryData,
+    flowsCassette,
+    makeFlow,
+    makeMessage,
+    PROVIDER,
+} from '../../mocks/cassettes/flows.ts';
+
+const WAITING_FLOW = makeFlow('5', 'E2E Alpha', StatusType.Waiting);
+
+const openFlowA = async (page: Page) => {
+    await page.goto('/flows/5?tab=automation');
+    await expect(page.locator('header').getByText('E2E Alpha', { exact: true })).toBeVisible();
+};
+
+const operationRequest = (page: Page, operationName: string) =>
+    page.waitForRequest(
+        (request) => request.method() === 'POST' && request.postDataJSON()?.operationName === operationName,
+    );
+
+test.describe('flow interrupt', { tag: '@flows' }, () => {
+    test.describe('stop', () => {
+        const stopped: ResultOf<typeof StopFlowDocument> = { stopFlow: ResultType.Success };
+
+        test.use({
+            cassette: flowsCassette({
+                mutations: { stopFlow: [{ data: stopped, setFlag: 'flow-stopped', variables: { flowId: '5' } }] },
+                subscriptions: {
+                    flowUpdated: [
+                        {
+                            frames: [{ payload: { data: { flowUpdated: WAITING_FLOW } }, whenFlag: 'flow-stopped' }],
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('stops a running flow from the composer and hands the input back', async ({ page, pageErrorLog }) => {
+            await openFlowA(page);
+
+            const stop = page.getByRole('button', { name: 'Cancel' });
+
+            await expect(stop, 'a running flow offers Stop, not Submit').toBeVisible();
+            await expect(page.getByRole('button', { name: 'Submit' })).toBeHidden();
+
+            const request = operationRequest(page, 'stopFlow');
+
+            await stop.click();
+            expect((await request).postDataJSON().variables).toEqual({ flowId: '5' });
+
+            await expect(page.getByRole('button', { name: 'Submit' })).toBeVisible();
+            await expect(page.getByPlaceholder('Provide additional context or instructions...')).toBeVisible();
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('user input', () => {
+        const accepted: ResultOf<typeof PutUserInputDocument> = { putUserInput: ResultType.Success };
+
+        test.use({
+            cassette: flowsCassette({
+                mutations: {
+                    putUserInput: [
+                        {
+                            data: accepted,
+                            variables: { flowId: '5', input: 'follow up on the open port' },
+                        },
+                    ],
+                },
+                queries: {
+                    flow: [
+                        {
+                            data: flowQueryData(
+                                WAITING_FLOW,
+                                FLOW_A_INITIAL_IDS.map((id) => makeMessage(id, '5')),
+                            ),
+                            variables: { id: '5' },
+                        },
+                    ],
+                    // The list query normalizes into the same cache entry, so a Running row here
+                    // would overwrite the status the detail query just delivered.
+                    flows: [{ data: { flows: [WAITING_FLOW, FLOW_B] } }],
+                },
+            }),
+        });
+
+        test('sends the typed message to the waiting flow', async ({ page, pageErrorLog }) => {
+            await openFlowA(page);
+
+            const composer = page.getByPlaceholder('Provide additional context or instructions...');
+
+            await composer.fill('follow up on the open port');
+
+            const request = operationRequest(page, 'putUserInput');
+
+            await page.getByRole('button', { name: 'Submit' }).click();
+
+            expect((await request).postDataJSON().variables).toEqual({
+                flowId: '5',
+                input: 'follow up on the open port',
+                modelProvider: PROVIDER.name,
+            });
+            await expect(composer).toHaveValue('');
+            expectCleanPage(pageErrorLog);
+        });
+    });
+});
diff --git a/frontend/e2e/specs/flows/live-panels.spec.ts b/frontend/e2e/specs/flows/live-panels.spec.ts
new file mode 100644
index 00000000..e6b290cc
--- /dev/null
+++ b/frontend/e2e/specs/flows/live-panels.spec.ts
@@ -0,0 +1,78 @@
+import { expect, test } from '../../fixtures/test.ts';
+import { expectCleanPage } from '../../helpers/errors.ts';
+import { MESSAGE_ID_SELECTOR } from '../../helpers/subscriptions.ts';
+import { readTerminalBuffer } from '../../helpers/terminal.ts';
+import {
+    livePanelsCassette,
+    makeMessage,
+    STREAMED,
+    VARIED_MESSAGES,
+    variedMessagesCassette,
+} from '../../mocks/cassettes/flows.ts';
+
+const REVISED_ANSWER = 'Revised plan after the retry';
+
+test.describe('live panels', { tag: '@flows' }, () => {
+    test.use({ cassette: livePanelsCassette() });
+
+    // Each panel below is fed by a subscription and nothing else: the seeded query answers hold
+    // none of these strings, so a frame wired to the wrong cache field leaves its panel stale.
+    test('every streamed panel picks up its own frame', async ({ page, pageErrorLog }) => {
+        await page.goto('/flows/5');
+        await expect(page.locator('header').getByRole('button', { name: 'Toggle favorite' })).toBeEnabled();
+
+        await page.getByRole('tab', { name: 'Tasks' }).click();
+        await expect(page.getByText(STREAMED.task)).toBeVisible();
+        await expect(page.getByText(STREAMED.taskRetitled)).toBeVisible();
+
+        await page.getByRole('tab', { name: 'Agents' }).click();
+        await expect(page.getByText(STREAMED.agent)).toBeVisible();
+
+        await page.getByRole('tab', { name: 'Searches' }).click();
+        await expect(page.getByText(STREAMED.search)).toBeVisible();
+
+        await page.getByRole('tab', { name: 'Vector Store' }).click();
+        await expect(page.getByText(STREAMED.vector)).toBeVisible();
+
+        await page.getByRole('tab', { name: 'Terminal' }).click();
+        await expect(async () => {
+            expect(await readTerminalBuffer(page)).toContain(STREAMED.terminal);
+        }).toPass();
+
+        expectCleanPage(pageErrorLog);
+    });
+
+    test.describe('a revised message', () => {
+        test.use({
+            cassette: variedMessagesCassette({
+                subscriptions: {
+                    messageLogUpdated: [
+                        {
+                            frames: [
+                                {
+                                    delayMs: 60,
+                                    payload: {
+                                        data: {
+                                            messageLogUpdated: makeMessage('501', '5', { message: REVISED_ANSWER }),
+                                        },
+                                    },
+                                },
+                            ],
+                            variables: { flowId: '5' },
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('replaces the message in place instead of appending a second one', async ({ page, pageErrorLog }) => {
+            await page.goto('/flows/5?tab=automation');
+
+            await expect(page.getByText(REVISED_ANSWER)).toBeVisible();
+            await expect(page.getByText(VARIED_MESSAGES[0]!.message)).toBeHidden();
+            await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(VARIED_MESSAGES.length);
+
+            expectCleanPage(pageErrorLog);
+        });
+    });
+});
diff --git a/frontend/e2e/specs/flows/messages.spec.ts b/frontend/e2e/specs/flows/messages.spec.ts
index 18d8e0af..7b4c1643 100644
--- a/frontend/e2e/specs/flows/messages.spec.ts
+++ b/frontend/e2e/specs/flows/messages.spec.ts
@@ -1,5 +1,6 @@
 import { expect, test } from '../../fixtures/test.ts';
 import { expectCleanPage } from '../../helpers/errors.ts';
+import { MESSAGE_ID_SELECTOR } from '../../helpers/subscriptions.ts';
 import { variedMessagesCassette } from '../../mocks/cassettes/flows.ts';
 
 type XtermHost = {
@@ -36,7 +37,7 @@ test.describe('flow message rendering', { tag: '@flows' }, () => {
         pageErrorLog,
     }) => {
         await page.goto('/flows/5?tab=automation');
-        await expect(page.getByTestId('flow-message-id')).toHaveCount(4);
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(4);
 
         const thinkingToggle = page.getByText('Show thinking');
 
@@ -50,6 +51,11 @@ test.describe('flow message rendering', { tag: '@flows' }, () => {
         await expect(page.getByRole('heading', { name: 'Report' })).toBeVisible();
         await expect(page.getByText('Hide details').first()).toBeVisible();
 
+        // Only a report auto-expands, so the terminal message starts collapsed and its xterm is
+        // not mounted — the panel's is the only one on screen until the toggle is used.
+        await expect(page.locator('.xterm')).toHaveCount(1);
+        await page.getByText('Show details').click();
+
         await expect(page.locator('.xterm')).toHaveCount(2);
         await expect(async () => {
             expect(await page.evaluate(anyTerminalContains, 'e2e-terminal-marker')).toBe(true);
diff --git a/frontend/e2e/specs/flows/pager.spec.ts b/frontend/e2e/specs/flows/pager.spec.ts
index e32c9666..58cfedbb 100644
--- a/frontend/e2e/specs/flows/pager.spec.ts
+++ b/frontend/e2e/specs/flows/pager.spec.ts
@@ -8,7 +8,7 @@ test.describe('flow pager', { tag: ['@flows', '@smoke'] }, () => {
     test.describe('with a report to show', () => {
         test.use({ cassette: flowTabsCassette() });
 
-        test('keeps the variable action left of the fixed ones', async ({ page }) => {
+        test('keeps the variable Report action left of the pager and fixed actions', async ({ page }) => {
             await page.goto('/flows/5');
             await expect(page.locator('header').getByRole('button', { name: 'Report' })).toBeVisible();
 
@@ -17,52 +17,59 @@ test.describe('flow pager', { tag: ['@flows', '@smoke'] }, () => {
                 .evaluateAll((buttons) => buttons.map((button) => button.getAttribute('aria-label') ?? ''));
             const positionOf = (label: string) => labels.findIndex((candidate) => candidate.startsWith(label));
 
-            expect(positionOf('Report')).toBeLessThan(positionOf('Toggle favorite'));
-            expect(positionOf('Toggle favorite')).toBeLessThan(positionOf('Previous'));
-            expect(positionOf('Next')).toBeLessThan(positionOf('Flow actions'));
+            // findIndex returns -1 for an absent label, and -1 < any real index, so the ordering below
+            // passes vacuously when a button is missing. Require presence first.
+            for (const label of ['Report', 'Toggle favorite', 'Previous', 'Next', 'Flow actions']) {
+                expect(positionOf(label), `header is missing the "${label}" button`).toBeGreaterThanOrEqual(0);
+            }
+
+            expect(positionOf('Report')).toBeLessThan(positionOf('Previous'));
+            expect(positionOf('Previous')).toBeLessThan(positionOf('Next'));
+            expect(positionOf('Next')).toBeLessThan(positionOf('Toggle favorite'));
+            expect(positionOf('Toggle favorite')).toBeLessThan(positionOf('Flow actions'));
         });
     });
 
     test('steps to the sibling flow and back without passing through the list', async ({ page, pageErrorLog }) => {
         const header = page.locator('header');
 
+        await page.addInitScript(() => {
+            const trail: string[] = [];
+
+            (window as unknown as { __routeTrail: string[] }).__routeTrail = trail;
+
+            for (const method of ['pushState', 'replaceState'] as const) {
+                const original = history[method].bind(history);
+
+                history[method] = (state: unknown, unused: string, url?: null | string | URL) => {
+                    original(state, unused, url);
+                    trail.push(window.location.pathname);
+                };
+            }
+        });
+
         await page.goto('/flows/5');
         await expect(header.getByText('E2E Alpha')).toBeVisible();
 
-        await page.route('**/graphql', async (route) => {
-            await new Promise((resolve) => setTimeout(resolve, 300));
-            await route.fallback();
+        // Drop the router's own normalising replaceState from the initial load.
+        await page.evaluate(() => {
+            (window as unknown as { __routeTrail: string[] }).__routeTrail.length = 0;
         });
 
         await header.getByRole('button', { name: 'Next' }).click();
 
-        const samples = await page.evaluate(async () => {
-            const taken = [];
-
-            for (let index = 0; index < 10; index += 1) {
-                taken.push({
-                    hasPager: !!document.querySelector('header button[aria-label="Next"]'),
-                    isSiblingShown: document.querySelector('header')?.textContent?.includes('E2E Beta') ?? false,
-                    path: window.location.pathname,
-                });
-                await new Promise((resolve) => setTimeout(resolve, 30));
-            }
-
-            return taken;
-        });
-
         await expect(page).toHaveURL(/\/flows\/6$/);
         await expect(header.getByText('E2E Beta')).toBeVisible();
-
-        // Guards the delay above as much as the pager: without it the sibling lands inside the
-        // first sample and the loop measures nothing.
-        expect(samples.filter((sample) => !sample.isSiblingShown).length).toBeGreaterThan(2);
-        expect(samples.every((sample) => sample.hasPager)).toBe(true);
-        expect(samples.map((sample) => sample.path)).not.toContain('/flows');
+        await expect(header.getByRole('button', { name: 'Next' })).toBeVisible();
 
         await header.getByRole('button', { name: 'Previous' }).click();
 
         await expect(page).toHaveURL(/\/flows\/5$/);
+        await expect(header.getByText('E2E Alpha')).toBeVisible();
+
+        const trail = await page.evaluate(() => (window as unknown as { __routeTrail: string[] }).__routeTrail);
+
+        expect(trail, 'the pager must step straight between siblings').toEqual(['/flows/6', '/flows/5']);
         expectCleanPage(pageErrorLog);
     });
 });
diff --git a/frontend/e2e/specs/flows/reconnect.spec.ts b/frontend/e2e/specs/flows/reconnect.spec.ts
index cc2288cd..d8b24650 100644
--- a/frontend/e2e/specs/flows/reconnect.spec.ts
+++ b/frontend/e2e/specs/flows/reconnect.spec.ts
@@ -1,7 +1,7 @@
 import { expect, test } from '../../fixtures/test.ts';
 import { expectCleanPage } from '../../helpers/errors.ts';
 import { dropAndReconnect } from '../../helpers/reconnect.ts';
-import { assertNoDuplicates, extractMessageIds, MESSAGE_ID_TESTID } from '../../helpers/subscriptions.ts';
+import { assertNoDuplicates, extractMessageIds, MESSAGE_ID_SELECTOR } from '../../helpers/subscriptions.ts';
 import {
     FLOW_A_INITIAL_IDS,
     FLOW_A_RECONNECT_ID,
@@ -19,17 +19,34 @@ test.describe('flow reconnect', { tag: ['@flows', '@smoke'] }, () => {
     test.use({ cassette: flowsCassette() });
 
     test('reconciles the missed delta exactly once after a socket drop', async ({ page, pageErrorLog, world }) => {
+        // The GraphQL sweep after a reconnect skips the resources slot (it is cache-only), so the
+        // REST re-hydration rides on the `ws:reconnected` event alone. Count the calls rather than
+        // arming a one-shot expectation: the mount-time hydration would satisfy that on its own.
+        const resourceLoads: string[] = [];
+
+        page.on('request', (request) => {
+            if (request.method() === 'GET' && new URL(request.url()).pathname.startsWith('/api/v1/resources')) {
+                resourceLoads.push(request.url());
+            }
+        });
+
         await page.goto('/flows');
         await page.getByRole('row', { name: /E2E Alpha/ }).click();
-        await expect(page.getByTestId(MESSAGE_ID_TESTID)).toHaveCount(BEFORE_DROP.length);
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(BEFORE_DROP.length);
+
+        const loadsBeforeDrop = resourceLoads.length;
 
         await dropAndReconnect(page, world);
 
-        await expect(page.getByTestId(MESSAGE_ID_TESTID)).toHaveCount(AFTER_RECONNECT.length);
+        await expect
+            .poll(() => resourceLoads.length, { message: 'the reconnect re-hydrates the REST resources slot' })
+            .toBe(loadsBeforeDrop + 1);
+
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(AFTER_RECONNECT.length);
 
         world.raiseFlag(REPLAY_FLAG);
 
-        await expect(page.getByTestId(MESSAGE_ID_TESTID)).toHaveCount(AFTER_REPLAY.length);
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(AFTER_REPLAY.length);
 
         const ids = await extractMessageIds(page.locator('body'));
 
diff --git a/frontend/e2e/specs/flows/report.spec.ts b/frontend/e2e/specs/flows/report.spec.ts
new file mode 100644
index 00000000..13148c46
--- /dev/null
+++ b/frontend/e2e/specs/flows/report.spec.ts
@@ -0,0 +1,123 @@
+import type { Page } from '@playwright/test';
+
+import { expect, test } from '../../fixtures/test.ts';
+import { expectCleanPage } from '../../helpers/errors.ts';
+import { inspectPdf } from '../../helpers/pdf.ts';
+import { flowReportCassette } from '../../mocks/cassettes/flows.ts';
+
+const REPORT_FILE = /^report_flow_5_e2e_alpha_2026\d{10}\.md$/;
+const REPORT_PDF = /^report_flow_5_e2e_alpha_2026\d{10}\.pdf$/;
+
+const openReportMenu = async (page: Page) => {
+    await page.goto('/flows/5');
+    await page.getByRole('button', { name: 'Report' }).click();
+};
+
+test.describe('flow report', { tag: '@flows' }, () => {
+    test.use({ cassette: flowReportCassette() });
+
+    test('the standalone route renders the generated markdown', async ({ page, pageErrorLog }) => {
+        await page.goto('/flows/5/report');
+
+        await expect(page.getByRole('heading', { name: /E2E Alpha/ })).toBeVisible();
+        await expect(page.getByRole('heading', { level: 3, name: /E2E Task Alpha/ })).toBeVisible();
+        await expect(page.getByText('Ports 22, 80 open')).toBeVisible();
+        // The contents links are slugs of the rendered headings; a mismatch scrolls nowhere.
+        await expect(page.getByRole('link', { name: /E2E Subtask Scan/ })).toHaveAttribute('href', /#.+/);
+
+        expectCleanPage(pageErrorLog);
+    });
+
+    test('"Open web view" opens the report in its own tab', async ({ page, pageErrorLog }) => {
+        await openReportMenu(page);
+
+        const popup = page.waitForEvent('popup');
+
+        await page.getByRole('menuitem', { name: 'Open web view' }).click();
+
+        const opened = await popup;
+
+        expect(new URL(opened.url()).pathname).toBe('/flows/5/report');
+        // This tab is mocked only because the fixture re-arms the route on every page the context
+        // opens; without that it talks to the preview proxy and the report never arrives.
+        await expect(opened.getByRole('heading', { name: /E2E Alpha/ })).toBeVisible();
+        await opened.close();
+        expectCleanPage(pageErrorLog);
+    });
+
+    test('"Download PDF" opens the silent print route', async ({ page, pageErrorLog }) => {
+        await openReportMenu(page);
+
+        const popup = page.waitForEvent('popup');
+
+        await page.getByRole('menuitem', { name: 'Download PDF' }).click();
+
+        const opened = await popup;
+        const url = new URL(opened.url());
+
+        expect(url.pathname).toBe('/flows/5/report');
+        // `download` starts the PDF and `silent` closes the tab; without it the export looks hung.
+        expect(url.searchParams.get('download')).toBe('true');
+        expect(url.searchParams.get('silent')).toBe('true');
+        await opened.close();
+        expectCleanPage(pageErrorLog);
+    });
+
+    test('"Download MD" writes the report to a named file', async ({ page, pageErrorLog }) => {
+        await openReportMenu(page);
+
+        const download = page.waitForEvent('download');
+
+        await page.getByRole('menuitem', { name: 'Download MD' }).click();
+
+        const file = await download;
+
+        expect(file.suggestedFilename()).toMatch(REPORT_FILE);
+
+        const stream = await file.createReadStream();
+        const body = (await stream.toArray()).join('');
+
+        expect(body).toContain('E2E Task Alpha');
+        expect(body).toContain('Ports 22, 80 open');
+        expectCleanPage(pageErrorLog);
+    });
+
+    test('"Copy to clipboard" puts the same report on the clipboard', async ({ context, page, pageErrorLog }) => {
+        await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+        await openReportMenu(page);
+        await page.getByRole('menuitem', { name: 'Copy to clipboard' }).click();
+
+        await expect(page.getByText('Report copied to clipboard')).toBeVisible();
+        expect(await page.evaluate(() => navigator.clipboard.readText())).toContain('E2E Task Alpha');
+        expectCleanPage(pageErrorLog);
+    });
+
+    test('the print route writes a real PDF, not just a file with the right name', async ({ page, pageErrorLog }) => {
+        const download = page.waitForEvent('download');
+
+        await page.goto('/flows/5/report?download=true');
+
+        const file = await download;
+
+        expect(file.suggestedFilename()).toMatch(REPORT_PDF);
+
+        const stream = await file.createReadStream();
+        const chunks: Buffer[] = [];
+
+        for await (const chunk of stream) {
+            chunks.push(Buffer.from(chunk));
+        }
+
+        const shape = inspectPdf(Buffer.concat(chunks));
+
+        // A generator that silently produced a blank document, or an error page saved under a .pdf
+        // name, passes a filename check and fails every line of this one.
+        expect(shape.isPdf && shape.trailerComplete, 'a complete PDF document').toBe(true);
+        expect(shape.pages, 'the report paginated').toBeGreaterThan(0);
+        // The seeded report is small; the threshold only has to be above what a title-only or blank
+        // document produces, which is what a silently failing generator emits.
+        expect(shape.textRuns, 'glyphs were actually drawn').toBeGreaterThan(5);
+        expect(shape.fonts, 'a font subset was embedded').toBeGreaterThan(0);
+        expectCleanPage(pageErrorLog);
+    });
+});
diff --git a/frontend/e2e/specs/flows/subscriptions.spec.ts b/frontend/e2e/specs/flows/subscriptions.spec.ts
index 79457b82..723d5633 100644
--- a/frontend/e2e/specs/flows/subscriptions.spec.ts
+++ b/frontend/e2e/specs/flows/subscriptions.spec.ts
@@ -5,15 +5,19 @@ import {
     assertNoDuplicates,
     attachIdSet,
     extractMessageIds,
-    MESSAGE_ID_TESTID,
+    MESSAGE_ID_SELECTOR,
 } from '../../helpers/subscriptions.ts';
 import {
     FLOW_A_INITIAL_IDS,
     FLOW_A_STREAMED_IDS,
     FLOW_B_INITIAL_IDS,
+    FLOW_B_SENTINEL_ID,
     FLOW_B_STREAMED_IDS,
     flowsCassette,
+    PAGER_SWITCH_FLAG,
+    pagerStreamsCassette,
 } from '../../mocks/cassettes/flows.ts';
+import { subscriptionStreamKey } from '../../mocks/world.ts';
 
 const FLOW_A_IDS = [...FLOW_A_INITIAL_IDS, ...FLOW_A_STREAMED_IDS];
 const FLOW_B_IDS = [...FLOW_B_INITIAL_IDS, ...FLOW_B_STREAMED_IDS];
@@ -25,7 +29,7 @@ test.describe('flow subscriptions', { tag: ['@flows', '@smoke'] }, () => {
         await page.goto('/flows');
         await page.getByRole('row', { name: /E2E Alpha/ }).click();
 
-        await expect(page.getByTestId(MESSAGE_ID_TESTID)).toHaveCount(FLOW_A_IDS.length);
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(FLOW_A_IDS.length);
 
         const ids = await extractMessageIds(page.locator('body'));
 
@@ -38,13 +42,13 @@ test.describe('flow subscriptions', { tag: ['@flows', '@smoke'] }, () => {
     test('keeps concurrent flows exact-set disjoint across a round trip', async ({ page, pageErrorLog }, testInfo) => {
         await page.goto('/flows');
         await page.getByRole('row', { name: /E2E Alpha/ }).click();
-        await expect(page.getByTestId(MESSAGE_ID_TESTID)).toHaveCount(FLOW_A_IDS.length);
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(FLOW_A_IDS.length);
 
         const idsA = await extractMessageIds(page.locator('body'));
 
         await page.goBack();
         await page.getByRole('row', { name: /E2E Beta/ }).click();
-        await expect(page.getByTestId(MESSAGE_ID_TESTID)).toHaveCount(FLOW_B_IDS.length);
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(FLOW_B_IDS.length);
 
         const idsB = await extractMessageIds(page.locator('body'));
 
@@ -55,7 +59,7 @@ test.describe('flow subscriptions', { tag: ['@flows', '@smoke'] }, () => {
 
         await page.goBack();
         await page.getByRole('row', { name: /E2E Alpha/ }).click();
-        await expect(page.getByTestId(MESSAGE_ID_TESTID)).toHaveCount(FLOW_A_IDS.length);
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(FLOW_A_IDS.length);
 
         const idsAgain = await extractMessageIds(page.locator('body'));
 
@@ -63,3 +67,47 @@ test.describe('flow subscriptions', { tag: ['@flows', '@smoke'] }, () => {
         expectCleanPage(pageErrorLog);
     });
 });
+
+/**
+ * Leaving via `/flows` unmounts FlowProvider (app.tsx wraps only `flows/:flowId`), so stream A is
+ * already closed there. Only the pager keeps the provider mounted and merely swaps the subscription
+ * variables — the one path where a superseded stream can still write into the flow on screen.
+ */
+test.describe('flow subscriptions across a pager switch', { tag: '@flows' }, () => {
+    test.use({ cassette: pagerStreamsCassette() });
+
+    test('drops the stream it switched away from', async ({ page, pageErrorLog, world }, testInfo) => {
+        const streamA = subscriptionStreamKey('messageLogAdded', { flowId: '5' });
+        const streamB = subscriptionStreamKey('messageLogAdded', { flowId: '6' });
+
+        await page.goto('/flows/5');
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(FLOW_A_IDS.length);
+        expect(world.subscriberCount(streamA), 'flow A must be streaming before the switch').toBe(1);
+
+        const idsA = await extractMessageIds(page.locator('body'));
+
+        await page.locator('header').getByRole('button', { name: 'Next' }).click();
+        await expect(page).toHaveURL(/\/flows\/6$/);
+        await expect(page.locator(MESSAGE_ID_SELECTOR)).toHaveCount(FLOW_B_IDS.length);
+
+        // The DOM cannot witness this leak: `messageLogs` is keyed by flowId, so a frame carrying
+        // {flowId:'5'} is written to flow A's cache slot and never rendered under flow 6 however long
+        // the stale stream stays open. The live subscriber set is the only place it shows.
+        await expect.poll(() => world.subscriberCount(streamA), 'the superseded stream must be torn down').toBe(0);
+        expect(world.subscriberCount(streamB), 'the switched-to flow must be streaming').toBe(1);
+
+        world.raiseFlag(PAGER_SWITCH_FLAG);
+
+        await expect(page.locator(MESSAGE_ID_SELECTOR).filter({ hasText: FLOW_B_SENTINEL_ID })).toHaveCount(1);
+
+        const idsB = await extractMessageIds(page.locator('body'));
+
+        expect([...idsB].sort(), 'the switched-to flow renders exactly its own stream').toEqual(
+            [...FLOW_B_IDS, FLOW_B_SENTINEL_ID].sort(),
+        );
+        assertNoDuplicates(idsB);
+        assertDisjoint(idsA, idsB);
+        await attachIdSet(testInfo, 'pager-flow-6-message-ids', idsB);
+        expectCleanPage(pageErrorLog);
+    });
+});
diff --git a/frontend/e2e/specs/flows/tab-deeplink.spec.ts b/frontend/e2e/specs/flows/tab-deeplink.spec.ts
new file mode 100644
index 00000000..3e0d4c22
--- /dev/null
+++ b/frontend/e2e/specs/flows/tab-deeplink.spec.ts
@@ -0,0 +1,70 @@
+import type { Page } from '@playwright/test';
+
+import { expect, test } from '../../fixtures/test.ts';
+import { expectCleanPage } from '../../helpers/errors.ts';
+import { FLOW_A, flowQueryData, flowsCassette } from '../../mocks/cassettes/flows.ts';
+
+/** A flow whose message list stays empty, so the auto-detect resolves to Assistant. */
+const emptyFlowCassette = () =>
+    flowsCassette({
+        queries: { flow: [{ data: flowQueryData(FLOW_A, []), variables: { id: '5' } }] },
+        subscriptions: { messageLogAdded: [{ frames: [], variables: { flowId: '5' } }] },
+    });
+
+const expectSelectedTab = async (page: Page, name: string) => {
+    await expect(page.getByRole('tab', { name })).toHaveAttribute('aria-selected', 'true');
+};
+
+test.describe('flow tab deep link', { tag: '@flows' }, () => {
+    test.describe('over a populated flow', () => {
+        test.use({ cassette: flowsCassette() });
+
+        test('?tab=assistant beats the auto-detect that would have shown Automation', async ({
+            page,
+            pageErrorLog,
+        }) => {
+            await page.goto('/flows/5?tab=assistant');
+            await expectSelectedTab(page, 'Assistant');
+            await expect(page.getByText('New assistant', { exact: true })).toBeVisible();
+
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('over a flow with no messages', () => {
+        test.use({ cassette: emptyFlowCassette() });
+
+        test('?tab=automation beats the auto-detect that would have shown Assistant', async ({
+            page,
+            pageErrorLog,
+        }) => {
+            await page.goto('/flows/5?tab=automation');
+            await expectSelectedTab(page, 'Automation');
+            await expect(page.getByRole('tabpanel', { name: 'Automation' })).toBeVisible();
+
+            expectCleanPage(pageErrorLog);
+        });
+
+        test('a tab click records itself in the URL', async ({ page, pageErrorLog }) => {
+            await page.goto('/flows/5');
+            await expectSelectedTab(page, 'Assistant');
+
+            await page.getByRole('tab', { name: 'Automation' }).click();
+
+            await expect(page).toHaveURL(/[?&]tab=automation/);
+            await expectSelectedTab(page, 'Automation');
+
+            expectCleanPage(pageErrorLog);
+        });
+
+        test('an unknown tab falls back to the auto-detect', async ({ page, pageErrorLog }) => {
+            await page.goto('/flows/5?tab=not-a-tab');
+            await expectSelectedTab(page, 'Assistant');
+            // The bogus value is left alone rather than rewritten, so a shared link keeps working
+            // once the tab it names exists again.
+            await expect(page).toHaveURL(/[?&]tab=not-a-tab/);
+
+            expectCleanPage(pageErrorLog);
+        });
+    });
+});
diff --git a/frontend/e2e/specs/flows/tabs.spec.ts b/frontend/e2e/specs/flows/tabs.spec.ts
index 216d75b3..0adbb7d5 100644
--- a/frontend/e2e/specs/flows/tabs.spec.ts
+++ b/frontend/e2e/specs/flows/tabs.spec.ts
@@ -1,20 +1,7 @@
 import { expect, test } from '../../fixtures/test.ts';
 import { expectCleanPage } from '../../helpers/errors.ts';
-import {
-    flowTabsCassette,
-    TABS_FILE_NAME,
-    TABS_SCREENSHOT_NAME,
-    TABS_SCREENSHOT_URL,
-} from '../../mocks/cassettes/flows.ts';
-
-const TABS = [
-    { marker: 'E2E Task Alpha', name: 'Tasks' },
-    { marker: 'E2E agent reconnaissance', name: 'Agents' },
-    { marker: 'E2E search for the CVE', name: 'Searches' },
-    { marker: 'E2E recall prior findings', name: 'Vector Store' },
-    { marker: TABS_FILE_NAME, name: 'Files' },
-    { marker: TABS_SCREENSHOT_URL, name: 'Screenshots' },
-] as const;
+import { flowTabsCassette, TABS_SCREENSHOT_NAME } from '../../mocks/cassettes/flows.ts';
+import { FLOW_DETAIL_TABS } from '../../routes.ts';
 
 test.describe('flow detail tabs', { tag: '@flows' }, () => {
     test.use({ cassette: flowTabsCassette() });
@@ -23,9 +10,12 @@ test.describe('flow detail tabs', { tag: '@flows' }, () => {
         await page.goto('/flows/5');
         await expect(page.locator('header').getByRole('button', { name: 'Toggle favorite' })).toBeEnabled();
 
-        for (const { marker, name } of TABS) {
+        for (const { name, ready } of FLOW_DETAIL_TABS) {
+            // Pins that the click is what reveals the panel. Ordering this sweep so a tab is already
+            // open when its turn comes (the flow auto-opens Assistant) makes its iteration a no-op.
+            await expect(ready(page), `"${name}" must not be on screen before its own click`).not.toBeAttached();
             await page.getByRole('tab', { name }).click();
-            await expect(page.getByText(marker)).toBeVisible();
+            await expect(ready(page)).toBeVisible();
         }
 
         expectCleanPage(pageErrorLog);
diff --git a/frontend/e2e/specs/real/account-password.spec.ts b/frontend/e2e/specs/real/account-password.spec.ts
new file mode 100644
index 00000000..7d2df616
--- /dev/null
+++ b/frontend/e2e/specs/real/account-password.spec.ts
@@ -0,0 +1,135 @@
+import type { APIRequestContext } from '@playwright/test';
+
+import { request as apiRequest, expect, test } from '@playwright/test';
+
+const INITIAL_PASSWORD = 'InitPass1!e2e';
+const MAX_BYTES = 72;
+const AT_LIMIT = 'a'.repeat(MAX_BYTES);
+const OVER_LIMIT = 'a'.repeat(MAX_BYTES + 1);
+const MULTIBYTE_OVER_LIMIT = 'é'.repeat(40);
+
+const changePassword = (
+    api: APIRequestContext,
+    body: { confirm_password?: string; current_password: string; password: string },
+) => api.put('/api/v1/user/password', { data: { confirm_password: body.password, ...body } });
+
+const login = (api: APIRequestContext, mail: string, password: string) =>
+    api.post('/api/v1/auth/login', { data: { mail, password } });
+
+const ADMIN_USER = process.env.E2E_USER ?? 'admin@pentagi.com';
+const ADMIN_PASSWORD = process.env.E2E_PASSWORD ?? 'admin';
+
+test.describe('account password at the trust boundary', { tag: '@real' }, () => {
+    // Deliberately bypasses the form: a client-side guard is one DevTools click from gone, so the
+    // matrix has to reach the endpoint the way an attacker would.
+    test('enforces the password policy on the endpoint, not just in the form', async ({ baseURL }) => {
+        const admin = await apiRequest.newContext({ baseURL, ignoreHTTPSErrors: true });
+        const victim = await apiRequest.newContext({ baseURL, ignoreHTTPSErrors: true });
+
+        const adminLogin = await login(admin, ADMIN_USER, ADMIN_PASSWORD);
+
+        expect(adminLogin.status(), 'seeded admin credentials').toBe(200);
+
+        const mail = `e2e-pwd-${Date.now()}@pentagi.com`;
+        const created = await admin.post('/api/v1/users/', {
+            data: {
+                mail,
+                name: `e2epwd${Date.now()}`,
+                password: INITIAL_PASSWORD,
+                role_id: 2,
+                status: 'active',
+                type: 'local',
+            },
+        });
+
+        expect(created.status(), 'throwaway user created').toBe(201);
+
+        const hash = (await created.json()).data.hash as string;
+
+        try {
+            const tooLongAtCreate = await admin.post('/api/v1/users/', {
+                data: {
+                    mail: `e2e-long-${Date.now()}@pentagi.com`,
+                    name: `e2elong${Date.now()}`,
+                    password: OVER_LIMIT,
+                    role_id: 2,
+                    status: 'active',
+                    type: 'local',
+                },
+            });
+
+            expect(tooLongAtCreate.status(), 'over-length password at user creation').toBe(400);
+
+            expect((await login(victim, mail, INITIAL_PASSWORD)).status()).toBe(200);
+
+            for (const [name, body, wantStatus, wantCode] of [
+                [
+                    'wrong current password',
+                    { current_password: 'NotTheOne1!', password: 'NewPass1!abc' },
+                    403,
+                    'Users.ChangePasswordCurrentUser.InvalidCurrentPassword',
+                ],
+                [
+                    'confirmation mismatch',
+                    {
+                        confirm_password: 'NewPass1!abcd',
+                        current_password: INITIAL_PASSWORD,
+                        password: 'NewPass1!abc',
+                    },
+                    400,
+                    'Users.ChangePasswordCurrentUser.InvalidPassword',
+                ],
+                [
+                    'seven characters with every class',
+                    { current_password: INITIAL_PASSWORD, password: 'Ab1$cde' },
+                    400,
+                    'Users.ChangePasswordCurrentUser.InvalidPassword',
+                ],
+                [
+                    'fifteen characters without a special',
+                    { current_password: INITIAL_PASSWORD, password: 'Abcdefghij12345' },
+                    400,
+                    'Users.ChangePasswordCurrentUser.InvalidPassword',
+                ],
+                [
+                    'one byte over the bcrypt limit',
+                    { current_password: INITIAL_PASSWORD, password: OVER_LIMIT },
+                    400,
+                    'Users.ChangePasswordCurrentUser.InvalidPassword',
+                ],
+                [
+                    'within the rune count but over the byte limit',
+                    { current_password: INITIAL_PASSWORD, password: MULTIBYTE_OVER_LIMIT },
+                    400,
+                    'Users.ChangePasswordCurrentUser.InvalidPassword',
+                ],
+            ] as const) {
+                const response = await changePassword(victim, body);
+
+                expect([name, response.status(), (await response.json()).code]).toEqual([name, wantStatus, wantCode]);
+            }
+
+            expect((await login(victim, mail, INITIAL_PASSWORD)).status(), 'no rejected row was saved').toBe(200);
+
+            expect(
+                (
+                    await changePassword(victim, { current_password: INITIAL_PASSWORD, password: 'Abcdefghij123$4' })
+                ).status(),
+                'fifteen characters with every class is the short-branch maximum',
+            ).toBe(200);
+            expect(
+                (await changePassword(victim, { current_password: 'Abcdefghij123$4', password: AT_LIMIT })).status(),
+                'exactly the bcrypt limit is accepted',
+            ).toBe(200);
+
+            expect((await login(victim, mail, AT_LIMIT)).status(), 'the accepted password authenticates').toBe(200);
+            expect((await login(victim, mail, INITIAL_PASSWORD)).status(), 'the replaced password does not').not.toBe(
+                200,
+            );
+        } finally {
+            await admin.delete(`/api/v1/users/${hash}`);
+            await admin.dispose();
+            await victim.dispose();
+        }
+    });
+});
diff --git a/frontend/e2e/specs/real/flow-run.spec.ts b/frontend/e2e/specs/real/flow-run.spec.ts
index 3f4218c8..ad260c76 100644
--- a/frontend/e2e/specs/real/flow-run.spec.ts
+++ b/frontend/e2e/specs/real/flow-run.spec.ts
@@ -1,10 +1,13 @@
 import { expect, test } from '@playwright/test';
 
+import { MESSAGE_ID_SELECTOR } from '../../helpers/subscriptions.ts';
 import { readTerminalBuffer } from '../../helpers/terminal.ts';
 
 test.describe('real backend flow run', { tag: '@real' }, () => {
     test('runs a flow end-to-end through the mock LLM', async ({ page }) => {
-        test.setTimeout(240_000);
+        // Above the sum of the step timeouts below (60+30+90+90+90+60 = 420s), so a slow-but-passing
+        // run is not killed mid-step with a generic timeout that masks the real state.
+        test.setTimeout(450_000);
 
         const pageErrors: string[] = [];
 
@@ -12,7 +15,13 @@ test.describe('real backend flow run', { tag: '@real' }, () => {
 
         await page.goto('/flows/new');
         await page.getByPlaceholder(/Describe what you would like PentAGI to test/).fill('Say hello');
-        await page.getByRole('button', { name: 'Submit' }).click();
+
+        // The form is invalid until the providers query lands, so a cold stack keeps Submit
+        // disabled for a while — clicking straight away spends the whole test timeout on it.
+        const submit = page.getByRole('button', { name: 'Submit' });
+
+        await expect(submit).toBeEnabled({ timeout: 60_000 });
+        await submit.click();
 
         await expect(page).toHaveURL(/\/flows\/\d+/, { timeout: 30_000 });
         // Scope the list assertion to this attempt's flow id: a retry runs
@@ -21,7 +30,7 @@ test.describe('real backend flow run', { tag: '@real' }, () => {
         // violation.
         const flowId = new URL(page.url()).pathname.match(/\d+/)?.[0] ?? '';
 
-        await expect(page.getByTestId('flow-message-id').first()).toBeVisible({ timeout: 90_000 });
+        await expect(page.locator(MESSAGE_ID_SELECTOR).first()).toBeVisible({ timeout: 90_000 });
         await expect(page.getByText('Hello from the e2e mock LLM!').first()).toBeVisible({ timeout: 90_000 });
 
         // The scenario's `uname -a` exec must stream its sandbox output back
diff --git a/frontend/e2e/specs/real/resources-download.spec.ts b/frontend/e2e/specs/real/resources-download.spec.ts
new file mode 100644
index 00000000..ada44d91
--- /dev/null
+++ b/frontend/e2e/specs/real/resources-download.spec.ts
@@ -0,0 +1,67 @@
+import { expect, test } from '@playwright/test';
+
+const CONTENT = 'e2e download payload\nsecond line\n';
+const ZIP_MAGIC = 'PK';
+const END_OF_CENTRAL_DIRECTORY = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
+const CENTRAL_DIRECTORY_ENTRY = 0x02014b50;
+
+/** Entry names straight out of the central directory — an empty archive is a valid zip too. */
+const zipEntryNames = (archive: Buffer): string[] => {
+    const end = archive.lastIndexOf(END_OF_CENTRAL_DIRECTORY);
+
+    if (end === -1) {
+        throw new Error(`not a zip archive: ${archive.subarray(0, 16).toString('hex')}`);
+    }
+
+    const names: string[] = [];
+    let cursor = archive.readUInt32LE(end + 16);
+
+    for (let left = archive.readUInt16LE(end + 10); left > 0; left -= 1) {
+        expect(archive.readUInt32LE(cursor), 'central directory entry header').toBe(CENTRAL_DIRECTORY_ENTRY);
+
+        const nameLength = archive.readUInt16LE(cursor + 28);
+
+        names.push(archive.subarray(cursor + 46, cursor + 46 + nameLength).toString());
+        cursor += 46 + nameLength + archive.readUInt16LE(cursor + 30) + archive.readUInt16LE(cursor + 32);
+    }
+
+    return names;
+};
+
+test.describe('resources download at the endpoint', { tag: '@real' }, () => {
+    // The browser performs an `<a download>` transfer outside the page context, so the mock tier can
+    // only see the URL it asked for. Whether those bytes come back is decided here.
+    test('returns the stored bytes, and a zip when several paths are asked for', async ({ request }) => {
+        const stamp = Date.now();
+        const name = `e2e-download-${stamp}.txt`;
+        const second = `e2e-download-${stamp}-b.txt`;
+
+        for (const file of [name, second]) {
+            const upload = await request.post('/api/v1/resources/', {
+                multipart: { files: { buffer: Buffer.from(CONTENT), mimeType: 'text/plain', name: file } },
+            });
+
+            expect(upload.status(), `seed ${file}`).toBe(200);
+        }
+
+        try {
+            const single = await request.get('/api/v1/resources/download', { params: { 'paths[]': name } });
+
+            expect(single.status()).toBe(200);
+            expect(await single.text(), 'the file comes back byte for byte').toBe(CONTENT);
+
+            // Several paths cannot be one file, so the server has to archive them; a plain 200 with the
+            // first file's bytes would look like success to any caller that only checks the status.
+            const archive = await request.get(`/api/v1/resources/download?paths[]=${name}&paths[]=${second}`);
+
+            expect(archive.status()).toBe(200);
+
+            const body = await archive.body();
+
+            expect(body.subarray(0, 2).toString(), 'a zip, not a bare file').toBe(ZIP_MAGIC);
+            expect(zipEntryNames(body).sort(), 'both files are inside it').toEqual([name, second].sort());
+        } finally {
+            await request.delete(`/api/v1/resources/?paths[]=${name}&paths[]=${second}`);
+        }
+    });
+});
diff --git a/frontend/e2e/specs/real/resources-upload-limits.spec.ts b/frontend/e2e/specs/real/resources-upload-limits.spec.ts
new file mode 100644
index 00000000..86e9b82f
--- /dev/null
+++ b/frontend/e2e/specs/real/resources-upload-limits.spec.ts
@@ -0,0 +1,116 @@
+import type { APIRequestContext } from '@playwright/test';
+
+import { expect, test } from '@playwright/test';
+
+const BOUNDARY = 'e2e-upload-boundary';
+
+/** Builds the multipart body by hand: the point is to send what the client refuses to build. */
+const multipart = (files: Array<{ body: string; name: string }>): Buffer => {
+    const parts = files
+        .map(
+            ({ body, name }) =>
+                `--${BOUNDARY}\r\nContent-Disposition: form-data; name="files"; filename="${name}"\r\n` +
+                `Content-Type: application/octet-stream\r\n\r\n${body}\r\n`,
+        )
+        .join('');
+
+    return Buffer.from(`${parts}--${BOUNDARY}--\r\n`);
+};
+
+const upload = (request: APIRequestContext, files: Array<{ body: string; name: string }>) =>
+    request.post('/api/v1/resources/', {
+        data: multipart(files),
+        headers: { 'content-type': `multipart/form-data; boundary=${BOUNDARY}` },
+    });
+
+test.describe('resources upload limits at the endpoint', { tag: '@real' }, () => {
+    // The browser-side guard is one DevTools click from gone, so what matters is the set of rules the
+    // endpoint itself keeps — a smaller set than the client's, as the empty-file case below records.
+    // The size caps (300 MB per file, 2 GB per batch) are left to the backend's own tests: proving
+    // them here means pushing gigabytes through the stand.
+    test('caps a batch at 1000 files and writes nothing from an over-cap batch', async ({ request }) => {
+        const stamp = Date.now();
+        const many = Array.from({ length: 1001 }, (_, index) => ({
+            body: 'x',
+            name: `e2e-many-${stamp}-${index}.txt`,
+        }));
+
+        const tooMany = await upload(request, many);
+
+        // 400, but not from the handler's own count check: Go's multipart reader caps a form at 1000
+        // parts and answers `multipart: message too large` first (confirmed in the backend log), which
+        // makes `resources.MaxUploadFiles` unreachable for this endpoint. What this pins is the
+        // user-visible contract — 1001 is refused and nothing is written.
+        expect(tooMany.status(), 'a batch past 1000 files is refused').toBe(400);
+
+        const afterReject = await request.get('/api/v1/resources/', { params: { recursive: 'true' } });
+        const rejectedPaths = ((await afterReject.json()).data.items ?? []).map((item: { path: string }) => item.path);
+
+        expect(
+            rejectedPaths.filter((path: string) => path.startsWith(`e2e-many-${stamp}`)),
+            'a rejected batch writes nothing at all, not a partial prefix',
+        ).toEqual([]);
+
+        // Exactly on the cap is the other half of the boundary: a server that rejected 1000 as well
+        // would look just as "safe" and be wrong.
+        const atCap = await upload(request, many.slice(0, 1000));
+
+        expect(atCap.status(), 'a batch exactly on the cap').toBe(200);
+
+        // Repeated keys, not an object: `Object.fromEntries` keeps only the last of 1000 identical
+        // `paths[]` entries and would delete one file while leaving 999 on the stand.
+        const cleanup = new URLSearchParams();
+
+        many.slice(0, 1000).forEach(({ name }) => cleanup.append('paths[]', name));
+
+        const deleted = await request.delete(`/api/v1/resources/?${cleanup}`);
+
+        expect(deleted.status(), 'the seeded batch is removed again').toBe(200);
+    });
+
+    // What licenses the client to send a 0-byte file at all: the endpoint stores it. A client-side
+    // refusal here would only have hidden an upload the API accepts.
+    test('stores an empty file rather than refusing it', async ({ request }) => {
+        const name = `e2e-hollow-${Date.now()}.txt`;
+        const accepted = await upload(request, [{ body: '', name }]);
+
+        expect(accepted.status(), 'a 0-byte part is not a server-side error').toBe(200);
+
+        const [stored] = (await accepted.json()).data.items ?? [];
+
+        expect(stored?.path, 'it is created, not silently dropped').toBe(name);
+        expect(stored?.size, 'as a zero-byte resource').toBe(0);
+
+        await request.delete('/api/v1/resources/', { params: { 'paths[]': name } });
+    });
+
+    test('refuses a batch that carries no file part at all', async ({ request }) => {
+        const nothing = await upload(request, []);
+
+        expect(nothing.status(), 'at least one file is required').toBe(400);
+    });
+
+    // The server sanitises rather than rejects, which is a legitimate choice — what must hold is that
+    // nothing lands outside the library. Asserting a 400 here would pin an implementation the server
+    // does not have; asserting the stored path is what actually protects the filesystem.
+    test('strips a traversal out of the file name instead of honouring it', async ({ request }) => {
+        const name = `e2e-escape-${Date.now()}.txt`;
+        const escaped = await upload(request, [{ body: 'owned', name: `../${name}` }]);
+
+        expect(escaped.status(), 'the request is answered, not crashed').toBeLessThan(500);
+
+        const listing = await request.get('/api/v1/resources/', { params: { recursive: 'true' } });
+        const paths: string[] = ((await listing.json()).data.items ?? []).map((item: { path: string }) => item.path);
+
+        expect(
+            paths.filter((path) => path.includes('..')),
+            'no stored path may climb out',
+        ).toEqual([]);
+        expect(
+            paths.filter((path) => path.endsWith(name)),
+            'it landed under the sanitised name',
+        ).toEqual([name]);
+
+        await request.delete('/api/v1/resources/', { params: { 'paths[]': name } });
+    });
+});
diff --git a/frontend/e2e/specs/real/stand-smoke.spec.ts b/frontend/e2e/specs/real/stand-smoke.spec.ts
index e806e6f8..44989512 100644
--- a/frontend/e2e/specs/real/stand-smoke.spec.ts
+++ b/frontend/e2e/specs/real/stand-smoke.spec.ts
@@ -11,6 +11,10 @@ const ROUTES = [
     { emptyTitle: 'No API tokens configured', path: '/settings/api-tokens', title: 'API Tokens' },
 ];
 
+// The data assertion waits on a real backend query, so it must not run on the 5s default expect
+// timeout — a healthy but slow stand would flake. The config overrides only the screenshot timeout.
+const STAND_DATA_TIMEOUT = 30_000;
+
 test.describe('stand smoke', { tag: '@stand' }, () => {
     for (const { emptyTitle, path, title } of ROUTES) {
         test(`renders ${path} without a page error`, async ({ page }) => {
@@ -29,7 +33,9 @@ test.describe('stand smoke', { tag: '@stand' }, () => {
             // settings-sidebar <a> at runtime, the breadcrumb title is a span.
             await expect(page.locator('span[aria-current="page"]')).toHaveText(title);
             // Either branch: a query error renders neither, and a stand may hold no rows.
-            await expect(page.locator('[data-slot="table"]').first().or(page.getByText(emptyTitle))).toBeVisible();
+            await expect(page.locator('[data-slot="table"]').first().or(page.getByText(emptyTitle))).toBeVisible({
+                timeout: STAND_DATA_TIMEOUT,
+            });
             expect(pageErrors, `uncaught errors on ${path}`).toEqual([]);
         });
     }
diff --git a/frontend/e2e/specs/settings/account.spec.ts b/frontend/e2e/specs/settings/account.spec.ts
new file mode 100644
index 00000000..c8aa9358
--- /dev/null
+++ b/frontend/e2e/specs/settings/account.spec.ts
@@ -0,0 +1,193 @@
+import type { Locator, Page } from '@playwright/test';
+
+import type { Cassette } from '../../mocks/cassette.ts';
+
+import { SEEDED_USER } from '../../fixtures/auth.ts';
+import { expect, test } from '../../fixtures/test.ts';
+import { expectCleanPage } from '../../helpers/errors.ts';
+import { baseQueries, baseRest } from '../../mocks/cassettes/base.ts';
+
+const CURRENT_PASSWORD = 'CurrentPass1!';
+// The server-side half of this boundary lives in specs/real/account-password.spec.ts.
+const MAX_LENGTH_PASSWORD = 'n'.repeat(72);
+
+const accountCassette = (rest: Cassette['rest'] = {}): Cassette => ({
+    queries: baseQueries(),
+    rest: { ...baseRest(), ...rest },
+});
+
+const section = (page: Page, title: string): Locator =>
+    page.locator('[data-slot="card"]').filter({ has: page.locator('[data-slot="card-title"]', { hasText: title }) });
+
+const openSection = async (page: Page, title: string): Promise<Locator> => {
+    const card = section(page, title);
+
+    await card.getByRole('button', { name: 'Change' }).click();
+
+    return card;
+};
+
+const fillPasswordForm = async (page: Page, next: string, confirm = next): Promise<void> => {
+    await page.getByLabel('Current Password').fill(CURRENT_PASSWORD);
+    await page.getByLabel('New Password', { exact: true }).fill(next);
+    await page.getByLabel('Confirm New Password').fill(confirm);
+};
+
+const submitPasswordForm = (page: Page): Promise<void> => page.getByRole('button', { name: 'Update Password' }).click();
+
+test.describe('account settings', { tag: '@settings' }, () => {
+    test.describe('read', () => {
+        test.use({ cassette: accountCassette() });
+
+        test('renders the signed-in identity and every editable section', async ({ page, pageErrorLog }) => {
+            await page.goto('/settings/account');
+
+            await expect(page.getByRole('heading', { exact: true, name: SEEDED_USER.name })).toBeVisible();
+            await expect(page.getByText('Member since January 2026')).toBeVisible();
+            await expect(page.getByText('Local account')).toBeVisible();
+            await expect(section(page, 'Display name').getByText(SEEDED_USER.name)).toBeVisible();
+            await expect(section(page, 'Email address').getByText(SEEDED_USER.mail)).toBeVisible();
+            await expect(section(page, 'Password').getByText('••••••••••••')).toBeVisible();
+
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('password validation', () => {
+        test.use({ cassette: accountCassette() });
+
+        // The cassette deliberately holds no `PUT /user/password` entry: adding one to "fix" a
+        // failure here would destroy the oracle.
+        test('rejects each invalid password without touching the network', async ({ page, pageErrorLog }) => {
+            const attempts: string[] = [];
+
+            page.on('request', (request) => {
+                if (request.method() === 'PUT' && new URL(request.url()).pathname === '/api/v1/user/password') {
+                    attempts.push(request.url());
+                }
+            });
+
+            await page.goto('/settings/account');
+            await openSection(page, 'Password');
+
+            // Only the first row clicks: the submit disables itself once a submitted form is invalid,
+            // and every later row is then validated live on change.
+            await fillPasswordForm(page, 'NewPass1!abc', 'OtherPass1!abc');
+            await submitPasswordForm(page);
+            await expect(page.getByText("Passwords don't match")).toBeVisible();
+
+            await fillPasswordForm(page, 'newpass1');
+            await expect(page.getByText('Password must be either longer than 15 characters')).toBeVisible();
+
+            await fillPasswordForm(page, 'short1!');
+            await expect(page.getByText('Password must be at least 8 characters')).toBeVisible();
+
+            await fillPasswordForm(page, `${MAX_LENGTH_PASSWORD}x`);
+            await expect(page.getByText('Password must not exceed 72 characters')).toBeVisible();
+
+            await fillPasswordForm(page, CURRENT_PASSWORD);
+            await expect(page.getByText('New password must be different from current password')).toBeVisible();
+
+            expect(attempts, 'no invalid password may reach the backend').toEqual([]);
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('password submit', () => {
+        test.use({
+            cassette: accountCassette({
+                'PUT /api/v1/user/password': [
+                    {
+                        body: { data: {}, status: 'success' },
+                        bodySubset: {
+                            confirm_password: MAX_LENGTH_PASSWORD,
+                            current_password: CURRENT_PASSWORD,
+                            password: MAX_LENGTH_PASSWORD,
+                        },
+                    },
+                ],
+            }),
+        });
+
+        test('sends the three snake_case fields and closes the section', async ({ page, pageErrorLog }) => {
+            await page.goto('/settings/account');
+            await openSection(page, 'Password');
+            await fillPasswordForm(page, MAX_LENGTH_PASSWORD);
+            await submitPasswordForm(page);
+
+            await expect(page.getByText('Password successfully changed')).toBeVisible();
+            await expect(section(page, 'Password').getByText('••••••••••••')).toBeVisible();
+
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('password rejection', () => {
+        test.use({
+            cassette: accountCassette({
+                'PUT /api/v1/user/password': [
+                    {
+                        body: {
+                            code: 'Users.ChangePasswordCurrentUser.InvalidCurrentPassword',
+                            msg: 'invalid current password',
+                            status: 'error',
+                        },
+                        status: 403,
+                    },
+                ],
+            }),
+        });
+
+        test('translates the backend error code instead of showing the raw message', async ({ page, pageErrorLog }) => {
+            await page.goto('/settings/account');
+            await openSection(page, 'Password');
+            await fillPasswordForm(page, 'NewPass1!abc');
+            await submitPasswordForm(page);
+
+            await expect(page.getByText('Current password is incorrect')).toBeVisible();
+            await expect(page.getByText('invalid current password')).toBeHidden();
+            await expect(page.getByRole('button', { name: 'Update Password' })).toBeVisible();
+
+            expect(pageErrorLog.pageErrors, 'no uncaught page errors').toEqual([]);
+            expect(
+                pageErrorLog.consoleErrors.filter((text) => !text.includes('403')),
+                'the rejected request is the only console error',
+            ).toEqual([]);
+        });
+    });
+
+    test.describe('name and email', () => {
+        test.use({
+            cassette: accountCassette({
+                'PUT /api/v1/user/email': [
+                    {
+                        body: { data: {}, status: 'success' },
+                        bodySubset: { current_password: CURRENT_PASSWORD, mail: 'renamed@pentagi.com' },
+                    },
+                ],
+                'PUT /api/v1/user/name': [
+                    { body: { data: {}, status: 'success' }, bodySubset: { name: 'E2E renamed admin' } },
+                ],
+            }),
+        });
+
+        test('sends the display name and the credential-guarded email change', async ({ page, pageErrorLog }) => {
+            await page.goto('/settings/account');
+
+            const nameCard = await openSection(page, 'Display name');
+
+            await nameCard.getByLabel('Display name').fill('E2E renamed admin');
+            await nameCard.getByRole('button', { name: 'Update Name' }).click();
+            await expect(page.getByText('Name successfully updated')).toBeVisible();
+
+            const emailCard = await openSection(page, 'Email address');
+
+            await emailCard.getByLabel('Current Password').fill(CURRENT_PASSWORD);
+            await emailCard.getByLabel('New Email').fill('renamed@pentagi.com');
+            await emailCard.getByRole('button', { name: 'Update Email' }).click();
+            await expect(page.getByText('Email successfully updated')).toBeVisible();
+
+            expectCleanPage(pageErrorLog);
+        });
+    });
+});
diff --git a/frontend/e2e/specs/settings/prompt-detail.spec.ts b/frontend/e2e/specs/settings/prompt-detail.spec.ts
index c61f6b1b..d26150a3 100644
--- a/frontend/e2e/specs/settings/prompt-detail.spec.ts
+++ b/frontend/e2e/specs/settings/prompt-detail.spec.ts
@@ -4,12 +4,34 @@ import { expect, test } from '../../fixtures/test.ts';
 import { expectCleanPage } from '../../helpers/errors.ts';
 import {
     PROMPT_DETAIL_AGENT,
+    PROMPT_OVERRIDE,
+    PROMPT_RESET_FLAG,
     promptDetailCassette,
+    promptOverrideCassette,
     RICH_PROMPT_TEMPLATE,
 } from '../../mocks/cassettes/settings-prompts.ts';
 
 test.describe('settings prompt detail', { tag: '@coverage' }, () => {
-    test.use({ cassette: promptDetailCassette() });
+    test.use({
+        cassette: promptDetailCassette({
+            mutations: {
+                createPrompt: [
+                    {
+                        data: {
+                            createPrompt: {
+                                __typename: 'UserPrompt',
+                                createdAt: '2026-01-15T12:00:00Z',
+                                id: '77',
+                                template: 'saved',
+                                type: 'pentester',
+                                updatedAt: '2026-01-15T12:00:00Z',
+                            },
+                        } as never,
+                    },
+                ],
+            },
+        }),
+    });
 
     const EDITOR = 'System prompt template';
 
@@ -57,4 +79,136 @@ test.describe('settings prompt detail', { tag: '@coverage' }, () => {
         expect(raw).toContain('E2E-MARK');
         expectCleanPage(pageErrorLog);
     });
+
+    // The editor is where a Go template's byte fidelity is decided, and Save is the only operation
+    // that can destroy one. Until now no spec let it reach the wire, so the whole form → mutation hop
+    // was unverified: the round-trip units cannot see it.
+    test('Save sends the edited template verbatim, atoms intact', async ({ page, pageErrorLog }) => {
+        await page.goto(`/settings/prompts/${PROMPT_DETAIL_AGENT}`);
+
+        const editor = page.getByRole('textbox', { name: EDITOR });
+
+        await expect(editor.getByRole('heading', { name: 'Pentester' })).toBeVisible();
+
+        await editor.click();
+        await page.keyboard.press('ControlOrMeta+End');
+        await editor.pressSequentially(' E2E-SAVE-MARK');
+
+        const request = page.waitForRequest(
+            (candidate) => candidate.method() === 'POST' && candidate.postDataJSON()?.operationName === 'createPrompt',
+        );
+
+        await page.getByRole('button', { exact: true, name: 'Save' }).click();
+
+        const { variables } = (await request).postDataJSON();
+
+        expect(variables.template, 'the edit reached the wire').toContain('E2E-SAVE-MARK');
+
+        for (const atom of ['# Pentester', '{{.Target}}', '{{.Scope}}', '```bash', '| Scope | {{.Scope}} |']) {
+            expect(variables.template, `"${atom}" survived the save`).toContain(atom);
+        }
+
+        expectCleanPage(pageErrorLog);
+    });
+});
+
+test.describe('settings prompt detail, already overridden', { tag: '@coverage' }, () => {
+    const EDITOR = 'System prompt template';
+
+    test.describe('save', () => {
+        test.use({
+            cassette: promptOverrideCassette({
+                mutations: {
+                    updatePrompt: [
+                        {
+                            data: {
+                                updatePrompt: {
+                                    __typename: 'UserPrompt',
+                                    createdAt: '2026-01-15T09:00:00Z',
+                                    id: PROMPT_OVERRIDE.id,
+                                    template: 'saved',
+                                    type: 'pentester',
+                                    updatedAt: '2026-01-15T12:00:00Z',
+                                },
+                            } as never,
+                            variables: { promptId: PROMPT_OVERRIDE.id },
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('Save updates the existing override instead of creating another', async ({ page, pageErrorLog }) => {
+            await page.goto(`/settings/prompts/${PROMPT_DETAIL_AGENT}`);
+
+            const editor = page.getByRole('textbox', { name: EDITOR });
+
+            await expect(editor.getByRole('heading', { name: 'Operator override' })).toBeVisible();
+
+            await editor.click();
+            await page.keyboard.press('ControlOrMeta+End');
+            await editor.pressSequentially(' E2E-UPDATE-MARK');
+
+            const request = page.waitForRequest(
+                (candidate) =>
+                    candidate.method() === 'POST' && candidate.postDataJSON()?.operationName === 'updatePrompt',
+            );
+
+            await page.getByRole('button', { exact: true, name: 'Save' }).click();
+
+            const { variables } = (await request).postDataJSON();
+
+            expect(variables.promptId, "the operator's own row is the one rewritten").toBe(PROMPT_OVERRIDE.id);
+            expect(variables.template).toContain('E2E-UPDATE-MARK');
+            expect(variables.template, 'the override travels whole').toContain('# Operator override');
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('reset', () => {
+        test.use({
+            cassette: promptOverrideCassette({
+                mutations: {
+                    deletePrompt: [
+                        {
+                            data: { deletePrompt: 'success' } as never,
+                            setFlag: PROMPT_RESET_FLAG,
+                            variables: { promptId: PROMPT_OVERRIDE.id },
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('Reset deletes the override and puts the default back in the editor', async ({ page, pageErrorLog }) => {
+            await page.goto(`/settings/prompts/${PROMPT_DETAIL_AGENT}`);
+
+            const editor = page.getByRole('textbox', { name: EDITOR });
+
+            await expect(editor.getByRole('heading', { name: 'Operator override' })).toBeVisible();
+
+            await page.getByRole('button', { name: 'Prompt actions' }).click();
+            await page.getByRole('menuitem', { name: 'Reset' }).click();
+
+            const request = page.waitForRequest(
+                (candidate) =>
+                    candidate.method() === 'POST' && candidate.postDataJSON()?.operationName === 'deletePrompt',
+            );
+
+            await page.getByRole('dialog').getByRole('button', { exact: true, name: 'Reset' }).click();
+
+            expect((await request).postDataJSON().variables).toEqual({ promptId: PROMPT_OVERRIDE.id });
+
+            // Wait for the dialog to go first: a role-based locator does not resolve while the modal
+            // holds the background out of the a11y tree, and Playwright reads "0 elements" as hidden —
+            // so asserting through the open dialog passes whatever the editor actually shows.
+            await expect(page.getByRole('dialog')).toBeHidden();
+
+            // Deleting the row is only half the operation: the editor has to fall back to the default,
+            // or the operator is left looking at text that no longer exists anywhere.
+            await expect(editor.getByRole('heading', { name: 'Pentester' })).toBeVisible();
+            await expect(editor.getByRole('heading', { name: 'Operator override' })).toBeHidden();
+            expectCleanPage(pageErrorLog);
+        });
+    });
 });
diff --git a/frontend/e2e/specs/settings/providers.spec.ts b/frontend/e2e/specs/settings/providers.spec.ts
index 876b770f..5ab403ce 100644
--- a/frontend/e2e/specs/settings/providers.spec.ts
+++ b/frontend/e2e/specs/settings/providers.spec.ts
@@ -1,6 +1,24 @@
+import type { Page } from '@playwright/test';
+
 import { expect, test } from '../../fixtures/test.ts';
 import { expectCleanPage } from '../../helpers/errors.ts';
-import { settingsProvidersCassette } from '../../mocks/cassettes/settings-providers.ts';
+import {
+    agentTestResult,
+    OTHER_PROVIDER,
+    OTHER_PROVIDER_ROW,
+    populatedSettingsProvidersCassette,
+    providersList,
+    providerTestResult,
+    renamedProviderRow,
+    SEEDED_PROVIDER,
+    seededProviderRow,
+    settingsProvidersCassette,
+} from '../../mocks/cassettes/settings-providers.ts';
+
+/** The per-agent Test control repeats its name for all 13 agents, so it is addressed through the
+ *  accordion item that names the agent. */
+const agentRow = (page: Page, agentName: string) =>
+    page.locator('[data-slot="accordion-item"]').filter({ hasText: agentName });
 
 test.describe('settings providers', { tag: '@coverage' }, () => {
     test.use({ cassette: settingsProvidersCassette() });
@@ -27,3 +45,290 @@ test.describe('settings providers', { tag: '@coverage' }, () => {
         expectCleanPage(pageErrorLog);
     });
 });
+
+test.describe('settings providers create form', { tag: '@coverage' }, () => {
+    // Needs a cassette where the type is enabled: the create form bounces `?type=` for a disabled
+    // one, so the empty seed would just redirect to the list.
+    test.use({ cassette: populatedSettingsProvidersCassette() });
+
+    // A selected type seeds each agent's model from that type's catalog. The catalog must carry the
+    // shape the backend actually emits (a non-empty model list for every type, keyed or not); an
+    // empty catalog makes this whole path unreachable and any assertion on it vacuous. `?type=` is
+    // the URL the type picker produces, driven directly to avoid the dirty-form navigation blocker.
+    test('seeds the agent model from the selected type catalog', async ({ page, pageErrorLog }) => {
+        await page.goto('/settings/providers/new?type=anthropic');
+
+        await page.getByRole('button', { name: /^Adviser/ }).click();
+        await page.getByRole('button', { name: 'Open model list' }).first().click();
+
+        // A catalog-only model (not the seeded agent default), so it can only appear if the type's
+        // model list reached the dropdown — the path an empty catalog leaves unreachable.
+        await expect(page.getByRole('option', { name: 'e2e-anthropic-model-mini' })).toBeVisible();
+
+        expectCleanPage(pageErrorLog);
+    });
+});
+
+test.describe('settings providers write path', { tag: '@coverage' }, () => {
+    const CREATED_NAME = 'E2E created provider';
+
+    test.use({
+        cassette: populatedSettingsProvidersCassette({
+            mutations: {
+                createProvider: [
+                    {
+                        data: { createProvider: { __typename: 'ResultType', result: 'success' } } as never,
+                        variables: { name: CREATED_NAME, type: 'anthropic' },
+                    },
+                ],
+            },
+        }),
+    });
+
+    // The create form is seeded from the type's defaults and then serialises the whole agents map back.
+    // Fields the user never touches are exactly the ones that get dropped on the way to the wire — this
+    // asserts the payload, because the UI looks identical either way.
+    test('create sends every agent field it was seeded with, zero-ish values included', async ({
+        page,
+        pageErrorLog,
+    }) => {
+        await page.goto('/settings/providers/new?type=anthropic');
+
+        await expect(page.getByLabel('Name', { exact: true })).toBeVisible();
+        await page.getByLabel('Name', { exact: true }).fill(CREATED_NAME);
+
+        const request = page.waitForRequest(
+            (candidate) =>
+                candidate.method() === 'POST' && candidate.postDataJSON()?.operationName === 'createProvider',
+        );
+
+        await page.getByRole('button', { exact: true, name: 'Create' }).click();
+
+        const { variables } = (await request).postDataJSON();
+
+        expect(variables.name).toBe(CREATED_NAME);
+        expect(variables.type).toBe('anthropic');
+        expect(Object.keys(variables.agents), 'every agent is serialised, not just the edited one').toHaveLength(13);
+        expect(variables.agents.simpleJson).toMatchObject({
+            json: true,
+            maxTokens: 4096,
+            model: 'e2e-anthropic-model',
+            n: 1,
+        });
+        expectCleanPage(pageErrorLog);
+    });
+});
+
+test.describe('settings provider edit paths', { tag: '@coverage' }, () => {
+    const RENAMED = 'E2E renamed endpoint';
+
+    const editCassette = (override: Parameters<typeof populatedSettingsProvidersCassette>[0] = {}) =>
+        populatedSettingsProvidersCassette(override);
+
+    const openProvider = async (page: Page) => {
+        await page.goto(`/settings/providers/${SEEDED_PROVIDER.id}`);
+        await expect(page.getByLabel('Name', { exact: true })).toHaveValue(SEEDED_PROVIDER.name);
+    };
+
+    const mutationRequest = (page: Page, operationName: string) =>
+        page.waitForRequest(
+            (candidate) => candidate.method() === 'POST' && candidate.postDataJSON()?.operationName === operationName,
+        );
+
+    test.describe('update', () => {
+        test.use({
+            cassette: editCassette({
+                mutations: {
+                    updateProvider: [
+                        {
+                            data: { updateProvider: renamedProviderRow(RENAMED) } as never,
+                            variables: { name: RENAMED, providerId: SEEDED_PROVIDER.id },
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('Save carries the id of the provider being edited', async ({ page, pageErrorLog }) => {
+            await openProvider(page);
+            await page.getByLabel('Name', { exact: true }).fill(RENAMED);
+
+            const request = mutationRequest(page, 'updateProvider');
+
+            await page.getByRole('button', { exact: true, name: 'Save' }).click();
+
+            const { variables } = (await request).postDataJSON();
+
+            expect(variables.providerId).toBe(SEEDED_PROVIDER.id);
+            expect(variables.name).toBe(RENAMED);
+            expect(Object.keys(variables.agents), 'the whole agents map is resubmitted').toHaveLength(13);
+            await expect(page, 'a saved provider returns to the list').toHaveURL(/\/settings\/providers$/);
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('delete from the editor', () => {
+        test.use({
+            cassette: editCassette({
+                mutations: {
+                    deleteProvider: [
+                        {
+                            data: { deleteProvider: 'success' } as never,
+                            variables: { providerId: SEEDED_PROVIDER.id },
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('Delete confirms by name, sends the id, and returns to the list', async ({ page, pageErrorLog }) => {
+            await openProvider(page);
+            await page.getByRole('button', { name: 'Provider actions' }).click();
+            await page.getByRole('menuitem', { name: 'Delete' }).click();
+
+            const dialog = page.getByRole('dialog');
+
+            // A confirm dialog wired to the wrong row shows the wrong name here instead of deleting silently.
+            await expect(dialog).toContainText(SEEDED_PROVIDER.name);
+
+            const request = mutationRequest(page, 'deleteProvider');
+
+            await dialog.getByRole('button', { name: 'Delete' }).click();
+
+            expect((await request).postDataJSON().variables).toEqual({ providerId: SEEDED_PROVIDER.id });
+            await expect(page).toHaveURL(/\/settings\/providers$/);
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('delete from the list', () => {
+        test.use({
+            cassette: editCassette({
+                mutations: {
+                    deleteProvider: [
+                        {
+                            data: { deleteProvider: 'success' } as never,
+                            setFlag: 'provider-deleted',
+                            variables: { providerId: OTHER_PROVIDER.id },
+                        },
+                    ],
+                },
+                queries: {
+                    settingsProviders: [
+                        { data: providersList(seededProviderRow(), OTHER_PROVIDER_ROW()) },
+                        { data: providersList(seededProviderRow()), whenFlag: 'provider-deleted' },
+                    ],
+                },
+            }),
+        });
+
+        test('the row menu deletes the row it belongs to', async ({ page, pageErrorLog }) => {
+            await page.goto('/settings/providers');
+
+            // The second row on purpose: a menu wired to a fixed index would still send the first
+            // row's id, and a spec that operated row one could not tell the two apart.
+            const row = page.getByRole('row', { name: new RegExp(OTHER_PROVIDER.name) });
+
+            await expect(row).toBeVisible();
+            await row.hover();
+            await row.getByRole('button', { name: 'Open menu' }).click();
+            await page.getByRole('menuitem', { name: 'Delete' }).click();
+
+            const request = mutationRequest(page, 'deleteProvider');
+
+            await page.getByRole('dialog').getByRole('button', { name: 'Delete' }).click();
+
+            expect((await request).postDataJSON().variables).toEqual({ providerId: OTHER_PROVIDER.id });
+            // The row goes only because the refetch answers without it, and the sibling proves the
+            // table itself survived — a vanished table would satisfy a bare toBeHidden() too.
+            await expect(row).toBeHidden();
+            await expect(page.getByRole('row', { name: new RegExp(SEEDED_PROVIDER.name) })).toBeVisible();
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('test one agent', () => {
+        test.use({
+            cassette: editCassette({
+                mutations: {
+                    testAgent: [
+                        {
+                            data: { testAgent: agentTestResult() } as never,
+                            variables: { agentType: 'adviser', type: SEEDED_PROVIDER.type },
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test("a single agent's Test sends that agent, its type, and shows the verdict", async ({
+            page,
+            pageErrorLog,
+        }) => {
+            await openProvider(page);
+
+            const request = mutationRequest(page, 'testAgent');
+
+            await agentRow(page, 'Adviser').getByRole('button', { exact: true, name: 'Test' }).click();
+
+            const { variables } = (await request).postDataJSON();
+
+            expect(variables.agentType, 'the enum the backend keys the agent by').toBe('adviser');
+            expect(variables.type).toBe(SEEDED_PROVIDER.type);
+            expect(variables.agent, 'the edited agent config travels with the request').toMatchObject({
+                json: true,
+                maxTokens: 4096,
+                model: 'e2e-model',
+                n: 1,
+            });
+
+            const dialog = page.getByRole('dialog');
+
+            // Only the agent that was tested appears — the dialog is keyed by the clicked agent, so a
+            // handler that tested the wrong one would name it here.
+            await expect(dialog.getByRole('heading', { name: 'Adviser 1/1 passed' })).toBeVisible();
+            await expect(dialog.getByRole('heading', { name: /passed/ })).toHaveCount(1);
+            expectCleanPage(pageErrorLog);
+        });
+    });
+
+    test.describe('test the whole provider', () => {
+        test.use({
+            cassette: editCassette({
+                mutations: {
+                    testProvider: [
+                        {
+                            data: { testProvider: providerTestResult() } as never,
+                            variables: { type: SEEDED_PROVIDER.type },
+                        },
+                    ],
+                },
+            }),
+        });
+
+        test('the header Test sends every agent and renders a verdict per agent', async ({ page, pageErrorLog }) => {
+            await openProvider(page);
+
+            const request = mutationRequest(page, 'testProvider');
+
+            await page.locator('header').getByRole('button', { exact: true, name: 'Test' }).click();
+
+            const { variables } = (await request).postDataJSON();
+
+            expect(Object.keys(variables.agents), 'the whole map is tested, not one agent').toHaveLength(13);
+            expect(variables.type).toBe(SEEDED_PROVIDER.type);
+
+            const dialog = page.getByRole('dialog');
+
+            await expect(dialog.getByRole('heading', { name: /passed/ }), 'one row per agent').toHaveCount(13);
+            await expect(dialog.getByRole('heading', { name: 'Pentester 0/1 passed' })).toBeVisible();
+
+            await dialog.getByRole('button', { name: 'Pentester 0/1 passed' }).click();
+
+            // The failing agent's own error must reach the operator; a dialog that renders only the
+            // verdict leaves them with nothing to act on.
+            await expect(dialog.getByText('e2e simulated failure')).toBeVisible();
+            expectCleanPage(pageErrorLog);
+        });
+    });
+});
diff --git a/frontend/e2e/specs/smoke.spec.ts b/frontend/e2e/specs/smoke.spec.ts
index fba878c0..a9f4d616 100644
--- a/frontend/e2e/specs/smoke.spec.ts
+++ b/frontend/e2e/specs/smoke.spec.ts
@@ -40,9 +40,13 @@ test.describe('smoke', { tag: '@smoke' }, () => {
 
             await expect(page.getByText('Login failed. Please try again.').first()).toBeVisible();
             await expect(page).toHaveURL(/\/login/);
-            // react-hook-form leaves Submit disabled after a failed submit until
-            // an input changes.
+            // Disabled by FormSubmitButton's `requireValid` gate (`isSubmitted && !isValid`), not by
+            // the 401: the typed values are still schema-valid, and only a change recomputes validity.
             await expect(page.getByRole('button', { name: 'Sign in' })).toBeDisabled();
+
+            await page.getByRole('textbox', { name: 'Password' }).fill('another-password');
+
+            await expect(page.getByRole('button', { name: 'Sign in' })).toBeEnabled();
             // The 401 logs an expected browser console error, but the path must raise no
             // uncaught JS exception / unhandled rejection.
             expect(pageErrorLog.pageErrors).toEqual([]);
diff --git a/frontend/e2e/specs/visual/routes.spec.ts-snapshots/flows-5-dark-visual-linux.png b/frontend/e2e/specs/visual/routes.spec.ts-snapshots/flows-5-dark-visual-linux.png
index 76d0ea0e6e2886f053372051e8415c9c743c40d6..0e712e38b13b23024d281f16c3df05fbeac6b8ea 100644
GIT binary patch
literal 59943
zcmce-RaBfyv@P6$1cC$zB)BBFyK4vpcW7LKySpd2yEf9ngS%UBr*Vf4?k<h@W$%5?
zy)XasUoTzXC>gb?R#mN<b9T6rg5*0?LR0_%@J?DvTm=Al^O8lFc#H7z^My?26##$*
zkQNtJ^T<3}MbT9QLXpo9M-c|2Py=ZLhjVNC3d7#!7Ker8s%X+Pf3vg#6&A!Mo2A^P
znci3|mYNo)gK#TMn&LJBnyRQW*nhCU9skST!;N;9ovtiy>Jaj+>&{oi$7N^58=_~n
zvvS$FyW&hBhsJ>LJ<i6<1J^*F>SY)Jz<2y8lz%gTAFsXu(ErOKy?Vv^Uk?BE>p%bH
zzGGnl5dY2o5dD7@e~SKBnjH@U5hC1ku(Ol@68WDdXXq0Xsa@Qrtn%_{aumimQ@U1G
zOIk~H*|%{gW|wwy$tuj1w5iFf<w<Lz_+>2r+e&RRZ6Xb+!wk3XTtiuzo}rR_YzCvu
zQnB!r!(?*O92W7^arOSXmJe4lCxx*wQsC_PaQ|rTrk=8By~<BkP4^~b{C~%k&E3FP
z6f&bGW3Qn>Cw&PEumi4^WOy5wlqO#c3j}*!4A<OnufE+w{2yBdg+SSmD-o@IJx)Dt
zLLnE^M*9Si6?YNhN#2|u$Ll|N`h<QPgE{_2m>rygY5$qc88*b8sF8wWK?p?mk+iX!
zjQ=qX^1^h0kj7YdYTvCPlY!FG9#0Q}V$87}`kyHOYZW_L2PDj3RTBc|3?<dbAT3AL
z{ZZ0^lomDsTAQ2RI$dJ+60dpx#d_x}WZ*#aUz;U@^t3pT6@t9FYB{GNJIY>}G}9kD
z=5YlD453V7Vffa|To^x`tY&6;qdHx(*VO#as(!J~l|*xBbvwSlyPKj-?P#d7fGtj8
z!r;|`BkOIju24>NH-|l8>yv;R-IJdp?tT}O<ot+PV_h8rdc7+vnSdV{FYc01RO-Bk
zRODWPU%Q-<cIh=bzAyOb|N3QUS0*MVy^Y6T4IG+@?<EZu-1eiMe^21n+d~Tcx9$q8
z(Hv;358GQC-S=(84B)$)rf9p6v9S@dkI&j>Hy=S?^K?~Ioq2EYpO&kwA-f~O!tcE;
zu6f`(cZ)PGR?qc^>y`2?z7H6$JoG0HMOA5{G0#rTjf_TXYf3(IQBgG>j4J_wzV}DX
z<;(6V$;t7!6N@wFeF``&pw?C8l{WhJIFCc6^cpr1Hg3pRZyiOVwWQ)IC%T!t*V21l
z0N{`F_w`420~E4jp6`3`a(GBb7V9>Xw)0wtGpzB@{}aGAw7_)0nC)RN@-s`cpMDRI
z9^zjf18|c6@lsk?IF7z|utcXb6b>ooK)D{57TX95S2ZB!{p)W~nag&TEds05skQQ&
znE@L3mrjFtN$txXd8guiPs`=BKMl(8y59cDLHo*Q`JQoEnT#2{KVUq9YOKM0$6mcP
zx$hHOHNo~-bbO96T|6z-!3LV0XK6In?~rMr#Yz#yB2vA73C1aSjo!a7Ng?8Kx*D09
z@KNU5Kn#h+FvY8?^kO<8ytQO0zvbo(P6ix`{zD8n$=uyFp$ZdYr;)Lh$nR<Ei-U;i
z4H4JTpOY1;^XF__vlqFYYt5-@s`62CYVdirbhrI!&t9+ln|u47QhIx9NXX{i?s~7`
zymY+uYs+1yS&`Scp{Ex1161UqDPI`pE#oDtY}%iWnm5XVMiY=ld~pXRCsV?l54Y}a
z1Jo<lFl-F1oMb-|ytoZ!8>gU0*UF+o491nKomm96@}<$*QMzFcMaQ$-lYu`O6~MOZ
zh+vxE#X`|w6!g3k0W?V5jjwoB6)j)1vf>l3DMwUq)^;7zu-7=39wg4eF@39QZXY4u
zO~k{<#1tO0Kun{7NAn!`nnnX6N-;2oZXj@-1x_R)GuD2W317_pt}vbgfkKmkjryY-
z$l^gauB!Ey0zvIN&3t?n3bUY1A=A4S%+Q5dY7bZe5zfa>xA6@yBz%8P`|kBSg5K1@
zTs{$;*ME?DA&s#01!E3qmZCwWL2FB4q1m`M8d>^os4H}05yS(q8`wMhIZ`Ra*U`D{
z?^WhuoqoY=iJk`nS*4g(+QnCM$!M*j*noJ??eD+pCjh6<CO!~9g!K`bwFoDrbU04k
za#^ychPgtSP}XI|u^YHFQtC|iGb=aMCV$_2BZZ%z1@7AEa&&7qc^_DV!5^TqCR)gh
z_jaGXH#4T)w=E;>wB|Z4)rAd70e~Mn?Cv+CGyW`OQG9X+QQ(W6l|_!d?JfJxht4b=
zf9+Pkz`Q^qd3#=f86UbqHT!Vrh`Jsgt{GMD5p>PzorrB_(Eu8II-~6Bo9kvyGd0@O
zk=2`Jg$qW_OON=?0Veo{EK(pFd{v9cf9Y$U$i>R!HR<299!csp-0GXs<ij~1PwMr@
zljF|cEkf3lonYt<m}g4qF7z7e^Kk9oBN>|;j4&BX>Gmv(!R-4Glht^jR2YO+0nPvY
zNe9=G5jW#-?`UUlzt_B)Ec^Q|Pj9G1CpKF&;?bkTt&WH$iv8Y7rP^dA<I}_rtSE}$
zY%1f_UNDoHVovl@UG8!li&YmLM*`>y?736}0w*^DIZJ5=SV$P#)OGzlJ00|l^9*ts
z8OGsMN<J6UR^OW6_oyYCxKz@z8i9Z#vfpS@x9v&Pn7oaiYXbH>ef8RiPvFt{IgBIR
zHaBwqlRIY}qJDmeA>*;N7+`^ENJ-8&Qb?NVA<jV;t_iLKLU&u)+m~zKdV8gIU~&`w
z*nIkzW!X<4)ngsDI@x);C~Gj$IQf9lPs*oY?(r4ZhSc_XJ)$-NdwQym7=8ymePo`h
zZ)N~7KA*uOW1(z)&F8cG=3|YGkT_A%(G<e-v_8kT_*^rAu)SAC=a1yL3Pcrm;vV{W
zsXk9nV1Z6J^l@^nZAT>Km~n~8pv9xVj`qT(deO#RBNfQ-a&RV}-af@13%F~j4?jQL
z(Qw8qkVEkFtaqy=V>{UmhkvJroQhn{7mn#rD|*<D6rRE(gzo!FxUh?_maY$-ngiyp
z%NdzceQvuZ@Q|O+HX)tIOP6y*iRtKOx7LXXs#8+NgMI0aB8=n7TJ|~z1D7aHJN+Lb
z_8TWm9W*`ue$qg$kju>W@KAKoWw)){e#5BC=Z+;{+cW<V25qYP#9z-Uv@>5nX{i!3
z5S2_O`R3dr#%@#N+e3k^{>`0zIw%Iz5Gdj05YA}18<P2#>U~Uyp?;gDVa`D=(TK3k
zfd$Q1@z4}GgU7~ue%&=PYnADOhDkKRtgi!i_U#Vh5`b*bjhwZA>E!ZdN`dTnTz^gE
zf>?&zH#lRnt6vu7ll$6_*gX~*KgsVVy-F!-v?BugPFBG+N7Na+R!<w|TwK6z5&dZf
z|L%r*YOU(ln}Sk5Lnl!q-2~2wq4)uQVD3Y`4K9>tG&!rz(Y1RpmO{+;?%ZF*>vQJw
zTB^L!z$55{i@JMOhCFP!))^izXSq6t&uOY6Ud5r~VhAZ5L*`249q;LnjeL7iwJ9~7
z$5XlLi8Md|3h+xyw^jdaKLU8ww}u$XNe5~qJ+b3wVoA)Gw7;e0S5(lfQ0;&=fA9S?
zuu4GZgbSgd%v86w4gX~KP`FAH?1U@w>4FPcId_4{CknHb)or(OS+Uq#&@odoy2yE{
zbZ4aoZc<U_rqCMybL+N?9Li>=%PhcY6@N7Uu62sgZr=H1HZeq~*b*+B@QhCM-SSG{
z(;xUudXPU$QQ}Tt4GFI>z18EHXpFAb#nRbrC?>`Tx5?7z+Zsa%?vlEQSKmG4tJF^T
zhhoST#LY`5xbxCkqW0$1lkKh@b7-wam+t+2sC<Sr+NKkqLHXn8<{Q{Jch=srPNN;m
zy@!^mDV6UNm};cs)@8qIPw(nFI(MVap9NxY<%ssq_A+UIQqYx-E|~OJ{ULW!(#p&6
z)&qXP@M$q&v;A9OyIn^&+PgsMa?5(JO4sH{!Ru01b%vxzDI|2b>b_PuwwF)0HHF~H
zlsslwt;Og!(amJt&sS|J`Z=Xq$TuKFJm@ro<M<LMXme|0!)z>En{Q=6nZqHy$UhEQ
zgZ(a0yxg;v7*VXv;xWVP??NzwwP6qiRAgrUe$TJvtM(gA#~eJtpz29i@0>vnZh5yw
z7dS~QK#+^Y4MbbYETa90W{HrJ%+Zr8+gi-Brm&>uWComso)Qvplp|Mu%BOZ$Jq1|>
zhg*g!h-tW<c?EK#O~<9}$$G7aF5+219dEN07%c;SDS@RDO?P>^LzC<2&%g2uxbM`x
z7oKzM4iy99W^8V43k*WEl05If_@wCVMMbaY@yKPko|5|E4wxUvC1f(hSNljvlsj)r
z75Zd<LBO@uCK{3zs&a*qDtzBMsweWS?XPV9p@Rni{Mxs8d%infUN6*Hq5Cl?3YA8_
z_dKidIfK^EP(=nsz~Y3TWqE&Ez338=q9~>ogJpDRH2DmP<(~PE?XwOU)zbKKetK=(
z?bre@r^8*HCvua^xU}15@P4?tQMjKbBekuyDO)-oGu14$)z^tUN18!Z4Wg&H)oimK
zR}7S!PXvxM3&xLR8B&44tau4^J90lWH#vl@upS;IE647cQdjNI8<^I8S3Q<F^2dC*
z^l)IpS@;Wm&GS_`ftw1w5MQ{6r{}y~gm``8v#?X<^P<baOuP5I)-)6yg>+-36ge7M
z+Sz)(LJwBqmcFP_QVQgOx}MGfi`A@*q+jChRDGe#N<2>czpJ;;=~rLpiKd~R*W1;n
zW4<(h`>^f<J01A#o^xYkxL}n5+gSK)KafD|@xRV0T>s*cP3>tk?PfI!^Quc#x{lqR
z41Du5-jQGQw=6Yt6Xr2p`%#S-2HX2Kf*ZnjfgD^4iuFr_>vw@{4+A{+1@LB@*W<Rg
zcossDngeEBL=8oKQfM>nk9oSm{<pEZe9KE++Ou5zEYe|w>~*L+=qJ|~=$@{oh?nS9
zF~2K{`6*)NxW(335E-9#+>V~OpEg@0bfH`!cufmoUEJ*K`+^s6J1QSr9_FRq(HaRY
z&xa}as*F#!YW&exk+pp;*cy@a+>WWN-$)sU$w&XQT+{a}Nwdp`=<nyx$PfB#o+SAb
zN8eo)X~cQ(o8RQW6<J=`8?fIqo%SrWu4t10r`YHbu~9jAU--!nF-1UG%@+yygUMQa
zcG;n#F`0=&TF7%Oe4oPv(q*0R1wvbGv%sMwhhLEhf4-c2Lr#|$)Zg0m9#XgyvD>Sf
z?bbOoJfux+bl?*mM^W`C2;G>3c<Y)?o=Z9gg;H7=?}-}6Gx=O#0lL7O{R~|BRS=aq
zU+4K|>}4Smd~v+pO`#j@*5|O~_jw1rcY?2vMtvNVCmdQcCD8HVpeuT@?O=V<;UM|O
zo<F0nkd4N-Je*Ib>eY?3puU53*Ip|2fUh7`OjV}24avDCpbQmvWviHsDq>sQ&u&{Y
zH5p`rkvc%GQZ2qjJ{z`#e|xgpD&PkXtV`>?#ItiOANXG^fXC+1a_5T2IF_`ik_?=4
zyEFDThXn%_HNUoA{7Uwz+PTyjLTcdO>h}~P&$;qs4JQTN8V&w_w4UGX;0WX{G}CM5
zCqMc)<pc5x%&pP3w6U4V5%X4cJ$1mr!I=_l3dDtbxHKHhTOAK-)bB<p*vE{syW;Qm
z6jfe2HI4U#@RufVT$uP}E9j5=6c#oHu&yhWC^1uoxAGhj6JHn_Fhf$9nakX%7(+#K
zvRzt%$u`Bh2~NDyoRqyw6r+%vFLtE1#wy3yOn*2HY*LPYCoj)Mm)Ty9tqPi6m?I#Z
z&7|S8Sy@>TX4B+5&&*EAzI**AR@v0TL@pBHx)v39XRU7N!crj0Zm6zewBDZB#@P7l
zq>ntscVPpwd%=;cT#zyDup!Kh@48^_s*>fyglhEP(VwHgJ##wTLN8v&W*brNpPM^z
zMn+C!P~wK%@hw+}(*sgu(b!MQzfulj5BW3`<Hn~_k_l|?@fh`cC<;_0LjcGPNk#YZ
z6aXZ^4{8PmhN3a`dZs@%+^vnV8Y)gDCwvYhf<7KWbKZ*tt-Fj1*^E?c%s09fV!a^S
z&n2paBTFC}r|oJ>03*ZDq#%Z<ei}tw&C`*d;PK*A8)fx<J}sRb-muthgF5=`rkZ$e
zLVwmC=VT!@(p;NG7uJ>Z2bn&c0e#E&#Ji$7;|W^@D7m2_6RyO~4wkF}>ygJa+BRXd
z!C#e?l|{AJQmvmQI~y599`bW@ouFN5l7$_D)JK<!!nv>bvZCwIjjyFR>#9?KALL*H
zUBH^Bwwe9Ne^y(Tm>zCLQc_5$5~eo&kIief(zP^jM}2pbs|~>wnm~`dFwS?&pi`4_
zPdbJ$X#2q-8OF}=T?H|a)rO?W!t}40v$Jh8;~1V2b3F7RU}_LpXhk^{u}O%vQIdVa
zYqnPNIcQ9|GVYLreS(=^k@BO=-i2;<mKhd8Gw1HY^RWs>hViLLO(n?~7$6ArG_@47
zEo6<>ia5B3m`e0640Z3G5{YodNyDTi(@BV><gZtg48+gDz>$+R-rJPxI2I|_<UKGI
z*KEWJ_^~W7r4E*9v=6KJ7W>{)1er4~gVq#QV(NJP;hFJ48C;>auF>Rna}bCL)1PY@
ze4@$<khpd5JW_<2`g)1Ta~s8N`gKvf>vL)rzxb;`tJ-d7k%pAgv*)TKf@Zjz9j3^H
zwM%7!dhCGqf_8D@yadQ3I(}sW!Z@~K;c2YE`EApLAg<a%$<!wK2fq;;OfunzFePdn
zS<~F<ks`(tZ|d#achoR#OEsb7=8{mf;o*pa5^iZ+SzoQx@|Gip6rLvp`&Il~0*Ox0
z&YmbDf_#*G_64_tZfFpn3=Vg}obMw!#C}I35_u%XuS1Z(G`J!cl7{;&!(YSq$u^Q3
zK6k${!nI>&M#ka?KL^|<#^T!ExrSE6*4ieW%~M;pe3_oFt9GBLioeoMpiX&&!r+n_
zg)g^LoLPY+;AsE6JEy0bIOa{c@pvZg^^Hy?8Q(KxgKFe-rTt+oGaU$=g_b?6fz0bo
z&b#y2ym@Sv+RlrZTz1krV<+B_b%s7mQ&wLZcncJs#jDB7$p#Ii`nPxfQUK5=?wBR<
z;XGAkK87?EM`8+ezK{3Aq;_amL&SV!9F@Vt;pw>i^(k~L{px{fEbQ)P6TkZ$)XLGs
zV(UbY_4##3(Sh#JPab0R>qb-&x+UN#`e(gdxu`V0f_GU&N!#Ri<)yia;9*&If@2&0
zcY1vXdmc|PHi_QfhrOL!RErylBN4G3{sQ|03S#OdIw98sH6%CdB_G8KGIm++MWMUK
z&Y3+SOC#9+PZlF@!l{D~1)R_Ksy>Atr)yzW1{?2MjZhy{OkUMf#7YH`w?w(N-?1MD
zNIWE7lF6qRoH&jVG}$=3M)(c@SWv?Y&95$g@1oGHwz^Vz#T5?N#E^8-J1w0F4SA!g
zC=?}1zt72*)?p62%}ZrI8(X|DFY%^LC1dxyx=A{I^Z5R~UuJ;uc@eh#j$C8}I!vhg
z8G*+`H!V-lQlmukPH9z>Ij>y2HykoqdWrLnmrK6VtKN*KwI%0PHR>myofzU#ueo|b
zlAzQ@#N)xCRBIAT5%V&OMfzDI_q{J_;P=^<%y<Isi-Lh^%N`pub#6;(Q&ZD@*8`9F
zgP_*g+1dSAH8?1+qF#rv_xWa|Uug1y!Yt<e{HEq~?mBwE76%(*UFg)TyCg0jcun-J
zuXcy|?b)fMm=TTSK!>kS3@P0F0YYRD?IV=O7n3FKAgsr3gcUo0tIwN24vdu*Chv|^
zjY}vnX1)Iv9JWb}eNc7)Z*w-gt>FOO(Bk@^X$Z`RXbF^BEoanV^zKSTxu1dCeS&W<
zfuU1s^L`#3@o3~03yiW+vbh?YO|SnJE31ttM8euuuAgRF;VbcYBJB0G#bPEf)1p3q
zTp;%h7yLd(Dfi%VwC+e?pa%ZXKk9bHR2oRZ#?D@UUg(c2^i>wSqs93=G+<Scv^{VH
zM$DNcb<&yqmN^s0DTL|PY}G@5D&^h24a87vcE5Wjf7DyA>OhMUCK@NlQjg)3M8ml3
z_jlpRu~t)SC5Iv<B*tMm{rXH#(xzx4og;RqT!^XxEt?GzOIa2*GU-RJq9<v-%zwTI
zbS$oi?n%vlIWKyFV!t@=&CS~N70KeG&yM{-4Zhek1shna)h6qDcwMHTeMZYQL+bN&
zuz{3ZGaE47?$03Pww$`}?k;o4gq0qwXYn1q7f>9_yVjJxsC4Gmqy13mdsRQug2|H!
zR@hCVJkI|(FW3z0(UMg$#*rm2e0Ev0x4r!!)X(hKkYiuIgx{n>?JWcQd@0x+VDl{;
zO1*m8*zZK}Gz$uT-Y_U)Sp!e98^4w(7CG6M>{P4F7OL3!O&@1wW=0{2u1a5uLB^-9
zr6rByedF*CEP(iTo<?z@`2hlfKg@P@KCd-j(|Co;awurDk5gv0rX^)&Ct<NU(m#!*
z;S(vw5X0A}w)2O!njJHYsoxQvHd{<{!*A8zS6^eESP!IR-fne^bcduSMW`8Too9aC
zt@v&bwpz3PI(4oV7$^wl1p$|dRGDRj;%L!{hTMr{te2tGHur9^(51JMsbR^T5@ksr
z-WJ%9LbYe7DV-nsd+-GY;^<0~<oa<)#mr4i@|9?%YVV(x{PmiiI?n_zI*;}jr!Hr?
zU?-s{TkV32>zBF1nef*86C4gUw&MlYujnH+MF(rBrUeJef4F9QrCi4=l-2NSm$Wc-
z=hlobuCpjghlx7sgU7BT?@JU;QM~vpkEr!cnyemO;Kj0!r?5xtZxA%Svi%!f2zk!I
zWXa54!CaTZ6dIArfeTkcB#sgDV9J}IW;=z-2acls0hLwt=i~ybi{$)M-Im8VuejKI
z9^mIFxS{O^4}+gzg;!1X-s4ZXoYzc$0DuV}t5Xe|UkSP_o;x?GPYv@OBMbZ^hieNJ
zl%DgsfA=6HdO~H=`YI6zQ&solf|mFFupJ*mYnl=H;aOdS6myFmm%3z>+LLG~sEL2U
z-Zg7BiC9Z;&XCQrm2+%zR`Jm6dp4e}D}x}`<@YPy#$S$sw?Sjzy6qWC*9gY-$f1(S
zL8)40`VX9c@Ap$}xAqTar|BN7#+y<H7}I!`3lk6GrQpq;m!<Y|dPDE89Gocsb(n|?
zR7qrSRn_S~&rhg9!A}p@LcTY;h?lU#Wl3F?jnjD^3XbLR82@c63`<ffnoj+z_vW)x
z@fd*;{J&LuX*%?;{9IC2mO8rL6iDlIuAVdsPR(-Iv<V4N?Zk-vD1q0W$=U1#>c6YA
zkcwzlVok8$eF;vQ`1q(!^5_y1a7VKUWO{5WvaC3nrN<|qta)r>%BS%V(3LiVW#L+^
z_5*Wd`_^N@Y-5Klf-9@)e)TDwr7GLUig1$lULmhVH015s<YrSkM&nxMLWM%=W1~p!
z)0T$Zb++77Hg+=yo9)Jm4^Lbp)Fw>JOYLqEN9s3Yd1Nkr`vM`~QfW-c<saBrO4lSa
z+fNz|px>-^Jy<(75S<K1$veGa`HxRG6P@8DwIL-ssf@<3O!<e^TSjGxl)ulcQBLda
zo+s@E^%0-s%X7CH?<%Q0ym_nh`RFVW&`&S`fU)&LshM)?`4^D2u#Io?yf`N2#+8g|
z8sDk-)Ap!wR%?FuC|dWxuFcQq+;SN-Zpo2aKm1czPaup~K)C3WAM7WxeEY>#3#OPY
zK_|RARS@k;fcP(z#pi191q`%bXj)uYc)<#Jgbi-kGRDR`-LeD?qSA2HTSn)Hmb|*H
zD@QYg67^T^zn>>y;xP}7jlew?cR>%yothm<`q%eoiI6?(m&fsbms8bg$BsXA5>I?J
z@gezK)k07X^e%FDW51^;^-umAx?%#ORhHH&4~+4-i!$__Yz-?-;*Pv_5}j;{LF~M>
z$F{0}D8KsnK8qJBt5AVZQ5F>k$2dFrK=Nvkr>&#}q))lj;#;JT$vo|tC>Mp_&g<JQ
zfCQ`BV^U7qO466<a4!4R#<tsbqN*?f;PpTJwDf(|_d=v51HNPL9bf15f~&gf;MMSS
z@cC+xwivxILmc9z1J34<3GU>%%+9BiQ2TlK7Z6G$8P*+0O!Vr6qS^NP^>0i1#;OBd
zx6-safc!JJkYGe*ApwEVT|6#Rv>oPZS_a>JOjtg$_D{x^TrUabJQysRE<Vea{|Tzt
zxzgg=$~`$%vl-R6_RAJr_f<BVq6O&>;R_=I1Oh$p=9_deY@fYsS4ITfj_=M>Z8?fM
zrA3zB5&45ixss`;7?59{f%@d}Q><yfNuyE}0ovfg*MFF{_U%=6C*B<&g>KoNXsGI$
z!uuC%R`U9)FQpC#&@`KDum$cff%T23FVU?a#hf6i?S8qt%1v@<qdoMq5;DSHv-vB)
z!mm9%fJpaPpXXU5;(qW?#L#DUc5YHOo4x+A&PV4BH3_uXk4O`Y+J^r!#%DfafR!UG
zz+u5T<W=DmN39nx-wT5#Ieq7;r1Z)5=-U<A3+3~Y%9RokzUM~#<T$=<K-=vcF{<WY
zb{QV-kom8;uC%y>T%x~ZSLw?%J^@Dw=%Jbd(pZS}N5k0(`tY|02F=J*qBR@S`?2i%
z!k)k2PKL8U8DkuYdTcRI&X0k%B}qW62`yE`?^e(*{Cmm&dUg3!$!HD&jmW$Q@JP$c
z%eP|8nYx2+elsB&%l%g)8+Gi9JP<YgeX*fV9nHjR+!XE?NcX~N)>xYjAteTs^X5NB
z`3uX%Fe--vvT;RnZcUjCU1f3q)1MZ0Ggd7#+#M1RYV<;0G77B2BI#IB1dHi2{D0`)
zALd^#tH>j|*bDrr<qG4gQ7mx}GMBa7R2st@A_hK9`bR~9YB!nM^*>e8Rx-9*<H!pB
zFBU+-&|WGndRcigf$$$M4+&AxmxfDSP6o|QC6G_?cXux-fj`OFk~m=gN7oAiB_x<;
z1$8oP8N#`Byu7tfq=YN~Z|fh_PNmBdOHqprq)a3Sf%^Z$=l|gd{DP59?eY`pzu5@<
z0r<~c06M}y0q;MF_3aC*jt-K?R7CjqJLE+mfM2&!TKqx*qhq!MB2-^2ef1U3;@{Gj
z>TiGiyFh?HpFX`jtN%^^-~ImoQ}NFyzyz%X^~(woJk1ZL8QKI`O9P_S^niM*<z>Yx
z^dFPCfWX(knEuecI92lRCW<NR=l<7!vPn-)$Guwh1f0i~58ni%iM%KntnT|RsPy=k
zEwD$1hhGi`_|$W|93WeOiz~>|Z2Wr$5dpz_z>6N>?0Yx4TnfsvoR(I_Z^j-LG;NN|
zm&seId+E2b9sA^X+i}|}X6N|j;(V-j?+mY&zTHzs3E$-kcL@nQn|z1#hgebslLkZQ
zT7{ZvaBLV$MtZZVOt+n6p?k(8N4Mx|XJFmib3uA)e4E=1@7FOaJGWuF^Ioz)g1oAj
zbv%S+CW`1MDQBUUfHAeKGIM#cgeq&D#5*uTc81YADtv(803i;b@pR((sQJ=)P3N~~
zMn<~PVs&6)S>_7`F28YKU&_QJz@3CPAZ&CVl3sy{O&PFB)S=mar<T((Nk6jWzBU|u
z6m72nO{SUu+<sSW(}P<XF{=Ba<p`bp?`}3qV)S04WA<qn?0xJJqg7%{UT38hwGJHv
z4WJxCQS@WCUQ-MO2>_`!YejC7@!eDx5iuCkVHk<&;{h)a>8NA1)A~4O1{t5?e89&R
zwp(+DE{}ohA2khS8y65bW8zT)4XqTu_=66TRP>b#;^t|SIe!YmqoVN9ai}A^*z;Or
z3G+|(D$8U(i&3!FamQvNWW)Y591LOtbR;Edd*oT{&Vf1YU)Is>=w5EXbbG4Jnay)I
zrk|?((XsDn5HY+IG8v*4b6Iu1Ngg10#5;AhH)idgJ?Uby!;2o1$?p}17AxhPnA>O{
zHk4rLWVnn0Vy7ctNM~xPGN0ZFOouHQE$Z%u^>Os*mQw~a2?@Z+hRSU7wwo|WNC*h`
zOqfQ(McQcinYGHaM12qcp}n}neUGYa{#f|i%`NqnD$10#Nyfww6Iu)~%SG^wnc=X$
zMyDo9{vq)znTBw5aHN0>C}Z@+$|?!9Kt-7<wR)7Vcj2`GDaj;a-}iKS`jNL^tW{ti
zz61IQWmo|o!d%Nu!Q|Dv4rdO?cr0U3G+%@pvU}M|;;=T>&-YPbrviiVJsWQr7h7ys
zKX^+&o(P?*fETTK#&5PKJb61V=gPD>lW1fFvzeV^bepaAm2`0B%^iIT$D^){hD;b6
z<CPERMo9)$cZW9a<Q_Z<OBv~eWp}uYH!H~S?zM_(9PY>9Y+mw78G;PlS_hoZwOKlN
zQ{U>!Q~P#!J>N($KYxm1feZ~|&o0E=yDX2JCT8Ya(!4$ry%dRY*~VrCNKo%Rmhs3_
zgs*?=#GD{0YE?up!|}kGETlo07@o;SKri{vrPBLnSjEX57Y5%8G(2l&IH^+Fr6~WR
z+R%NEQngvVMezS%<qQM(_`03W?yliLOI%N_`=+dMDw7vaVO*S$H_~m5GuLs0_=irz
zn0s7ZzrBmB5jAC(041T%&X-s2e&fGzausD8Dx%Y{n}j?&2l+o)QL<P*we4q2?Ij&g
z7Qf)lQH1x_U+Yq?OV|@W_A(N79z~_~_b|uHhB_t8L8cfxUi1lBQ2DP!Ri9b8**^cm
zln<8v%)qm-rxAD}Ec8~cfzJ#3U~mw>lgq-Dvj~95IHwfw>d$39+pDt|CiX=d0bMLi
z+&P|yR&;vM@%`xpXXkz4k<w4_If}}Ih7oKE9XF{9BN8vDkY>nlZIt1pmwjXKUwMD!
zZu7X0b6&)e?}TeG8`<(HPiY!Y`+v~Ul>017p=Y_6!ueX><1a>rY2aFtj6q$5Ro>v`
z&00>?t!}jHbQAr!BG;>Duldq!>3Y=gd#cn^OUVl>JiMabEUXx`&u5Pu?EO8YM0wgj
zAMR(7e?}7xx|&7-@U_7$MF25|f6Z{tV|(SW9-RvlzCDZY#UN4h{c(-|rbSq{qn0F|
zI((Zkbn>vl54U?<=sj5b)41&5hb7AvPT6Tc4|6B4y{5sl$;j@!lwo!ri2rGZ+%ezq
zHg<T~O_tm>NFGs}JEJFM=s+%B)`Y#=Olu+bxf6V#bK0|DGuIO-YsyaW>c{=;jG7@Q
zMXvDMy7jlwGyuq}!2dh0F)iaBiD&O~xffx|&gs@<nnZ8Q_1{|wc_KrmHixgDYS9Rf
z703NKw`b?^7@s`0cW_)uw?>R)6LU2>h5Rg_)o6`qHa-2wXGBd5iG9`1^``S3Zd>oe
zl_+!ITj6gZ(U4{yqUGV}f%v!fHIMZbjm+UqO5J`{yph(Yy<(UaKkkcL(Kg1}atSy?
z0biEQ<Nn*e3Y^pc(nlkurR}S8)wP*N*ZNJ^@unDI@IRP_%h?N;B^fN~_q<w?UJ>j)
zXRnxmovum$f_r%o;~JhnNk}5`In2JI9<V+cPirSCy1&q@6H0C9o#K<tk3gFH<3>ox
z<@|$bY=F(9Ur;2Wih)^DA)g==X5#eKOp$P~NVV)f8cfgyS;q0bOG&vF{@UIITsWe=
z-njWZor|RP4|@JjvX~{DezVluE3WHwsJjuo^kGwC4S#6o{+sW%`)M@g=GlcM)J{=N
z=(Q$3yl1J`Uj5NSFhT(<OC*ji>31u+EQgzY7>Z`&-=a%2HG9(+z`aa_i8`>pLX=t9
zk#@{>+dylsgzMjTvQl;lP$RqEcQMuOP-NMOQAP-S_Gd#YLse!g;C}vr)^cfwMZLBB
z&SRun`bw`WXUv=3<_YD8Thxu)YFSf6YxBG;z0_fk1$263sO-$?AbRI$6gs$r5Yyh6
z8puT_Co_u8b5AW0^Ymxp%i(Ab^4=+^j#-iLTZrv+eQk33J%(mM*_N5Iqa}`)Hv7_|
z>n58W-u7zBe$v|GLW+w!eP44fdmt&&yKFqKkJiK;p|P?;LcNs#08D1|Adt#jbs4dq
z?czoodX5?_n2@;(AD0`W;h6L=T?5EGRa@ujWt!CR&SKU4Sc09ccJKS_WKz-^UCU~>
z=>-S;HJO>&SmP$GY{f@tN$Yaq@v*HyoOwgM;`ydU2|rh&_g-wvCq*meqMN~nqp6>C
zA9;$WF6!{vn98p7c3vRk;ArB1qmS}V1L%un%@Y0bp;BZXBVe{Rbox2a{~smKlm%l<
zUSlYZEGRL7+M~&2E>k(Ij#Wsj=$<Wd_h@qv+tdUl9}_ZGbA997U^XJ2ZaGw6(0Ow`
zmslNGlu@rXF!p1vzcAGNd{(U;m+kPoJYnCI^GYaA)>!!MZ9f?HHd}MNq4sol_gl^8
zI0{vMuwWgk1YRf1EO@~L-t42}#ZjTGs#;cDoFZ+v--b29=3{#`{Dt|woxk<PK#`18
zo<rN(LbGeO-ebbV-9zw_Up8au&&@of_-P`yY|BwaO?cm;t}F$`>~?nu!gtkyA!nMK
zN@pGEyRou`cD8{x(fk5#S3bL|lUXd!kNcuI7w1<=wgyLI_KPi9mM|1&8d!5PJQA$x
z3dgokTY3Nf2kvx}>JQ;Q!V&K!MFBhyVNw8|I0Vgrn1*`nOHqx&@(rK3&0>A;$-?MF
zpSer;4_DeQIU58Te|$68ZMh{CidPD^VtLfmS4gcJg<vqwlh|mBhe8_G!ScS}w8pnC
zsDRt)h+XwSxwXK9AQ8x(n&qic9-it26E*4#Ckt6NIbFM2?Q6Z?nnMR?-NbHM`m?!Q
zXpRNZ^Iu=4;@vr0S;s=IcuMVqa~36j7P8FQFKjIj=p^F%-!o=Ka|Y|uO9@i^wvSLt
zb5oIWp}{lHDuoGBu*eAme?NE~4)MaehjbCnD386b_wDo@cbNlsw}(V1u>^B0zNg(B
z%-g?>r_%i(qrKO5eny|f!~A^J9_QJ*x0u?%r~_BRtPrO)x<rn?+RCyrAyEd^n2#rM
zHn7%r5q^e<_~=r`pDub9DqCA_Y`l9BWj1X(qy$ao6xG(IW?U}pb93wXucfRRaeV|>
z_+4bCu@s@HG5yi494wfAh{)~K^;Wy?MO{Kz(G4!QGhJ0x1twg~d&QT$Styh3L}B5R
z#x}YsgesTl{8&~KD9L`=E*_{f_o3?MI3Gw4mX(P+A1XU*Wy&+3`eP1wd~~Hw8Yhbj
zdI2xmuA&|Fpqr}$yL2zO6{Ap(*LnI!J`{xZT<Fg25#cQ_J@^Dqj0|Q)4Qr6O&Z}tC
zo6)w4^|ESE{uR!TO$|81ml!zlZAnkbCyPDhH7ToY4GjLI=iE{45QWb(LH|$*R=}IS
z2r@k8{@jMy>`^#js~N@=D2-qSIq+Nm3w}_W&tBxVI}z0%cPmWp3n;6_tG$pZory$t
znpUL7YW&oQu^kXuy?c=!<BJ4yt|2dI#)I@0;+Bpt7IJ4ldBNPb(&-{qm<x+c(Cpc4
zkYdsNEk5$xiAe}9B!p<Vw*`=Gebe}?z~{@ZFfsa>U}TbKG*ZXmC=?OH+5A5GY`u@9
znM~J7H$*aqjBPM@AO*K@;56^J0)%SNzR%cUKNCQEc*_FS5GiZT_FN$4nDfEiA2v%2
zi*6M(dI9Gai?Ls{L?**ctoFzil!xM@>kGGN2y|msXH&__D|ti>vJVnLUJLQvI68g{
znMNP47dG+<l5x$=(d_7?y$%X|NxZ+w``5$6exd|)R;bOvewK)Egwz`={Yup-x{>Q!
z4Y=xEXxUYe5I}|i-~%FDW&)vpJpn8HiBp+qD0Fz0^M0Uf-&bKNK<f_tMZ8*pmWL&E
zYViTe74CZX%UlC&=A2p-B4^Mm59S&D%H8-bc5)n3-7ujPR~98xEl=dwn78j-Hiw-P
zFzumUyjqO&N!)YitvI)VV#M42Pae7RIye^V&Ogw@(HoK}PnWB%5d<t$)P7fzw6fCO
z&%X<uqMXAV=GSTuo~4`3GQGyNV-nTU_My_b?v85Gz$)01@bhvTYR~=s-ZT{{uYEUc
zV!ff@9N7rlPEE-3nR?o5PF>#Gz0(J$C{xz_hG36csQviY7ZO0#@k*P8bm@UrhAZER
zE*s!8!~bFdUZPaR@EI+O^F1xiPu7c18=8EY94CcfK^NuO3Xj8$czCNGdlO#qchH1X
z;WHBrf9f51f4eG@q*kWuosHFaAZgz<*!RFdFOu}t_HkyAb+Rh)s<*40d{eo;-oQzR
z-acEi&vwI{yq5!a*=l_RMy$WvyIBw^zY<XKmY1;w9fNFoVU$4IE$42fGF|Zd`mMup
zb%psE-Qjp|P;gPp&!06_b#$%3vUzg3X*Y3u>N)+Mey_Ov9=I;!;mN7#$f&F=c5$ek
z^}MTtl!1=refntY)vo<Y$F6J_=}z!Iox5D?g6qj|Mi~gMZnM{u1YhayZ=PqI9n%43
zydeRPyK90yL#?E2&z>OWHAriyYU2%%ox|^RP2bOM+*h#7M8)WErDwITkeq`llvgh8
z{GMSgD@@#FpzI;;=hMSNSmKmDkt3t+VMX^~#dt~;k!Dt_ue-aBdhpa}SAA+@29uDp
zE`$FDi6a+~ouo3m)+=~C3r{Yl5^i`(0y$eBkMfTtZ6yb0v3Ue)JU(7u2{S66xS|X&
znXE`bmd%Y`f)4GeQjZR04g=Q~XOoBOL+u?p``x|2bG4!Mj6CZzeL=lwd`EviirD*z
zEc|2|#z}vWP{_hM(DXR6NXgHmFMZ|rj7Y3iLr*G{jOjahcQaIbr`y^RX}&k{4%Edx
z?LuPn8;vtBFSRq&b~_nInuoq*mM+;{JSzKnEz4w)Za?DW+V@v3s`J2nE_KJ&AUy+a
za`j!uD`5=xTIRP5C1W;^_k8XzEU$)nzZh8Cl?LdQnl1by%xj)%N!9q(S!!yiULxgM
zQ4UA@<51>5Yj$vI$P#Ktf<HSP(N;#D5wE&~?tDDT$n?1Z@xgncfun+XC_<5Wt`X&%
zmX-oQTW(t6RSTXq{Z33Eh2%{W30Zq;ibBcj(x0+^OEura>bJc7_y%Y^x^JJO^8Lp@
zrkBcOh`#C&p0gomkd{ulkM{Tc4erDQC)KWo#NdCtF>=_8T($UYuPB@Usj)=WpN3Y*
zYJ^|D8D?Slku0^M++njNIF_h)Oemk8#&rQLOQvec*mRqCYr2^HQYBYOFF}i!JNKxD
zRw25x<cMpd-V%`!?U~Powzh2P>&Rn1fu)G`w35%tOfzh_aU2oxp=m+eiNQ&+beIP?
zbf>SW7<sXri#mNG{DjO$SIc71*;8>k<H@HwdUQ6SwXl$53X`?8**@4lwpdjlZ*vlJ
z6^lN)i7qSUu>;Ow+3MJp=%j<Q&ACmc{JVYBilSsHG7P|Y?H*KcvyX8KFB@?N2=daH
zuaW$vt!~#1gB@78ZC-fJzAL4kBNdZu<(M*#r3s5Vgi=xou_uzP*4LFbE?~ZFNR25{
z;@@QfOZN$Lu|2(Q?WTF`Md0qk>th5<(%5-9&VxB)YyVo9b%Nrh>Re;@57|oqQ`BVF
zSR|y)mv4J%HFx=dl-IY#dAc5IrK1OOyqCjcaTiGN-TO;0OI06p^4Zs8J7A$c0|zas
zcZ%aNFnnB0&{k!Jr!v_<pxJM^K&RL0&lV3gKRwJ3?tBzYuU)Do*tb}&6S_&~&H@e_
zVs7(M2Cg(7au_aUtY!*uOie3-tGz8gx^n-@b4DyRmSKU{u`yRBI0*INDY{%7m^sSi
zn?rMus)&(-y=sC(ja4tEf<qGvnTS6eSo^BE8WV-upY~JmP0AKAw|**MqM?xF4Odfy
z&ZX#UJY5c6#*{&ia5xvjGqoQ28VTwq(`baNw?~3Td;Ig0uu_g0tQ&l{Kkk{ecYeu2
zSuKGTl?l_Bp7&^ctGs&W$dGY=w!u^^<CK@5$*ZNsDrM+P_S>>0sHgT&Dq{Rwr3h{Q
zHLHN4d&U(1Zu>G_te+KVS&-h@&E_#tKhezPJmV#rhkb)J9dW!NW-|EUd|i33Z@@m;
z2Uo2On56oP_;P=1v6VLJ(W`?NuDq`U9cT~$t}lj41}{apjiVV9w)_m>aq+xzkH7qi
zsTirDh<gOCptn_n?RAKUQNADyjSc2lyF7l6j>V}iJxPrna`ES4B9ZzWY5itpw~`$G
zbyXKNOTJ|}-N$sw+$BfkHlcr0^N?HypR5PwoJ&$n`f+ybF_s`p=+>}xJCYN#zOr_W
zj&?zo6)oo;4l&n*Bc+5Y<NA9fsaky&UwkfyGL1PeSMS@rA_c!$cT8|Ffu6QUXHwsQ
z`)MN~9yX_)Hr#O-TXYyIsYv}hG-aY?o317KjzkE0GTnTW)a80bgk#b3%bY<z<IdO|
z{Mr=er2*@y$Az2Nqc9u9^TV!OYUFb2sa@f_%c(dO$&-4&{S#~MKF6Mdv=)uIeuvOo
z)+5Ul#fo`0I;NM31m6qyI#Z2#V5QGx8%r))R6Nqr2cy9Atr*1We2cTYi^?co{x8N9
zX?VP~oUH70?qo-$On-X)XMd6HX~R~}`LCN}4M%BPLLBfHGnJjGflT}U$?3}KK~2e*
z@+Li%92pj-4tWiSM)6f$ZNJvrl<vjRBvJZERhE<`UVcnc!|C*%!+kSRdV(nGvWhLx
zFHOCe)W`@bRC8yvmYCKtpqHaA;#b|pH*Aj5M&zlP!f|xxFrsyc$fIP1F8zzzB{A$A
zdbD*c;&Al!>&A)549Tx;?I|tSn%RaUimi>hz)8;v(H?U~H^+^|2jugxsJ;%cs_0HI
zF)&uNSv-y=;f)h8_LcvA<H{svUH%%TnrCa%Uv3maRzq%@?e6U(7t!H9{vOsjSaI>n
zSVvm!Nqj+@BcDENl?G2o0bRVs145>P&EHnFR#a!}j*qpRPr4~B0&2kX?a2Ku1-sV(
z(ki!?_@~A+#(0N`=qt2_ufe9<?V@J8ByTZbbehlgo<=sPnH*?H!HgvnE-M|QSx6ri
z6iiNFc&T|ERduatIP0)}lf+qaRC9sqyF8jJxD6?%2?ANU_gwNsB8@NA`PAlYFYhm1
zFm20J)fW12Xe4K%n@U2ejb~BhNXLdsbi51s0Tq>4etV;LA8usnWT5B1b2$~`fd=Sr
zolZF%y};{qY=`a!B@+$XyRZ3^?=ZpalmWfAAha@)L#Sg+$}B-a-R=8Njh7HqnRc({
zR#!RcPpiJItTIz9yD8YtjrTm^46`-X=#eeW2b$JiK@G8+@d|YOW);_m^JTAC*IgVO
zIA;ZY)Rjx*=Jhi;{X@Vtb}xiT9c|)x`wH>iwIMv*K*U2u-Q9oS2G5n$DbCPrm@;`g
z878Y_YAIcikj9?Y!f3tvaIBScVpi~t=X657*C@V*qv(ysJSTBc4uy|}Ewj(@-Pw|O
zEUU;eVzZ~ydHVKcs#IY#+Bs1ptp|2FTK28cT4uSW3e!F&7lO6UP5f-DxZO(21ek#t
zYofD_IA`=E$C%37P0@*U-L0Cv=z3sErku>e^m&cMpFZGe#p{}2cQ#fZOFDe*e7bof
z1mYvp7l;%4ReJdozFgrP%MZFrn1H>=U2E_6l7qUEl@liB(m$KA0Mc$F=Y^8^YU0eN
zQxPj=@<B!{VOnESI@>EoAJW4&o7l}AFQ<y7g~_66VFc$=>)oB(Sa>_L_r>GbubkSO
z_KWBl)sA9W1*5fa=%rsQecxDaLI%IaiH=VvX9?x}G|W~OI$!~%@#)U+Mfl3BFPv{W
zvM+fPgK-@ysYsyMJ>&K(yZ=4yNNbwv#`e+n;0VPDhM7Aya|v@<nxz0j%ds|&mHf32
z@$&2Fp|)ZJkyYB)G@Xk+`#Ih}1m;9&HnseQ`9%Tf6AAcj!una^oYwAFecqk+(<c-?
zh$JW1f0VzWpmT6DQPZoL2jA?-U3kpzMPwL-=eFwMky7aVJ^}QfT8_~|aAiy6z;#|Y
zBl_9x`1Oj87W3vciSvmELh_n=(+-(E0mNZ@S0!An&YY4z|B;JPg5!U>O?o19uglbM
zvt&P}C-pfJRJ)9szgHc&>&?$fngM4k@tCJHn392p=)yvvFmQYR0Tn*$U}POCN!Hg#
z0S<e8IXX4%>&cs+AXbJ*WB11zN$JtDRdVXi6?oqo2A#j2C981-6Eq^evZcaiDJPYy
zy#-8FJaO};sn6kJe!ErebGxeO0pnV{y`ps$4+>y~25)=nMkm~2I=5J7*4U`J>{ho~
ziP4l#JZ@*e#pfnCBOF-SpQPum>Sy2`Lv}6kcfk?SnTNDlrNsAnhw!whtG1!UV@Bnl
z<?Pr3ufq7V*cWtF3xXQ#T(4$q`<Pk{%=DfLgZNUxOPv(JRZCe<9-h+tHbr;pz#P+&
zaQVOAvxXl-6$yF+paZKi3BFp(i;{;wb5p%^t`dQXx~-YM%OfKr)8K`;3_3iuz#8jS
z%G!$d11OiJnB<pKZB;}v<j>JVx(~{}+}X!PWoX6-0H*%3$c$8`yseAAAQw@uhI^Ll
zDM!(Q=Db!NNgNer6&IbwH3m+rGO$1R2c2>IiBPgmagtQBoPs+`;|X_R{)U9rqpRus
z-_-u=^<|fRE~gbN_mJC-W*-uytV$L26uLBAZoRvdLYoZX&&I2#uw_q=kFH#XuJYZE
zB!Yv<dJa~w?7b$6ff@f$H+#i+hjs~cClkjubDPD7hZM|Eftsy4uAqkOK}srYf^`dN
ze_HeM%R$s$c5WzzjmZy&SgLp_Q=6DXa1jM$nCmg{TbFLPokt>>b|xnaT84f*v5=5=
zECG+<erx5uTbuLE*$_iA5S5ASx7Pg6(@`*=y&8*bNDEV{^oOZdMH??uH?%a?;juN)
zDcOxmTsb?>x{6&v1Iw2aTU%&BC{S0n-648Kr>%6k>Fmdg=Xe5s*~Xh4EhmaT7L7$;
z)oz>#>EE3_7#H0<v&=LE^HUufG;y^`r05N!ri(i`U3O(&C_ELm%|tFQ)F`;W1J^T%
z7o*hqcw2UR;~-&@e&F^F0M9;M$m=;J=y!d7)>}YFBZ9og5q|L4G2uBzG#B>4wcCFx
zX<}mDbvYGr>`wZlZ`ba17mLs1omtz=De@#ykix_R+|%5d7c$ipz`!7b?feGtpq0O~
zS;A10CHv|9a<6L{IS&Yn#zZ9?d2eD{FH@Gc&TYwPBa%sOvd=#p&Ua^@7nLE_y`0X(
z4biF2=1w%idYa~S6Rpj3ciSflPu}O)3U~u2F~@>bGb1ATsqn0$NUeDRe(N1+J}+tk
ztHFiv)m01|ZT}WtKiKm)js$YFH$|9&S{Ms))S7JNpqtMH?uraw$Gr1JZz{FlGq&=|
zXiFS$37Rrf8*#-yLQB-yLjCtP2#NpwdUjqhW_B?Hi(EwWClpk4G^e!=(}yJsXl1{@
zC*z|mp=U$_jLD#xFI_)azCt9c&pWPOZA36=tIuu;r&`!*M@A7|NfQfgHncrkDwv)p
z%}_Auo~{nxU=2m$(Rx1H$fyCGXMZ;<5>_p|nrvfcX>0S=DcjjcegLHZFBb5ANq8dS
zF#Lg;zx^0~uv;SRJ)B^T=Pqu*=rJW-u(vU!yF7`8_nZGZIltFtR<Qre2;P^Wi5opH
z&4M!}&L{QI-*}ayLarBO`*G@1Nf;B_Qq$Zl&nuQ=1G0^z1|?oBBYanPOL@Ug!j`Wh
zR`7+;8gVCrYD!CPSDwpP*U~0wTmpV=6-7qV9lG3X)!v+!3w$sP3~hQ7<BT&sZ6O1W
z^WI*5N^ss-!K5yM;_0pU)3!!g9J^i*hIf2}MaHRg#YA^%M7={n^`6zp`T}9>EY8-J
zB-%cJUg(H7vK!QHCZ2-X=_AHT1%Dk>R+Nwb+WrEh)wzAULc!3Krn&{K<e-z0Zid@f
z*@Clb%AWNoY6{h-2=93bfrv8=Xpmu!=OplGn5E%20D6KvCgeq>;KgJ#*98(3Ku0Sb
zH%tDO%Pus6+F&|AuAX0aD-o`bsbhU~K>EA5SQ)Ovl(<4Z_LDpLmbdC#dU33vvy@It
z$0b(Ei$JE9L>82tMs4%+bH&0x$TF~#NRO0!>I?Uhu##8SYz|IdzLJM5Y)$-yVbEjz
z&=?s(cE|vP;(dXgCZNo>)KcZu{gv1pkScAWAO|oNIu`xdVVctvG$+GjNM~i@YcwSt
zdH60r_J7!W%b>WTZtt@b0)${mNN@>(Ai>=s1oz<X?(UipLU4C?cXxtY<L>Uzcw-Ik
zi9C1i)ZD6hYd%cPhuI$}s_QiDv(J`w*7~pC`clu*@XWlnvWUS@(_Xi{0VP4ON-Ic9
z)?WLF^4fDN^l%=N<3~YEN{Qc@6aO#E7Or&O5SU(dRYk6$*Xc%4zV+Z`K3~2x4!&W3
zNE0V7QSma|B{iSwQCdo9({#LA)KyrPZ35fY!OZK_`MhFlzu!`hQdTTb9S4{YRObkO
z1HyaptbH_74G{IzravRez5lrv<%_NAj-L013Wrropy#SWbfsnQk(PC31N7vR_pK84
zC_L`(;Loa<LY+$&y*4hpQ()8n_DWzT@)(!XyIXh@bHKLxB#}|_EOGkvZ6s^LO9AIH
z@H225$TIE;mN~^Qg^#6q$FuQ`zMxNdKV;LNq;~_ngO|SkzMvCshH7o*-{EU3?gse!
zL`%ia<1d{i%KE{^s-N(56iVpjVsZM9u?NLP?TboF8CiuteBu)p?je(uH&mo#u()_<
zVwDD`Il6-T#Kh1{<_UsIamF(^pB-U=CpIArMS&A7Kl*`WbHo-o`Of`MDg=d6G*a0&
z!c$<5cx$Pc$akRWG^8lS4{QYttKmI;-}%v>K1nI?G6$7NF3J1wzXkdZT6G;C?QZ@U
z3YV#E(zII_=jAU}Rj8CHw@e}YUDu2s1v~1P_xOGa(aU`F1<yqdbM{{yf=o3+`&6zH
zi==O9d567^m;WAH0(06&p)J^&%qQ~1HM!v6;1C=#i_jdTh2UD!mjVT1I0cDPvqlcR
zA(FwTAkw8N1?7o9_XR|UeJTG&hsDgXcFkfxJTbZ3Wt*$7oU=m6y|fcD#2G}H`Eiks
z!yKcOY9`9!Ybd;%_5?M>Ec*u0QKV&58wXbM%10^p>WvQl-)JM6DXNb-w$ZcnBl9ck
z%F4>c@BOU0I+E->lS-H@H3f;d0s)r$p*X&cS)ql1{Gj-$KeAfhyu1(bn?FO+knQ=B
zI`{@<#D5!bc#8W-y7`-$4b!uT_<eGABuo`Uv7wOlP;}sLBNkU}$jrnCzFi_B{RBa-
zc#RwhG!jM5hkyhk<Trm>ov4))%@Cg}Ool?D|Dytl5be|;Od%r`(o`U;J*nxa=qOcF
znH$IoQyTTQ-As=$Uww13__q%nKS0>&5hhZavWmihqVHt&4IrNtW?=*ovX0U*vxm3N
z;+>BKe9tD&{R=h$ajS<Q`G}w#KeoL+FMInYfj(FS0a4Q1dyCJQmL*(^PYF>3ntJb#
zFrg@VRwW;(a-TYV_&Os!Kl%6M2O4t}Ant*?bv4rJ$K$z#yS?ozb@aW3PCsj$A3rc2
zv%l>{);>P_qBdMA(<6A!r^&Q*x*5no6`Av!qye;aS0Kb&T2R2i>P5d9R#73_xrZ9Q
z)mw7C*Zd{dRYcwAeDk}^-%CM>>iSQCGbwte2StMYA}b=owihj#?g1(Re221Mg4-2P
zltqmnt>LH;Xdoao<8L0B<-FA3eKfw<i+-OwSOlR)r@h-cmtvTCQ*8Bwhz9>4zU{8X
zdL(E|vbO?q&lY{C0@J*B3!i7){=MR>7Y|ptgb)tWqs3wpbu7l;KF~{sxH?H32G~RH
zjcX)JDaxXyk{*Q?_kvLK*!ca^8wRiFy!Agr(7qc!o^3iiStnx6OA)u`thTMPoxz)b
zj$hRJ`m2TD_6D(0ZPX-z=*|4hf;cU;?90Jc$Ro4`Dsa@0<4lUlLq3!Q1*^DY{#BHL
z;HLUy)5DS_FCga~eXH%JQN5#lTD@0OEG%`$qPwK5L5{1U&7lIHs+tgoZ+z%v*@gzh
z&mR^YNvnnxl<HdLeQzSY>tqt!*s7xY(LHydVRx-O;}0edc6MUv=6t*mlLm7>_tI)f
zBU7TurF#t|Se#<Gjh0PN`QlA!EGhYR6Pt3LgepPvH#mHW(TBgvMxA=xNBq?^uZ5M2
z7Qc|151vaIJb6E`O`on#?8vh|I(?bZD8AOBtDabVN=-+6N^P_RieDI9h>?$NW@D&|
zZk2zI@xb9ma$-p2++-ObQWlMRxOFt!FjQvT^ew6)p+%s1>1O(7Ikb3z^3+w2^Dd-0
zSl!_Bb%%Dz!_E2TmVI2PAQmOS7x>+<3xS+3zwUMT!3UAakq6jy3!4e3*>r)|GYv-7
zbaAJCu3x<fH)NnrKPN~VyX;LUw?~knAg!`Z{a#$GFA98!bMdWjp^$oO=6r{pu63m;
zPZ`VoV7xhM&RKzJMf|~R&$+U{^P9&HPi7lZ;yRg9P1rI-nZA<w&wuyPH5=k-cMQQ^
zd~AC3YS&`~&kjkM^Lj9(vzfBK5cA3qogTh~R|mH=6%X^k8p}zAT=g0<SM4f4Et~4t
zXt#1hcH26-zJDHHa*uaMRDHM+l#-wuOr`-ZT;GV$p?bHBOhO)pAnYeKx}~xImJNzL
zAo&DWdEbS(6>0A#-OL0bTw3>l;zi4nLt8&<Xs5J#6enf5w<r5Wz^Qf!jP2=hMC@qu
zI{WVJuLLD|^KK|L?Am3vj~g4%8TIs2y?1nH?1fFG)fO+aviXe2^%*b|k}>WPARRyb
zt8t)L2!T8;8T)DcxSw$`K$qs-tIg}#(IKOqYi-CDW^rw`#Nmj(Beyn2I=0YK%=G%q
zq>HM}_5-i>a#<7o!<m#+I8}>>iDvKu+Zv=h#3Srw!|qCb&dRakio`zv(~myDeo=%x
zgD*oL<L^uNI#6!)ZYc+Ji{m*=kR$Ym1$-Gkw>L#qEhKr8;dGG)bKeK|7blvy<UO_m
zS22a#88swrVJl)ugsI)i@<93tHsNpWAxcyL(qQv4($sdXAR@<2#}L&GK|LnC5L?@=
z)g7NPT?FPAMK=+TqUOTD-J-&a*e?`~nzB;uJ_*q)`D{xa<GF`Q48S7n^!=^&)HO51
zGRgEJqlc0FdGLU`R|TLXfe?yvbANEt1qWX=eSLJDcLtdRUC`73w!xlx0Ioj9pf_+$
z2*3AGE+)ZHJpqmd69z(5wV|T8pPZ5`ZNmpZ^D6Px&U$4*opH{nhm1l1v}#(E+l@(6
za~!*?Vpj94R>+;H6wvybebajhLJ?4miJZo!I$n;9S(-9@h|Q-tP&Y4$yOL{C;}2eN
zsv-Q8)0oi9H=)tHu6DlXz2)2`?)sr5FrqdXp#mkAvSg@YXkJXnPw>vM#{F)&f4FZ}
zP)k;cxIt4s1n=<4swopAE30nh5IX@N@s*1R=f0fQktT1gU=ZLB;@>+;6b}CK6f}x}
zlaOB+Tv$1CuQgXBH8>UPSXRRt9Z-uTJn-V_=v7S@Tf#%?-blTI21OZ#<-r)8Y+cSM
zK?Xcdh!MxM3^puOxUKqFm9ix(TJilYypQoWOy26}nKP><?<DnQ&m6{Ba9`;+I?cZb
z0aV#2h%~2f_NSFeNc2N%G&`B<zF4Z3sTHxR!Rc&>zXDGEL}-#Eok_()O&;BV)e7kd
z!KF`rkA=Nei?g}ORf?8NRLuS)1Rj*0qZqr)!k}wLRipOQ(utncNGTKh83;~z@Dm9J
zLK8vVa)C@<?V?RdjqW_0&J6)c!*@`%;f1;6qi7YQwe<%ocPnq)GrIs+L@G=9JyN%=
zFc7F3_l0VXs|ca1+EBfc_#0o4&Pk!cTce|z8SFH1%Z4>IbGTr<cq2Kd6rFTslP0sm
z5Q(y=?H-+^k6SUD970r1D784Q7Ja+`Wn=-+ZIT013V|j%zSvE?1T&Kpo<bJosZU1M
z2Vw!uE8frYZ}?K?D{IvbFj$x!GGrA$RBg(!EEN7&%J?x>ilDE@ul|3s4Uy?}>C=4g
zylOI<rrYT~d&p20p~#>TaVf_bhK;?DPK(b${J%dz2#ftrHb1zWC$DZ*KRxe5p2nmg
zD>(S<^}k6jgG#7{IGP-cL;d4+uU@#PC;Mj9X~yibYNl}P63EB^4)F@W)@8=Sg;mnb
zM`5PB?dC8He(#TrSr$V1v${vw!E>VUI;+?g_TwF?9UuSv;Z$XlCkQ62J!E9rems7P
z%yeW?YkS*^ony;|`u^q}9fw5?a~!VEK<zs836e6-YA8;5-K&@1@T#$g1_1LFbP^2c
ztW8+K?kkWgH6bRu<28E6`#}OO8wsnWh}c-v7bnPgyrf$zL)y-eC{YO{Q2Y6DhF*EG
zg^tdOY$sx##_(dR`=e$+G_Y4>6H23zaWd~y#0=o`6Pj895^Xi%UM-9s)anLTqk~@;
z>if2<;6?<&76V5HPBMOjmtmv3dnSC|N(ypjx87~Aws{+6c`S|V<7$~Ujl3_+Mjjqa
zXd?sTK;GS(C0fh1(@QDK#`C_COuaq(yGbgLiEImVw~pFv;iF|SsxwRXDq_{jt;408
z-)H^{<GBnTOUYJ}n82<&QRFOj_bio*Vp>(S7Z(yEjq^X3ik+*{j#@#VN{%&;Fk9G?
zGCDC1O^6%T2WxI-kVUIL18&0i*eJ+Jr77+lKZ2WR@AuX<aX&L~usUg$ypRka)}fbN
zj=vVSQ|m!*JIqf?b!2hgng?=vZI)+8b(^3tp^IO;yQgLf*Y9{K<0!xlMw`<ynhRch
zsVjP6synm(QiPUQ&>qJf$V(82XRLAQpc?z0ZNoq9fC>St4U3oY8rpLE*7v9(SyeW|
zsg||-y)9OfbhYBm9e4pb$SM-^{OSP1>u#gnFS{CH8|iRnCsfdmW8;OX5`K^qh8CeC
z#Z?-dHxap8;=}DVfj7Q~LDd1uE&kbmd;wC=eDcB&swa%--i@Fk{CaA_Aa2+%wT{W%
zRkEQUC27eGr|otZf@B?bv^3H2{Uruoolm&eQbVDs#U1YxV$W-%iw{{T>TSP#-D_qJ
z#AEEsQd0@(xKpJu_DIhZTpF5cchv41-B&iEvU3c*34;k{+vvuSeX;0iseO_kZ=<##
zG<WMMBVL>ygU4Gx-ywF^r-MM2p)<&|g?cB>G~KHiZNB%O0jXpmcv6p^kd2r@W$!wh
zxwvXm=8tD@&x$V(j`rp!0+`v{qK&9k=6?bkT)OV>mB2BO8ANUm6X-$U+CIYM7G>S?
z7nH)DJC(kwY1$qpwqB^!Zo4rM63Gk4y7@47gY|aFKNx$xNRqPewNVm>fAC2my9=ds
zSj=n8AP$2sFN6A<Z72&^#{gcE59sj^Kx7PD8gwGeP|`Zd#c~knV@28)gqq^N+gI!>
zKyC*!i2Sq^^u?76a*_(SMMr<^OvGH{`pY<6Musc2a(AVxZA61+%t4)XtKshQ=<)N+
zaIpBVn<&JQ9Wj%}f~6BAIB?YXfTqVH*b0Bqmb7VnvS&^|Jgq22Rfu10KEb;TbJEG(
z$iW7(($*$|RTX$Z{unCJaAV_aBBiu5^2QNzFi74lW{jQ}<8+CPd;N_?z>Q?f;J*KU
z9Dy}#tfII5EAT=YI`m>}>-@C$;Vo4S>2w=OB8|&0V;$|8;h}}N5z?4?lnczB2fJF)
zf*tWE>3}|wuL9d(PZ{O4UN6Ls^tf81)D4>ud;|4lcxYX&k>^=TY0*x{BI3ZA<LH%6
zEh#7<-Y2d{xQ5yuY#A6CCAv^vZYG>3ChRn`a2#K7&^cq7Qw`QULXo9xo%i-OGSs+P
zc&IMzlq}OM^+~e6KJjc>)UaA=z_Z^>TX6p1$Yy#wIny{lr>3sXG4H%oe!~WSm~Q$I
zRvgjF<8~&A?tgr>biG5DliC!`>EhFtR23zthMQ(X%+~g)O7xH~&m@V%)Ao9{pH`ET
zrxIuW>NtRzYjDesu?pUJSi7(|+H~BLd#Rac5u2<hZ$#71{@7MtBeTCsz<qf1>k}tU
zPKm*R5%Qeu9AgZSNfnS1Ga4y=4kfG~azIA1wNOs#alAmT#3Y)(KX+bm@~&batIL|P
zaSnRTuf)*V18yXkneLaSq<zoI!&TX!*|<OvB>(JosXY41`W7JnF)!xumyro!z{b0N
zgOBnuQyLm-&4@lk6q4Ce&%atyT<mWV!uS9Fox^!lqpqkv;R<@1{ZtX%MBYC_RwDD;
z;hTp3o50de^5L{YeF0;}8t=;#RVIH2%17vZfAWhRS@~rGt30(>)3KVSgHc;uIIc0W
z+sr0$d4FR0SV7d>AnkfJQ?`q#M@gb-iHY(ddPjU*#&Rx!4Em#eCYxzI=!AJe<vxSW
zX1Eq9<cx-?>}S4^ecpHHvgUgT>UayJXalimXQtNGNmmv_`+Se0UuICz35UUTy=WLy
z?RCxJ^9q}=_=mLo^x?P4k$xzU3Jj9FdFP{S4({9HHz2i7T=rEz0)NTDg7`mw_Y)F8
zymCHXOLql!>NlRdKesRYbm^p%?#+Y@4c(@vR<Yn#;<5QLq$DMmy?4OB;BLp_S+`b#
zD>6DiBOsb>JC{RnIjpJ;{ja{=n_nE21DB_Aw#t#^*(0E%#6zzp=VL;#Urz=YQ&Li$
z9~@mCUr>fw$UQjfy1I6!G(}QzxB{sV3$fg-!naO~yRTv@2b#@4C$^p}nQGpo(B*14
z?HWOQzAKwyt=UjB)4lI$R%pVh%9Ap4f#BxOsU~PVSPNgZKePsIOHO2q1QWhuIelB8
zkQn98!>H$AP3K$`O28bo>}oG(Ed!klrf$$+-MB=OzS2YjF{^s>tq7eP&)m(7)UlZ|
z{NBZ6#l^1rTfX&U2*VqsO=rj3lq}eTInh(;!P=LxzqV9F8&$%i@868I^R`%6M6+(r
z=RBKOwp!xcQCoO9mZMRy>}zB??`1k#<XRNqb-?<(uDT;r54}!nK6if3iLB5}o_H)p
z&cmoTErmRo@bv22Lr3uDdE9WWCb*@<s(Eu3{gR=jS^qruys&4e>Jg!Z%hM))Fox)n
zhSUB8x|yV0rC4RCVeH^KQ&99a>(kPFCWYAjQQO_wM}?rK=C`B#HYNv;(uKIvBlk(r
zGaD}2IDUnRpQJQbSeF(WJ10W&_=}d3RYXk(Dv>yMcNyPaL@Eu%vsCq7u3Ql|P=DAt
zk3r6bDuBHu2Dgz)j@V;%p!c;~+HPM-_JX4b&W%1W6wy^wJ`hk=I1n7`6VEoOR&5zS
z64dHUe_{f&+Fqzqf~tKw-j5+$4bSH~9c9uYAYV`-Al*1ZTl+V9hSS~(;f2%X<UA&&
z(zH4z<pPOUs043L&O`a=ax`+SP46}%p~ekYcA2Q<3?h#i4Erffh1(kTOia!@sTH=+
zVPT}5s4JMGWR*)__>(rs-GM>}{B11jqckqtk6Kr=Sn&ro{YPCzzD*`1td+EL%#i^(
zjWZpE!nUxqOjj+8<<al!s1{;NEM}xRhWIx-D6-nmPi&mEE{}w7IoTd>^Bxn-!Brjx
zhed-4bB=7j2;+shI!Eq#U=l8OUdqcV^p%5!1tuCEbJ6g}P(JjYw3c+$C357QN!ls!
z@RfH`t=X}?^aI;@kJPItKCuRiks~~&9v}<w1_$T-j8ujtZ|@_A7$_Yr=gewgE$U%H
zK-euXfKy9eL5b4J_-Gb8<@U>9saWmm@T!*9gZM;b(9Ir-vA45~HuA)}J;#TT{Y*7B
z1h0WHI>(Y#VgIYedGQevV7G7Z+@ZB3dUyL}dH5c7SLAPbw4|xwdDnKERw4eYVucOA
zv9SDTuU$8q{nERp$w(M2O2y%L`Rl1QKmW91(Q&E3(?d>sPAA6-BXOE|=vm<#tYuk|
z`mSKw;g>{%%`+G(u1rTz%Y9-wc66|kS5vy+n$FcVO>d#A_|!SYAXW5>0F`2|tb7U@
zW%?oP{riKZ=AnZ)WSlao)L|*{rW5O)ts>>1y;GgZIML|K<L6abDQ_un?;c{6pHI-P
z93E&k$v2h(ds6%5w~o;HpkKgJX7(z|ABA9vlC(JTS#3C10LRs<&6S-g20DU3*v@E#
zH-6(O7%bVeFgMNzPJYXX<0++_a%P<?4=v??@KmMF4f9ub6%w+v>bT1?o^#%?r=fmL
zmt(dJz*XDs_GaeitN?eT)+Vy`sP}^X{1mDW(O7%zq~-=J8R8dVxV3eWZDUO|rCCNZ
zpTPGT#8-)fFU{o!!kgu?B%GTIe1X%FxO%)OV5cme6g{HZ9H&M7k&=SCP&4pHueETf
zM16R)t5CS>2jvN50#M?v#X9`0NNS@nLi@SVNHUju&&D2GV4yKrGd%g*t1A%Umq1#`
zU9Y*8inIOakzB<O--^HKv^{9uH`{mENtacSBnL@%r#8}3wI*x7njKM2Xj6YjtGB7}
z4E@yb&C%OM(+iqJ=G~G)r5Zx=4|$P!2WD1Yz@{DWN|&m2`3q&#RLbVg#vbGVHW<n$
zrcd#~PkCg#ZNs)jSUMSpzKe|#@^m8lW|VvUu<Lxi$XQe*tZut?KF)PxW$2*0uGDzP
z`Pf2LCRB22ec;7XYJV50o4(l`cTVNS^)>|A;}-1@a%wjDDR=#L4csPV96%()Z8NcU
zdF%AO-+*3G=DADx)>dFo$s2U|CnjFXCJgbej_XuF&*r|k2NnF#wx)aJ)l$b*MR~mz
zqIWBj#Ho$TX>%bVAd|{tZDf?&Fj6}`*F`$tY+=-+b^8mSlXA<>$W;}7iPURHI?UL_
z$V^RBvxFwU2z;{~ggXwhRR5fK7y(W%5#T&t%2L0c9Ud^Sv$tnLh~lp*Oe)<QD>+?~
zS-87%yK`woC0x~(rMx@twd8P}K>}4vg`oJ5kO!+@Ue@th%xfgQ=G2>YHg6jM4=z-i
zc6Jq5YYz8Wup?rwbguaIdNHe#4M<90*0yJ@sp5->sJ|b6`_py|Ew!}}P=HrxSqC5G
zx@Eo5T(q4fGn>SFM3rx8N<G;*#Vc%-^`p2GH|3);m0mvj_<@8^SsXu_W3DdgVstf+
z=yrO(-f*Uvjht4U*%;c|`R)E-e7sVcdyrR)uK5jjzOYo;B6f<$dlHQxG}sNag|IJY
z=COqqX}4dWalra*jDm_b@7>JG4LW><63lb4KSsM1c2sP(`Ef!^-veP93si&&1Y&8V
zMwX{HEzG7OWWAa$`j4JBj@7yrrpSeuIFjDozp9d^)s50VCK^3AP#RzAeJ#(#v%mD}
zGS=B~M?JZvBv1z@R?}@Rp5Y9yYW($65ZHR7R<kOT%&XF7I2Gn^e_kp<_{JB`6h-)A
zGK0tXcJh?#k=x<Oi#s7Yme*;s+-cjW15b$gT`*Tn`W}i#P>+R?#YA_ScaEtU04*tA
zei`v&!r^o{#YG6Ju6ks_HDmcWnNmw*inM%O+IYC6uYSEdJnyhRCalxAB`hpV%R^v_
zM<>P1Vz}VAXQvommXOCYvp#e~dTVSr$MEqi<`+Ng6%dEk1fH*}lG4pgDNpLdcCfSe
zo#8|+_z^nrowC98W}ZoB4mG~%bfPs3v0Y4ChOmvYXwFw5*0DVkg87#*pan~)D!%oT
zIeP_J@SsK~W@Jv0b1*&1iz93<qYi~Vv{gV?-fDA~pXn7FVi794=6zCdq7yC{TB+DS
zcOMB-cmXZG@jy52{P>Zo?ZL`kr;Ru32YRidvUs%k)?5CEff_ysh}qrk_c&EaGRyi=
z2DThQQU+vXJR+rvoiZklob6iPte$HXvGK?ts+fV`DnFP%Iz+qt?r>|NtJM0sdM%j=
zpwm*7P#CK@Z`1clbsQZtjCRg9zt2idwl2gZVrjNMtG%|M?96>ELKap{UaDuf#WclC
zyeC>|)(>n&UPh9;Z*lDGf9m&H5tHg;w%tN{FGh}<lVFU!*B67X!4F0Ob8qpXUtt6|
zf|-xvgE$0>{^$oX<C%}c)Wm99`uQdx*jT%yJjxG0lw-R#>}-Z9@3y5`@UYXswaxr~
z{#|=FbGAWzyrh@okhM2{ADC{{xdMlXxAHny1*30FX*A$fmiIzc+VFJmonPP2u}952
zZ{|%S`d}KaYAhv%ah9tqha#7H8num5L2>=P)3q$G*-BqlCFsEshhxWJTJh})NlJK)
zRebhjrT*P~NU^hoRbbL1XHuv;^rwiElTRBRs)P6P1LD$r^+j=iStx8{b%n8ko1G%P
z`E1$mi`(8>P#D%>Fs~pV^(|6jrRuoclwoiAngEcV3<i(PYr(Z+v~ar_sF;WzEwms$
z&O4vbn~H&1pDQWG6s8Oep8Ek%X5Br1A^;x$_@jl9|L)N4S81JwQ-PN4J?~E~K6c%Q
z%`h3B!I+nY|M3MZ2tQAiaS=2)zBzjCvql-Q)JSZR`>yDc)ART}jERY*W?Oaq>X}ql
zuj3jjYtUQ3%Kluy?XFdq6h(!MX7Labj0fB23VJ_<<Xo0IcX1wJG3DrengB@LGPOLN
z19C4Eo=e|5v9`%|{N#$~*t&G)#pRzMZP+;%+PbU(VdPwIhVmWd%4nPvxY>#wR}i!j
zrK9HIk8?*~TBk;m5=c6va9kbL=uZ`NFyWzT#)t<I$~3Fm<~<O|THYuzG8*gx`MO5q
z#Tci?IKE4l+NSVXRVnf^*4ruiy(XjPYLDi>9mkGk*vw2h;I<h*XdwT5pu`3RF8;?D
zMdR0Wd+}4ZMBXVE`|;>TZH9V!pAR$>=DyYN-Df6T0H@XVh==|ZIr5%)V_-Z9xyg{&
z<1qPS(}nLGv#f?47tg`RmIoE<VRfg6o8{nq>$dCo)?8Z%G|78{;WkHaV|@qg0ehVG
zsMP}_G-_X3A(=jjV=CLNcMePEYSNibN=%6v+`_ASD8-RD%sX=LX=S!pjE`eK8ba@W
z(ATrGMj^z-dvv_m{2nJVHWJhdZc$3d87NXlcXy+m0D^<RXG3?ISUtdBySs|Lh0bRF
zhO7vBHzZI3_^tZn)Q0tm4=gM!M09t_THA|F?oB0b3IeD=61Qe$AvwtCzcO0H?bo5!
zvp9KfXXJD`Yn5V$@k<<9S)CeU!x=|-p#e)BS?|B$*GCr5mL%1YV-7&T=jM$w@z0g1
z03z_nFieC|F~vsZe(j)k+4{*gJ31a8?fbsYP!g%I<z}ZH9O4E2p2QL085yi62P5Of
z(%g{9Ydso`qB>#Yb2whS!y=5>CKIw=c^Nge-r|vNID2tI-CC%Pu6t_<S)7nqkjvGe
zBH4)btX7e7bj-;%q<cHoDd+IPFW-N_qg=}|%&-wshkP!|ghcq}i;`A`IY=W&S9hYn
zdOcSq(}Ox?CBe9`SzYC1m9q7_uA%wNTyZ5u+b$9@erHE1SC}estCq_A`wA^sk_dM4
zaA+-N_Sx{Ihpmu6fSMB!h8O-w#Y`DIyk?)(TxJEc(Ecj-81uARlfd$bh^{6z|5Y9c
zEC*IWL33wFFD_mWPVIi@`)k)~W-GB=G~)|5V}FA`T*}90S%o^p$|z4|%%GT*s65jm
z6CVi~k@=sA-kPF`#mm6C(g;~1*&QA~c<xviZbc7!F-17leQtE06ydoF*+{G-Sg^Nj
znx)tbwBRRv0&<+YbD>mI*S8RSvhe(JS}iTVfTrDnoMnblNY8e4buCd43~SGhV25FP
zv>AS+gN;7SqAZk~7CE_jayXu*;<NVl56-N_*st%dVSM`)LF7fms7XEWa{(ib#pE7f
z#)=L{k6=umqnz1e8m98TOf$sd)Yre>MV&D6Ot^lhqjUN{Lw)mXt(8LKe3RIzC_gBY
zPBr4-bU804D#|t&!;SR{g_68iF0G6O-|ngq<A!`KEG=X-T?5rO7K+t9tNSP-lS~|v
zPEA8gUBbunXm+Y!@WIcOQ<MHnEaqnQrplK~YeHG^pvo!-v0`fx>=b{QFkJCr>$z8S
z@3<jfiD6tZWJJYGW{JF1@IHAm=P%!RQpSi|vZWhof<3uqp-qY`b#1IcZgtrom~XWf
zd!3z*7v!S@3$>jd#ALR<!fqY5oR?eJa-H^%nqC6{7(l!r2l6;_`xVV*9B$MNfd1j_
zr9BwUhiRu$+TBCJOZB{FMxzPniWNMsy1nnl29V|K*!|D%I3d+xu_e6k$=u}(#tz^R
zIqY65#8J<Y+IRj*{O7m0FzuhNc_sg}jvP|vsg<M=>8JyX#Q0Vp)xdn$W?#QBed9VC
zkroEzCv0Nrq}&~x#TaK7g0VFojSOa+PID>-F<bEDMWdi7Cx$zEDm3*XlvHfGwd6Db
zrQbj%6hYF*up(IgFQzyYg^(NS1~0u{>o$E+V~~&V+-dKxF*;Pu27@P-IGAyZ4_@ci
z%IBr8KrYA3l%Ok@U!IStD}-YB1Pl?(Pi8)hhV;^&1ZnIShEmNbX>{11RT@r!RA_1X
zUKaJTg-c}1C1jU>^86r8_DaHln$|yO_){dIH<`#pf>5&4y9)ZDk-1PQLhf>n{~0P^
zKW54lyj~@3P>Bf;GekyLDo*ocy3&Tj-#_@d7sl8DwNwxmhGxHyHG5_#63`Szi>tzG
z!au1m%cS3fhKRKRIs%izj?5&!`(|GtB2g;##KuZ%`I^$2H+6POI*<SPez%c5Aug_(
zQsm33rgs%zgdLicRcYfy3A-v8r_5QKq(lD)Ou*^I9E#~0Iz&<$od64m*G(4Cx2kS$
z-#|(LKuvuZLcU#B{-2;riComv)$wu09JziS?moecFQbCv&tB`Mis~g*n_tESpob*3
zue<M7a|iw9Lq;U;nTrsDWd-p9OIV^3?$gH}Ht$8`jbO22#%m}VtnA<NdX4h!41a?F
z(iUqHHyAy}2EqUkfJN8}$)~=*B9qZZmV&r#WUEqluZ2qc1DP6c@55Pf3^5E*cp%yS
z?7fi)s{QIHXzH%UI<&`HeK+q8PHa{>gUJ}J-0)Sb{z<T_7pbnYhIGoV0&VO7Q09Wr
zf4CirM}V{0-ZC>u^)_J3BDI92C<DCe0$#!akQNHsgc4KciM2F?T_0Wxw*AN!FQ8{N
zt=;jjVRe|<MKeoM)6B8h(=B}hy3jMQkSp<U8`&$&>`o6rdIF-is3t8Q*Sg|OnYZh#
znMPnX9ej`)$%m?nEH%zW2uB%N0-54<5Z;Ar<>=cMYR{d_qyF(bsd}0BSmgK;j_Nnc
zv1VRkx5GJu=ml!Ns!%ej@27mlQujvPVZDkCLBm9SZ^W5t+RuPIQK(3%wjDK#*`0b6
zAFtx0k!b%hD#Mcl%zFo~ubeCZ7ws~y`x(klIi+7Z2?JEABN;!iEtnd8=W{<Ayd{&2
zl~WP}fz%MyC@42&Ag)@~AOm`pz>nPgC?FJE8l;&27SR*tMZDIyA4{uyxa!OWUrMJi
zncrq3m0cmfAPecKw7Wd7*8h{u{#i5ao$_7z3P;|o6+qP{k@y06uK3?_;=@^unAkng
ziKgs*kSC(5=n)(irs{V<RSULr+xP|b;oM>D(@vF@O~6dOwhQA!jGqcMAFe45ufB#G
zcmi@Tm|m{Dw+gtgkUI##h2rbDy`bN65M+1`LKqHKdY)6qY-p{Sh`TXSKx1B1!z)Xo
z?&ExTt3URw;X-Bs#eBy4ofI)$Kl|G_eq1rKA<mh0`Nb_c{&k!bLdQHqrtFUDDDX+N
zi%Hb(NU)*RSgC$q<pNv(c}_}>l$4`l%hq#G2?=Jkp|SN~%P}n_w>SU>W}cgjrf8>1
zlDQ%*pZ1hJ7xRefPry|!rbYZ_V~nmrTi@eF%@%@LiOgglD88p|!TH$9p}Nf3>>oW$
zCPjk`+~22{C55RLub|LZQM;vbzE>uFX_8r(=X|FsLC>m7KWlWMrYYrkiBUEsCiK~g
zoXc%ahPWtSuFrH#00c^<1?ofr{GNW+BBg;eFK>J`lyM_OrqUQWrBa0f^TIDc1el+m
zF+))pQ$X?Rqj;KzzD2}*rB;oSCGH$N?kdM<{eyL4DS_Y=QGJW6yM!7XlP<lOx>An9
zs7dX8sEU?XSz22yvMKu2Ql@9ql@bc(5_HFjn;v9RQy9&BQcRJRGYz})7iNBBJ$~~g
z2-A04g9>3`a`T1&^A#w)^rPDKz{f#I;DO~`Nzs<sVB?G$o{t<}dc>xo^Bxg{=-GIa
zox>v>2+pYuyO<aRLJ({-sdAi-1zs6<MeI`wt_G&<bJvPYMxd>5pVTiLtYDTpFhImY
zc;#Rg976jDT*usVj`d<+>*qTZ1fS_uRsU8%vKAg&#K2l{F9O6eU4Cf5K2QD8U*S%_
zFc0qeCxK}P0rB5In;Pi<ea;sBALS8uK(hh>R7(#LK>i<!hXGU&PKU1YF%p4=x}DJ(
zIn%u!usW@V<omy!29?AwKPhJkgD%aN0buta>*Z`~fHpc`xp&8~L8b-n|8Tp;e(TC^
zJ6jmXXv%M7_CrPb-#68MEI$D}Y%;fy@K;&p@(;5Wj(2oP&l+4Ejhoz+8zDdp@`1OI
zg(TFoYaNwIlZaIGS?>((-Th7%;BWZTMi(zy5of!)HX{HtVVDEc`7EMKizlV^@yc9c
zFf^O^KLua75m7uX*9Ze3nK8)zr>g&kKD~jZQ$PH8vEdHDoQCD?80B6ZZJa|RHe`lB
z)4t8VZ_$<4=@Xan{>_P&R#961l|}LyZmE7e`5K1j)Ps~=h{J*A3zS75-0UD3U(DV;
z!qcl{?k^P(5&40@sXA!4jt&V3mB1WC`fJhejwlmQMPqc>VYgm%zJgDReRy~BC5MQM
z8jpTHEvd%obU#WDyzZM)oWmi44&lIzqgHV4nYPCJd#mY+=5w;?At9Gw?c9gB3F}`_
zt{F+YsGM%2zNOrf`3A<07=b9yof6d=6AGDV7jDgM{06(J@r+t(&hvYstQo<E{wlqw
z9O(_dg$Bp9PlUP^9MYx3(#>~A{T8W7K~)(3IpWY4!5a7c*xIR45g#JQy4#fLQghWj
z_KmsN3NUBv|I?8g^B<V2M!)Q^@mW~Hsb-0ihz(EuMgEy*rPT9pns#OvLk_Zx5K?aF
zJC{S~LNsf4m*PJsHXHlUaVbk)`(_EB0T`vER?3jtE~_x<rFuuB$x&^(6f+&m%5U*P
z8*wSGCN9tX%kWI^bWY=uCGuR=&e^G*e2y1<el`6a4z)I8JW$n9$4n}E8&o*50+Mxu
zH!OxULib;G6B^AwyNM-mgfpUFt@^B&fZw~fCyn=&H>beI9aJEX?u}Jg+YGuYZS%_{
zv2A!)wX`Tx%@Pf@a9Il3w#`QFW|!>;z!#85r!cqQjQVfZsI|l%J%y1%5r5&*+c$k8
z!^q1mvTil3VnG)vOerEIHiCZb`kcUg<nK%-1A8yMPVY9Bm=>BcUu%$0<3CItB}ORN
zWEUVQJWEZ`^r4DKvst>4C+cPSe|!PM3qG`?fA6tG`(XDeO>4R9#9p|eER*j#P-^1+
ztL*^NTCpZ2?}Y2!6FKTyW=glqe$65d+D@#Jdv*(t_GO|oL4$I<Gy%J*5g9%8hEw*)
zp^ne+>cT418lgt~tTVBLrN-bw$0^O^Zre?J!H&-@wYu*2gijKI;tao=TAlI2Qw<4P
z_C{A31Uic=Qfst`7if_FO`)Ms-0gH+$ASM?IK6BCWvNW{DOJbBNg1q1;+Z-aN%tL!
z!QD`IRPM8R89n2(mT^c_kc%fJwOZRiI8_BG6`R$sq!-<ksKNPF?3y#zid@c~OcP02
zGpwR7VSm?lwVPWVNV_3X;L(%jJvU_j62Zv68Y2A&2B4D;q*4pbdp5I)KV38Kav=lr
z58ZKAE1tEdWfYgps<*>J3sE_8mF@zP?Tzq!Dcb4M;8`AHm}!MZ>wlO-l1x>9kwYd`
zmeZ+pN_WLKE*ljL)d3uPqkaw%B0L8%#yr*a6pnY5Id}>st+y6%e+S2BdiZyO!o@|u
zNKl7JnAu9|LOZuJMEqg4>9H!NNGz+OSOdm=G|MP!q*i&t&u4(P(kXI@vfOd8S&X<r
zR|QmAOD-WwQr&SJ>pp52Z_W<x@b9S}H^)ma`BxheQ0T3hc2R!P3Zz;FBpF)zPj!5D
z;GXJ$K)!we-?5#(Cer;MqY<Qr`TO(V?f-M&#{ZE;`M=GKM9JinL5DgUw=9*WxI(R#
z0)v7EsXm6{^F<^jv7P0tX?s>3=ZXscy?2mW!hc6IO2-Yej>}QjdESL#(a<w6GyoOJ
z0s>CI2@xH{qV|prcB;k3M613plR7=OdH+GIUsaF8R2nc3vuIxJyl?==bwba|qq0*5
zWBw_}Txgkdksa>Pjz&_s_;d%<FD`)sgV**DFI-rtmtjYu<BC5Tk&%^EsXQ%E|IN_6
zEpflU1-e|ga&Mi<=83u25y@hGA+e!-;3Kr++2)W>BQXR28@YIER*2~T_YT_aGjWce
z41)*r9?_m3wms?u7ZjN8p6Fz<g+il8rlp*R=PGw$C8j2hzblafGsI{no_6#Sm+yEB
zz{=j<^_|A`{x}L)F6)h?jy>qxI>5XRbfQhHdiWNfd-4>MHmNIgIk}za)vLoHOwHLU
z)AL`FQW`_H1e~0VK%pzOSPbvq1-vTb*?)L9>zN$S8}g-LU;xN>fC)1VV8s!~sb^+*
z)p4V5mL6Xm6b}z@xi|=#q~j?kVzha84zqu~@Vf0Aix7Z2n)MT7$eXh`>wE8z<8&CA
zz3a*074`WU-ZA{Xn%&0#1-<xL0sYVYoLI0dP>cfQE?nK3U$#7cdi3&QO(}NN4nJUn
z78!os+}*Kn{fSY?#a9KqHqot=!`qXzs4(ITS{h6?ve+Y@?Y@z2yWtZq3$Tka?k1B+
z>G7_$Kj`?%-5^R)bA|V6J%7L4;)vya*NFWW00kp56*WgbI};H7oamxp`$GK$Hp~*W
zXkc1_V^;^bXi9@^6h}DrCoH+*r0gPdQ(l%Mf*;w(FTG}fx+vu`-kCx9<PrQq$~34@
zNBd3YXuRIvK9-;#XMzE}6NbYPRLXl}cYm^KfW1_>ss^Opr1g^5Z8MKbX{m+E)%DP1
z9=CW<&SGBYZV#I+vO#yo^jBxygZOK<AyuaztjT8raS)AdhQ5fXcC??k{Ss<?*0*Ge
z2M1TXlOgKH!l*FE+lmRX^)X(p+G4?qsI(T+)9RlqGyZivBFEf)5!u#~Zz+>mTr01i
z$o@*kNE=G5q6#Xt9I0r)n-Kw{aGq!A*ld209=}yhOon!Om!CI@C9>+oZmi~KDD7#F
zB;H<=S~eK|m#;%WJr#P0vpP8ZmJR9&{`0gz>1jshPnI!S0NOOg?RtAgTThs~YMtNg
zw3q(kvnHs)tT0UyN3eEYi~``VpolKe4t%Ei9>;%B&sOs{j*xsE;z%BgOxI=fy6&Bf
zxtNkg;N<W~XQ=T3q@$n1ja^gk05Xtu&Q)P2ll^8IA*~SK#iCSubKH=~yY+Cxb?xep
zJ7nvW=SWn`a(F$u9^>;|i_l~g+GGl8ICFAR1p9#?8I{3S7?;wpC&{F0tR1K7&ugIC
z70_03%xgi{P@b`)1$%!q!i${;-`~@&d9}3jbL6+IG^v!w8<D|QsnuXDPIvmYub~|l
z9Y*%Ej0u8DNu+Uo2H(MYQIQwd%nAD1L|EEHR=S_{KB5Mv+;e-}CpR?YVeD5^7un?}
z<rV)k1V|G51vmh3;T%lJ<e>(lFxZzGog|rf)yWl==k<!*7Q4j+EYmA(ss8Ohr~Zgq
zmE%|1R!VVh@6#;?UC5C8<NW2fxZYs#JLp*yrXGfAfT;Lp!d+Y$(qe<fab{OBH0!(?
zOamAOeL8Hs{+qG+akX|EwxkJu?>Qn2lcmX-Iyy=YyYeu;`$cwXTt&aq{jU7do>=6;
z2JQ7iwq{YAq=(6ukD=Nb-w9Nbn0}KC^=DM~cKJ)2c^Uv31?I|}|HubQ)UDisuQXDD
zTAp?@W}$;8LR5TcctqtqUSS|``=6l&jYtENUEcec>m{cicHH2NKEzAP*(9YO-d~B1
zPyF-tNQlkoywXQ7doy_y2BZ7<r+K-d|FRIO_op=)=r6zf91$H-i%C<34+!<=A-jAf
z_OSgduC<ge|1q88<d2W#ONinYY@SVIqmJfcBj3LEMG`^I@Eos!+T=TPrxYO-;-EM>
zH_Pkt(Y_oa;f9K|aJ>J6oVZ&$N@h0yjhZ$B$Zh-6YnR+aCJ?U!d+Y-qr-#Z#t1mDy
zG~F&I^>tl!4-=;lv%jA6;_r-0FL0|a#Cf`YBWT!~y;+>x;KG_EFIKJO5GqvVrsR$5
z$rcMx-FIQ9;TQeMek9n_X<0R1e5CE+`VFh$v`oGsAup2;HJV_dnMYMT+cc?7#q%4N
zbjo?FP%@J{<FWJ4+#qT%>l@0~m8*jx=9$1MLVvz5SxCob+5<RK{CJVQIMWg%Z)f6k
zE8F7A0I=fU5kH~E0my(qQ+aPpWPu=za_RQ<-6goyEyid(gQrgW3w=s8P`(om4vy35
z@RK$os%OC`712b3!RdvOxkMTa!`u(Zc$Y4kK#pWuo+b|mKygpCnjQyC6@Ot%BU^UC
zk5kz;+?ZA{UeeQ+lNhXQ)a{-%_v`#rIE`x)t5LH*VS+?}0p5PXy#D4LUH6m)$cMFz
z0SdC7Z_W|$zXFKqOB5ez>8RpFC6w=>RN(9w?NZt1Jnp3M>z!7(Y`;F_C>a)-(%3kI
z<iNpv>u<klc8mTKCS6T?ch7Gg!gz0pzq0#FrQq#RglKA0xXW3|>CTH0|FgxEG8t&v
z5q@-^<MLSZD|{!?c04ZwOt!=kWg%mh!aW={EFkq5giZbDC)u-ho%-M8Y;0;E9tHYQ
zz=8Pd-)p2v&F{~DxBp%t`+vKX_Wyq&FrL5L|6FPOe|vbo@+S`U_4U<C7~f`|2+K-I
zq5gf&AQR8TH=w(#Q&&pTcx&@Po%qo@aYMzgUtHd8+lcSC{pWR_#nb?_SgP5?mMeL2
zb;0g_>@l<gP+h<o0X**PH!iNj2^_Hd?rh7pqmOiSK#sznRw6+1r!e$ni~3Ait7=?=
zr(f$O^gvxv)A6Ar2Pn-vlFS3$#*50z6)s&VFUX*FA+(mn(d|`gi55eiz>rB39g2#~
z%O6I_??(=WHEQnS;~a-$wA^KX`RC?X<rt6WFaP%R&b@WDRd+)saX0Sl>TLJuD91G=
zHQ{n&yQJEdy}eCaprM>&+C#mxy8KhP`a9hQzYz^)E}xP2G~YHD^tTEd;4Eq^KZS0~
zkdjlUrudc+{FmvN3oL@pAFVF$ABLuqH7uD73=GpaqdpmPMcI`8O5TJI@b{Lc&M3Qv
zGopS0IWY1RrpP`mEU8=3@m5BAm6Q6DBPzob%V^FG5&pXA>?i$Y`xw(_sr3zeyJSQJ
zRWZhF4L)rmC*6(;rX4|Q$m%C9%%CH->$k75+zY>`tst0`<L_H&9^sm9_tF~tL|QQ~
zM<<7L6;M;Iv7<e=AyFll9#b+8h5CTZ_xwmGKXAwSguj!)<qKkz=_QmBpkn;<5I!Ab
zI3v?X^;aK_f1u>ZS(~H%kauR;gpGHw(lJy?#A0csP)?&RTwkhhG)#EZCrdt@8-QjJ
z5PigGH1<u@S_@`h=`!s5BQzk9w__y{e2M#th0iSBGAl90e1;;bf}nRu<0VTt9XWSg
zc!clLZXw4NF^R}`ctp-I%MEvw7w8W1Ezf@@vks@p7}(WLjEc#Uq>P3C&FC6++g*Bk
zINE{-V<TrPv(f`*WpBr~Upf>q;!@%dHRjB>j^z-b*2PpR&fu_h7akgO*CvN62gcfi
z!>hG=1hn-a{TUDU@Y=Mqr`xpHueKfCs;Z^m?>O+$r3xxNCgXiC^sooYMO-N$1@U=|
z-4k2yTvGhU7hvUdW*wG#1+~{9?}6DCo<yM9yhv*>$d|m7OLW&6Oue|nARI{E;I?&|
zOn)*QC!K@&9ij1*W3Ou>@eSrnb#lVI_W3z!Ethw7-#cx~$v%jUEqF^uRI)2+$ek%z
zoBnk>`XKBPfXq`b1`QZLek3GK<#0c~q{L7zQNeV-xUQ&=s?ja~ozL1(af9ZBuLrJs
z-!YNI);*>ZHBx6-<?0JK;${7EEX>hFx^_;oYb{K5zX~qps3bZcD-gokmN`@lK`PX*
zi?*XB#0Bj-$SjTy;({W>i24)|3o9e>Z}}k0&uH6@al7H=62fX?3Mi;FxjTBhm!*eE
zz9EZQXp@VmbMdBGd4z_GasU=gs_sPW-C#C+0~VSf5vIf#;$J&Ey=IgPG~DEr^03fi
zK2tqd1J3#0s?}`Zx_hDv5TUoWGzS~)YSd>+3lq-E*y0no$=y2Z0^}Y>6M{Yy9J&-6
z;4+A3Gp{Z_T#ocR&dc1uWq$|jPKYYS^sU?cR2WRAMwGdHWX!}9vr@7XPjUAllFV-s
zW=-lQlWUNql^%J6Zg+YSXG<EODrRBqO{eY6DiIx@6WEmFia6tuy19NRi~&Osk%}m}
zy|rFM_&2Y_cRj;OKWEfazD7jdeH3lfpj~la9UXGsnb?hMB>>Fo%uGGbDm2vrzkuGT
z?B?)@)@qnybW)4}KElmhkyZNEjdU_5$LLo93}h8%Sx04>Uh~CFL*$i{^+~S0T1UWC
zH3yHwtX3P%H(lYc&kZ>!8|2>8_4UP^cz9l~XKPf5hEr|a-JWDKe<UkJ4brHj9``pO
z2w3+1JXKg6n)Y|=O?NaIq8Jqk?G_3p+Sy;EBB5$p#%XQ=N@qGRogJWMl9;L;j%lQw
z5bJ80^5rEj+xM}4^f*>t6J!y$zdy$KT%h6Q=FTjYe5#mlc6<?k<Su7|VZ&qp+N<Se
z=L1sLgTRj0R;BmUjBR7}z<{6Q48=&mqhpv`xk&?k$tPSB8hIWjG3iRXE|No0rAE=1
zEM}79@5&0Bhg-V)in$POd7q?zt`Id;l3c&HV=K)ZOilBr-nXvmZbs82QHz?I%O3ib
z@7Sz?vYXkbD%`Dbac^FHANR*_6;z;z<+B~$&Q!~iRLDOEHy4IfWGztiy?%ddd1>M1
zf~hS9q-W{4;M%?jj|&7+F{^C>?bt$%IkYD_U^$i0cqBzeT&%^8#s8NMJLfF)3V`j_
zjpS@bYu6r8{61ewuzx#e{yA-c-1X^`(<}VTahui>8eiSdD}eZA2KfaVL8z3p7zwC^
z@V{TYO}MHi)?aWj(%1LXdLgH<a9>#VcLL|{W)cG&hUSx#lW(3Q1HJm)K2haD^~3-E
z4w`@e+r0VR{vRF3E@$>WMRQ6lhiELpPAol=Pe=E06sdxv4TUSYdMf`p-fgu1Zx{@A
ze=Vy~8?4>`PFMKbU!TNjQ2qR5;SW=O&^+TULGFsdzstXXhAK%xmPD=ne{LW>11Lj}
z`vV6^jy#e2yIY|i`RbSwohPVj4&)cm7ewGh?YkN0ll3SHTjWF}bYQ3Cuc>zKZvFlG
z)n@OzDMN)U=Ay>#cQL3V!f^T<i7&`tMYLt~6~zqW)-->v1FA6%tCTf>3%g{3y$&*&
zCWQVaWVZv=B0)pN9}Qo&5EY1HWg!3a2>BR`hYj~j$_eB8(dNHXvqCU(v~hs+d%I*7
z?~1R-aP1dtHy?X&DkjstS^hX<8X=-G>(+4IAQ+t-O&-IiLfMwb(j-Vh@sS)=N44qt
zWR9&;zLbUipMSj?-tAd?4@=-JqsfZ#<nGH}r^K&6-o$jDHbK)~EAqJVqXwl;@M&G!
z#rcoFK=b4<>ULe{y-Io%Mr(dVnfVrlw{m;`Grc-PC_8L>coW?NmKWw(zqw5Z@x176
zxO-){)0$SAaO`5&9sjmpE>qJO0*#Y#=5Ev*+D9<{X9U-NN(0p|Go;~QqJ?@C4HO6Y
z6}tPHf;5UJEq`$u+}KiianeOEd8<1Jnd$O59@l@}JW~$xx?x)3HaWZ4A|c^JY2`Mz
z&d^wRAGR}Cd4+u39kcwVf)gGQs^NUhy{__i)P1KmPZMyC>W2mvF?yXfnk8^cNa;>D
zUHO;pg1DfYgXaJ+<w3%OP>Q$uXteL^1i=zl1q8AElKKo=$r&2AwD30h9`*&=SLcrC
zrk)zsb~!7Va_4n@s&Ww3^hoO2i>~14^1!s+2PAX*2CHtDW?*Qe9e0zng&ohgY$Ury
z8jg(4{0MQ_v6naxCFJpBCf5A9ko<R%sr{~9gu;YeN=d8<%jD)tQpD8cb|hPKBe8z#
zB|3IPXOvdv*;~7Qu4-rdK#)MFN`K_>w1tE1kvqX7-+lF<YEkRhlE7QxVppRWEtJO{
z^^k)uKH5-&as%GKi~z@F_xvrS`;A%d0;&hBjRzS%hd{%<32F}!H1ci`+JD$%Lne2K
z+qrjFHJO8EZ4pn%ctQ8ay}!Gmzx=xjKr%8DX`@BaKgCPfN!czdV*u2{p2u+yLB-4^
zl7gwn!rc^6-S<UxVY0=B+a{VgqF}D>ef*QL4qfS-ot+eqm-?*DKiwF-zSziIg-nRh
zVZ8{HCYSN*q?=7~J|nVi(Jkb5@4m0$DvP#X?Dc9RV{|zTq9ykpoRn;|-ENs{%Z_He
z$vF3VoaO0j=?sl>UU!Ch91kSK4>~^|<aD?RtT|pTjeUF`^lu$it4X2y#AHr_SMrwK
zqa1q=Q<PyXoW0s3WuxR6a_=Q?*km%1q_*B?R1c@CrnIa)Lb&LhF^^OldA1Wj=Lt=!
z@U)0r8N9{kN%IKmlZZmsq*On~Se?1K5J*@gZ*<t)eXDp+-D2m~yHx>mJ0qZpPXyJk
z4j4}LsS6ShU<Dd3FVY_Ml~9T3e-DK{%^RuNQ9py-I+EIv1<~(u|0k?dMCSapw!HG7
ztKP9hC6hF}Qc{jT-iS<4rt*H`K&f}qUZ5;z;Ua9OWm)rjaC}O;JIFz8lhD5R>yu@R
z&%(6L?3Jt)GlMN9VOmrk9>l5z>;H?rw+xEw`PPMpBoM(u2oO985+t~L2o3>)ySoiA
zxD6zP;E>?%1a}|Y-Q5Ovx543V^8252&wcMX^}bd2t-4>%u7VG<XZG%1-M!Z8wVqxN
zG``|9eIzz+cz<r<g|jK~)#w$+l`R-=bpdOAbls>X9QmKg=A~SigTz>-a6oNc9ZfXf
zxRLg2i)hh8EB0E}AKKqIqdFC;!+GFw9?yDp`(8Wapp@+TNJ3&ng)qc0+ZSqVH<vX?
zyhXfgg{MH}Z0Ts>#L*xE`Lm5LRSB)<4jVDl%c&H@V<Eaib}a+%J0GOW4ggfMZkTre
z+5ippu(5#(Unb1CPU%Y?w#jOz9qen~(Yng!-n9y9Okbn#_7<IdNpEvM8N%dO<uBF}
zJ>3`9Cw*;LB-t1l?S6T8(HF`9S(CAXCL}?d>s66`Lw5aY?l;MzeqrA%(<C>g?2A1K
zod+r+;*`1@F9p<dXz3*Kr`Gbi%nIOF`9%T69;A8=EgK9Dl5S{KI3MfWo9gm>@1*@l
zHb55WNz-^+b;F0No?{s?1_5FNGpp1(t@m;hjc?6f)?P2J^*)_!z#+ago~y*bMsZ9l
z(rV4}B!zlP--Ah6+=@Q+zBf=#s1az2tg$Gr!mhd8=;p?J8Ws2|R6FXzEp*qUab-1~
z@T(0od-_KCyoRcM!}svU8xsu};+L|Tv;DcsV*you7ri;d_qD(6H%IoOYyYP30W-Yz
zfb=|*`FeQ88>X+V)R#SM?QDXciB&t-_Oo1O{^xDA8EmB+$DpCU`(Roy$y3Be%C{t6
zm6&LL?=rtMD1%m?_cnXnAb?>a9z5Dwc41Bfbh&lZPr>V7+4#|PWL0pRnI`B99(jR|
znVzwHY9UMS!LzV1<bTcC88p5}x|t<4r9TU-(efFYGf~5o1AmsPlp0+c1^e&*Bf^xu
zA?ug<k_NqwN*qD<NsWIxvPas&%8f-f8e=??{!ztECo+wIN%o^QvNuqUW;Un!Vs3aA
z?4Oww{6+=8BvRD)g#quoe*&l=b>uxHn~LvmSauRWx2juVb|afQ<T|_=|HrLG^O|`2
z8lRf>*{4}w>wh+Prl#m#!L%YkJ)%|){J-yGEq~f{%p(eUj%3=qIT>?@_4iXRlt;Qf
z8N1xT`BjjWqI8Armcu`8LCVAs)sU!CWM7!nxMd!Jqc4GIEdiZ@K2kZ2==cjVquAfO
zAtm`g{^`oxIbig2(w_a>x&NUK{C|xY=<)wqPU=5PUNybFV$mxN-XitZv$T{yKpP)d
z8kaPx_^h1y>z_`6yp%r;f~LA+j0TwWN(qtzQ93$4Vz=n4P_G_CsB>~C|7kU7FaoNT
z;sBf#{C~P1mMw-mIJa<}01-U$fB!CtR*JN0aFBttqDN}QJX)Xa>50wqSic%2)<fPZ
zSG$zcUCfP#9_xAO6a5;Qz%iE4^0zE(LR9}+^SVu^&%A=al=t^l9<bOrlQzUIgTdzd
zyCQl%g{UK+#{b0|mYHdtzzUU)>!Z-0car*i@#^;vtNus|D>d$o9Zsb;c^+6f2ulk5
z>nH~8Td_ZiJ5j~|;b26`KZD<NA{I(Nq~77qUV`fGBAFs0*OU3=+lW<LHMPeKi@kbr
zRQ_96Z5=!Y-)m1YGpgQF^mx8eopP=^>tD$WUa2Q5`K=oRr)B1*SXR@n7|%U6da-x0
zqy&ieX1-#A|AOX=>0lQB_$|EA1SfAYd{yl+w_9cW@9Y*F@ZUw3S)U&1vvSD>SXoGy
z>O1X8skB!>1obt;fW+7DPHv?%r<43T@|CImin>qt(+x5cwMrhTYX2M9!>==lExG@6
z9ik-==vZB>HytLxy!K;-*Yc*??=2=z2rHlK$xNcjP%r^VorMe=8)Y=;&cd({!0RP-
z)~To{O)An_04PckBWWd^hjnS%8>cSByfZZ)67kwDq4P`3A)*@UI1*8P`ijDgdCP~?
zc<}12@)jH56utyW2n#A+X<Gxi<WYYLX}s6$%#YSM(Ox(jZ~R#oSJcYBrn`V{#7Tfl
z%csz4X3Ld$R79&wGq~{8xL&=-Hm1nT2*~)+j;dPfFbktbgk8+LEobtVO@b5l0*~^M
zQXFz~-k~YjRf>rH%!z#-KCU^;AX1iw5ARK|(iWP0P&GrwY!wwz-CMe5d%VU!M7C@4
zdx;Y}WVY6d-8%WdeJT2~`&j_K#dZ!Sl$cmIl7jZSzuYdp@W!JHT>O&{Pof&P{Vlex
zcS4lke$DS{;)W7zdHEl5Q}o6E!iykyPVTPyWuQnCHI4K-E}|6#$`jwtq-35g%dC&o
z-2G3!uWzEdAXB5DAZf+HYy(CKDQ0G7{kRGi<I>k_BXQ=e$iQ^?6hB5Z9~mi9!UGMh
z72FYu4#W@7I<*VH&X79o{xrTHr|QgL8nuQyR-YJcL|S>_&FDBMMvIBM3ZpyT<o!sm
zvwpx~+)iNDTt3c4{|(IR_)TY3Ud6%Dl9qmn%VoMWlt00zj{I^8U#t;}rNeE;w!j^Q
zvpAENJ^l|iu;xY1f?&8IP}2Os=6vJQ$kM<2p&=B&)Y3=8YbcDwY1j&oB>lxjU1M|i
zA5CNtmQxv>=Nj2AcYY||74v{O`sggpOy^<pyFV_R5Gn6#J&LcjyWJFT+*|nNOOhgN
zNb#Jh7FE&qSco`54I_Qh>h|N0M7Q_+6`vBKe^HmOV1WP*pROOxjBFodv9z=zKmP<o
z2F$v^I06u@$n<pNKtp}L{6Hj?G|#o0n#7a#FyrdyF&!zDt^Ar5`q}m;HzES$k`kj`
z!k>Q!8TIQ)FrNtjlPq#4myNQU=WrBEzwN#Z{nICZp1=NppnZhI2rB1Cqnrh{th^%j
z4roz1X{ABHJ3-}a()*9JsDt=ysLhuNlj~J;4P&BANEh4{v#oD>*W54&B+cEVrJmpo
zJm+e~buR<+GMM%Lw6EMKPTjWGGnZelmrL1EBUj1g(+E-6B=-a_t<QzMYF^@tO*a_`
zk-RcI`K`HpJ9AuQe4>xncg3tm^Qw26SHlALcaQ&<kC7!-iOxh<12fk4hQA)GIK}}D
zViu*8%{e&{qP2<|zI#}WN!)xiOn~k_;~%bCc3pPT(W%@SN!28;Q&PMCp79RIK8~qC
zG2wW-30#iY49s&r(th`26n6>-nSp5=KJ*jzW`!odhm1@z&<$z3=gKU%P?P`~WduWm
z{q=rXu%}4QhprJP`kADU6p$_df@`u#2CgWAira#2($4#0_M><l0TPvda&FJJ3RHps
z2CtkSC?~U;!@>+jp+$ZeHf|ue5gAfeI%6vxW0}@S<MT!P&t$eLU8vF8_J&z!lt1%m
zn2-9EN*QMeoJ8iMnT%vyN{&`>DqHCT`7T=|Pyoo7IKR8>tF4$YXr@#&;n8ZQK44s}
z5=iKpB-M;o9_hl~npv$<;Abr}CozU9{&E)m1iToy7F~4nuk*(xxvY9AT;+Rcx4u7U
zgohikBV?dIuW^jn*v4UlItp3^*;Ew&+yV{8LCIVu6jhYqbb!_SYaa8Bh$6PPbImhL
z)!$hN2QmS;RpdtZd$!y2Gd0wQeS%lBX<z!s+?UgjfJh6pzW(oL--e4&|0z!fl$U&f
zzx=)aBfaT=W|fCxfI^g@6!gor>!OO_%Y-DG)87$oQq<1u4;y&ie<xN2p&-#Ufk1;b
zt{V1iR*m4h=7+vD>8AXPHuitvQT@+e^dB4wQGkV&QP@9P{-1UORjxt0e%l^@-`I45
zt_3vc;rg#>RlV5rVXy#Rhe5;4hc8O|0=-Q^&&!by%i50xsx<%r&8>$tRk_}HkIBnG
z{_w~L?}(N7kuH#P%a@c>Q&12}N{ibzhsi(O7(#gm;7UzfO*wP3Kav4TfLM$Aui^3j
z`w*+1o@1KK@4PtnA^^1i?~V9>ZUBcVfs$z=B5HvMpFgpql{&EZFz&xkWCt+Lz}T=-
zD)pH16bCi4vN7ucY`;O$aT{00|4TVXteelXBAx`eQHfJ~Gx3Zuaj$`bW~cFVwBZqO
znvSV;0ATx|FPiMWqhtr<X1NM5e$o(3*O96vL8CnR4Sv;u_7lJWM{#W^H!HO@0m(Yh
zU->O^nGBa;2Sdl}DM+?EQlJ*XAJkN*UjpbS(BIKn<m#+6U1*{^wtqF7AO#2;^cP#}
zwUO}LTWuC`J+M=B#N$+2Q3Blvo@AvK&7~jt0`v?8bPmWB<dv$+jL*&s5SbF2))rMn
zQiL~urLx^&0QhkqMiXeo=hUzC_v`l&N=l~=qLrUcfZw7$g?)PXEz;%SE{CgqmEAV@
zJef-lm`7-6z{mhid&|Zq$`&W4J~{T#P)5-&sI-rCfBk!a@vtr(8M<eIZLpHNy$xev
zO>!3fw{Rm+hyr+kP_sU>z^!i7B<jGa_4GAM>=(43k3hPrU-$pE`4{bL;2g$#ISFZW
z>W{CeU%z=o0BR~uL1leI|3D1P_>$L6#Q-H8A=ea|{f=#1GLw@bed)_X+1Ev`e~^ZU
z3E`0vLFKZU;f8Au@jVm}Ff_n2*~p*}QOXs&n;7bV!?w1o*zD!aBp#xWkG=i^&=y@(
zw3Hxpvn?Y(=R+)7bos@VY0PFBf}s|<HY|+)o=P1QAXt_Z`Fxe-5~%kU5DWHSfdMc0
z-*T<2K`WeZ^*hRkZ!bOq?Eno${hh+}%B{*Iz5QRhrKc-~LQjTX!xzUp<smEv{G>xD
zr1b;miB*v9H00!hnB{JlkvgJ=&ZboF>l#%ysr<RRnun?VFbhn<meJXlSa4Z1+}RgP
zKIj%uzL)im;{%FY*v3X&KJ;@J^D_<#d^H(caU2}LZ$M9)Kp;A=J>m+gxl5Pl-!k!s
z^A@yj09(WL@JQ3%ht<N$pmvq&A;DaDzgwe6kM1yUbi_+Ze|`7WT_0>LX?z1GrX{O$
z$u;aeT=Nt?m??2Sywv~~pbXsKeeEmM`2!qR&sIYe<<B{?UUgCkS&?cX_2w=_tnuiF
zWM;eScaqM-%sakbbK7zT3cQ7!{n0w2rml(g_wTH{wGMc?;UBJAnXU}xd421V2%SIc
z?>llfxUF;;<(>Ya>I<!7F`m3PgA7$l#92B)Pktt!G?^`AhY0nQ2*vY5+okGpt^Nv!
z73mS6LDt(Tm#h1kKDVGJaJZGHN4<<$V{~ty&`}A(1n9Pe-#;&LJjB!~wZ%`=p?@V=
zQ%HZ;Og6_#?CCP_j_mO~krs*%3U`jsC)@=N%j~RhG7a+A0%MfDr38p2SsnqRm4mLZ
zXArv|@)nI)feo{j;D9n$TGhg$f`B_)J>g%EyEzkoy{lMv`{_|_o<kD=)_nz#Z`wH8
zIaIEgIg0l7dFM-SPY<H7OC%OlS-0I-v(rB-Cu43|uR#vJHorYqA+i}{00yP}*~6gq
z2lYo$THd@<7S8uJp(ilYk!9>GMUSm#Y>|s9vx9pz2tow~lO7v`2Y;zO9ZbZtq{VKd
zc=l|`4GkjKUQ5*3z|VUoAJV|TEvjcR*}%#k^_-sk8R>p_-@2Mz26D>@;h!M%7sP}_
z-0b#uwpdFT1OhX@>ut6egaU1Geg=4r-1ay5&zB5@8acJzMwDJE@1juhH5|<tSH9kh
z<8vAKqlo`5EoQLOw*i5eU^Q!v&uDRY?<q^XxPkL}^=71n?=#Hp8*90-#3&TX%kg&|
zkUwa*IDB*hqZ(h8g4Ew642FolU!6(7VJgJ4lNGGtE%bO93w_m^i<b2QJn|nKq}zIQ
z-NDkS-`*~C4kihyI%+q_SRVNc<-DrAeXBA<Zn5@yRZm)6=4LBF?EPo632RhJ035Q@
z+xF_rtwuP8CJl?cb0SWo7X2fAXgY>PCccIVGP=j!{L^nnkHbl_X8X`BU-{<9{3hR>
zi6&Q;?d2=mFs0{%I)<Df1DI97cy+u5mha8#ccFzs^fOH?R{i1KR*4-WhpZA8dPmKx
z<byit#=(5)wW$$S{Lnj%FzD%bs)U2pJ&AZ(vp0QF8Ht=xM#Q^Y>`l|$4Tir^lYh<q
zP*6L2lJGIaVrbKE=o6`!27P>CS92kIM8rC=A3yOH!Di#)<cR`vIP=NK3Z`{v2(~z3
z!YOCHF;KyO?5X7YaJY3>R8BU=%lLus2yLK^rj8H#)fE4@j!(y0=GV*GA^hL;n4t@8
z#wDcI%MrNi&mf~d6s(UT43lJDVpVz<g{GG^qN-2=Qx(E3_*TII>S&L!Rpg7?Y+J$l
z(CM@^5fgKOD;kVuzx>Ldk#=cn>pM4X*A%z)W&}li=%0Woj5|SqwN}$@cdC-&v1uOU
zL6U=gvQy+hW4y9nJa{5>B1tu#<A0iY@J@r(87XsQU|-~^<a}yOqGUDfg;f{A(#o-^
z!-{n`1XCfT7HU@$V?=t|mXdmk)txD+l`@v{znr<XZZ<#jHV*5-HQ#gJ4)2OIW@fh-
zL<y}%4SlNR)*zReyT`v(2o)qQxhTUS<0Hch;`w!KRjPPRuEyu~$7mh>%KE`cY8v&%
z1=K<mnKb-zZ`}}omT4&Y{;d*ywar@*(fr40pGkRrx|mMA?+b2p(~@DtO7t=Tvf(f9
zQgn5A)WDx5lM=-3mK9K^Fy1wjXnxKz_TNz>*6_G4F*h`pPLdJ)20o9EQ@ioPr)|7n
z+Yz@uqgm5esxtp=jvpf8R1i*LodbSL%3byao6b(vaw42#%b%nd9cWgH1W*ACG!zCv
zs3vzw%FRZE<dS(U1}6zy*!xd(4i)UbYKDE1bS8P%Ot1N#{Al((dxJ_GpuJAjV+nn>
z%vzsF5t|h*Y|wIH`JS63US9Tw7Arv(FZj(Whtmqd?4G}VRtl4zAjaH`gJecqv(qo9
zlu(1kZ!x1>ybFGZ@3x!ELrm7CbcUFzeG5017R$c5L)swkQ<{sjw1)a{k`dCJS35=M
z;F0hy5zLLsOVy;m^`%)!)PeP@9>r;UlDj!4_9~NFKsFIEon)93zToEvFqE5~0=ou&
z&xva$pSU-&^j~=1eP#2)%}5v+Mhp8W$@81~U9R{`3%)P^77O5{mr#@?ry86;xm)hv
zVy;v;%*Z4i2s|ZwPUtE9Ypjsj>SUQ>Hk?9pvZ)IhHCl#vS(MqJF^TJJhh_Oe8O5QP
z;C{G+(QqqtIKFueP_!#9$h4qvY<2tYr_SvTVLUiH(gtni#qU8V-TyGbK05qT;*0>(
zV@w<aQ1*{{cIDOp<bt2RQuF<QghZaTp)u}4`)KgstLGylc9{^Z4_lF;u366HA6R5_
zM=AMiLrHqjQ`G*V#BhLkoaxF-koOW$;}N7={9s7mP(C;-e=qO<;8X*a>F@P_72S^Z
z2$a&Xc$~P)*(Vkr>4bV*C>8PK)Ocb#6`L9hcgyy)FW-_=7*dw;{Zo8rvHkw6H+A)?
zH4~H{XnFxM(1q%(dbg=s1+9KkX=TH^yS2$q>$Dd|9N^Fr>w0tOVLY3O^;SbywbPkq
z#yjJX+s6s}l<k=dt`np>JJVrVzQfZ7b8XT6vbYTMi8>3~97i#4mfr!}LQ`(Q+S$l<
zPm{vA@?4v3o@p?5l5O}}R~o0kE2T5AN%;Q#Dc)+b>pGMC!*j&dY?e>BK9tLVmzkKl
zgkAs&+Mbf~qaEOke*9?F1IEF24zd;75WKYn>xhd}rz%;9PNsCT_&QWaMKR<k%dW$|
z#E=YYP>TPyf8jyfBK59flN6zD>dC;PY~+7otY&33mtUr$JCz+Rih+PI=TTMD7iL2(
zrHvD{-@G}7TuA8&!smkyR&n8Be9WP0PW?382uwnbzFGL{K*g)@q{pq=sHD72!GjHC
zeYIrPx>{(o(W&X8A;e6EDbWUQBDP>#wTdX=Jq`VdaatQo=PAECzL{PcZVV5${MO)A
zixG1z$6r<}JWYu%TDrSzkc5y<u`+STmg(;=#?in~y>zh<qD6Rr+7)<M+CNNhjgaYt
zLfh8(&MI@=JBHWGL#v(-E$?o{1f!~sLn4yTQ*~^$q)<7klF!xcFjIx)M=r4k?_j6E
zJ@-j*-T@H9N$vc6BKT5Yz;d_uw$_iqB$}#X_ijZjtiVVrZf8dh+B;>`)obwmsq2&?
z?u&q)+zKLXj}UEd!jzqJ$qE<jx}LHTkz=teNp3Wco0zd$nCp27Ov=Oe^(l}7XnJ+|
z8L<3TL_lFsub<TI?O}-hZ;xSdW^g+<WJH;PCT-YD%Bpzpokf3zPHtsGN>qQLsqdjC
zKe$beS?q{-+%EeT!9BFmPkO-V@T)-$Xd>yBt^R~T%Z<+g#zypq<dEJ%o9D?Tx{Bvw
zJej7-So|$Mni8~3JAAeSVInLYT#6aP<6I~*30Gldu?UA)2U4Du0{@06C*)|z>zm)!
z^=!kz=@fFaQ8wB!7x1vyW-S_KdMy(K^sGPU*3G`QijaHvt=zoI9&@g3XJ?=7MbH|H
zP8v%>Z{a4p{dSnh(tvT#aaaIiA6h?N1|fDmx2rmsZ+t3yJJ3E^L8$P)(5g&Dajpvo
zPW2(+m7cL9eEvmd6ff!YvhM~ylS6j`<2Y|FW($kqa-O%<>*ciXwJ)qX>l(<^4x(5W
zCJmbM^t_2<U-+n1H8dYI;H+n#(WVX#Tj)Nvzt<k_-|0D+NKzXdBk2ew!M4iFb0WnL
zC6x!(>d<pwXVQeNsM%<r(^gc);Ay=-{-VY9sNw_i(-G5^;@s<J;jc+A7Vc$U4-;HW
z2i2aK{6O2X-OgftUL_{3Q&vv5!=9it&+ATOwE3NjtOI6p^Xq*<c+sKaX_QnuzFMy1
zdb!1yyYJcvUQy_<LF8p^H0DhuN8@+$d0prsxTub<7W0Po-3BD`K6Yh!c=}_Wa4+nI
zCCrv~;1;nWn;S`)v^}1vrYP9ABQ;h^p-&t7yCETAVbaq>Gkbt*SK!3^;4F67=;`=t
zWZ%Y#+ly7WPS6135HrB3?3UN?i^C2&C4PWy5yk=`hst0?1!<Z^Yu_C22G!1y$n43!
zroJFalo)7sm)Hx4th(cKEDwzKb!qmWcPmmh9c0PdzwHR^3wJk~qq;_DqR7z|y-dE{
zDw~hX=QSQ{ygnnAfTShSnKcxNU9PnX<W>dju-kTP@R_>P4k04DCN4MGijmg2J&Vl8
zS<X7nf_y`t50?T{{<o9vAerw&aKqjkh<7Aqe0JV%=|{TdgAv!o8Nt(aRKl=5Dul6p
zsd|ejO#Il2XpaYs76?*uE3&9}H5049*cRb^;5IE?WPDzQiq0#a;jkPXu(O4)j6u@+
zeYdu}YIohZHNqw~v`9<s9sRG|yo-QiNaixQq+0VtRK8F*ZghgpY6q4Ot=trIG2yny
zK%OWiBi%co=tCZK^~%2#PN%0nyeRFwd0fxrzUAXpp5_JLo;2p(OS$XZfP(USlI4ip
zJjZ*&@}djFOTg~?(|OSlS~#T2+EaORwW-b)F*pB>p=Qc<ghsQL=|{<<=fg5?Nmb-C
z>(nwcM+#xvI4UQCbGgnf`x`sQv2koClPhrL$mmsn9Dx4p58}q>iinSn&_-qB0OuSk
zbH?!5UOh3&<H2Jbq5?Jri~bQDVT1E;j`bT0#oCqY6T8OgrYo#|N{aZDvYX0@(>x0o
zq}^aeajE`E-_Pr&o^U&4%7;dqT!q^J4^{i+$aOC&p>0gx7>Hx`q+my0GSpJlqriG`
z@olm{i+5~5oe&{(E*yGt)K=dP6#sffseofbMY2mut-@=T846Bp==9b2;A!NNDAJ3=
zI+x{-Ga2R+V55>%XiTzRHDI(6NZehmjhKHu-yew0A{8Oa{q<~px``LvP-zf>O`D9*
z?f!@E_G~Drkwi>(2ZhRd`=WkE!A79S6|b9;yWpWFcN`92Kb@J4B-V4jFaB;Q<jB8R
zn{G6jV2@<#b9Rg}79Qozbd~O5m{%Hd%zb3*l2sn=*|BPlo;g!{cJdZqpz!LbJhx`J
z&qcGbIXL%-qnIA0?ES{>xBRlFeU`i(4Q#eepC+qM+iF88D0TL=4x+Lll;21k6Gka=
z3v1A58>CF^jQ6pXuMTlHUEHf390N{wjEx-CPlR<*ssba`T=wZ^F0|x+xdva#H{K;6
z!pi%?G}fYh`rg$)W$bS=DGG=LI<0;@#*N8TR;nKnElz9Cv#u=2?eWlY)3=`f17bzr
z(1(uPaL#AFTa^djPrGmz{_Qvxp!z|?RMtjGILsccqTE!Y1M8E|ePguT0h*I`IUiqb
zhG4r7v7Ms<5yEN_j=5eu&SNQf`EPP<Gp=QC_1kx^R|MvT;)Qx+6X^G1bHDaAn-o_`
zul&rItfc=rKXjk33ey#LVo{={m#bJ)7GFK1kgTxur`gafgJP4BUAfgQ;xN)PPx(u{
zMlU=qDX>^Qk{i^WuvYXcqakOvBYK0YPZ7iupT&JlaT#40?{ab6i|oQ`9KLGoSHSD4
zp`_VE2W6d6P@anfN^eK42YpymyLZJ;^!`JCY1$$F^k+z?=8lQ_U{v|yWP0k21HbDG
zJHWQ2v=`~)ibw5v5wls}h{+)HCW;{_k=r2O*EO`F?!i9<ko;aDlBL*ouaj=c{Wl6H
z{bM4+`c~beIRr>2lNzW8xhjo%ksS_9*ZLJ2Z{b!QW5~3kc^e9=MAt`(`$BtuVZEMv
z^}H(um-oaH3v=}l`l{+WTWM|eiA-{Tw?Ws2>+PEZ9i=So`wh?GSb6`$qqgN^jWcWi
z<8=WI=-VZ|cPnrLGx}~`$J5saKg7IgJuGL*%|5Usz;A9$h(j^Yn`LgxjNGcYtZz4@
z`qA36pf~RdKVhd!K<M$Xoxn0M^B*6^Z!_E5eB9Vhj+RpWSoaP*+w9&qstdda_iq<W
zqp#)|)jJinfu~D3R4#Q}3FbVW3(cBbZAO*v0+Nyyn@rELdK`fagBH<r-7-jd1P&Fr
zZ2lD&>Bx@pylc&=F+AXwr{IUFOK?dV5(xB+NnbrB8s`nwzc?i}yZYApMHFfiwC)!g
zea>k{G(+(Nwb=wN`tRvkU}{VU+Ialxt;ROoPHQK95r5s??E(*${N3H!7?rt~&*Ig2
zCQIp2q7Mu^-{DjhuEFz7spNX282kFf+v~IX7%#8_jn4<}^tSfhjR5)Bk5(rVxVXPb
zC=9tl1btX7BGo!p>^Err$k3qtR*5}E$z!(Y#AIef2Xmf3@n_jkB@$pIl8XI8^1P#l
z{wEkh2!!?%6{&dOjWPzGrn?TohDM1~f9U-f0;ir7RFrc~l(_NSoAhdb_a$V#lTOS|
zJPR(=(t*CJJyQ&}fJFe=gNJx}6JsinPT=*A_2_D=Qalg5Lu};0oFr+;Cks*g4`{kh
zB&mb0`CuLweoiV+ERsC2tJXRf{yC9ct_Fk)T77^`F#zd&_}}{DA<6J?{ns)5zqkLd
zZeIRhvKD}L{V&^i;fdHsrq5+wTDf?fP(#fU;Pq-T&kt|x>lDrlX-!rJ7g}|ez|tr-
zj@m8bHLw}p>~RHrrf??LV(U*NOwBk72WI}+zt%6?tH%oY^BbUyEK4ieVG_~__oA2S
z`lZK-&<5{D0`N!l=3>xpo$Kq9M-O3V&?l^CO@G@Y^7bJr4+6dZ_BZ+t`tL9Nn;e?2
zV$S|87V!T?Xb&kVDkP-8*|U^qPjnxo>h=C55R?F}fKQ;mJ8!B-|NVsrdHlB={(C<B
zAFd1WN1q6@dB%L^#}+4Ro3ng}2%dlzOH1N-X;68C#Og~MURJOH+xsdkuW!m0&xm%b
zp`yNZo(_HY@{t>dr^l~AUcH$Og#-KVl$^G$VyjiJz&>KOFu>68J<&~Z*e-fr6nK|7
z2scWq#IC4N4y><CZ2%(L^mv%EvJ8<h1L?@h8yln3gZc)Yt;<#@63C120*!HqU^~Qt
z$@B2?oEg(1a$Iw*SWTi4WE0!XP<Py0)ULQ?RuBdpxYysuHn)EG$+M<Uv|~PVDZQ5+
zy?5yaS3f|YoBaIo536{FTKko-UwS|fI9>uhFg-k2@p#_}E_()Q!f67RIp%ZIG;*SX
zKy!d*QBQ3ys_IE^7|^B#fmA@3$ZC6X2SnkGse&Mo%{#R3$mOD90<sJY`~ZWGir>#G
z?v1ZE#1EB~z$s7vf7e&ykD4gnZasEIcFh~0b4;M3|H#Vo<goX>!#*K?8ci3cYL63;
zM!G;I13iuw&MIaq+us~rn$vefe2{`qnUM>XC$W>$(6mLAu+(mE@VlwVNYRt#SlnMw
zukesZ^WB@J=A}1u*`>890KqjV?i1a`Fe+KC+fK!eA7cim$;OC5tr|<K5T%rU@`GP7
zOJo6|nK!%mTRmpoMypgZYP<}Y)9rXJGOt}Ekw8s@Exl6nf}nua`OMi+oKB4jiQ5zn
zbdlPEb((XIqg^7`)}mY5(Yr)B>U%2&<jxyMQOzs^-xtzn!GUM>S#TcP;)1uWs~iB`
zhBuM%LH2MXF`wbrlo@3;ImAj1XUd+V)!2^`vQ9W7qp%4zeQxnsa@B`|g{D+8a1tZL
zy{}1k5F437snTv@7=>f6<%7As`&?5}(jNnyq<Y_wB<7``F~y)g|FG}a6?D5&$6L4Y
zCFztQu%(|C_nnK3xDgX$912tJQsvE)qS6VB#`gBI-u>IyJTC58E7z!bI}FZVGhV-+
zD^Q-D96f*L|K{b_M5pqLPS*{}+xH)W8f|yaJZhct1#IU`Ay`QRs$yE6%fgX4m3ONy
zFVi}$JLZYTD|l(E=7#&=g90xdSm?}(@(glLw|REgk4jomE~X{#+-^F<_c)87-5mNY
zLBkD3zNm@6hcC5QDMYo#oS7*Wvg1vHj=5?!Kcm~6mvYBD^}dyoQFhs@k&^zokl-n!
zxj(SRG~wXjAo)#sXp1NQyRXas{Zwmf>utfzA+4_99`+;9A!_Ga)uy#oDu#mn*SKt~
z;<K#Q&w@!_QQ<@>qeeQNlhhkzeMuZ^b-if9OzYefTbCi7O*dn+>iW@!?BD9W=W_jG
zcfJ#TxjFxPexSxpXx47q8?%qVMY{jnSRz*x6gx|Rnf+ppkT=eeNzYK{w`cKZ4rj^b
zy6MpsH&sk-Cp<O>bxj?slj{)_S;@K+ggB{!plH%coUPLWS4FZDi%)+=o7-YUtfwRq
zi7r=Zk$6D$+Q5(Or1@G&FmXz&Yu%#ntH5HF2*ZunaUU@@D9N%I#Dl^)rrpK}h<MIq
z%dEHa_%^%-wN1vx1p0~gG&@~Lu0ml}@|G%>kcb2uR;R8)j5Z^wnS<@NIcCaAU&AVk
zTCom(oAb?I#zlVVe@14gKQgD;%Kju-5^8~o3Hw}dZ`56jBDUz2qBZ7Cy{@B`z}jCw
z6$?U2%A+@GHZp4FYj{PsZXTA8O^yvJtBsmk05d{KSXB7Q=8I#xf&5n=0~+~NmtJza
zq)J9W>kZX<Y`Groa_PI;TxCxsQQvnlZ@Gm8jFH^vt{p3G`1&efpm`b^&t(*o(PAhj
z7fz~&)w#?!jHLS}-uA_IW>}Cs-`l6fArWAZjwx+WKX*wLF(is6i5b71nvrebH^t3C
z4yj?eM%(?vr#al$5OCvtHZg{7p~B@97ez#nPgC(CF|Wl~T^^o!4}{j{WR)9A$}&pU
zhwVuH#@Q;izCYc}=B~C=sj|3sqLP7M)VRY5IPhn<&QHdrD=4yX;OC2*B}>%43WJ*o
z0w#%%FRMb(*}Jd?YU=CV2WReY%X4yz@e9xQw?7F71V)uFjF%W%xfPWt{e&K!{PFF&
zWG||rg`A2PQZr|WndGE!zda@B9VVmn5ND{r>BnX)&g+_W?Xx$o?`Qk8fiU80Zyy<H
zX*Eg49`4)MBuPJ*Bpl>=fEq=kA-$=t%csaO>xjv|o3C0Yo$wJx_OI)AS(6s*(&KVm
z?CLhN(Ayr)je$cfyGoxTo)1f{r7|hFu_~piJU;+&T@q#UlYLS{EepLuYzjb3ZM@)F
zZZVBL?ssp-1_~7oY#j_bY{pcH9K(mFI1Q>4C#NV9$?g01Xm_TX^|uhUCIlnQ2$C*d
z=hIDFE^LXy7e1{<Qi}Y|4QYlJ6WvHns~nFoqC`blWp?Jco60yjeg{bijIU?+&8m=7
z{zQHwpZBG|Kq0PVpA<iMoFmbfrWYBZy*WTVUU4$cHJuyR(*kjGN+f5~@sx1=#`Zqn
zEsIa!$LX)tgIsK(l`9k%((<nPMhXe!aTAsKFOU1cI?A`QY&CG<YJesqL=KRUCjHGC
zlBRJ;*kdyafI;xPW2Dn_Oe_}*h>U|e_bzT{&X^&Gh7WlTd8)kGAcoX>tDAhV*x;2{
z)+#piU^hoDmlVU0m`B@o*GBNuC%j>l{{3FLdaJdtmagonn8O_Z5}NB029?737%Se!
z!?KZ=(R6Y-<Tb{%xAu7!yLdA>rZtHey<0OxY#6?hSqc^9GN?*5Q?-ZBlb1TE>&H~G
zF0TqYF>Z8|hj_@vdA_PtaBQf$U}BLH%*_vLsl-KT*-prD%z}J}`+H#}7g;b(a2VO#
z3^CwO3>J7ivQhE$ytFV=iv{d)NB|jiduyi%f_m$fE*EU8_%aJQY=WV<OosI=)Xc-1
z8&#^~xo>t36?N4G>6c4=3&AqALIu^;PqwS|laqfqNk?<{-0Tc3<KK&+UWbuefVU@o
z6&fcT(BtjT3z&qicl%^`Y_*r}@@=B&Y$ra#Fwu@>a_k*tB((~+W~D#iXzFIsRVWBM
z9;8X<Sl02V9Ag{~tG}SJP*)Y>&*YbvHmYc^7eWNv?nG#B=Z${8{gameSxHkdq9GhO
z_L<fbcIHjP&MTTpCwse<^oWCCaouRXX6e+-u0&#hiNonBz_xc{?kiZV?GA1}uWk5!
z&v$<s{-_C=D;MK{`uBUW(48gD7<Fe+5(Q-8kRbH4D6*di6}DAB{ablhLV13q0|m^d
zcpNSJK9P2Fh1ic-4ff04n7QYN?;1-5_wal=&}<$e<7J;~v}&#8sA8bDxtK!^<$pz(
zZ--dsUf?Rz=&LAv(cfR*re^nz-MpvZNKWr@Q83J*=TJM$ro4KzOv9KhmYBO<_UYCb
z<;**S^eb-b{_&q^#4Nc|-63T%>s&kH^ZI`V+$^uENy6fN=XR+bhQp+s9n^ChkEa^m
z?=^LK#eFw`EVJPdu{my$4!6UK7U!Nyb4-HH8Fq4<a5cg5b_g!Bv!kT?nqS<Q2{yAq
z&-DhF>f_>p9iVA=;4M#@o6Qh$m25224i*DLQDgntBu6y8wUI!vI_YcXx8l~cy}i^l
z9FqZ+qvt`y0>a@9XFDIuK!uiTT=(5&=b_A5nYf8eb-!8@5^eJj=1;(ET`W;^#5)ta
z7Ii!`dSA2~sX1-8$xu633rz;+OV~3P^Rr&WmsVO2#6b_dWrOVoRx@!U#>)!^3t~OE
zglE?IZcXNoeJ8<YAL%5uuP)`vYF2Mr<fS5aqBw(i1XSrLgYX@sS~wHA+&T+iQ-gH_
zdH8CL#-CPYMhw=SwMQ>I*3}zYg=o%pHnSWgTx*U}8g=KX9DH<4u={9IV9+CVr8{o|
z5y*uX2(e4_Cyv-@K+K9{q&{SEbM#WR)SblfZ&>m>7Au~PZV>ZZ+Z3!5EK)h1m#Pa-
zb+1>?2tyZ^^6f^pSNN_YaLv4hu7$I6!@^2?L|8_HZ~(NzOq<Z!9<BO8Lz`Qg@6C4C
za6&QE!`u6N$CsdJ)bNH2Rt^Ro`rX;A^Zkf}1+Dr&Ym%pW;mJ^ky9n(T!%}=S6uC;b
zqdDY*U21E`#}x+-M@}LH0$Q;VI&ScM=;48KL6X76q1ihJpwPrWX9UiV0uf<eOCjL;
zr^EuVMy2>EY&hoKU1ra+yY27t`h!?Lwzm#zw6l^jcN9gK@l0-|;GNP;HTiS;u$=7G
zIe{aJ1F#?xRK3%Gx#e?NufRRULenBBu_7a7Rewd0<vQ#Xss2&DPsO(Cx8V_aJr=s(
z<=lFFmobFYZ=sI*ZNuY(p6Z*XwpnylEY)J4KIF7ZC+uA0eC#l29}iI`EuGCemDfpR
zPavuyTtpbvH&KH3F-)EKzwx0KxqWsONL3m{0=E`<&6uYHTaA{A%%>L<@gMju+tQP*
zE&+u9uW8NO+E`51$Paf*safm&k*K{vYqA2D!XhGTS@Bh@8iBBdh!3R6hO_pA+0l-;
z<J&^Z#&qhO8`Ev&vpRPT(>L3A_yQE~7#yS(K>ThK33vMi-U~QQkut}7!)4ZOUEg3W
z{ZE57#2))j$7~#nHOYC@Ep8s+(%^<1FW*3hN#drXTQwn^vx%Qo=zc%y82Ca&A+O?5
zOsjGs(iY;srCx7+g6}P&bpg^UFJs&=UGkaC!38U>nIC|YN2EL)W^5pHV6WNe@%c=;
z10cq~XfhTB;$5Bm-M!#(-<5t6XWSV=!gWx>b=)Sv0gk&|O!(7M2!+ZuhFDUA2p^Go
zx20kV+!l7>8~3}+M$@~h1<B8{9tV{<aV&RqD|BEI>N0NZ0;CqLdo}NG?o^VKar78Z
zJ)s6&@Jt5JRnPm;ER$rdL)n#IACl^&%8nQUN8JW&W%6(6P3IyAug!W8VATeQ-KfWK
z@Hk}<DQ-Ts?Cgb^%&C?EB$~gHTS%Mo!{HA%%Ft&g;qhUWw*4b?)AnR5VM8dPageN&
z$9X$d<k3mLJ@>{t10=a)3gH9HV%-C>4V$b?;EC_58^s-e40!leYw2f$O#%N7R32XW
zWD#@H^JeRcjU(iypJVpUVRVWxy6#RA+U!Xo5yuKmn0sF5(MiwsN(Yb6a4C?XLNPFh
zvq1by9KV~)zD^Y7T705bb-cEuwfdh%@P3%m`33Qn`>0CnxA1+9o2A9*eHUYE8DqzR
z#a~DryXB|1Mr+2Sv1P`o6PrTU=cBvwJReXn{dY4l`}<g?$9`kKTG%b(kiPGgQCQsE
zh^oUc5-7JFRT23XepkoYoWf*fdBd3k?MhI=`*3CCS!t`GR%H7;5chhP#F-}NLZ3ej
zt=hO>=e(!IfxZW|s-ae0bNpkw*-lhu!Nd8pronVNBxlc#Z<)P!cYO*cs~}$YsiD5z
z))ngpY5E1k+MjAHjxMANpAFo)Bg6uRQH8UwrWN9+$=xg1roWoCCpU%Nc?g{j_`>-5
zJh%#)>;01wp1p9?_ZZVNf=+A*U7{?yK9X|>w%Q3-$0y($6F9i_2@FfzN#x7J;LdX$
zP0GX+*!hS_(0JHt(kga3;%O2fMYQI&8ToWyZGZQ8zIf*dbD=?Mw7PVrXv6F6iOS%B
zo1s)monb4w5UY#m$OFC-q$xea|DrrPT4l5?)<DMDl`}bS)rOOokKx9P!VW%hIa<j;
z%xl?}T`e)X?#X$6RIVf|aMR<cF;$ENjceKbk#)`S^J{RC;Drwc#+dsGLaV!Cy`@iI
zW5rMn>=<k1Cs@G#1pNi>C9P9pUDb3<gNNAu>K{ENi{NRV(y<fVf(zY?i6X~6c!`D6
zpV%89!~nz;A}e{HIxEiksj+z8pSIwwZ4uWtpzq9@bWSE8z#G^yOhT=A9J_r6c^fxV
z)y~`DjAOw)=7A$sMIL8cJYd*blG0`Bk$?Er4jV!JdY_Wz+JcqZ{d7|Jx5{AF&*^d&
zKl&YEQ7n}G_y@es=X?xc4xcYc=i3Y64Y!@&<-VE!jiFY%mS;ZYq(}U;4sX0Ro^4#+
zD$ud6y<ZZLiL(ix2j3fxZa@~y6qb_4JUfHmG@Q(?uG0+rO1ms||Msz_bI#eS5vyo7
zleq3(_Pw<Dkwewk_c{hK+{>`XRokmFFRS^)q(cAL?+!|MoItv-^z<wcjoI%sd3z#e
zl)a(uBt7~}&tQWtPQYwth^>}=bp-tZzy(qX1Xh^GHOs60n5&t4y6uT^0fzfVsk_S0
zGIbD_^Tm{Q2HtaldGC<uC=sz+*F7;p_3SpwK88_D33o^6bRa{~<%FqU67RuqcXLMp
z52W9CHkz=Ma?q8EX)iWXXT#rb7VmCB2&&WXv6$(x&TLT7!7!vlM{w|!-vsffuLe?~
zkaTy_;&OGi5PK{7Me5C4-@OiztL8Elx@3KgyG~z~y~t}HHi&FV$(-=tYHVJ4;u_#@
z@M7Ch0fEaeGL26$jC*uc>Q0OmF5P;gFD@OqoT;SfHSdqI==dH>7|+#S47*qa-L4m0
zyyu~1b2$5srN5&P+R!jcB{sgx#?VmS%Ahxmx3F&HQF~OQSD6uMfrwqxUM9}tz`@Y|
zRqolV13u()LVRB}zrX49SqNaV(@{s5FMG|MC9lQB?SE%CDb#^wazgeO6wb2_?w2zq
zDhp5-X8K3>A4YxAd^z>lk&K(2;V{l?ezxlF?#_4Ie0+pMyB>TIoM~iKkSkb#iME%?
zv9^wrI2xRX*dyhmQZ=CM?U_;;lfhh5+Bs`+hX`C9eo$t>FWU$OtT+33A?Axvd;X`@
z7eft}9bU@c{}Wq|1gd7fc!Ky?xBq<W_6LjDT3rhJ&5P`U^?F;-MZ3i{)sS?6C)MR*
zI=ZLz?vuOD8BC3MsE=LK`f{IrG-?k^<9rhJOlX30G()U>?N*Kn{8HvL-hOcRhxU3A
zoSUyQs)owI<oClA0%=Clvx9n*+}AHB7w+O)m#B)eU#c+MA$mlL2-hhaE=5*WJbMvE
zE{M>;@PMry0F?#;QJDIIKJsX*(?F5TgSQCRWfvHA9zF-X&Z6_y{kvWc1BL#NgUoM%
zVj^A$g-Pn{W}X!74Ki}+JoeWZ@mZN8>9DpPVW9nsuO2c;UWnn85w1rqgxptwmA_ff
zu0W}n*&I(KDDX)f0|7*-mhHm{BU93lCcnz81(vSJE+yc}GlYCipoqNGR6$K5OiWCq
z6gjP|MHDT(VVTw3)fe?LuK^o2gNgLU>s9x#O6IUj4%@MSL?+_cd_GXmBe7N6BCl+6
zVti(o9hK?LuW`ahA^^iFInbIJJm5E_UBi>Dy;29GO7a#1A9>mKWa7?F!&tc`Ho1F7
z9pfutrRAxGA#c!pEQSb#Yt7GJAc26Me0|BaX>Jdnk>O8D(ym|=P|u?!s;F>q%&Y5?
z%8YdLc7XG5V+^S7K;x9m$`fHI<BCdS>bc!bUs;QkLoVGfX`g_oNPxG?cWtT63ofLV
zS$k+D*5p^O|2XQa+b$mOy3hX;fRT91<G4lh!SH-Ezpm5??|xe{bcTQhABe>+28e)A
zQl14n@k^;63{*@I*lm??yA||i(BP@dyjdg4J0Qp(+2rNZU{ZuW6~e3SANjiR_VHu7
zXS?~4o^JzXr+}z#G%*ls*eypA5^ZlgJv?}uEA@ieX}_<Fg-5fH$|3kmb*2e?eb5n?
zr>*_)dF@Ha@7vQb8%}c?=u~u693*AP9!qK4H3+)8&+kH-uNiH?r$ysH0_k1N9<e&u
z`&joVd7k>|Vo0JpUp=oyu1wcf)mr4vF1yCrb1u;2<YaB~x3!*np6mFa_I?yytHF!e
zw4QMGBv=ZJq!nAASYk)vI6qCg?kU`Tr;Xlahkt5(g21acR}62yUdVgZ-zhxsPNUfX
z2&hNTiXiJ^GB8MFhBvx8OCIY$3uY=C3L8@4@0=nzcPD<rxRI!SG@K`5&T)NKsW#A<
zX)e4KYljoyY~MCYIpV;A(zzS=`CuCM$AdYuW=f>&28e>68AjF_Z)B~=a!!#1C&fkX
zxm33|hbRo^PIcP%)yghfKZcu<N%<tq22*5i2-A1Jd_(lntUXdprcs+FSTen0QgKo-
zvSw6>w&>56=~puz&f1Xqd){JY+MEgq)Un=Qa);14c)JfZ_YC#<YhqzS34Ra#)*H0k
zffBxv<I=qL_R;eOll3>fA50o6kjle#N%yoSpR(WD%z1b$=0>EoNH&ZD1E@s!*ha|v
z>lU|o9EMfH=pcSf{n+PB#K<Pm1VQbY7?|M4EAcA}SN!}O(tHiKPa(8sZlmwT&WZ#6
ze9Az7LqyER+9#%HNNFX_<1SNG+?%Q1*zwuZO|Bza!ptXRz}vtRCv7q(?WZgx!#!3V
zB6=Q>$>?%D<Dmq>hPBJwk4~jx&4y5FeD@W-jK+(p6+vK`%~q``awxwcJ7|Y$hE$vR
z(q=CDWmC<UWJI`|s7G;Q5)q8=Ih#XDGQu)2<PB=inwcJAIBiGeAKgw0B2W1S=T%tJ
zJlV3nWzLJ{7m^k3;`JuSRX@7jmFblGM@#PUq6#S2T*|N1;mv3c&wxILj}dTz0w-8b
z{Rr@81ym2HxPH}faV<=Xcy_Fb&qO)G6CZ_Ht2!5Rk>#Y_`)%q9A!H9sO&|Y63-;eC
zpdFkln_NDy7!c>W?n%m*Y_OTUig+E^z_c_^CzcRByUWMP4pWI9KuisjWoq%1<#8u0
zkf#)^p7PvYz2!Pm-#bH36U;geGg*+Pzxn2t3d}{h9hg<Tv$Lz&X`<3h$lfcpHAzKS
z2tj?QW<j;{c9S3BvVOYT_WZ(o(@pH6k1i|2)o&|6^lZMFxpRf2ZwN<K4!(r`Nf-;B
zWqz?n|I+GkD%Srzc$a>f_-Apv@hv_5YG0CKv{VI>fyqFfwV|IOQ(g=BYIOIaIdR_n
zd+Ym+Hzv+FT32l$iM+J7?uw(BecdnO5zJS=rxgrf>{AXN`X54qHn%mkUIYY?62hg{
zY`O?T0`R9q!U%B%SdQRSo_Z?CogpE6ITn=_8@qWf>ILf|3o=AJkc(KK<9yBR;qtYt
z^3>mRx3sccmIa$&2%LKU!a0M5G|XO5T2{q;oKl8=>A4doW+jn?1kc1f^W(9ufw0$%
zkgHRP)Cq61*iJM#7GpT;VS>VkMpCRTlb)V0vc1@R(DBKv97bJBfN?IOka0!aC3Nb?
z?6T<Dp`%)42Bv=^=N9~Vy@;T;^w&8uNa}z(<aFwJU<L1nxOUFCEj0W|AqhbRHz(ub
z*nzF*0=<^IOvCpspX2u~$ivXWt&HC*V7W+#{-ouOWbt>h5iyqM9Z$LgA5@@}#$D2p
zyjdN2q^SzT=Zq$}Rhf)FB*A#29=7PZay<(6ymTwmh&R1S6P@F<{3HjDTbm6uN47Cj
zGA^9`<vvKqWS1ORzy&2|Gm;%i%3o2|+a$)G?Z23w4V}_a{kK>EZ51vLd2*LpnOG>Q
ztd_Pbge+QWQuSvt&FibNcav8!mg6ow_t-eoqrYG~Wr{1)^A2IDVqKpC)tG;@$!t;w
zH1KOKy&S+?j>Rn0sTrGQ`G__Nw}*YU8ssrq;G*xi_go8UF5y6bzL%h>K7KpH-|&Zw
zFjP4ZoJGi<A=TaaVfH1v0r<1u3H{7^$l7UxdNB)^Qr0+}+ct=|-eH!0I0m{l9m?TZ
zL2FcGO3M(L&_bv_&Y__~Tl8^bYNCGhL(VJ&yV~&CA&ydacMf%X$XIz0Mw%oJw^=s3
zUH^7bBI$mA_Guy?7v<RXV#6rkhWsQyma9R}w=jsp4FBj@HazkCkMh>%^q<?IbybEQ
zu$xCQ$`d)Ai5?CuYR=k9)5ka^Dtp&Afd$CQzm?{<nwK8e`Z=@<L}=tkrQOs?=8dh)
zQ4S-yv&C|_84t0|^WVNV>z%w0TiO5KNfLp&(ResndK}<yuuK^eOnbF-(GtDzYA;nv
zY#gu@0feJP>HDj0Lcm78fwtlL>XXYb4^N2F#1!BkMQi6hF7}NkH=DirRuR=T-s2h1
zKBluj_&9!4Wgwwpb|I#Iu)YaRlSu6H8-q6Aq0cHdFC#Bxtm_A|T(@=It%I~mvJA{i
z&PjlAtR}>eaZ~yme54z+Yh+VW9v(WK<(-*dyj7`cw*-&)ydi9Nn-`Wl>8C-8|IQ?-
zXRf>`8k!`(X?k<%q}tmrotPF@7d?ujo_9<`j5UA5qevn#;9twZ+;-lCiKUk)t)>By
zJx_H_tnhDl&To13o)^8JxOdA#>yyI1RZo*NHss2R#?qUG$AFKQmylrQ`2A=cVd^Zz
zA}F1TtcLX%(Mdua=RnRz=U}Z~Q5e{0{c9m;+Jiv0Fk>f;j>(il?pEPN<fE3BT0(M#
zUFqh}+Zm&X;O$X5I%)f(-+f{-@M~~E4_yI9i8H>YGKCJ7l!JfHQ2^)1fzx*ta~U+>
z^2A5a?M68qJUr^F+d?8H++jthidR<pMS0OIhjdt457L$bq@6LMnTEO3Gv34Z!Eq<F
zzaRyHn#_7zDS`D4MFZ}%V0lktcFu2L5Ly5;vAnTT0PmVG8hJ(;^43GUR`GBto@5ni
z#^JCVxmTx}UXQHp*xhvW!>l10sq7{TSyIu~{cOE??fsW_pH1O$ok`P*Z|ouAlZXrH
zfKVVJLwe=Dwj9dr*I~*4YdV}_+|q@p>lx`?4Ybs~*t_BR{2AuFSH`)E6KfI2y$^kV
zwz<Hn=TxG&jY}q`TED-FS&}jOBCz6;p4-=G;i;7RzDMLa1ol~?@awBcjN0sh*>Dv*
zvDG1q$M0c^d$SuvOKOmM|4N~ii28N|+tFD33;mG;>f>t*ZEbalf)b7S`q7Ln<8}7k
z>}jI`4=I$}Ej&1e)@jR;cbQ;Fm{qU#45eAEkEjgH$klSQvlo*8=ew3vR3?#=i&6!W
z-0wtbWHAEF4%@Wq3`$ma-RN?AU!l!99#)TB%`k!@@x=M1G#cu!noTa!u$XV7Hkp?T
zlXvR}lOp@;ky(LKlF6=1<1pA&PcHWH?s`#WmJtyRi?W}i{873`YonAVeHhE(l`$?7
z$cDN+^=WmYHIzROl5>f;K#x6{2vfr%P>}l{t({j?Q`@)3qg+Kr^w<c95)}cZD)rE@
z07sD^NDYK?I7%lJLr-D_6#)e)l0a0D9za4M0YU@>=@B8J1(4obAO%RsKc0IZ?&E#9
zZ+nbA#u|I9wddY*{?_-+<@#PyXOV<HG3gdhSsl6KOx1Ve?}+JaAM{Yv5I-H9(<Lux
z8+!Ldyk2BGPJGVT*v8xcy62CZ;s>N{BsKjXwd7ruypYqxkFW4Tz8kBA6s*xOL%IDY
zI`Z21-c0!m>QQeRVmO}8uSmM5mv5Xhc<68I|0aw!Q|Wmj!qy)PX3NSwaE=7ed=VxP
zvQIaX#r!rss=-Tc6&vwWDZ_mvS4Cja#NV>fGNWl~rCFMs#5YT{4!T6^Tf0O%h@FyI
zV&KFjW4rP0>vrCKKLY7Z`boMXR@WdkTiqGfS*AUuQ=c^aa7t=_+I%`aTKQ7d;K5%y
zsh0}MyyqPu*N%|k2{*o>@Hyhn*zgE8gkZKf9h2TQ0#GhvM2J3ITzL{!x%OJFc-{RA
zF??w*<ENU<D_pFM^*!@_`W49*B}{!;>vikIEa%=s_}=6r&!`7}I&WxLn3;($zpc9Z
zU2&5<sjzu@kPW{*Z$-6QkTAOIz?^QU+9;xH;C!=gj0_y-#(XR*w@rN6Bc&8}TK`$w
zn9t}ZlZ>A(wy6sh&%->7xAp`BEp2Y$c1s&ib=W&QJI3fmp6*bxveePk#E=dE9u?mb
zMq|E1^kF;NYl)Ty8?oV!Di+h-1LD|KE#FvW?%e82zPT%?GVe!_^Ct|lqdq2L=t-C9
zC&8wiH1@TgpM`Tv<NO9)V&5o*2imw0d#awfQ!qUk%WakhCY-qv^G49ZQwK(OL<ekx
z#=303cS9={vdb6ESsMPAwGVwb>v*V&!Xbq>wyuW)U#EL5pE6I@jzRoTJ~Pv&g%xFl
zcYs{$o1J2mBcV2L3F{g);6xjs#o0vR&DQ4>ROBZY$4K{$@93<fjh6?}c7_l8K(0qd
zn7rf%dPmXYjE?z3DkOcQ(TERUz7Ie$GVQc{-?@eTe9OcuJv^CTIy{6ho0MlynpY$_
z@6GgCF7)(C4SQK{iIIgw9tijjmbmvE-DJ|CR6QOxBLPx(K?H52z0+?|FkttQyPYg<
zrN!(`(t|mwc6IcQ=yI%r<>RJ`i@~m0k#(Kh>-22SD8E(gNKaw>J9MRL;Y8nHe^}Ci
zp42>yj3UDtzGgxzc(LY}TwTUDkv3*`r^D8D-=<<*ZO{IFEV2DC(2i8M+y@CM|Enf^
zTVzkPHjc|<$fu?VOP#N3n7H=gYCGvUy`6ZAHXA$ok~#tQZH;)f$7A;zUznn_y8WX<
z=06tqh_5yP+Ofw=)~WL7X}iYbM!dO~trup`Ir@;1)xj*xkIw#yd<xoWQGY!Z4g;6t
z-UoAduntyF63hjWF36sp^zy&7go+|y^5z-+6R>ohV@RFOG2(=FQ|Z1*5aS!y(E<A}
z4;iZQTKHdk8(%JFC1D#p43H~N11jquheXo8{PcBjYMQpe!5m;7>S@)(y_#94hLm38
zB4!e%&YqbHP*l{7PDx9eX8N4o2U%&+;_mw^*%s>bK-U`CfYW=(UL6>8h=^#D5=uUF
z-Rt$SyFq>Q%-5zNl=Xe~X?3-58ss)rw=Egw9`vZ&+Qv4bh4xNN1Oh)ThqHH-UX6tb
z1E`#xnkAR0ZAZJ40_gW`k|*Ma0w_n`pk#E2;j?(X#SO92$rA(kwHk$7&It(X81BCz
zPFIi+;?&w&5q?C6V?s8#4gE*n<a6$yfe6}WKz_;-7v^%j${^X2g~zHY>MA$uFc-#G
zXO;WCG2yDi{>IJs(1TO-b7d+mPQ$ta(V?s+8>fi{^G1lP%RtPZp`<>D>rj19F6)$D
zk(gK!w6FK)7neZhShKPHY4Q3!dQaT~5=hNR$n1@$gl$#JaHCp*0{jL70l!}uG`nS<
zxG>o~i@j<d8H^;wH_|a?0aRyDU1+&3d?UMP<?Yq0&;)5bI6-v9n|~^J@ZzseF)3}F
zlfs>j(89fIMW4%JSqHV!^y7X=p3sS56ddbC3f>S8hy+TWF8uOYCE9(aI67eg$tjZw
zBWnOUvQ*53hGKHmb}=W@@A-M}y9ML<RKTQf<rK?ds=H2f)<FJ|eNpIuUy+i&WX;0`
zwy~B%dlu(978p3as+#rDA`V=i?V8<vEJRwi9L?&_P+T}`%*k;n*#echIH*@zab%Ee
z%reZswNoQ>QoU5!VEq7KO{3=G9wKUNG-MkQIv8!?P_IVqzFoIC{+`2L*fJ(<2~Gvv
zSMMKs)?!>R#>&~uoO|YUOu^hsWeC4p%y@gS3G2uT8_2xF&*c)`9~aXXC=`tt$JYky
zD;3o!osDaIh~`IXEU8y3_>LoY)yx^)XAw0;@UuAM%&F2}dU1H20Sg-oMM7TAwa?3Q
z<Ku%F35JZNU0hjNaiL-vffwN$J~2C4U{JHMkt5XK0cO`vrkhlkc6Sf5uz^0ABjxjA
zTYkcH^_ywy)&stS>4k{K6R>*zkXX;m+4p%VI+vtV+@jfp)ppH>CKy^r1H81w)R*ZE
z*81tK2`X`2FMe^2LiViTsV(%sW%~DuubFfpqekc3%0ljFNuh!UaEefK@~T#rNX^dv
z=k0>2gRn8bsq3?u*$MOgy_1;RE)~PRMTtPy^YcKiE{(uZh+E)ZIu7`d1x>zIenC{+
z1;50a$IFbMXU@1@Sa5jipb|OF{uZZx<UTZLI8C%+0n|fvZ@22u6MVe6{h@*XBp}kq
zY5K4|+zzraTHz;pn7G5?tWy6xM>R7$3?WZs3HkO4nD^AX7z_VH*~LD=(>*KOn>X}p
zeqN5ljVdBA9n|LYMe8CXUbRSL4Noh8M+7n85?tuOvbG--*Bpqa^$TrG8Jl8q`0%8_
zxq)oi`%yf{JiV&fC&gC}NC3Vf(x)WmmSjn(b_z381eXt&7Bb#GXZbX#j-#_vui|Z;
zvq||RuTL5AKRFTyT?j&&t`aq0FA}GYe$dNaw&IR-Mz3Vb19UV;_NsIffspKyvNF7r
z-!p>Gqxx74d$s{;W25*X3ApD{hQs~GIZ%;umyf@(Bs3Y|;`znEVD&wvzTAC0C8-@R
zd?%-@s97=vQr={9Y{UZQI7umDrEY7l_vgHfA<3s!`$l40Oop$=u!8czCgTRhNgar)
zW!k|dYlKVbU7=^JRF!t=hv1g+mA@yJ_X0`}=j%PT>Uz~%Z5CZw=YdY&dwUYjdn5Y~
zag8{4%xqyXH(6w_ke||b_i+18Jkk$W$0(NQdHAO1@44|M8@1gA7w|4l{`z=NZd^q4
z4u4riOrri0fP+bS{9JlHHAbxRl~({k_}8cbUlSkQ!_ottCxjGSkL&8SnYV^cz@J!Y
z?E$F1WFP&SpAEn`2QAr-m+cq#|9A8#)&ePv_Nw-{SKg|z;Q{-o{d^JcEWAEatxo=t
zc2JAMab+Qo?Cajc#V7!<h0yH%hnsKnnwnNsP|;nr9eLCYIcllv7uyx_T|WP)*asFQ
zvEinWLO&|D(>E6V^8-3`E<Q;+&<NF2V`T&c@-=^@6(Gz7TV-nBIrrSWO%a<*N!2Ap
zRQc``rTyZGJIkAcR(G&xq$MI6eATq7(Fl0Opg(7n^MNtFLp^HWAz<%%VGWdkhd$s8
zGS3SGGbq(}R>qyszNOqH^!{!DQypyE-QW-$(N;6|!<)Nki0sXdNz37o@UpEdY6|@f
zp5nIa<SJ_WBhlSC*u$E1YZH9}MWLv8&VNd$=cUKT15a{Vm^+qg-5CPhAU}cO&9(z4
z)*j?^^LF%MbQ-NICMfYYWPe2Wo(05Q+KD-EO%DJ#sQJ5hU~47|t69DI6cwnK0l!(9
zYIIT6V`l2uwF|RoOC_B^*zG62l(k#EtC=T1stvR5C$<b)79TksGRys1;lj`GY0`X;
zRpnpO=dzs+9;>hFv@9bNF5eryEvuQ36VmDjmOAB_p;Vd#0{V`UAJDe5B16LLIW>s!
zqPR^znHql9X0K1LS`-^i?FOQ<tF?>ir16Nz8~j|K;N85}RC|iRDT)+oK|y*>oRAkk
zdXhBkpz0<-SmWZMk|GMD$YB7*B$&FiqqSOgr@g;2#$~KT(8<ss`Y-0yrF0qX<Zhz>
zT-J_Es_G1oHe%FhP-DR3nKU$5J7+qS+0hU{{XH#1d0DW>M)sRcVr6wS#?M(dWX@dN
z@gDhw^2@N&3}aI_9!;mYfurog{s)6~DFUg_;^eHx3e*_sUXmz5i8mSZhZeFakHO*A
z`JBK1zIk_@S_a_{m3){uTgw!m1fj<3gAl!kdRxTT?&&MYMDd=#zi~6F=(2L~;P8g|
zPT}*h56^t~A)`@|mZhuTyd0KpkKw&KUUAaY&Ui+l)>RRWhD|*1%HO+aE3o#|gDLNc
zY}ef(j5qm5oI?F}zwXnnF+{zgx$#z4^-R){5P}$4MZvJP^MNWOB{NNU94p8nqBnRt
z247o(YV1XU@4R4Z@%ol}6-+@$!LZUU4B|dm>OcI;sl&b#E17EqC8{|e&L;S>Hcs5=
z0~#p&o}wU{AN*(#0+E%UpH9@AYDYWUqH9@&Qf+y4f8+12UWqHoG`eU@f!?%|@%#(9
zP`?iy@7ugURzp<=ne+}-@x)=|O>oVe-AV4aVRJkd!H>opDR{SvU3<JA9y{L|70~QP
zW-%?II~SnSyGqAPS3hro567R3PM1Fw2i{p!rYt9oFoDMm7X>qHG3`DiL1CEvCX^C~
zA-A@axyJlj&kgzLimmc)!*I`I7bfNBQ-DU>OmNO0x0-j0LD=KV94uoa?3fEbhQ6!5
zarfQ>CMP5gH#8kQ61Gj`F%Lfln%C$lAbYAU54JmUf1M%SgOqG<;t%rutMFp{FynQ4
z<2UJ@&r77Qx>x&uOB4Xa8iF1`r%(5roY>dycC^==aTuNPR`%1*RtLY%v^k`#9Ci0Y
z3sFD6<SO|+^JhrcN6TV*re$}Av!8}A7ZZOs#iNWxrqa`9-|43Jx1$F%PZJ=X2Q)MA
zhfIIH@U|R^b3<YsR9`PrUSXF@8vH9?{&8ax(W)Jag!Fc`6Iw72b7opr$O45cL<b7c
z{-_Tli=mB3#JWz^445h<6+4dh0D!YO!GupEKBR<V+RQ2=Lk-9_#{bCRL+zI{%1!v$
zbj*p$uTh_bc7mo}{J%Z{WS~s8E3>15H=!(C^c#!OkIo)Zvs1$Qjb#egyiW-^ULkZM
zQ<WtJck3VUgooIMN(}iEt_S?UoMGSg{88!IH051D*R(4LK2jp5V3yEgB|G)UaOIQH
zpb%I>v$iul0CyQN-6^&DAiD=$1TrXXCKsR$Rms@#zF@6TcdxRUqPsYqIa*^0BN#uF
zWp4VI+|X<BIc%UrD5(xjaeLz@Z7>b=3Z5?{M^YsL$aM%`>X%+EffVQEdQqs)F0CVd
zjy-2=T^ap7I|i?}wmqJZ_4!lP6-4+)6yu$@+jt!)f|=W}9dGqjJEtf2=s}6;F~mI?
zUBlqNGhl-8$<ozn=_R0~9ufP|8|C2%pmSO1lg8i5f-8$IHzCBrmv=an>S=C*zwc|k
zODiuOX2zuGo%wzNOjHQbUMJCIq%(Lc0j&}6!WFj)pA5LyU1)wb0?K>W<B{388K4{M
zad0vVG(kHGj(|<R+7ZQC7ubuMj-~x!jjmFvHH<BdO)<ZJjWA}CY9<Uj2SBR5!*V$8
ze-=YnAD_9mOb0c~opTs&4EP*Z6_a^_`7Nz47wX1?zuNsr$3K9c*IdjjMTL!&syJ(R
zi(l^4bme(^bdhS0zC?O{V(B`&x@Go<(u*y!W$FZkYV{`|2yb(Z_qih_{&cN#K;A^f
zE?!3-kzBdHwHQxV9?gJe5#a00x<w#vIOScXvClZGWkf$S`k%L#qs?n1@pB-Mv3~BR
zU;1~#ZlRY>Y61jPBN#rK|FW_KpJ=fR%I5x9a%vKJUiZD49oLO8)<RHslO9Nik@4q8
zT%wDvu!dn{*~;~id;)Z8EKGPXUE6W>3UI)Wh;X6N1)FL=Hu!PnAMuwdZkWgyI)JZd
zWfWm!_JJ3sWZV-*zgyV6WZ#=DAMQ*Aa+g1^O7)CU(`t=-BiL^&x4*vFeVo_HCoOBd
zOR4E!j(0FTN%ZWgd+yAH(hEQa(X?W|wgK^%{*4zOFGaicNL_PS!7qbWU>)EN#qesa
zQsKkTD!oq7nrm8h+a1ct)$L95B9`7A^(-@Swr0P_1wmin;fscI+#aFm|K{!tY|bdx
zh#4l7m27S@D~6Tf?4j5hQJAnLqyEt?mcwUzpNA|K{8W<+=Qe^mIY4oiel)x$w7mqK
z^0oj-bW5JI9XgU+)znNGR}?)IhieHeBqfj5&^V`20<qBV`_k{{PoF~j``)<w;`|0H
z&TVA)q=MD{Us9p;8E9rt3O{!DK5OEbDLO6ivdop;s#_i{{W9B=we$ZBhS94iNQ~5<
zK|#<?#1Lb7`-E<CP(&oO$YWesA`}-FhaPBSkgBz&bX+fY7{2NqUh6*~H2b|POxVMn
zYH<zGDW^ACFxTE0kRjnhoC-zUAm?1$J^P@#)vY=8FVIOk%;e2zBqg*I^UR7fCzKxD
zkpe}`HCgVcI?2=GzFEH4R<@P(H{GEOF{e4E2Kfbif-XQ`kiT+wOpv#qVkB;4_>6u|
zNMjRdQ`SzuJPan@Z#^%-y%js~Rp=pt+5+|?d$^0DfRpiV!nU1va5De(ue9fp+lBv&
zyHWU|{{Qrha#6wo1%kY%N)+M6{@?kN2%xF69rNVrXQ40v0JvoezFB(R{mFj-S3*Qw

literal 59926
zcmcG#WmH>R)W4ewr4$OKP+Zz##Vxp%V#PJMTX1(tXptht-HW@sySoJq6b<eKhs!zV
zeaHQOxZ{rd<?b(gWlPo?Yp%>S=kuEhQjn8)`-bQZ004L^`CU{A06=+aJ|BPm{OR<S
zT<RGB@D3m;Dy-s`vJXeoRspS`9={lV-v9fJ?-$>}%*vkJz}J}tfdQFH>U2zE<`zl0
zIpH~`an}hZNVA<HlY+z~yi()(h_#>f<y6URK5VZ?|FU&)q93OvDvBE0&Ecl3Ty{x-
zM_VqJOiV`w9z90|;yZv<9|0Z%g}*#kFO2^g1^{r=5%KRC0N8%^vi-m2AN+TK7ymYW
zbiV>H{=4Y$>>0~{t!<S5`$2-2|6cnV4g!I&&A4B@crgk42zd4HMFBApy;q9~9Y9V)
zwzn9e-yI7IEx<N29%~|v$s<jyAEX+Zi&az|+O$2&to=J)`#ep^)5IK&CyYnDYNa-<
zK2cLtWuPzlI5Le{Y%ZVs%&wy*8}^Q5@}OdORo6`*5lA5-^2&E+v~#e#c->o3H%Dng
zwNroT#eW073A7$8_zc>dY>NFLHF?+aM+;Q9yS1D!D3#NErwa*dZq9B2aZS4X?`ZEc
zcdlg~qd%<JhHzEZzCRz2U22gnq?=E{wB8ilHGS<P(ZY5&T|x0EN)9n``}pr*0cIBo
z3^?xYv_Encd)hC%b4^Jli6^E#eLRundY2c4Sb{fm{r%g}m0~gn=kpQ%Pyh2)EYLbO
zKpX=!1~y~MDNgC&{KUvIttxG1fnFXG9sQB-Qek@H{#V%e`0PEE+JAN$ZzLojj4YIT
zE~^SE02;DA^^=XKk540kirPem>7wU#6O@sWVSQ;67AAl)&tp!Q_@89}e>lv)qT4mO
z9Nb*HO?`=P<z%<Kysiw#dZ-8)TJ<`f=mTQZR_zH|9{xmXA7%)-LT?5>^S($O8Lj2h
z>7JgB0r+4Rd(=mRiyV)|e_fUmRxT1Jo_Y+A?(*M3|LKCLzrEeZ7Vh8r*Ma9eytVvr
zl2C-6qYQb_a2^f-hL$q6r!p{J9>M2xsy=w%r&A5#kESQ5M)T2~hn^2x0{z7svI}?3
z&e3k_EXP`z<Cu9qcpHz@J!)NC=Q&v%h9+m&$~1ajl09=%9N!aGrU|_~I{+IS_g9tY
ze+G$(xmt`WC@Q)m@B9z=T;pS6BJjrN=N>lYa2k^umz0-UnObn6i0?s_tU|1uV?F)#
z6w#I<@^B!AsjCMJn;QUVN7rAyyVOG`Jz&@0ezd-dYfWX@B-M0WZty&ECFaC7!`#{;
zl@}%b!yM4eMr42j^e=sOyl5*o*kW%aGuMq~+bo{7(m?)z7;dQNMPz@npX)AQ#v(ax
zvsIlUa9c@7oh{Q55HQ@`wQZd;mnEsIQ)NV}0}Hv)M{l9At&NfhIBi5J$Z5VD@|f<U
zH@!KYtGwF=Nw)<v7Yd{v;l1al{?a}XMHT(paZQe7&Xr%Rc%C3^-4fl@?|3t>*6YNv
zImTz1fX`z?g1i}eEtUDLV0*6Og>1nGKr#XGl;f&*&_*5HQ?iPUO~2Xva>XEZrTBAf
z=cJ`-Z>=wH%cn91KKcjcJ`#chUT0Er5QvufYOe)V5)|9r{`~?9^0$u{OqH<uV{7}s
z*_?S-inQWJ3ff?jxP;;+ibgnm(z+MXx4%Nxa%z8mZ~VI3Ar-H{-{fG&Xy^mDI|pCj
zW~Yi9iG+!!=unK&;8)urtBug3akL8ipH_|AM(pYj^sP~s^17_Ds;OvTP!j%`=@<qY
z*~y42@x#q6_mA8}0VB;{m<Kx{8dEE}4L8Kk$JHBOwX3S8R#rKR8M0bWC!LIHEo81(
zAlBAoWquotrL-}=N3(^qadFY`8ak4sq>@~Pzb8q7qlS`ju{*)1FClVPUcb#*?H&*z
z&v`T!Td(Zo#Ya3?LyqwAmS)9f(mR<p-d>gjv2ql`NXBUCVNm|=T;7f<W_Uv2oU<d|
zqnEHu9judHzyD*aDBi$z;zt0CLU6eyTs%GD`oZhQqpOkQ$qzaTs;gV3$?mn~RB_k>
zmck}hDf09@9h#v-_xqx&$oHGxlLW6opjd`8U3h0!QA}kL&K%HwZROm*`Ab&egTW{6
zT7wX-Q6~rkqw`tziKVi!oWWk39#MCEAf=UbDTBdcCC^HCex~9<2><o^D(Wb_*~Kr%
z?r55;m75U~(O-G4b$<U1xmA~UG%$e&uViRJlz0sCKh64x$>DzDz@x4JiE~UVfzakb
zLlt;@Xkf+r5!zJuSZ&iK?#ZW>qzeTMR}!~6fc)^|OB$INh66)*>#H`2APdyeWXxW7
z^&j*gJ^CzLZ9<l3@{49F-_meg>*9^sGy)ol_tDLV^YxkHo7U^#8z?z@0_}<t;j(TN
zR`A&(SlRuq_EJv^A5_uV6P5`TN>3HC&CNK?eY*m=9D#~RglGCcHz$xhzf;>!xj~Zh
z*<M6Cp?%U$m&ASsW0+KD;GA8a=vjvU7&8<S?C1pt;)g=042e+Zu6`facvZh&9&gYq
z%GA@?jVvLTBV_*@TPL*S1q6vRyx1y9*&6xur;R}Tckp2F4Wb}F|4$FlTooIsH=pQU
z+<dbuyn53s-X^M{lyDo;c6APp4OV&)P(e5FS6ETM9as>9A0o#*1{cg%LQdbAxJRDd
z@Vd_l+!0HPXv8`9?<clqmSlLp@bY?vkxFhv$m^OLF6JG=pU672KtC7C_<d~s%HK`>
z9RT118>|3_uhTqUpS7>*x!k#YdYC-&q=2r}rMLdErNANy6Lg6hJ&s|R<6pSz`T(Zv
z&dUzwX+49^-Fw$NI;sIR?p7c1iJL5gjn<2%#$F_kxH!9Lwm7&;O74`dJkB+E+PXLF
zx9NFF;p|YJ4!d6>iP*mQ%qvllRdKsOvH}`UETG>R(&Xnl&AT{O-lX+y=d9cvBM!+Q
zxS-WEW!FMuE~W>n3|jm~nlIgjcQpCJ1tF(3Xv*SGd*9#4wpuGVr+X*yV(s0r+W85y
zT3PJ(94?#Xn4u5VrM3n(t>^3E0j>OYQ{h67wcr&#TUk@KgeU(kB_s7I^b>wwpOt0`
zW7Sf{@Gr!Nzx|<u_*1q%Q-32A9)(9;v=g~G9=2Qi6GRuxhR(F=Ee=1r4EEY$zDu|N
z^vuZuVliE|_gOicq>ivCPW0umSs2s0n#4`EmCi$t?M_ly63kb;(LRX5;Ig;4J;wmK
z{E4jD%%F8QlX!^Jc-IW|o2W#boZemC4X^enxn;C+4lELViS%dRwN0Coj5r`I5h)|B
z7c#-;7?&qC8rfTkwkVP8BKFA8;%MJOdEvV3Bfrfo1(Da+Z&$!up&Q`Qa5BxQ+~7<`
zSY4kYK%ftuLd#|f4}R9xl5ClmB;P^zof|)|5?&Ux`3i(P=YGGmoM&it4P@stI7_OJ
zl<xFxxvqfDw!V{t9u3h{WI<#v2ynKnK4Ew7FM1!VH&$<%VkEKAGK@zuHdfmX!Mc(p
zN%{=d`}|Sr=k2l!BDH1@1b^-A0RZC+HcP{|R+|<#hL0H(Nw_0gTx$5Kaq*H$6kL$^
zi4-&p2wI_iT^7TL`{im%o)82cu2fMCO!Qrq<IwWdH=ZZY_Yjc!MR)%_Z*NE{dCTo=
zDtKBTjXNx>cZ$av<Y>d^#;c_%kT>!j>TqiJ<B|ZMDV~(1;yZG$SAh1SE}a*-E7>))
z5d*c%5vuByXNo_&C>(?9IviNd1huv}A`UaDhMta{y+;O}hfVMhro>@Jne7MM+&fR_
zhfFF);D!_<@P_m+!gEV|sZC8;^2|^Ji-a7T6>{~_vy{PJ$83L{{M`_**}^bOrTq$L
zXC-lqLl;7r@?Irs+VTd`B*6G><(8*J<2K`=){{BDOQTw!$-BjTNcFVS{Oj3ttRLl#
zn06h+NO2<7nV9pz{qHzf8h`4Qt~6OVr#~Sf5egQ$IF#<X&IaXG_=l~P%#iF{)8@zJ
zCi>R9V4%NtQeJ6JB@Y8<NDr2Jz4ZY%DktNYZnoMcwf2be@fVJ{-uA(EBq=G{3_RFH
z0iN@guL2z}-`cH9QA2UdIBerupb@B{&}gjG`WP@RMit`rm8TY&(08@(MSq3m&O4)6
zcq>hraorc<2IREJTGz3Cz*|qDi%D!wA3F4tY<s1hae}is*TrTNnpW^=3DecB_Y0BS
z&A+jJDkio&I-mj;w!?Ar?OjYV+X+(xqW94OQMwDjTcry=%oX?#s!*H_F3L&c`6u^i
zXi^;37Be`S#$)XlZ}R*2L?O0ki`&f&>(m}MCtUzH*#L*%$Z>l+bjnnq{#Sa>NfK`~
zrKz+rLs=yDUMf!%tzI{Fo0t~N|11j2dZj6Rom|ipZn|82V#&M;drE7}c!>({8$3Oo
z$I2{cQG~O;N#fWyBdo7Df2OBLsB~i{G%a^|+*ETEcs(8$tTTw5RZUh=HFt!xUOFZ|
zj?$dK&T7rJhG_)ZIk7JESgn^oF{L_2jkp<D+%=d@vM}I9*E&`v3`?uMFT~+kT{%fm
z&fetVK@xE~*$o%WJ%wL1G>Bg7$b65<l|H#ip(44|M%N==%bP{vA0i~47k}*Em>bMY
z*p3)YTGfXM|FEHC+`{$zeT0K!-u`|~^gS$XDB7{PR|3OO?`|Vhqs^r1mT|d)vAPW1
z7MxU_Shj7swhYF3QD-?@>Zz9e6t%|27A7Axy6zRK&~a2`KgHe3WoZpuXGxdOCDw1j
zlju6Ove2UowLS>Tr9fM}?>5%M<b1+)h#=3zQrnxjROlRl$ZSyb=iP1GgC0aCOK-LH
za`}2&RImlcv3^UAfBid=>&eOoN%PlB+3qiTbw8(N;WO$H7><$S7Fq}{03UsuYxrQO
zr%JBOh4x*ahC0CI_-`Fh1`2-OHP2xvep#6W`!PRmlg~TU=A`BnS~|)7e8*vI_Cbbl
zDLKddbnw(;i%_3XRRd%%M^a!NkfQf0;dc07?pEif&l$6+0gN#Qt$5~Zt*<}rzVQeT
zy6rX9&W;RnkFC5rjD2jvd5p>XJpYn;{($wegIKZ`wkZvjE@L(R06os!G+4^!;IqWQ
zR(t%s+f(c<!5j4y=jX-aLpd#x*(~IH+x;}Q+a^=)xt66K;%Tu~dib0@Q1F`Y2%!>g
zll|zaqthE9x1PhzW#4_CJREjRYjqE)caFTtTj#ELu6-WlT*R;(An^GMz}ILK#D+|;
zTip$#H8s`S&aFnjQSF^iu@xoWzPFWAupYG6Li*YX-VZSIBd=IWlX-vZWkJWS@fP$-
z(0rba2GH3vAZ7Ck7A`cJOmqe2o89F>8#@X)D5B`~e8dq$;HGPGScct@3`!kbNtF|G
zS?ulhNpuw`54IIp;U)Kap4U(>TXyu0HFoPYH`|}dv*)#udf!oc-)~^}*V&?Cdb=z5
z2&EnniniG>H&pANO9vUn$pn33=p$T|;Kv3OJ;%d$KczV_<cVbAqVD@&7NDoj0W*)K
zPVCyO2vlK+to;tk<$cu(eSCP@-9IvJg~Jy~J&{*iO>c=gZ8BC5^-wP-y5oJtH<#;q
zE?WqzSvl4hF0en9MQ%+^6XV9lN{NX0Vv;Tp7kRD{6B0&lb&ytH^{rQd+Ek@ITMGr$
zoLnr811jL$%!1yj(LK&2oYRW2DRC5M_O8cv8|)kcD1P=5QT`6JK`Tx6mw*3+-#WO%
zoa_x!=?&)JzH!N0EGaaW-i*r5Ld*Ol9B1=M5caFm(Tq6SBHrv-?zK`yu|&y21;p4n
z*%k?-jTXXx=L7ET_fdR`kstYmQz=UE^$KVJke_rSFGMtP^V323gL+kOd{JpHqR`mi
zubq*nY?#cub1>soSc%|4aXZ7Vjb{{pXxE7WhYFY-b0Lnj;dp019e+(yY@v8Ak_=!^
zGc8jUR3IvWAtB0`J&0dd+zaJFbbvVNvq`ezZ<PJ-2AUg4@FMZ4(zwA#?1sH=uEeGO
zvjD!@n7o@viYIL0LrqUhn=_(1!`N=c*;E%V@y)REkjL&|soBjB<~eWfiC~yZ{6du`
zSF2sBGq*r0T&PSmG#N$XuvK9WV4xqI<i`|FOQ(vc^tMV}vYwwzd0BCj{bfM@!=UdK
z3=d;wT}3oAvp01c7@0=>3f64aaa_ivS8`7-kX9u4SY2Fv*S?yssjNqebJ~-aKK?Ou
zR6GsMU+HA}L{IZ&pS?nP7NxyL%65f;*MS6+HeP?&tplO}j~G)XLm?(MHWJS?pDZYV
z6Zsw_a9$C7sJzz_I&}r8*HTN~lzuR>Syuc^D|kIC%$XdUW^diGbg4^Bd^$fkb6xl5
z`&2pOHD+8=d}Z@oOHtdr6Svl=>sJ0x1L;SxqC4{BWXll~b3v~L(TBf7!W3$Wg^}Os
z!>aTmsyrI+6WoV>z2lT<`Bpmn9h%%v5~=bfW605+GfDXM#$+)Ls;d-_RanVUe=8>t
z`utdCGbS6OCaDu>OiQ;X7*F_41eLw4&GueJo*GU=3U(={0L5NLL$G@wy0lHuy<@&O
zkygss51G(7RS;bz^t1v)ePP)<xMA$pR6u;=ZeLB_CNsOGD86r6@wn1T!n@WcNB*I4
z-V#%2*;8ZhGgiFQYl79D%?csDh?Ds);C!Gk5*4L}D0tH$Xk(&GA=g7^#g2fXX=1Mq
zO4dCp_#rukW;93|f8j6Q6T~v3E*+I?s=Zftw4z)Hc+Y82SUNOBX>SRZ4QFsjM0VBA
z+vs{BSu<p);|4{+YBCxsXEK8)gfe8+lldNWjvy@jm{?pX(7_LexSL8QE$4YP2HP8y
z<s{Z)_Am%X>zzeOLC`={54j*A;0e2ATDKieUa%I)=9<4J2ez;Dk8cx_qlTSDyz?|)
zirYvE_u04}zVkTIpFd$%6*a9MkG&(D`fPT_EYQiga3}5G$|^a9lGK_T+Tt4!nmro@
ztk`&jT(xbl(>U60MVij|0OsHaITR9EJS6OzeJMPQYjD?PewWkq9%;3uCg`It4?8^_
zU7OCMFV&dg&YFK;7SeX9()lUJ+a6Ygl4qd{x?|l>ea}R+o!F>AN>pTJr2S~ryc}7|
z!~t~Crg^d4Q2_=#R~Yt+_~e{|6rJ8=vVT4DUy)sDBt+6tGkNt1KXcKV+HsXm!n=S+
zed#<&XyPkpwssiA`SdaXy!&k;qi$dIvhKA2<AO2*Ls;kYZ;S+uo{QL_L8ZvMQRj)B
zu??}E-!7`D0i~wS)os_e1TPH7o!9hEGi6S8HvRjAnv;)>@;((!Gj_f0t0Y67?8b`Z
zXd##vrpFORjwB)h3xjLWd*el_AZq_T0mqZ=2tZTn4q<qiztOtY2=#91#CeTC_;<h0
zjlWG&ui31hi{D0tq{}4c9NLc%)_d6zJlFqcNj&D}UN{u3qtU{foT=V^lnq@V5`Z{g
zRj=N@zucrsm8FXA{0YaY)p>s+!L0Q+wdS4=bg953WOlcmD#>?tMbYWS?M`Dj*1a;C
zgojPG>uu3RW%IZGou_+ensLQxMPr4wxK>c$i}a~Kqw>JHDWE53K1UOwj;u5m;q_qj
zPIU*107W#v2nRDNe-}Z*I@|P^xR;Hy(nJ<z_;FbqTAk#L#qO!^&p0$_QPv8W<+ZA$
zq@+bC?{X;7s*Q<>iABk-p5u6pi?r|D3S_>S`BZ;ym{m88tQOwb%Hi#zeJ3`e!W1u^
zoNrzZDf(jvTS9@f-kW{j*SB4%3!goSe%!xvKigZi&E@EGRry?>Ku5?L*k^>!Oe!5!
z*!Pkgd#htWdT^YTz<c^zw>`!i7nKX>vH-i&HIJ+(Zivv;9(?Z`11YHHfRXT*VO3Y}
z;`OL*h0<NmE(LAj9uxo3F^U1uDz2xGa=gf1`}y(k7djJg&#mskjlt<X^l$*(Que^g
z3V+%ATH_=gW%I&$q^*HIA^(P-edKnO_2@C<Qx&QA(5}8b2FC9a{+)D<@V}Y$Wk)*8
zF?E+aS*~{1hrR*t2fFIscjTad8!bm!DJ371o~vbzJrK0Y=haC_iFo*fu1XqWEc7O7
z$7EC(d0M~8hn4EaZG%Ve%jeWx`4^k1iJh!%FYw?UzvI?PiZi&I^9TFZbwoXgRbxT^
zMd9AIl_e@!3msF<IU#8&(U%8?C+KU232$5|zO$nB&1fW4$WUO?c<2cg=g=DP2iMs&
z;Z}b%H2pd(L4zz={(FA$GkuidW8p2t6<Wbw63AUdww%~QR&hJbuNfXo`M?Vv%JDK7
zq*>uEd30Ov*>RGS?6lFeABpr7Osk>f;cfk5wJVSB4fB^XZ?Eqdqd%Y7o~i1)U;y>>
zc6S?Z1R6-0^h_Ah3=R#M8;+4-Zp;^k{TMQ-1UoVVR~!6as)ww#NxRLthHV0G_G-|*
zd)nmmyjV(1dTEomAxrEbkaTpN7k{~E<mXy0$Cw{(FIL+gmRs&=Jc6Xz<<wF~dvxkk
zA`+6`;d9#4-H#9u63JnbKb};6$R603XVuE0eoJ)JYBq$qGG~lkfqc7f*%g;^b3Q55
zc@rNKtYV~bLh=()YOEK$Tzi5W532(C@~88rDZ+`BnWO}9nK1|lTnVKt7gu_$uWi!D
z8d*H^%0X=bB~cq_IaXvVN;6ZG-iWO%0zQd!TKX87US+apV14~R3SYig-Q4#=Q|s^B
zoP>~V!#jzSA+aE=L$MP?3-A14$j{T_$EJq|Wp-A!!#U?~xI@i(yUTA(8g>=ipIGQu
z=h0H77{ba04NUFjW$V)sI0e1bUR#OZ$VJdqqxcb;2aowao~~QI#hueifwVU{^6tIZ
zD7tR(4pO`CbI0yP;q<o2Xb0w`^iyQybQT%1p2;*2ck9n>D_e5Sp0`62rK5Tun_+Pp
zn|-KTyB6pX5#GoJ`t%!K&GfJsE0m@pFeB%5qR^=D6Yn1fBsg<P4^x&bjpp}86bbSb
zt>jpzZ=UE|sYTU;74<jpk)t+olr*0toz2y~!D&F}GgQac>e@&X8e_{+=AkK|<AT<Z
zA0bw+ZKxj3c2#b#MQ|7+nPpu<HDikhud(hJ(dBLe%9*K_vy#C39ici~=>5TsrN&P(
zOyox56fj6luqgS5J6ZK6^P|Fa7Pgnp^WL{>IGoVQTK4E^+RA!nnj&#giV^Vwh4DW}
zd3r7p_%Wr=>@>_1TT)9ZDk`9l5ckfzhx?l}0cb|r_3gz01ry!r#ZGcunz>O|n~OjQ
zFg$Z=h2h4p%47a}lQ6}>H0_%5(`Obo5gT)@qo0$02P+5X8rX;XWNgcEskqK#qw+J4
z8g5Ly_ln`qHG!0(I)lUmb@oW~%9W%9+_QlgNwg=>jFD@=IV;XV6i>N#)#0pFD?YpZ
z3*hnPVKVlSA)(IlHvGJ1>v{H;v#d=iQ&Fp~L=vdt^bq_Qrn^hjaF^5dlr!x|QO0FR
z;v1nFWw}hCXk9L;YdjK6U=a|oal=meX5Ty{nS7`Yv)<7Z5Obk9L!N~5ww(%e6%Q%1
zMdo^a*i}SOj4q$^%#Di`BHVzrs}v3f)1T8(FCXsi569br3abJNwc;79k5U*>b*>l`
zH3R;xz6*3%^>rs}&Z!9o$d+Vo*InCoyEpQbXKP5(KF2u3d;+?wwcn>pENAnx`f{5E
z)&~lZ$XX8a)hPmpf{!~(IH^t9o#)b>GzhC751C{50<}-B{F_Ah(v!H+JEHaW?OU*n
z=U&LB^qiH;lhU%`Zq`9<@7|kxBA86pf|xtzaj)>i60q2frGa^Uv>dv+55M2=H*E)2
zjhnQ}#l_()yIC*qC!VjtBtqgL&33{ra)(iydS-`e4-P$S9y5FE@<MrKsU8>EdQyCg
zhnA0*0^Y*Y0u6e^LjJv7+4JRYa)-KJ9%wR2@i8gXu=^;~5HP}wcI-P2=P?~xNLO85
zjlodWOG3lxWIbF}fhF`ZuFBU>IXHY;a@{=0>K_qE;Xcs9yXz@x*%8Zp5`eh2J4|?O
zq9UJV;pdfs``XD&Td0CFi`VFbF6B02Ik!?~y$5ND00<j$QR3nz`3DJ?+m$6!=4jRM
z9`aVm?f)=yVYMd((JjpE!tHRMa3Oax>CAP-_Qs}*dQwK+tL>O;|Mc@E*$^xQ=dYG>
zC!dz{O<Ovo!4YBOoY~;sM|jjMwzy#?76J^;ZCD=8bR0<iHu)TQt#x5X-<)Qse|+9&
zQ4MSqa5Az1b2zEwzWNh8_tUZvp;!}eUy@$>tUSQCMMq3bOz!Y4Q@luW+cLrBZmGa6
z<j$mTc*l0CtMMt-oTA8`6!q}mN<QNJPN_un3TMW5!U65;-c$^r-k<+gc9*2NBK065
zrR2Vlj^1j8S1-!DnZ<+5{N4?M9xrbw0jX%bQ8jp?(TMJ-zAVNTXSu;<m-|Dw=Sxk(
zm+d2m{%?IO?d=^%?oPjYJlh(NY{S5KD}h1W=)TANn8F*4wCXc{VV0sw@UKYxRaykF
zw7;MLSh_+0lnZtU1xWUfmYec+?)bm7r*k4d-~1zcKXs;>FZqn+NhaOl^xE@3TLD+7
zr<U-V80*sfdmB)q1rkGHWl<48f05MN9-%m~6fS7aBm35;3~T~@k}1g{ED{+C!%0nm
zy4!yx(XV@I8W}*Kp$Z*q%6Dbfxn3y^LUW2FB7ia~ro@EM|H!7|{X^1;y}6Z!FWY66
zK%kjYUz35BT!F(qLN?0(I`$A@S5Wr<X8N^o&h!8c_#?65DL?gZR=LQZg9$yyGmrbn
z>pmSmoD#aarky+b{WS_P@hV?7L9zAZ>S_TP)I;6F)i1^ZJ8%)TIf@a<=LD2KoNvR0
z{~5u!R?@EziWqUM_w4_P;8hBUrP1c-M%ii*|Er(}BmMD|ROrsdb9W7M_Y(n)sh8gw
z|Ca@vc*{y9n>|pOJ^N2j_s)%ppAwq%0%p`y=lfKLm6!8Q(^%8USo74Q68t;F^ROSn
z(i~%|;6<s-k+|iwIKC*xXN>Lt-usgWjMN(8oHQM-y)fHRXnQOCKgzzxTT<T()W)y>
zuZsVZs_rpT_>1p90sGzuKya@4Uk$;{FI_+n?UQhim4OcYw<o~=Ss?KLxsu@j&j<D2
z0nBh;P*A*@@_Vq<?`Hva)=>J07Z&Fi7pka&zQhKf76!k0K92Vn_sL>XF>o9XvxnZ7
z?T0p{M`Ip!I(*6_i^=ZS=t8=tR#tbL!8tm-TITPirKH+!A0Cw+TBHEF+#ryjx#6IG
zG7$m6Q)fh=WBu;WGI7|8q8hq|Uzj_X(KXpqo)*MH_0#v-HskH?thyX{#BCkatM%Pg
zJpPHyP~6^Dv_HY;2yzN2AD_5*)lT9`&V`Dpb)iH(GBo-fM@n+NoFPTvV6JmRG($V@
ze5-HOvwr@&5|c5P3;v%278amkqQiD9^tr6Em}Mk0)AVoRA7sE>Nj?#3X+^q{LQ!Rw
zYVnKo=eh}oZ>b0X&Fw@ufV!jchdcj}C&4n`JvlYac)7wiw>afV0GC}0aJC#C;e*Aa
z_i<XC^d^pmzo+~eP28qkbs+;0$pXdYTsDKy=aW~`T4^LoMLf=oG=4GYlBTtOal7Ub
zZD;1EpeCNMU2mSlwq>kw!K;ykPpqg>MVG|HzW0IU!D#=AF~SsnK5IuWo<Dq6s<2W&
zGuEed2J37#T0O`^_Qq|BF}=|tp;(>sK)FKo4@<th$KpH#mvBd}OfuF2LXGsh^$C*S
zn{mrJOVKhHDfAb`NF{yM^?LORBLF+PM?Y~KF7Z~$^;}IgBO(KvKr>l0&j-InT?FkF
zfH~I`-KUI_60t%z_Y}8|EJj5|>39mx+G{ib5#Lls{nuI1iXhrNe0K_WN$Ay|V%NE?
z?&`|{T*P5O4u`!)I08tT$m8PMl@~^~(M>VA@7JG7oW*9Gq&)}o&6RnB?qnRobg)=?
zVRz$OtIj#gYIQRF4vZf3(RAg|w{Nm&(TrzQMB*3fEuZ>erD6DC$ZttpOI3wg5BGna
zb2>L2G0Q@Ha)r%F($stOvB<2hUpI^8XE>RomGdvppZN}mQ~kj<+YEZeeyU^+@{ih%
zETqf%R-mHNZ^EFA$qMX@mykIB%BtQQeER<Rc+xaK%C>Mtz<UgUuFS|2GyKkgB<Eim
z9S}LYR3dNlm3XjFz!Xg*$9I?Oz9cgqGdQ`6vstNt1eZ{{9JQ(!%<elUgFPL$`ALr4
zE!CKb261}QWny^($~0T7@;O3stGIQQ!2zD-#%ysz{ec&j2+WOwGvkxyT*ky52I;_&
z2>0Q+W<;OAAl@!o3gis>Tbp?G^H`u<4DatpuS=xA6Sno9Nd*rk*~4mx(3{nvs!29c
z5G+e@vBLA364iW=_L=AS9o6cn_H&Q+_SdQD#4=9+0y=R-;ncTth$FD~a#^%`CkRl@
zHj@Wvq5E%1<+5^MM1Ch>bLcKT5K_%s!V5|^!8Hrw))Kw5a$|7U?9F&9Estg>2cFuR
zZL6y1gWcB8mou51Sm|6%Zf}MxhY!*iue3f}-nWu%V#MyTNy%zOi6?J1ymSEJlG3Qi
ze_!FfZ%Lop_Uo^TI@s&Xy*iTN|5AA#LNFjb$6|XEhs$dMHa^`tV5bOpAi^&&X({||
z?5-Hn%Pd5bds41^Rhg0E_qGZcaujlJc6k{+{;C)YBlP!cpkHohc0}y1^?8x7YdYCW
z>P1`uG-qS|z!jou-XvuoGCa#K9e}@LlL-K~A(%BOZ}pMYjN}>eDGJbTjoL;mmi@^3
zIxDRk<F=O4G8Ra<4!5qy(|xf&r$m-4yRr6Ld8b&c2(t9y*wtx&UbzB1mF<A1Hxt6k
z%&0eoulYZ4H0~yqk^`w7mpfa<y{X^@2@KDAo7|srr^9{CXT%Ov-sqH`*fG}iX)@X9
z;GHc>ldO3YbVC(?WFz8Gh>uUxlkz?c{qyk}J4<&L8F7}<kK3CW)E}Y5{mv$V00PbQ
zq&$E({eM=<Vtr=!Q1bJsM5<oZ@E2yGVEbDFltw1))~vUY)PbA-4@l0e5h$(9*}}!c
z;im1jy)Bl3J!HJ2g@7JgHzG-%c%G>0y<D!xNbWPn<Pn1*V~*T@DmFrcs$naM#}#?!
zl1qCl&b^bK9Ja*YfUoevLOPZtY(?^y3wD0JI6nA3%OC!oUjK=Nt>TJL6pt-lOnd^8
zXRbGHDinrrUb|+B+|Y7dU0$k)`Io<uRQN)Pr#H#yaf})@7b>Bs*OhaVe*GLrVdM+0
z`<<!J_aaUpcOHj>#`abzCG#_72kxSuaV58fcs_SJt~!zp_tx62+EaEeGU%1;l}LUb
zjV~u>99>)BJsy8S^v7oR@Mpc_Z?jh;p8(^?9h3ilzVAZOd{Em+A{;oJ?_%mWpgPu9
z-nVX%;;W}{)VHMkR@;9SGgkGy+B|X{A6nn?;be<GQOP+HRI*=U>R#y+tIu4toqY!W
zfo>L$TLsJfc-CV%j1^9!p9?b6ILb)_#D_`rWzQ<GQdq}+bss!&NgVTq3GbbhKl9PA
zPIquaAnV|O6Gx<&ZcCO)OHDq0-Rnfs4BaJ8GtKUg(l7rDG5{r-MvY&eq=ul7L+!ve
zl~lvIeqxGw?exGhZ?fjdY*HQ8gQnDz!e0P%Bd(H=N0-fT8j9_g6Fnk3-+~(HD}mNW
zy<gfc&>@ZWUoTYSYF$SIstnoG_lP#ulqHn3pVDN50!@+KLlgS2jeJe#O+vnS=w{{W
znKjMl=`%De#<Uuag6~ZEo-H+!%C(S&UXz0;YZ~eaS9gipL+L6c6<~pNVbQ7TFWn({
zg@KNu1S`v19t$=4u4texsfry+k&Mn=n?~jmM=A74P-JO4d7r!Xh3`G%R5)2?o8@F9
zzcnslEogQWk9wC+KejS+5yihpcH4Zw3_KOuSFaV}sFthzv=t^#!D;cqAyVfa1VA@M
zV7~hLF}yitcl#4HHZ@H)m-57POl6pf!I9Mn9wHkpr;%9&iq^|gRas?oDLU31tfcrt
zIvK1cZocRP^M=__Qs7i!;*o|*p0xaIV$`M<x|Bb*r;hU?4y)W2UrkMFvR+z-HNJ4S
zA-={C3d=22WOw&@$Uk$)Hs!Dgw>o1YO;ECrrehonel|6nnK9(`1ezlvDN1$5CYvuV
zc8H%iP3RBk;{{?@xZDG2$L)4i_Eg^^Mikmpap~l!FIg3(^fEktIEnpD<W?T_u8NT9
z2}#SoMrJj}kMolT4Op6BSe#Yj7Xhk@#`D?MWnQ*gN7ss&-Fm|D1@#L%=H|4eKVmYx
z>QUmXuH=^|q7urV1skpr-aqr=st&AfuiYYs6VSh*nSTl|`8m;p@YN7jO@x-tMK1id
zoSw!lDx@=s;^SrRuEf&8Zx~FM_TyVgY~GN;HpdO?(`u?4s|wN~;(z?3us9ZN!fNN$
z{n5c?{m?P=8jZ`#o^y7o{i}0Bc`IOU4syB_bZ@z&s^q~(;Q^hN6wVqABZaScLY)vp
zLQog=d@nWu^S=07N3B{L@RE1u(tx)O`Q0hP7~b}h$mCM=<x{=TA?|pDVdy5$K^`1^
zDILS->@&ijDGWQ>^pCPep7rg1XYGN8g`=VA@tR|!XghC=zPRc`v=C;6`zfqCv;I{a
z=UDOY$;=<%197)kG&g+-PWI_6pXQpTx^l}Zo7-Fu1R~}Q!?k8zknV!O6&c-KTdfD?
z>xZmv2#yeD&EQhg=IziWag-Ljm&<}s82G+td;o_7r||Fan4ZqoSV5_P;OvT(2tCFK
z=Nq7Rg~2-BkziU<_gocX$10n4LrM6KM_5NWyEA6$TP9xv_xiU~1fe@*Ezt`;t0mDp
zA1?>S@yRn^DUx@cs`R`h<i~P-!2a=<R_sMry;>VYB#_~-QepBNBD7B}quKd7kKAv#
z31zIU+C<~_Rg*o{H|%5~vuwU28H&BY$!u@O-0X7yfeYAc_tuQ{&LFRqC!1(W<KUNt
zuOT;eB-kl`V+xRx3TTt`$<<XZJe-A1;}sPEzMe&c#k@Im{#ZQQ^6+C$URJ}so@rb!
zq)~ke&9~^Roay({5`#0d+c*PN7~83JZe-nhgx}-W2wkKp!JjYXE+`Va!EF4%c9~Es
zXVqsJ9m}LW6`qebd|7jy6X5-PNLL?<2^2q3Tju<$n4+nJi-w(i_~F(7R$1>PdogOd
zM%)J)Glla-l5`yba*6AzdqZHiZ_<EoiPC-k&=FpB+=9^yj>RwIqNHdz0JrB^Mwf!{
z-yur!y)Gndu!)&bnTSH3m4x|Up~Pm9*R%3qbaVI4a;L<13%|4l<B!-F`ja{+Ayr`K
zHm9qx7loE%R`mF@04xdO_0w;{z1Ks8JUt(Fd+r+w^40^TeWZUWb!={<H^|%y`rh)W
zN387+Au^-UK?o}&`b$X5?c$kC42opDax|O2D}k!-Q;1a?ym<GCg3Ma-zKBnw7wh;>
z(L0({0a6OHt%%<yN2F^VBYYJ*5%8r%L5gNK);_XV@g#YxtLqXN4r>)T*98@*W=%!8
zooZm-kR#HHkDYADBCHv#y;38x+Qr{B>A(1@<|(bt$m+Ij@w_3qfjy4sNo-8rQ(^Q2
z+#j5QyvV4pQdLCFR-l)cSG}o|tp*)7oRp8#wX#~#44>1~Q-E1(ox?I6q*Ri!tqy;T
z$^v)FF3DM0<c?=+P8$UkF2KFz)mX=uc01E)1@-CiMC3YWOHYm!afrCx$m_KN&)TZ{
zNQ0G9oN1YMPDgg-t4f&x6O|St_!MUjrV?tld#CmN`Sne`wM=AB$cxH})4)iM9l-3j
zyLZ9QrY>%rSuH(5!$$V9kO6(HeZrvQfl1q4b!{SbF`PPhGikDy&Bc}kY8TORS4J*>
z;Q@Zm=!F^iY4ryzs`~|Tot`18Oz>-DtpS2Y^r7+OdvN!uq6SS-RXJ}~V^#5JX9?Ap
z5cD#WLfwRSvuv3$OM|i_3?2%&9GUx*`qi%F*!)Y4+(-qLrIO&hu@z&@v4ukO1F|^V
zwQTf)VZj$V*<e=^y!;n{+RzYGMstvkHG65V_V>|}lbQcz0VDJ@&gr~oBNplYD3x(=
z<}m+Ms&&Zj4n;iZAlQ|O{I;!0%-1uLEf+h~cz4+$(=n0Rke}PcF2<iwZHxviu&bzj
zIiGhpQ?re&usjmnq$t?4T%*>vQQx#X<Gg<ek0pyPnmx3DXG?&)c6I3YjyJ$+dL=s*
zFF+?T;ZG3r?>KAdNJ@qYe$rT1(g1}iGJKZI(gQQS^6>X>b+<y|ZCZB6q9{K9x0-(D
zOJTr-$eh0N3LDDRZJ~JS##;|{c1NZ6qPrQ33(lk@)3cgM9!&Rw_t(U=N7qt+lFcC&
zlLG5ZoT+?t=t}G;v!yG|put_9-I7N?x4Cj@u~SSkLGM?MiTK&MD{Pq|muLH{<0any
z!+tAGb-%(xjL5mr6Jyl*kao_MbkgzzpIvZFo3E3=G@r5I>^p+S`j3LDYkt#BuSgvC
zl8RW$3o5AgJya1Ei}0BwP%f~-@o;m;P<D)jODf$%LL1~S(^rHj*6naaphQIza~`xI
z$at3`PmWG-X0r>~U)dfHrne<7|DqafrCqIm8A`kZxzu)2iqw|&KpEpR+}gvu3_IYr
zS03WeIoLnY_CS`$nDnJKkl;gULk`+b5hLWU7AnMeJ}Vy`7vTInIFlzCi*Qmg;b`x3
z^%0O(?a0bI&0ywR7Vs8~w^VjK0g^Tfv(Hf{mHJ*d|1fnrKX$HSYIC7mRn^Gh&ACep
zoS2%eie_M^1x>V+VyUQ@T0Dw(cdPAdQ2A%R=UiDF8#;vaQW<FE1jWh=^&O@*UG5IM
z?JF1UXG<MTP7S5e(}OgTr^lDhoMU6(@d`$3oT1MMkj`ZbqW1#(CbK0kvXnI9q80Ty
z90pSiMpF}e#JWB7p<H_|0kL9)6+!-Qt-mS8#lQE#o2pj!IqXRaF1Y`D94T<vD}I=l
z6HV7)_;)hBmXW}awjoh#@Z?PjOREsYYC1YfZsDY9M0#C3RdRoD)cYL4bv@GE^}QaN
z9IN;Y3UU8t5`sGiF3tYM$@jGFIcvi!_EL4bm2%35Gfc&XMoKjwY_#LY?S1R#B~&)E
zF+DSs(Nw*Q8Ax6<^Ty`r1>qM;v$5Zb$LN^)4^+&?wum>gTKl*!3rU1!$EzfnC#C}_
z4#3t#!Qsigm%`UD_dif_8cRnT4WtI>I+u<|==F}ds)w42=@Pu?@gu6q)=cu{oO3E~
zS#C%oDH$I+@j}f$g!V0CiU9us<D#VBtWAMUek8ml*8U!rdP<jRJrwFpf2Qmx6CiUV
z9~i$Iqd4k(vU666TDHCNn}4$4uqwP!N*S@MiF~axC>46uN~R-gqtlY#XfV@1X}xWx
zCT?*)z#VA-PtMMkFm*W4k#2zey1xReL8%TVehl^(l`@;(bN`lEOy;6<yrFH@m}QFC
zIx!v*%`z3Jz2Ukor@m$o+6+)7urnw7<Il=l?{=K%T1E}8*RxZDzsQq!wJAhuS<{D1
zji&9bty+k%g_8*8HD<#mIP$T|RNl4NSbC*JB{cnl04MANn?O-FTQ!r!d0hMT4!_hf
z67FE4o|_Nkkg!&euq8)G9(SYDo*moH!;G?G;<XxcQShycH?@psQ?e0Q++ug$ku$s`
zv-g#gQ!&_CW@jdyvu`5?r_^(MEeMkgK0F#oH0PR6#?U0(acH$Vv7McwvO3{sj*g1*
zR4AzipX*&+Y&`z1x=~p$#4Kq(G|-QY`FUolt|n(z<&yt2#fZ4p0|mq7BLe1qtwUrD
z+zOJnzNKTj-zJw7^E0_$SRmE&ylPS>8&(E?tK03OwPgCPaW_5_S=8*SEtM<S>Ly(n
zu|!8lg^6d15v4baYLP;>dThlT^%Fgk7!%!GV7M1PQ&`{Yeq^I`ATR5fEa46-9f3|-
zPX1;Rtja@mZ`&t|c4rFD+C;a@I0Ol8OH()AL3cqcjaS|qlNmq?i;*yTe<_M0NEsA&
z_bcGft2p@IKz+-JL-&j!5SPMnKxyEepqK9Pgn7m8z)#;PP)_JB8C>mkWVUVU!{{h*
z?Vs{Arn3l}l+#f)NjAtaBGM9dYVP+3Exxk_|JYwW%QzPwY{mjB6;1FB7ExM>SpSG1
z^_pt+6ly5h)7YSn;}DpsdLyRmj-3#N1>E=aV8%ToEQvUcuuvKNE3;n5a+>RF(z(ax
zdf*Qu0XEM3#V*Tq-s=x5LJ&MtC-c>NCA_pH&v8R-h4y;$`##!`my%F&A<{fD&2M{g
zG&`zWu1?T8dBm>rtJ!7n@3s%VX(d4GE%_AhwHWxGHawS@@nK*YTf2qYd4K0nKTXt9
zcK2b-wX7HZC8J5<lG^0dH*JX{I*P_Z;Q};Sh!rD8{_7O7&ZY)^<Ln)XADndZk&O}F
z7gjl`eXSgWzWyKyQw=b?RTA)(*N}MnznCUo*JMW%eb)Br%)UdWis1H-sVbx0&8Eh!
z_JcKjBP9qU6NS8v)Y3q6l-J_SY(-NK2=qhKr7mA4R#)3CzVt67vazB1+-8;3KP!mU
zHwK?tkEyoOm4v^ukp0)}RL}1ib^=*-or$-?8I2^&A3jLohUJ<%kzOVjov(4<qVQCm
zWg5Qk7G>h`{GzkA$KDwaJrB2PQ2D3Y#bCV+KEmg=-JMf^)dJ1u`#MyUU1echWIeCB
zu@=)6$us(_3(Vl+@OS>^)p6kO9!P?+?oAE@C|tNfG=d`P+7T4~42rB<n!u{gAH`B}
zuVXo4LL*=?;H24^oEcUTp4=qrVu4*06fBK3r(_>S<}^EVsIru+akVzEMw;C|PYEqU
zG^w<_QI>8+sp7u)7SPD2BDOj+RPY0n=_P=y!U^fRT4{nb+F~UCwo=Ihv+8s?F5fE5
znr}X@(%`tEk@lPa3^Je?#gPh9R*X~6r3>`C{!D0artbW^{6f?K1YJe`1{UsD9>0dn
zb{7M8#t!oQk}O>B&$vQ7Mi;8Rsxmhh=XXyTcQpTG<$AG$VpA|oBrYqAX3%8FMg}sq
zJac&grA6-``@`25NNHLr_=QMsWNDbM9unQ|fZg6BeN|GC7^zD;RlAA*k~j7`Je`g5
z=M`xZdNJwVvVB<G3?XIB74}D0$1(I^0gr}8Cz)UhcuNyYuu_>RK8|vHBUcdpOr<48
zRZ_#Qx@Do*VxMA>a&TCp<^2tZB|wIobbmjT11lYbORrorOD&teo>xr##4s2K^BtM-
z`8>SmT-Uh5(_&`ev#s|gslP~!6A0KP-OaDN-m7S6tCUjqV&pOnX(A!6s^vwJ_8kYF
z)gLMpviFD0J7zfE_8DxyX4Xtb*KuX7=AB^d?z>TN3Dfqn>AA~^GGG7c)yw!MMRf0H
zUTX>$*fUr~`o<`<eIc%-#v|`|WD)<yp~wCCO?)&}%sjtKvGLfEB&PTh6JBohgSvL<
z#S6wUc-x-5*q?CeGQoBJn+f#Kl95f2Mg{f9MEL?Yr!~bd=EN_32c~aOShg-8NANso
zJb?@-RW)|ex5vc9?GC%$NZkrki-RpLHS4HLf>G+_j(ewsiA>34?hpSloEH6*POfRS
zdI9uMh9()6NO4bm@}p9X2`&@)^ftn2R~SU0HIjFb%XvUjhVR5va9=T}UPr-63o+;&
zauhG_zhS!jgR}sZ;NaFz&aEk2Z+x>zqS}h*zJGZt<3Zsz<^(8Xjk>Er@*^r`NJES)
zj11XKvStBxU_Pwe?F<g8rTDX0%8>z6>FcWy8BZ8azPXqR{bqNwSfWPOgj#O|cVtUL
z<Q3!mW2>N!z4eL2@9ao%UC8k*=b<3m^va<y76~Y(oyB0vFjK}^)y#H~Qr;z$sfjV}
zOXH%`Dl41+E~frnTHNnRnTqVrEAt{QwxiAE5XF1kUr*Z>pBsP4@|52{CS;{-4+|VE
z)otREcEqh;X2+L5CEBsYNu>BlQc7vGw>FS2twEB9Jp_Z0aXP1{sSKJ+!guUB98Jx&
zkQIp}&&{sxkLRTeb$>#9`M(#9PkidHV?RS~W_#s`kz14JV^=*Xva`&$G2PvhR92@&
z_j-rc@#nKO9_(A1XN&|5g?od&q#hcRMYn`eY}R@{d>E*DI<3+slb$Boy=$b`wbidY
zlL74_4vL)CZLxv13`vbT0@QdzKgVLxdz9jI2+Scew+Ov@LXC3^nR#cSol9r@D{R~A
za8fQ7&$9~4o&|($=?P?4z_KV<f^jpsabrXJVgB~d6s_+FhpLp>o~nc^Ty?4P)?{)9
zEEQ<9ljz$NHIrH!b6Le6EOqMyW+Tw7O;Nwbf)xxy?_z|9ue`MxDHGLdQoXCmzIYVW
zi3w?N41^XXx(e{~FL?)jXh?OE<oMDAlV#gkC_2=MhPl3UD&Uwovwt_4FkC}EgIK?Y
z3^uY*0>%wx8tdKE*@H`U!=yiCn-)Gsm8IauBrh~IIsreMh@rT~9tixT=)Ji@o+Puu
z);p9NVx@vq1~#0Yaz`5znL!(>zGW4cw_YaN<gK81U5dW9_9lVMdi^s7<JWIY+=G6a
zo6f}A+6>q3;s9Y625qT*YKqD@s<V_Nhz{SBd3P}KNt5Am`F8JWd^AdlHfz-V(G#!F
zvA6cV&Gy!<UO-w-OT=t1NJfb=5<4vJyw3r~8_polU~~rmCVs<nrv5%irFV<_s($f|
zAw@(;6Stpg|Ay<jqDS(Kt!j5>Xc^venP86-*Yeot+UJP~Pis}x%@{xZk>o^rwS1R&
zCVs&N&R=v$6#dllIGw9z%GHLJrESG{-TJBQr8<4pdZ}@|<?VChl^LXthxUBvhBQ~d
zZ%<R>Z}f}3h0|12zyhB6!VhorZr6n+J92c)m4ljaD7U@o<Kxc~t$byNF7!In+5Spt
z4eIFEa<&2~poM~!7&Q-jVlCKC=|h!E;uoH<INLIrEB(&D9lqa8<&P`e)LRRr<tFJ_
z`s>h>4NNx$4LcFirgAP5f_7W$;MKV0vdX44CArH792%LEqs_^p_@hAksy?11DMw}7
zSj%|_BmXcH$cS=4&i&tUd)x3+N7ku@_S}Q7HRsrFf3ykWKXKL^;pmTj8T4Xds;HHn
zY_yau&3;-MK&G=-(0k1}$A=haA3S}ZxUSk$yM39%p4>N<zwtbT_-N~<XELD7x=Zt&
z+bt8Rc`rS$UR|8F#JlsXn@UKG@JsfMnTTT$@>MhqWiS$t;`JU1%(-`N``Fu}j0e3r
z$?1x`-T5#dCcpBNPm<=cNj~jru$x);Q}7~TJX`RsRy40_q^1#}$-3I?OOi5uDC*}W
zSN`h>cIVA&G{tzzXAhsAh4IxLXyfnPUtE>R`9Z`e<Q3O`d?>1=o-8U4a?Y!A3$Ki`
zNc<I%vdwtg$tgOly?J;$vT@SHRf?`%XLZwvGZiG`#>uNoVyJdRJw&eOB`warj5EAH
z4IYdUOq$KPR=Ye5gz*b}^HV0h`(GBYh^pzr{?Kmn%hg-&@!JeoUc+hqw6uT7U7oK1
zS6eXETEJuVIVi6+GduqvsgJ<y`uP{ag;wcsdVI2=?3LY*7i*jIV7YWIvPr3=$!D7A
z=7X>vJ?>(iN~_xelfui&VhX)tzBFb;G~S>7Fbn-v*z+U>7Z9#4cYVvE7W>Uh`FFVY
zP7SOksiSESm|%l<{Ac6icleL?Ookprvb#9vf4n@^9pqAOCqyr9e-5FB8^^sXX(_cx
z-PUqydrgbCzi{U{KljHcVzy-l?R@w&dAGp1TCwzyu}#E@{)~f9@OqUttN8ETsz~9(
z?!qpHCZ<YarGI$)i^}F94V2b<-sqp%*}ukeVaRz}>D^_H&z2TcC9UCEiX309n~t0L
z5%SkN7zw6$FTXNt{GR|C@yoz;Vm`b1tIA}1<xlJ7nkp1pre@IepI;>$F3#a9AW*?$
zNsQ!S#MakjspkE;%<~P+F_Ou+<#G4dL!I+e69H7Rq4L<Z?eEmAN*jLsC|n6;!on_~
zA+{#}(lTl>8>AS++??fU`&ryGnaMP`3B_OjJhpHT{m-rIK%nLPe2QX<Yte~Ob}SqR
z`zc?pSN?j2XUUM36(8*{lMs~vXA9r-uFf_6vXrF#lS6BMCZV#lfn`oRKqgb8OrtEY
zq3ja(uGK=#)H#HtYp%0*;s0Xpt%K?azDLiS5J(6RLLj&#XwVznAwh!&cXxO95FmJP
zcMI+=Hw1Tg*Na@-<-$(n`}=LxdsX|k_HFI<9~3prFx@@fbIu(397$Jp@S&9-cLrYw
zT(7#SGRM$sHM;1Bc|XBt@6V}B9DP~pmyRBMDydI*UA-#j__>LkOBib?_en(8nXLP!
z%P4rNWEwJGBR%<<0h!YPEo`y4gBGS(<w3>Zmmt9qGqguG^Iu+t;-0qW$-K}pfbl0O
z{4h{)Ma7%%rgJ=uduUqlh(LJa6JT!Q|41|APhd!zh+~K-)@iJ-etvzS)jd6JJywG`
zPL{S$EfN5asK%NT&oHIW1e-=9k2<5zNsip1j5zJs0`4uzT$s^G>0ocuGf=fIE+Rfi
zEyXtyW7M7F83_E!^Hw<f34#w!*SNY5?JTw;?1f^elVX5N9Afn&q}b;OhC#ltw9Mjf
zEOmW-&jke)9^-fY{5kT?w7B>k<xLpzlfixa43rynGEj-+IrRth5Y`wS(9y3SU{EQO
zfuc>LGGoJ&jQtE{vqBZ3XGMa!6%COr(;1bVPftq<KfikN6V158K(QyR@Qfpe@x9)N
z--i#zh0FLKXys3_GL$><#ovQmA}5>~%f9FbZsW``-0bHr>y8!E#Qun34}PSJn~cHR
zmD3c#?M?6)!fN7Ae5<xA|JR{Mu7<E8t{*~^r=_g2iueK2ewHkmB;%iTw|YdCfjMYH
zjf4~sfJ(;Jz3|OaK>gLX)`=Wcg+WRS%*J&jkpLG^)BzCQwPPIyc)tPn@DkP^|7B-R
z4T=Lre+sDD^DNmyWyyjaVce}DtNE+p7jr?h3_O-trL@9N6n=&R+v&t;sb(41PaV6F
zG9gU=H9^+Fe<tYh7(PguQS#Y``Dxg)fuU;wMzm$e&jcH^&zh<e6M2P&XB4#soJOd-
z;ar8EX<{mw2pLRL3uPYNd@j!X{j{PkK9;}VVs6Gwx=og(eZ;iGn^!^IK7;l8@#3V5
z3*~5grqHqCC?Y)IondZpr5tc|jalmBvmBLnnO7h!av5*bSD*<2^T*XmTA4A730+7c
zs0e}qnHa<`jvZ<WKZ7q8Cw_o;ODnS~3*}T5KPG$iZ$mijM*1f0pS$S(8-gGRb>vfZ
zUg?i_Z$Y38ZySKcVv>!I2SO*<#w6U9(S}9bKovB8$&ddHYXYT}0ns^RNS6=Geb?+K
z&qHwo$PnOp-u1ib_R70rWducjE#@-!`hGh!<PC{ph;&{u5>AnyKYteg8}|fC64QUY
z@(8{#UbY#Uc7x&RX)%2B5$<mOSkrRHk$I2Pv-g*B6Hi=R4Ro9_@@{xax{klaZlF(y
z`rrLchyfpOQDGq}8VTC9zKO|aZ#Q0p21Z)%#&<EMOQYB;gq*9GfA8h9HI)G3U}M+`
zV{BgwzcbO%0l*K?{s*|6x0`3M-I|OxR*!j(gS!Wk($jojuQDVck@wvbW$-<oD_eoj
z&e@GS?PCeAYdwhxG{mChWh#{JIp_g=r71*@bKDE&{(wf=H043!D%G~L!>(Hlkr{pg
z)00(O;7`7!3f}yO7CDpGPg{KDx%<ogL6t0;R=nSEe9Ifp{=yEvBQ^3?=itPTb}4D3
z2|;(ZmFv2tMSTm=S^nGMyDRW@s7G(qOUk-<ZyoC<uh#n^BNnx-r%x`=tG}a!V0APf
z20p-7+I7^ej(LMrhmlXWJh`Xhg#QlwgAA)3*0z5By60^(3)6`A+y>)W#B_zHq2gq!
z`zx-XK|LZa?4tFTBd~*ed%iVbd{vceDg2j&K#F4QWXa*ght`ed)ab248L-ib-}0@e
z*s`<e9C3uCB;ASgK{u2L?08_@9~;**V2RL}to1JIq4H#n;rYSKINIge6a!(;hl?Zy
z>LNeUjC4<oIq$zu?o4?-9pP@=`YCrcdsQV%ei?T)Q~?7)3gmI2H#W8WVlOEKad|!0
zDM{UDQ<yxivltI#@9xTFFaGMXJ0EA<`MK@_f4B8DWOvi7itPTXCd#*kXP-O%>dYeE
znTxB%`FlR?GSl>Unj<?ko2aBQBsSV9Q1Y4PRZ%CucUr64YF|aqW5j=p$aC@v!~yx-
ztaJVF?PeAt!RHc!^i$o5&}6&H+fdod+t@26&fO=`f|)Y8r*kZDSdgZbDy9#)KSo$c
z%$Bn<krzShm8)6|Io$2|F?18%{qk&E&s;Udp6fKtY>PWc8+@z9=BnZ|T`q$ZPQG!l
z<7m!z1;-bO`x~S<A`{l|v_22R@7DWaIYLD;4>`HPaK9UTdrmnh^0s#nr+1DMVo=iH
z96#BRFM|`8^G1|Tc|%hQtA`s671kdQC45lEC5e}5bbn#L|E9kMx6E|MFtIY1GZ}IP
zFhi^_5^vz?4Ma~{83$%l{%r*>Gc!=J>xK1$?BN-T7x$%6TgLq$E(mj{rYds!+v(o8
za;Rg4^LcXBdyh8~F62y#bW|q`ML1TBsh;k(_Taol>erfKI0^1yuue&CPpKR$nXUTP
z`|(;<?yZ|+)#r(!UF|}YEmUoqKmXqFrtnxZgBAZ6wv6<y^`akV`BYglz5J+3c}IPA
zU!MS??fr4Fy+Or==i`|bxWBrd5dXN(S~FxY_HvIQw8c#wb3?q0Se0b+#B%#7BN_i2
zA%+`vqgm(M$;(&&f-w1*bdppjI6t=S2|B!F`LP_JNU}5lHo(Pq+!=7c%zj|&9*;27
zcdV^}#yqnVK0#tzt>n5qgAHM6H&NF6VU(ZY$ZK3WkNp?u>E>xZ&~><hK?hTby+CdO
z>*z<N()VyRtEZ)^T5bDfkmc*)YuX${1*~PvW$Kb2Z_pHFJw)GOEz%c}XLN^(TTdoh
z8CfaX<pZ!NpZm7o;hy}gH7G2y{Fn*%82=uFQZe3R9Z(ApJu9q*g@lCG<oh5z=L|9l
z!B;bT1o~Mu{ff1VGVTE|+~ND(Cxi`hCD?E?%}|P<QkwSD#5~U}E>^G;Rr1h|f4te&
zTE}i&DTNyLIRLm&Ni2k3&1?}oRxx3QY*BSVseyttKl7~f4QM+s_&G%hW85NyjJBby
z|BhZ(-O8k-MtV+SUmTIqVt&#M6x(M+{2*yh6k^_+{}8)`NxQjOO(QbLgx|rW(pAmW
z&16dTdJ}VhdXgCCPDOwqNam_4mbhW1NMTj})W>-6=g7#nUZzzCgTw?eVS$qYbwAG3
zD?ltG(j(<M7vVDsAcH;-80h2_G8Oh|jXyOkW20AApK6&>)25uG#C_NQTYkP;Hn?%m
z<6qaaZEY^DFA;?ZEyf8rf5kRnN!nE5Gd$zQhmSQHH=L!(DTQz2fYMOZu0}||Y58UQ
zz7G@btrDI#`GC4JXG+VGr41S(sqT>fp{|XFipm+sc0RlyP_v0Nsa7+J4<d*Q`F*$M
zWdpa5A&aHFp0akAY_6+6o(i!VB-`yZs|!{gp8ZNLR>}7QgFy5p%~!3F81m``ldnvw
z{D8zM!rv3hsD^}(%Q&-N?<nobR<n6yUUEK84C+6`>!Em(L7%Oye<PX{YwC`o+KX~K
z{ykn?l3T?jS)6K=7JxxzOn&a^lj1(<snYvZ^EnG(gS9BXrDZlPYw5a@H0wW~R@>86
z8D`0jN`8XSA~3J0XsY57&BBf}uR;x`0>4wM&@Y$j!4$kOU1FN0eEppB5y*tqB(noZ
z`ZcS0IZ6E?Nbe=+jEEi?Z@01zTT1rM!mNMJtVBj}dBh*-_2xhpZLCEIjZ+|vNE1zH
z5Td2;$J}2ZRQ2988NZ_?rT_V@&EwI*?PS1#8gKg<9zLVZG8j}%qZs=-Ak>)sMHL1;
zk}Ys#n^)}>zA4x}UCOfIUd^00&1>khFa|y5r@xCF#KY|3LiE9&$)Fr}H-8-;7e8uC
za9)#ka#*WKXqx-?Nj_ZyfZAbUa@NmgE~DnNn;9QKM@A{3<N<iQfB*f%I*T#cYo9b=
zuwp3gNJYPofm~!W5pgqSaq;mYu`f`SMw=5P1DZng(cRTU!ilV&oidjh8yjr`1eumL
z1ExhyQ^uK8Y(Mr>t5Lo8WVFcu$IAW-2)Lf*&=WFj{(7*dB5-lyxXcOmlfKbjMoojM
zXPC<1>U)m&xc8#_2U2=U5D47Z9o!Zb<$Lcbibj&+!0HKI^1Gyvdko5mcjK7B+Zp+h
ztw2-tgfpk%EeOd3kH}pLmwjaSqG3N!{_sb)FZ<3e&T(+(X3r0fNG%?L?EIGfJ5>zi
z-hv1C!9!uYrj(}5>g_n+tyzn}Xu|Qa6bBEAy*_D!vQ1sRfA=(d?d}kn^YiDqV3>Rv
zC`0&s49kzYpy;8lfoowB%a3Hx3tGiWfb|^Fl;iZpzN!8RZ-D}NtDqY0;+(pF7SyrV
z?mI-rtm|9^W|W!?_qap^6*?Z8Rc-stq7tR)h@$kyYM1o4B#I`zeyrnz-KLYE>bSqq
z&u6kAwJH;TIQ}xYx1w^#EYesK2&mOPo9dW;B|pXnuPich>pF)i?y-5^A2(ODwO<fl
zg|Ixy&Ys`H$n?9)QOIK1O#03}eF3|I8(4+#8l~zJFu7LuE+<cGH;V!&v~N@UOF5k@
z5YuF@(jr`qyN}yFKbJ4ri*YT6HwS{B)m7BeU<Ea)IA)df@mnk=YTG1NCpa&s9L<vi
zGEn49Fh_Vp_%6w#icF_JRjnn|Bp>bmARB!kytySe&DgOHUq0_%RZG@9fDSeO#};5r
z3gU5R$w*~$f8^@*{u%a%5LucKE6n(xZyAWv6AUai4<7oOtfgF>Ee_L+M84vxHe4Z|
z?+qzR>CayrqwKb`XM*weHEz&|7m7UnN)<RSc6Sag#-evvBBe=(zXlfByO++Exuf%N
zim7RwKv%bY;kQvpx<_|i{#TJ9%N~tuew*5@m)A0)hcnIi*gE+nI9Q;J!DE+RF-6q-
z(p+4g6K9_?cGC>8b&+vzew9kI&ZI*ehKFFbFp;kik+eFmmc>+euJ2nS5o4i<{rDL0
z$Dj#xAY*}ERMqC%q1Jk2=EH4D%NNn!uDgtH$Yk70{mr(^6O7xMdlv+?X$*VYFVC1D
z@0c$uvu?j*2sX!xx#Inj#O%(%AT|sv>tNBz{o1Mb0uSq_9urto?1%K(!9MHH;Y*hR
z>Jv$asvXj1#ZN_GN9n<O$_#?uLp@>WTP~&@o#~(jp42y=FG&@a200rKKkrC{1_BVV
z60H;bjmhzVY`QD<`$PNb5SGQbFxOH(&s)eu4Rf}J&GFf42<NLLD+^|iUmwQ5#>i2D
zm7~=Ior(JC*lX<^2sYL&^yT8>qwEfr_gp6z)9{EiZZ8iHr#f?BTRRZ_C@cOYBDLtr
zPJ6_~Tenj&-Cx())Sa51kC9ppdcQA;a}l|7)zzmB>N~&~Z8G9%A!JpO4(EEXAn#6b
z`XI-{Z$>CU4`-$um`@KT?U9A05qSMaAt~U`Y&N-|5m@7Kx*BRFz7pyyz4k*px~*c3
zQa4=U!Rt!|+191BN%=)hB3|t*91>2`L{%#3^s>T2(%rZ9NLLrOJDWOsdW7B-*JlkO
zNr}*AX3i}bBDyk_1j?!7!zGH8t>f;_W}X@kCo9>tnTTV$r67Wzua_sUM#{lL6Nw`%
zz3GyImEH7ag1vE0MO{s8X5MMB{+xaAeyV|@X6n;2F~4VNpr-S@)m?~k6j(!ynCIto
z=jcaL`tY!(nAGHaRq~s3=IX(eRt~o{hj@lmGs}S57I&J#A-jf@Gs(7w5aqsp!z2f=
zGmZ>9PC(@9EQ+!Qq5A?hj_C<(B#qf2BV8(fXe??h1X+x_0N^6d(N%*Gs&m#B;DMz~
znqR)a<`wg8_dOreb&A#k>3HES%U0oi2iuGblf|FD%l4GpRakV_IF-u=qkK~w4!5w1
zKTzuXMgFnfN=5vd{d}N-1OH$wLpeGt$jfvMfEe{Mj}A>JsMkb9eNv3(Fxvli(05?C
z{PsfdivS_FN$Gs-qV)Bxfk0Z})9Q-Fo^QDrkJy4?9U8*ZtC&!ki^?o!y!qDqrQ$@v
z#+ZBeV+W<g^&ixS=ykI6{VaQPi>}-C-+fa}Fg@Emb1N3VQ%e9@EuCOZa2?*wjdvdU
zUaqN%5$-%X8vaab=4V{zb9|1ylE9rw1=Vw04!cj_DEss9AW@Z$tOj|3rg&}mCHBtJ
z<@vGS<f-{QPxAL~LDnvgF&lXXv`wK2Jjafr%=AHOPG1um0;C>fgg!tk&4UC2pff?M
zo|a8cV}xk|#aJM<58U$6H^FUd0XTkNpPixvynr3fv`e2}C}qAo>0un)i)`0QW4k`D
zJUN*N-SY+CLRc9?De>{}Jg=7K{hpp>Gg^*8O!fT&5z#KD2ds_fSv?j^fY&}^1N-*8
zE^s=xqep|JG!&I^oBeRHV3L-Ikvs!)SVK;3ZG3(mz9VmDDR&^HYic^%avNo?%K1E3
zZa$8uLFC41VH;z!@+5^oAgT2TZmM~m3Z~Mm*)uww`Z`^RvuZQI0{+$2EZ2fpl`mE3
zeYl%HtD2~BZ>_fV^L{C0OL9CXFpL<3@tCzhAt~0Ana9Gx8eJI>$1KrH?(TBd&eI#!
zs0|uy>x0NIYBiBTEUMllhr*}E)7R6(P3)$OK-!jxthm_L4*W|mrpUEn+GGx{E&aT`
z6c>8h`$6UNxVFs%vBreRoCWgHpL{LF#W6}7U9lYNOAL!##_DPqqp=pIeoqI-s^P%m
zI#t4iPg%UQGQCFhw_<3ima3^ZkW`q=^T^`Py;>;c=a#|cU0Xzi`<n*gl%>ctq<JbY
zy7X2M?HYPGPEXO}D263MAJAO9Z&qIBoAckR+Z-Gn2Gx}r7aB=4^=_ZE3M!+Bq&3zE
z%VIsud!ui}6kt2Mb(i_A^jtioDzT=d-LgX`SJ^Ze{C?zNh>4$pcW3LvGeh!b8r1NN
z`D~{v$a!xr$y^P|bH6j18$~2T_W7L@#Tm9}a3l{4k{-h21~Jv<Z2G_lx0dsev&W*p
zIG+-1?c3?eDeJi|a?2SU@GSI8mU|Z&^$$OATeKDXQYKlhu^0fat;Z)QLf{4tv*fv&
zkVf1A^G}SQdH{hWNzCqaU;J#&$Ag06e0f6hIJJpo@#jyS?KhBgXSgfH4vnY8JXO3G
zM}I>+f~8Lw*FAce?BSv^D>Nx7p`Pm^G~CsOEx0McW~B@>snah2^$Pw|+jxy(w66Nv
zd90qXdQiSfVGUyXG@|h4ZF)%4-D--n3-;DpmT0yd-17u=@HF5kjuNZPSi-DSmh3IX
z{tQ3#+l_!va?$$kA=~)$Yy&(0?XZSKnrlf#S!tf})B-C0r=p}UHHWEeHBJ|L0w+)s
z?~%GXcX6|>@1SK(Z{l!XZ?URI8JwX4t-|E6^M_iC=>=%YmGw=@Jn3T)eQ!BMy8GA_
zXeO$=s;;giQDELf`rbYX^Z`wL6P}Zu@0tHJ%mD|}u{rNu+2@79nHo-}>xwwdY{|Bk
zwiX_b*e>CCdwIO@*3yF|qb`4(%3%CS;Tj{<yU=XyU6G}d7yAv9v1w|++aAab=CdSu
zgO=Hxe1D5R9icYg$i?Y?=?&-CkNtuPvF5SU)Lk48Z+~aE{ov+27)nUVxVO-Pu)f^f
z9J+_Sm>PIB>#*ej+coHoNn#|~P-GZ_<cHe?A#0|*<%_(}pejFc>O16~5X`Y5PA)mK
z(u({ww9%^`u6T-71eJ}8qkjFWLIo}&tE5q=lkk4xdb+`NhrMizc`1P>HTk>U&T@6p
zbQ#XrdfN}$$ai}S7)GK5C~`-a?et*GJdKvc=_<E;2W@IlwGWW6M^uC3cMoqdy;D+}
zD%XA!b~g1;@3-99H(4O+W1T+T-E0R47P9X9ioGs&R>lJ>eW?c)`?y|%GgeK<G04t~
z#U@}r3@Z|}tQc|)4JR9rNy5_%=fj3snL{8^#jft!r11NE?IPnQNA+UYNZMxM2g_ko
zWoA%mZW?_-LsuXWNk%3iF0muF+QwJdq?KI5T=E(;J%{=tpNQAz9QJ!9)D}yMlu-f;
z^7}&k8098PJV_2taPY|qN@0A~>hb*Q`Wm1ZYGdYT_fMS(JoTaEBJmEok2Efge00=2
z%M2Y#J2to}`SMHE9*3M#_bacDXiQeo)BEEDoUz52kt$Q+$Twu*k$lKge(0C-m~nI1
zv+gg<qsCT!&&#&rt}joOwhmr@L%~%w^c8HzL%c=2#P<xLM02C1Q7q|34g!!3jcKXL
zNw%JPDm{JHY;izR4b`<v!>yb9edV6a7_PY3{rTzHp@C#sB&P8V+Oc#`LkEiyA6o<q
z^L^IU4e!|Kek$O%FkHG}ha0V?CMPzeawktmlF8T9S4!3yGck(!G1ge5$*FqS?V-DB
zc|N^xcIVZ5BX4`UJ+(~A+#y3r+-P}eq{;oufGMGn>Iu)>iJb7dQgGlG5DUb-8dnm+
zcU<#5cG;@9wNs%zzb??4B*HR`4k_qJ=`B24Dzyxih~p+UGk;i{g^_V|!B~CY!{f1~
z78@fVRZL!_#yGIHROf_Ry@J^1Q!%qJvXvGWPhd|dLhn|DUl#<{(!Z5bGG{i~`yTGD
z?2eK?qnapbWoGtEhsi{Vb)1#Ak+t=~)Y#iv2J9T)hTzfPXSn=OPeu!+eB@JG5c$aF
z>Z@%L<l1UHu4IzBjV!<ua<B(WNwHLClTNuAnyfy%vDZ0X^hkAq&Gj<Lx`}6%BNC$x
zug%P>W7^h!2n}&Mf+=ojhKFCcm|L(<669{5lx8boWG~%Vf7@Lgtml_mlA8?c6H1&8
zzE%BHWp|+T4zFQWPA`9;uX#Qv5Q+bGq;77@(%q<q*Y-M#(;c1g^~O>RcD%z{;^nc+
zPVCQ*ie_kiVWYjYJOd3YJ?Y;3+rAner_0H&AZa|5*=N!pWfM0iPrc!(w<<5qN0<9!
zHEuVXmWPT&N|_E=yUcYoAC;Tgu1!uZT-|9(4Rv7?;pIAqq%VbM5LhPX&rwf)Q|e{{
z6Ep8@U@=`!-h1)N7?Uq}lQMEHmJAWeTDvMMx6WQS6+Vm8UCND*MJB6bq@^bXjoh&v
z&M?#Jt>vRYVcae(+|axYSw@cUT{=0wT-8v?bS|&UbWtmwP%2D0x$bbnsi6rWmm(je
zuZ+fPEUCUlqX~mwEt{`G%2=faGsyxc@kqyPk{Fg6Fw0hSX^X-fp-KDcjpMZx^ljsl
zs_`xEdMM_H#fntKmQV83t#ou&CdSihkH>`c^=qZ#8Kw~%l3eHP2ZuBzGrY04h{%3v
z6A+G&JbM3OezFIYV5}SIzTOqRV?FHhP^VoBo4N5WlS+t6jV|Ivh#T~2Nao+WH2|d?
z0S;evrX=1^hN?I8H(qbuPv^%kHzra!`?IvS$-&3IB~*4VNd?ELg_Wl~oi;~rPkwEa
z+!Mf$G*>qTix@<comXvRFHeLh(Dh<Y7Bq_>E=SFua&4C9z!#Bh#l_8c$%l0}mwU`+
zS32g7xk3dBT9_N9YIOzf%6sfo&3$@IrtSXW4b&8*L1LeJt^hQdcWOTkTg?SNYgfNO
zRFsNJsX|`r@FBm4%R_Suv}}oj%~LQR4Vp54Jnw3%N<Ci59Qe@+)5^Kd*D5a0(A06m
zL%rte$Eqi$bBB>Qo)TPJ`+XnmZfh{o`BT-%#>2)|>gO}fBQ2k`!+io7C^c4LrHU+N
ztol=)#CMaGWQ8gA2*293=$V3s>DKFCz^sSgL<N*p$Bec)UX|aIQ=A;0k!EeO1_UFS
zaNsAH2Dg3BXwxLd_G8JrIdo2LnpKg(BN108awMrw2#7%?%kC|UxZaNtoNaKuV^CTb
z6vbY`Hh;`H_neE-;>`N?#n|kPODh&J+YMyzJ|bWNH6YV9@ZwjcU1QhM0fS*gov`^r
z{3la7UOtD3Jj*5%eMiXBfjm|7&Cc$_<nGsE$9D40Euwj4YlBpEJN1RT=~;(`CN;Bt
z7)aY1fBU}q6uq&Ax&SX)o8-286=G=Ts^g<=dhLgjc{bJ_FM$mU=MmtiyFtdUQXSKq
zH0=JqDu|0pHaIvur-krSzJ<%p;FHbg^LcpS1DDO!J5#Yiwr5Jh{)MT1?eN^g*5zv0
zdc^&2GO|{3hNn}5&M>#MyFwWUABnIPE+M=3Nfh&Nh;T>we{2DD7+;{T@v+l9ZK)pX
zxQG}yTOlV?_n5T|Y1K<UNQQ>dyKYtUejMMnm3Ijl)bo!ZDEUk?tUa;6wQ<rcsP0X+
zE&`x@vTPiG!S|rGcOG=|j*HqJR)-&xzfCV|7gF=S{vr=a9j1?eulFKf#`UyCMr4FV
z?4nac)>M=Jrw}z?%brZ~4knIAo|Z<Gr{45oph-J*APc(TVsbt?a^QNZak!`RqKaeT
z(Lxv5bne&}DopG6#Ugi61@+d{P*i*_Hjl4CEb9s|*DjrDU`d3I&UR(yQ=KjaVX|zq
zmfo@grkpOf&!|bb<6Fzgzn*r!vFyyX#X@@#+ZSwqtn4sg)*b<ocJmw%ty*SeV#+!%
z1-=a%r64Ah@XEc2YvyG&_>RC$QYq=~3^l&}7$hX<f#KGKO$rNVQEISWx{QA+@w9f)
z+v`2qS`#>aWSZpwuDfT=B?3`!kc2fSTHi0v4J(%}e!46gqJK-jVs^tybXkhsScPKL
zQZlRBpwa4jdze(w;WgJ_4Wn)E3Ul=zA3FPV#xEj*-nEihaje}fBje(T1#jM-hY`3Y
zWj4E=m*+y6q%w;3SwTFCu!j1g9lS~F!yn!e^nE_2Mj!Ek1XNRizojfcuIyD?U07(=
zdjbYXLU4CywIWg0iE{gs5sD(N$2xKT#w*+9I^H;?EVLIZU5ku`RNg0d*bM0%;d9BG
zj9eXw21K(B$6seCSV-x90tq|cmRcQ+JzDSDcp!Ohp~&{N-=FDS?DM(MX-*;s{z0L%
zW9x*kmmjbHdc0u4F*eatvgeeJS-EIb4ELZM6sH^#Z>qMv9^)U|bhJiV)M;v4l@~>~
zTf;DQ64)3Dlf|Q7>VK*hpoo6?YY%Pjtt4bW)!ofRy)VIBS7)X&0=uZNm@d8=mP_iU
z^1PG+<NR}C#8lBih2$mN%Ik$GrLW(exOl$<nokkqKrt6y{35nQj7-ic_i1SC<>@Ig
zZ)f~_x?)SN<QSX{Y#xfQ`U$fRP{#fa_R|n`@~I;C(`SC;vrBWKG0RPfv<yXH+5YhN
zp;Dh*6Dj>iIUTINLeKZpNqXejJaR#n%A)4;R1zimW*yWYsuY;9{o1uI00boW^iRF-
zZ8{EhJ9dI906)r1$_}P0n*ZGT^#sfprZXSgsb^@kX);H%y9!7QwydostSHJNdkM8K
z2ky!!i>hu!nOoRnXnES1yV;E{OQGK5Oz3b=xzk#G_fkh3T7Qj5>Ylft3<mdfI^iPo
z(6Dzp1err>d-AL`hzSQdTWWcK()2Z=e>9LJu)NA&{z6hKwV6xIiJNLf#AJDH6;YPQ
zuoV9X;d{$vFHOYnCjOq|Zk^;yUWl+M<E<VuQW!~#31@H8iExTr+DE?dth1^>J!Xq9
z#uhJ#T5RWv%hpH`QR&i_v*`DJx%LLu9xiqtqo=o6F<Vbvp|Knc_MDX4V;GZ@Q-tKG
zv6F?l468SBeTlbycaqcNC3ICd8CR*Ap3)<l&G<R?^=lD&LXff&%TC;i(&klxeGW!U
zr~h@QV?I<1>_J-dj$bq%1*vbXxj2pxrSM>oOx*ONQ2;}b<NmYk)1w^>!QM{GCOyQj
zP|o*1yz|#O+F3=U%zMNit;~+|Jo%9sBc5AJ@R_;Pm_PBy?P6ilymqp1s`}U~d{6K}
zG&lF<BDJ`1C%EY$C*SVD%d_!>`*4v&k@x(-6B$khWKXkFgIaBwt^4MgKUL`+!$}`=
z=JTbp8b|C(uXs{zSuMR}WL{b5E}TjGrU$t-n53ZQOzOP$Y%%Vm>YpaWjP?|(>_NK+
zShTi<5^)w$t+qGr{Q0AA*iMQKZX3&~@3}G2mH5k~7<xIXb$6&g4(wPY!IxDRi1s`e
zEP93kc8258an-=RV`rhg+@uj|sXO!7e`5yndvB3ks;U@^v3W9LV(}U0qvM2>KZ00d
z5c4k|CcP$B5+$A%c6r1t@YL+pEi>jYgFa-#Zq|>sl><uE8hvU}LqZPj%g^ifIN6_p
znr)J>Kus+hZZ^x-HLpYirO2gzI-WSMR-AhLisvj^7q3N(KO*EQo@M#NL+#i-M%#E*
zpg`F>EUz6DE!Oc0FQi|$fcbk)S6cs=gAqnPVel~ev2C?(v?w}V{Qm@*+HEwh;V_5l
zH}gLs3w-ll^%c+6Q1VD`V`F5|W3kpYQ4|dU3^Ph1zyOJ9`em*>?SCBtaRf;;kd=$P
zbY~2Z%P8=yhK73afVu=!m`!urEYCis&R7iT3kvoJuVr0qbwc~USzXffZ@%iyR#5^n
z{eeKnNJDlv_{Ff_%xu11^l1mD?T!F}mLQv85@e^Px1eqPm!K&4d6){N#4^`|-{kgV
zH1tuBVmR*W-#(WNMKd{&hK5F#0u5fMXyQAp=SiQEK9CMzh!taA6kpTaSIA<jc(A9&
z8UIP*7vha#_Ou+%<_tCwtjINDiY5U#9U6BAeZ|XTJ9H_&{Z9jr@yqcFHD-U40P-)3
zS2@tMtIfoETp+0xw@;qA{=O#&q*h0HKIYNe>AGw^?_~W@aB~=;Id4j8`nX_ayVXH!
z2KG(Yi4Z@-t@U{Sc!mhY)4}@<^88zutpT70!mrBz%FZvuNbT#C!%JTOxjuq-#h2ZV
z0INq&a?2&HNExiEHJGf!BaCQh0tlXIyMy`#Zc^j5hKco`zHBR}E4+IhAToGyS3VVR
zfWP?BQl6GJhMsqT74*Rm7Z+cVCVkPqk;a74#6SoHIwPP*rmc=|8P2QK@Ghw#mYS>d
zmLK2sn3AotV#^uL!Q+P9^=;k`vp>Af^a4vPwwM@ao#|p8jQ4cf{=?cOX-74>&jynf
zPU%ef^*+~y<vAWNm);%c&^Z51`_DsEN%J<lZ94*}9OR-f4`V>DakLJIfi2>0)_Jwb
z;Nbj_AHNuywNaA%5b@5?5H+r%8P-W?_N|RAllzBdp@5Q6hXJ)A5R{VPnBgBKa1Tp^
z3Zr~L^2`146SD*Kp=>njb3qI2Ki*7}4SOGO2l0dJt#xv(MTz}xit0F(luL{Dhc~7y
zasE{iO=#+r;xb}byEji7b_3x<ob67lRYInCU${hn=-I+}7YS9yigU1hs~MBqR-0T4
z(hyS8lM;Lxfxz`H-lqwR;r(ozpE|EMggYv#BV!lhV}EqTyPt6WEOye6FLh1K=_L95
z0+c}(eX*5$8L}Z0qb4(14+V|O`!ME{1%CvM*i%*uylcs(b~hiJzy;ips_G@@1^Ba%
zo6UzwLa+yNz2}Tn>U7CWpS#M=B_^<pePYt>@^?#HV~BsgHoSB8gPT72?d!Z0tAP9t
z!DJzCBRcsiCnE0O)r_?0_6JIUn6X_t(QS3LtWmviY-7NkUb%Mr1hnGHyyfuY`)?Nv
zTha~IPewL#?eO3J*4RRrVqbcwS8qH1I`a?uX?b(cLJ_2&EUk+T?qw}4mZ|d0WttG6
zLXYd#29v3h8WMqJ<;bs`ERXP9*6t`7Z^uGWOhuli`C+v$nHYY+Gn?K8x{&TxB2Dwk
zj(c{b-|M-ms=t7A2=Qakkp&*$0cBK`tQE_ZyNBJbkLZ18<4&-lkExW)mD5u6{oSE2
zz8ED;mAHkK%CdK7`1&CeaRdtHlX;Oq45Ah&Z0{j&XYQi{+;={?mOY>KJsDDTwc%@V
z#4sa?!=TMv^qXt*rtcRf%Y$=u=GJXGqn_Tn-3SOiN<{)<2*Z`H)XaD-yiJ5ot=FX=
zO#+*suSTalEKF-b7vmAgtT4mBtho8CwSK5}IZ3Uww%8rm67Omr;frb6rQc(;kb_&n
zqL=)j5q<QKHX6W_DvFP7Svxex1Zb`SqZ-DAt(E6r3La?YLRt<%BiOvj>fU>*{Et9B
z-Mq>8`q};7KvqN8@tXgaMjX;-evdL(U6wKdPyIyxrdg;I-2(;)fhCPk8S?oYcyEGy
zZfbtvXaB1x1sXy4S3e8%0sNneR-hID)Ai?_13G&QL}vVHBPjp-PegtE`(MkDfw6($
zG?Vp_$Nyu=F#j$G-xtKdH(Afh#Xjd*je=UU>t3xyJm#~%-TFW~wes7xdF!<}J<Hhu
z5Y)%(c-=WH=1<yzV0i!m7ag!Vb6d}8GgBDPWUA$6m!u;7_ezkOh#$hrlGef5@>?<y
z<@~z}^V=cq+GmyaW<yR7t!F=1$-Lp78s;K|^W~ic#$5d3-=9gBs^51G9}EAUN1$ai
zuwD`CkdbApQCknE*pqHKlyqqE5_w%65ZIrF=kQfF_qckd^1v3JqI&AD@&#RHDWU`(
ztN!=Z?fTyj7Mp%!PG$0p^Qq4F*Uv92qGg5!7+#aZTWmwTM`)b2`EC<FORHd~`DV9&
zfos-}70>t)ICnqGDa899X;Lh`{{thcA9>h%^+XKT16E4!iN^#gVYI^5F<jN-EML_Z
zjL8tjqT%lM531C;44PIL9k;!R8!KKHy-fWkhE>R|&u&5RZ>Wmqv$7dzXaq?RNjUho
zV(C<tx<M)tBpux(sovtQn7|xJ=?-XnZlj;m-rXA%4lsI5?ivb~s5)$2^NW;**+d!(
zQHc|EdAGXX{_^Gd^}Egz5s?e}eDo~O?`mW(Bw`O%Nm{S6U$*kl(hHJjhdg9x@d(#k
zO$<9*%hE6XwEWu<pQ%zjHJ@a}ek+>}1@F=o9fzctP7-2_9?tWfVorA^6M0xGraim$
zw*)+!gLM{loK_aM>#WP{6VsDFXeP#0^zi=zF3r7aVrFtZy-36m^lq`sORMQU$-)lP
z_L7#I?gzk*Ip^7(*$ni_TUNd6<uhK5)(A+4f0iuB1fFIM8mL7EGPTZtQU-IrGF#To
zZzy<3ym5%Rhp9XgtGKES)NPQ5+uG;eu&pa_nU5BdI3wN>0Tg}(*epvy3j4&ee>8;o
z;v>I7!;zc=S0c`emFvem#~M3REwxr5c+}q6)!NR}csh<x+CM5MT?zgz_-Z%$dBhu2
z;ul|7b+)8^B`Kw)6_-8wjm(L|6?m0pH71q>kFS|b`|>U+W#CLAdhBkabLrA4vlR|M
zSObUXqQ!`Xo9u!lMP}%TnkcHw!CGXR{pVBwfbVZjL8#>i9FspY?K4&8=-`X3J=eHt
zF>>-P@ew0Q>bt0C_Cl}rzVe#42AA<RV};O5ebcaa8^#YGKN2pA`x<&V51|$nLTWnV
zBv*&uk=Od8M39LM4=a}&el_gfG{H8oFKK{rO%<yt4|b{&y7P&W4_J?|!9o|QJ~00Y
zashqVyYNu=De6V+t~-!e_a8{x=zS~K2JnQM%V#m#VG7yOuK&?+IQ~mhDZ!r&u05#?
zlGJdZ^&c8QPU1CvlP;`+4euI8U5CO#BqPO7Fu!(CI4r#33+cRkk<RwZSG_wp*OV1I
ze-9txc9~{v>}H2wjrK|i@^_h)X!)u8lxYrUJ+xwAC)uwX@m9^wJLNwZ0o+Nhs62~B
zI~D`WndTLQ@k;~P-3e{{A^-B7@>jPcI>*bb)F3(P*(Sz5YxtLR28Pf1dHbnVtHmk|
z%MEw5@o4GR+?k20E+)stC1TaHZ2HUb=FL+KvmSb=mU_}0cGQX+O5JXocoFmr;!6!4
zvm%N`)`GRZf4lX;+!(;9zCk<Np$Y+jtY*t;>cc#jhZ6TQ-bbg3=AW`F=u$ivENA}M
zg^y(U4PGn{N}QuE-A#0aimrpJig`T=>C+Qbp^l@SmJMSmU#suByQ<Ab*gmN1Pqw!l
zxiJC3pz!f;@;=SD%FT~JbIm|tGYAaC`h!4jC_pT}kCz$6<-a12plZ6`$A7o~8<ijb
z-{dv^Ulg7EU%oYN&g#OV#&Y_(Rg+U5fNQ6vqobpz<#swzaB>>zQ4aWxHl8O1MEjp+
zVhA7+A;)Sz@&o5<_EZ7LqgY7p!o_|(otln;fy3niFBw@oVo2O}99s8M`=DH0<aaId
zGU;Pm`!~YKL3nzcrqXobEiJ4V#wZSh@$Hv3RgpOwJ#nx8{&$zREO{snw=edGwd*-_
z`?$}}f%<~*hKDy{UZM~--TfPqFM;UHtgMsNIN_EvCyv@Oj!-@q>rw0bx=3|CbZ5QZ
zB=(!!<Fef4tV3@Vwuz+Ny~k5;LzKOFC&L8)-eLuD6!j8h4BZ&>etLDu@50eHGXoU)
zd1LxM92zq`E#o{eSG(Q5Pi^A(56NmYoxm{Sh|hm88J6sQb34<k+#LW5;hFKFP^E)L
z(oTVou=llCjN2&~rB<)$HTZ&v8d$^mN&mYp)lO1<!a9$GgG)KYFPDz?;!goD#tL-J
zN;{K_#!Y_hmzdbzN0o{gaorHPr(<+bc0O(F@AvSB6LWx?!ffN9QVu~;PI~Qbvwnc<
zd!~ESGrB4Wx10g;tBhwY<jgS|<p`W)1vY%?(#1Z02}6JENZ()!Lkg53;_V3%&6!1x
z<YpH!d{g-J&jh%%CRt)_TWMM@ENTVwxcu<uCn=JSYXtY4C*GdhdE4EEaB6own@mkt
zwFvhMbnf}muu4pq7`n;Cqz9jCKyY<<p1*uYLN+Z@-@}}Rnfqd$f4RkT^+TEld5qdk
z=(9>?N0r($T#Su%zIQY80ol8~u-DuBAA-L|+$h-J&|m3Z&WSNp#%!}R^jA+dDf@F4
zK?%=i!x#IhI6uitBhUD4fsviPW>}LAd0|!Q+oZc<1|w^e{Q@nTFwXPMuH&>ir}L~#
z9@)EIg+zV8#)7u(iT3xw(r3@A`B*Oupb+t%RK*q@F2^@>Ik8xxO&L<NS(d{sLQ%w)
z>!HOf$Lih`#{^J1eo+GH>o!^^urq<daFG73aOehwMFP8LNa4BTf1wGv;2pD1j!nSm
z=1R>oZQV+*yp=i*_d4ejDVzxnWaQYXLa@S<cvL+g-#!c#$QTdKMt_{HJ?vN*Bp@|H
zO1V{e&*AZoO1GU(YUoyve+~{Omm+xI?`6~RIb_1xNXpYLs&?VOZ5>(k!?zb`M@GgW
z$+xXWe@A7KU}XMi3CHz~!`Zu=H2^c*72&Q}=RXt2r?2tE{W4colrEh!R69FXfniXh
zKfXXa_z4~<USPkTZR&3xVZI)T163RfSU4Xu9^@<`CgKn^(bYW|V7$NA(aYt<qNumO
zH;{eGU0x|ev8ntty^zqwqEzOpa#NyJrPV;|2mK#&h^vP)L6m%I6$kZJ%;yUojPo2p
zRw`ujbEwgqA&%Ig=W6HcrHb~;&z)j`(hgXp_kVYe%TN+M=-yM?;Pzr6)9)$V^~k2K
zlnp5Kvs?b1{O}4Y5A{CoJvm(C$c`T*9w^JtexF=EOIRyO8L3Fs`-e(6lk<+1P1tC8
zy1#cmB$)&!T@pe6DG586MAYhHwjQ6pzmU*ui<&k#WX}B^-?ER<iOP^%qU41QMw0hA
z_aswg{w8H~o`swB$pl!R+$kHU1isUeNF*@|<WBu=E3W3X3?u$^!pAsZ2p8o>iz~@e
zeIh`1m!*Et@|+W}Af<mL7Q_Qz39h+siXYa*N<Y>$2(N9R_(h0;2m1y64kJAu!)D+K
zC+F2Br>d;3DlicF^us^w$|B{x_N(;4G$zuoM<-bfhP@=iAN5kpjR%#FBhbV<k9*_G
z;YIdFww6RLFnn5In<mzQ)hD9{*0|k{8^{Y<7Zf<lbCDy>r4LoxZSh-8CZhmSBDek}
z@(AkRuZE*L7Il>O=TKikz-MaPkivgKGT{(7m8fB3Fc`c}ZgRiyp1Z^{cdR=5c8v35
z6%|?zeJ9<2!3hhk24hj8WsqlDeZ!+VVt5KPVqDlFpd=kQ-4vS>p<KC-lMuibP95*L
zCsh>FtUcU$oVo=_!nuq?zRzOprdayr38PjTOsjl-UG37D#U6l;@<RK<_AAOQb%QO>
z)<O6j#I=w;;^4VuRvvxN8Ywamk^Q^*Knpn$R)EqfJCL^aKw)Bzg;w6_0_9;OI=bNq
zt){K-6W&YR>nU@l$yEB#lQQXw_PW&igj5f^%g6KeH4=4{Vyq!l9Y*5`EC6?q2tB_8
z85tu#MclpFQYoq8v>y;Mzt|rfDY@a28^-sQnCi}y;z2Bid-3Mdw%rBxeC6Nlt+eOb
zUyM3Lc9Ilx2!6r#sByLY8lrRf_G6fs<0hrld=n$hvN>Q(iH?qXxS<icxC}-!?)>)!
zlSYM*mxySZA;YhV1yEA~+1JYF$y}zLpXgvRypQwp6IIEr+vEptNH`Jq$n+yY?Ox2S
zXru1Ri!<A5gMOhM>Y!gDyjt;wtFUz|dC?biX{k*ixh$-V>lL!es)R2h#aXEd>-^`v
zp9Md>ahRkqZE3K*veGJqf}qnwXliIh#0UP<(a0dscDhK)<BiVxBs9>-7V8%A3cY%r
z<Mv2vm14d+qJJ($?km&dz6Y<8#OmFmnqc%8==$0NkIlF0m%ll7d7YCdS=G#prjAlC
zjkUQ_;V$@LE_HV=DfzE@^OM)U>Gw=DtX_<5qh0^rJAi=%`=4Mop}-%1Tx_hu6ES*<
zE%f#JNRj;^ILf&cuIFeVlAV;6>G%-^P?(kke*g3WV!LntC{RnlZ=j6yB>R_if0h6M
zIRAb8Py7EJ0Q-NJLiN9_dHsKQB5qDEDk^GmlS3Z(#QHUm*889Ql&O5NN9E2WWy)V3
zUr$W|plHt`1*HvS|G=zpN{R=GzmE>277bXp_UCHc&HIF8oa;_;7)0Qnu(@-(q?xKf
zzxcr0l*Dncmh{Z=eA?I;5HA0xjc~CrfxK=9#Q-G}elvf*lQ_MtuASccI`%aVShK-{
z;&|a2#TvrOsb_W-5T?G{{{?z66@$TMF)5MA!q0jSE4U)0b`3DI@JZr1>?q^*4`0o6
zQjK(%K>^H~f11{tFuW(UKOvA?iBbaghnyfUY8mvpr8MHCX@I%UZ?z~*5D53Uos36G
z*6*#`5<fkCGVA&(PGWmNxC(wnH%7`~#jI44#{E-m9?8J;UdZm(+U$(#yv@JQ(PkZB
z695d^{(QY*&EdW&HbFI!tweiUhgy4EoZUgOG#u|U=oRTrFuzV$)<`Qu9Q3OIewmv4
z4eEvC)=Sxwf*<y#Nlv<PHO4;aWy}%JqS1-?sV2zzIH|gAb$tBErTWf~FZ7_@sT|H9
zJ5Er~>U1k+`24iV7)Omyavd#wkorrzrWDH}jl9<6k`j)1k=$+Vq*HspzY2$g_;I3a
zcTp{Cwp?BuRmEs=#VK^ypP)Rq$v>`o2e&vo#;PX$n>JNVjAr%7h$(SOvyq&fa*}^O
zw!@&+5l65+pzeK@g{V|A0fxz797gGBLSmKZy!}K_m1!1{I;kOdm}>Q#g=po=6uPwa
zj7)vfyojS31AAT(p@9foqs1Rao4c%i1{SxB%s4`*8-O8(+GIlqr_n6ja-;|2t?&H{
zhxscjKLNO=0{HG%e%R?IW@5_zdk49WPoga3|EI3i?k$DgC&vO7(~82vV11)5o%euu
zi<0893k@GWH|sR~%D{X$)Nq}7jh-7{?}U(tFz869@S9Bv{ONJ$s5yjNa$d&O%N{56
z*)d0xq8eGGeQo+v8PX#6p)di(R#nkjFK2+uNYZL@|I$h_JLW&O033pA=kDQ~o0*Dr
z{d<mRZF2-d0b>Rt8u^wOBa*pV@cHW3ZYC&)bP5rpiO+g0bFV7^NA!@Uv8^M&cI}w+
z?e48|sE&k^^f9d2!05yPb$lp2I)^SCF&>L|Ts`UU*HeZT+6y06nHxhUJVV2XSHr20
zqpg^rB4vi(6@-Nbc6Q&-jErR5FU)vw6TGO{P=C2PTcWOKQr-(yubOTCIKJgp@Jp_i
zB9Ls&-bK#5mW5v?>p+ffu)&5h@Ln65LZ=9#!wyok@1qbV<<!Njy*Td|4x&QOEkaOK
zmBogqU+O%L*R~H^<0%;EAN!>e6G=n7x@lle2E}O0eNtQJ*HVL)F2l|z@hK;z%2wd=
zyD6=Q;aD?FB9Js9ICmT2ubw@k#=-#_YOsyIpKmdrjwzZP%>CM`)$AaAbfl{<D6+Y+
z&{OZ!qCQ<(m}qZ3m7K^!Yq#!vEO$SW81iM`!lhUUpHV!AWo6-da5#u{PUadR=j)*E
z_$Q^<o;90q3jHZ`+|K6@Oj!hCP9l18VeUR8Qa>6**pfRb<r*Xzq@{4s?d&dNZOM=E
zkS#>D(XF-FB(TymgPU?W1E;+rS2nf<Fg=k(B_m7jx2zYC{%T7j;w)Fhn*IW|>f|qQ
zM<7a#8Vt+c+dTu9(DCi~R-&7epI^QRa8<of?ejmT!pv#Th+L|ME5@Wo3d4}DX9}${
zHeF>>u=z&91u;)mSY#cQ>AUq8vNlncPgW*4^J^V@48EH8j=`-~lFT<;udYuFRmEoI
zNQWi*<BpnJuGYR<RDAkQzwYjSoWnvxS%`+B-N>^LVn7(e<03v;SR9`IZ*e%947?lZ
zmhSi(K>~%%(9)At4dL<dE@;^~E?w*~WRaPQpB-D2jl6wJOwCV~y6D`&Me1-cohigB
zZVy|M7bwv1axx~DN;!5cH#?a4k$M|tf@wo!|H>=%8cP1Gqg4><weMha&d%6a-Ph;O
zI{j`q819(vR&LVpo<e5Vnp&QhSxlO#vV+XxlStvG*lZU1tr$_EE7<F|yNY=SeDQ(F
zK7Tu^hW1Ajs&}<Fa;jN<I0L}6XQ67*8mXyEUgni=xQ*Mp=yQ%$cv^|#H&DKgbz`~;
z#en1Z9f!8E)UqXG%1#HH3&Sch=il|bB)zdbFLtZP(UPGA>?+>)w$H!ggaArTwQU%x
z&wP#f<y1^i+JO}mtReYHycMW>)TT2tKYMX;wmn@p9NUqj?F6Htr>6jw{3$!v;t!be
zft*Vw(A3e11Ic-xO=}ISpRUj{P3&v-)01$*FlnI3HmHR7u?~<U_U~jsgE9l6IM0TE
z{`9e4%+1PLQ~LNHhk;2f;4U@?q~j*?DbTCm?Y9lS`_12p096bBKk^eCok2m$mGp%(
zM1{Efg{X;7GA5aSDB!-6KsC5THT-9IU&*|Ayh0<WgqZLCI$8oW_rfhVFL=_ooJ#>e
znLx}Qjpm>5%eZG4c}>VI1Q~G}wFbjq{7ZpnEqP><TOs^<JQP$7BvDF2djHDGj8;&B
zp)_cY&m;QJU_J-}W#|=AF&~dytS0~6Hu!T-+s62|n5!xiWEG7RD45A(9fv-Pq0*wx
zh$CS7zvYr`KMfe||9koVPQ=H;-VAY5IorUGeS7I)NL>MnhLShRs%n54(Qu@^=I{K0
zSh(Af1}){@dYPT6W2PoD2>d&qRtFf~27>jFOpnMEcSs%nRE7cmcBH|YVb2sD^Iaqp
zh2~pavac!;Ow;{@B>f$2J+}9Lnp+`t8F#w$Yv^--XK_ch9BgKDbY;HyZ?7=za!y2P
zH!rIVaF7uZb90F4B&fiAw@OB1VQ$8M1&&W`#-m5&y0KZMsB@QitXw^<sYV%Zg<W-F
zOMb>euVu79w--atC{VQbPgK;FBFnmpn?GrEd)+P{`J$(<CONyEa%&S}Vole5t9Ck&
zy#LAWt+v)lQRjWV5)B6Pgns9~gj?)8+>X<B7fZ&x+UIijs@H3TAIIuXO>qD7HB=*_
zA^YqRo+j!V84uUJ8?H|&Yh+JA`spveh+X_Kj-cu!KSW@*y$*3Y$Ea2w8cy)3)T?DX
zp5I;yfl@}Bk?C&zXHnG!w7-V_#GsW<BK@b9#*QUMk-U!1@Hq|xY53ny@ey??;`GGP
z@P4{sK1aLh&D)&OzxacRW=OrgOe+s`CM^}xu{E+m#vL9?$g#LogL$h90xGk~=r}ri
zPS$8H?JP$)pnKQVLGrIVXSihsCK?XACA!qomTswbxV<t8+fUPFyThrz5gQILIlf4{
zGSdMA*c*@GB~6@(=mB>m2%|*~ZMu4j{oU2<x^02L!q&f+b0aG&$S5JfHVk=Z7jtz9
zfX}R)07?}*fosu`{&NN|&Re~6?pnn3;iwS%!(ROFh~r)T%hC3?!{b4sjkgfa{>{my
zxQcG!8mOLQ`Qfa&&akU*4*9+sGWfm2;-?3I({uNRMw@xjXeIe!KN0-yU}a&xCf%Hh
z>9)vHZhE*?lOwZ<XK%Sk;IuWp_*s(I&FyqNoXp|~r2BVe9>G}P$SvYQKW4rNRz{bp
z)!#}b3_-1yUVB!(^`!~3c8A=r*JeEJ@A=v^?E%@}&9==~Nrm&Natvf%tu>EF=ndT9
z$b!4jpTT-t9WSmXJwCS0cJx|bKWRLXejqDlmW(wnO@UZl*2snL&5%q5JPr4p-8r+~
zNfN6Y@_c_ApQA^~@3M3#p@E>m4de0zI}H!xl%|F>x<!=J`6(A`KzDa6?jy>5{`U4m
z(c}b3g<5>+M)1Us9q&?d$$fD;+a5N!P#It#5d2l_Ve1o1W&vQWo5E!&s)7bScpgp;
zWoh<1i7bBJuKtE!ln?DmD{fxL!90BFYP%L`PC?sz=fRckNf#X`q#RBJ$qP=;ogO-9
z<f_${X>Gxi#{@w&n+ow=L*5BB2viJ2&*u^~*zdc<jI^ddoHhI(?7an0Rc+Wdx&cK6
z0Tn4JmG16T1f-?AySq~X>4uFo(%s!1o9^!J?!DnG^nJhoJMqsy|D12;%$fPt47$;^
zpY^Q!iMy`nzN*}8o1~gUzYOZVCQb7Dr;nx+>$JlLn5;?Ijuvl4qkW=dze1jmb@(%f
zQ(x`hvPj#{51Sq`y7xA))gyZ<S8eVoMMws5Ynkv34@F7z^!UaKE0A5fR90`C;ND2l
z5>qK~o0Ti{WZJaplqpZ3r@Som_MAOd;2T_Mn0IYcn{A+Wq$m3O=wZm?Y;)M<*`S$9
zTYGk;j>(7*YoO^Xf1of?IxA*1s9M7syc@n?4e@9W#$d6ViGW>akgx28bdQb;@Rf5E
zjctXVzdWx9fM9Vm)Mw@+FHtk7Uj&nwrfA@cSf`aJ&7}w7IKZGh%GHkU$GzED%<8E;
zezpI4(Hj8sR_qH&OFk1;606nh;$g?DqI-;5y4scYPpZ?mKy8QO6Y=zGwXx+eUKNHC
zb(Qr+Cmq~ZTKS^QQBh78E7$!}v^EDC_8y7Jyx$v@oP|RV0$r}RiNN9L*QX|Q4_=4e
zPo(C5_a9<Z=os8XVAV;QDZIe+w(jOLcJv2>etiuR(=%&wKT3w0PO&2_LG`q_esoj)
zRc940D9^p90<_hEl1v+kA!^pFkoi$@=jyL%1+JfD=p3$EsT5uoc~Eg)9@OCDlfK;l
zqRHha`S9U<CH{Va!{E~6J6N!*fcwhIi%NEjU+S3+utZr1P^qyx37aWTF7RfC9Hw?=
zal?UP9feyJjdMzNO$}qsP($Io%W#0t!0l)Xflr0OS-W5FV||R(I%Gky{vRb~wDDN0
z%3ku@@$I-MLm|1I9E+KgAxb7({diAch2+9dSdD%iY$ryysea&S=2Nn(gq5&gX@L@;
zDa>yQA}f4Mb+}<U6S{$PQ*jpmm(-7vIAD2%nDQf+%zKU1fPT?_RcT&@p8L3|8-kb6
ziHVW^%|+q>(uw(*1)+2h(ADz&&Y&J%p~4*92&U+xF&5WD`#ZnPh1(HZDcP7U6|MXD
zw{G(DUP40pMNAc}PWooB{xKmMw%=ib6yMQj23zz)bcE#Nq+<$-7)r;>U$-M6RE@TL
z(e@`>|LZgJ=cn?3isW7i7$nIWDdiu0s09^DW}>G5^(VXthHt$-BIx758QmRAApYqA
zN+F=oYW;!AM%Sc&l$_VkOOTSs5I^k)kU0+Q-Pk{zZ{MUq;y5w$#Pae_QbY3cn5mmY
z{=UKZF7DIW)U-rpyUa*)>CVG%okoh8`r_1H3Z1Dk+NsnG;R{UB7=ObBUVh2<*u?U0
zzw`g&;?J@R{PQXG*?)a>1ISbb|1uM}?bgD6_ilniKwn=lQ${&AT%KI-Uzh=gkrv2I
ztA}v|n?d<vNDx6+0Q_3Jl<KXGb8fVp{6EVO2t;bDr`iX2n5Hp}3H~#_EoYMe_p^Vm
z#kcc2D+)~Y@W0{!aVw&1!<%=Q=;4`W>>?K)7-)qyh9w|m8w@fAyx;g-C3g|oxiU95
zYZdS{{KKn0zyb+%&T!u8HU12gX83dQJT~0&b*|rRju*l2Y9)dE(2%TKSQ8VxQ}-T4
z&b%GdGI0m0q_VpyvNn~~lh`)t+05)u_gZ8ctft&nrEl95AnjW^ixpuqq!8(#)w#;z
znITqb@!~%pjiCB#&@?!`8-A+N_iIRq^&W_avQd4ldqeiEE*P6FQ_A(HB(g%(hT!1d
z-n#bHu_ZBzzVhUUa>Lues-HmC;RJ`?&LdcV8(==byr4;=QN8-mdgN{&$fGmUou0I}
z*E(>9go2D#A>{ZMoZy8eqf6j@j$M8T=RPeG;Ym<KL9}kNS;$KeOu8jfT1X=zbe@cm
zn^&Vi>mMc(e#<p|reqlSZl0TpPL!+E5r1gO5pX#-G~_jn{%_E1_*GWjgDobWTD7eq
zq61oUwWjkhJB}50R9rq<>Xw0@L=qwMbrx3~cIk*-ll?6{{;kZvAKqazz6^=qVmOMy
zh>?$h<N-iRX$^VlPmg0TTb4B$F3#yt{Xx(dubTm#w1KNAC4`xRwDPM+yts?;*uHTO
zB~T&aFD^itP>^>!q<;lq-p<JV0TmKT#jF4HJ#>G6ojM>7*}nNH-@XP{uORqM5~*Wc
zmCIEgy&;$x@YlpX>$L^@WavdimpFNdRUawwbt=56choExH@&PIC~ss)W&u@50wj3a
zW)RlB9(q;=ow9hU+e{+`=JscC<r4YZ@qap7kX1Fw$bsKagWnxYFV+-pU76lKP0_f2
zdC2)boP``cVVR_!XOq{7sCT-~ZO3va?6W$MKup`vp3h+6TFd05l`$n?9U7EzTaLPN
z$QtPZA7T9mWMmuuPO^WY;e(Drvn`>;^zQPSVH|8PP<~4;Ut1q<w&Xne{iYpj(%upE
zVdw>~1#5wrvC$JmFNLm_;jb6LoB&Xa7y$v{|HPOF^tnQ0U_@P6`BmfI)i2cwUc1V0
z24_(|KkQF=86R+RX4Tiu2%ij;?Ki|%pOu*jV0yl73%vm<mV8&M7Bm@ZUp>`t;?-3s
zirEBsFgDhY+H|*WeCTWy47;nA-z0ncvD{s+Dfa}ukxDGT!eP*Ds7IM<Gxfq(h3J+W
za{~2G<mHBPOjowAMu4-gqNJ)6R3wjLH2)@xuq?CF$R+bLLv8F`YP7#zMr`RW?eb4M
zZ%mQ{^+s+X==u}zLC(-*;d!qno9n<zw`I#joj=%_o!8dU5*z=p{7m(98X?-hfSlIE
zGMQ4+qrjV~&*J>{Amv$Uxl||VR)Fp5s4puwJZN|p8=C>UD{CDmEgxXo8-D(1+?q?v
zB4}ljGnLPe)W-^r`hLu`Hq=Bz4oLkr`jQQ9413&Vx;tMHHO3;T*+{k_nmI(A_-(He
z7!OR$BTQT>IbFV)ui{*WXWCTy0{cLW)`L+WTxZB)xP02G4fvg@7uxhQh=_=fkJK#*
z#@HZv+yqk#jcu^DZM4sSQ@uuCx`l4&khIq@pRG@>wf*dBR%^OT{hd)aRq@4Y=SMh`
zS!?xP_t~2&b8-E8G~7H%EP#254<Hx|6)ek~E#F{&B6Yg4X*obk`37$xme*x--`_{7
znxKy~*|Ol;g_X{wwV?RTzhK(exrsd;GB|TUDD3wUwY!ktvuSI6L!j^vm9Ex#Fee{h
z)u;i^0U^-E<v3G*lB}|_v_Z04@IvszeL_B~I%jmCk0WGHBYfQNkuiF9YvitBfvMYK
z#n+Fs^u<Y1-MHhfx1IEQ!*XXl?SMV?n+9lNMY0*m&K;O;F303zVESf55eVxv-4s8+
zc%r;}D9DAL`GuCJ5~g+iGm|Wm$f1eJS>!)(wI-y0aJ4T~9_7fu%=mFA@%xIc5(Usb
z{xKZ-0cyL%n2Au+4!x+Kz;LdUpuEG#-}ujXlW$@VCYareV*}qw21G?)Ggl(BRtWv!
z-z7u$s_M`1CUGW!90ok+SDkzWnEVebLq=ioua$xO2bx-u-A{zkk%ImTcrtJ~y~f_<
zHO-WfoU;)@pxD^>&u;L0P}W<05_$QUx*<(@<y>+qAZGIC8d7Z+IxWa6AaB;x>(Ij;
z<wI=$*2hjB18jt%`k9|6{V{ccmJvN}R&Z~R63Q|EJgaf!m$0(j`?9A17}3qe_0PZY
zjFr$1|I?`XTX?O%AOBZq$j`b$-w^@k*Y#M!rV-XnTa)<{6^awZ$YV2Npn*R{d;T_b
z4iAVMq+w-WwQVx%q3(w8Xb^cV@&h@eKiB_8Mkp8_1(X`LT1@=M5aIED4EzvI-28c>
z7Z&dSf~fUL3$Qqq^!1-QZzlJNKC0<>R3I(IkE<a6n|Ns6R{8Hd0BZVxjM^z<hCX1r
z(^5Tp(ng$rzv`RT00gJG1>|F5>@xo>JCw&v*YM8~D>-S6&&eO^IP3nTJ%$ngG%^>x
zkqO{yok_O?fg+HPCekqL-~RxzFnXh|fn|}H2gnjk+2+l5f_C<QS~Lf6yujEPiRVR+
zIB4N`8=Gl$(9;9u%~*ym1|WfuJW+l5r{=db=?@>TeXIJ0{YQ#)$*PoHi4bL@bSB!9
zJj(lmNHQIfsTis_fSlZ8cI)^@DqLRLYTP2)%VC9KWC4707y4fXDm%>B7E`TlHTYYS
zi}oFWY;Hk+YLzZOHJmI(2g;<gPWbnl7>>jNqebvHOGd|DrF?g58DW@U1K3a7aF1dE
znrG6XN9plaonCT1L-E*>oKyfGHC_k};QYA<pvMJny8Y3sr*uNy&*ktw12Wo{*sDbz
zU2}m2;t%@^$#wtzja<>~&Jz-dbjwL2o9YY<&n?2A{_uxE4KG!B>gL$(s&9r8p96Aq
zd90ZVbO7M@^rjpjD$LJ&d=$=OfD&$4?4R`rOu~^7_~zTnh~L_R`uYP{@1%H$dV)Fu
zG0(CCRZf7{YSLneOL1rJTO$#^t%kP8iIXA<z=4M8$ghCM^K15CAZfRnN95$>1+HWH
zzeRcp2TVWB;ivD;u^y+|_KW1g@(<q9F!E(Gd2)=^#EM&{PXM&g3k&pTCbl3;Dtu(f
z@%$<CSj3X&FXC9kYBcQ!(m@!su;3f`Ee0^y!w7#liZ$$FFdQxPs+g*Es@L8z{F>+m
z=8pMY<_KNLcVNl<EA7?v4@Gjs8J_Xg*og2z-1C1*EzA#NzeH#=5XW5z8~O-H3vdMB
zwLo5*It*qL0sH3}`x!jQ?(AU_D<~SaA1Szac7x!|k4N_0j-2zsv?|9p5Q@XZ?18?O
zdK5g)nv^KP@(##A!k_rnpJuuo0)G*1-i&LN7QWJ$t+|{Mh}cs&lJuC3l2Jx&MP~DC
zwt&ew(i+!o4*W?WJgzikEmt9GBzrgM&sxSR>+x4u4{p?|f56JKjE{3^Kn(1%&i^BL
zkIU7<U)EjSQJK3spwE;24Q@(Oax_7`=TsiOR5IlZuU%(KgsTG$0rVKG8ua}PxTA6_
z)_4)^qY3!HG~WR)3~IgeZEu!JOZhyZOh<7%fLLB?e|l|BaR}Q)l?c`F<e5+LOc@y~
zaGZ^Y_r4?aLBe{C+x|_T%Xl8X@JG*_k>dKII1UR-^XXELc&>z3eSqziehEz>eP*7J
z(d%$kZF$3vns`~b%TAocUZ&q`O0ZjL)c5$FsV^QqAZ9w&*WG3zZ{8F=G|Z$QRQj|~
z*RN1jKh)VY0H7|?HzNL-NtWBA1ARMCn}}}^dxujLyp^<_>pt6;?{<!Kj+n`(mp<Xc
zmt8M@5Lm$9pZWOvx|CHJ+*uOlISV_%)^r7b2~Q$<gkC9~!$L1)@g`JTZ9H`C*Taz8
z;rGAJ&eSmHk}UD8uTAvHN!#&6k%xvPr3aO#qezuAsTdIG8OwEhOqPr6n(;KYZ+g}{
ze{V*Kc+EOQqBTE-tI%NJ=js8>*i^yCwP|EvR>f>_mSyz1^krhLQHD8wD_$R`(PbOG
ztMcTbGr}$6^^+$xXuoQiBn)ua9W_!b#b2S5z4tj{?GeE^vf00LIT;t5adpkb^`%L=
z8=Y1nt$9o4)*!{0VAvb6`GU?Ok&*SilbP1>^zsdvpbwW3)QBz~y_-P~`bz9$s0Q?Q
z_@tcFCluxW)GYZMWK*?dFYbK3%QRs|t-|nfokKNJ-^V|#37ZhwRX-=2abX#WH1!?I
zWA7Cv%<r{Eg?#m5=kR81IG#k}=B9TZ*d{>yQGZ{H*(h3{P`wc><kFBj!{nXp<npR-
zl%~T^_=_Q%1xJ2>_QtB1YPDwMt7OZPgiK;C&H%(8ZghmIsM<45PFy9O*`dT@(^cMy
z#!&^n0$vFuACyZC%S{A*MuV3y#Zj?u2Nh2Qcdu*$=#{?^eGRQ7sdm9tQX>$?pA;Rd
z8bZRp?Yawt?{gvL5vh*bn;}M(P5KxxXZ!wBK{D9gV(G-p1!}gxhXepr0W}r;2^fu=
z-lxJ%s#yC?j9MLOGs5VsJtmU6XNhJt=X^)bsvarINs!VkV@3j4HTlIgi8T3A>sS(N
z$|(IW8W9frkL`@Z3;JH^`eq~V$#_4^SQ|3#K4(|P+wywkd(*g_RAW_-NRqH8rx@UP
z>&!Yov*g%XjFp{1ma&!5MX-Q_Lli#AwIhNOUwbbhLr5MVep~WEH7kvi-;5J^*7b3+
z%m7vTK&kpYwwLbZERvsr^OQco+VVh8==3NHkd03v>5;_19C`jN(t}m<%e2Fy#${-e
zq*~mvncC<K`*-n)o0-LtK8*{bG+8O3M7$&4x%9LqO>BnIrSD?IZNW9@hG!-P@6GQT
ze#?R_c#^4g=57#!{jZ%C0?@g@sHugJ3vm}20Rs;R>7&HBWgnU0jVMmfz4NPIE;goG
zcKl#?!7{2J=@vlQ&r_{4o2J`V2Y#EGC>rVWgcB7B?5YfrsU|agVVf3pO7wXF5v9^W
zE2`nTJa=^#`NU1g&&eiWd!MWv3kJ?W3R8Ainfn1VH!+J~zhB-um*PRRpI#kO47Eek
zq(A&N>KGt%5T$3o9|w+OV|9xH`U6VFf7Cb?c*d)TM^&Vd>C5{jsBo@LYo>q*qs|W2
zYv?w`m&;Z{nB{~py8HM+j*azavp}EYXHQ+`ddk)!ZPvfUV<aSYS0N+Wt-ax75m4*i
zo!*@blP6*_J+*s&?C3l_-oJV`pmfnrx8&oRr$~X7Und_V*JssVXPR`bCuYxcGaRQM
zZxq+AQ=Z%;B6ab_;;~y2KQIB604A20sdG3=rHLX4x?RV)Yns6>(@#G7k@68i=gkwD
zHe2ASt8YF8EYwQz2x|Zs%oivL&R<@o?;KEz@Fl!|hu&t0KGM6L!MUm#u&k43)bT#0
zHepKTC>V?DN$`soC2I=BvL8tt7QMM)jr%Y(!K8szXFp$5X|ybRMjpl6NU(^q9Z%S^
zl#BH!5->U(%FhLJc!MHnf#v*(re~pJRI(7Q3wJe83u66`iFERKie|X1<3v?a*kDRD
zniR%uKf87JCKHvHsI4muIeny<*nJDCOenMgL;!2)H=_9`K=HA5tYS=G%g8t6>U?rO
zuKao;jUSQ9?YiU_RGkHxM*SXT;fIg+Z!7@p&P_M(*I|CoA}P}di7pI^Jrs|&N`kdx
zQLC}q`y-2l-5YF<TMh<1Zbl}%Ny>N+d%Hb$ICB=?wriYa8@XQWEo5X9)^*#If8u&H
zRhUBnirF8aZIXWwT`jhqt21@%Gs=)NS#&0!fsv-(RSp*pW!nIDDvHdah&W|8GDj?4
zG2*Wx17L`K(s-)dI9Df;@(zbg66;Q`>$#EzXdvx%Hpsd37qF$_`hl>|vEa4-Bf<GU
zwF(|b-Am*DL(r2JVDhja#vW<4YfnllEDrV6Qb@lsqK_JMNctL4k_sn0)X^3wKwKRJ
zd0yfC(zd&a=hqLa2h7ziz+f9z0k&?hXS4M`8~7$>Djdo_!mf&&IGl0iuMyWSvF`@=
zvizFWUGGByniALM??L0;9Zk(C?J%ET<6J{`Yo<J^r~CAr^&tt@c{@98`mVNnvwNfj
z=<eJZfK(&^8G;DNIf3J`XL(pJ>%%i`=gU~#>v_;oBFu5T*IvD1XQ#XBw+)L>83J<)
zKpJE<`#Cc0ZP3F4Gzeq>sb(=T>cqVPHR}B>2i$`Gl8X~{*U<h-Mos2*p$bzSqIfb#
zL3>EFnn<P#<CJmRdC4N<r^pQ1V=iq1q+I2PaJC<JuG1xuppI&>JkvGOBp#@MP$Q#F
ziJ!NK@}h*b@&>vo<IeeLORA!P=8G4{`vy*QTo0iIliZ{WEcx5he0uZrQmW~$Y=OZp
zs4ty~?2bWLym!g;TgeT{_6*dCKSSSfICO-6C%8Po@SX7`iBWk|X&E4*i1twW`vcMK
zl@T4)9{c%4IBNA9%db@SGoPwru0V>L65oG!_gHfh5Dt8dv)(#`$T8Ji`venk*m#+;
zl|$~HR+EVS^mUx>S9J2-sdbErN7Fe4T}oVB(o^4trEttcTZ!c_q1vybx;a&Usa|a#
zbj4~&q31cA_j0E|p{D)qMGc-up*{r21J6GBAC#09UmksIidW7UFT0Z>5UB#w7#9@_
z@8An$e<%)pfwyfSpG-$io;z;iglluYy8u#eR?HhnSeA~Dpp2YKrre=F@70yr+TES+
zhS1vM%NYFvfRkVd)|*GK3aA1K8keG=jjnLKARM0fa+W;T*PMc~CiLBhzII_h@tIU2
z=VTK#kM!65&zRJ4ug$XK20A?U_c53d>M4rVUz68|xNPwqUE38+taW5```jQe5f0Kx
zaN|ZPZ@%T!ZOu8X<O1S)uQ}TS)Wj%&y8hOKqk>FbGclRN6Ek;GiMN620hji1c7$AO
zNdb$SS5Fno-a;de8kk0W(@CV~z*ZXZ*R7**-_;?bMe}->9<YO4n5&&@2`=aUd+7zm
z1Li#I?(Pnc>tGBf&EHIFJ=A-wcDtj3ze7nOqiJQAMZAp@<u(T{SGJW03(e1@V1vDL
zwYah$i!90&qZc5Ui<BgRAGKW!24ReuU~W_MleM$pUv+kp{w4$y&sGSSPcB*&kgPu~
zy8Bk?YD`5G*ows;?J+E0gtuOb`?h7MF11`Oy(pc!jWOyO$u~r>d(ape*n=ERCM$Q3
z6a1_U3#giys0|AyLwj_jx1Rvs+cE{jLZen@eQYkFneWa8XNBE)F0w&@qQY8f!rey%
z2@Q7SnT=$G0(F~(-7x+5dCq<&8|X7flv6AMsk*=&%C{ikjbgTIO?<7ZKE_HSV!BSn
zjb3{os;%-fFNtFVF{(K=mL@Dh_4tea{r!YM^T7}e(TnO|gpEs7hI5Mo528K3W*eTH
z?6vl+z2u{1Mcnxo^JU1*u<Iz3%o9Twdqd3V*JE{WD$N3>+srfA$o8&KmJ;9Q*`nSI
zL0g`=8`#Z!Vi8;%v9#mkok7D&XL`vz6gYpbH4$rLFo=e;<7{HCqXO>eZXHaFpg9-~
z(u|LDNSSN@4a<dpx>U&2%b7@(t5JG7*i07ccw)sgz*Xt^aKU)sY%t!iR5QsPFx3@O
zW<I3<YT^{><R*o8DZdwDF0@duITb;iy*nMbdFK+X!E>ALl3zoM9@{kL-Bk^5t{EVn
z6sEz0tCe?lm8XI)Yq=oq3jOtpCO_Yn5Gdd?!TGqCr9LvY9W(2<A;(&vZ68e@9ACT~
zBY@RK7WC{1#<PD>b|GSrC~#H>+kQA31j!fj2x_nGx9A7DHgb<hMm_ZtsZlptjvy|4
z-5k9jE>T`$i;Jl>m)YpdhDDX-)8}S$0AaLFmQ(Lkj0RI;Tp@R6#<NArJROU!Dl%4`
znn;Z1?&@&lHS(lb`K)6jYEVZ>tUVs{HQL_d#n=x-%QhlK!r&D#x+fWLuP+puSx1bY
z;d;0cAhzT|aePP66bq^AJT^#i_S&|Rn>|SC_wg0yF1LJ99r{(b=;jHp1EWyLGW%<B
z1+ZztUma9zISZ$mC%5^i^O59eShEmzB$Z|Fdlb>8<cctP@(`HG8%u{OX`4dyOolY4
z!_%|%5f1mDjjO!<xrc)OlKEq0VUI?|yQhGE${lm6u<ENSpm8{LQ8S%ZjZoV}Q(ial
zEtgzY;Ta8*2#z+R(MDp|`>?6u%$=>FKqf-mLO<=5i@`RwJBBlvqRmB0h{({UW9j>l
zRC{&Nozf6fi}MRYyk!<^gZHu#wt8z}cQTfIaW%~)!bz%adU>laJJVrAnSt4b6_=AN
z=hs%I>&4WCrAE0we%>*c?hB=Td%e3qJkc?5KIq%8R?34j)mN2}R&T8B<`Qvg{48&f
zdoM0KxnOtNLuZ9Wz;CD`vzcJ_%(7)<tPTz`$LUdgxxv$)KPbo;AesLd?=W~oKP5{l
zM|+UcS!Gn8(I9&mZyxPTNa(*rPY$VlF~TgBs}VIyb%jxpL@A{<OR;gDB0Zxbkb6lB
zoBui+mhZ`(Z(_l0jW=a!m2LvPC<tn$?&I_%UxR)?r>ZVJ633$-<{)Lczef)UP;{ND
zCCN(+Xih-cGK<JFrEULlG(Hm@2aAs3ZF-8r%{%{&OYqjdoSq}!`6IpeTxVMb^Bt-=
zl(tW-snso0(^Jw_MAT&@X*B=yX80n)FVfYssZK~XJ~@rENs`|$B_(>%pbY&weA^&U
z67LxJ-eo+h`O8*1aIj$ex-szPU_?7#H=-X8U-9t()WCCZEjTaKXvfhZ<haETL<i9n
zTehY?0{yg$0H?`nPMbiOVpnbCc@)J{(KPC>98ul)+$O_fm@g;TM`76>wKkXSCn*G}
z1HUuHC1Wqe<;e}USf<DFtOZ6*Rk7L)wmlVSRp~S81M)Cpb7pP&h)?U@WU5qsiLtE`
zX%1M?hAn8E9^+yWY_|{xx+vauOtPF_=NQuOutA2TG2SFhqrH4l_Nps!NE-hpZJvrv
zV!q)f^9SC$a*?vJ4or(i8c2~I)@0~qwEh)|sBBR!#hS76WTS@AmRGJAUmU||=<hX#
zsoS{8QWBc$iyS)7q_E^Flwp{wyu1GIK|xVMK2ns$rEV;;muInEl1U7c5{=y|8o+!2
z0fAY5VZk_n$l=N(@*0`V^ozKth>K3q*qmmtsnk-mLDF>9L1dj{#pz|-lE)FN?(UD6
z^ocWyGD)Zt>0PPAm)?oyOU<N{LFhwhhUKAVeYm>PYz-+L&7Mr;HEe5P$<zHFtvFxS
z^8T#3$1eBFwVsalPEuX<7w5Ya^MtQPUx#ZPh2lklBielJ*eeQ0qAAm?B9I+szv|{|
z<?gk1_X^nuv$+}bL9T}zQ6_<vI6}70bz>c7k;#eAtB?Uv`H<s`y5@>-cI)D7J`V1;
z5m``Jn3Lr76s}N5fqFSlc`|op!PR}`w)xzpAr+yyQe!=xw$YuqsijDt2hZ-EogI(M
zEGvIp_TE)qFgLVpyz==%e0Qjb_tn*jfXi5hDqZ$sKi7z7_S@Gq#S99-5n|8>L~*9`
zGI$>Se*gveaqNwaMkcXmxc7I}$Dah__gHmD9?ekLlDrTb@+K^yZI;ChG22#=cj${V
zAKg|~#^5Ylds|mkkns%7_mbR7Tbex`s~c2SJQ;^Aq057^TR<JXXz%ce=5d0&^d_t_
zayaUj=)2sc+*3C`kXUmtSwGRXs+&EVV@i(nY~PN|HX)!gFkT7a&MjLk*q!xA;(J^T
z+m}1zDZaooxN*IR7PM2tukiVEf<y-hpPJ*rYYl5Y_p<LQDcM_Dhe6nn%3!9R(CoV6
z?RJop`M}n8!&hwR@|EGU2wOf2u4F;Z3xYR{7VobhT^Dn*K<Imx{V`m3`{Gf>8;hHH
zlQyN-X`WZ}4UIR*%6zD`mNjzG{G=f#s@;DSaUdYv(9HPl44UxEobUc8z~TVtrvc!|
z$Tr=hPrOa@=TEZ7*#4i(1@2F97x?_Ykr{aG&g1p}n^U?_KG!RFEcv)&Ybe~{d^C<A
z|BGY!4rCMZeI#E}+W6Q8jKVlU<-YiY1-o*a>WU!q8x>1)Me~VDyD`xPYNkFUb(Y^9
z>R;seH>%)2yu>o}kJCnU8uD_+x8i3$gErm#woSGj1b$FoLbo{10LK;t3gidEdB8;u
z5BI0`Me6e>T93bbeSGy7<NMz?{3{0@qX=M{{>26SKL`zQVL{*E;U67)5dZ7vEsuYL
z1m6R*8Mxkl2XZdJ_3g=j-|*jZ`0x4fU$8F1pLnr;bId`m&uuMs^p-;V&GH=7qOZ&1
zEQjfY9p<9%{=vi)u;ML<KnR7Cuh^%pVZo@*54*n}GAV~vb~XTDNUWH<deVYG-r@Kh
zqjl-|0#ewj9Z+4!^?3{b-nb^Z1{RDfrLm9OoXo_u5YyFMz`YR!QllkEPS&8b?~bQ5
zzgdB7FS)umkDmDfJRBglV;rqimT~+&o%`jpBYlEN%KTc0c6p=++%jX7rqf2OW>D_v
zm<mbr`>D=(vhl^oue|d5u8@OV`ziJ;Bo-#Ddhr4dbgitMFV#cWQ#WsJ|DpZy4S+qQ
zaCmvC`|eBVg28K$7nRq7!GV&!oQE|g2vh^?EES)<H7#R=-IE#>K%gSfDRS9t`XUFZ
zr+_yAvG|Pr1lcGg)FW9#!|f0YRP+kv!hZ1gHP<bWKb+@B`!C<GfN>GyAANR?bgq!3
zy3a1Hrex&sd^uKdcb<*$i+s3sN%WBhkRV1D0wK}{NNVdEER1Bg*LGg+OMx3o$G-kF
z;xYd!C+AP0Yv?dB<bGL{2v*~jnYurb?Q;A|>v})-Sy9+MV(Uvl_FE7LO8va0g+w~J
z?lvrU@I`L-Hs1iio?$aHi<i%zAhP&@p<Vbbq1ep~(`d|CWM7YTVwsbMXn7FbX(IV)
zG(5;F#Wyy#&KvZ$w_dE8kSes=B<l84^}9d^)dBfK%hef<^Pie`iditObea1(4W!VU
zgWwv;Zd8o;U0kd^SE)wFRV~#|KYK0r7to(^^e;-Mdvdw-r1Do5mZj}?%Ubi#9n9vu
z&=n4C)YkGJlu?t@&gHX|QfdA!AUw~ly?*`cduuWol4zdURzW(7#jLN?`1W<pcOD*z
zZc1)fG<+WYHWUVJxLI_Pr(`Co)3NJgcWk=C5_tCQC{y=gt=iP&g}IhlB{yIr@8Xbn
zcJ2P{?PSD+2{MP%Ysu~_EQKk}V^Ad=5qg&R?$#Rmt2YeqQ#p@}PQoq*C2j>Ju|3zO
z_wF2ylss2!M%F)aCzXcQ-FE~~%9_J^&)$CtTMDk{$TM|Tu&7OsYfSNcziXf}s-f5|
zvoqm1J+P+hhjLsV1HHNqBb&3<fJIt%_~4|w_n~5O5~ZKj8;J(j<(%k=Hc7J$VQ<*l
zjQGA=KGe5oJpz9MCl;K}+Q!DeZ02}KteH>h(=FKB-HnDXOdWG%eTsHA|4{1Z=Xa-C
zxuV$eW0njkw1yS>sl=<VS6V}5fr8q^D7?ye@zpyX;%}7Hg_x8_hdeIbl5w25eiz5z
z3BQDmg!L!!Rtb-p%!a=RKz`%*Z0_t5W4b=9@oc1?s6NT|>Sxu~_%p&^ET{4D2)SIg
z)G$&>Pd&5aS~e%<1D&>>rjHL=z81&P9nR(1-B%?9c89bkyA?G}vzu3$D9O=ITL%%m
zSwDigyIIx_n`}+^jtr0zOarc3D3~6i*|}S6^fV*hTK6Trkmjj(jG5=;_q%XvMI*t~
zE++3Cq+nLY8<Y@|)C|Wavn;#HVPSXJO)*#+S9BeOOKBX;$@Prqn5_*x<31;}pUapo
zI^7`WSTQ;bSI77716M3f1k~z_o1yhuOgV%FyDuM(d>GJpEi92)DXXOSWi9z7Pn(~Q
zeV9MeiT$ASRmlFBdLC_c-3aK4E`Pou)l18JUB{Si$aYA?w%*n`c=YCR`7Fz<U>Yr#
zmA%#9&-V}Ze?E+{u9~P!qV(3&y`=4f-Rb8Ta+phRS@fFClWE(I^W}5tQXbj+2>sD3
zJd9kP>sH7{?jRakHXinUPk)Vwwy*+T4zGG~C9(5aoqMJ*8rNMMQ<%sU_nX-TMM`cD
zjd*%}_sYYw&p|!xv^@0rSEZFHZtla>GRSzghL<?g60S9Aaqbv5&-My)aVLvx4w-2<
zn3d#BFgO)`2P!fe#2!i`7Hd-q+;j~^bO+M6cwgn4nv6X~8<w`W+A6Y`x;*-p*l=Qd
z)4*cESYdm(m7icDCP~$B)H<TuE{mF-Ji_5Q$ocHl5+BzroG8)O)%7O1^5M={R$iM)
z?Py`*yZ>7(8sp}C-QL+t4c+{gu+=RIw1_iv4O_+a?Fcnly{}<|GN0`Ew^_jH!s55#
z8ZI{pWLjE^5!DyJcKTfsOuYsV`dk8oGBbVshIq-+;udPTg_erhl5HPhMYK5Z^j6Nw
zVlrdF4AQWA%K^Ru<N%~M&IxCbgdgGUHv26RQDc*B<LUAYjT_V9`e^&;X|WIi-K<Na
zywAmN7U678Ilj3Id6i)r5MCUNc&-mGgBqo-=sja@pbR-l>bYI3yIsL6Ii>9Tr0J#B
zT^6}TrDB{S+wpUXlcnCBqX&*d%o+OoJmJpA+aqf>q>*YENPd0b9Je3tg1wUkQ3zhW
zmQV1gLjsKwCu{A!46Q9b;zW7m4M@jT7k?FhiA<lN5ErkS&8)k?$M`Pak`qlHjJ)4C
zoFtoPx|MHRCeIS%y8(bwMNFFRBhTSYzbIWvx_Ug{`Ov#0PxiCx0_Bv~D5Bm|ED|Yi
zsHiRu@z+9A!EK6(O=EzSsp9}%I$#sls9pCV)b!(#JR23&(f#@4fb!@K!N=3d^~Bu@
zyJ?zG+1y@>DkKpZk<Xc<$@t)YzpIRQVaXS8QoUr*#TnUjIX=7|PKSoo>6IT|UbJZ_
z@e8r(E^`nP-w5eah80<KUHMC0%_6mWhB+sX6~oLAw5n+`A~pjKcRLDG({vTGBQ{+4
z;IT>$6Fk%y$!rtjB+NXUQpXi^-u4h#m)v5>vkTQQ{OeZU-;Q6y9a4)-EC)+Z2|n^N
z*VL!i7ctY+uNI_RRKcO9C&b$8o=Dl(&JzpQRB{2HREp}|ljWlO`_rk>GDf)N&v+QZ
zGJ$?!LHn|!BrP^}W7=m@$i#)3T82qRyM$x6i1wJ^V02VzS!o%I6TV-kos&Nd%GI(<
zdcLprxE2>nSo3Dd&s}ZyOtT7xVqTJnOwNxNqh)&(?!9B(IaJmCc{vl8<gnV%22)<4
zRb4Gmwj;z|Pm<Z$PmHcp8>>!`q^xO?R5i)=-(M6=keP9EELz83POp3`H(5~<>L%)*
z5f3p5a`oHCU7Mt699PWty_FDD_RXuwA$KPOPI(H(knBB^H**RWRZYGf<9TYq+%nKt
zXWPCrwy6`9sB3YE3T!J|6R6%=jo0%(jvU>I9$fEt$ewy3+sNTB%6=3KC75crrms8>
z=FUR$$HT$hr4fF)WV&X7g6`*NK;ZaX*w{d{)Nz0M*LU7XTfCi|x#WbD>#=JkvY7$!
zyBJ5W#o8agg`Lc5Jm-EoT3TqzEFae*6SxzzDsAm|+Bex6RR1zn$B0ib4k+J*Hy@8y
zT}y96)WEghi(Y9YUNN%HHmvS9VdS!NNkJXWm8cNt61uQojL%2G;WUtojl?%h>bISY
zsOuC@x|%+><{@T7tDTYEO(Tgt-mQ@H+$ePyoc$gF$MUp$y~C7}-DH21FD=Mkv$Ym2
z-l7QZP;*lDh`MGzV{_kjba#!%)%Jru0sBf74tiUnt_uqr5X%@Q#kzC+a<!bwWs$<D
zJ4vLWq2cMeS8PeEz6kNqs^lft;}2g{0LRM8SrlQIXCL8kdH9pM?@cKiz^TnZZ11BC
zj|lZ8#b`Knoj&++aIGmV)o(4Bgd0-Va!nS_OgTALwEt@GkhNMJ7sd=WRvSvL*EJVy
zRhGhF)i+;CWPvR{OL@1I*egauo^Pz0qRMn<<6kl0dOK9NfmXaQs-zO#aDJ9<VB34+
zn+c|zqOrzy^e9mg$7b3E`&e_@UWTeu$jr9@Tt^Old1w}56e-SoL3Eu5POiPPc(qkw
z-iC`DSG8FZkVwViMdf|=Eu}$~?&#R_*1Dl}54lEFKeNbquFS2f^-+x^u%x8D1z6h0
zd5gt;aK>$4D|b74h|6tpS!IBwMSA~GztX=XYQVZO0NT{9yp=K0?RrT;Gm7YU8SqV>
zghW3k$RG=c3Mk%F5#R@zQ><8Y54ie*b~6!?&Y=yvMSS)&Bo3Pni`4zZ*g~U8ZMs_O
zXn|s>x!y&hFJ`-)ln=HGrD*i&)nmebnPzsiT8j+qAdCBmCQEy(M}f>9b&M3vmkr9W
z<)uOup6=t7qcyAp61aB!1s60<4?E9%)_c_$vVUU%rDP3+P?%Uu=gsOzW7j1nR}=nS
zh+<VtB2-L+kX83mZ(&kjtUTjTomf`7x7Kr2Y;oZSJhUPdz0=p%AlCC<tm%6z9H*(s
zr{2ykZ-Yyc9R!!BF36@6rSR#QnQaCtAC2wXTuvF-WcZ=`9scS0DGwFHBde0C7KT<~
zUXn6F3G7oRvdY2Tf%*7_yn5AAJDE+K=Ik66Y%PF3`Ytg)k3W3q2JecgapiOF@i{*k
zVg9EkT;+ri;A;4qilH4BvPrp|1_<-bo$Bj#yf3f4bz~wmqLhNR3rGzlP+@^_`cgbj
z0|EmfQf!vSRhah86jHpry;VEO(sT#Zc@use11c3(gXICn)y+`%@|y`dMi0@?8oTjX
z0Go3G2W&z0Su>RvRnq!gy5W+41cJS90vh&E7$Ryp!_Y>USNg3}>&P0795voX=gmeM
z4|6%4U+ub86_;<3%Eza{Npb9=8AZ2Ribcmk{`lx)l`c!0Oo%~s$8dE<hT4N8ZOFy4
zH1j!-iNyup%-GxAik0=61yD6ze!ZCLB0dPzGL%CD=hRb76xDopA0fQOG7yT-W3#Ah
zyB^?aG0%L~$|2#a4uht7;Lpf_Sf2<X1_%&(+^R<~^~ax8(W#%8VP{quuj3dVS#*R%
zWd{?owrCB`R2uL2&DjcG!-{$NsM@r)AD~^~jbfVjJrDQUQbWA;%PCzSq_|yU4c0U<
zv#%1@5|wV$hifR<F2|w|7E0VUHnZ;1aPuXw`KXm-0sfS+#O?a7by{~b`=1TslFKiy
z#0g$+lChDPuf=DomhA|2k^Dv>VA+t|dZsXCDMHIb^e~$rh7n^&uiluX9~zmI;x=Ne
zGhgtubWl4)qT9i(#6i6ZcLcESKt^QdFIotT9<IkOOfB$k5-h7=ds(Gyw9c>?=#K}{
zNM>Uwdo8-tU8uSZaTBdePaBq|NiL?WwMxV<X7|g)`DSVf2pd<u6<cHUVuiTp!aPa-
z;R)CIO;#}@0@*_Kb$ct_!dd@fV*h?(>j#A38RMP1KFB~8li|SU!V$mAqwJYX2g#QN
zZ)U^@<Kqm=a*4=@n`SgE<L_gWvRX!lXq=feJdM_}iUZ-vV9wS*KIzU*Ut9CT!a0g*
zCC~fr&DN^QG}hi=(p*;a9Lvd^bh;7aSPjHCAIA9ZsYPR1xI0$X<S7S^P11;|0?QFl
zwZf|K$M?YqVzDq-T=r%!oYQs5@3<Mi?j^SbwWfnU32P#YaD-#zAsVN(gJyh)$q8!h
z>^{m6l*DcXy?pWBPIU7SU$trec;NB~*Agc83`L?rx_K?`8NofdD!|keX+Y;nWj$%%
z8`fCK$n28ixp;?+MZz`3<*I;hr*M(QBSz>ksZ7A^vEn!MGi*EaVeoA%JLGDZ3T?i8
zerBUyduola$vrm9TE9|r2=3EnadOgC4_L>!_b2X8qtoDwKh?2n;w#+W8qv`eX9X~I
zCmx?$@hbMNSUI_9T*HZNHWZ#^n`?49P5Vn*M`aB>0L5O7^OHTUV-BiHv=N}pz9TQB
zt}I{vey8bujEs+$bJKNDA89(^8`oLY)mt{d&p7wWTgCkOySLP*iie!emgNlYccJsW
z676}D@5&wZa<^zyPFjx(H4kPRb*B!+nQk5<^PnP1b7$1!oSN6=2KV<nzI2c=E(dqq
z$?Bod;>VhQreB8$<{b7TkyD&KMg+<agBrDSaAPJgGc7gmcE=p&?fQ7~PX*S{$u6c$
znOz3r@~0uqb7lACJY)#wxW+z0>66bB4(w<Q#p9V4osSP)HRdgl;<%3{n#tVn!k(tX
zPXM735XkDnNDR$NZ69Tc)bnbf%CmP&wRzFuq1`i)d4;ro;l4L(XrpN?tBoi3ArzOv
zZL7L>Kt2sE;j}G^2zg26SZ2&N%p_<m@-ns)?QH6~th7fQ1^q#Ktmdq(Lu_$fO3m{@
zlg{<mFc|AP2j6@?>Mj<J-m4wHi9&{Kb2sNLVY<Ecu0d61&(VtCrVi#knYe%A<wcml
z3cI@mxSAL)Dj!tG3-diS?mc6n=Dvwe8>fe@pMo@<4n6Ch;nUFsh2CDwhOt(B3z+$(
znMD|Ry$>zJ($qLB9C^j#yqF&49ir;E9zRe;$EGKdeDO_ZmWir)5dC#E9kkgG+7y4+
zB6ioW-=z|wncA$vy!hK~aR2Eq+YOU!ZrGOZ+4){G(_P3fFg-u&Tu9Klw_&jgZ)X)W
z46S&U>I&I(Jy}P$HsBojQI3icRrBzT+G|;!9;b1M9%y*|(al9pTLW3AS75r6vjdys
zZ(y~W`!y+57sSZ^8po6Lvq|i`0o4;h2L+Se-KRtyli39B?%C3zc{8ROZpMC^ZDn*#
z1AVs+YqsrXB2-iROnr?VTnd(ycn$B3AHdD?%dUs}PkSfsZ^Dq9F?2VZD)uKj;A;2y
z`dC;No|+G;HQR|<ug^DUA4)Afbc#ip0o98u6S5Z`Bj+s>9ReE%LUv{v%Pes9)s`?A
z3@v{mFVnKYW#JfCtPi3h@2x_JJu7Aj8KC0K##KC+<8%2|(xm{7DJ{-PB7o#i?)l!V
zdz`OG6=*OT3=smF+&oX6@GZfP8>-dGZ}*vCxWXs@q1XS1E{6wM=^ww?S9V%JAH92F
z7z%OzWPXkDO?AL^4Rjndbt#>i@b=-`X{#{q{o?csXjmm-6)OyB%WI%BZif~t+R&q(
zN4A2H<Ahd|G1Fm8cBtVjX`5{)dFDl9zh<Moiy4irbl2d=M_ekXhEm-O1m?NvKPzsA
zvH7)2Ye;`6(%amR3DRKemvB1^>gs*~A84NK6Jn8Jj7|L+MA2bXI3<UM3OOkJ_`5N-
z{*)%|rpLBG<dUk0t$)_bGM3-}>!iac03roC$S#uo=IzMeI4JxzUcsCkk5x)6Q`kOW
zDgfwz3(21h(n0#COxq_uY<A~Z=0wK37jT~mzga$y6lLVz$Akm%*RNt40oE@s-uKt$
zQq6|pR1x_=%N1-cUU1}!0s`JO>;wb^@cij@lC3Cpv}s8_^1T=?N#uYIs~`k2CM1#R
z#iHqFGN$XEk)j716Lnbax14^BlM05#h53~;=9oJ4@AKK71Uir?eg#r96?DLN^dr)X
z{bFMmv-2}16P2AzW|Nrrc1VovB8TmxvkzEJ?e&cX)bSaxk)~2v{2e9^F@S>;AjH)7
zHp3I!4V6i5+&qmYrXCdvitHw)d;1E`5wW6FSBQHJ?&J80rIRq`{81w=dz8G~yqrq8
zsPDgxGz#&~ZcY`SgT8SCPtOb=E3Wfy5-?o4t>d&+wjOw~7Uw*nogeX_EP;W~dFQx4
zDlge{n62!re?)sf5kpYPV!#N*Vp}kRKri`UzdLdRS1cx(7P4%P>e^qb#EQt%RwU9x
zI24vxlrl%0U8;0)pr}7-9TGBs4}L;KRCzV6O!dHznNk8ob!oYPSi_7l!q4EqfSr}4
zPjazu^$zFbA`BgB)TDRc#aW3BH4LO2P&@bst)M$>;S=5MkgQmZ%Rx)%XjnG*fA4(E
z8^6GY^(?rb@+#HRcDvNc?Q*Y!d!;ky7Uz_mp7PeqqPF03-MF|oPs$~Qk6HFnP0g5B
z?V{U&ii(RJ`4IYITpcgjaDoz0T4s|^ss&@n%(?A9+4KA)>)?!>%wAU(OmISLxS0%4
zKb>?h$uDF9#ma}#*17s2_M#t=V!^6^bVK1mwADdKEd&}Gk)mXt7st`-%}|v}b9Z%j
zfkuHtO6%!D6nlI4Z_nM2xCm=(eTuBQt17(J@4^BbSt!TvJY)AM?Qn$cJr-Q;s<+ou
zWUI&Wc+I-@RZ&Fx7QZqi&kD)xAp9tb2)wr~86WvA)>E_79Jo+!aN?&-IwAx{;;6<I
z6CDari~K;(t~44*6_)7HDEBT#$h0`OD3{VU+fPA5Vr(RJ)WOODzy85lt58A4bOXBY
zf*v!;cKmK44ohwi>kT=lKWn7hZO6|W9JwT2*NhE)#h{?<Bln?x2C&qihbe*)Su5{s
zeG!`3?MltvZHqjGpl^&@HXMjHpA~WWC*to>`*3FbS-0#ICVJOgU(tii5sm^DhrO_Q
z=I12g=Tqm5O0s-P)t6p)ildiVf}y+G7!u#V;?lEoni%~G%jprHjd!?Cw9t+ftMmx*
zy}wKgri&Uy!cThEeNXwNSXK}vW&P_7W954AA%>Xt>1E|z-a4sWP||&NsQ^(GzC_g%
zw2)IeI(o;TeWKAS%f4KT0(zmvAXp8a^%$z6XzOcf={j8zikra-YQW89&YL?KU)K>K
z5y8*sa@h0MeT?A*tQjj`ZmLr4xF**Z8+>^%`SvUcK!h~&WkcE8i}FjAE}@3aM(A`g
zv(A_v1vY1yUCwkBwP}@bN~F0gHXzJG!|m5Bv{jxZi_$jloo#KJ%7gBM`ywi64jQ<g
z5-*h;YuO6P2tK?XY5lpMvN$q~_!8$G`k1O>a;af)=h9SSgw16Pk8+ILO3?)c1*W@h
zTfJ&1J6-jRtCg8uF>TU8X}Yjzy@P?GJ$thVziRJ}<L$*Ko7KwMJ=`zek{cvLO$ln(
z2v?sGK(y(T_H(Q!$LFKlT=^CFb0lSum>fHN78k-=73-7n@2}Z9I)$#r>zf6KhsiXQ
zPrK5sKbgR(nV^cv*Q)c;vt|`9#t}$x<l<KAzlEs3pIt6xLO;TtQ7_|qsm(TUtFG1)
z$CFDNYl6@<nCQIJ^Qu=z!FS<2d*;NOtA65%pWq<F;4x+0c>q3_v%>0iP8Q*>C=AvE
z{d1!7>@GX=lD*pwNj#j9iQ2liZ!!2-8)6|V;cR#qOeI0YY}6hGtBun4ZAD0-`1o_O
zQ)Z?^Gm2*wDg*e<N$d{m$4tl@%C+Cpjr*jG1&C_z6q9YHRYn%p8)WNFPQDuQ67T$o
zPc9nIlSp)HLq8-SFyn}fbSMxQU(bz5BB9V)Ki`S^T=;B^F$^copufR*nIl`$gYV<$
zP;^XOGMLN-npZ3(tKBl)(cwd`uH6-JN>KWux-(>V<)DmGgzycQ^=KoyOVE#o_|zKV
z_0LI_>)WO1n5NEy5e+i=Yf#b`YCOy)_EuUgxl3#JP3m>miEd9LkT(QRk<wslV<JS|
z3u%;l@jRU&d=a0M$r)x2LtaEa7T2JSt%CBbWsW+DP>vL>Bkjq*^D7im!{ZnjbhU52
z=(@^YxIeuzsAe6x77VGep7u&>VCk#Inm}3}&FfdI{&175s<X+9rD_ZPY63~l;8E@_
zY#Zhxtx7m4uU536arnv`QEm`MfR$X=aK6s->S*}iSbz|1Y*Fb;K6&!<T!EqshMBxG
zhkG*0vg{A`Q---+<@I~S0%76bG0XLy2P6&4zIAu6Y5R~!*ug}o)@+koZm5J^)VO2k
zJDcn{*kr2~{O|z5_tv$1_hy!(wj%GY(%nr$n3bRqb3u~L>}zafm{ipVv#xocS6k{8
z1NePA?v+}GHhGfyjrOb9&MtdZ>S+uxNI9Y9y@?`3V?;rNlEas+BG0m_NI^q+u(Z%M
zTS}&SgVd_`)iPCHWR$FIAbzef4*r)IO1sf-=9}>onp}MI3DP@Ut~TO1SFP^Zu7jCH
z?jO&)q7g_ovMSuOa-|!&jwA|4eT7ga2%Rl^Z|!cL(iaxUhH>5P`jj6x<dtnu=@idi
z-C(IA7ktdG8}n{|=J0wi(38AciAM0oIYuG3yH+9%;o5}J^0GhGw9frja1>npK+?VN
zG>nHFYtVD0SbqZpy}LsK4_EQL{lu59nPgTVHZ%{=6c}t-n!*dcS3dzq-c8Z%>f-xp
znxg|=enBZ<AJH}{Jkvs>6B(_#K`^C>$d7qoHP30DPkF|gU7X0_Ufs;#n&SE$r-nWB
z6hX7WWf{4b%t^~>JtyJ?a$4k))7@Tt5pR+mT>7DhR*o%xuhwt^d}C%5+;rcvjxiZw
zxzsZ;W$iKZ(#^I;3g5wi&09qh`Qq2ryo{d*xnpXLHR)j7nZqO3XGbOAgal4O5@)(>
zstSb-dCre@H;y^nk%{PzmU{k2-w8jqaVC^ittTG}TyUDA2c0PSl6-M`7taMAyQ}lc
znxBjQo<O>OJ|{PgXz0-8;^f52T(KdT#lrTvdSen>SX#)&c>N%Zhm(2ltBK0)Vugu1
zmgmy@W}Nan=43UIDM3}8VbQeP?6;IpeS96+zGh7){O}zY$v(iH$W~Q}-(Dq(3rlRc
zT2P5mRl(OeVXP?-ZTbk_eIvVuVXc(7BVbZ1A`h<^k#)3{Wx0EM>tY>%Pf>Vdr@51R
zKG&h4NN2dL`mqk_aj^l?7RjvrLO2<dALA;yKS`LN`so0R*Z9^v>f`5^RSic?GxzeN
zhwfcn1giE!)7NuZ^V36GkbCN0Cl^?FFCDe$b4krwW-2qtwUxlgWoF;h)^$jN{nGkZ
z0rSBosaV>jcvG-qP{P@k&u{}v7*BaF{q{O(@xe*LTSB%LE#C7RNGGBGtB?^5yYDNd
z+M})O6>X5V^CVwqjM*DUA0NAuSwrh-D#j^h`+3-x-H~SFwnLrVaT=k}5|@QuLLHH8
z3{2BAbvx9)CNyxx{2k@dhMjMu+HYb?d<W^IYO><Z(4OB@h+ph-XRC)e+RE2m(9Qk2
zC|rZOSF@Oyjyp4!WY@2z8X77hRdlQCT(d>S2KvpXrOW#g@4zo_$LJdH>$ZK@o*8=M
zk<5VsHu_Nq<d8(WzVqqfu-FYHiKq2oYB7$((>xP|w2xc~NTJLG!E0ZvMI?-_TWF1U
zQ2mCT9gS|~YKd7iA~@^Y1?6Q@YrM|l?HCZUS47X6i(vyx#X<7}R8m;6(YzOJ`S$h~
zG4f>VGXt9DQhn@l1_iGUGFFA}etO2%s1X}3Ukp&g1GzsV0W>SFC8(RihRoT)2`=OR
z(c5=_HL*rrN4@I3Dxji90YybbM4FTUfkXvC#83nb9lVrKq=wKTA__{i0V0G5NGAk@
z5PA@#OYcQO3kV@3bW$L1yx+Ih`yagX%gkD{);zPGXU@!?ea_xz5hq@DRWT>C_O`so
zFcKuuLOO@$wS=rl_pfK|06jJZ8%>;q6lb+lVf!Bll81#uj&2GF_oBnT_Kv=6`SM2S
zr1Doe=TSf$%wA4QJBkf-?BU!XxeyFz3RMZZc!?y~2X@~)Ov_>Oas+d=wc-pCsW={W
zGvN1V-sojoL6=Lb79(#If?3gd__Ja??WeuHeWdo0MRDNp?<Nn-D9K?F*e*fLN7k9h
zm^3$QZ>!fz+ggELRxe%|D@?{ozZEMKDJ(B|5-alShf!ETBj!~>Z(hc)qA34M$Rp`5
z%6&I5@>yyznbz(15yKX68?UcgO0_P6)&W1?dfYTJwC(FJEq@^rL=}p9&E+*ouYk}Q
zD+JfL;ZCMZYRv&No2oVb-^0HS)0}56=slVH{;xNEv`;?U_Ujo-K8?(r_+x$!;>l(d
zf9=fKED<m<=d4q%_{G1mr@j&w5J|DILgQlY_VK2_gIf)L8-JrwKlWqOv4hefUyA2D
z6S3JQ$|x!;E=^Tq*@85GNax|Ew_ujSlNCk3zdw)$YVU{3Wmo0h9CAEPYYbaIG%NG@
z>wAkm>sL}qxQdFBUEg)ZBzXE~4`*i;B+ml@{(%>b2Keps1qBzRV<WQ9RcKl!bzn+`
zA!N6~6XuLQvLHL57UB%cn5ocG-Af8(GRhC9#%OVu^pqhNP{T<Tv9AUeani?X(M;&V
z{S#6llpUkaGQPDKkc^P3-R@;>9Me%|J85Tp6I!2|ACIYV7}9t;lCX>zef;dq9dOB+
zXJ|T-{_@@2qRe^Oo^h%8Ywo+OFFX^xd^d<dB|QmR8xm8tYqnnf^{U$(!WScwEt8}s
z!aMoyIGVezRaLUyu#f-(i@r4e1}Y5tod>NIsirW+yL>MxH&rDMoVD=r52;<dW1mn;
zkW(sj9lSwW`6@<1z<=M+w<Z$Uu`RHb)&vJp;$Mmb<HoK1H)*FsQ&n`z*H4beV{YXf
z14V@=!9AL2KcyiKm8|InX-WTBgMgL%U`$!k`&-PvE}^DMtUf2_)*x50vyb@O;c!f?
z+D1Ui)*McQUdMh16v;FON`hRhA2;Wh;c1snWlF(RHB2hAmZ!rDj84srT;s7`;mTnv
z7+LZx@~V_-U7p&Ht0IXPWD0x&C-MpNcJF-Yn@10BKeJe4R>5vc@M?#i+o}j85<Lr*
zdr{lK<oDSHMPrVx<kvIa_L)tb2o?{byd||+1hEeZH=gqhlqpzgGM~f3lsgMwiihm>
z3BJ4EeYd1PXwPGASv4aC-)w*el@0sPN>QiM>?{@LR+;1^YL+Ouk|o2{=xOa4H5}z`
zx~jqks(2t-#`7x2;}gld**((wcnh@h&01+O<Uc;79Mv=UzkJB-zq)Fo(1@l0&g9Vv
z=g>ox^#c3sq2h0mo!J)T;;BZ5Tb{&R7d5GJ_<75<pTg~6m9_~J6QAwt(xRP|0mWnG
zlW}g0<8QC!SAYBIlgW8uiTb@lE-k||81EHIqN0!uA^woPnLM1*g_!xUx#LB*0{y84
zgpcXS_u}M+X#ghcYaS!EP!f2gd|C0K1+GMSijT|-AUm2ASWm>gpdjV?f#RV^m=}UD
z5q9x1SKY&l-i<&FF9NMvB}x!8D1!%diSlJJi~mRBq|We29RK`u*NmN270SX|1peY>
z1A3=Q`TmD4=&;$3`@K3nHUxF~$70VM16`H^Rqr>Fd(4abROnU}V`0&`%4O}iyEc}w
zWfjPMfpTzE_O~BH2`>q?l_gBC1)qFEZFy*xE>+6c1bEJ*CNDSJzG`xw6oW2O6bd=y
zdxSJDgpAoM?~Xd+wq^Z!HN=l=upG%^Eq6Sg>E1{X8ETE`f!fEf&vJZ#uW+hy<LN|5
zz@i;;c|pVUmze#()j}XAjF7-&A4_WXn{LB>=JgMBNnWO7;ql>VQ$1Tgs-WvFfBp>l
z>mIw6Mq)X8`&YbA9hsC<d~C00x!v#+z9TfWw`!}g5`+LGfh}XNU*QCAZNlkFBgZs*
zzZf<dU=OqmIk!{sZJ0oT?!ZR?oXKLzhzZ<J&Ua~$hIZBe2&TV+$WC^Ut<^M>`7t3H
zb?O+gd1Y-o5EU<PItUJ1)u}SufZ9|QJ2+!kH8?A(6XemiDTsv@M=SGy*;9aNgs<*F
zFK&GuWs|+|Z6~QX#5Nt17%<YLK&K6DpnW#DQsW&C#e{$2(1s+c&XQ8!KV?_-<GU@&
z5qt0|F~LY^=`yWEDTSrG=KcL395;kUBX&#92hRR-^yGRhL>%-=5b;e-w|8KdR%h76
zS7N{{UsI}@1zNG)`a6mr;aQUWHOa&krW5gSqOYl`OkOy+a%|7i))sDTYU9RS8(jU-
z(`ppxySS+H$LghfPEsb^!y1Drqe6f6E7m+60IrYl;Od*0w;Nq7e6$whrNmSSn*hx0
z0^f#7cp55SCvC5|krQ2BM3I#}ozg}(DE{g>bFN?eoFQg)v+z?9VZp7wOxr=c7-cL+
zcse|3Z?ksbgDvHg>+SvN5=+zS_#m>I+EL#fzGI2pcEPFok+xUeN*clg_}o_2#7YO^
zkjX{a+I#)73}k^D-GF~+&FC874!Gu8gx!69p-QJQ>HtEc8q}p)t2Kx}g11=jpuG`r
z6zQm*u8<aZF$B%Te*cI~LhWn5*}NOUK0LAB|E=Rf(Q-lgLY?CX|9P(+I-QL5zLOpo
zd%irV8O-CiCo#K6`<_6lm(41RgjyTaH2QW4-v<WtR@b&n+$eaPeglDk4aS)`5F}Vp
zKdqX}Of$1wESYd0uC|Ez<y43VhbG7`0UtWiFa7E*)zInK+%0{Cde(CoZqMrn@tiHw
zF5Nq(<0Dn5{}an*u&K%gLk0Q7N4FG`M7!J10`n`>kp{>fEqP!zUHWvTE00aL-0TlM
z%I~P$l|!4rGHOzGCY4|S59jK`7HQtH<?80PwurLfzug7^p?rv<mB9UlMfj4B>_J00
ze8)kZnj>~q_x{k5)z=PGw)`6yFr|PFefqsoLNpP<dnVhk>0k{*h2Ee9$l9Q)xDT8$
z8Mtw{_aRK4Ab$jVteP(_yyDgF@{B&_d1K%c(PZ|si9*5AELNpe22X8ZZCzmWh5I4Q
z?#GXb!vL!b`ly50&u4Qz<F=gxo0Me_e{7-dUeRgun(^)viya)%6+g-=@}%MR4l(j2
z0RF2EDyC+r#z7f_Ly`Y#a5q0t_nEpa-!*d|HXh~w#G0@?cPqpQu&OF?=s0Lrih0iY
zY|pqW@2i2ryb!8Aw2Xq>bEO!*;!n-Z?$4_JLH!HsdJtfBnkM?(K;wW4ae6er(UwnW
z^uMcbEe|1S1!w)myC0F!K_`ngPq2>msv-P2HUThz`*bY+ni-Fe%*PyJs2Ttu#x?4E
z=c5yMqoT-```e%WlVMnSy>#okfAc4WIc&D*xjR&XNW_~zEHu2(FO1*o4rs9#DC#~L
zvY&~<hRDdUTpFZ}*zx-twzl!~-1^>V*6%S<Pjhds-QHpN2_cc4iKQ~^Cy1)@Eyjx>
z8&?kyd)c9EY_*Plx2kgoD_WGqrS0`V0-wm7xnmiqsL2~=`sPr#MuThOhWTfn(chx%
zO?=)*(sH?lcfRw9yH_%l3EHodT2m`1t2P@?ZS;$)n5LU`EoAPdruX-X*~Uzt55GYY
z`(bFymj3&)IG8LD$g>2FqwJ*Gq{(wF%h<wIeJh1&BL0G_80L=uR8e7JDsx)oKgu50
z*L`5uaQmGS73$)#bd)>kD@T3pEET%KLhS<p|A^^o-8Fe&)%der?1ff0DD{cQ<kZK%
zhQek(<dBsl@7Y#RJ4NEkQlDH@obO%>cdTN`4@A1$hFY_X{1~*d(^o^>Q&Me$-HdZ;
z6SbX%bSQ5}(r(`@k%L=_LS+VPgS!g0z#H=`MXM-wqp85sh`KKuyp%hTW4pNm!eV6i
z)ji#x;E+vg>ya$ofmsgh0u~p>E!*^2ObXj;`62O0=+X@zBHpTgpPgv|tdTpSU%OXv
zAS`?~eQd{V$~NUA-i29NZ_Z7rLU@f0!vZBzL$`I8K;Gl->zCY9CX_=eQHXSATBA}S
z2=h$4b8$X7Vj}&|w3NfZ<b$C_zoURQfrVAsJtU5HpMZEKZ1Ab^l$AU>x_-CNGdhB9
zUb)h)0<AKEI&@p=rPmwTR?7Cs?eClS1*u+f<wU}&=xc!k_d0IJ?9E|q2`qy7-Da>K
zMYsjJ-xxZ>$~l`8Cp?|&r?0-bdt4#v^`?oj+3YvsV#2oZanjv?23VBZt@Y1V<TpLV
zqlxv1o}{yMX<L<+&HY(x*2~~XCT6mk1Hz^~YwK$3`=L?CA*l8RWe6CAY~hhdQc3KP
z;P|lhRL?Hai}S9)AWQuqzmzVkN(m)tqE#iNn2|Hr!F2LB=f2G4rhPg|bKA`y%Qc9G
zaQ2CC4!OMHoAp@5_p&71C#d{`&}uK+iu3AjL(7X2k$JKK|9Kis7mO@lnr5-o3=Cww
zUD^^s#5`qxs<Fa*SYWeL#?(`ObEVJ+d0{oL)74wvat1?>D+7n3hk|YQooAls5Zsx<
zQ$b4@-@d{djHcjdAe7D8aSGM%eG7bXkZ<|KK+4v5G%1KmN#6c6RMW8szh*_&+rXSZ
zC%G*HyUCB)9x)G_5UrueUJV-NcF};(^7dQ}Dri?0!vs`=-^JP1?KaHmQts73-22|E
zu4zJsT4DVXvLTxkjP{lH(R*+xM0}hMty-jAtz<Ea_8b>7a(>R!Dg2g%&beyZrZ<yv
z;fQR!FG`=2>6v=^V=3dis!wjY+13(5kTv!U0c6p_W^u3HfVTC<km1OGi~nmY?uBwg
z0X*`Mul3G7$0UM!deJLIRbo0?I~&RDz?f)?%~S4|J8|Cr`sVgQ3Y2WhXU)_nIHlAy
zdE&4W4~q%iXlJ5H8#i&%J(5Tnd?KjSMbVYea?)82aW=Z)RNv=v0TKs-w>m$9J`0^N
zj~H_nyb{^Me(S!#DbGnwbc<76((a1;70flT^TLP87G3JE1XsDUM4)wTsM44xm*Azf
zSqEggb>>{}*9`aw!wb8}Rr0nnD`=+-d3H_Fxct*_mIh8$!a00Pizg?D%0>LA6W~m$
ztJlpZJ2IQidGD#n;T-^2#HQd0WTal{&zi$IjgAURZt3Q7`xzl!yUn6gi?_<hTwjfU
zQB_?@Z298S8rj}wh;u10oD(tA(~lL3!)mu(sc<=5H#0va6vIolj9VD9I#Lv-y415k
zrqBSZm|!DNuvHMWDSys&p`qKR%QVBnv$yb-dDWZ~0h|zhFgPMN`5~>u{4lRR?>bL|
zpd8R4+dbQF9K4Y(58%uaSPBg&KR2X6PwfMr<j+=tNIky0VVTZ5@fu7g)bv)9Fj()t
z`%~8HJ#M9BUwvaBlrgUxu?56Fch}D1F}b%oNbDSSpP<<va^(G{R%>!6Xq0EW?giEC
z+iz?E6s=J~l3}lH=bTNABiZLx$9L#x&(1aBvBC2w!%0E>Pm)4WiowYEJa^s;=OI#6
zoievB3_^^btg|3fTPAYSj1$xt)w_~eO^UCUCVWmboo)d`e-w(QF{WD1?g&7#3~~I?
z_0m@|mEGZf!6&TwBoaDaxRQ9T?7Xlm2HeCIkJByw|6=g|k5zNVanNYJJH-{RCLRj7
zGZiJ~-$>`{*3|D(&+N5(jE)z<V&D{O?n<?_WyP~J;m4m`YIj>3KO_A`Pw%y8QIQq3
z^@{k#B6za8MgZ5%)A288`R>vTQ!iNpsN_c+f7I-_hwyyFy5=&sF#^Py*UHzZxlv~+
zfg`dOL<vb3bbli?uEt++r|qiocD%2=Qy&x(=J#M}L?*#)&$!3qrZ7PT#U+aB3%Zyi
zE+&sd)z>n{$|8>*3rz5&31HY^uB`Mu(Jo~khS#jF+BSK*OeEK9n1^hz+-llLw3fLC
z@5LP)Fymj=R<8j7P$^t}ndYx{q0<s1m5r00fahR!lc{>#q*j|ogHT;U^4HU}-0r8u
z6e(H8gdSNTlZ2J_N9U}qTuI#wKecxVmcm9(AZ|#Y@Do6M&<(HF%)sNs`I;glXux&>
zob4Xq_1!=6q^8k!eWt>T;z`5=bdsEeNitpaaI@mwd=LD*uv>2wnZzN;>mqZcd%UbO
zYFll>D>7FUEN7}uBB;Z`y=z&#qW?FXE^=?^gV1>zgj~0@L~$gVFRu{zx&)?p#!dd0
z)~Wc1xc=YERO-!0jnza}dTS|~s0<*^!2e)@-Xy@SH2FJu<rlBHN5!C<O!?37TgLr*
zj1;d!71DVEbl^h#ahXp2PATQF!N@NsH5aG?q-vt1e)@?9g@vN78pSLLHs4<7a<f>p
zvh=UV>UJFW4~?;Sjm=j7f%b2-B6swjih|elboD28dDX<0gwM4Z#(K3$Q{w?ZHyjRM
zJo&x~>FL(yS^GFC_)IQw27ii|2)<z~e2CE=S2yorhl@&{pOFj<BCL8Wv#ME<K{^o}
z@K29-q-d#kkQ+th=a=g?!WOMm|G}>InI7d!xea0TMx}0Be|uCQ@Fw-PyIG$0X!JIk
zK<T8%1n3*F-H-skeS=>a^;{TVSg24)(BHVbJT_Lius!QrLsP&Hg^lAzmSVs^LQaqB
zJirM~=Guq=;Kn%;FVmf3p~3S#`LmI<{<8bC|36iHGPt}Exm+;evL)}}$RD_L2ylYg
VfTdBJ|CAg6bnokH72mUa@jv+YB|88B

diff --git a/frontend/e2e/specs/visual/routes.spec.ts-snapshots/flows-5-light-visual-linux.png b/frontend/e2e/specs/visual/routes.spec.ts-snapshots/flows-5-light-visual-linux.png
index 7709f9abc7d065c76e7eb85d52e915d4949aa3c6..f112ece88f2a19606c3f42311c41030780b40dab 100644
GIT binary patch
literal 56786
zcmbrmWmMZu_XQfDEl{LFaeHWy;ts_r?i46cg1fsr6}&)kcXxLQg#tx_1-BG;f&@t*
zaP!E!*8j`>aMztL`K?UW<jl;;nX~sklgJNh@&r#Qo&o>>0!0NGO#t9A`Vn&y2NV4w
zNvnhb06YgM%Dn&RlXbL;Cz*J;hJ6ZZz}pLJ%XfN<KlAyijbxO~57Oz^{4<0lwi%vX
zS%to_J3{HnzDm_ya6chmAv<7^VtG-RqR-byQvjlppC8HIX8x93eC34!eGrh545K7{
ze1+=j&N*(ESiX^%@CNN7;xu%0<NyxSmtQuFYB2w{1ORBs7em|fcdNs|>HX&cU_$gf
z<li@Y8UF%c{qtssswCjazulQ30Q`TS1U|q2_aUe4_8OMBGqW<<D%0t8tl(~UvfV27
z-*~4oQ#KW|`}{ydU*Cbi>0jK*gKHZvJx3M8JghU#&6is3hs=0{U4=c4OybBKgdUmv
zGp3K5%Ko*Jt)4u#KVyGQ;B844>qU>o6ty;|?tA5kP!IE(tr7oDTtzL`+Ojs?3g)ir
z0w}G^kI(F3|5>L_2>xaXq*etvkR<ZOrMR5ACr3p+oyOl2#9oOd<hx$eSv}tCl>@Xq
z7ykLrT7)qDdZo%b!kVU%w2>i+joqSFDmdGX`za3>)5XAGrLwjMnF_kw{uN2|=pPGv
zMa^|Op)|y!C6dO2Pm7H0`L6s^kB*MEM^l60Q}Wx}+qA)VuDRlY1_lN=|E`lH9%SLE
zi;hl8W#u6rXV>XQH0RStUq(|oiT>>mNh#GJHpvLGl&jROttl&ObKM-At<+szS@~tg
z{og*>C{~pLpxyq0{QUf!oN?khm9zG9RlbMSt$SZBM^mQoRl<Xj`=u<&b~|I~#z6=M
zYBi=&Fu1sJrPDhO5c0TYhxs?!-!ORK?gcDwWW5z9t+)Df|2FVbbjp`4H=)2ho`Pqu
zp33rGqVOiGPFC8rG&QA`IFwm?LqkKIL8z;0{nowBVAP@Ua*Lz8rzZ+|SnGd%q8dJ#
zv|MA@xh_}Rb^a7Qn8>J_!EZlDY8>!>sH3gz4i^02?&kIy;P@CNZUgNJ+?~kf<mA+4
zNrqocY@Su9n^;>5+Dzs}L`1|=izHa(^}M$LB_ufXov8Q(DqiP*8>S=pi~TQeCB=Kk
ze$Gh<S%97z+U8#10}2-Wj8>eAlCslg>NPSchXr&tNJ+$`mL=vdfMFvR6&=l_k|s$@
zCF)aGJt(M*b$SgAh8D`l9WS@i3VTG{D?%zb#oBA#l_(+wo!7FGlHg}Uv=IEe^HI*f
z_tF3A2(b*kx0=e}Ye<`|yjIjsR$ny8Ul8Hq;-i-tV*<<gdR;_iTPIVra2;hACkC{|
zeNP=68v4bgOl(J@PJe}mPeAZOSFI?12)07?W;3jdpGjqm!Gt%KMhrQtYkUcV=KeI9
zgbnZg0AjRNReh(yYd1JSdz(_m49d-I9YlX?JzYb+-jUFWpug5N8+u*S&u%D{pP{m>
znC4|+>9hUg>R8cNcKd7e{P47mrfcqzZ>EP^nKgGt-xymuP~Q<J`pr4q%}O^GJfTss
z5J2i}T@%_kQ!t`9q3J3XxZ2LIlksN$eAV#a)?RDdV&{2k#s%8f_~P2y-uWG{CJygy
zTIUAN@lC=*bV6+Cb40wIY;4|Q*bsOfEtqzE`>Z4UfS3qQX!#xWl#3l9EFyya=#h+^
z93j=ax|~Q`{_ppT5WsUXG6m}wIFI0+kId+*l^7K}6K-94i4}oT9$P8B-mTRXoMwq(
znw9~bX3|+eQOA9e{6324_)=MUCT09o2jfU#7TgPRgX5;f=R;6^SNQr)5d&>p><ana
zNk{P}!Drpdq+hh^zqjlAtisj@t@RT!GK3u#>d^i-IRxvzra@gdPKa0XgF9h8nJFoA
zO&Fg_85Kt(&Uwy!qkX>d*B$sjh}%MA4LW5RotdgK90AntEIZfV*K&l}9u&q8)%dv^
z%Eg$9U-T>s_eXEh>ht^WzYq$am|~f&3h}kq9m8>{@lKI{XwZ(N+y%Kya%9|H*2wl~
z2PcLyXYO$7f^VIUZLHmwWuHR4yKmcU(T<yeQ;mOlI1dXYHOh1KKAfwDGgB)>OEz68
zKNSB=BlJ}PaHtq`2Ixm61ic^Icq*1lE8;rC#YxqFkQ5*P)2eaVC0M%Ym(+!|jLain
z3Y(2vw9}Gu7<@7^QUlGU3pi55xD|ox`2cZb+-AcG48_I8=-$)o>(cEN(EVjC{Czf2
zX;IN6kUM4s272hJt>r|S9gT8==;zjB44Mxm=mL^O`8nK1Q*0uIh0d3oemr|3*oI%l
zo}fst8x>(-X#dUNWon7Q4D6k(Y*eG`%k4iE$z__Y0Tv1%Dp;zO8o{%(ol1tY+t=PS
z$@EnSK46z^#xoWbf#?>zrYrpiJ})mX51#2F4u{tRnlJCjT~E|0s_;_p;DYC1y@qYR
zc5AjFoz=pRC2yz~E!1#)-$X2k^+W?=ZTglBVc0Ww(r-nZ9kmih`(RfpXB*Q@tk%I@
zUe3L9h-BuLaXlLCG@8sJVnjqzWO$<$;>jO%0ssJ5W<OsumA71~PMe``^SCT8FNBP>
zx3>Fg2|euq#JMH#QP9}yrjaT*TQV%o^aPG)I=ip!d=g{W;JWzfI*c^vKr`*;EORuu
zv1jdFOY^-2b2V$0h&RW(cWHdjRD=AK2<N>Oj_rScOdle&b_tIm-{@nk$kMvKrc#S1
zGM!vtHV@}VY+HH5)==ocf3n&sXg-L4{>YXu1AS_sPnQbwp;#hDm9nz3g?9Jd(%c|n
z>v5`Q&z>QRv23N;2zu%0=-~Dtn?rFB=eiP=bhkgf7|7M$)Ajy``)iQ<yDapG5U#xW
zL)&8S{xAY`pkAIS*BXkUyhdF^A)n!+T(q>b(|;M{KiqhyG$!-v(7&C2X;JYr0LiU2
zJkI!wDN8l6Tn{teSi$F0M1;QHhU%o>gu(L?F-oFTwqkQsUy1Cuhy{wppTw-MiK6x}
z8RB7JrK`*qAJ?+-jH>uj@^emBmjeS0cvRVng)}DNdZrwM%%B0C%<1&G_Ok@<-$etj
zb*8@a59=1hDfI<DAqruV*HWn&B7%YhSWx$u`qH-7#)ZRU`4$er4eO8EH6>*N3Tpo{
zq#m9$viPa6F~+?@c{jjqHXrMdu2fa1$r8C+HeA^CJ^ayb$P~sML{Eri!yZgmz_qFH
z6gQ1u;;$=|*wC~#hP2&8l@hekuGVYJ;<^eIuJzGig07G;mO>NNXH(5~cDnYaUXLQE
z_m^HGK{%V)y9NfDMgOgjIz3U_LauXF^*uL1)ac)<OdO3E38#???YGd-^suxX;0;ke
zTi+!WuYLU4QgML#c2cvv=2qd#DuFL6x7S0wme8-jnXUc7O&wF@`T|uCXDST<(tOg-
zs7|wO-<ABE&(chMG?0v)4to;IcsnV;*Wo3(xSEe^aEE5Oc!MLU{rRscqf6T4VohdM
znYf%@i2=+iW)vX>U&P$9B2i)O%!#4Dxw<v89)@xdzRT`hgg+v3dG6SflZrn+M?MS4
z|FHV0dZG;AG*aSio|tk3<gK>_mHJ%H>dx9-mZ)a#Z8H7%yx%G?n!?`cvH!9fHC?Kv
zrbZidli%Gf7I-%$Ph0(|{)?3`vQ0Ua18(^+5qu9(F<cfk)w#phe7HyLSDw!4JD>S<
zwL*h#i&Kq&=)`Y`HrU|f$C;i$f27#YeMsqku2QSh>ebQWn^#Zw*^G>g;G<s$jl{=y
zaBiriW`Hp%B$Y|!nWP+1T?Gtmz((y-1}3VQ*vL=KPCrcwN*Ih3<5|uN)0$Y5E!Val
zDNYSK;&p*J^tCKTKtVshV#&6DDKiMA!w4rMa*3y3b1`kwS7`HY?%>tu3tAmMdzMp<
z(@T^{q)c`d#+pmHdBCpuL2A&LK?`%Z%XBMIH=-vi;3|4Oc4Oi3H&b~frQs;D23Xg+
zfC)up_26a3&Dm0gb;g}adIrpVo3seQT+jT=-83YQ^K7MsU7*<IcO6heyKqEF!jpv|
z6eeW1!F65Lzr3~>?6Wo(!^`q)uOi8Cc>yDbDureHcL_wVqSp3tMv-%tgnuoM$;Nl?
z_Z3Oq_Pe0U72xjdJo-SGD|oR17KB!HoR6-qqR=ZzPmo`J#pOQH*(kW(hW)s$Ouafg
zw`QfyHLR4!5?11f2*^(@C6%Y{w7V*=;@2mA{I;^>BSUp|@YYO2tuA39cBg8lTia`B
z2wh<luu?#(ayCcEU9J>@Kp?aU98NGD#44tpFOO|`SQg6{*fw|%d}r5^<mK$nwPG#m
z0#YBngIt?Gv}i5u>IQUsHAS-oZXPYlzvR_cr3xATx^ip5!-Xn&BQ75F`v)DXZjFb#
zdu7ni#&Z8n{Z=P*?mHzZ|8*^yRrd)#nPdh9yPq*As2d&m&|x3WY)H*smC-<t`dYwR
z4CUZ=JaxK(0U#By4$nhEYT+hy82pO;Z2Fjz*J=!#Hehlqn7B!fGEnC|h=M38luG*`
zjF=DAAv^i$aDt(!sncREW2-Ei+cYS-{4d>o(AlJb^J}pl-^+tSUAIj$dMy-o+`|OR
zeJO7W75jM(a&gdh1Dkec<WAWS8;Nt%B`IM9pDJid<MUN0`(ZQV*1tVX72o<i)mSPz
z52Q@B8fn;l?68JAT_d*7J$Cd+0u|%%5F?Yre|POJjPMg)^hvO}3{$JSZ_XVfq;n3G
zc7ncfU`!`bSo4dWQD%)s`N$1^g(<d+LsHo(jx`-`pK7&KFQw4J&!WP&p+jJ^59z^y
zh6@45T;A1m7|;CSVMcyz*ICVTaPVOn;Qk14>s|U?PcJ>mFbu43)^*^gvoW#=V=CU7
zIKOnG6$u7&X@s0bpKF{{RCy=zY$bND#G}Dm-jt2c4Lal2znoc8mTPVb@wZrB!WWo&
zs})QCBBS-&QD0KGKkw?U<En6IkbY*c!_<+dKhY4Idud{0fVCr^!En{E#NA0|<`q-7
zf+mexxstJn|NRL{Zz8sU=scW#5$Nl1B*yI(9OgDwMP5i7jN8=ODhTf7bDth68C%SH
zyfBnUTw|pIdL?LbKUfVPSa}#<m&dG=%XyVK@buG;xer124oor2Sg3DO>($UuyYKkx
z3ZA;c!oqU(9jgr(OntuDex4)4^RTNuc`nEnF6Mv5mR%(@%_$2K>hL;V$`W$72~B=-
zKAgxzWKKI%Q&aPB3w>yDhORYQPn4Cto%W!h2~oAt1O-0?DJm-J>5+5aKcTRtki|XR
zRfYa62sIuc4$aRQ#f!yxVN*O+&WCp)gW1f-pG-LGHejaXmcgeAd}Vj=b)Ma#C{3M`
zI=8Nsae&%5zDnnJGrY1%SR$KZU@?sk8Jd;}$_-I%TcZo=Djc$9O!+MxDpftWpvN9P
zP>}`nyn--C$C8MpwO`LvFYiR51Co}8QyF9qwq!cJSlI*UG3n#~9~WQ{ZTr~|8SW1~
z%?lLKY!ACF!HE0mc7~5rHdf2lQ;Ju)WSqhHuuzhG+gzwKUa8Sj?VK`#&@|(XnCJua
zpXrhD4Z1IvEF|4c#ZlGhQ9(^HlEs!>#lj!AAE}RM*hRP+8ssxUliJ%)_~c8sDDN}c
zPcSe-_Z4sBigvd~A-0BTwbRc5fDp#Xd}(Y5Dx{>8B4#H};{NpVve^d%XsM$VmGHLF
zf+cs@UT3n_n_oysNXc_<?HVd-*7ZxsxW;2x({3duToY2P?a<T7B%kPkkSj45@bng>
zHf)!or4tcgGPcZ;{OxQa!&|JX^+Z6-W)KJYj?cBp`QfHVF(XGVhb(gd7pQYsQhujp
zuS-2esLxY~5PnoZTgv3Vd)(!FvA63r5Jh}-b;a2Y*Q~CWkEKE!HBOYM=c+Ni0rw}-
z+7{3c)+8xj*!uu_TsNOo1EB5h;r;7fS4;N7*)_VgMrg<?;s@W8xIcULSyGZhzVdgs
zCgR67iKzR}FA+bbS~M&8zO5I0BT#;6r&3+iuZod2V5-ZglfvCO=l(NXF5b_;jI1`9
zcD4Qfoul6OeI3U#3~W4K1B_f*w^>=G<}k7)!j!ij2On#sDwA_#)P5H?o4$(uGwgOC
z>t?198rx(&Cx+oD9Mz~W;d;q#F)fgwZ-LYCVj>|p>}8FZ-YtvXW%RliG&n}U0F(NH
z5Wy3BmnP+PC#PnWARSz5ZOWEEk%WjoI4Y>%a)oqOCKy;brb+x-?9)@()2)`*Oj0_Y
zCe1ZOnvm@(DBW|VE`^#2L|<@;xg+594NJsE$;Z9@zUS)Q61V8wVE5uZ#>t6zf55bR
z5}MJ-Q?#(OoO-FF4Jb)d*_k&Ec3eMV>w5-l^E|e38o&3pa!@H1@{Zum9N2aX?I#f{
z`;%eAlZZb%G_skkW4R~NVUJxZikv)c<`C<#o3U#S8whrhTEUs+J=IbHmALV-OHCKS
zzqP(kbY~F==e5v@iB<Wy@1If|Wf`N_?oy@9TZ{orDBd>C5Xx-6(+{<3ou1arIHDow
zMY9``5fNz;!Q!?8o!&43Lrm50pi)X|YSn%avoadX1Q!?Y(}?-~V6>D4^myz~N4$7*
zvevB}-5nnv4-LFFba6TLhjq(82zZ~YD1wsnEf4$p`eG;r)zWz^mzr#wf>a;w_v9et
z)u2xW4WxTOX+5f%^*BAQ^VNa%f`i~WgM3P5xhk#X;K<i>9e#R-?2*c>6y$?Mk&o%w
zbrXJ6;1ESFd}F5)wLLK@h(AvJML#*6{2Z4ohb?s%9|Q<M@wxI|m_Kd0)6Zwh7CY3(
zseR+>&4?$h2&>sj8FA^XRZ;B8F~ymvh5aSg`9qfTN8I2K=C8ji3X>%W9lHB|#lU)K
zN3)x)wqJ3wf++X{W;2EfGFmMfYWIb0RZWp6o}IDu!}7B|qjJfK#UEn?E(0ums@6Lw
zDR6kTSMQQg%uBnef!)(SP18lrD<C`!GITPlfTpEvr2IX6jErdNF_!~ps_OlBV5?qs
zGb2+0P}7_x!*KP|+wW)FEb5NSDSP6+_iu%hfkA%iM=}$U9Ej4Z(lP_N$MDNdWP&5M
z86;fgY^I1xJZqTXW+7bN&5k1zY-XDzq(tmmf4885Ray>TQb`2?d&sxmzY6|B{wXoh
zgC$(TBA%&rDX*Uv1Y(vj8J?5v&nRaFSHN%SMZR2}p9`bug~I;*R6_9TuHH~A_5M<2
zj!s->)46frM=dn4g*?9<7lEOZ@u^mNF)=X-iQwa<W^LW5)TE@zFU`zV5KQFXz!sfM
zpwZR$@89#K!#O_H{Xr8eb_w&btZ*Xt0^)<$ui;mMUYk`3g9DZ}q2h55p(a{JK|W4Z
z8d+j?zd=qf^jq0|Tu@&Qjt<D93y5vGt%=_ZMazf5W23qfx=aU1PBzl>!=R|*!)QHP
zMeEI*P``_VYECRZei0H^>i73|u^yL9S6xfyvj}=~5m#!pcdLi`3S0VN!I#?>yXoN)
zUuAet1EuH@VGn9|dI(+xk&?ursfy%u=E$OoMw!^jp;6gPDG1D|9o7|kvQ+hI6U@h!
zU+TO)^*74BN7%W2M_g}m_tTKX$}T}}C1O>R;#|FJ>)oo4ez)}Zr>LH7?=YRLc}3yt
zy|lPPMRc?#%i90SpaKFJIl^f5mMB@ZHcx^80GroM-<sXFm9!qG%>|{h=}q@G5DS`|
zf6rUcUcR!z*L%ffHPttEt=o;*U=jYZ&Fi}@<6T2H>-Ozr>-1>7a^@RJ>~3||(Wv(o
zpQ=y*b#?+RSKwmTU%Nm=s*9NXGgqO8TksS)-nB!TnJ+1sx*$@ge5BVw;1+i^ylNyW
z2JDIp{5YFjnoqhXTbXc^*vesBvjIaNJvUnrPS48&?Y~iQNXnPZjSZXgqEK~ze}CcA
zrDppg$G;sx&>Wo<^I^qN2_^I}l&WR(Ttc)<|E8>lhM4&HJT7*?Jv}|}%&(~1YY33r
zR@C&*%;_3#ysf<zSc&kG^d(|3?VABRr%yZ7#0cf?cJo?Tb}D)AvNHOM^qW4^jCGtc
z0mA!KVX7ZuQsaGU^4_CK%I&V|wL^mXuP+ge7lkzn1u5VN;NXk4v!<w(*Zs9g{_5G}
z4sD3%7z;X66Tz3GSqC0y#58oTQ`d~_e&0_iB$SH}l=4C0qYTrxvg!Brafd>0^e1<b
z*_u3_*uxxrD}XVpmoc%EFfY{sBmWY*m$j(mBXtJo7++HKVX=0O(e=rG_=IdCXpPsf
z{XyZ07(J6CFavJV=F&GOmJCAa&$C4bR3eK<6@?S}3DUN;P|DiYx!f2l*XHWmDp?w+
zg6AX>HXkKNZaHfbAxu=c`>dpM%a!5olU2U`R-A$EZTVWV{nZ1n#aVg*fJu)EC*vlh
zxLj&IrFu;DmBVp8_QZ-j2xJW}Ky!>j`g{9Md#=MDMorxVt*Z36jms_CeYAr>V*+YI
zATD{uZzsuOyuRQCcL%xVSr;slV?_fQAg7iPGIAAP<pRcBe7m5beQ6vc8W|K^Gn=sL
zObB(P>ca)Ll-dUCrU&_-#|7W@!#AbXUlR196G2grz31%u89^^?(KJUeI`6Xul*p=1
zw|w&RQUd{ggTd^qtcA0Nz#UapRqA&xdF_$=z7L^zq&}iXKp+MC-LxBb;Cn^LALQ8G
zgxj_}YpjuCguv<>Hk_dA#^QXbf~tp?HZAWQPG-JY#wRotYVcGW;}~0Y-M3ra^V9!{
zfA-SFsZHSsWCGzh8wZONBoYIgU(Zjndcfkfpnj~PGT%1hRWHy?+i_o&UgMrQgw(ub
zXx6YN!1w2u$3=?uZCeO_`gQ0Q{I#_Aq*}LPdsvzC^FZc(p%kA99~IguM&j#X@XL*L
z6`dHSQNl!(fqo72x$w-G5k^b@I1Uxb*>am?2vRS%9~&_T)i$}MR50)TM9zF)lFkkf
z2)Iewrwg>`5-;V7zVAP$YIYl}tD@5M)jV}Mu$w=fY>XPYz&Y8A3x;QBG0Zo}<QRcx
z9Nz!{3l!qH>Z72hQ>|{&Jr<ty?`o11p~pv;d(Y+@vsb%m$bWl!Id3wRfj`Asb*ilR
z*=_XiQdstkpb*1_G;<@1Cq%7`YV_cPWL+aVbu1J<B#D%W=;ENVc6x(X)g4U@0NdS)
z)k+W7x<zdDm(u;5gV>O&z3LLECih)6q|g3zF`RQ{cJ^}B8_K_0d$(wvI|b{wM^pQd
zA>A4Sy+$ilBcnBa=k8{&>h)d8P^tB~YJE!7knvX~j^q*TFp3`wLm6)?G=_=oVkLh!
zUv23YChd|;39VM;5(6s^9}jdJP%h{%uXcK0A1`~~-yzP=-HN9_C{|tKmNIO-|N2B$
zM&{FHzoqWQs}zT6lv_cUj8hJiZ2Grj1>tMD)h93I1*ZW-tz?*|_d;RHdB&?!NSxns
z?h33Q{$T{QFM9MvI?|nb(Y$%x?-X`@G!QYGc+~h^L5o>Mf+};H$4*7E62+1lRv8r)
zC34{3r3QXE52G|3PL7u4P%qJ4A97OH87JV3V>}ry7xu$seklw|oOl9*<%sz|efkug
z;I5%5!HUlV0|V$3sHAyf-pD_ui7w@d2@#S(=l1H@7Oq|Xu}M7W=F}9){y0#!2eCtm
zbo*Ngfj1Xo_4oJhLxoaDi)GEt?o9bGC(rp90fIz$ST00<Fo2MI=$$Ckg&5wZx+TPo
zn0Pn+v~2piYN<G@%_0bZ$prw2S~h)1N=($+eG6oDLyI^c2ryj|?E?TU%yW<b02>+_
zUJ?<3ZcjQVCqE#C!~>D=t>MIQeDdj)z)%dnND{Jt<isU`M}HW@0S?J>my?_O`--3w
zHxCa!!@Gc!6(Qh}Eb?!K6pcPe%IXbgrtzyjylrt<ESR;!d-~Mx@<8^VPBe*|Gx)^B
z+xr@=bUCheB>yxCKx<uXtEB&S14|fh;-@v_{uAghj}<zjZm*X&b7tlGM{TN^;L_9o
zevlC@{y_HOk0_3f%ENxvy)mh0Ec;LC{8VPx>E%Fj;Z(jpWRr&9d3CIjXdiJN^)w?W
zxm7!xTBP8?dX(<p5BCyD6)vHV72A{JUaMr=rfVe_l<8U#!p(LP^qBkp-3L4bIlb8m
z+4Kxr<&-xb9A6=%rd~Myj`IodcN&InIaFF7&3VX6?7dZA)Z<P)b`x396=PIa*M935
z3+4)4yOL7?rAYrPy@oKAvQ(#6`~<&P%W*mhOtMv1M581EjM4u@+Fl~d5eINmP-W9M
zvXzyoS5x!A|4Fc~{-Wwj4CnZpXF|9C7g^Uo<Yx*0kaNR7LZjs9Hvqmsb!ue@dQXn?
zjYBrj(9q<o3ohS3LjV>Y{U_7{>Tv(R3&$A$O&{QZ`L}=l-Twa#h*qL|{fLQ)(aaOv
z7!#mc6nJ~}H`ip0IoYs|wtUj9ZqcE##90B5qCk%hM=b2@{9?p7k7xr<-|Oiu?&byu
z9nP^s(6VoMI<NKB@p3AlNk}-Ga90eVTGJQt#Dp<X5ddVNLMz3<=CDV9a)a*?)5Xd(
zG&Cip@^Lf-czA`_Ul$fWNk~XQB!%CrsHk*fd@4**vSg`Vr;BEN)sEXfXL)V+k*EAS
zPJoO7Ubvu8f6pt|UuLFXy)l3U)jIwU_bcCHAO6P$1Y*XRh;W*qEyej1Nu#=FOddV(
z8o(acE-jhqFgN)HLo##b2cSx`{0@bZKx`2~An5#dttW69?gJ@NEx|_fxTdqc9k#Dr
zE3KV>h*I_Lqo%V4+=p&YBb$>FoT2*pIh}`%A9`f_GpSZnFQW?v?7i7f-(xy0kBpAS
z2T}II3swbRx0GhT__<g#u($i|zIt(S@kK~V5t6RgD}%qu1TZ<sw<y+I(%GV^rKPGK
z9UYyWolPr9G{hb-+cI!(0F+c!j*Uim_1}fI+t0I~I`4Eno&3;tRE?p+6agQLoP*m)
zo7$It@PO_Qp;^iF@dVc=wsgn>I)JpYmM2bKwiN+88K6l_l_VrEAOKAb3IyK=K(x>s
z^tbe!GCsBwjU66|jg73%X?0LmSs1i611ik^o*0xFpjRNaOL-TtGgdb;ji#I^h^Q0U
zG;Dkedg~%ie-?}sRO(oziK|s?BSJyM+-(PT7Rh`k%V1YqyV!SJe4-w8bq9Vn9Yvc{
z+-I7bX?2r7lXaEm+l{mbduBCc>GHdp(kzOv$BH2VZ7j9{Dk=sIDy;bUcyo5R3z&~g
z?6tEQmzI}_GG(q;$IGg!@U4HO^g}6{BunCoRr&30egg82Z5ze~Y`d>}KVw<bL_|kZ
z^4q<tCxqS>KmROB$FD1mwY!7RN|714`DwcTv+Mh1bV>m0>~rai7+{Ny>h~|S@22Az
zR@;vX*~^tSyAGP1y$2PV3{rq@9-{@<URGr)qijlR4QBEb^PCHrMaKqw=2NYj5S$pe
zKGGpP>6r9rC|Qmpo!hz5l*IjTwxT%UTiI-7p(R^>Ys9E#j-i<ST*F&(L9PY;#JV8a
zA{kXc9tS)r{-<R4#kU?D98ZAbR|0{5<^i@*xBzdS+4N)!IvdSC7te*#cT2h>UW-SL
zYTHJBdL>}3UH5w;Tph3d&FaiF!!UUiPQ3!Va-zE&hf&YFZ*!LYQko1vVeI&6-^X<B
zBomkUvMcG<w$uoR46~AFaZhyn&T|lp6=z{Qu4S~rYXy7GkiL7OKHZYz=oDX2<1im1
z+b{otuFH7b_1w^Oy;|3cl|EfZo*Jn)aeB1ITi4?)*m!HA&O!8cy?{6#L-BBXJ!a(V
zw2pUjs7HC)jo^PBjGO?sH<3x5gPFN}q~q`Mh7b&_pa+yUtN-U3THP&J>6n5z*_&bQ
z-wbEEGosCOrsuzYnl)H0vUz^;u{kx7a1QSG91Wx3l7G9C$zi$^(G^<t@v-U@AE5Ew
z+RuAT$n2znD;hMw_4MMy>MVx&gylua`bm(X5qg<g#Uph;I_8z_s-##Ge@FNn^gj+K
z^oovU0({6U7krb&^<vZW>)rxx9zoszF&6W)$zp?L^OI=>m8yfs9ULs}AJuL?8<4~g
z1@k!%yE?-DNCwCM7Fp1L&B~+plO)EtSvl)D5jAzUuwQh_rkLmKQhN!Kt^5xBJp;wn
z_{l(L_Blr!__ZuWhD|dct$Rfb9TnkJMKjR-kbz$(pMgTt+>7K{x5U47Kur$l<pQB=
zBha-SO3KQr>b5lKs3T%4n#^Zq{axzaEHs8)f+o9!z^KE~H!Yu&RdsM@?>F}QkA;?z
z(xrjVg&phfj>auV%?c9UkhqU=eq>K%(atZ)sl|_LHW19H)oV&qHlvB1DzkjbKB4a-
z=vdl*sWY^GDg?A`emuJW1s5>$@sgMB(f10Y=SjaXfXw<%|3t&($scNU2?+^E_<rLV
zMyQnQ*@o=&b6~S(hL=FHFePnc&|)9K%l9`~F5H=Q??h8t6l@ieDJ%!i%GwN?^I2I6
z;!pJ92T2UKEdCACb~xb^=CiF&963~H$(77^$Kyp_D&*BK+qC>ezoJjw$h*Wf_@hfu
zepqHbe`DNgP9IO7isZ!bRpY?BPB~uzH|sB$|DA7nvi1s(+X@N_+;_+C@9(vx(a}{=
z+9vv?0Gnc2K;K2s{%Q=~Af<5n>$~38ohK9e0=EO~@W{VT8R{t~K1EtaOIwH08aJ2@
zMpNRe>#e=0v_iTM>owY&;C|`Hf~3SO=jExtThmJA#3802rN`Ir`qW`DeB`SCJ+VEM
z)0mXes&Vze$l1~1MK)^0e^jNhvm36~mP>UFkPh@XIP@LSlp8v68mCqmE$n3PW@A0x
zm^EI&44ReJN=s+ZBI+rv6-nhwD&azXOqdQ_;HnMd++=3f+F4^`fgF;*%A8+JpKz41
zZWO*$ZEr|gUhU>BtXW@O5fQu=aay2G#sc}15+(u`NVLqa_DHv=@=H^diTG7x><&L7
zgp}Cj_fA$Uu3h&(MrG+!bQ>9)zx}#Cxi~VnGu*6UC735m+f1nttnS%a*7n^cyTj9I
zM__SfYL~g)`w&S$T$oweTaR=)bTXdkEQH-PiCd|k9@|u5TQfe(;l&T0S@n0BnH{GY
zO=@*IJkIWP)qnpCaXd0I5|P}4c3yO43z|`YK$@DG(7OA<J?i#v7+ER&b7XuxXg!ql
z{wyx|M;PRHF`9*Ee;JM7*SCt%WK3pmHpu_P)>PK5JIrGt^Oj^5IR5o<{Y}Ba=2%T@
z?Bmg59)5X?bt_3c_wKy5)XLrpJw6Ho+vnQ@WwW;pO1KY*MQ1e^e+Lo$l*A05c%Lxj
zwN1;WQ;hbW6NB>#++G6;x;y0Ol%KXx2`ru_jR~@}LKuV&tp$79R%Jw#1b5r_IAcAu
z@Co@_sp~P(w(N8!_h*6Cij^d~BtjplP%YQZeiHL{b>+?k2dM~F6gLEB_NZ3Pg?{;(
z2aV>8qgZNuFF#~9yrYU8eP?}lxJ@%AA4Uq#ZMh-VxX4*1_hwRkcaJJxn+s~%vzG;A
zfM-Qzu?R8d`0O*XP%ss}<Z~MUiP}QPE-Hjk$i1$rnz!(Dp+Glv=R3-8{&h43Hy)4+
z1?GhYy>OR)_>Hsn7ps0I)0|wo>9$5EMo#bNo+qo-5(Tf#$BD(?>MeTH3hi@liV78_
zr->j%so{z3*U@CMP(^p>iE;C&pXK>la`;{^sAm;A92Lqx;BS3@>@!V^A1&%;CFMzw
zey09Fsb4WplY0QIYG%S$ox|e`<U#|F3j2I)0t)z&eQms)Dc*p1pRoL?ta!kSdMe$m
zO>@MTe>MuDh}&ykZb@oce3jkix4qqzdA&k2&$l-tw40!w82h<LOqdViTDZfKW{A0#
z^M=LK&8ZK*{2>%A0o%oXC`-<c0%xo*_qxlp-2USC$D9eMMULa}kHAsOE%CnnatJrd
z=gkyC{@rAl4-r#FvB+h?qV#f7PU;oc&7DJMwS##FYZkyHe4%fb)X7uuV~BQor?^q-
z29N1**A$0?`Qx_o9>LbKYJWGfu6s`K3ksHAVc+wd1^ce|=0jK8X)L|f6|r{zTh+mX
zSEbiOSz35uDt>e`UkgXXy>Ck0hpvY@CNd|XjCSwvbF3w<i5gf*Eg4X>0hE<m59vXM
z6Z_jRJ8h(6)OAfxYybUl5LcCkua%jf!%ZQH#~zyvw{_f{ZG%x>IU0Ju0Qh{Xxv_I=
zDY1Xh_}pst%o;_<N_^?b75ibB@JK>q`nq@?>#<6|MM4>>{CmjH@dPc<PV%ART?)G{
z$|#4crgXh8AyY45D>|L0IncX)KJVU0tPOwj=&U$U`c82teYBNY6jKV@lWCFJwR}Db
zo-K3#Rq7TGf9PnsFS>kJvv@@F)(H)>4&R*oWQx+dC4A5fBsO#!r1o!PxU6xy`B1|q
zbP2>*zkP<AZ>c!lbe<SnR3=lHqLNf==zZ{Mt}3MBQPr@zXoH{tx3b!1{X|`4;t*1J
zp4T9`-uqYpQO7XK*wJ{HC70M9j5uE<2eL1=*m#XB$kI;aF+A5EFYmuKPi#P!jhGh7
zJ${U!7}wTjrj%GKp+YOof~eDVdZFdOg{^%ev1HG&HIFpHRX>0D2CpJC2qXUu4`}&Z
zdZXSaIF74c+R(Y|OstT$kvB5fAO$+Ld?Aav3rAd)bxbPPf->FrRqUu?z;ret0mQj#
z;BL<S*C#i4w1l;rSdwE^OE*8?zIb-vukUt3Vm>))`dQ6VDD^?1$EP}C3Je8x<^UGn
zwlt=eXKTir8}x15KEcOz@#WG?P9*bB6Hr!a;j)=Ys_(~d4M+oKh74njEG)2%rwR2p
zdYxzxX7Z=}I*9}CK2pu%p3}{A^LgeNfg@ou^F6X~wS9KELzuF1guSfN)&7Y}jiiGE
z9*moZIwJe4<jgXpyn(r)=eVM%Gmu+=QEi+Ysr1Q&ba1oOnXgga(F|WA>`GPVm&=L7
z@93;((1P#p!$N;@EXhT%asn?YuX7o>;Q&?`;rYS3<bk+HM}<9YsQ;26EGU`T-6`39
zK-%a4`qhaA^ia01cBhpZi8V#pC~2s##^!X<xwlW(|E@Dow_evoqPAi*2TT=sU}V_X
zgQ-$#^wnU|zkxwFsv8xf>%8Y=teOm&w~&O5TL}((@Kx2@XZ6WLJN?Ep?0P<YAL^n;
zQkGr~@OiBJ@pevn)UJQ!O$`6okYOD+D;Da#=vMuQ#W6%j%{amHOi8cweNQ*?cXr&M
zfht(*n%~f)NEbTRsWGWnSO|U^2=uy@Tk{NKD$JE{tyvVb{G~UewdI6EV>z7*T21mv
zT%YOo-WAz3<H%M!x}M9zMG-WP-j9hSK|&`Wt159|CG~CI5wg|L@0rulx(&&(h9v}>
zD+{ft<zG^rH8kBFtK;91Csgy^cOawvwdy$*I|s$U%FfpkKB4`varRC+)$WAA%&|za
zrDEpH_`9S9k7k#ny*#>fqs)W^!cx*F_}tmu#SR${<3{aVCZ7Pt={??va<=0d{z0Oi
zj&S>@?$cUsE80z0n%8{hZBn$fbYckllb#-o69W>%fhF?B>yb|dd8Q{LT9s?7qqNN%
zoympS`vsbs2|R1+q#d0X$$IsQijhK9j?s1#YXNQDIkYqE{5mN?l`1O;D{ALG8E5(K
zqu!eC$X1a{5^wLfovwbtI|Qql&e+14gsifp=2u%@{--s}!&$@9G0s4ZgU`qKv7M}?
zZ!ay7?K7jbAVf$0Z-*T$Nee3-$2%%3)*6?0u`4Gs!MhvxVj|NpGOJxHnmZ2JQYIBV
z&I*h=V!n#;9FT}H8Q-teN~Ogsr=$H){dtu$o)&@9M4rT(fSzd1DU$6XdIrm_B0Moe
z1-YXRNa=NSM9T60@Q6@$Qc_a?`I2y`R&{k{WBpRI6`Mri$zY7=dlo&cB@V1?AjNI}
ziHs*SvhZ$yy#($G5yZHVcg#j^s2jr+DjlGNu=}rj{4y)X)@0T;Lap>`JH8Pe%l0+D
z9)2)Vi^DGS#STP0dc-=eG}_v)M{{6n0~{!~yQ%2A`l2(3$^UTyC<1SOk&egT-Fahp
zTenl15n+qhI@CPVW*iKI{%X0rKW8*PP|N3XAUkyBGZ4fk!k1U1LJF3{i>)XTNJ4GT
z9-7H(h`mR3ie&gdrm~|VVD&yej$f@3R`kD-(mVCqb2_AKbLsE=FwgO0NBdCpD!-xh
zf<qr4gDfw7--)uO-jye5zQgkh7PxV`JwwTmv*X;{ym>{=CzH<6{vO%Q$5Kb>NF2qh
zUb^OS>a(5;Ay7|FC3Hlpy-cmxTZVGAf3^ReHIIEde7ps_Z)M8l_8QO3my#PUmNpJx
zQk>`(YYHB^p8(D1?l~UiN(P?YJ{<q<^pl3IdQbky<k!(~#EPn&YZMk6dZ-qX_UBR@
zF2*tr@V+$5@v|Xit);FAXJp#P0fP#|e1-8s%`scp)rAu@-u-eh&y-6~<Y3B4)OAXO
zjWSk@X_dO&gh5`o_uI2IkJ~PcOEansM~WrL%7N1a2R<<BoPD)o!#m}>WYF?CK+Qu{
z)kjzYTw>p5wYeSQbGF#ZY?Q0aEdd(^-#k%Y0Drb1S)EJd@a)dFTqCrMqHI;1f4{j)
zcGAMq8N}QeqE+qdP4V&8koR)k1j@Q`j2jjeC2DzlRakzO@WItYusQu%Z(fJ4AwtoM
zhG(elY4+XN;HY=oM(PfTW-_K6l<sG;dC&IhGlt!7^%Zw|`FFmR`#bvDBO}a>t&YO{
z4yr#)=||lMpP1WAKaCrp$QfU1v#P@TyJ#nAn|USF*g1P+fJ5c(2JCH?sJTUy8*H)O
zOi}5vy<mDN;H3Vf@Vz4`b0P!HO196kn8VVm;C{UZHNywE>d!k3eciW_%Ao$^+vz*S
z=4C<Pyl`Os4?&9&31a~R&OjJ&?0`BFo6`?`#`nECa4%^YT<!a6Zq;rFW%e{D_nlh1
zgn%nF<yYWQ4b579q14^#yD`6(E|8^TP`!nBv$UL|)A_oLWx0~N3aPA^8=U-Co5t?J
z+QH%xj16io>8v)F9L-Z)OO#tyTf_=iGrF&#>cI1KPS^!Q;!c3J@()YaA1<?tw7Wl$
zbW^L8_7DKu)(y)pR2`-r^!yH|Ik}avA<KRH;x<3LpYdvC+<p-I?7b+3rYOP6-nVvc
zMnV(N&Q2^-9+~@^BZ<a`HqE1LXV=yb4CiB6JYKN(YpdVEWYB)-JYs`<KPDk4%t?q!
zSVV{{Z23ZXnaH=aX0YT}zPliebO9@b2>ZQpaP0Zgtk#gz%12_O_JGudL(iB`)DzX%
z6YsKW`r_mDfEB@8_8>HtAh<N1N}I|t=-YYn{plb2;$K#;2n%u3z}Il%gzipgb~P2R
z*TN4#u12BiYDxyB5yA2oTl}^Y>A~|0t(VtFBMG~^^f{U@Yg#I<DSDi@iN7|vuvuhl
zRyGkFJ*$qV$~p{?PN(|ZNhFkg(=Rt0(i_z6=kIf?dl*(f?hWQLp!#Fa_J=pr=rhe(
z@Xl(Ro*dO!ARz3~%!OVBP}cSgj2Sp2{<Z6SBX36})*kLq?jryV%b4QGhnH&i>yGy3
z1QYyj6kKl8?oES$v1@{|pg<nz>gvKMU|#lj@k86Gs=6qm>XWu1_ycu}c6ZD&(R5x*
z^xU)7)KyP7Y80N22{CNDREN?Z2-&5QK=Y0>oh>gu6$Y{vvzK;c`5wj@2aWTIgH)mO
z1zjS-<^X|t99>_`+kvAEG27UA<?}JEAtEBq(v!suWHf9+hzR>#+VXj?5lJ(G{~39#
z)92dEr=tU&FrUcu+4y_#{nO`8*Y9blA;k%-cEF*Y43_y*q<?f<5nOXMvuGn@kw3cw
zsmU&CUoo(<JXO78LBg?eG*oLFU3t)#WpAkhS>BLDBK<Qn>)^~iqbctJPi%CMnW-GZ
zd)NKDJ%(;Ic6n_46CRIaWj(@Zlj?SL0u=}Ac7+z=H8Y%Op`67hIwM!?@(*l>3)+8v
z9rnR?9CY)X250$W<#K%987ennTRoHbz|VE&qI6$3#qsS>#QvCKuBE#);i^WsA(Q5D
zj&Y0U_9yR__Vrm(hhe_3^NV$FYfg2|Guaa<Qg3xm?-Uh;3tRL|+i%2hiE&{3ofY%?
zX%?9k^aJ)(wAK)BY_9TzTC9>feNiE-Z5VRc##G7}UNIlCZsOdguk3t}^+6}C!S{Ak
zLRq+<XK%W~N|1vbP@y%oS21f*T=bju;YoXrxK#hMH|02VF<to^Q-c-vgU7=*Cd=Ah
zsrOnQLT3gwZ)awR-TRk>S!cXw1e%?{SGe!m9cR{W7cn$Y>V8Zvq<*yOYq)o7zZh4|
zcN?VbR9`shzw#00+Odp2<xk#`2HXA6ElX!Fbza<I|9cw=$>RzIucd_GHut(An<vod
z)SUE;z|PJSO*OsJ{GQc)QdTA2%%WC@c?#FLk3-Ac!_9Pff)8i*N`y3Y?j_hWZP;yX
zC(NGe7lti3m|T+X)5Q0_8t>obY#QV4St0FN69-U9J`CC=M~A<x$?QsnrKPR1THsFm
zU!%h+++Eyucxu*ucUB+T9<eG1UMRV?e+_TM+N>u{If!oLFq*o^4L$_pim9e@8L9>w
z0GxguP{{vX$)r3Q95kH3TmpTVeN_T8YG&TXQSIg6aEJ-p7V=%3LpVrVb5KHquX}4y
zdi^8_H!yx}`(8(Bxo^r_b#4z3zwc&^EJjJ?BlRKiGxuK|<uy6t-dZrx2p#)qO>lR<
zpIG5-U8HlYd4hi{&olY^A7r^15D66n*cat<3t3@viNxYiO(B$5t~4l${{myrz>9q`
zVIl!5d{eRl9CV8$K!Tk~F#*~O948!AukNd2D2FnTzch&}K8-hx>!+z_<mjBiDFp*H
zbflL!YM{nDx6m6W?~V1`4Ow0}^3Hi4-axI@!%r}c<)6cmw>Gy{T{)u*ZX-T)iBLj5
zFJv(*>l7~)HCfS3tR<_{8ftnt(fc83fSSikDtL2;J9|a!hH%$ulIS_FzM4}GVzxj4
zv_to`>{YoY!+ihf%GA&io-CXJj2x#B>LA?P^x$T{+z=}GYaHt?^y<=Ky4!%abFdsn
zT(?zKp40mEM;P16T_w^(bk%$D<uNXRk23pCv!Wntp3~(6$S6=O=HZf-Z|19EhWFXT
zvY!?wP6a$|Rf3_kBxmtLODWz~prrdvcs^%O21mCVUNH4HRCouE1rs4{n~xzg$PZq+
z0B>-*|0+Y`Av|H?BEmyp_-f^2O3JEAj96Mw>P&Og0Y!a>+|(BR)Ez4YzvWCFAd#+c
zNQJCVw{)oFH-E-hH>?YJaHJX;O3`OV9!0@sO_wUmXB9U8siEC=fl55LIGKrov3R#~
zfsHV{QhUe3YP<5I(9m3U;1Ri5%%UP>I(e-tA@K5iAgL|4pyvieJHEQ}%-1(!;pY)$
z#b^xlJUCNe(13mF1!Mn0HB;)tf_bhuCpU|Z8*1)yYoV}|*sI|E{R!cYI6y3WEHK6H
z;4e7sfs#riG)bB8F6nJQbuWP5RcuHN&Y+k%M>GD>_UZn-+l4Xp{lQRVXpvrBmD5Uw
z5!NyXBP3^;ck7Z%9ebc%Y=}phVrfpV=DtwCkp|25mgM$$kai+VD9~o~diN<!lk;Fo
z;+^m7ovbdEQcZ*JtDWZ%Fw~IeA=w>V=;96|P23z~Pi8n-zFkcp8`aa*Ql~sI;@I|p
zaW)AyZd>9jFW=dPf7fr&k~m&PX>C|0FM2_Lj^WL&)b@Uz^}c`&ae~#v6RTl!wZ`7z
z6^3QziDM_gLiOnbUlEEHmr98sa8*AfFqJ*zDVO90bEm7&#gl!$U#&<Ot()I9Y}-YM
zSLpC6FaOJ~F}bJMxy@3$ac$P&%+N&Vtz)EZhB%$HA57f$Mr3i@H8`7SPt;?hE%TNT
zZEmuHJkL##srk^fvqdy5=y6xio53rT0L#_#!>^ZNjisQrO(CIjbK;!Y9aDh-&zQWC
zsA7cfJJU~>xkDa=WW>F3VxIJ};&vNpzC`NXo!8l<*VF54roG=RmA^~4Y*||QG|P+#
z2oku`@R;lL-gzFbsS0&lOoVY??21YFBRUp0=U$}P%%uHw|G5g;+P-r{l-a<<*8SRZ
z;^ZU59Q!@!3{B`+-Cg4JqzfkP3)mdxRW1`<2ide)O~mf5KOk8##Av)VG;~4Fue;J_
zBPoQHb)j|h;bfpKfeQ?igTLLw?YXD~_Yty&Z1d=7O<L+na*hI8cpz8~9BW7xf`LGH
zm+PYh6M8vBDd49rjH)Q@j7XQX<`{j5z0C5!9toKM18gU@DXlDLwd7W?sJb!jvHbCT
zDOc=3u9^h7>`l-csQ|4wofhY3!0|Fw`vUxl;|^qufBf82u+<MBHqvU9v%eNsC5?M=
zy)+HNEm4&Ir0pvAeB^C#Ka6;`dpp2PFVpz&hbh!?lGU7GzA{t9n(IP}I~{!Y^kW0;
z<ZzasyFSF@0`~A{MBg1oov3wP^J01-u?e{r`y?A9V>z^Rn;A43H(ygV){sdASjzgR
z3god4xL`^&J10)XqheWblx(%brOJVIB<Va;wj*}++qe#D0Vu6|J&9(USXo&1qUYKh
z2MmK|qf?X`wkUc!Q}N~t*5}lu-Q9z%QVd3~;e40EkYDI4ri%_<=qilmW_x*x@gqtl
zkaf3)N}J)MfYDmU>GIl9XWmYn4zY7;2SZxGsDv`ozxCB)ztWSwu;8Ho%eAVmR8285
zp$n#RjK;wzTjwu>)l=-B5}OSPY!5S{YO201=sJN|+~-SZYkcmujcdj3EU^vuk270m
zzOn92EgrmvBrb4fBdtuy`-c%z+B41DI$08XA4B0kejaYjeE!rz=h^*1{UV$HVNI{i
zo<PW+=fR85VLb+M!ynFc#i8%thrZk0QaSthk51_@mW%zo47!5tFMxET-3yF1?e}<c
zO0~30_s3}M^4rv!Xjspl+1+P8PpG1E&njp?i10a}%K8`=i{tY@H^qIZ!fEnr!;<f*
zg8y_zhh-WZcM?zt`if3-O4@(@_mcLh5A`=J#%?i_mlz>B_}!BKyK7!ni&-`O@hvRb
z-h+7i8dvfVed((%{TM-g)aDQ{dNGrBLR9#m^YLSov-6?zqrewvF$fb-oe2I<m*iUZ
zg1|Gq^}W@j;ds?AQ7hBxoamAyb)L_qs<lJvKR09nHd+qHoD_cx%;Z*BF6*mqn3Kr$
z#5<2E;OA^~y_5fS1h|kBGm!a%D2C0kL!+KF-V=ah*dm~6s?h0)<9kR@f-7}x^WNgi
zz$q3MmZx}l%F4>4qmC!HI31%NL;EM09BIGy3qwy^pRoVfH@DRSQvkUDHvVI4SO%Y2
zbMsYgmehGr_nA45p4UAQvo@>$1gyRq&lZ6jjLaEHcHF|v`+20w8mR)Oa3t~eA~jh5
z#|8XfW&DPm9>CfpDD|WztK2|xB6q<-AaR&4S?L7Yn#{RS;RS^c+gi)~aaG|Y#jr80
zpv82^|92iQF}XrK$?%_`=5j*@DsrV3t@LUSs$T5Ik`&~B0W>L;NQe9<RmY%n-#S7u
ztUM?Z@-&3N2)u04td`?YjfqdfV~INxl+RG<iDR?;@9YxMe;Yu7nQDUxSYZ37P@?w9
zlRq<!xVsZsMbE<UDUT_i-z=>ETkQc**OkURg+-RO)F9MJKP&tCB4E~PVB?O4;NCxe
zVVU_HV?703`sP2R=YyOKn?vWLJ*Xe|jkEpxuLXcf8H$%7oQ4Yf90!QA)aCun>jwdT
zvF$46Jv4G^?bMA8YT>%qi7~C&Y-J};?1Xiz6TcB)PhYIX`lq-BUGPdl(2d;&w0_1f
z9K<EKvU0FGq?RqPf_NXCOK7;7MxXkhnSAJC4-;C@XIxi_2Y2KRIx3u0X!r0w7(JZ&
zab+X@5MrAKfgfC}6=%+yh$2DR6RcLacVW+bPlQ^>frv=XH^Jti<A_pYU13x^Oz=d<
zM<v*ODNpU!y94?|1R|JrCb^jPU8>KPg<Q*qk^K9K_vX^_@I#q@zr9zEzv!9tL*9?}
z2jI9x{lXO?jLne$&te`jT=0wV#d2^EeE4C&vMlmMX=9!?@O*98cA$zdJMz5GdABio
z@0E9hS`NrX?|hkjz)-45Ru6<q@yy&_iI+VwT6h@tk00V#aewL2;m_;@0fEF*D$#X-
ze>amt3Lo62hd+PDzT@o%iJU3Jui>DCWxnVZcaH-V`F)S2-aqjqUKoZM?nkHNm4t&s
zO%$RQa2(UismHq;YDS(u{||L%6&1(U?fWJIJ6J+UAovahNN{&af_n(=?(W_YG`PFF
zySrQPMjCf__l8@9>~p?x&i8QcxcA}S8hK!Js;g>MueIh}bItktuM>#O<B)2HviBwz
zU*C3&ERaxvP4y+RwV;rqS)|?U5al{(YI*yd2o|(bRi#*ab$0C~_Qy>@Yp7N6+gDIp
zf;%lmZW752lKU+4hrFYQqeKSf9&b^yn0Hnt@(t!&NVlQPi&_a$xJjp$a_WE^|4fnE
zL?=ofle*_IOC85pszgBThsE9WUXUtL5;`_Jkf}_69=qQyo?LIOcWO0cZ!6w+%_G@g
zAC-y0#XKcbcA*%wJlJ^RV8`xsb;fj>G+t{rRJ3~8`ciHIY_Xa0BPodpK2_<VbQ?Hu
zCJsUU2avrzS0Dzra0df-lUy%$9zqLXdul#<cXf;Dm;>`qo#hINa0RjvS|fWc_Ip0C
z6$TwTqHYh&I=rXPSJH*+)`HNh+FcL`)>{|eWU}MkI5-_6qucE=?=ReI?9aHq-|OxP
zcQW`JtUDiF&R;|O;_=>-Y2LF>mFIx5!{k~jS`0O)j6)%hQWj+ui9;>-kEbvHNUbF4
zaIn8e9{aowb?!Nyd`9@jH@UF*^BF9@ZZLS?loRF{j-y8<_y&)|=VI45PBCBW3^nn7
zjg&pOaN#id)x|Or!pn_0;>Y``$7AETi8aIO_jjJ&SF_jow-7f9JvB!N9vN~fFC*e!
zxSxq^+t~;*y*lu!Z}diX%|ajOQb|7ANgd#_QiZyt80ldQw7W0U`zk0xzeK8V?v%MI
zbGu&0^;p?ecnXR1u(g?Que)7S|Gu4Dq2VR*@JofOnPyq_T9nw6ROdO;Zs-7;cru*|
z!r+~GLU1WHc~py42u|;JX_EOOn6o1d@f7Tq!yzlA@6_I+ZIk|<^LV~q0D0(gUTYzN
zQ~YQB@BBj$$XKQx$W>$$P_D~;k0B`Lx6p8{wNcdO=Xade=I(G%tna7BohN1|Cn?`=
zx!+n|<(^MII6ywkcD}g>RMib^LjzSd4j<hJAj8mjXq@9YDlnfg<&?t3ykl==yPtW%
z&d#qcm{Xak4#)AEr}7O6$ZvBqF?1J6fgvD_-v0*(Wa7;Q=;>q<Nz+_or#`f3PAl6W
z{{|IQ7)o3y8_q-j7l^5dIDwX_1}5+@1H-f?w$AeEb?ij?tgkI0vNTw>czC<DczdzP
z-nH;v`}Iu?3H$Zesz7e79Y{Y=KfiNp@v{=8cj6qne`^I61$FVaIUv^Zo)ZHYO*lLf
zZw%V|_7>IkpiN2iUAmk~RjUP+_&|(ImIlU&`SHNoTpcNay*$QbgIX|ubW~o%u8_Q0
zDzQ*#tqC*Ix<s$C)CIw9qG!x-E~5}*s8nO)^8}sqiyUg|k5m@w<(?`Do5C+ZZh^GK
zGx2<Ob+)$JG`sytv`iaQ$67;*JJ87mIQWuJrxJ=b)e(1`Cu|lo@=r4AdF=8$JY0P1
zDh5SlH$R^>(#3&i=9`{=Hj<t)oGRbSoeZxfnKJ*YMoxH?x)>c{3ln6FZUWQC5tR5#
z=Hgd>A}!O!<Ms8JK-I2@7h@oX#w^%}(dN?nOl)xk1PK4g`L1g0dXwbYQr3G0Q1#M7
zBYsvX0xuQcq%zK<6l=_!eHuWq%<#{s0{6Gl3y@eho|;wI(TYWBF^2bRAI4zVBb~CB
z6mY;Pa)qd*v+M8QG*mSnfQGThM-3TSM{QhkU{659Q6W`65*Gobt$WQ=#*4EfL7)oo
z<%i$ijhpWjs9&er&PLN#y|TK!a(EbVWQY=W3K^n-eR#ycxLrH_$m)e#`eUl5;b*&_
z3`YQN#;NZ9PyGy_`jPfs!1>-$;+uyN^ZDtLHg-zy@M-?&R$MMM22b!4HawN*zrXAT
z{}8*P1E3OdQ|R))6Kp>#d5NUJ#r20@y%mP!4d<P8ip0v5>HJEYG38X|aH@4WKmHr&
z(oYBe27UH-2i&xQwIOn7)0ADxrR|I2@^GT;m0Wtg;Etrth2o*H=7!~-wO1gwD%6Mb
zDJv4JC`pSO(r!zorl+RP-qcnZK|8pGflSh24r#fIJ%8#=I(^|7=469+=F}JcN$A4&
z(e1bOlN}3*r;3C3CRdJb5(^jeu~Ifk(GF|V`z{DglQkw&%U7Z#;qnKny_7l@Sm8VU
z8>|f4VDbnuZLf^-&x@1&J8*7Hd9iV=%k0E_oz?8DmRE_1akmX67<EYQMJhE3L94#$
z**!1xTn{$JXJVnT^0|WpV85Fupz*c2km9+9_As!?J6qfPIPSheA0&hC55eNE+07~;
zb}PcRyI+F$M{n4%1}%P>uCIQYGg-k`O;o)<n<qf9zldem5<Xi}ZFHhipt)$5QNs_o
zVqA`-(L_-hS<6w8d~wzBqwk|kWaywvR)5SZ$lMQx@UR4;P#<fJ^7U&4m;L9UVcY?A
zUt!qzU{8aySBX(Hj$b?j)*Y-cmtibaxBO~{vqFAvVWB?BAZ#$(*3vpdD3T%9=|cEo
zmz%-%v?p5a9e+WE4m1g>R@gXYgZj*kG#GxmxJh0-3E$fN`LOXjTMj+Tt4ZI!JOTbl
z3{?*FdLw9(3U~Hujy}o6LPG>@v}0ojO%Vm@ndmHEC+GFI>?o3C)<_#Afr7syh3V<&
z@bSbEAd;)TH6O1|#C;vN)!GQ~_?lgkX>_HXAr3qHdJ}I+_qaoN;i+!*r=t6!OmFpd
zS*S@3)!Hh*10&%HqYJ&D;Oa~65!dEh?JWfVyQcM(i#oOwJKnp`NmZ*6+;<VG#A1b7
z-Ka_v&Jed#B+xf*X*amIU>E3@_l@WhxLg+Fut?RH_mkFsHFFF2l(yS@BSNm9Y(?f1
zSx0$rr4=klwK*(2xoa)9CxKXLS-rjTL0P^9=^(AzIX-_u%D5pAtw<l;y1l*4gU`y$
zOnfAEaG=#PAFDi58Bj4;AJ5NLEgq74V~uG`gaN_S#e4-_{DB|jttToF9Ewg#LvQ_(
zihx4qHWvT>W^E@Eb*|x775Q~M6?=B6!m-o$@BB$=WAj>zKWT^RY}49BPQX(HYTJ7U
zArAZBbItpW(mC*~{kTWNsFVj~Sx*m-kdAHbT+FA+i*~C%_)>iV2b1HolJ&&PojCH1
zrX^uPcx<^oCD(A_aHIvp29Sh~tQ`@SS{4`oMypO57=5clN}SLfqE=9id5-gr0g{b0
z+TT)V*HQ5t%istzgV|;l?kNJBYT$kPPR`bsE`<VxPauZcEHii%D9U;;J{l03x-&H3
z%6Pt-5y23bCWiSnTW#=`$Ro>CMr}y7-5Wj*%$$Ue^m-^;_^#o*qAd32egAL^XtX1~
z%9Z`Lw$)Yet|5~`k;aG(&ysaVSn)b@#!ed6*a&ZbQ8;}JR5y5*Z)`<ykY<+*ZzQs@
z$}VKwyVOhAa;jP69~z49FU&h9nnu=A=2r4wGgwa!=TDU-%;I?5-XI_!vL@OGnLdr~
zd+`GM1D)!TU^W&b$7FdlyUVNdwh|mmzQO^TYP(>aX$3{e?B`c0Kfve4RR)&?SkY3W
z#A|DBhn~YL|7!T!tZ8q0SZ;l}_j<f{A?(<+hZT<<`50$$6dDftobUAzCmKNq;^fp$
zThv`$DpGPPH_C*ZcI#0mlUQbhE|i*sGb@gm_h_UtCytJ`;|mQGa?!KDDAW(@UuT}m
zD&*d7qd*3r<8?vb8yXvdTqE8UDwM{o_gSYR2<JP{U=FnH`it$Yh0c)?8sSV?^gh}I
z&bqMOaN6#B3a0V)Se2U~+>wQG^XJxEmC1JCI@qd>cek5rzz*p}!Ax}C7*^R*>i`Z@
za?RQ%qj^R!&-oC0^@kpmlkG8R@tuS7eX8dZe&*1Y(9}Nm(vuSv(sC^PA;&3l@!c!u
zo8m|>9Tx>#XX6IZA??lL`@5YkmF5X5790#4;=2v>Xx!Px`l!1mvl&dBCRY2%rLC1;
z4HkFx2V&0+t>Q_!%XZ>9G5y#bt{iDjf?S$Ow<RKDf9TqJ=6v8by>XUn6LSjI<6FH*
zKHn9p3zPe%J4<IIiwGJ>*^2-2Rk<E%MLaoFwU3r_Z(^MFHWO1c^kDO7RLRcuKz(R`
zW1Rh5yRGQpV)O@)p>NbYZNb6S8)D#cjdyu9d34D;+5pvdSh#zoBJEtC-4n@`+1`BZ
z_;TQf^{<*yUp3RKx;!?qXytG69eb0stZQxF_byUK;j?p&)|-nhR@)!;*G#)h=&Ol?
zi$b|zOWE(3;`iQf9}P5l7~Rz;uIt~!aZQ!&uwUGMWAwk?R~hxl*-Xx7(i#mi+gYf;
zj<t;%(7ZZ5%CNblX1W`yC`Smwox#Ui>sdRuv`g<iKf#0``TL8NJ6F=vt$pnR9dH?A
zIGq%6verU@7__40FM`wJn!)?Q?96ao51@OMYqI$9bon(0UbB{7d>eh`Vo+L^A!>1b
zQ#?eAjFvCx5=|}_-jsHy@>;4ql6lW;TNwdmJh?tW&OZH+WQ(pRQR{3WH}_nGr+6#(
z6HJ!+FXrlfcT=qB^8Ua~J&*5}asR{uSWneLjqEg8bvIIc(cj#l@|mgGwG|GP4_$Ka
zjMiu8;wyz&Eq|S&57!kZ(Eq3le`Yyfv$Gm1dSp$okrJJaytzC-`fc!RFDuNfw_g?>
z>AAPVyW1aV_u$U<Z+RbU8#uSBcF5^BaFDXUaP1>#6-P&Gix#G9C6{a!*FbvrZyh%M
zdv>`ItvUHB$+Mi3C0((;WFNha09Rh+?L_#dH{c0|AYI+Mes4cb957Du=aA63-|hG`
z>Y^WMuRc7!Q%7~4A+6Z`*{9CVQ_cBm^102BMftkVyQo{^;z^r$bh6?o>QdcI&@ggb
z6V`{-GdZ<Xtgs~P^R2m2SGQ^j0&3L_@ecV6*x6WYwd%cpa`BRq_yO0l#Dwv+)i7hR
zD!v9aa`yO`c#wC#<o+D_z@-%Swe#AD{^sBJrRf53y4krl$DXu2@Ykc+6}LE7JPd_F
zaqEs<*$a~+M4L|)kyIMDTz{o$f-6;XRqeq!tCmqpFEOz@ccxy~wT?sezvefkzUSHW
zU?<+@{t%5hbVH7Ef^W(h<<ivjO<}cvLuSG5fGcU7IsH=HH=L+CsgXW=Vi2BV<)k%_
zT8dhDGpnnUR6LgDytYM8OzG|j6Gyas*gnCD^FFazoOy2JHb7#bNF@R2VWc8;J%%OT
z2#Y|~`YaHs-~l*K7qeDFXrLVLUh88#ys$dr^JxFbZV`BoR_kNz`*Y8`*=_V~Cns}p
z9hgOs!h}gkj@?!!eKa*mK60=FN*!;dBRsfmEBf89H&k}Q($VEbr)LG}N)evr&FnUo
z)+N<cj<gOgMC<4HE<_vO*Vj&jB-L;=?NO7DC;IUFl_17%m()02X%<)##S2GsPY}o0
z2;ZDqHWSsqzIUoh6HKK1)X+UHx6b3;*fNmoakSK^1mS2r=}{H$|5bS!Y+u;CB<X8G
zhZ$s0hROk#{HZZJ+v_&&0HHlejTNQ6^+)R};$@cZcx&!cDT(Z6J=2p0<z$PI1K(NO
zgQ*`+T{t-S@Si9SOpG&z(Co~jsf^eVqXq0s)vn<wJ2%!RH6N;H7svxf&tqL5-T)GR
zF;U^n*P1E%iBbjZdbnYcF3`k6_u<0(R@ESP7uX<6HV}4lVj3`JusuK6h)i^X_1C@$
z<d3(Mgp4dLVb{kuz5MWjTJ6iuI73iek|itNM$?t!xHgr0QKZu<;Ro-$GnJ+*)7YJ<
zux%rT-0dd+(UH_V0VAonMkPgAa?Oc(<j6WJ(r(A|!30Hikp=grWz{h5OzXx|Pp1?$
z*U`hGL1($>Uxk@C{BjkXmJ1<Y;8Ytq8ywFVRJ>3@fp6Z?xZMdP)c}DspkmDxb_NYb
zJ%D8P0dTPGl@%V)BAl+?K`GG(HT*hR;W{kCHqILx?oj)Eh>hJnKI(RVdv}qo6S(7B
zstdHK5%)E^6js`cBJsIXPCW4h(NQ}BAb+pbM*-VW%uW^M-C+h!^gO=lX~IE0%!m7O
zV_|bj;!LtP*EK-|rgfchl<__$vCiLP)0N0uFLAQ`ig)+msUBB8dH#sdyYLlO8o|Gp
zL(=?bnC}mra#NCn^WDe~t^1_jKudWOi$o>L$=mz;`t4VLL|W@I1^2Fc_g}^@wq0E=
z47par<T%s2H=D(=7V`VjpLSah&Z|I!Hh-#iYts;zvd;N?7e<JHQgX*fk&}$1>GglQ
zpK>d1bJ!BTzuqjaAXHQYkRkKX)E{saWWY<Waz5i{^PA9OXJPs2RJYOhHkhiUq9Q`P
zUAJ^wS!Fy->|V*WT4lY;lVLhNUSnyVv&^f~ZX#(QD^(?%em18g@4Q{Q!lBTSL$531
z#9-@_t2S=1L`LjYVsq2d{)7kU^Uhd{Ro&+1CacxDXgpJ)VUI65Dc9{GkDMHo&mY5N
zvZS@IFaM5MKY}h-G`Em5rW4bb&zZ@<(b@}<QsP5LEI!Bc0Mk37ucO*NC&&^pD)77k
zO{F&*Dg^jxL%X~@Bpe6EmykN1Xw^nm-;J82#>97`jXBlmp=go>8~k(GhpXwuFE|@x
z&bl)0_kZ5npLsV2IQ6y<jEByYrj&eK3qDQnUJ;X$ul%g?WjiUE>f#-vMn;cx*{b8|
z@nUjFRKzy>a9Tc(Me`!2>aHqL2iZ`z&}m~fb;4`yoYb8nSOkWe9B98~Z%GhRCX@Np
zA&WSA{u9J*(IS3($HgjMZ}L-PV|R;W(o=ygzYGMT^swb}fz$1UrO+Qkmt&1Y-o!hD
zBF8dcIC$!_q}FuaMxaUZ$WHr$KBMPnV+F9{FSsonWS*^>EI4yJv`yl_Bnuz9Jm-9e
z?sPHFnVPZ#Y`plO;O(x;uTc1O?a~FVm%qe_e|;$-u(BQSlgi!H`aHfGv7WQ03>d*A
z1CuC|f>ufpTnM#}VwqhfM_u``yE|8-(~H2jx?7dFL#p_va4N@VIEdJJVxz-#)w$A{
z6iu+RB!Xbl4^3x|&*0o9a(`@00A;mv^-znIU)$sP3l1BJu6HNNN>#=d0MknE1)o7Y
zCZ&jd#tA|ckU2CFgvsdgL^jJrwdO0Q9aJyXnO-U<!-5v8Vfg6I`N^<;{~+86H*(Io
z@+&qyp-m6Hx!Z17AGhcyxtw?6bM@wA^nM=tkmZ*oGU5wbv$rq1LS+NM0!^D{W{IrP
zmY0(+_*yC1JfqULdOO0NTWLEm+q$}b&L8LG)(-I!(Xy;($wMW$y`wp)jCSW$o(uFB
z0J9Y@Uh`SosMB4;*CuddgpXNihL8q-93+^<%}0zo;t%oQK~O3Enn}uGDG&uFOfRV@
z>T?17Q12RI+yK`5-JSQGcs70+Pj|qw!7=P7og{1y>3zjkC;VY2J4~c30gfwsuTtMb
zw|$>Nf6NLxTc>!$;?YtlM3m^=!!?=yB$Xl-60Q-?t_Ej{CJMiHV(`5TA{dXB=;!EK
z1A`{$p~y{UhVU17W80@u%pQrjwT_K<@i`vF&DVZ8J|azN>T0J$b9HQXHtVAqY%SRb
z^G|)UMc;{#iZp)oy?yW4%e`*NirXlzW_^PyRt`ORTj92)uGWneMHIcVuyAwZ!9A38
zhfV1N`Mv>la=jgLx;I}}I3?c<3R1>K5(_riFSHV=8*50d7Lo_paMe}ogAh9(__^vV
z-eJmvg(3f@PsKqlp%XqRk@E<c(xb)rQO<R`fM3w+fk20a92baJ>rK=#)SLv_vdM~1
z9^iy`>rPux#p49mZEy8aBQwt(E;z>(pi_)SMnzMp#L;SXU7zhlQ!2@BFhXQJQ<L%N
zv)}?xXB18}Z=t42izm|l<=8g-*4h!1>|@EngtQ!J$W0{zGk0}fN#UHBmlUw#ih_d0
zs4!W|-CblC&pKO7!wN-5?+$G`(YX+gB#)h#>g*5~pEM?LX*Y}80{P}%F10=O6Se3R
zp_Ml?7X?aJ`4$0<0_MEm>~yn>s68*HYPD8=X<5I6a`p^Nr4}KU<T@2L>^U`E23yz`
z-E2Y$`5|ovFAT8z>zIRuJaoQYuk)x;GARG``5o04D*<12Rz!TfkLKn@P69D1Ur8Fj
zXlex?+^@@Hb<^8lmS;8#7pNH^5DwLoHGWRu-@G}-+O8uY0zG9A<Q!0sEyV&Nf8MBw
zCFTYv^I)Rm?qsfolFGC+_awWsv)!}cDYLlkicwOrOUsi%*ZU2mQQ__YY;k&0m|2S2
z{e8idAi}XjVq;@RSwmetbrJ^JovV@^OlvFqw3I&i;-WfBF$SDF((VB@nPT0Td&w<-
zX;<fAWBS4X-ui-awq9{_uxO@Xw4$70crb}}YAkxP|C6gP*R_%K=}^TyI}knrC;+3U
z485cD$DB7WT`$s8w@%G>G}zehr5t7Q$K%|KYP&&)@;nGvqud*L*&Nxr%~XXd086ZN
z9zbM0l-*KO7gIM~x>uR{V^ZsuPnGKq)H$4F8Mp&DY*G@%F)SAqIC)}r987?qNvY}U
z-cHnZ>vf95`A|w4Iz9YXDg}vn+FLJi|G!pymebPEGYo_5^gG6A*y=UnKAOmT3S#4h
zXRZHy%G1t+5KrYOn*_6-@IWl#2Q!h7k$lPfR^G8hujhSr$O!Qu=bCf46-E;nR^qUq
zhS+@#%rDTQ--Pdz(n`|`Blbqhd)iLehTtE!;%8$2qzLoPh2>j$MkLs|3JEm>b2NYY
z`+?vA(|L*6aSkuRO;L%FJhfZ?`?Rgx&zv{&Ad4ekJltJMlolClGQKadJW#4cLq0l{
zTtYR;G(8q;G-;S0HC|qWg-UMq!8+k?hx4rF3DN;8OTFzHlgLEA)5*^w-Xyzx(INBg
z_uI3nO~9&>H+vLKca77C?TR|y?rwf3(6xE@R|Pl|R4A8N7)5Nwxc5E<4$OImlda|R
zH+lS*L{(QJwGoxcz}|up<q>a1M=|~xLq)Vb={>~NgxMViV}DNGtX-2Ji*sDX%B=TQ
zaG2amWyAxmZH@Vz73Dy9V7xk{sl=LhJpX#?niAG{<LQM;&)Mjb%?m!k@bBH-+Mn)$
zBBYquYw86|n6_&%Ry~;={K;i*Ys+Q6=w^_z1y+ZA&I>TZ99Z~tff~;Sk#Mx$NOLd{
zVWvcRYdHR0h)%4&RfFiM*Naf{_0AXe&K8p*t@FK-lKFD_bNcQ~qTwMSQC;Xh-U$B4
z^a2El<pz5UwAI(k%+zrNnWsp}*i7<?b!M<M;$LDoL@Zy;2qdT9G7imf4=c53#xEcn
zjFs^zt<Eo@5j`(UXODKt02rBYMRD*%*VW(7+I<JA5h1cMU|5@>Xi<ujO16|J!jGPn
z(5k53gME#W1yYrQ9M&Po_B=<M^_z3+3T<^2fLlVaa5q4^%<KX&f0-8Yp(Ckh1Nogy
zA(Y`^RWC7*)Q$~o99HNn=)Dv@1uaeW!A6!aY@yl-a~=%OA8ao61eQ!9d;O8?!Z6gf
zYt{Gq__)I=x0ZPoZHZbg&}Ms8@SX@Xe9cG(dLZ83-yPfwj(*SL>&|hHHdQjDX!AzJ
zpjN1H5Qtkq&}<j{(v$FfR6jQwegsQo@S0kMV<1_itwVbvto#LCU~tH*!l<8m;HqEt
zIR9D;e0<muN{$#`PA0#)p|xpflo793_kooMjTUTvDedsJ;X5v^Rb1(76H|KLG6q(?
z)#WvR6n|tSq0CPG47HpNbsFU7wYsX$;b=4vJ-Qk*0$6Jublg)fzMBT4NiDovK)5gm
zIM^MlFSK3~umjKUEGa43x?yv7)1S-9SM&_XDdA5PRcms-+N)kDVl)R5Kr+yz%NT@0
zW$l>^{kLS93cqJkLWKPpyg~hFeqzj<Wh}U;{s&#mHkw0k%?%F64aKw?JYdhWM0jhL
z7hByo%gYE+axuQw61sBh@E^Cn6Ds;j<(n;|RylDzaEOlJ-y5e>KBlph+Ufyofbl87
za;5%>1+dI`B1~7C4QbPzIl5Sl{n&zzGr;0Zs}N|mh8tZw)Nazrzk}Sm&~10<b^@V)
zfhueQ5nBLiA`Y`DV9}MSNKvw6#(UB!nq2KY<C%lSBC<Au<C8m=%koS^SC1ztzGvh%
zeRjANIEliAo};3kV){0CG!mB)8Zmhc5HuS`v%Du^V{^1Q#h~nV+Rm%Af}y#mzDCKR
zn9$<R{JpPt_=bTDG)h;Hn5ZH{?a*QGLV_oV{i72TiM19SzAlOm-Q5!SRA~%n7%QEN
z$oQLKwpM3hfbS5ZyJj$AFuj;L6Xk<NWip{{927)Rrc1xcp%}$tJ&lk$iqSW;uUthz
zLdM$0{U-X$pF(Bxz`6uFdioPH*Bc<mY<)0M1R;!Hz23{yi9DTIAo~|1gYhp-u0#%t
zd9K{f#2v%RT3U83x(M(2xFP<1!M}en)*I+r*i)E<eiwRL${%aNK}IEKqR15AnXR>o
zI4WfopZZV9a0c1vG=nFP-k<IBVF+X1lijs78-Twr;ImL;;lc1u>0On5sr6FWRk0}z
z7qhZ9E*aST`KeZ^{f|_zL0^~2x0rR6roW}-T{yT83u{|Xq6WYgNG^nbIScJ}<rjcX
zV1$I8{!xu=ngSgYCP>cP^T<pu60yL}z1~>V*a+nfM6v@N&w+xGhokWGQ&$9g0Ey*#
z)u#r4eq}c%i<|GR7h64iQ1J*+vcq%)BNZ{!K42VC-i?p`BDk5W;`l}$iIzI0z-XB(
zU8LdPvD{5rzdtbiQRjQ?_rAA&onJE+Ch|3!pC-8G%P-Exb{fYw(i+(~@@bTcL=W2B
z<tfd~KWsbpS1JaNmn^^yHrpsocKZ6FUct3gZJjz^70ytpBqS|kX?e`t!<%BDv?vAi
zi_rkfC&)+T(BS5u49NZiZ?7-M=;4$;o}-0%o59CZA1^Um@1#WTs1JQ#AYZdFj8}8X
zIf!H}8BiS?+EQQezQ6-15=|T0SeKAWAZ9;RvZ)S$=1R^bf<P6v6?>W4Uh7?4vE^&m
zz=q>U3+VQI#>~gZXJdVRg0)I-C<#Cvul8zLbj;85aXc9o-GqwZ?M?k+H@ptHo2t%K
z{0PGctRlJ)?z>E6u>t$@BS1K*8pJMC=DN;-+ou1L%@<wS?I_)@zlW#CdxCh7<1d0d
z@b`8LKuFQwgHE0sCJrS3$9^QV1=w+$c7s=bqN0&8zCD&1_dQTnP4&w(qPL3EH6^ys
z9k>6~e9pwPEEnij-`3Xp+;<e0&j1?+A5gwXe_HRs8PAndKAxurWL7aTdN{gV&CwMC
zo0Y(BAr4RTO}dGhfD=Z$=*-Qt!6*W!iR+lD7a;inaIf}lrdk$ydl7o~5>VlsQK+w{
zZOGg2k}M!FVs=!6w`<@(8uhz5-BpSMrTleN-l<sHR=D!|@Ng~g3ie%-1$un|>=w-p
zu0Z`7haOg1*(jB4J3hu5RWbLlb((W0o6jmMFpT`fZNTV-UO=G1?{l@TMU3*Zxz3mg
zO`I0sQWzcSMyjv3fwMprp7dSt)%U>m8p@HUM6Kc*C7|1Y+;v}pTAol=<yPzmY5eZN
zAU9dW|J#6=|1ojq-EVjhem))?$ZZ1kt@`5={VU`K+w#RJu;d5B&g3G6`3UTGCoO(O
ze0mCx{P*LzAWC^4&wwsp_ag;`^ID`Fz#ARO6v4c%NJ;seE4@Ei+CDdzC@=6YbQoVR
z<tK+9RH#4huaN;4QFj7FItsX+E#j*K&oH!&Si(z~dcQwYU2NF1J5>&>Q1O_VtGB}~
zYG*N3?KL`nqUmC0NOlw^HGVlZ2W4M~AaTjRBH>4U6l`(J(mUg90mAN;-p+Sd8$8~~
zxr`6+yaz-KP%NJN5+Js$Q0wKO``8x7{gP0H%}13B|C4968n>tyl8}%v|3J|6d5On%
zy4>kM#C?Ceg860A*+TGgtRjXu*T8Z>oh$xT<gT$YfJ3SHNsNdZ{MQL)8Oo@^YA)>v
zZSQNZC{jdZ|Gx+*9BD4?twkH82hb3_y}eK|M###@v=+8|(hfVVU{~Hk5qi+#APXm>
zE&CtV3)?wqA>ULLMav*g>ktF3S;KN4PjC2Z->a@n#cBZQ|8NYaF`7{i2S@o6_zciy
z2+4F+`|DCnebTsjepC8^9dkeljTAcE3dzy&pXm5_`GW{14@vCfnhq1*>BRn&Xg`9Q
ztD#xMVA&hs5Kk}dsXzYRmsj>wy>*%}me-LllMz+or(z?UV%KX&{~C%wYqiQLJBrv!
z^K1><ovJ?@^on%=Jc{{6ARQwcoj7F@+hm|vMDGY~-h;{V#x^WU_2?AAFr5!wzxW{-
zMY0i~+~92S7v;9MSB7u}As6M|{%@R#!MHsSG1Gq%O`cCwvsE9;#IIk!+h+nie}=s4
zT`;?ypx+pFnpn9e&SUFSI-Tm^<P&i??>jetk>VcwT+1i%o#G`H3V&nZrI%h6Q`Z9_
zlbI$gtPorwMa2kb?9<I{Z{zVmxN*4gui=f16Q$SpY;Li}qf^?%B-Aw#k0g7lunz4*
z^SjDws*)~KEcfY${oO&sG45ybct^LWVh8FU-~@z3byyi=8nZv~A%;bOM<rQh)wJ}3
z|Ii^a&%p#B*vE?sMcN(8Hpl&SfxP&Ffm|}S(kSzq0-uW|OBUYz2}6SNZG@xC(5ZZH
zrP6<X%;m}ek(634v{CmJ+1;OE&!`SJ$}TnElS0iP2?op4wf}}A(!Sw$^?^T6+A9t$
zAfF!fse;1{&L@*;7NOv~(a%&7@<7GhF+;E5f>`1LR(8oxYl=Z3X5&n}mp;pM`oEjx
zhOxgT>qhVzzL{~n{v&`fk>;5+eZMsSYja>E*IP9k(0!30l}M<T$fLEEJ9~hHWMqZq
z%kr=|;|qKymF?aQ7^FGn%M9x>4hr*a<LOk6>QUnTFf#HwGnFSl25&@e%%&h(Ma#CX
z=q<f2g>RT)!8AO^W8ZO$8U#kSj}HRu0?=^)@N~s`Wep7+*Jj14jX%96(@J7BM*Iow
zK6pA~ko~56nD^ewF~94!Xvi)?d|N*C!CLq7h!{t=K_9pOI7psxG`Ww&+c%mbmebVV
zB1h@+*ha&<tWe{9*oACA0VdyH)HEC&@zIJ<M=wTQ%xB^%bsWpByHTcpvLfB0ihi$d
zA@{I_dpu4@=|Wj3J&I5J3nV0^5_LEOmPiVoys@%N!qT7jhiuyaiNsi)z*ltA6v5Jy
zvmi*EiZgMWSa<wlK`jRdv~tFZQ9|SFeai3owCFuhRBG}dB~_vTm;q2#ZszP$<j0OR
zT<|}Yo%$co<^L~S&_iB=Fm!jiGQXmN0SFfWVhX6Js6(6=34$MhyzzK?y`b`P`ad&?
zz6Oxi3XsJ%fU_Lz?cZQvShC<o3RhaJbO8|syX`UGyPG8+0>!F#f#1m}mw$GAH64Fd
zD@_J9@8lw+GEl_M6ir?8^^Br|R+wm(hKN1B*c37S9^zq!qwAX+v*`+7E-;`KrRumv
z9Ond>t|P!PN@lTGo^N!*pyW&csnoccE||OB`aSa|sz0Xk16g#5pp+C4?qo4@DT6?^
zwyFx%P9-CxdH!5GP~Y9j4G^f(2XO&-WkA#lNVt$lWaBHy3hgYAui+z1DmOKV`AbIb
z@qB$tl-g(4k^rig-FkBv$E*SE^=nJOK9-cw7_CqAtjJO;CsG8+*E@$znuq?j3?EG<
z84l8FHd%6`HZbpGI~ITChcX_I{ibs<3gEuO#$c20AU?hv-&t{NuC#B^&|RAvASaAW
z^~c0<XHYrz9zSZ_Xd*7CV*4-V$<;izTo{{x$EUBNt))c0FlsD@ILTDVT|@d(q;0jw
z{%E!{@=N1>=15_HZ;(*byP|s32MZP;{qlEH4kH-FsD~?_P(=4ptJE<7Mt*E;%-#Ko
z$c8qW4gXl#c((#kG<EXU5HrfyZ^+ibPCBt7l?WwkoldV4J3Vr=uu;YWRa~k5ze2g_
z@dj5cRt*G($dEB9@-r+fdJVd@z6TEZeXuy9Yum8Mo5=o^A|hWVr78bJq|9oh;jM*b
zd&IBue7ylh4B{1dcqgOR6U9FxatQj<IO@R@0Xm`IM{~wSWO+$N$f#$T${8XV45!i<
zX%WGTg4|Ko8)d;&8H&zl0EGVGU<fA32O)X20n}vJN%H-wISasgLMns@IP9`u=M%&@
zE7-c{&G@#tAG7`7axGUy7W>KWwnHBT@&=p0WV%T|_JTcLHjw#^bo<u^xqc;r*jIN7
z<|W+JB*3ct{dzCNQsGCdCM#uc5N4^io({#4k|tNE43%^&23|TMfQ&N8(J=WBb6G7P
zf&2D><Ha-@#sgy-iYGA0gELy~m9!WaaA7yQ!!T(Sx%vFzKY(Ipll{`ZvK^$4O*xci
zoH_tKpsE-yAP9iiS{p#fqlgzO6#N<Wld!E(hh6SKR7QrN^TE_{#j_Hcy%&+mfaC#)
zE@Ai^BvGMQ%2On?@(iF>P43NZJFT{A<X1vTUml*u+GB=T2!qSdi}sylncvHO7be3#
zM~}pj*O65p<rFibgtU2;E47PQtV@)1#^sfq#umTPX5VER*e|QovNjn{w2d!xB@F2J
z!a94JAD>o2NeW)QQV}*|)*Oh>sYn$KgcYXTV_Doo`<N-!4hJF6TemmIl?EpozSWd5
zZ~Ay?6bg&5C{MJ*J;J*1hrFBqi3NN`FJY#<5YEKv6&_JHYyM0dN+Ock)v(*0UnN*5
ztO8qC#aQ6xSSB`O^YR{(r}MusC$@g$uVV6M$3jG_oNq;LZ@P{lfz)5MQNJs{cyL;o
ze)e%q-4YIEi2f`E@G<dd)IpR_9(3luriO5B&Qu?0ZD?9J;4&4ic@L_X+s>Db$3Lxh
zd8JvU_$!T1<28{?-dC~ajeJQQ@GMlRh4zguPlvYE>=9utz?o~=c;?3#YC+5U33tov
zXW7gB4V|OTui`}u8LXonj78NG+5rA*tDQK1?R#dGAx0CEUsP<nr#H&z8zG3c;j+pC
z1UcM5VR_hqz*Ag_g1g>osw^gF^{@MH5kDU1)uc3_S4#ns0YH5ssSKHnynM`-rGDQF
zo^`6fwD8oL=f_B85+~h5%*|~22RD&<GUbT_r*MhUy?n6QgVvpVevZAMeO;6s>?U@(
z-1>FxXoU{E=phnK9=*sPof0sQn`kKS&yR7kwd#9vF2rbT0qitL_G7GsG5#tKWk-KA
zjZlu9Mb6m-?yR-|mY#uAwbx3%Q8M=s28fHlYGRqTnvR5mBFfUCgV_B_*JFQB56nVt
zY4>@VeGfst1=OPQ#<u~H6?uAQZtZn<bJ@1*v+gxT`tTAj4S!6ZJi9@BW?(wS)H4o2
zQEgx-D7zL$FNxu^2ZOsh`c6>al>KZmD{+HuzWy4awBF37xjBp`CHuh~fQvzhOZdE(
z$X3Dx0+foeu~co=81O2c_m*2f=$@tV`7?=hqG`O`hhwT{sA93!t@-wVBD3Di_fMPB
zKmu4~e^Syp#QqCgD;O|#c6N4bp0X}tcxo=UN8KBPiS<?+s4llF!Q6;mUm>du!m-j>
zkIuwGNitNXmoCGG>I-r7uQA+Ed3mB@Lk8?NUAa5d($kr%ljU0`lXxYYIjcF5{8`bW
zZ^}jn!<x$fb-h#pL|}%e8CUTaf!`V6z|Yp%^a0e$*47_=YfUGE>{*gPENCG{G%Gn-
zO<w+;0f})_j}J9rVC&nfOK9ygY&jQ06iClGWgKR&pL`Qb+i<1q>EK5!YHQs}@v?r3
z!WT@ylKbI^6Xzjosp2ONoT+sXu(m8(f*2>Mbu4FEef2~k=j8EsM+B0-2fjXk2Wnw@
z5AxXi`Y#U8C-z6VNuUO$^#29_<o^zT_5UlE>_3|fZ%_fGEXFgNK@jHZY>XE0eX$>Z
zVZ}85=ZgS;eg%+FL-a~(XqYXbfam%9RRAt4WM(G*@gz{i2NdL%hv+uolu@bFtsWe3
z8&A>zXgM|-c6KGe?VE3`cfG#@B-;)qONst*^01~OBO}pv_JEH7)q>;IUZC78OF~LY
z3Me1k*w_#t(9_WYvOS6cuB=(pm9C5bHzBRG<qSj0_Y|lSi+jwIGXg!t62t8%G)pys
z0q>~8@B*TKwvk+&yr^)1BKbMhA_7$glS%mwi1{z!_JF@DY*A`;E@o@3Vq;?gIxKyr
zny{v}<L=hh6~IXYz~oneB4)82Em^H-(OQjfC*gZFa^Lv|9kskLhL@4RDqO-YBd_1s
zEwoy`Ll4bHvPe`iWBgB5j=mBQ4YB_E^{cviN_~BO?F)TCRBK9aOZ#-eF}maRGjH#!
zciT;5twG}>2H!KelcQ7_g$)!f^LWKQ!S7q|B5gEAKj%VNh6Q?xm`biA$XH!|VID;q
z=w)K3+6kt-R3jH-&;OPyV?cXEaou1!p@{QMNY!Kqzi7nCJf-=kNCcK1v7%%Ow~9M|
zQXGYrFAP}((6Y<wy#jl5DqnwGD&Q^BJ?a3bzUPvtNcpqIJS(evQZTw@I^VFhvLbb_
zZT-aSYbtcdcYIZk2<nPMI%>&csE8R95N(u)qHXar0>l5MZce{wZWKueuPY8#VwN;H
zM3WFIkYu8+P-_@SQFn;9)67^PN$KnF8x29oo4t&Q*-Y1ai_PP}N=2n=Xdi-INpxM{
zZq712Ta(kn!n)n_*nKE{#@{Z^&MIFQ$Hyz3{Q!L8dZ!Djz<Ol<wI=}O8w^MW0O9$c
zyo4u6qhw(#nwAEfGQ?uxuO(|@Bv!PY-9_I4iYDss10%2&Onrl*uf0n1QO1x5Lq1+*
z?0+J~+Mm<$RgGf}oKTC@V=fL3{nex1-0H54)lIz{npU8Q-Dm}~XeYwxW~U&mFjO+4
zP$mkVD!Z~Ta}G+b{zwJvF8V5bf3EcL10nz}&5po8TM|T*lgjuuDr_y^VNV;KBTa@8
z{m%*`vxE&aS|Ac&qYm(S^L`9*-R!>PzAZ5v&kG3&dC%ib6DvA;2#hpG%q*E+t4zbR
zu)fN)5Cb$114kJ$e`!UBuVdHRE6;>8<BGo-u^PUO?%u%C(?oK)H6SAv7Q&Ny%>!CT
zyrO8Q!SLzU$=#U&MVTM=e4~w)VWk!8cv&T?;1Y<-j8868H0JHsaAnb3mPQzrQ1cw#
zFdW#U&<OoXgq#r@J#dWlCNXfnlrXjv(*Xf~v?lP`<I;0jQy$OF>2&kU{lL(WowaoV
z_GGq1@&jg=R3eGPb~h$J-)Ja_(_pXKQ1gUk*_<a=*1@*>`dzHDn0|n^r1OK`Wu9t*
zOeTb`KsG&7VeC*k{k^g6oYd>uh?1Y3^0+?)De_iSRWS0eu`3M=qXtr6dU`*jV0DVh
zT)*<=Qxqy&HO^Di>2LPd=DIA*oVU#7B@_w@_9fFi3Ov(#>@4~(3YrjNvc&O&qZ1O8
zjaUH2<54Fjz{VFErFMynh#1QhiO&0O4!Z=WdR!e}vb392DTh{n3y&uW#W6jW(dpP@
zk0FB&{~#n3iRuZgp2eRn(}aDA%^LhPV9FqpPxW01EM+>tn3dUEV><7h(vR+6dtAZ5
z+O5=)Z4g5&A})2j1+e24G6!~uh<Q0!7>qNRle2W)<NuUaDF%3-KEZqa`ZXRNWu$PY
zrbQz9@N0ct-E}}N*%t_8EUH@=o*q4mWf5gy;ZVlMss!^f(9RCvyrvx=HnCc3(eeJ_
zd~leXn&$J=Nc2;&)zuSMT5d{H7^1?Zdo{e$DSGqmw$bWO9@1Dgf8Eh%{lQX}0kLvK
zuTQoR8~M7}sO50qQTz;G82G|6j|Tp#{N!=04{KJClamuo%#>;gfWdbeLg5^ooJN6Z
zBX)oQF|hjuOs^yc&mxtJbS*q@x1pp)(!z{Ohel^qGSCRI&KmxvxBgi;QW?a!KSF{}
zXO{n4fcB5WLGz%;eBna?uCd+<Yi@RJ2E#ZwH~`eE4jon@Otr?mb!O&<+Vx5V*nk1*
zc^?$2)yp4jzp>QQrzJv;j@Ljq`3>T8vF6iH9<8qsy@>b&Qs81h74{D?5~c^qo))GD
zw}z~VA7GpVD#gaoA{F4@Om%gg9OYvNaU)HUgq!sAR#m+GQ@97Be1}-|_@DoCN$-DW
z$UU#Y2=bY^-{#4on`FNZ(A_3Fi|{n)XHM8BEv7D`5PshSxgQ=-u0Ao{`RnrzZ*ygB
zc45kWEgNm<qYv&jX7$4QpEB#mQAeUn-h%D&98Mp0DD)VqMlXk}d2#{!8t*1S_xqYL
zi}Qky4JdhmoS(J7+OoOcQ>9l`ZM3joiXJUDOFb$xOEEJ0Y5b34=9c{nP$3p;=B&5g
z?5QgM0Q+uD$3~mzHTdT;pd>Q#Cp3kyFnEK*fX6F?#5(<^3pmSvFe5YD^FMy(mZixD
zsyh6oN3JK0sjDVAUr76NsuHLN#a-dqOLU)Qw^P8YLrh>VqlnKWF_AR2HT|?y>sV`(
z(*)T8I08>J^e}RR6_aA~cV=e_jbP!Amj5&P@MgW0O&$_AA6_q|Q%M6Aks1zA0c^0f
zYgdd5GuF5*#BRS#pKxK=z|uWWHA%i*@S2Hy`n;X{a%LCptE@}8wY~O{-5|_vpe{VK
z<E&HWK5_Hx@AsI=GZ*vOerWMg{kzcABolHjyG8VNZGwSay`#Iw27N{v-vkvjC)%7j
z`tmHm5eB^{rc1aw?@&a(D3!`au>*(D8L(D+FkPHh-`9Wk7QY@^K(Lk5+rPQpnWTPc
ze{pm3*N-WMZFzIabu&z1cI%a$W2%JO<1i>a9^hX*9FsX+a&F_qj!wZqTH(cxD7N3$
z7_{#IYh&AEU-gsr89vKa@zBj*`aO6I8pl@)Tr#U~=7`);*L5AFTWdRzD;H~Bxzr99
zTzW}QNH|x<k3tQABIRZayWW&$)c1Pg_qKdco5he3qFWC8@vLtf#P{~=s}96ci_E&$
zC#qeNc2=X}0Aj^<O|^R-JcM#_zOxaKpYizK6{`Tv2$k5pjEInYp?d0`0~!?sc!cM^
zH5o^2T=YkcdU;86_4(hnV}j;bWmWu?V=RuRIa@<E;2rb`w3Jz*V`Ns>y7M_hs{})j
zy1fEilZhIVk~r3Si<|uBxK|hMUFb_Jg*$zRs&&q6ZODGHTd9U+sXL$d4i82*xtc8<
z;fS`<54|wG$GExzcc&6KSLpMS{@Gullv{C4jcz>{l#D`qNuZ{~-)48;*F<l(?mt&p
zuUB>2c0WNqtH%1WZ|`dA9z36}$X9uZO9@$L4ZNKBn>ov?{M)p0Z?8zE3i6urMp1g>
zxl5?Uvf$2&-#@Vc2wwBXc2I7?7c=nr!50;Ux*eapoB8`hcFSeHW;w5{xgFXgv-{ZP
zE<(F7?yI4V4Jz%oC@8B}0r%0--Bw_H+^>F+iMzA>f)j^MA~wc`XQ+=q_dpR)^Ex%|
zdaZo_i&QmHglS*sT7|Z(KHuiWWN%@%gc-u<lh~r$ZA`L-#*+J!mn&v9fzAiTj8tVs
zdKg41tzK3NcF)^=>TN&t2Mr;gZhZ_*Xpp^CPLwk|K?ppjwLR<KJ(@iM*As{J`PFy4
zabtIoRh^$rHB#d`sdfT1UV}`zi0r+vHkMJ9DJgm)6Ua&MD%t*dsfy{;Kd2fb<x)24
z|6(8M*=gBYZ|Q+-8DLkCf!J$;@qr{qHq*^UCt}k*pJwd~@KK`#$wY(W)GkG2g_l8h
z(bi8c+a>qOydN8{i4mJOo&}2!Xv@GnU;FoJqV2VR?)$)q*k@g{e@%T4+eGS}8+6})
z0=}3pnv3<Dc~l+&Dc0~KEV`f6GiRT)lQeLZbT<ZgdOq>){<x8~Wvr0TQoh#iqF_o5
zzU<{CNQyjJS7ou{J7BQh-t~Q=Wg%~O0~w*5p_fqph$}5%43H441!jspmYAd7#7;2_
zZEPURsF@`CPkbWoraPz$x;<<zzKWsxakt0uXJPZ%A36z|{lehv7y~G_F^jw$(G!2#
zB^JA^WkV`oHxo@i`s|lsv%%P?P-4}|LjB+yhk)39K1+IfOO$r@x?0D>n04K)Uk)`b
zI2(g{JI~TdQIQL-w}`5pdT;KdZRyI@Jx_?BB0I!RL_`kZ{I#EgobjXEPo1qQj0CLU
zVtRLbwo>ZTdYZm(jwnT+FSzLW`Jz9LL^q70qeOMqQ)J)EzqJd>QUXS5tw?wFVTBn(
ztPMNi?J^R0KCb7z8EK=WCz~s~L}~@x-&qruV8IexxEsc%QCA-L+A22lW~3+9b6??Q
z?k&`lpjJaHNmrDTY3~?v&fyPz#BB%ej>GNtA<pFQu7`5douK6ew_jWnX*QGVn^bF7
zjoLQ3oO|dKSFHX_TovXIv5Re7i><7ziC5gr0+4S8wZs`ZWL!rJSIK1j#)@<@-(pn8
zQhnmB1Vq3PIh7a}zTCB1#~Pa!YEZR3tgdti7yKLe?e-v*QX7|Da{X#J2&l|8(&Kwx
z)3DqG<l0uitob3wrS_((Q40qB7U%X|v5y1kbG`;2h-y^ET6+d<X9P>gzjOHo2LesK
z6}I&r)8i=>*s{+S<B8*vRInkf^ogMr@_5Oymm~Cl`r35ed6a}>wzTWsL}PuNB@(qk
zR``hT7KJtcpYd=gtpG)02rLsUf4tr>wt^(wqs0a3H}=CXo^S3DOh0oD`~4%ebQptl
z>A&H6SAmkXe}937HXbE`ooN*_7^H~(FK4Zn&D68evX@NHEFpf^_uAZu0y}Q$#el;e
zqe7oyjh{zX-3}jb3Nm?m{Kr%IKT~@7cMi%kZyBj-K>KxYFzC)`>GVH!V1C~lXg`{p
z!M+Y%YzOvUpfwvF9nIr2aj3{DKM^x(&iI1O0fdeoj?Yr1MNdSrGg|5YygY`tJNs~^
z@YtEsWKstCC>j=gnzYF(tg=Z;8M;T$2)Uqb3iyfMotXZ7%1n=)9DqZ7fU99Rxb4-#
zTqO<|#2<PVc#dvc;w&3TXnMAb5{BL0u(3PMA||?Ok-tI7p0{|&q8RrBwqBsfHIS@!
zKw*61zvdu7p~^+dD=&d8E3~3XXP>$fNd9LGF=ZXW$!81tO((6sdc#l>zAt>6%85vK
zV$wV~VI9?JfuvSxQp#Q3^;zdOXrQ;v&UP>E!#adCf1^;IV6EDq=q2=)VjUwtESqFk
zz8TzUSZXg5Gxb-2q#myTzi%TC?COjP<MCxEW&*PqBw=NvFDaH~jSp?0!G*IvOJ#UR
zXeHM#f)^JXjf}}#vS~rk6$m=Yi8*7x60iMwUs5}|9L}5^nJ4z&b6<HK%{#N%NB#UV
z`qqUIB$TejKPHM3apR!B4gXsvM`8IemcHHj8#cTfMt-fU?cj8B>qF#O{|B}cnN{)M
zH+4<^pCiFEmKW;>;m7t(L@ssm7fM1l%YNOihg0q$zj|^d1$7LQCIfk}`H4h=qF;w5
z_mqJCZAyTp=R6l7zQ&6N*we=66ikVRC%2zO2z723OAgglyRP{}nj#JV0(}<Apf{W#
zNJvLwF7$eMDHV!=g`gc_GjgO11Xo#3oYkGeI_E>z=<@6)TGdtc0lJD>3vyi@bNMVi
z<>X&ajNj^P50101{Sb-frnu)ajlv$)9|tr7zg!*<weecN)={($AhX}9%Iw1Wir^nj
zG26gXw&!t}d+ceS$)dT=FlxxFVI}+A|JE7V#VF8PN+kM&-bca?!qd#>Aj$yQ{6^P%
zE(bz=<g9$HQu&AZAmy#0pLof;!Ssa$y0ZMG*ZM!e8+I>PiFjSu70N+TpLY+a84@K*
z?KOGes{Huzs~v1ANUX1BUp0A^bI=6}4+5G!s#T&TCVLD&D8#;JyiE$6*4!o($(J_p
zuYeE+sudp7{dY~2DB!(N00|}%6tKAA@sY@7gn6K^rZ5^B19c>C4{O;3oJM7akh=%Z
zub)J!3jBN<{iXaF7n&8u*i?Gt@ov<GEGd#+Q9ON&*%F0~M0)6cJU6vr@&{u$$??C+
z{v##PuuJLRBp?Dc<`9M*ouRXWH@{Pc6w?7`k7THQ^!?sNztRx$ZX1P+a*g@SNcVW@
z3)3eg-lz2ry=5%>{W5)|zBn_q^zrQ*r4`$Rlp+)umX<J*f!w=%A$V+uGri-AO$L)g
zh)G{yqpkrRlYjsr=;`OalZq!a4+Bx(3)|&Ig~!gO@6+mo=_-b(_OWPI`^H1tlHp&s
z`7-30270|7?2a$wHYqU-r3|hEBb<g5{)PxkNujhWd@T(QF#=;$O?4WMm(`eskGHXE
z;?Gcim}NKYUe`b9T)O*8=&t~qN9DWJGa~g>@cv05m&3@V%%owl8Lpi9UBr|3F(Gko
z7{BJBTLN#J_+cZK-J0Ndu-W<KcpO-tT*;n+WrUO>N;HJp+BX0#Q#&zAzo5{Z7ee!8
z6j!b0UoN{;9<?HooF~sHqBihKogHdYx5@t{(?G!dA=7{nS?`9A_b*IJC!3C-pM^6R
z&zcyS?dQv;s7+}LSRTYmUcOcT{TOZ&1waZxtXFv16v_ddLb`zg_xp_h%s3p_i{=Le
z`xuQw<@*IThD=7z+?Q30o;(?j<1C!0q!oDP7PV-Y)V9s@nH`va3ss~}pUjb2@NwOx
zb&Iw$DO>#$Z=%#UyUIY>KYKR!m|Y5Lk<tUqC^a=H3S<%M&paIGXY*D)QCv@kwHgjE
zeJ$uTLq8uLa`H7Wr5Di<0-FWDGBY#L9zMg-;sc`fzmJr&hj9JxBObt^J^sb?Z_Un*
zBY-+{lhvDVa9F=~#%HtEFMJOMgX5V@fQy4bCTL_Wk6%|u{{~oG{gv&4%{aqmy}^X{
z51%tV{qxrTcQn*gQ-HWZXmT>aLn}*YA0h-*IfDzojlKTN|FJ&XuwSLw{hPR>?6U8`
z_1(JKg^)p?$#wPgfGWg)K6}uk)9;+d2_@a^Eq-`?DY=Uu;6W)iS~TxgUue?B{+@|!
z9MiIa-)ndk$TjQMEeCLVKtyD#Im2N%uQ)Lg&#-w|c#E8@h&<xdEaSQbh*pn2y`I{C
zzes<01f+-jrstTz6^X*<Ac!?Px;WI^+5~5&Z$8_nQUN@-3Y&+90~%x_)5W!?BFNE_
z|BJo14r=pj+eM+YrGk`V#oJP#NTEfGLtEU6rUWZ4L5e$p8byP<v_NnO?$YA!5FCmJ
zmq4(D^YDA$cjh~1??2AWK6~cunQzT7!w|Bb^(?#Zb=}vx?g((ZF|aHP-g5(gzb^kC
zJi%v9806ul&o_PCPH`&GGFzg53DoKR8bt-)bBLX-RhcF;H-6$99NrIft>QIz@5aaI
zf8CJ)U~a3ed=Vekj*Ebu?d^QYm!6kozy8GyjF$q8lRxp);rMM`)haGF%Ppu7@c;iB
z6TFXauXFzGj$Sn`6f-E+0i#VAFZE@og=Gl%^~Uvg{qO!WJw9?)fcramKv(SDHP5<#
zl2(9U07I+y`Ff!7e(RKc*tVbhnwol6kv3DA9MNt9ba)9%%}rWc>g)F?AsgojxUQN2
zZ}P@}a4)=nPuJ<!^(Stay<`R@xk|(Y9bncgjQ`zluGIUF)|j~&#xv<)*KZ-k_5tX#
zp^jHO+q3oVc@ir&X*cGifW`6{P~*7n&i^56p#Qn`;V5ip0m@Mxas7FP&2`l(GO=Y&
z+vQ^sQ{KD+l^unt@^Z@h$;D5L!a2-mE|fq;UhZd+U~g?g6=Mr8MMW>a(QS)SZsO|-
zfc^Vtp0%c6(M<Z$WXUA>6M@BxBq8IL78%poDOjQwvt*<F$@bLVUXM+1-*ko2wQF!q
zC9=9b9Ro;I&nVxts3%H3z+GtGNMVYHUbh-72xKYr&u%|VeEGybQ+2xHK+CU@>_e=l
z?Q#Z<X`tA}c6n=uYGU)rr|{CDM5xWqB@N%2gR<xQ6D{~2nBTM~6oUa71f)Q1R=3%|
zD=;>4f@1wVb}rdX18Iue7{$$TJ=h=t!HkIT>@EIKMnSKo?btv*Z5Wfb)og~0H>0W^
zvMnj4m1)qh;)RUTkISyk@5B<e=l6ckveHnCUM#mJp0Qs@roHm&Du3HC-~nBJHCph|
z?H`db;y_^U8LFsgGe@IKpJs?P+DD(=(NCyxI@wZkPak++_VrDZPFie*``Kk>j#b9$
z{j;9X(5y+*SZZ9plL=}1Kv&NX@sxwU2<U&X04*B)qfye%Y%_CfgVWih``YlrRP5Se
zqk=9+aZXN-s9d7c$8k{yi67xfm!^Bos&eTAPYnkp_gb~PHAuLiP(2gl#>@@*B3@1w
zW@ct3Yj8+n&>$7EGJQ>`yJ9jX3%j*8Xhg}$#+4Ck*|uwF<3)Krs!903sZ@%5H2-x|
z^g4{}q4{>Uor3H4+Lktz0ur-Qu^b01%fZ;+*3O4&e&Tb1ERtn$7OGWBQW0!L-r3J+
zA-|F?V_a$-vs1FTYM*pdtvxf(z1xd9!!z!O00H(l#Gq&Qz^8M6TfK9!3q|y;Inq9R
z>~C*ObeUp0IPOBnf|*Di0Kx(i<{c-_^Uz6Ku`)YN9cEu&8>A!xJNMX{*2U*~^VL*h
zzS0ueQ@Xo-F4QfRD8mZqn;%S;YFd)mB|Od$^|OI$NEp|{d|j;n+1k{vNy14n->r1H
zTi0IDMj!5y(OS!$HArUZxN!D~L_NzPbDCJevmAX;ythKrdeThiEh1<-5#j#?KVwe!
zFvbPm5zjIx-!pPAooPAB>DiH1woPHZPF##Cq*Ow>@`#5xEOTK&q;49oxIQOBCMKVr
zC2T}rb7?Gh41E5>?neRy0}~+b<rmE#!19S6FniXfsc0nM{`8qO^pIDl%=$3>b>GqN
z-NH*Q`1hK}yMQT`ivDNQrW%kgUkg(N(|Uj0*&R+Bg@lgeIukW-XR7F548+)J6KJ3D
zKeSm@Ec(7B%q3NWks=|kBNt8#N(B4;E>Q=P#>5oH6t+CMM7z*DNo)PQS@>h*v*R|d
zHHX(}h2w?#s%3ZO_mDE;$=y~~iDsc?myvu>;NIcg{bQm#wBj~e{!gqX_%_vbRP?Wa
z`QN!JkrLf+IUI%1$sDK6xTYXUk+)v&kNsa%3Vt7@tv{H;g~^!-C}r|5S~Df4Y%QTs
zD9)v!l}^gxo62Ll3cAARt8x0lC;S#9M`qoc8fIs@?80Av+}M;)N$L|nl7l5T`d}hQ
z6BS!1y-4Ve8*-;<t@2Jf_a^%2C?Ahmu(UHyR`{IM441pph|J_$YB7jfw70>go&hcK
zXS)X&XaBVpHyQz`pKVWmmK_9kQ(LV;Um~7L<g7K$7VB}Rx>z_>Jn-xg)@G5WxRk}I
zYsh!w>p+V?o_m?ls+NXoT+$C&VrQtCtae9aqk_#-`byj7vK~5%Bhqzx;THu>76@ZL
z9g<|@1d;X04op0g{8ZJ>ehIPW#)^g9cx8YEYucp03NU(j9wz_z4-&SRS0NU+N-A_q
zb5_T{9}>vk`t;*+Y(B7=vanmS@?bf(KHNM>q~Gbpb3Tv?7ELl*xIweR%s*=*`b_Fw
znJR;-`okwL2$5td0vt(Y!n@i+gpfl`RXFIDgZ4QtHiW9kXCLxLAM>Qu=k%-9{n-4c
zN12RyTF7ep7skU^nXpQZFqUNW>&p0R|7hs-b;?|RwyKNCZ{;QnvoY%8$E5}xeaTG8
zO&r$aF+${Ww`x8CX|YC2Y51qgzK6YXrCHq;?TdF7QOJIlW~vMlb(WECx@?p)1A|41
z`L4>W2C~eTv$Xe$HB?C!EmEhUr!H~lf33KQ$8t1PbIe#&=;>B66onfwKW0Di9lUgB
z6zZLQzRN7GH(pN9o$TRtPa%rSZH7bVJYqPybF5hb=DkxR5HENj9d8V@7mxT_b#|zs
z#*my^CEVB9UFSH!77+w-bF3-?S7XqTJ!C2VC?=j{ffebFWkRAOa~2kB8T_{#2sgKr
zth=W_^c6ZiCSq?+ac9OCMslt@C<>QZpOGbLiFb0P<jhvF=Q&keB$z`E<9QZRAJ&U9
zPt@E?f2Bm#pS+<&Z8VrGr=z*x^kZ*DCR%fTA=&X<N+)<$+-iC9To6^tV^9RY73%ur
zpJoD*#f71GlUe^(8eGg9$vt#-TCr)N_N)^XQt0f=zwG0xO=>6e^ct^}QZZJgD&j;|
zHhIbFR?@escE@rVkN@bj9a)~xf>`6J{QWQfG{cRTliYws#7q8m9fL|9x(m1j*X4f$
zBy;_k>+)Z3PW->+y97w%;f1=eR3F;sDY>3+5+o{re;dzO9Ikvrhf}-jo`Pk-?_iLc
zd(L82+RV2-sh{Jcl$PdZTko3Y#V*f)XI4-EuE_hmXM7gRO`PybLOwAzoSol$>Xa6}
zqG#*!D^Cn23v2ySU!<+}kY1HL#hu3(ib8QBNTFP{^&IR;Wy%XrCztkk(p}N~`@2hL
zWe@}Jxh`ZIl@Z_*`*#34slVc7z-TkQmB-KMc0XKmZ<@nE@W!_{W{_-6%d4~p3+=~K
zIcbsLfjBYgzT&qy?9_wuOuDnA$rYu0z{2rx1JVxT<CiF~xc7RbzP`z*?zq00IQFK=
z$p2tOCH1NG)xfB`!MWR>nI*kJl<%j(UoI9r4)%X|F2b|QMGANr7p{71(LOJdJGZ7w
zH*FiV4lKcaJdT}F<;8R6uI_)`OT5ig>P)(8qXYef$(&`QK!2$3icBGsviS!~f=~31
z&x|nXaVyp9wXadmP)X1I_|pY$P7aZ~`l*x0g-W0pU)B?3x+>0%mHCP!nr(A>c%V<}
zNKYdv-VrCi9aIwo!6eX|k3?p+zcB(WbHV1MRg5=lmBR{hvF)Q5FujxWN0xaH2#F{}
z9vPlVYWjtRh$h9vx>t)gL#RnKbCiL*2afQN$x3nq<skme<c()V1&-bux#?9*JjL|p
zlgwuaT}&|Zd2WurI5Q4<ujAd_k02y3lkZi5N~XE6o6~k%Re=w4Ph#2VtH1&3{R<%3
zTK_gK6JaKksyAZB1mi5^rnPQ)avm9x4=^wc7`FQw8UTF%*xnzW&N&(~F`UT*Gw`-u
zkJ5xSvAPx)5BQo<j2%aPb`4e<(_y+12LuzXcCOdP7!0-1qK@;#VJ>?@GWS-})OyD6
z*G-Soj=4_7p89%+>zjK>F8_(a);YEcHFqgT#~NOEuIJ3C8CrS}ZM4_;IStnN<|!KV
z--=&jm~AjV3epQVB#=9QZFbe*tn|5I;@Nj?{l<q^M?p#?yYmK0(1q%q5aI>;hMs-2
zqxt;nt2xYFq+&m!K+DezDdf#f;eL2{{Be!p!cT21or8~{-!4e;aJg#Gon^KH<Dv7;
z@5*{GEsN9hmU-OnV>rkX>$52DM_|ZgFdvkfz9*8{zwa^8YZ&?97`2vAsFBS)*tBAk
zl-2bTm3oPm<aOrOkD#^GvNVX8f0oL?G_k#NtMRK3xACW2fUeOgQFfyFgkL*E+1X@p
zeFiGf(DhwtX>j?1l!fADUC_;NB4>nWDq<y5Z^VU(bSjqo)vE(u@#tU8xC;cGdn*4`
zWXa|@Uo(Cjw3sN_-9SA9VQOpPxr1z*-Q1k-l)GM8cqMm$6ODi8#^Mr28Oh)Mt!4Nr
zlH^^i>yzY~hQ+zWw6anE95#c%!PHmsQiH$K4?fLa_6L1Ud91#m$|B6h9V5<Xy@n3>
zo*ekaOL(;WggJ2uB{3V=>-ver%d^Lydsm#;_uZMBW_Puj1?QJ<pXF57&LlE%yq}Aw
zLGRDU*9wX?S;G(A9!qnt99=0~Js&#WwzV+eJ`{_^mXqf^0*Sob*mO0Z_SWDiGX0tO
z;xDz4gq!r7^K9YSlkY5&Gn{U7YhQbaEV@Z(U)Ad!o!5vb6s`1>X3Z2M`uOL38CI5?
ze2<2Wct6h{ka<t$81yuXmjOOEyCr(_#q;g~O=7Z__gK!d<Pv_4wo<yEklfRe=U&+2
zHM{I(Wa#4=b^cg+5yq6b_Hp|-N+b2)!=FXc&{GU&wv55NA!ZkOrbyyxrj)e1{ELmG
zQC0=|%}=Z=Rg%<~jJ=<Oc0L+nan{J?cf2{}uMr{%(%wvfCl`SFkzW&Z4N@<1X>le+
z@z-jiT-PQN*6QMSLbIN=FiHt87FQ~V#=jD4ZS#3c0~365QatFfuaej%{qlD&y96KN
z9WvfiDXHk`Wx+b>8l4<!Oe9qVAyvdYYjf5vJ=BXODSC31R`guMQt95F<1uXFJ&NO$
zn|_&H;y*f1ZoSt!Pf#@kAoOHlSUgy>fq7?NkJ<hmAi<dSlr-RP*;3u@hZd=N8Ju;+
z&pr?PrYO(M{%J?nZ=K!m=)`bMOK%ya6XGXuORDXOm4R0C6UAVb2J$Z1O9N6EORuTD
zGfl%o<@iFM#w|WS5(PFM%G`#;_@f_-GU~oa=OiPGbybTT6w?71+M4;Wwdu}miins6
z=387t4kih`{3Q3%BjQ@5DzS)bbb*tv+=nSZ0FjnRya>Lm<?t-Ys<V7TRW#5i@et@d
zs|SG1^We(<2}@rz8`(R{S7kv>wV8S$@)a3c0}l4jm007YUA$7$HeAdFRQD3;2Lq&U
zsE5(1y2?<yJK+9eG^8b&K=`0VR9wz;R^pFt2Fmtbq0M)>Q(#xvOZOS*IG<N2ZY$=X
zu})0nlk)nuNcB58v<T~$vrktW0}}S|%Ibk><htAV;qiA*CT>`_*@g?ef@-q0GxpMj
zg{PUTpw0Rt4{0aeT|z#}DWcl6_4PmI6IX8%buD~H6ZEuFXVikZ?W-5X?UrDKnI{BC
zz12(OeD(N!+*E$W9qxJ4{&gL7WFb117T4I*PvcKqxBNSS<j{n*Ec9y8huZfD5sr-E
zq_P{m6la^>S>>f-+Sz^D<Z?MAL?Zzc)(pWHx0?4&+{@K_J_%(vVbI?+KZhFF8C<Zx
zXp+XSNpnS^PZ$a0JW1%`oKcLSp^CwSjKc-cK)Krz%bJ+DM{$LsJl&vM2SfozIX%4`
z&zUni3oC9zjMAg>Q#b!3R@5=0;c6cIv@tU`<jb!IbI31ktf@RYA}7ZieXbj$GVV`z
z+%widu}S?+?=9l3-Dowua^x2RK%yU#XZ%(@L*_@<a2{jjm#S3FUdOin-_i@n$eFlH
z!*#Roz0hX>#+d&JAghW;_0eq?6AD3nGlChIdt4mnx()uqt$mw3E#UC#DZV^fiIfb&
zEH>R>HFnzpTvpW|3O&3oud_5$VBji~P97nfnAJxlBn(!!HHU9x?S^w<-^m)YTi<cs
z8kv*VuQq92^8j?^%_?>`f4e?*C3bmP&hnilq{nXoy7)0kD=O0K6STz@YpQeJH6gHn
z{EPf+O&$~`4DEjqq;wQzqDmo3D9-t^;V}F&zCrIZY6^x1qQs(TB_`_m$Fl#y0;CUC
zk8Y*-krwL}pNve3I_)TF=WEO@$LV6cuC;(TCw7E!U4Dr(e&u^8X1$R@CfIqL!$E<i
zJptF1zV?ff0o?=vBk}@F_1ZRii>7-}eFoZOyD{23YYKFd6ab}ijpfCs6Y^o*i;W_b
zDx;o!Sw0JexUEn-TeUHtF#aKf9`K#ywrxM;w@xv+NOR?c3aDB>qSPv<M|N+0+m{e^
zx7GIymH1mnSSu{bUkD^jF;HF-m3Z!Z^b0}7$P4&|L$m5js^OpI2=4*8&*mRm#78JN
zL`+UDUo;ErbQ};d;%rffC@&D$d*+cU!RI!e1_^EVFkVqYm6V8T-$ClDS1OD2{L5hx
zJ*&=MCyo{t`QplnVVvmQo`@I^k3+_yY^TOAgshi)fp8^1hF2H|vc^r_?8IZIIk{%4
zS7qnl$LlXr>yo_HAa)9TP_a#KcP`)KK0CbfdU$#P$%@nJ+87|OGXJXsVsea|@KKl>
z^8~@Ee~jMoHIiuUGeuJZke8JF{~c>Ad2fB<PIscu^xFCF9plv?m+sXaI#N`NMdO@O
zI;ilP%`h&~IuXlpNXg>${VjDsfoZDcg2-yvmSUrCwcL7TT%s#VamBN`2Thd2m@&Yx
zNoQrD1Oz;dd6_QDcK?geN})R(W;<Qf@cDM5gh=eu=Ka#%>Ts4`epTneKU0+utUD#L
z7E9Hf(~mtU*`CXTlC25;UK$)XwJ81MIz<1k+sXeTzx|8eUX}2-;c|M9&9CP7Bgq99
zSjO-dJTWAK&pO)WaCxR#SoShojdoX>BI@fTQ`8uNMW0V2X*_@{Ut?S!ldnN*F;&#@
z@<o%d`m;v|(_bwMjM#ft&<~EEyV}<G-_d-;zsq9Y*WJ%aP9${Y<Q<xD-r<pD1WYx5
zo%@s@OAM}0qLW<LNTn_LH75U0`8NOz{Qf^j@Bdd$DF4%Nz<*Z=^!5K5)$r#3xqbK#
zpJejJ{|{ea@oK7`u7-8bdv6&kaQ7?gox4Nt+GA{dtV$^D6Gn&!^2e$Qw@OGSM@>Pn
z9er^g(ZS)`&E7OmAU&yNsr|H_huFjncuRZ=Y>hO5sJs8nkw3Uo^pYvVoa|X%($8ni
z5$_rh518IRym=GSzdqMw<s^Q2b+uK;-ygqljE8sU{=d3J>ceATl>(*Z#=pcJ9#H)g
zi@@_QxkmAU^7R$~6$9ll*S~=R;{afP0Lp(?frt0seer+byfC{V#bbBXOU<)#h3YkB
zQxmGbgZCQ=XeDi)L>}<G@InXd&9md-ZP46!IdtE0u<Gifry8cagFyI*u!23S8V&I9
znn>Q>CY6}mHatt8k(`6zV9;a<vpZ~+_;|(Pctq$HD2U#+MA)x#r8HOm8;4?E#F5Y)
zye39Q1P^#MP9h?{*uxu{18o%I)5XL4Byd?rvGI-a78BRy0aoLDoJc#`4}THz%=eBG
zQ@eU3+5Pp|W~Vtfd^{=A2mS$ur<aJ%@A<JBJHYL2d%XPIE-Tk8^k1LdSz&y<-{bFF
zZg~AI(CoLInaRW6_)YxgTq;f?4o+%${q<|S8YusJmozUvaNtT-n@D%5ZEPAKUv*04
z^?PShp^vw~HJ{xo;A+@<Gy1z^BOcx&T__$A(T}ya?Fc*Zr6#8`+dk&2Lw#8>nheaW
zk&cdFE}L0s2(}J0AI2B8)j8wxab{v?zVGzaf)Y{HII>2q#WDT{o<HIi{-Z|^rqMZm
zsk_j>mD?W<j0ig}k5U@c6$2!W>NZc}VmsKfeRpV39W>pp&(vxz&Wz?5oK6IGqf2H1
zrotiw$j4F4hA8sU`#U_7J$O2CCIWVztEyINM3JtCiD3WEz;`PO$--h+15?ynJ1otV
zU$W@;_1Vw-!NR>s`D<dU!&Pb}TXT14DH>ENy?c8hn|8ZhS!j0BY!;G66B_r%=8zzF
zScz7gP;gsCAN%st=6r6RqSC78$Ed_an%k~IzMc%OtLCxeVJc1XSOyf0W;E7y`zQHZ
zSet>7rZ(6P*Hh5MDK36)g<8KmnkHgIy5~mFIFXvXaJFFuIXZCHNmZ_M=)jC(*_OQQ
z2n%`&NXLX@nLAXw6qykB59z+E_CCuoORxv>r7}*EW^1kf8pLf*NS>Znyy|(-=sx#=
z%;g!@&E?&6Oj~xo6Y589m}ZW-{_BMr$c3Tz_(`?Ra<-(Cdq%~0|5{5CyuX{&bz9kb
zB7Gr$JT=|55+98&x$Oq-csnYWhe#2f08P85-`wHe5X@J*HFM1bA^4p95g!>X=9SRn
zSK{Qbd={NKNMFDuxi-r3PEn@hc5mcJk>0!{2cL>^l%9m2U4J&|i-7i7BfpZr@Z)+q
zGX?jsD1q(yGMg=ldd%VXx#O986BOGbG~$B3Hf3eIUx*>Sg&?k_y`_!F5mGm-wr4W?
zpGNnsI?#mew40V7tFXFX!(owRj4z60E`H`5*P)`9pZq;MHR2iKYJ*ho9;wJ%Wg>xx
zmOJSaMUx*+w9Pb<q_=(Dd*cq7kJ-T9RRNK8>Rv_QuCcnTNahM&sBFPPrEz=5oNHND
zMQLPJSxfxAU{WK`j<eO??P=fwPbba}y%+dJbiog?{dHUC3pbd`Ci;uLJTel!FkDJM
zrLC`TbI@(x^u3X(xysRfgZU|J;+-H<QNHVGvhZll)zMpML9w7adP{^08!X)>%jx~n
zKaEM}YM<7&zv;0vX=<ZW`qxeFQ$e?Xh&BX3`h-sgGQ>)W3GcP_d^aWDn#6o!EG{N*
z-4$q8Oq9NpuJ&w}&wZlWMdM~d0);_|HE3#qmuNXq@X8M4y46Ngp00=it@FyZE0q4l
zzU|0~8jqjW?lAY+3#wmosGoxd7Tv8DDT0uWPw^esaa+Gh7TYOh*FciH>@HB#tN1KM
zTC>8t9<l0N#-AOL&(D~?MGN$S_d=DuSAxP-NBP19J(iij&Cr{f{D`zlCh^hQsl)yf
z9yCAGQ>Cjk)s~(*d*Crn9MhS^%WGFj2wvJt!!>3-zv7US;E+r`{W2ABKc6qkLC>fJ
z+nN;m3RM~}SlP=v<HpZl-^jq^&1>g1e<XQ_-}R&K{`?pFt~mqQ5vW`zTTEuQ_%Q)$
z;|Cw%g1343S;=zR%=nXOCUfQB!t<@tQO&@D?ZCn^^-R}(*W-bD*D}q@Fq3!T_Ezh0
zZ;5};Ew_59M`+ut(0iXrkUgopUl%suz1wU8>^FEsk8ZsD<lDVG!rBqLH|OBYHosdu
z1BndlM!h!Gx%a!Qt1U=jeK1XXbC;G*(<`@WO4QJAM1P%PIx}{LR@B1Nzz|V@``XJn
zmU<&bLuj*#PlMRgA+`T+enCU-9>CIlfT!?IT1$L9<HWQ6gga!6MAOxbC{cqwy1;e%
zx1~QXtKu%?;0*lcSU}Km>E%LP{}y;;WHdUu<5AS*I-U0y6^g^3%m*U0+i%<#Y7%}Y
zWPVq9$)cs>-e8X!zHKNAhR;(AxsIJptR!Vs7-wum>?nI}4@LCOCSp!gaiD%2_9q<;
zxohnFvG^4H1=h>OWgQm&V`QV^P{g|c0T+08(Onmm`Lvq8LQpMKa&|*0B_V@r0gEJ8
zjlPs>9GY`@Z!quj13%Z>=R-121%(ggaOUnC+e}~|s4=|r`?o7AGE8ZBhkIdWgMPZ9
zS@oH?z@|yw`|KD45qz!UxVwnKEpkJLE%UQC#kA3BzxZ;w>*Xg7+UagVXSXKiB2#iT
zw>m-#s|A82?o7q&rwVKtxs1ocy*U@aSEXu#OHEATuY9$9kU^v!6So+GK&K5(iI*cM
z3UuC;sxt1&=rg^ViXZyiM_zMH_VK83*882*Tizu~7iSw?#Xe+pzN<f0-W}{lo_9>N
z_P;`9MrFX_?L^HAqIH4md|ACv*9T5`ho_8;6Q~1f!Uwjy^8dUXGr+@f9hEeaQcV?M
z!G?x}kmD80GD7+u=~k8Z6uM5wm@+8_H@$2{+CW??e@up-e<;8vD81`^*ZnR=D@R*!
zF4A)k+xpf*_-gfM)3DkLkEfZ-yYG#f^t7jQ@Mcwv42{e*&MRJ_MjJ?us`|gJ!d*3G
z=V->wm)ceqnGdSBiwf;rEUYdA7Pbl{eKNEk6^~eNIEMeA(sosKughN6067%&{|ymr
z<E+<}tr>jnqn^ZB(DTcy8gyb6Pl6ssWn+J}cCZC8tj4OGY#b<*+N{=i>=oxXw!j-b
z7^O*X54E<6tVSxmxUFlR-4r+n;EX<v=YLs0aOxDEN(aVrg6`pgSYVB&CK>hT%dqes
zWp-u}1N6p4zLy+IJtu}{o6x-(`aXdbhV1?(X6)1P5~S;RW_-l}YpCjJG4D0H+CMdS
zl}^;4VfiMNqlJH*R=T~Q?cDR?{Hd1F{Bn9RxGDSR*z`zgf>yjve(cl9cjiALPxS;V
zc6~2W?X=gXlYD39xgq-o@X=m5Dw?8j7tvJvy)*4H*}4-dkRM7?0BK-k*igXE&8$N0
zdRFBE?tpMYEzj~_h{C+RYr3DfTgOKdZ49G|u~u^icZ({=t8z<mZK5uduMI{6ddTxd
zxl@jP$MMmZC5E;yH#iP^F$#!k%;7kEA$-j5eGTpl0nXd&n->5c4Y47?`1ZE8K6{Or
zETY-@`6jdODBW_4<0_Kv3O!pL*c%`r*f`k|ZN(HOR{O4|MLsSm3BUNuuS|`ol?zP1
zChvFGeBB-`Q&!dqJHJ(3_8TExS$z$i8Y1?nXRyJ9g9tlpoObhNjj8ZeVQBAGz}wFG
zWKsLpEd=(E85MS36&mT-(=<N&2F*fEo^83!<FSXiKfm<|RT5e|8u~WV)qrg?#_^Bb
zQ`lhA!P`>P&Vgzn-?4n!Xiv4Ii{)v1(MBIL8%+zZDJa$v6$Q)b!^StLm(sw*^qc*9
zIh*ekK8%006{rg;eA?_ob8LqZPZQDxXV=Oli}61h<8Cy0M&RR8HzS-s)7jolS{rpE
z2vj7*(q)qz-QnUH`aT!GD-eS&kqshP4<xsxL}5tcccKj)_Ezg%vI=mywcs}8gD_;z
zn}#*RVF1fkyIomT6+AyvX0GJwdJM?9`mJ=4u@fjcz=L3b3P4vRGdu{mj<2Gml>Ew6
z786#XtAyk-)Ny&2%YQGvmBl4d5<5PEl6Bn>NLh<oqE$ITYuO>I?c(h2TNXL473m2f
z<!{KU@uyhP#^!E~b9^CEV>mODaX{W{F~CeDy&y)FQ!5XrU$HLue8fWbJe}9X_<BGK
zE2AW%MrSD>5Hk~2kdyA11Cgs%+b{dmFri7`$Z9u(>gqS>RlBN*blc-@6WK>5nRUsJ
zOr9AcKwYcrOr;QP$;Z}tbx9wb_j>w|*)PP~BC0t>2V>egs1MmPH1P>P<1k*)-VI8G
z=No9_b+iYbxI`gH7Y?jC?5<U#9ojw3;cBKs`pfNOn<7JK0w%)~?>BKi59Q+0($WHU
z*IhG5wJ0yIb~R4V(D!)!w+pI0NdS@+L>ngSMMh5Uyx@!ZW()7H<AZuSzMF^a^~c^Q
z)M|R6-(=gbB-7pO%WHPi-g%tDj+;LTu!x)74$MTO(0cDWJbM@1$NklLgY@d~1c_J0
z5dH|c&ILvWTk%>AOZm-{-XwidF$K=^w?CRzhR=&l?+d<~ly8_w-4gPBrjeH9s1{W+
z9=9_&o?8b2=R~_AngR?6vnFW9>KM70i|4h5=KmkBES@^!3&>F78D%!zTm;m-p9%;Z
zQ#YT=Ebc(BFi>g=3V9wzkHr8=PMw>q(>rd~rMovuI>8Xi>{)uvPEghzJDd4SnPBm>
z`{k)|;w<efloo+45sAt1(fQPCcD+W^?^i!1#P{>5`8lbFA030Z8x78*ZDTzlI19Pm
zj9S^PiOV-?1JSH<3hF^qnF`&$A`XXVM;WPc8rCL>?V0H@7yeBq&Uucz8T4<zO2YOy
zxjBk+D?RzYD+qhmMia+GzIr@MELv?py*i}gdHJ_uASb^^o0*7tc35aH%yIQRG?1}`
zdXM|mJn?GD==cXaAM~}aK4}JU>cksTJ3q9$_!Y=_J`D5I($R@aOss_<i?3gsNy6uJ
zs@xKg^h!)mhhpa3uU2`WdBw$Pl2AYQqUUJV#^>Dn238*^e&mpSFQobYTg<XQ`F{G$
zM}gJ8lq8e+CgZ;i`S4}~vytQ|Vr@BnTFuR8(W<}H4Ne5#c<8T9gF$f{9_l*Aj#<y>
z#_xepCzX^INJw*Pa$(h;uDF9jWM@pYkhbM~VsqQ}Cu=85Hy0~z{i;tz<1w85rM3$t
z+v`>Fpnf&DR{;J`<sQ8fE}kxQ+l3`Ax+YJCxS4NH&V3E=Z}1kkhU4*kIvL!>&Q_wE
z&-xv*@Ghq;)5B;5YycsQ5p+XCgPJ5(>)vk-BHTI@w+_hnyC4<6`fX-Vzc}kfa{E*a
z#Ux^-R0mcRI;2u347Ihk`}FJVt*fqlPt2C1Zrws4i@l$?XIB=E+4m)5&B~f>UE1|7
z%=;m%lJ!=_(DQBav!gg|?WyU|;^3Btay@Djjbd{~bN#BG&hyTYK~Rc897lm7?O+BM
zJ9^D*r{MUJd^6B)yib~_i?cY5ZlV1pK(~XM?Y3dBS=q_SNkP?vU+H4*<LQ>*lbD^n
z=P&dHA@HZ>YrQ-JD%v0NZ5SA_X)TojdTn0Ys<2j5w+eXfJGDHttli?QV(gzR(6;ky
zaYpYVnMan{n>W@43&Nty!;(V?LLi}uvZYQ_^dMDxx3v`t&HMoJe?;jP*GA&k@t}v@
zY`|UlwU%%9;mBw<HQZq@50fu?7`XC&dU~*|aRy4N`S|Cv(7Z=xMn(o(Q66!$vqj(4
z_|?TIR06_JZTGyi;x24-6;<)|O>$B)#$REyH^hlD;K~JDppx|HSIui_;D@c{C3ZFJ
zs+J#Q%HCu2dTUs2onqS=Aj|+hk4hG>?;IW;R#a5<^(mu{-J37wjBtnXEG#S<<L=WH
z)-*IUBW=*rKxoZYaeY=ht4b0@ex#t10&Y`dd0U1rilAMm=v8|b=PYxq4JA0!(3Q))
zqg>7KKrB<RpyswlIauwlM7g-!!olP-IlI_)7G>(`ljosRYE2Q?m8V;2#JzEp)H*A0
z3ujvX>jus8pFi|hVbxSuABJ9bLQ_OsZ2%coHSyz^7!NoqEG(=yo~IgI<ml*_4#j!e
z+uI9;y|W^^4Vs$v`Q|k|o7WA7)ta?VFPSE7%iMPT`jiu?b?PM@X{~ObZ}=hjh`QOn
z7du|S7kaNq_HXI5zFoJ?l|eZ-)LVdznQc8ua0Ov#zrRAG9iHDJ1Q8GZtuSu4R&;;e
zPN&cCIAbjEL7L#NsHA_mUH-{(Myde=-QAvx0fbp-QMc_6^#DXWobeld>poSAgs)d$
z!mAN3Yy7;&vj&_trt`gsfeGZ=)#)$x1>6a?JT9K2%;<8w9Ow1vtAyon2G_;(I%Djb
zvZsk>qKLO!RWog&N_X!l=!LgSk7RMNqnjtt#_uWAMh5)46ze?tH6_1o`+8rcHRrx=
zNe~wW8P!`%U^SpHZm!_2L`l)uf`8cMix#}Om6h811j+p;UCgkC!yZmX*!nj>-4@t-
z;D-(f@B=%ykbd|GO$A8DF*T01d@gf{Hq>DKSY1yq`Nxkt{1X;_N41_T?9B#3n9Ib8
z5ve|^dbuJY+T*N+PeY$FthF+VK?Ov-Vy-LEl#K@W@m_ukpO}$_uAiMW+tKq|y+=%J
z9tV2zBoX4x{yg`i-oQ&$#SFbA#co?lMjNW7OEe-;pohN%ZbH{0rXx~p9$<6&M;tSp
z=R-mcLtFIKD}D`Sbf@{E=D{OUQI*)Kf0%rW9gao#9}X{%1_AXD@2-d^fN7lVdP*dG
zv_5ms(CE~v6TsuyJ(WP>qKR|{fUk=u^<g6rk1GfUqh7daV|sF_J#}>Jdb&N{Mz6A7
z6Z8Rpc=`VWaJ&oPFH1pRqv6NVgCyxCLe*8CGDb48UE~$R3uhAvrPW)&W3hmg0)R~t
z5{C2JvvWvJST)C?IU{xAX(N-OXaTke8jw=B{ybfakqVo?Kz9?*U-KvaSA_HWKoEq_
zYUnZk&sO$8O>}{u!vj1#Am{w2XEF=T)fH8qzIKd=&MncI`T2tJKqAJ%h~B3Zhj(hX
z<8tLqUOpC4HTX|`ctnpI<cE=4$Emh9Zq=SQC>MVZO8sCM`<ovoAD|01I0tz#plpI*
zVR60YZ6ASfARRsaBdJG`WxF(>5Nt(xW23<nx`#zgEG<S|+VbVoVvKpTv)eWYrvoQ1
zZxdE{H4wAWPyfod(x#vRZvQOG%HrLAz<r5Ap1J3paKaaA9#yisS*=&l!b4+lVKn(w
zLaC7t4;M+q9nQwAbI{JY=Tz5sNq-ZE01f4mM`>~FE22PxX8SLFeZIb7ba}<z(9uq!
zEyG^K#$dQG1qk8%V07lc66byMq*D3z?YdXn6CY3xX3L-)pu3R__>XFKXW2M=drufe
zrnodw-@^v`Qa*XR?7v(SKWL954G%q=$M8K|SpxGXFL*)ZQfIDsIRp>FgHSZx=f99c
zW+CRCkmRi>#w+9b=d19%`Rq;ig_-1+J9%8#N@8~@dHmC_STtbPO~=%KjqJ&2glo&l
zD7xN++Zz7|3;4+1b5cw)J0`{@P0ou~za{BY&%2qnXGtt6=}*<0qu0~s3!6>NrSM%U
z^u?rN7!+XQX|CQ(dU(a0t@|~)Fmpv7+#XYJID;e$a0+ia$I*Yxd-*iJm-3!Wn?M9G
zcTn14w@xh}#hhHH*e!Dvu%;LI^WLYaDs4K>t+#U<V|E3SV57a0pfrd?iQn0w_Nq#1
zGWtBJNyOf{;Mi1_MfPG-(rXJ-FfZ{*7Hy!_@|9h4WONDfLtnz%^zGbTB(cYg4tr8n
zMOE#L7@3o918X*0fqY1JAdv)88vP*|>3%Q|mi90p?kuXBP$kq7Y3o$0m0<!vQ8=Mm
zCBIIr-Z{$pRsWih4z_q`WStCuj^-D#&*yaa&lmUtC$ZPz-+Fj8fCO(9@KAott9cUL
z?PW-bYRZ!ekXbr9E5;_K{3ad%&c@q6l)c4xcywR1eXTHKuY1=6mwJW)eJ|kTg!h!l
zKayNci{b2TkzTJ;o6rHpAyX(?HFlGoEHeu8-1eG8EDNf=Fc*<D82CmecM*a%(#^pz
zcq|X8(`4OFn2sHPC89F%-q07&H?GuXe87%TW`OUGEq*Nwy=%(fqN8oNqtqj>M!(6_
zIEM4n+x{AATx4H8$ku>!6w>4D?dhfS1@vZI_`nX%bFseP_NST#^=69}uqRoZ*;lJj
zj*OTd2lza@m)g0lwVfTr!2za|=iQ{ET(S9eSs7vfgT)$h^qiT(_x1hrQ1b;j^9#C^
zGCj6=>__m(P`Kp7%GlUd+}vy99&v*~ihTfVER#`7poPrq&V90&J^dBXZ4Ytv^gL5{
zcR8#c8CP*TJ|+4hBCpwhyjoeT7Z}vKdO;f_du6OqXM^!OfiGA1Aa_$~5_OlyUKj-4
zM8{INLr=S^=?cRq1QBScw|SPn*9G)`Zz0=jYFfNcSTsx93Fy4hmi`N&Qh%`DV#V0@
zjAd2Tu@A9#|3o}hbA@ZV0Um*BaX7NupwfIbFd2(-+{ks9lU!9z)lxVHOI{*ex7?AH
z&&~S<W{hTPE_w%KYJNJygXoZy+qn?+g2q5xgGs;WxOo1Jp4iC9Hx*U#dG+1;;LG*T
zVSB#w9MK`F#2m32JP<=pF89-wB3CBLz4L-rqlx3R$>yCeJ-5@9xr=HF8tS^)W{+nC
zi@kjj+RqzZ&D-If;J4u?!A)-<c94tKDvac;_OxdPS|{mw|HDS=+$BZI#d6C*Sy@@M
zPy3y3`e2#h{>B$KLhi$KHg9!OLuVW6rSBD32kjnWa34ljj=}Es^JO~;w#w6A$##2?
zNC(MTpEHj6(aP~00FeHus1~DllAg|4RO#4C7i(`&rtW<?T8-OxM5%*@va=T2WBm39
z=-Mre<uwF%{fa(b7#n4|eaO(E$zzC(iFv@jC-N*HIS^f)*EBrs_xJ83o9fh#%KDdF
ze)XjB>Sp_28{{TgHQuumXdQLWMMM_5#qF@Ku#*?Ad%bwz$V6wr9AeY_2(m2T9dJbQ
z5_ppH9u+s|sCd2OTy#g8@35Wo`0lK(4n(l8OJV#Z<MmCn0(t`lGZSpqYucnX?>QZ|
zrg2y6f4RA`)c5PKjNEZ_eIQLlf7jKg6j!;!#GnjaYe5A_uS-1P;SpuTEY410NaK}c
zntPI>hk3_$tn(CBp^!9>!7uEk@$1S)N2PUOxW?-(x82uIzb`<d)-L#}Y?j_SryYR4
zw<jjSL<K$=)mV%U9BR6oXN683toOVvt{~F(J@%`gPGF;SP}6@jIegg2=29D=okUuA
zbsQ)1B<ZbvFTANPGWOs_-VJ@N%Tn|?j$Jo{8LQ~v?7Z9GBTw!7)OY5@V=xWk0NeIh
zQYV#p_k6(M2ch`--o|Y0ypDgPYO+e3Sr*)kC_aZJr=kl;GrbpEAEwrqvesPVu3zZe
zFADEWF^%Hc5qF68L@;yj5IRmzqWM?j8UvF?Mosm?wc`X~P@COW@=Ul!Nz>T|E9!?l
zdA(pP1t*sGnT5#!0fuhHq%gnsXW_}$1PNtHEt)+3S+{!G-AaAoXZL;!MN>j1belyE
zhOnB>Wz91mD;v?9ds#uvA1)Dh9j7tw+uYn|A-IXJ<{@e1SZVUisL%F*IfD;v9i?71
zH=vjL-Er&PsD(I-qPd0wRNn$%=m-!<d=LMTz4i`-03OEh>l4gsSRVJdJOPRt`9(ij
z%uf1{-=Vy+s?G_ytHQI>um2L0_Pn#3uc*o(85yheq;<x|y)J{!VEzbya-D=1Q=#cw
zCPS0{NS;N}*Q;*+Dns~Pb<;#$nPig=>pQc)gca}f-da7yIo#(oE?zMCDgC};ql?Y^
z*qFyNGae&FuPj1?XEp4qlF{i*B1H_Cp&v>hoFV~avqDi{!`3YI^%hCxi}>@pV5wbV
zv&G-{*|E1-Po#f7+TvLWcHUW^4n(i@QD1TF?2PQKd8JujxUmQNd{ESRGahGz;1CK^
zOHPQ2q(@0Oj?8;(h6%VjUD=}rgeo`biwqrKee<#txY$a4T8B1Gp0#wZW{e9TZliF_
z=+2>m;^M$P30Z&hMNltq*>UJ}F`LTXoQ`JCjA_~0@{{*@H?MUA`kp|N&<JPg{dm{J
zzPP;c;-D!6CG>ks{9>)@syp=r3b=VlB?Q5~zr_49N0?|oyj_Nck}AICCA;_LibCEx
zGbFh&TRBM`P}ViGED)oPuZ~+=cc`MX9N^at3FZ_#-)>0MBrYz?5K`ix2fpQQv1`_-
z#ZskX`=N2lB;jo7l56Ko+d@*jTU|rT#4RsWSZ%P6l{Rysg8nK49r4n9Ht|tWdcyI0
zjn58eYjv&ReJ-`ijH0;GT2EZd+%3c2fZz8$BWex3Yn6iqU#!0kscwIf5%WvQg?HS5
z4`*&)Jr2r?S0Yw?l{d~drkMC1rohKhy~~5B)D~Ul9dS{Aqc1{Pb;O|&IkkTO)wI&g
z$lFxD{mQHbJd|FOvf!!yR&5*=W@sY~_bra9>Cr<k+%TIfg;ScC2D^jZt_z5-dK4AC
z1#je9Inb5#lIY#4VwkzYr3*GXJ>N?#jU4{oS37tL)h7Fj8JkZU9lmYa>H4S4>I?Vg
z5N<O&CMc5kuY_+0TLptIa%WG8_30P>RdIW&xh>wTba8unj!)4a#I8EocEbPG>A{h$
zF4avHD+{+t88d>8nf~t0c@MVTb#H@Q?2u@Oj}}W(f^Mg>m@i8D?E}g%i(Y4IH$Uch
zZbf-Q^7WG<GquyA1k7b1Y*?4&-cjNfaGB3QSt`jBEm{?AnMB2!0mSfHsb0QKL4F)a
z{)mEGPFE(@95$?>v#Q~tUz{JzQSY{lC_4^lw-I+!oB5_~6Az-S`wC?T5?Vn(Mc&3`
zI(XO?OU?y#!}-Z`HDPkuAKwk?N%?!jL@If`#=f>On6FkID_94q4-m`*_t$yv_P=fp
z=Q`E5&N!_ptefX&0rWU8^7~y)Ee6im-ezfCmJ90}lFjsz>#Pn_)Afyc!gS)8VDv|)
zcdn4eZ-W&Y^L&u(krBcNWrV!l70jJm4fO;C{K%L+J9JRw+p#%2B_8=-pb5v2({1Q!
zRgJ~HMCJVTsv13SGXJ@v49vK`j8HY-`;NqiZFEdN`ZO0(=bu(-dM$xaT~~*Nf^p^Q
zX%hw$T$rLYmm9<0t&I>8iEZuNN-D^w)7%w$E>nKiYEtgj(}<!zfhsNIz&X3P#D&2j
z7v+Pr*;>ER`6Nvm^3H|x`OZC%ss}6QfNyTY?9yTQ!{P4-bqpXufma)MR&m3Gihm3O
zSGH=lXzWQM$;g6Q(bNkauEF(R2uXLv?&J9<cMEL@|GxKjpj@(FWne%sf2Pl2AhEK_
z#<GZ6Zk@wZQ?a>@(C|2COi<|{O1PI(EETB<=K^C)!aJ($x>I5)&C}8gFFt)A);=F8
zWSM~|^`F=_a>yHXoY5H#yz;QQM<r2RTb19pozge{XM;)odtZ*<;`ws8B;tHE9bR2_
zI*bu_La>7s)7jNl_zR)#b4LyrY;5LhDk|@TJB}dT<e&Rudk59@-*c&i)^e`@CG1rA
z3le%IoNbG#OK0$1{8sxUIPl4-w`Z;~b|&C9b2KkgnncwyX_H3$t5+7FgFMmfP^97f
zPalsS^3lzSrgbA3D#-x~rl|)e71Y&m&^gQb?dL0H(q9PEo%m4?m%I)`8p?Ne*cep4
z+{T<gvD1+IWtp!cEKK7--F&cR)U*qw^DJN&cK}CSS<KxHQrK<LZk{cQIor0^o>0!@
ze!}YjZawdZ^n86ix>Ao#Yslfjs<zI(w{s)yedK)b)ygweK}0sz!rP)lvfs)V+8LML
z=<c;K8Cp-2FJhf-@g^c$^(Ng<ieb56A;BwLK@h2Avh!+0#Wj(1pI8V0ASywe@7|%8
z81sFHCg$we06f>+JD*F?+YWWYk=%j?z+`jXxPGuscK5}g>k*bZw^BDGUaYjiB<qUx
z1GC)>)c{x*a*pZ%<<LD%@jkSC!KHDNis+e@-dc#p-4CY1&69DU90<3b%xj3w;F;qu
z$Yw7cG*ag7>DuW308wy0atK*=Dd&<!uKp1`S+3$cOlbT1Q;7ba2+~gSZ&coLAcu@3
z%Ic+H6ZK%jfykCxO$IqS9x;Ng(w79pwne>93ei&<4x-1HxVW0hN3A~!K-HU@bPPFz
z&nd_PEMqbI#_~>64^rJW#vNk!T&I(KdL}2iy$k=$b8OX69>Iew!)LY+Yuav_le%Xj
zcc^;8zlrv=q$m5G>gxcgsmixU4<F2yY44%UN;{h{FHjEVxzQPj{iV-=h`PREubGWK
zu?1XpSfhx73b+8tv_{}TLXWp7LX&&1q<3|?%5Db8Nd-r`&wH+;QKJsEt5lA}(|vl>
z=Y#%K_vSVzqKAKy3kLE}F#|{T`GTQ$H|=+5f4z5Y?1t>uH@SK9d}uenI==HWy*rct
zK>bfPB#`Yp&Q58lR?+Uwm2C99&~p$Q$(~o#JIsuefr3#8`~e+xrai>&Vl&HtPE^ZP
zNlU1=9yjlF7{d%G*gM%GnlvC84ya)cr%LW8U0OT)S=`>r5-uJlJjD&JNITBSLr+_;
z-L{19n};KStH~4;i7Cp9czdH*p_{Gpni<qBb!(9cyCG*$uA6yaq*(#r=nSH6w$l{~
z`d>`F-E?Xx*d=u_heVlmDjd_hh5LjbzrD#+ziV7j`TDE+9)b*{tA9hN6cBM$L@mMN
z4IfH5$m4&Yp&=vp?adptgpe@M_(3jz7}pgmXmcnF@K1+BT{So^Np?Lp^#%#{hxDE@
zQyk(qYU9S)qq7IS-hh06?oP6w<yzloq)C0$AJkh@y5GhOaL=ryZtMfOZQ*D@`e0Dv
zsE==C=6DN<FsQF8F6L%uFS&6B+<qq7y5<Eapta@9k)}e)5X_W8<u^!ySiolCL`*WD
z*Tq`d>V2x@Bjw_qZ|$8o?ZH>)h%2xzN)lrK=ku)souY?QgYv&BmSu-{Rg^2xEq)!^
z4%nXE*9=TKwJeIBN-@o}m%y}auAgI569G?8Qv~0+vhJg1^!6Jk;)1XI;((u1nLmC>
zy3v0Fp;)ZYlQe=M)dSF-<Vk-m4%L+X1$`DFA)$T2{T7?bV93XW6d~8F*Hyk}E$dWk
z@p-(O+_UwHsbWXp(k(W{I(q~W`g%`US5-Cc&ia7$^w#^6L4ery(BBZAril5IlY4Go
zbEN1QW~KADY)k`5LSX80>~o9=_%FvR{G*&$?UCk@`%1o<{OZ5ncbUC4<Gq46Q-k(c
zM`gRrt8Fp}P}S8r$^fr*(Tg@B`J*-nq*S@!x-|jM&Q^2)0x4IRPD$KBM;KjnbTp#Q
z9wYRpED1}B&uIPLo#tKgoKxQu7g@$B?`W^x+I12piOVgctMhQt-H7?!g=Qm;8%hWe
z!tllUCZzE$RdIncbwzdcg^vUR$%%ETuEI99&#fI)c@C!8ImCZ1pfH3la*q3o;%J;o
zQ)Vi2Ma}jff755h(&a@cNfIbU`H`)8d5{+x0^xK#f1JSM94QzLA1f=XMSCzM5ap~v
z%Nzlb&k38#OgR`8Qn5(rd+-n$_)DZ{<!sy1@-jRM5HU9;a9~qTcr0Utg2mx^EiNHV
z*fV>~cu_@#Z)14N8o$JZ5wL^6k3S8r+mAT>{1ftR)t-u=MbYeQLuEhbIc)4F5NtIf
zmd6VZ4hGjctsV_ZHv618p^9Ssj*gB1Rf$_eAjzw<K}3R+93ejX!+O{By!v5m?`i-Z
zS6zRFbhO=i?K>l>hdJs(9~d&O<cWdk!1=h;+%2!AwjdxP5eXoGUt-h=%;$g4{64PJ
zK=1gBu5t42{46lQdXLvieK=D+PmpY=mP0e;Ndq*+=FKZSpM$%<0lDX<*RNPvvyIYj
zhn7@2t@aQy`FsL$C{pLpi+Sv0F$-5HH7JLF8Y(4#01-$;^Ax+?AT^YZ=VfxaVXU@d
z;d40km;7W6B1|p9`zGyY7;d1tBec<g2f#-`SSEiS3H;Nl8T<OzrFC_6|2)II^h28W
zZtcS5nh<NWf_}~22_TSiYltqDV24uRFDKRG^Bca8Wpp$+0aS8g5dSoo4bOdoM~y&s
zvS)BGKDhB{eUMZP2U2X-5IBtm8Inou-D<HzqGvq00gTvQ0((inh-f-jJU`oSm1YFL
z^gVY$S(=(=K6*aj>(EqDx3Z~5XV2FxyqDKL!(|6D7_y%Nfg4;Qj@DuAp5t&rFf7p5
zIXE;_zt#z^b(lJ1-17A<P#=f8PHW{OiqF6^eyilCbN)6&TqQAu$&R|l>1;t2BWHG~
z2-=r<kx7({?2p~9a+mJRt<2Kg&dg4RPZxUM15s1xF{8gndR6A+7v}yhmiKkSl?!*^
zYM9~9YPbgCd>O=m%B~DV{LzVuYH&TG@njlELIJqU4JPgPuJLia#^FKy>)e(w@skg^
zwJ?eEjY_fV?EX4LO-XKF{!5G16;+jS!l<94`e1!6ePg8MS}6Kv_E=2JB>!zSUG==q
z7*W2?kL>gMTE^P&6^X=n^L@lP>ohl)?%Gfoh4ze6UvRf4Uk)n-TVBM{yG~hSQ9S*6
z?i0J62&9U8aFCjZyFXH7cjJxa{x%m!X}+eDlXLlvKa<u|ni^WOui9oC!YAt7emQNk
zbIe<oKffomA;y=JWAoNF9$ryXVp@NgZS$g&Usw41{np(+>p9J*FD$eZ%AB2f36@ED
z4>m7W=$MT}{)u=Ed1HO<p?{Dur$KRN@13c648?%d0>f-}IIX(EF8jU#-VY1<Wga^c
zIney;V?u98>URa!^?`A^e0q(WC$DWn1PcuftR@oC6D{V>Yh2u7g1nrg8_#<Nc@ER1
zW?5gn|6qIK((t^?sOi_6SJPPn)LbdZ;oS1<+#y>pFZJ+&(wvWfB<I}+G3ima(~N!%
zczWd*)RaunSQ*>lqE=;8Gshge4{s?|CBa>6rmAcmrDH9eRO5yXD{Q-`eNR3bcxZWL
zDj-H4DMv>g=RcS+ziS)M&Zp#Vc64}IDWgrY{>|8Znq33t97hR0j@Ed}p(82e(9h_d
z6T}`6bmo1db;B+Fdcc3HIQ&c_nB9AdPCP=wb1QHU*Png!G&C+MdZ9f=MLEM~bh&ds
zy7J9Rg3h3>2Hgj+aaZa^p;mMM2>Aah?)?9mPT)Ac%iUE%*ZI;HrDNs0bz&`Bqf=TL
zs$pgut}hca(IXpXjFRrGk;H^0mT#NU*%zbRI!>yKn5dhtA;c&ugqi!e$NdlY54_*6
z_b>0q<NbcTp6~a#JUnk@>c)9$@A2NdqoD%SHX{zSs{PJ#_V$(yLm}b^O~cL}e%<NM
zL{3oY@LtoZJ7^e$U19qrK1E!1_SQ4&zsQj<y0WwoXB9exTV!jTBw{aq(oH9e%5o!P
zNe=Yc6RYuU*)h`iMGuLScUpDOFZGsJgG;e@ypAy?ux6Tzm0ZR@_plJW3%W^gW!msU
z<moIZNy#r&VGu5=&3<`cqW~|jZihf3j_g<(Oe#wK5Z}F4bW;n=5)?}uCg5fC3*kAc
zq1m_?`p_0gK{v16xdJ{W(6{8Z?8ITsN72kOUu(bg4gN<_Z*#PEQ)ZRP^gs|c{Bw$c
zY-}qmX$v_l?JeXh@k4(H3^|UHtkm7^P;j~IFdkj}%BI<Ie9>6nGVzUWu(0v`%x#=c
z7r{RC)5rJ(c+bMY3>Q5b=gD{XS!NW@W1d_VMCbkFYf8!dvi0SK{B>+pShh$L5J*6r
z^vm>e<fmuikd*-{t2O=6FV$3#!Q7jhN#;;9a;{_#b5?B;HNi4v7SBz^hrdY6sMNhS
zLwp()X;v<9;}KJbF)txQ%HyZI2UCvi+R$N^`AM@P)$BqK;gVRM+549R_QfiqapJ)F
zm_c;K^hX&*E1U=$7}33Z+F1LTSpD9zf#{RzE(9ptH#@k7pya5A;1HcY?_+XWzw`Uw
z5UH-D+S7J9_7Qfi85wFUw8dU7kv(MwR!8TfrLjaE2HObF?V+|poNcnH&;l3-&wa(`
zCfLuPqg`(!j&^NdC-KkZkrOKGc_Td~T<not8|7`1_=BF8;e2A$SPf)jJXKf%eyzLO
zey?{gl;i-h&gvnHu*N3ca7ajhurI#0y{BwH$&|a7@Lbb>u<fy1(FpT6X8hOr{98@7
z9+TJb`>Xqfmz03je?Bg89VlAort8hpOwz=kfNQ@)M_vsoLMG5=-Xtlg*zuMlZJngi
z9h*2v`f6GhT;5pW%Iv8*GpQ+G&@fbns}-1ylE$!3mu5+NM`@l>1npIWi8psy?85vs
zd@aB0_j(bxV3WzX+PA0>aYFrwB|a5)j8A^ux`-;Dkr|cMKg#0=pu)yngCrD{p@;iH
zO4H{l*1k!LR0rH{@{!P5oPv_!azV+eZ<M0ls9Mapx?roDxU=k8;ho6NAeydNE)AO_
zKk))K6;9)5<e1wfrowN||Nfz6veewdJtqI1(kovc6UxWqzFvA96no>)NDNBQmtVXx
zd)OZIhvbq(d;mfCk0a0{M@AaU_i&!Cx6rApt6Ogd-iaybr_d@iC&$>bvkjwpM~a;$
zmu+t0&`GXQ5{HBdmdHwdbzm32t(H18%<uC@dqWCPPM!DIGKO>L^&hwCBh9=YOp`Ce
zuQiM$7La<IzCkzz$l>5FA-@pI5-)Nx-49Nia5^R=eFL`QG(&IR_f$EagqqOSNfR3w
zvpj&4-~+6M#x%wl3F`B^-&1otiGc6T)lQytW4uN9DiTpO5G5QRrJh~|OuVoZ1tW1`
zkpX-?`V6a73GBBNLoFk&`oOkHN><;AI9jZ~j6PQwSm29c<2_K#pYOK@O+L!GY^5t1
zs4zH?|8{^~rlz?7i*N$2q{szEh=8c@=b<l(sy1=YcQ5^Lh9HEVDw$%c1|4%4m}Su@
zfjLj{Y3-;0M(uT=8S1wEaWfN64mDK{W|6YFyAPji?$h@KWMwP-l6BJbvb3+A;!dqs
z28_dxO9n6cBx#qvMAVx+EC)~QfC%;>B0N2JYEcUYxE6}&eQzMfJm(e^?42#L++O+C
zAlVg&!8{wW8K$AHpb&1z=qcI1%nJB=MEL+xJ9xLg-8uB=ZUr0QL6T>>7C?H8mviO-
z2X@f_pu#qs)S)8m);b30qV@kmiD{TX?$y=OJr=;JLeRHsV~-B#M0nwYucnu#)^wfl
M@HtxT{_~Z802<9dxBvhE

literal 56794
zcmbTeRX|%!7ycWdEiGE0IE5D|P~4pWg#yKk26uONYq0_aio3hJTZ_B91b2r(AP_it
z<@?_pxj6fVfy@?W&tCJa=eKskzA8vzqLH8h002zsFQ1hGfR~6S^5kn|#1Byl86*JU
zEkOG7CsmL1lQneFxEnC)MOQ2OMo4px-A9bsZ)n8<;TFFLr>VGSu?j6yUE9<1Jfrsb
zQxZI7D%v4l{GR+)TKUo?`61FCfiI>2c!hsdi9V(ciY~o#Lt204`TQG`nD8YO-rkXU
zy5zjp?>_;(2TnX2#wR4;0McAKvYSK80uWaM00h`t$o|s+0BiurZ2vYFU%W8*w^jY-
z_3wXM26%4+5Lb=Ze$)O1K>4Q?AaC&Yp9bQX&riP7>8ajNH&cc3r2n+!(UFM$`P2q0
zvQR5SFK;d(3A9QlPo`pd!px%7ly35cw~=4H&^C>Si8c>qAg3cx*E;Oae<w81mOF&n
zS!#NF3)1H4t~APfnjZM(<qDRPSAI`?i+(t)Gn4>z!HX?a*Hdz=QdRNLmWZZs(2{;7
z33&C-Sy#k34O7&mW?0kuK8)qjq(ABu<mP_oLh;%OSOI75fmce~PEVIAr~r9*O#kdq
zO<8E6rKI=AB$sUQ1=-1xKn7S9O3SQ=_hO^Dxf!JId&BB~KN5yV_xhjiq9bObR?wBk
zQgE6U6O2c_J{BTN;*aLy=5~9vJ0b!*$h*3_iWYfl236^?u&})NXD2{*u%*pQK1Rlo
zxw)HQLOqYmKEjvCe|ATb-u(Ny=*Ubl8k>9<N8Vf+2&AgI+U&S}G*@P4XJ=HC{BIXP
z{Ref`fOBw1T54))Qj!!!+1wGg^?duyyf)-dt?7uxtHK@;I7B5uhTC~>l(p+I7ON<4
zcW-Z6`fROD3Xn}+xko>Um~luP5a(P5Y6*AgN%NhatiS&&jflkWJ5Kz**&Mmp@6aST
zZ`!Qu&Q@Dgl$FH*Bt@P08{OUAP3wLS^A*~V%dV%JD%+LDmey83_{{>)`!-+PV%T=3
zaLgeOq~{rIwk;h;JC@3Q9KqU|UDev${CMvF?Cj)31(-nd60%tD^xdDxVr69oF(g19
zCbln2qbDnM+dc)plKA|&-hMrk3*`or>LDTC1kX*X`&hmei$)I15@3ncq9Su;PkQ#G
zV0>Z9|M!fvhC{oafj)N*HZ~`@5)lU~t!0n>r1o;@e2%v#OD|Hz933x%-ryYs2BKn9
zsf!xV@&f#y;n1~K*OgA+haB<HgDkEJ*mQ<>o$>UScF*g*{QP{xeM>gmNYeMa&x;mb
zt}~xlf4Xh*VwR?k(CqNaQdPT;AHxstKtT}~7wh$zmWwy%ty=U{FEK>#0c#2jg+2@(
zPv6}o-<gz%jctYX`hCmEq1+md;kvrZNHaEB{nfM=6xQ;>rhh6=sta~hhPVt4A`CB~
zSgaEKfRW+h1AEG(5#O6RkaS$Dz5>f*lF75&ay_LE$cZ;==SgO{=Ev~`Y&_?yeBtSb
zQ8yD)kKJF5w$h#wyMYl4L(>+@j#($3X)e`O#yqLrqf9AU+P1GFsIMSSW}wd0tUT44
zdzQ2DRWAkQ2nIT!Y~KyUb$?#NB1&h(-M!?vN<JYjMO?>90Tlq46x!O_I;gCYqs@y(
z#UL^uvG5XQ6y?I5$Pnb^;))mDK3S~kQPnEKZ}xw>&U%rZQ(g?1iLI)ua~2g9H8I)w
z{SD=qC`G;JAPa~I`1b9a3+^{j(deaLUel!}vGt5C*r+-&`81!U?B4jeuasU=@mPLT
z>u+M@=`HD-N$kX9C}$`2)N*mD?R6NwO(@QbWy|_A=az=)_}GCjMNz4sb#-|#nDOVl
zQd<E0)}uj2`tdSIhn&&IjEKdjk*1`iq$dPZyUq;L_Yv%UKIJd+a8jqW-TrXaW@%|D
zPa5EA6<h!FBP(83(+?>Pl(J6fd0eCIV1u^Fm0Ne|(yPgDDvhM%kOLE<A{G+QlTzLV
z(^;ZD&hxek&h{@)HEMN9<T1{7WEIL|Xvs}(eLn&F0(71bR_%ml$0tG5o!lY)bFCfi
z8(z)iTFWP=x%Tt<D7VIXy?i#`g|=u?#OP*+O%8v}686>e*nCOi-ek8XlQsRV{`F_;
zE{HzK&%<8>FE+Y+8%CN6J{}?&5r7Wv9~Z;&LOeHl%LP(D`#oL`1fvrsCMC`EV9pfE
z=ivkj(GU|8+weRPpI!e*^gO5u`SIiR)z4CU06Du+Z!C?hjI1oHPV>h3x#CERKm1t#
z5T%Z~C_jHvi#>Aqyz9BMs)`lJcDtLTk9&L}S-E_Z^|n(clZ3FvRJQ(e2HCx>)*xyi
zsm`l;f}szwj1r$KD{sE*;3gIF%%1Z}NQBop;_hyg1{W(g`Ivm^B0EnqQ^3T&+$*EG
ze4uhCPxw%N&!yFFnTpLI#}m=mRe!4u<vU$&$jghNbv4AJPmJA|_~EQSZIIEtQ`8k>
zKOW0mGz2u}Z#*I?;COF2LF+6wNct&%ZM*ID#t+)^wHrUtF_EBdl@%VE7N$qLiFd3l
zzO_!b1J=-2HW~UUMq>(B#ods_4;6z_`Eo+(+#`r*-U>0H#dO=;B44fPb$CsUBBt`o
zmoIxYko-;?7WDk?5kZ)BhU&uDEJw|(z`Vp~0K>TmHAt-p)X~E0Hq>uwyhf^b$6myC
zxy_rzXzttLXk*=KS|XV@G(P@xR93azWG`aa9TXlOo+0S&2Rkf61mDYxi|kMFLYnoB
zj)*Y2v0*SR#C3m2&#$vi*)U<OVoENU{^vc9*$?!zVkd>ub!R>ag`iKyML*xq?-aGK
zb$CM&v9sCz9Q>1*bFi+s6N&G`hahr0e!oXP;CF7*;dm5OtVv_Go>1)PhxO<2O@~&u
zQ<<Isy{e)FFeWL_<L!#QN|C~QUb|K3y1ydobfBTIuyFpTX0hkXb0%{}^YSlW^JxZE
z1MeZ!>O<qSy>#jFaV46_G5TLTG=BWh*4&bx^qSClTL>h@OJXXhf(6S*yvC{Ft_@^V
z|4jRCidcqfJuTsc*Y<Mjs|vR!wIb(^zWT;&OYQ-_Qp-@t3$kwBj`+94&cSd0$c})3
zU%-@c1Q8k%obw;_!-N^$K#Ao5nPl?pE#!(m&&$P-hXs4gf;In0TF%he8sDK1yd4=N
zoXfDz?=Eg1#JzvLqz>a8aIn1~9Qe}4V=|&@^gcmZT1ZNseAm<_Dg#9l^+M5nxA;dD
z_n5O`f6O~vHful8lLzmpf->Zg*-VXuPV+gv)8wHu%?IqF;^s_oNqI8vd|23&mgd%G
zhm=tr*JD6f9WALJ%a2VE&E+7Nx~TR_jcFpR&Mfk#@6r_ju)swu8QSe0?7nXa2+T-~
zytF2?gKA$dIFFV~^gAbA0TWc_$)#hWo!og%GI|%`QVP3op-OQ@r2b84GuQ)r7rreJ
zR5smXVVkQRrOtlYFgat|y}H%VDO@K2e6x%!jx}1Is%PL0>zN{mVNR;?)JQ&)Z@KJD
z-?T(kCT>4Z@ItZtPCA;FNxSi6x<I!6RyIq3pWpXxGt|w^4RR?(;ahLihnC8Hu&t0G
zFm?6tcT6@raw;HDfxYLlc&q!-(g-rM++l5ha>zu(XfPCwbhb(|B`o5&(%NwnoJTwD
zo1#*-*F{=(LyZ4hehFe{GaajIP0Mpy6N?Z(Y8C4C%k^Qxezcs`_)VXVR+?DhjU5Qh
zAw+(DiqHgy1xfRjx(}BF6omNr4Yn(Z<k9@TFfO>t;dH@BCeS-bj54ElWF&$--}1x~
zW)l@KLHW62&cd=rCZ*MLGk1_tt2>ul+f~b{d+H$hhuSd#2CbFWR>HdyDv@yMHf7B{
zd4*r^Y*!n9uWYq*OB6mH6AJNtjc5EZtVV?E@Pi$RP<jiKPO>dH$Qx89SSPW)kU{pm
zkrECNV&|_3GBoGAZegzkQ@x}yc~s+|`87%^DeM`1FfwG`MO67QN>`NV^oumTCXV=R
z2CvR5IqI6ZW<5L+J?$I0xGZ{=Yu|DqzLYH7G%+E<S9f=~6SgZxDrlh?W%z2`rR5Nn
zB4y>f%sg5w=Lv!K(+qg%zU>-c-W95DLajBa;P1E|<pQ!L7XjHD?h4U3NaVHox!Nna
zbavV=3AOI0kM0TDW0}5~0Du8A$sE|{daRVQYjthS|M604`faKeHYc=Q&|4+S`)fc1
zY<Btna5$3G+=D^o)^0g*g3!y;%W<}*%q(kItIky^pw>!GZF>1$N`d*oYnKgX++?YO
z1==BHGl^HXo|Ca?SmrbzKX4Hc5$P)ZHm3Vn9z}a`cXvlA9#XE;GCej{0edr1Xy<Of
z)|!COm4UA?{{mI&94=H*SemIFHo?57O;l@DYBYPzXRk{;=%d?<hZOl^|6J+fZpd}v
zJv3!Z3wLcDH{|K69+H|*2*)OuSZx91$albWao;Te+{12;5hBrMq4K@2jEK6H2Dhm+
z3{^rz$IGR}65E06QTTWLQJdXbt9U5Z>0-_H#-BhJc>ho0>p!RzT=)7fE2bo~)F#D^
z#cF=#$*fg>FVt^(O=1mi2}*QJ8r6y;Yv80Et>VDnVSw|JFYn3c5Aas$`9fsubbgwY
zK5tw;YxX_6^vC8&fK^0R_~aiqWR+9=r6)uwkg^C51|o#D;tAqtvESh1Mrzsd>84U&
z5o|$ZEpQ<2VR?d<Aal|r_wV(VvaOhPeBFxv)GPkfG3J=h@N|XFOa-3I4_X~Lc;)`5
zbamo`+Uvhops&-U3tz@IWm3CN4;zVO#$0X?(JYw5Y9;b?ODpsZha1&at^$SiE~_6O
znx!!quB)oh)2iO@RdRpWFpSoll=UA0npbeYzahi_odxuNK8t5(WQ?mFsrHopX|6jV
zqr?9I&yRo9?9@9m-mfC2MPnoXNU>Wv?8QqjF1$4I{tY7WB8d#Ce|~~?sVP<fxk0k%
z%~FjOV+MGU9J^m|b2Oy}S>%@5cxQaU^A#!wQ_GLW5oT2@X?$iWg6}hS1+DWo<;>)t
zHr>}(>qQPFVy_(J)L_d?*Y4*NBy8bPgA|P>*1Pt`6Ja$EobkqHV?^*fmF$j=4$D`C
zp3%ZQyB&K>eyN)Xso}hU5cL-G+}=|(74Yc;@7ohifn~feUG>BBKM#|(UX89dC-`MQ
ztn)v90n87^8P#bZjrd?><t;n{!>$?i*&t~BmyULsz?4#qlY;|`BmcIPNopy?LDM+R
zu_~&kQ7Gc*6lwcAJ9Tw+pAmV0?RqC-**sHHQp!K%5(1=6=KDQA!DC}%Yil`-+EGa?
zNhIDJ@5`_M$qm-;!w=5M96^tIjbl+TRl<dS{TaD|i#q{p&Z*Bx-6@qzUhAFJQQ!iz
zNq({->HDneCfdID`Z49|gAI_csY~`Dl8!vIk>qckuc3I=Zx#f5qun8VW4*YZ#b1l(
zhy=?_Ycvv!%f|f#OsA%DQSqSZh=fB22g$>TVHneOxm8zCPQYtUMlDbAe_jB7fHnKr
zSH)+Cb5inpTXBXYhjp$Eb`6$HB&3A<gg&T?q1uD&%nrp$y;GOl?64>IaFeUNGQX~j
z&8tgIB7-|$f>)83tBv$LH2x53kp-rx^Xh<M^3&$bp6@!hbh{t9dz+amC*$mgS9RP|
z^Hi=d{l|2m0Ri2Re7MxK^VRNQJ<BM_5|Iar;yE}tu<2r3c$H3BJl$<$>+7$3O^B9_
z%1A5WnkLHaa(a%Td3k{1;^OjD%};%w$Ef>N(yw=A5GtX6?M}r?pdozB9lB!?%d$Qg
zU)FqfR;UlEoRk`j8XE!;OTE1!C5o1lo{0Y@kDbc?l)`Bb7J~UzYSeU(kDnDJ>6P9b
z#ZXHLBjozwOwr8LAl@ex#g)eBbBcmP%bl<q&Gc;32A0)fkp{OpoYQI=&eSRuDp-Oa
zGDtJ+idsItcQJv((hn2+H$wMh<8KJMpE>ZQFX(y87tP!pOc}2<+Db)}!v{p3DBr&R
zvTcFi0%D-3UHxv(qVbkpV^CctA%smQzS>Y)EV3rSrI{X3$9FQ^JIrCWAfRwJ`B6Dq
z7Ng2~SIWIoL_wRtxK)kR>h~Wpa?o${7#-Ib<qFD>#y}dh41t8QNvmD+JUk~$TcTiU
zkJ@yvU+F~3In=f(ds5l*QjP?N!j+XNa?6rV5g4C%jR5!NA2*j{8meN|x`<ey@CAz=
z`bqZlU##1M(ex$*_B$rD{1B*sSwAjJE~RVGhEOdyEDfxiu)|^9^GG><linLdz9$r$
zt7?_h$!BmFXqZk-f8V2HMHs%sG~NRl-JKa2wleonYec~=8WOpAI&n8{$eciZ+1&Pk
zaV<Tegp06(Xk!u*BxE(zkdlo!QuO`du0T3-9KXr#3Tr86=i4q$V`G7_7V-2YCYB^d
zvc`i?FBd+?rI-{ysy%@%)j~S+1O@qar$R$|S|L!iJoPeerl-L7Tav|@-?AKF+&L+^
z_4V<zQBo)usod67R8)HtS&EsjRix7i(k->TyUzn@_f>7M%m>R!GD?c4p-lStBP4ZB
zn;J=GG9T(66-K%scVcyk{v~T|?r93&X!{=yC8eZhHf)Du|4wE?u_?e6+Pu^G<*$Dy
zvFMT@QXWJ{%Nkw|j;prwPIN3Rzw-|0!TR2KhTtI%j#eWJ6Vu<`N<6(vp?sR;@dD&L
zx{@nn5*A0p;Qg(VJHBs|<SF?j^|~$@OX-vO7=CMwNw0v~ebPtV+_I#(x!C6V+!#Zl
z7!A>BCz>}U;cPKK<QKdD#O-0xk}L^J%ONxCzKIFg9CGp;cR<}ZE(%KvPNSc^vJcL5
zfs|X*w%_)yr7&U800rZ;8G3d*IcV;^LMVm0Is;wKKNEC_3X_NzVo;Suse{QDy@JC?
z*L_721+B-1>Gjmf6S>ItMt5F~X>%+sxMbEBviU+=b){l=@~reXbBBkNOC{61Iyr>q
z9o8^0gMv%#{Dz<2onDW0>RCP(Oy=9KcKzearGBZ>>#z{;a`Dj9Bd<YT@trNN@!mUM
zbF-Qqp7L2Y%v{zDRV;e=dAZA=h){C}!k$kb1roLVycAD9PlU1D7u^;W>qx$Y+-}2S
zZBdP8Lgg-J^T~wMhcNFJLlvE@#?!`(EaUlQ@EuE@?Kv^M3v2iB_{J8QSXrx#2cm!i
z>93~fe5iAeLQygeUd``($Qa(l*4!DY;5oP$IJY0h)~I!zsx~_suVa7<e^aPNWLJtJ
zyQM{Q+bk8WApepQgo`ut_F-J`JSaGLs)-s11d53GBQi=g^PQyl_{r}L^yO6=HCu?p
zXT8Q)3ZalCCHp6H#0i-+F6Kb`+(Yj1j1WBMT>K*{D#$Ib+je<uf1jyEuyAyjcr`t%
z$SUvr$8mD*9sQ;s6)OZneD0#IZZ|(Aro!u!>%wEU`>4geBqj8u!PQ3S?w6xqdwl&5
zuZ-rUrib|aa=`5Z$0GpwiuV!CQGfaSNeMjQ3F@7K=I%cj3p&16;L|-$mEO?~@xR$M
z*-r^=`jkt2CrlaZ)8kL~RNjs`9d)?lSZ`%&CPP(nRQ!t?a_KZxI0<RfJ`=RhY2#t+
z^PohRJvh|9x3+eR4fXF#B{P14dyH0x1{=rRLY|_H@pg?@*Q}Xz7zJxjFRD#dd|K|q
z+L|(`#1mf-pHmq6>1x(XmJj6=m~I(04^4wLQb<5h6hzF=p(#&b1f??kuD@+F8H#<C
zSka6WXa1tEa=DS$crZ7BJ%Yfjv+HP#5Hv-oAsh!%aM>qOW|lfoz?vZMl##dC^Z*YJ
zb^4eq&LsCNOtIf1%_NPXJ5?t5zgcjGyiKBRTPMq?ahM39zd1+Vwv^D1D+5(|d3a2s
z*1sboB$UF#VIEvsTAKQXSlp=<)zw~^)h#LRX<6hBhewV%zR^;h%P7tvJdh}hy^CvN
zv8>!WN0@YXz0>C^O6vf*^&gJg{Zkl1PCH*<Zs`K9!?TJ>nkcU@E-o+MU}CPdd)EDJ
zZ-~|TKl^Dh(niu@q?3R-DLHJ%$~A{_p2Vm`NaKE$?Y?A%l8%;n%V6n$9{AXb+u`S`
z<Y4i+ISY2;SVH-XMNaS4OgeglMb7jiO8rYzmRgYfRhY(GM>oG&eCgR*Vx<v2WZq2m
z7;Teg*%s(*%Ab%3Y@7gFeE1VcWNfJX0eUWStM_OA==v3={mzaLhsB%C8+M4hX{>u}
zzC8^Y;g){1@WOd~Y>D6(x13F61D-ewmmu;LZhY_4<d84zx1d^)1Ru_suPl{u>YiR}
zZABEqgz`^b6E3??)Wi@ve#@EZeAJ#`yvDPVc4$?LG{L?4jcih!%ZE@>wvi$jlDv5q
zJJKrDSaDY_T?wB5mO#WpRdo1)wK8sojx6htk#K&gEYx|j+_T4w)z`T>M_jz8ppQzJ
z;WxrLaVcfduZIapCe@HCMpoR~oYtUDtV(rtnL~0B9wWc@!J*y3>EPE9LuX&Ja!q#q
z5|b7WHFAA3(t&jS<h&1J&|$rpcC!<Hp1ftFW~7MQ4=hv_=$O9|L0ZJ+;4O1eid|T}
zVNXccGyI$jFk?jOxg|$)N$1ASHr7=Xe`YMDHs{ZM^}!26zl;VkkvdoSg7E5X6lcII
zDdd0d5sSHD>(ne~NvHQdL{t{xmTPJfSDa0A*jrg0AzVo2NIB>O!u<NZeK|cnZLyh@
z7;#9L#D!ToG5X8|@~huENC>i+;qLyv;Vz<0!ti0ZRq>lyM9-dryaoZiv>*x13@rG<
zwEsHGdQV>*nf(4Qr2UYH-Y0aPQ{3~_c4`6595qHK%nmUq8UIa1Q@8l%kK{{S{{H^U
zPvfcF5yCw01Gs>dX9z5SPQdh+e0U$tL>1+mXWAk{;?_X7Bk5u8&%S{NveM9+UhjTm
z*bknPW<|Tix7g;jRzjL?$tDcsowFTy_ZOyDPoI=87PWn9){0JGzTqt(b@B(_f`mBL
z$WQ*|ietsVS<k_NP{kDTX{r9}Y_z%q5vB<xMstjjVaf!-m)HZ9Zk6xW%8FN`H=>^I
zq}GQtotR~J4(H@_X^{Z|6`R-h^^daXB6ElZkScEI;B~&z;<#QkxH<Fm<m_fpw6gA@
zt}#$%T{~6S$jC^~_eM?YS3bQl;(4uKteiRg+kDClF=Gm=)1|coa$jybM{?-zK0WRz
zVISYvK*O~0=wi)oh8e4VnQM`%oR39IL^nS|W)u+uEk7EuX3IQxBSieVFI0EtW;o0D
zmKZpHgFpsp!ktdL!wAiQz$sv_<BA4r%qA3kv|#NfJ6i~aKPE$qDg%hvO4NwLI=5Jo
z22{+COu4X}p&zN7sr|XgrOr>;qNI}W9n`_rz}^<&rL8sDuiszqkBp2Y$cWR_%=4xv
z{y@bfd542zI2SpBU?WF$GSHE*E8G^(%y*`^jns#W5iZ1E$kx7~$gLW^{{65|r0~tp
z75$LrFOhM|3Q@zY0ecqE*n{2afm!Pv0`q0-HQFrI`aawWNG6+pPL(l)Z7wn;DH$W%
zY=1pNI3Z|gXoZSd;2PtB(r<lzeQoaNh1@L&eHzL28gm*SAK!fz>hV5x_tziaJjNEM
zn!(*6h|S~T&Cqbm=I&H)hqRiMyOD&Lc`M2)Zex?(4d!oJ$X^5%cQXfN$|ao$nt-qa
zXQ*F5(x79!>yz@n+mXBn?(tX{*w{t>`#LO11d(Bv{T45>cP-@rcC<GbzvT})P<BS~
zudaQ1G$*%tV)lD?M7F;$X3MPCStU7b#oi<RjpQ!kr^J*L6rz@rEGh<vhQdVA0|Bc$
znM(j2S#@=FBcm<%bzedf5}7XXBE_ssA<wH{l;W8VSvCO78Dx}yxFQ$tiw)X^aAb!(
zuY*enBtNu`?EQOrI*}|v_b3AI7{7n%V)jcb8^Q)I6vlVq%-W3z%i{a@@8m$Q|2Shn
zVo?p!;@X<;QmrXs0+_N9W%<GAS)hN@RfK{~EO}$6EHM1zpWguWxVB%?!XFTf?#^0W
zyL0}AM>r>q?_YFTPliBOQ-_cjB&T{MA%85Sw8ChM|HGQ~RJP0YhIPsAvY5QRh8)Wc
zwh^rc;_)EWNl00H#nHiH=PvZw<~so6pVROJNj4xN`^@U`Z?go;dZ^6#IvrGchJEzR
z?<G5!tT=e}RTvQ{gsY*^c6qX?hI%2V1K1XcV|n=>PyOAPoJ$fn#Fo)!9sWc9$M~;f
z1JF&f5Kt|ro?pG^o!1IU4)VWen#5Hr;8x*o=I>sa8S9AVu%)-OvMr^oK>Cl{E|RI3
zSr<aI3ut;b_M!?aXke-Tk=lSrF}`~4gR_5+1F%8<e<HojuZV24oL8|CRup2>qJ3dd
zZ3)zQi2#>2*g!yd7UGYjK`Pn*cL*%{A8`ew1^hQA03M|O*zf<#x&FVY^8b$mVju(N
z%ZiIXva%LE;{q(G5O>!W;WWXM0QEL^2)1g$zi88_w$1wiAp0Q}0Ra*c6H_zMUVO(E
zzRNBzKe?U|>2f_zv_yCq@X-`bgo7Xt$mAEuz<K}z<SV;>yfUDTlLlxpJR(M;-U{>0
zZ;|K6>jK#%At50-#b|OM2?2qmKZcR9G5qmS4(0GQJ3G7UD}zX7hJ=#(kWi+|uRF9m
zT1jhVN<;Y^R2Mjo$NcR>#Ek_%s0q+X+uuxDA?Eo5v~Sv2{C{4+IiAIf6;G6vdQ0)&
zGLVI!r-T{}CgjO04cHqG+BEKZ1Hgrx)fa$ziR#nSQ<l$F*x?~U-P*5r+IqEH&d|;T
zVv9UhTV;EaNUR<$k$%8Nb@1xsGQV8C6!tM<F4$Rtsu%B{!I<Lpt2X7M>_%V`Q(Fyf
z1b2TSiL4BdjKuhn{)QB;@lrJwMdJJcn{-T_zkzF8BL)=7Lb~+%#iBx82muBllU?2o
zv-+^KVs=(_W@c;4$lQE?K)%-zUBAJ$MkI;g>rCvnQRf<)zv0=kEBa#^e-$#<I|XlR
zzzi1EnsY8UaQW-vGRwO)H(0~ep-W+h$;qdAJl~nO0XYRFus78iW|+)G03q*GCcwkp
zoy+00>C@wVVbSgF?K5nl>qwA2jg_2?mYnRM$qQV|%x*|p6lO`OMlC{$hadNsTCwKV
zMG9vRgKQ6pr<I(GT<zza-7w@Hs&3Q>hKNe76vIcplEi(&C-vTq(z+P6>1KQ0fr1kL
zt>2RulYhEPuX7I5qof9UWh1MCg0U)vRF+Si)QBI{rSOA;uBMG*6TqBF3fG&Z`IqeM
zjzb(3Y-~&#Wi$rpZv!gS8qzGx&82K`*KXY;O-)S~1ItAoD?Xu{z_gZC{~b7>{QMGa
z1(cl6VPh1<(a|waGLmY3)4S^()i1jIJu8ciRU!Z3*e}E)d`v>gNi}{`vGxTdMqlcb
zMhGgxlrB)DU^V%INxt<oYL@Bh8Mmk7L}7^|%Cb>*nh@|fMuKIg#E`c7$(L=|OYgY)
zj0iI(n7WnMCu(@2@Cv2r!^;Q9f*4t|(G{EI-f5=>tCA0tRyRi$#Igs>Teb1#po!E5
zCYgRrjNADS<@z}EN_YUa&@&DWq63G_NnWHJtc@juz%ddnHh_m2SN{Fpr3csgcp7h&
z)$6PY`&hl~79X6f-rdsr&rE1(bqpFi`#nX$t1)&~hp{^t5<wdIi3LOa)P$`1WMap)
zhLk0^%o*Rm9M*sT#UHT`o1{7$t*ejn;gM&b36%<DH1wQ!w3+h|PvM)57O_`?G+7!x
zzu9D*xs@1cUtcouqG9Uw?rXn^d9#@ntf^7yc(d9KvgKeAqmI_3(BFZMH==Tah3x%4
zSp5b>b7TmII&0FyXp>v{B;hZz)#}Fnonf3LxB+yEnL5hK$_cKB@`h7CI1K*uaISuf
ztjk+DxUQHI<HIHyTlPzKtE$-3O1yg~EU?dHtXA`=`eJh9k01Cc<T??P+aT)eC~rph
zD2^w(W(itqt|h?Cu{{v}val|vWozTl_k+4xDon$nSWA~Ej|(*I141e@TZIIM9<fo@
zq*;w1b=nx5%h^y)toJ7b?-c>rJSz5*i-uJF*RQ5(@P2dt=K1%rAGP=bAb9;^B$2s{
z`<JAVks9mdUh$4H|0b%F=4bNfsdk!y24ElxT!QM{z&@;eknfc?m){(VqnMnF3*_j4
zSt|-Ut7g5QdQ_Kxl}XI~U}#p;TwY44L!KrP&c!ulWhuO;>K*LB_qlA|ikbQE3rn>4
z5;>$P1bO;z8LH*}0C>I{VYQwwr)Os71{QdFJlvk<U#d<gXRxDfs`~RbK6<#M@^~CJ
z?iz-4mU9uO<xx|-P>M{X!OFP(bWq=SRVSFl91$iHr7>C~q|zW)sv4a7k7wbuX3=Rj
zWyBKZc^59ptYYB_{@!LO$jsa%fE7A1B~v!0p<pft$Sy2h33|&`>Lvaa7uBM`rbSa6
z{S{y$B*f)=LVWxzBCm|Z{`f9Df{-;fWU@42y1uStcIhtpW`w}**X!>6popcQzRj9?
z2^sOy*^iu2QhmFnn7T?hkuK}GpdzLv&{AB2x;UQ?d08cmg|lVp_*W8yL|KgyMUGsP
ztb0kh2|h~Bm<j=540$`p%e^CKII}QpX{hcq+yqOoYyXV1jyI=vr~UZ9dMT~?5Y+%i
z1_lAQlY{efeeV4B_H?eG#*c<Qu|dOhLgz`~wPu6%oH+V!Y#(d8i+0mG{Z+B7*U0*~
zZI?e2G#dF_%<e8}NX^=t|6IiHzOS(=6iG^NXnv9S7oQND?NT!)8Z2lV=z9PCYmTF2
zcXeMxfo$R^c~c)>s`lNLtDzCk%GjfmwQ<D34hXDmmb!Xc;NA`2L9F&ixhnb-Dv2D+
z?yk;me=$d&H9~63>*GNBhUm>@p@nRmvW2uhiu&#>mLKH}VI?059;yxXFtY|!lnX~Y
zG*t^1I6v}K<#A@M{1`WLJxX&jrEe<pmI`Uv)Lj+ifzsJ6k|hAUtm&}g0E+}F#<vGZ
zPEnIHBL!ipg^~@frH^C<iPSFccD2XNE({Xm%#nIkRqXM9s?RM<t*>{MKSnT4=K42~
ze(_gyZ7Xj6>5$RtVzbAyG+i~J;&eWLL&_jY2>NDxGd920ndvUIerf4Dmbo!7rGb4b
zM=oSe^i<sDwq0Cy3QVN8Uz=ayci(LMPJXrWcLf}y@BMBPBIuHnlNS~tYC#Z{U32gU
z=-;pe<oZ1!BLm)z&ic4b@%$HNQH*SX6Q=eDf@|x>QIY~V1{JFou^J7Hs#`spkzY7D
z8miX9*k-+35v5&bjxA<pOi9DDWJ*8~idORR%RYp9QkT!2viK7CkyWw+oTMgmH!<Po
z{C&lEWvMoOwl|`ebGA#n4t_ST5p<@0)i2*gaPu_MrFZT0LB4+$#Naz~Kv@S<RP#82
zgOd77!z^G6ZF>(q7xuDob>_G6u2+WEo!b1POIsSHke&yXFTZ<hFtvZq#Ssz`)-9b3
zxa4UutTY|2^jhhDTttVp-(3~wtdT;FHJFy#4-I0TfBJW<M&1uzeD9ng=%TU$`wDLF
z<-Zx|5}8|Bt|IWQdM#Sll3HZ(TQPupES1*$Sx`m2K!_yZZ-2p4BwPBH>}X+L^Q(u=
zRGF-Ezh8&7QU^(mSG@r&&Aby%wHNXfL+BA$ZeyFNL2CLfp=%lQ;)UOV_2e3int@|a
zXEQK1L3bf0?ulbOPCPZNKtHP}(2o=9hm&^zv^-n!E#uLwk^{G0y?uYT(DWdn$zE4@
zcf#aPrU;8rVvRmY`I;ea_Biw0pIF*4Pz2+(KE)D`yFr$xkjoP8IMO*l)RA@EE?Xlq
zSh1Su$rE&+7;OE|N70N|mnF|XnOGJ^e;yXU*r=JUji^;_!_w)va#|kqwu`nVaXCtN
z9x9T45M8&!8iTYcIpd5fAlXmgBna^H8p3RgyW<z%aZ7!i9aiWw8@sUG5T;u3-AV-_
zS#^SRy@N<hVNbRzgYAZSJ}sC(v?9~n6)?W}_gb(@!B0u2M`t6Fu+EwtuWxwiZY&#t
z_y7wpo6T$VrdCph-=(9v6jid0Db*%m3&O@4<W<#yvE#XUAU}rQdeYu&Onie3Ay35<
zZg6&uvA44v{)W1mRKpdh4Jq?Cwr^w~y~24ke-Qyj3Ph|JRVu;v>_Txr>O9&ti#MlA
ze%66VXhQgm&IH6VECUnfBPmmPPVv*7INUt9QiIusPgF)l_nZy+v6m~gm>YT7+~pDQ
zxxA}S?vOg>(qx^SE!V7j4G<Co`Ec`V&$OHu|JJSvt$X^F5bm`?s{eHe>qJCp`k`O}
z<)vJYMQky=<Y&O2@mQ6vy@X@w$3$ijTrZQYvTd_BHcc~jCnANTK^IiBklm@b){L>e
zb6L<K{wTedGSYMkL>5DJrCFkPELjMLy#M?ZDE5Gc(X~_%OsFzZAd^twrVG10osnIQ
zRD4%-`~Il_MkTQJQ}EV7{zzx_B1cEl>8Js@8%lvIHWHg}xl8w6S}9DDIpw2%+u3YQ
zxh9g@8;!Uu4-<PEqr~)n<19lwy679%O5<h*<MU<PD?`~tc^C7v_fl~!{`XgF#9GWt
zjTUahixLzQ*)(s}#!Gr0jN@umbtVk+BwxO~C%IKqqbC&s7n1SVQ}MztHb3yM_%7}o
z;sF!PXzc~$9$0`tuZxs?_pE?PoRoFjd&*0V_AaU9Mer)B)#K>F!in4#MbfT2#LY*E
z;@PlstyBRreSE&BBM@h`r@|OVGeE1~S#rL(=Kod1f3s)PtP{}Nog1nD6ZbM3+(ff)
z$Ns8=jNm{u(fK}lCt@L-NcR!mcJwA7(n!!dWtkqIzn_Mw)Bg7_KoTlzsS~a-_KcbI
z5CRaUa=0aL#$u~j<FWCJ5|gI&5p$Y*%#Q<y4eR=27vVMc>DghN{V*#Ptn(a9oK4i9
zsqBvRf=yo9=8ZL_Iw;PO+MEVXFO7_~J)&bQ6_=OLKLddo3~5xyE0r>>D}=_zTRZ7F
zRY5P^jD-9iCF}0W<bQ4sOm+^16OH?#dd4_k5(;8@`nq5n13tESN;~Zt?O}4~)itkA
ze$rbz3A@iy0J)y(Z=Si0wdtA;r)%%(T>eUex#g7&p9@;G;yurr8Yx2hnGEd4q&rp~
z6}(_^hUu%7b&HJE(V#iY2?9UgQPxV$b)-U-=ued=z@=EmKJZh29j{AMRpIcV_jHxH
zR79BxjJv$XGQC?$q)p&9)v8nJ=YS6xjI`*skIQAx3q5Vp<$N;`7#FHqo9Z1s2Mkth
zdD8l$xeTaC@BDDQl~9Wn=;IBE6{Lu4Nlh&}vlTe}Qq`H_o|l~`DV2r~t3SDoY(K_O
zl%$Ae$*8j*{!v%lHn{dyXgFWQzm5Kqwx`5;BFcTdPe&kQale8e4@N?p1W$4QScI2V
z)Rsb?mXJAY9?#y2M$B74SY^WaUQnL2zoo|hp(!l*RKOc@;3UX-)aI<Se);TGV4b8D
zQCvgo%6u07xPgz=#n^Nb!gV8aYs*1rWKmRTBYCA_G&9#-lNT6b;$<r%Bap5~#MWC6
zO+?fr3VQE$2N)vxn8LujMYZ*9^F;1<qu2}Y_VSB%n#(Ls`yTm>o5d(7DA(>koOO00
zo#_zh_AV3GL5DSRvklLNRm#9?BNPo=Z3%f9hvmx3u^eDU!q&Fy1kD<0=`j9s+XyQ~
zuun5ElVX;JTRqXQOm6kEFa_Hsw<%B0&0qoCyYk*EylpvYjju!GI^=Au2_-{bgi(Uf
z_;$z5^P+@)D1Asgl0r-A=-VkqR2yT_#~Tw^%j`&1*L`cwpv@+_s0jgq?IXDvW2FOM
z)N18t|NX5epy2d55$(Pi`6G)&5#6X)rYed7qlIb)(BHk2&Ef|uD53UrZE*&@sWN5D
z)W%kU&Xo4@-iJ^>mw8xPT4s1qn$WBD*Uv@QBE@q;9OjjoxCCbbdV2cM-3C{*BCWrl
zf#n7>CXpVWZOP2P63UTmlfEf1N5T!=b6cUkN>7meLWtuwFVaZYvcOGWRwp<{eW~+3
z7>+t+{iC^R{311HcQw`{ZJ+YUs;C9`Sv=L{u6-fYjq_pV{`O$Gt9z_N*Ubm2a5~LO
zFCKdLKQCZ_qGOO^Wx+wME>HV6AMcEH;(WWGZKvT?hnfhnC3_O?Hn3<S#o*}U;AoX1
zUB`W2jF}&5vH}n;ajUH9bZh$@Rlifl+UiDMRNmpgUKy1LMtUIW3Q0)2y&YsxKg|dF
z<Q-i)9@rg|@;Ubu8Q9@{xh`#>c=)<Bb02?<iA0p0a%e|7UgO9SztHLeIrrSU*qtS%
z$xLKzupKz%w)nxJ>l6s_v{W@9TxNJ@o~h7bd4Aa~Qbd}`!1{g}lJS8>ZK|!x(8YV<
z7k?FWJ8orY9d574V|<d%D<1qaRyMTrP9Zka+uLIO);G()q-k<xQREwJ3;Mhg<9-tY
zZi8l1@>(<HE~CBEuP}D>ih9;|4skP%jg>|1ygNJU6S|pHP|p-pMU_{W#!2;;!n}4N
zKpS{rqn+vUA<yB*W;ahH2c52h5M9+O+j^3`YD$s9?geHWbz;aua@msO;<z}i!cZ76
zRzh+tnYZsNt@>r4858;i*A0z|#}RyCU0!jR!KXU<V|ugGF$QbnVQ{ZXN_j&At-T~h
zW_1K`h^e)LE@RX;+Z23j8cy0Iz5i)@pQy5tq0NuJE<mNi)15^1L51^X(_n#m>-0@X
zc({=1!);#4W$af+1Hy)2*57|!M^rx23Sy@i>jWwInQiY1>RifR>ti2u&#ub>s~!Cb
z!hZv}cj(UeW2w{I=Ugr;7)*ELmsWT(NE&GeFQ`VG`(GJbi=##Nkz|f9H=C8C4~aaU
z#qZLu2J72rZ1u6oJ>HGE8^tN_;AQ!n>@|>-x$G_)y7Jg5zRLS#OGqC_L%y2fu>!PN
ze&^q#SF4~4y_5fQRn=Je6*tK*bmgJoKF+GizP{2GW<+T}81LU{!>11eHzdyq;$rJT
zQnxKV8g3O4<*KWxUEQtPW9_<ff3EQc=%E9&XDhMI(Q8XRf-b5*x=2Gc2U4LG`f2)1
zOS-3Yc^`Q19dc_`3+M{ta>?&+h<lq2-5l**?Qazm&!?*B=#GaaQl=Ne6lX!x_+E6Z
z{vfQi7uRJwp4X7PH1%b0*DblKuArrwy=sRrR-wxItFhG!`egXqG%oE#a4SUi=QJ2n
z<Isvlva>eUot)UIs<@$2N%z7aV6ULfmz%#TegAxIE|ZOz${%!_wdAiue|uHs-t?8`
zYBZh0ZQ>JH_vaYVde8d8{TA_IWUO$A9sh}-z!GW5%B8?Ej%Vn2e_?N@F(J8lF5?WI
z_a}S*sH^2Ul>xg|ReZe`pQOb@*GLVri3-vQzI2xEm>5m1QvaQ5{T|Dm5LlJPsD&bn
zp)-o)ONUrxBTlr?sTZSr-Y~Qw@Y?yfdK9ss&6j|Q;;BMAS!T?t5Z!1;jOH`({;O*h
zT<FPg?Ee0TOl924#!@Irr~NK*V7&vANrrM+J?05^Ma)UYm|wPB)bF*hbcIL5yi$FG
zEOH>Q9bV?zV{xm(i9v{ZM}mGQmjlX{dd%|VwM)eDmemiSL~`{>DkV_T@~IPD?_Btc
zb$jP0%NC%u=aLR7AQa6xmLonW&fjBYS)<1}GX2%hbO>1mJK)+Er8FyR)ZLx;mgBc8
zj?<wCi_Z+6qA;VnX(chojK<tjGmsL~s?7rK;Ju_PwcaI1!N8^)tc{pnxl#J3(_5tV
zzSk8t<kt1}1@*hCNu2iZ%aMtc{{5!IeXV$RDRYe9i6om0iUw`T8SQjqmtNADo<|-=
zTf4JBZ598^_k!j|BHpsr<coQFwtiz-7*b8Y7vzI?jjl=cj0_#~?d!Twf>vCANj<of
z?1ZPz*B}G{cY7z8iiN(z#4kZr2R*G&1(anCgr-{6Kpb64__cuMc9+Ks^?hothT{z!
zg@?v9bRF;x=12|LJCR-3C%`KUby!*w%g_OWZLPELgSfvYrkV?&6zREykjgANmSM%R
zpLpD!exa9diat+Lc4stwNX+w3Y&d6f*mB)+ceDd#+x7QxM@eRS@af9dqncrheC1}l
zbdY(fo?;0)7PLMknQ!bUioLBAs7-r96Y8=#9<DjFk?kp)Xcpck8lDJU&*%`6?jvkL
z*Ifm6tZH)X_JB0=`=!SfdEiG8JG`=QLic;C@4hWZ=%ou}IzH-nxjCtNQBj`y4#;QP
z?WLxto|J)6LOL=wt(ZG@Sw%GshxbmSpIHtuuCtxXQdjxR0mTXud1dNx39(dFkEA<Z
zu-BNplFB$@B%Yu8@*>sNB3I(3em9n#u)vEBoVHqYl!{9j_d*(6)r*foE3=*KrMDSn
z4fg$safyR=I!bDtHmnE3$Dc*kVQV%8OHE}?k?(`S+l5}yGi#khb?yT#cPfGHV$9|I
z@IfB?5>T4{Hr=)(BoX}a!EWps%V8DneKF0cQfKczr#no4%r@J^2&~Snua<$qY_+Iw
zQ%8Ns;&ezkoJaJ#3Qf*&ILy67Bdr4>#-dBSQ?r~p5cGqKPIohl5I<;}|0yAWrLe1!
zLvvLz45Vy23|8<7$#E;?<TB}Zls!)r=Cdpo@TN0o**=PFUuiw-@2s8Wt$LTV;?1|h
zN$zb_(#dzcg%5nbZvv-JuDPJi%s~cTZb&j!I&$$B8P(N4?k6#&7_~lE{aue!Do-zE
zf$ZjJXwAhmF*MRRZcZxTyma@}hU#`YLDD#wWNqj%rkO@jw5OLV)HeyA--&D^c$qwo
zEA;-M7m72cq6_prD+GJKt(Ye$(1MBHcu6i8;;oYne1O`Sl1DvKvI}z;*(W!T6DREq
zg}e0o(aNG1IC;5biDUO^-66X$wI%9goyP)0jTKAf{T^VLUOP>ANC6BsgzkjuX#Vs4
zk;d}AMkQ!!Oy*kq%%gPjie(<K$h6LnWt6sr3+JrYaC@I7!OIK9%Ut5TpKI2dL|rA7
zuI1OD74T5lgT;fHP}azz)366++&UJQ8?1nlaf*}dlsNxR0Zy>mzETiJcm6~lA!u?E
z)Y(60EYRY8aXPV<E%+C~eEO=;wROkxW2y-8=YlT@3@zk(iGIFJol2ker^~a-WAd!K
z^b`nZlvy*W(Y976^esRG3~M6|)t2e4;BT-K?zv0Hx6{8;wEaL?QAH2*3sTz1fH6tB
zuK3cA`!{dMW{afk6}SC;Q88}}lJ;~TuN%R$=-(NDW>CeUk`nXV$9QFv)Ss67gN6qY
zRfV!uGu>H%)#qP9At$|?D1=pvyP)W&cWHX_eg40S$uq_|iB@mr#0g*WCKQ<Rsu*Jz
zuG8!hDCtrYEPPB&|B&i0kyrSWgusBq1d{wl{O$;{_^w4Vt_7L_($DCiulXvj!6dE}
zxXZLt`=h`6g2cIz3oET>zpnl&zc(M^gP+#7>CiBoK3eXRz_7pA+7P`aUe3;Msnt52
z2CA*n>rBRls>~8TLwj0Q9w}L|aaOb+MO|AiwV&)~`jg9O1iDR#+HQ8PC>~adCS-qx
zC+Kv!0{L$bEF}b|{_=PKJFuTABzDSj^S_3Nw&Kq0@b1Q<h|ml>ykrxV*O{on^Oc@1
zYzXC4OBM6duzM=&(TDTZ{Nh4SoQu?+u{K!gGg)?Q3vDOgv#jE4+Sf3X7GG(Fl|6vc
zc%r}6`$oXswxi9*(}nAIADmxeFY_9YNIwbTI4kHCs?f9apXuHo?wzw}3h(G#gPL2K
zB8D9I5{Gf2r|>hmz1{M%k|InHYm!szE&j5m#x;ke@5-Z<2yv51k>7ILLs9PtL&Rxk
zM=)<`%lbFei1V%WQ2o>lA6o780>!M#TeUO;vjiqPtvvVXqdPtl9_O+yzp>HHL%-ph
z05mqyYx*`v{_9tVY`sk|I5t1<;kLRfJtf`Md-Cg_>#Cov<eprot5u+J*Mr^twVTFX
zE`_RJltA|^p~sAqtLCopH!kD?j;mw7p@_?s$!F!b^D{Ian5M4ni`GZcJI68h_9w-E
zIQ2Jr)3Y?AzxtG(o~#*U-e8%Gsjov_Tx(?cgs(uP4!=zvN6JIKt0{`gAC!_O<Fwx@
zaffzZZ|Mo7(_kc5+k{=dlF}mx0m<gu$Zo&gr{pwyIjY}uwiZ7lduv0)=?}iHOR7o(
z+PyanlZ<?`MKM_FonfsYTtn~OJ<X^LJyGBWHWEUJpRbAy``e^0n0>P4nm!q$>aJxr
zL&baey-z*JpQ^fWCr=&e@Lg}w9Va3*5d~CnF1MK8zCSMiY6@lrsF)wNsm66|+=m%1
zxc3p!nM28NIf@~l1&{))7SD_mD@Hw^;k#AX`gR`USLxL@>H(aVN8*;W-G=i#cJfs?
zwuE`I28;3SX@b*6xvlOgXY0QjE5S#XWpLQL{+hd)L%O`z>-L|2*dI*|-=2ONA#Sjg
zkKgoc8~5AR%Wn{iAkLr1_N}u^+O$K)Gm~q4rr&cJ#kMR&s`M>t=NMjh=%Tu|9;dsp
zzP5&&EV>dyhBbQbj}mW*nc9`)%s9JH5>8rSUaksqOn>P<J_z$&&rh2V>?E&qiIKF$
zsV@vnWdlWJ(=O_Tb`|e0m*W%W&bM9!n2+Cl-y*L>E~A~Y$W)k+q7|4sO*8$;lEJ6m
zh;J%$KSrhdz#?W|X4g1B*#|_t)(j61M}rl*o@ku2bRB(`rO|Z4Twfar)~?!|j}muw
z_A^V=8G%B$ZUkm}!y_V=Y}^p!`EP7XGQNc>6I}=XNV}?l><6Eqoi3>wvF8+g(<<bI
zF~3Tf{j^R4@6ZlM?oa_4_H>CrI;a3+dsdmbNFqq`tL0O)bW+kmnR?@6a9jKD{S{Np
z8gUJ}n3l(>;g#h<i)xi!49*LM6qO#2yZTkY_PW4I$nBW6RX4uNv4v~Qp|nksf^S{*
z&&{331FF%A7W@Zn0X0ha(1xp%(_c5*IL`L7Gmj?B{%$v`^&uzRnoo$w=(^trp4x-=
z5MQxoh(Pcwb4SPyWivZS%?;MM02@XGmep+d0az`~eo0-hfNlGHTMzc`wy-A`*LPum
z5>0J|=JT$ft++IyyZ{_)w)F)3S1Uk1(5Zb;W>_FHKyi1LyGaFVV+rh+Cy$1pPcHvg
zpCFVOSiPR#^dL_Km<-P$wD_k20Z{$MRV_d*6>Yb}DY7#6Q5eZWce#Pm#!S0YT#$uS
z$}^K>#?=V2j(Fp)(bg6om~AgMM=A!$cCB6d59={Cu5rQl*5=n{sNiB{pSzkME3#cZ
zkTkgs%b8<GMveA2fQfh74-t}o(<6)sq~;4dek2R{g}h&@MMXBEN&tGcM$Hr5`36!U
zdif%|;s5YLCIs6jcjfdT;5y|c-oMm}IAfmTt;o&It*)-Fudi=k-HVc%lrJPz;9Ym=
z{@_M&{KnsU5;>(ak!P+v=Os#jd32w30Hebmrx0H1ZJJ!P|4aq|c|Q9=j)_3FY!2Mw
z9C{|Zv`qSiH_OjfL$aioQtN+Sz-!kVsdX;o$!=Bn|Do`}W=z}w{AChKl!dGk9Z_i3
zq76^n5LbfC*?Lm~ij7*DJ#4R@o$7+Guqgsi&o<|eY?JdZG5dgc&;OVW@#^txmS~6C
zdT{Mnt=^m-_3iuPun;ulNvae-WSi1|yAu7~brJ|bbX5n~T-bnLl{H+OSmPTM)2Sqi
zo)T)+YKb6Cxc!T_r4jWVnBP>mkN`FWeu%F;(5ia%YGbzU&HhAsK6VHO=_%>kyT#3a
z?=nCUB#wM>9#+&?d9O(KP1e)%{@h$)Oux0({`ZDJh;}y1XlHJ_w(&3DePO$dhTw$=
zm(!QsQA~e-lLBI!{EUFNth!$g8IGPVlU5G5q0c<rz}<5C11%Ce@EW6(h&GXbSwGvt
z<x1kup*1MDC>$p(ar9(c^q<`UfK*BGDx}K!CGp583MR~^dJkxgN)e{J-{g9cuQ@O6
z5Y2!6<SQtV76<GN#8xMs(}kZ9aiPsB;e51f0oaZuR|MAcgJ+asGgNYiYh}7oT{c~N
z_Az~1zo47|?$0YRid>rR*q2Z8KSPe?21KCn{x!7dLwg0%*>6Pp0z+PYPwS|zW`}6w
zH01m#F%``VdXv7Bi<3CM0{_)LRV!g0_DqU=G&$=^<kVzp%zz8Zf^JCPszNU$znc3!
zOhgOccQs>hPw7fO!txZs4?-2myOS{=Ss&em+kQkj(jD*IqbJdHWhkxEeAbS?S+Un_
z(i}h4+&K$|XSEZ0o^%80K83a=ZSlY#j*VLc{u^AL(r-ng57=1aqs<OyO?X|O{S}`X
zTjc93NdGV9-a0I+F7Efd6#*p$lm;JZ>F$yi5LCK5Zn`_AK|s2@ySuydrn|elnT`0o
z@0s(Sxn{02ac2LcaBX(4wSM{e3TFkK5hqCCU~-lws_;f_;BwRhJz>Xm1u)21TzvBP
z>pv~cNsDGKAG<;?JKrd*Nt|rv0j-8-Rek|UI5YFxQx)YDmoIP0h@uYItje1lKdshI
z<ef(Rim$u-3<bUKci?bP@p6TIqs>)(w~c6LZf)_M1n%Ffs?1%!e1U&1+O8t=#r*q6
z=X}|S-?#1W+!}5X?KI}pb~vJDYbNQ(GR54mBq)=XnO+_x;A|Gnn;bH&u%(pnZy|AO
z-P&^5+{|Tgq$TYhPSa8CA`8+TDn=?^&1uW^EEux+b6gH?&hKxnPeO(rWxEpRIl@+9
zd6b=RJ5oGg92|l$Jxwy6>!6I}+n{Khq@t=GYr-)P?{DvezMi!NEEg#_9;)3wxT+kD
z1fUnaXv~{H2}*-_EcLFjR_UQ8$O_xd!=7s&)c=kdCoXearORoWoWF-1rB>N>*p|5E
zUP$C@>)yZpb$jU=eS4uMa!Yrzri$%*J9KL?@tTF?`P3k#vEPPndAD50V;eM)+vn^B
zvSk__p#h)tzCbi=EG%`=*L5h!i{=}giOYC5hh>(U3Gg_5YD4GB7YE5^E{`p3cMm4R
z=2$I1r<xt%E;OWpjS7Os8LS?nlJ+<&UD{mv<^pJNIpb}ko=1S2v4IhYdH&XReiHV<
z)Yb|Zs}5l>>af8hLyl#ogglFnvk|Skn?WYmhhBAD-Ux?_?z*dk_xH8nvZ44%YrL(Q
z5W&;p<STK_$O-FjI&wp`dmko;k{U@)=J2RAMo~+HXya?A(jMUdoK8It+Xe27Uv}Yk
z5{|O!qa}BE(e2t*twPtfROW8;^oO8Rx(l5SR68UKLIwZc_Su?XNtR5ay5J<zp?4NB
z_%srj&Kpg_3yzn*%UFw!dvRr5Z_MBSsY3)RT@9pUWpyvS#8{Zp@qdJ^uoOK^)sz*d
zrq*W{t1sMA#I76&S8N}U!v!b|&f87Mnpt<$*h4FJnQ$e{q7^GR*A@>THK~4^Ym?yx
za3~kb15!(*z<*$vm_cY-r1G1t93zEzgtSCsGZMw1L=Z4@g0i83g1Ba8rj}2`4;~)d
zuK(gdpbh;E-Ch_;qNyD$XqJN^8zrlpd9z5Mg740X1tdPYZ$U=NVpCd1X1Bp01a-Wd
zu6)R@jBVdRWaReQ`kF$EcDbRcX_v8Smo_aW6PeZQ`TDxm?D(Z<Qid_C+k|hWA}*}s
zi~-$Dg`*~2G_%M0`ukkRjB?`iCZMjbxpNp#aOTJYZ*R83P^k-FtL%VkQm?2237EZQ
zY45o($PQVj%Ag1F6#DfxX+-iM5P30{0){4!>4|iU*#J@8J^7)jN+@1KZG#GvQQ3ga
zsbc4U46%@2?)1U?i|tKQYLJrFetQX0*Anl!&>cw_#KXh-WrKc+8E0vFUE)|^ZMf$Q
z+&kQTnCv`NhU-v0(wrXUi_w7;oON|mxm0Q<$6h$R>_#~u$YEL4K4=(Qrc%+ysFvbF
zd+-bM-K#l@jP0mNcaJl8P^Dj`OF3dXhi9&%PUHn<oa6KH%P`$$xxEYxK(VS2m$2={
zsres>T`h^6Y5I;fMdFr=**9j8x7cn;%YUDhtymwvaYd|03D%g|>?{fhG%GZ#dfq@U
z=J-oe*K~SRbyrIPq1gz=zwL-pf5x=*I6de@ulnH&OQ1<|#;X0$#nZ!(7S0=A6W=^f
zxqt`pD)G(WbI)^i!c;w?m$_Ts+Pq3WZ)3sw^M#88Rs?ljK^_{!eY_HH(92ua*Tr<Z
z3W&LGv&8(_12i@d&-fMTHS+UMM@G%ol%TIUsi}OX%l^JX29Qidj~4w|^se+jJ7B-&
zfPlVwXR0MgOo}^~U^=`T-rgd3;<|u9jIUqP@`j~UsEzg~HWU2$RiX?lG<I?iXH4C<
zP+2e80vgrc`cNt<^m&`zjg{%P`7$5a7ocJ+eV7*@#dp9rtWWK#T5~bb2-Q&~W`~!6
z%eF6>z~)GFA+X5ZkomCwUYObk1mfHs21+r<`1;r;ElzqVdOvXJ*4gaW1}Fn2@k$)(
zM<61DJU;Gxy8_RS7>l|wpoa}J*T+@1={fqiPWvdqd~8eF5P9mV)OfH7xoxoBklx?a
zQLU+TTy&>lHc_gy;|}W~ny8br5K~a@Tw_1Azd(#xfXjeW__$5>mX-O`0<?rRE<T`s
zoDiD2GK+^>a~CA>wNXtTe*V?xO$lWQ$CLIEl{L?@rpx1<?fzYnd~KVGq?Jk#ueCkP
znjy<!wqz6YFPr@bCf7(M7L3t!poS;bOTxA8pTo|Gy(tfTm8?r^`n}cg`TicM+SyK~
zdiI8g-3FeE(*q{k&hVYK1_v9pQuPC$yhcvUQ^R%&jdtwX)V}X^si-G@Tv6Y1$qDfs
zzsAsgOwZ#2lMu5B6CiK5>JFTjIV{41lG$QgP$O>g5<={+;WRcSSl+RK>F;ipq`=vP
z1G=Y^j`}4tO+~hNt3(Ns`%7CQVdUT+mj@9C)2{k^TOl+}w7=xReT7^_O^S{c14ysj
zNP}T!iW=o567j8mLJu2Z?%NHnos^(O$pqI+E7~24?-i;z+T6#7rlrQnyPp2AP~JI5
zZ8Owi%h6k*CO;VQVXt7k?$61eW!Hqxk&X=sIo>j3|J^8%=o=8qa~PhT^+0?#616pQ
z`9@2qgEXP)z(H5VeDne8i}q4$aHMmM(ROFBuJ@@$>IJbf1z<!`eS@%gcnUlmq1|8h
zNk+O9Zyg$PyA+i%xC*Z!uYtuRu2&_uWk$zls%)o9H^N}j)j)2wK<V?a(;hoA+;)uJ
z%8_5*LD8ArRad4|`~Jg)eu<Q1Fw%`!iPFhIe+<56QLjJ8$5lVVyPiO)E{ROKaFvc#
zhe(w`4)dVv(o0%R=mJ^Cjee{IiOtPTIVM^vs{Oed%a)dwHNWnLkVAqkqiu19BK-Mt
z2j|Ar<h)||98zZun-}JY_*={RcAZvdm~7@R8Tc=k&RTwSByArzsWqw^EOzuAcKlPa
zU2cgTN8Ch8th4q>be|I@2$P|?0t!zx_OkEc>W8W8ZNFudsF#*1&N{eA>MkbIYT2T)
zw=phQ?RQn(t_LL1TBnNmixtv|qw;b0_s<LUv6~dJy5p`QEYsKNPAlyH*a^_o#bJc5
zY+qfpy0^4^CNROv%cAI&5M_1!*d%XCy2n7PpDsz7>E*t`(q0aO1wO_|XR)4hfr4dM
z4SY;H&EEdp`6XY048&NIX$ph5iMSDrkJ74%^#D}+r9-c!hcm{eekJA0QX9M@^vE=k
zF&)Bh^M;8%z>#!?M;*!%eW?GTD2u(d=&G;o244F*+l2Qpx5Pu_y6^*?Dw-()sV3f<
znCgCXpCh+%LG`}gQLeyVP*AXS`qWB1F-%H+>r?^{H?L^)v2mWXF0rUu#*T^f($ut3
zVzPHMc1)4L8Jpc`Yurdd;vn$zgEQ34b-V<p@T7a+y5}oIRIDMp^wnS3_<PfB3EZz8
zHKq`2QYQ@LXKK6XjVTMVAwQjld3iXPXBqE;fA!^Thn}4HZ@z@0)=^FI!A!*AbVF)V
zNoBuQ`mun>metVqPm>FG1J@f+xgt>Q&-j6>1f$`qH0nXqXpYHxyk>}a)KbrcEjZzL
zV{VdQqn@i!@A!lH52m6zJ-z#ZJ`3xfg8r8<O$^^fO(P<Dix&P-aZ)MRCF_`-bsSFq
z%y=+5Y>2HX+GM2;V12sLQW_nLf*w?G@epZp#teSABIpGV65VR|AM*r!JvY<cTp$!a
zvu28aq2jQ=nUG|{W1p}*QUtqt)5EoUkwI?lZDeP5>ODYe!sdX8yRDUUe>zC@#-gp9
z{ro)76@Sr{EX8d^kjPAX>qKJj&S|p8$h!+f!_nc#m1O!@QCgf&(-#yR7_}XPaDTq&
zI$ymzIRmZNmS5QZ=(G~rP-nY2x_D`PtJ%f^TSU+4tQ^BK=z7_Z!)pvaUlX=*F5BcY
zhow<N)?Fw$ycD?4DWx55^?n<%)@7V@C|V8Pq~jHEc?1t7rc>BM>vS@e>85~&5n>y$
zh}tXiXb;Y?wkvQU5bA`4HZ_Nqch^DqJPp>DmlrmB+^Sq!k|cXKE<AYhs;Z3_d3ar`
zVF)o3Swrqg!Fa)vj9(qUMqchCj|g^D)deVTOR?YO6<rSFigf+rNVr;$EXvD;SPepZ
z3C>;Yhe=TzT`jUy$o9+^#Cdpd4dr-L`#5q4aflh7Y@u#LKDhX6luhHOnk?>dRBtrR
zf`cv&H^Zpv8ZC#AWx}!#7nrzw{U2%!n3(skDh~?s;=o$dl#!A&l8Qc$nyZiEIF3u*
zCHo=YgOp8>ZCMnJcw9d=6jx6%_Q-J%N>OW{ogQ@PmarVogoQaKfOyl0v+h1W`VTzV
za#JNR;z$E4$NRSLxb(7j#$!W%Tt2bhTVeqb#5(?vMOWt_4PSY|ojT>3*faF={qX46
zf_kv6)F!)r_QTwIeJhR^%a^Rr2e^5U5??FSupPcie%-Ee_*`9Mo&EOP!oRVA_f|dC
z@jBZwwNd<!?`v#`&%5?88O?ucE~ael?@CmkV-GL7x=9WlWI7mq8T5nKxhEZn=N|sn
zkFc{`Z$8;W7_+j?J@}bMa(l9;p)MtUcUF*iF*K$C0UZtjLVE>82)MXDDbn99>>Wpq
zC*^bpS<odsoaT@_RcStr$0!PSscJyf%rnyFuTO_DLZ)5cZPf-C$cbNbr#;aB3|gfi
zyEizMnf!z%Y(E?J55~#$W4iY-hoU?ehJ9kMNpt%rh_il#o%-<jZmon(y0n3Aa>F&^
zGKLzr&F6XNx%}&o-fYNQD0L>5eCyLE#1oY7K(U{nR*?FK9STPNQI$4TuDaXH(~Ir(
zj@>DD%z*NyME28(UDxANCfxP21L6nmflMA)mD8PNl#5m~#jpEI`m8wX3k{>ccrsFk
z<Q}jQ@z!{3&O{(<j1>}zw7T8At~cS4u7s|>nd9Ff()Z3czwo$zawk^|kH<Y^QIc=S
z?MCc)ZTg5(>(y9WrhKmtVoIS<cJ?DF-@(DA_vEgYN`2tBus^PE8l^p4o-m%?+=Y)2
z9CT7WH@-YrS8!(XKMZGOv)G+t7c($6;&n|zmUWJC_|7NCM9pp9+g>sRjYL~;-KAzk
z`;~9i{NVh~_JMugD#6k<X(54w4Gp9(alTEE*Mg1j1`iK!X=#~<Tmy8oSq^alNIz^6
zNRO?R$WG*x8nx_$Dgcwq44b^FB0XD|{qTJe;$ca?8*JHMO6?)QB}S7_<3y*RW7lsu
z{3&;w;RsElsr_4~S&dX`ZM=0x70`(J9d+>GV60_iVX$_qW9>XBde-tRFkUPsYKT<O
z+1z)T&8b(3#*x<aOPP$P>-k-a)2bbNg+$gM#kXDGZ^Lc(L3^TihtvK9)|Kf;_;PA7
z$XGTnSx8}5+Z?OX?Hx8lxZ<ND#I|vc71i3(P*?S-aUuFhoG+3-HDqOZ-Nh!swgsuN
zA+;?ewyeQjW$KPE^tk6_tuB_8JE#`ktDHF!RL$eink5JOWOeiN=1sF(LcM|Pd2jg_
zQuwJ`74<UNnjN1XI6bs_1eR+4nU&J8(!ZE4C_zr%Lr2kPlv`cjw<L81;$N?H|DMA+
zam>gl-DTNw&7|Akn_?^*nVPN&ma{oHXW0C~h;7^}_{H(oM{Li49bZI5wejaf9vBx0
zFImhCIiH^AjwruMps4B=6hV;Lt#j&|r=Kh#8IRKcG470!)!-}>Jdw%hSXG`c+n(Qm
zO>W(V6l86bKwQBb>GG<fgNw*jblYMZ>5{jpF>^T~;kuAI!ca`^7q!0QTH{BLm-P+~
zcIR6r?C^LX>`%1GAMS%W%@GlrXRAyfZ+445;4S1xWl8efk9BqVfSRHDgBG-eMH)G+
z3c{`E#ysmTw;c$M=Q4H=9_IJPV|;>D_D}A7Q~2rz8yu%dNiyjL(3BHux9Vn-SYt8|
z*(>X$JY03bTTCkU<3)>MCdv*D)g#W0hZi3nmXci49C^moL?!N5m3KZsNCQa`TlR)!
za0MQ5=s0)V69-5&T|cl|x)tUNk!pwsZ8rbo?#u5_ZL)aRc9`*#o4fF3VKanE^1G34
z5W7lDqOP2`S5?e$Hx$J-Wj=mb4`R$QON-a(aZ}Qx$!(E?P}PWQ0)3-!mN0D4c67t+
zocETmD&X9HC}f-W_ofOL110B-k02x(N;ByD{ygJR+~Kq#_;|BbR8F9%s3^NTGnwN4
zqMTewQMS_QT<8Y1po@KKHlVI<v+sTIAP}1k4{Fmb>8CC<7|eVusGFr0GvveG9~sZy
zoZu?;u3(u68puph$zo8>ZqK#RBA=<3<w|7G>b)*M3+JH^>LMNOzZ+CrG_&0m0^-aD
zOWZ0zPenYNC4i8SWm;?ZL;K)zm6DgY3t%Xjji#2?*JUno8AW5HGsh<I`&R<m3Ap1J
zxoUa6B1us-C6N<f3Sm5=q<~A??7d0*CGH7?7N_n{3z3mW^!5e#NjMLUSoQaZbA%-&
zR@e&lBuQbUXm+**v<1fcYQ9f?;=JB6<g=yGZJ^t3;vnErZCIvRRXs7Yv|g*EA)^$%
zCcNJ|wu4~G4t$gQUAvjpH!t)R^AmjpWeq+T=M`x>afSn|qE!XW0oq+_fQq4~{Q5Pc
zU*qPPm())LCad|1q|ucDXmwZ<7U9sy0&=`=hJl(hiI4^NF5}#`+eq1=;_nU|!R~3C
zutB5mzaR?<5qIbXZ;ebYhq&K6_nZ1^4A!28I?22p8ZO+HwpW1G5g7aJW%CbcxP3<-
zMk}a`W$B@zJh6U1?vPXxb9Vo;PHB_rp$A=w?cqEc9Q$IEtLxNoi$oC9g@t}UHAJ8L
zR=wnt`=b@(ppk$Tid9P3V!h1NdP__L%Nh%~)1+BcQ88@eH&AiKtt8i%hC@L^wl!Yn
zGc2zWsoHnExBU6TFq>LaN^;5!BT|85oTyCi%B<Sq^|2k_ic*pATabPNcD1RBvhrL-
zUJSgPY?10c0G7BrO?sRw)d`4;Q^K<(6P>NsS7;?n;3>Xan6I#@&)!BWrZ+xqeZNyv
z#|^)(gvn1F7|^ri6?D0Y<|d?NgAo0w!CSHUbC^wx?*r%V3eSPsgNA4gUx(SwjGt7@
z_dUTdbXVFOi#wCm4OiNra?LZ$>(r(O>kZ}JWi8To&{bP+6@xN4(8SRDL)Pb~?(bg|
z$X?$4{(K&f160s`x4v4s^oc2Ict^CdW1`G?0<njlq)9E~3LD|*UcW1ePCr2N;ItPo
ze^}a(ml^)W@^fz=&#D71BJrpjPvOSzSL+YUtXq1HOC)nKR!mEm=G~9;c-H>uP`fU&
z!O<M29V9dMX{Ri84un0|)^TWi!VSkZzQex_&)X9XB~6I9*@qWey)ic^MW@OhL24}R
zVL72h#L8K#N=@G~C5ZjFVg;PKf_DZ;(eYQUcz|q>0n8!`lgBNRf%VM|iwEGBJ2X7R
zWqTAg-S}t6i8ZFGtDOz0uyfejY(UayhO#afpnS5#F~x+%8p!<aK05U9Y*?`2Hb|&h
z-6DN0n>>AA?glp1(?#wJ={r8$y$9xVJxSNVNPck6Dd3GiY&N*Ep6*y<SP2VL2YO|8
zF<!>1gh?>bY#F1T&(+QtDp_i6XYqR+C`l1)#a`~O3i5=@bv26Ywt0&ldZ6WQr}z*j
z6~=ICh#xJvi^F*6Y6%xEW2|hdNp7F9Lpp{c@u8ZvM$+VjgOds!ZcgCazGB?5B$4dC
z>a)sR2bw~4`=d*M4l<p-$QUl+T7TNJGObR=<PaAQL)Bl8Gsf^vi3aAfX@kB&zfc{0
zZce`wd6WKZ!LV_xM6MckF5P?yJNzix*9&Lz2|S*v!omL`rBKBSyCCx5BV7!F6bn(X
z-XZ(O{wM9ll<YvYJvyYN%hwK$JMf9#&6A(>M_D^AxOQb944gU!30VoUDa!aaF<Kq>
z=Ss}i>DYhm;;(HOnHIh@+EJx2y-lQf(29@W<-V!#4JkKM<co!Y-0jeTixET@owoA4
zywP5~ZX?z|ATx&*Zb^fJz8KtK@tppoJ&Hrbd~x+)8Wds9>EVM+b}yrO&xhyBd6;|l
z(i}VGa6m76fCs=Z>;GntZK2m<=vFVsVJAyYw2ZsFzzN}bIJ@>P0Q%gmn)0gjf?fMv
zAktY0+~C%zINOI?9<^w6cHJ?vShj6fsQVj$yd%W^duVrSpEz<o=CILDQQ+#)c>X*%
zBWbj2&}m_DF;;QtOe_!|zuu&8knPars-?9Fg2-4$l8!YzP_#KQ&c|Xizmbp`nBi`7
z@vA4Zv0Yc<TI_5@EiKhG^L(KsO&CC^#&u?WNjwNSoOZpc`+)d0%SVX?vT&U=nx|MW
z@y?2h3&yPro4q^fflZEUosH?%9&Fs(+v|Jojf8j8Lz-k~Z|@9XoXh{PA>#%T0T%N>
z9Lrb2xh7X0x)RldkvRBf^6Ba7=xS{+ir70`e3T8Ebm24Ur)E+EenQXEXjVVjckEOI
zzX<~Z{3U+pvMr>bNVRRPd7Gz}YoHK-t;Azv36T&Gk@1Y!w-xL!APUIj&Dht|(b>_j
z0KhP+&rm$pM%$zaa^aQL<}rmJ?q|v4C9v4y8z$<}euLrnky)JrT|{CCq|&h7f}Y6e
zOkG&BN3WD=$PSjtiw#g6&QwTf${8bs(moCZ511^N&W&?=iEN46j^rlY2|cE67xLoG
zE`ZFB{g5tf0Nj8K(6044#(7f$&p?n~C5J%md#c`)Evoc<M--CGLUrNTthG6cjXJkU
z<+a!4UV;jTWgPKtj2c%eMabqnIfNm;){mWij0x~30Tf|te!cEj(np=s!9~aV<HIPG
zm<gJ9$>;R52IG3UnfGt>-P9!SJHdx<wRIS>A-kq)6t!@5v@uMv6f@t%ihA^wzEY&(
z<tDht13s9yafwfNcmoxkL?VCQ1Y<k%(%R-t{ufJNaUa*5nF0a>JBA{Q@;7|rbvM&D
zRL%{KUS3EHTn)}y0xqZM0X=&M2Q%H5uuIcN?H8B@Dn4BXM$pxPD9%fJdrnKuFCe^-
z^X7DSX{<%+*e0n1JZ9_kq_eF-!PC)56Gd$DvD}PM?N}R+HX#@|Gy=K)0JNj4mEx$M
z4Pj}ivPHwSBd?4xNk4w13M55BL`KIV3F2nggUo<6P0puHRT+6iw=uYxjEdQ<7jFc`
z!sD2Q%sdykQ_Cp~602O3tK2#&>#;|(bpk588`=nk;IxHpsc%I}4CY_PGa(9{nWpS?
z`VCaQKFOz@zi%}VFHFv>ng5j8z`J%VqSUu$d!9YHNSaWP&2~B3Uxcs04p+x9p_g2P
zIMNer`nZ949LEi=hW#!A7$s|#H-WhmhOtcW&~BuMUK)rswlGwRvHR|R54?64X0BFt
zTy=)@5(l4Se`YX&kq~!(_3m|=+%2-4H6+m4r#9Ae9xEFhAleID^~n^mTbrdnqJZ@8
zvERD^QQ#Zb$4l3A@Fz&BmUN3)6%`Y@20v^-6eU1V890P0Sr+`<9S;rB&xwK=!4ez1
zp;6%+ND^yp*PaM1dqW=>{QGS|q_3V!Wv?BUdG-g_h14xmNb3XIiCI?&#otC_tt|t?
z^f<*@A~t>$Iv2AmX?wo<AGmauu_dU+U?zc5MmD{*mGuC`G6eW986EoRYT51Tv<T2O
zx~i{U&}zVWbT*{_Vym&&`I&P0!=wsDY7ui0e$otxp0}^P(L(;f@o@O)1fT_5Hm&b&
z`*Y?63ts`0fWVoUMyKnOS<@yJ!=;P;*)N3I+Tc)vf+M3bbV!DgVuq+vdIUNc;YBpz
zyEy7$9dlM(^u<8ao%TeErO~Cl@mSSkqzjB_36ynz4_Nrrp<aK+bVZSM|GWEetR7e`
zq8hjwqC{Ee@tK<<?<7`v@d?Vf3?z7DMEr5a8l-<?0ehSKG_4CHoWqsIN+e-9le=+g
zNaDzHkTb*DDg5U46vIW|rVBwiAW;xVx;F}*z$roj*-bE!gX(H)P3EePN8BxH;u)i5
zWe9^yuO60BOcpqqzsDx>m^h#Z^yStHg!XBbiG*a{AgmvM7*MiMo@HPiRwFt=x`^!d
z&sRWXcD>70S@DeC+S(c)Q7Xqh%*mS=JQsfLEy|c&Dj$3w`6qSTEH#`B67MSpFkN{&
z#KD+DL+Mao2#c>YKax(Gj>dz5KDv9djPp2mMG~1@zOP(rSonrDCd#qG_~{A&2>joU
zVyQT$r;g$P;JobrgP!6e<PPxgp9}|xN;yp;tG~bhZg%m3xhb~Ba&y!@9c9V{XyNVM
z8W_p3Ktzlyjg};pjIWYZJRG#Hn3)4wn6X6pO$UG$UZUU4vGa^&telaRB01^q@@f67
z`0u0gm<QqpRv>a~a1bf6yp)gwrL&!I;@fm`$S9*HKPln!nTJQ2a$oMPuUl{Q#|Zl@
zR-1b;Vk%))+Lc%>hh7(%&~mfHYvYo;n8BQBmDstbxPbdQjlV@_sx<y1Eq`zAvZQ3`
zu}Kwozk+@v@b)TnDo{@0#m23mz-tUDN9*>WCnnidv>GDwn*=Nuryg%C8f@6IdP3QO
z_BVg;ynq+#5Q-CcvrTvFGyor*;dW<I&DHs6sRh8RhImW$(5H)11<;@dT%9-Wg4YLJ
zs;H31M0Eu8&3^<clSdd%5tLk+pE5UL|7X*y@7b&a(;j#8b(Q~fPOywcw?LwZjM8R%
zY-A6pJKKLsqjmqtJC{eSLpFOTm~EAi5Vz_^233B|n(Q;3x7l7hdv}S6Gxxw^R-q4C
z(9{Nd#xUrG3N8CP-3g{^$Qu<7cVz{kJhg28W^`hj0-83PQVd}W;yv)hoQuLIm!~<;
zQX1uShbrxU@N~5tU@h2y^aJ&QikXEV&QG|ol{+R_Mf_>C94|on`}(tDw(wL9H`*7G
zy9<T|{7_Iwz!1g5$4`ulGrSlFv=BJh*g{ByJ5U@QF^*sJGNkxK&CHfW*p8ijyf1T&
zG)Ork!!{N^h=@GqFzd$`OoQ4+$5_amEp+Lu!~-d&^~&anukN*%>`b|O0Ch5OhuHyQ
z2m}A@G=tPV^!F#HE({W=4(XUL7f!S;6?Z3^foiD47l^FTwXGs~<2hnX8Q2Al^*=c&
zF!yIh)AVs~9w~K|(i91!D^;>+vg+b&#hA`sya3rbL<9M#{b?i{qnl=<Jeew(_?N~8
zFy}WXbvlY#4B0^5nb{lvHqF@7kpsPrZ}#@pMdXLN$(!h&H=r>bu5Rsm2o1z<q!6kL
zs93pOQyA&&9`luFPZU;56+W&;vMKMdkNk5xU6qOhB?7gS-YHnxmU{|7)~^|6+%mXC
z;W83u`hgGxCEs$!qI;v|cwyr_Bdv8IbFyc`0V)@=t^)p!_2*NfTJ<SWE&iOShN#Vy
z)$U5!5}p{DKJ6w+awDsT8~Yhx^b~hZEnR#7+KN6V9#P8$X!Zf=Zr(pxL;e6`@`5_e
zXVnl;as=Q1GO!Gg^8|20T?PP;CAoqh`tKF}H{2Xg@A#L_EA4&&CQ~Nk$4J-yY*iAy
zj%bt1{d2w*#0x)>nV;XE`vwjkUd?_z0stFZ?~M6zQ<0H<Bah&)*)y}XC7l={%lHu^
zYG~KJ0w<{XF$%=_WfI=su^J9I$W&sUJzSpaOEW}T5bv&@HMBfI$gu0>{;V96HlS;9
zSbrJ>c&6tg)yfC(H1)Ka?XLqEM#)xWhZg>^XLW;|W<Y<Se2qp33-xD0;)RsmU@rj(
zEk%BA09^whpU1H6fO+@{6H{FsJ?6EF-gq3vFy_Z!C;N4sw8+J@Pl5Pvor%81S2G+U
zQc}Pz19TLYfeEC+?sx@2<~&|0yk%CyMdfCq(*0r(tIQBRL?S@UfrA0y;;A(Kezp;|
z-gz0d+5Hy)3qArjJ{}s4jAgrfibjfuV7Y&O?^G3gDVfu;vTLKpyY=bwJgvC}MRwJH
z=BwCq$%w+E(8Kc25^Jntk*j9bKBlC&yJ$9=7fuvB-yNu2e_$5=ENy+IOT!WY{3GIc
zKNU;NMs&)h#f7p5Fwtb&dzh?>84adWndsnLmPB|Wtu{-8E7M0EN`yp(Rm=GeFk>hJ
zmFcw>HW1!_RIHFD2zk#HT~aAR5~BJY9N2~im~cUnC7wX{h#29#obd^sm@d^EIC`!Y
z0K-3RZjps=$eX|NrHKay{gMjELbB09)3LDnMGinPGE%%_4Y$;fL%rf`)32TX3H=ZL
zNkHur|D?cIQmpPaRcGPQNResbn;#<lu_~RZvo_zAp1U>GAeGa2W(~J@USNbCPhc*0
z&Eg<lC_#m{J|tfr_W9)c$B8B&*-fD#SGwAhH(eZ>*STLbnZJJ-B@$Fzp3bJqq%JKN
zji?l%pc=jU@5v<u)Za5mAPCsYG_(mm{pdGdz6x<t8NIxb>+2StnvFR{R1x_TYacCn
zUeh5+R%qfqpD}sea6u~h!{%pF`6i>ltsc!c^@6yo>II?&1<dFHhad2dLs^0c&;!*f
z40lJ(5-A<dQ?ZH~*$pjo{e$v}ajAEgt*dd7Msh1=x+rfxbGm4s<SxtR|NAoSs8-+U
z7fQC5FIB(iNF{QIzpJ5al<)32k7Lw}t+t^a*H>5>27mCBP@?3ivz#uC&R#pJ(d70E
zA(u(XynSsrM(-85Nwriw=Dq7CV}M9!1<v?R5usRc6hd6)$wW#@o}t`_a#En^^ZM~y
zJj^riYPgka9`1<0b*U=T0i$E@SBSyuSt_DAC9DQE_VMA}a3S>5?KQvCi!V&x2f3;V
zrP@hj(iY<euYHDAUvG6k0YR|58?ylf%D{K}?{?YIeW>;UzC`Sbsf<?o@5=~p{Ac<t
zrkO~x`V{H3Iz!2FI&-bnfeMqSO@BMT5abAuFkO*9aL-j3PO=LDbh@<1i>(olF*K!j
z%nXzc-`9dXe-H6_X#`-1VNl0B?!c@XK3Q3O9Y+7f2sqm;_0w1*7Sj!$)x_OFZ*)?L
zPBAi!_FHRsf7&I8(h83N2y<k_Dis!YuKjGz5sMP$jIM9o<^6LppyUigpgKw@|Ln<H
z2S~{>dE?f<+Lp}#=^u1Td0uP@0DM7SLD?umxx&MVtdJJ|MMsoMjtm{Xrov|ezozk5
zSYCCogwX&yuc76?LQ`)007#<vhBO)R1;}lp@Z$^2rRgVDn0nb0B*jQdtOn-aNnZgd
z5&3f=ZeRZ=FknFC(x2^rtXB2E?tm~Qi2?-E6^3#EZbVg8HA^C4Z+}0@@qjHv<Q)bE
zi{2ovo}S*{^2Xs-Mu4w#cRB<x5l@be$S5h-%vi}I3|2b>FAo<Fhf|>LFWZoL@)wO5
zMRUr12~pu|Wcb&9<S4hjzxAz72ZO_b&z}@^!nQHf8ZE%f=<i{No|deyXhls;k3hJ3
zYqbi1DFU$V)Ee8aAUxBi`wKwX3NVV~ifZ)Vndf0RzxyP^6`g0b7>ZREDX@-;4mRj5
zAAsL1kd&RUb*eSl1@<5wfBXEn?SvRxn3@6XCL;)-`5gelR>KArz)cd!Lb^3&Ddz}K
zh7_t8#XWN=p7&?00j}jfo7s2<m)&YBkY(ZZn>TC@XZrH;(M(c?YryFXCD4WPRk*(x
zv3^mAC^5ATXEutp{jO{kFWq+v?@FO*wm#jBZNGE86>XRECpZF+N4bJ(f46gP&b6q>
zxj<WTvbXU*q<6R@0P%C|pncoURifo0s;pAHs0}kU3AKV^J1Vq~u;(=o>wp4rU~o#C
zj-rOTe6g&UfjFw<BvH%Jk1Mg(wQjrPxsHg>^LKMwiqAomO_e`E6rtSbx!0~YHWNc%
z@kM0c`V)4V%fZUPz~J-e&(2xeDAqz_rQ=-+gi$m}+e0jfPXPkY?19}hVnu2(Dz;jk
z9!Cxage+0RbReKmqVE&FkFnPkAw(TRXUc##xN5!z79Ju;Af?PpH#hGAcWM0y9P%eJ
zKc;WpG|!F9>P@zkFO|}ah7v2a9I1bAZqXLqTb8FcpomVq3IpS4h&oZ^8=n0^Je9M~
zW#X4k$Pb8EUR1uXM5J_LwXuc?Ie4s8&`|T;U2}*F<@TV?2jedVm(!EauV<JuHvc8%
zJGfvxj*B7Jhp@KgI{^1oj;);Zrs8BZPHs4UmxXk$NY+QHzQq!K=sbmKJ_ewMDMdzR
z4qxg2WpkAq)Tbn4qpvh*F5Gl`9u58UxVNY4!Sa7iCm9*p2Zw;(2mWGH?@P=<q2;%T
zdg_;Nk=a|mg(-71YAnW&C<eSw)l#$5AjYPS)V1s@f+pL_m<`;WD*J^y5h+A@LdhWi
zyob@M(+$&+3AQTa|M2bkue`^_BlHEG{(kn7GGX(uSAeQfW=#~g-Le-35+1vBli!%X
zr@kK<!JJa1<@unr%y|?mAKl`Z9)s{2m3EH5v|<Ehj8KodtNW)<WnL~HH6s~ia@YKS
zI<tEB=lu{NA~)C1W|2!Ik&5j^K6bHtC=-n&`81k4BxI~$TFjuBI*Pt78Zbuh_schL
zqyN1Rl1*MdwxMAYBdc_Oj-v^7BH+ab(Zp4lombK6St@9{(w)%!dGgJWiSQTl1+tHT
za!;CY@Y6>{qgL1@fZNi&9v4Ytr?>r6-TG{YO3yHnOnDmTtgW?JHsjB7dLD|%^=~Wy
zgyf??u1J;gW-2byF=O<Xc7}d&m0EJNNLa=XE!B%vnYawuj6xT4n!gJ*9zVZ9e@usC
z_1hcN0F`~>iPeox-GI)bnF?z#t0X$0mGlc}Xsf8vt$zOI-AIeT67HGowg+=XYCMXs
z9sr1|7vD$cVE|>?CDE~R!fK@0hnP^ev{$c_#{z3|`%k-OMYv!<E0NF>=<8rJ?>mmk
z!7kMjCS2J^%~G}lyAWl}J*p+kmmRU))tIU8g3ee3reP;fOaC)6fW4_?NDruOoh`?Y
zTjcyuVtS*7BiPrk!Pn*w_9p_<GaVNins|?tQ<`s;BlBfZMJCPH7%7NLTX?#X^)^3$
z){@`DWZZJ1R2{b0dcw#f$SEoNt=O&Z-|%lxzt+N2Yg!m1jZiT9EK*&?uB&I|o$>=<
zf*S>e`nB>0;t8KN@C)pCV!oLi5^g4OI#y3PxiZJ%Icmx2i?B3Hv-~Dx8YIC)DM%P_
zZFSOaf18e7$x1m_N2VKKK8Ov>RS9q4_C3D9K)mqPnpS430Y$maJ>~lXfxcYed)RIi
zERs+tEh^2TEbunFs?Thyp?kh$`Ls_^M@P$T+f9s6O;;-c1{F8G5fl^R1IRHo|HMZW
zyWE@COtg|2X-utjr0gV=bs^%hpLJm2XnSDLAm-&aj=rMQMM+FbqB}mRhw`E%IKrV+
z=VAAGyB>L66okoc)gJ!-&D?NIiWQPkh(>iU>n6(TM4phhTmsuyHN{4oV|COrhmlml
zxQrFwV%SNLQY?-VE<1xV*);8{Ap6<4;K*JvG{b$(-)iQ>OlAOg*e(jl=IJOa$NTsQ
zD=Nm;)p6kQ<uzso6>$Sn5|*2T^FVtG_X8jl1bj1Ki|6=)f>VfmyXn-vwM;2O&NLgq
zvx|uZ7B<5*nLr`_slDFYw_;5RJT!x*kjfgFO|G~krF8=fuN6g05A;=s&*sQ-fU69e
zwPcdiIG5zb0fv5o3V-1X07Gl><x5Y2QdN9H!v6k#jq(A<VZD~aHc*j=6V`KfdJ2?M
z5Ds__U|b&wrqfjud~hwZOg10Sn)oNsXff43B;R*EfDl2&Q1I|q=rNz3>@HDX>s+il
z)3algyv>;Y(#TMHv^pWqR)BO9TVi12T98teom60|c$A@>><K74MF~^_fsD{z(oRvo
zQU`(Jyq@fyxY*Las*@l$^nZ0S|G#3T{{PiTdU`xh+y9y9=>OwpoceDefE`<He@fy!
z4CL=BjYG2kzF}emY0$%JFb|-pmGO-XAfqClYSO-X+0q?C2&mostJx_w+6;06dc}b3
z|1zM=1rS*Q<-t=x`wgnBtc)172QaGuKq80B-4zfXMti<Vx5$*Q0HnNRAqbD-<n$E4
zPtKL;N!~CrF;#qxV|H<IIWw1)odA>}Ypr)LHsVYtnBXHANysH~Cs12gj$SRecr-YB
zDxbXKQhtFJG~4ZaOfcO7tY}7|JW0(AhyO=of_j?E_CQ%zcLQiO5Z{gp#f-ssbZ}?{
zNNK=A^KgH;xEmiRN*!j%2FQ(ybWe(=vY1Xs<q{3>6VF%OK=5+N;VIPDsL+oU1XRK)
zq~3v<{vG*Lh-}d8A3uJir5&E1pC5hAD1n4Y>lP&RSYRnZ`B_~*IymJZ4|Pu-FM&kn
z<`ldwlNO#yoF%#@u!VuTr>20xj2KQH2<7a#X8@HKoD&Mkazasyv60P1aqxL{b5sE!
z9N{7qBhb-?Qimu=3o2eltc_0`ETcBS!rlZ_3&fbqroM;1fw1YX<@C@;P7TqrMC=*G
z#viiC_h$s74vMZBpiAyyV6U7Cz|TBC|8Jyu6wT}j2O9%%fGD1Iu#oUKvUd&*iSl1v
zm@V$B%;~9o(lV`=yX|T+XL!+lM8G9i>fXJr(FR~X@w2Ls5wK_l0Tqdb^V&2_WJF$M
zcPhhT$%9fGDxeG!ZTHDJxi>J_&yU+dHia%cYIS8L!y7i|J4fme`D>rFfxrO&UtwuM
ze{q@?@+vO|2L>`8Yinv`K1>0|Ik1k7R`;n(4;BN+UBKpVGGFx;Au8o$C?H^?CW)Gm
zk{M<EgyI!&%_z}H+U==fxru~6DiU+NAGu|hqlQ^G!#l8q;1?>{AI#Qcwoff~Hrfv^
zf5_#mvv>X_Ed+Cmh)&eU>Y@?+PG@{{D`7Vn2fu`MK?5a4W>-;b1KYkoa-b`0-SVzp
z(EQC0FVX%`@+rQL-@E-8IWx+AUkm$J#}atO%BHpvbOzK2Wc(<p{@2Bz@)~~;t*fG$
z4>dbGD~E_ntKR$+Uosfa{rwxjfqT=&h(nHmc1?D@Oqm|b41?6rzKYb}U=$CqgA93q
zw4y!V*p2q;Ytf9@qHl(52JfS~HnB)G;hpcm<iw(WF?4<(L6%-lks6o*ZL6hY)&(Fj
zRy%FL)y~C@Az6Vn%*<~T2*L@DAeS@X7hJfj)>inAA|^5S5~`vHRUxEUBn1U#w7*aH
z8rpwQ=ukccD9EXY@&L~Xy?ho7)~CxyY6hZoX^$J5n;h)yvWR=*d6P|m$}J!<h0kHr
zKR#XofT02DN~TgBT=VJ_={(LlE$3h2g(QqZrDTnlVhp4*G!wZ$z*w?*BcqfCcDW;O
znP=~!1*nNBf0$AR@e-lO)W}A4<TeTvDCX%{Zb7Add?7ZNsFP#wq8TC^O34<ND~okn
z^f3n6#W1HznLI=!bX6<WU*1XU{;zwi_%g5PMP^P|*D5h7=_K}`Zkd|XaR(sVF?uGJ
zL_$mqgcx&j-zl>+s%@z^a&ixv#ZbwuQH`x-ep&MlaFW3?zeNHlC|1e7-J!%5tHf2X
zRr&I+-!kbqGCLx4!Q+BEH)`QZmVRI`ePLYHN3zp)%|cG9uY<?v$6##To=`}*(@iv{
zX<oU#bGoN5tdDo#*#=}x+zf^G&!FNB82PQ5%+JS{nwFOFBS)T+nd2puyRNRTL_BNA
zQzQeIQX-H$@gFoFKNugMKEgD>M<Mafv*#zs#I7|i#I5e9{e6hX%_MzhrXEPQuDeNd
zgmDU4nJD`0MPp}Z)?jknR|LFbR;$pQGJWQ+&3CNCUD5VT1awK%!%EuurxqRVEkC<O
zAn!a^@s>&3KmD5p5{i3L|7yVFuvy#Ol#FHUfk4V8#29Z5W~+t(9cF-&PZXFO+BZ%a
z^jq!zPCHOEhXmK9U?HPFa9aA8*qRcZVJ*F&Vk^q)Ymp|Zh3Ecpz{aTDG)QdSNpfQb
zCPBqIpu-gyw+}~c$WMOzB|wDF3I;47d;1zdKDS~K9)sG>(eZJe#?{=+>>m&nCV*gf
z8+eLv7k>rH`bf67w@D@9fjNlrel!aKhM(+R5GLJE81<LKD^C%TDaxnSarRHg-xanD
zAPfying9z0pfzeTJF%l$@jR=665WKL)zPpWz{^p8e^ahbHudZa{ojnJ?9?I`i%O-`
z%N35ugfEhU3dHJ|JqL{XZ1uZzR>_`wlrZHHn*X$1qqt4@;aAjT6(m2_u+xRO|5;Dn
z#?0ZYmgg;A4&N-tJ<on5=oHP^&d`6luAhe?8qkORa`L{F;l-l%pIe}9sR((#7j-mD
z*}(ah#F35=<1VAwLgTouAZ1naCUH6QG6BmhX~};d0yzaaa2Ym-Yr~22h1}awsc9o2
z+eB7;e|^FuX$2HF@O~7dhzIH41x%k@c1(9a8nIrzx&`g;ZjA3KUYc<YIaONlS!-Op
zU!TYJh)!^{Iqaw79$Wa--C!BDKCG}bmnhTp#Q^a5bT=bW6Z4|t_|LsmX+|qBUUQU+
zsEnQTE30%Rnk4MvKgStCita*c33*Z~SD$u7Or|}qt+B6Xu964)ZzNnUdq;-QI~Q~5
ze(@O03tQeWlp!16u02xE72=X%KC~?A2EQ%ciEUpFnO<bOTx8mnh(w*lkh`}{o%HZj
zb~0IXOd=ODQlu{n=EvKWbvkG!^&a7loz7aA{To=Nl1_svez2Js-zC0ixb<W84(~SG
zm_;$9o9mKDV4l1F+?&3x3~PL_ZTe{Ij*xJc)P%g3J2-cFJz1iLe{^tqiSjZaEIP*g
z`-UloC|>Q6wLQk5vVBip6V$W01i~4=f-9~SFx^DCYu$Ch`@&C`;NW<DZd=H`br8WP
zJLDera8n=b<~{crjU?%DUrJD7gp0ten6W1fXnoerh90^<z5e-lAjTcTlG7x2E8JP*
zsPWi2Pwer)?itT^Kl@%~)16-^_~>*=28TZ(>TWeAY%@aKeKC4_$Pr7eHZIO)<>(q{
zES|YMb2O>0Qv0A6Py9E$TM9I1?)FL(XLu@qopJsQG}*D!vXY6k69-N<KDJ-p$Z^%#
z%B76a;ni8>v%jyQU0thi{P}SR@nn#@v)YWBF0Z>USk95iID}v|7#{198|dKWvhNL3
zbADgv+THYctE;{q?T?mZ+PAa4BOPwLQBU-><!Uc11&_x0aiMjUCHm*X&>NFS^y_Pv
zu9Oc><@y4!e?K!Sxz)qrz9rjrvOZs*;39g$<+?|m#TcLnuW&+zLCIm+br<8HDBgSh
z;%?8C=kR+$s-ja6I`}kR=+5{zPFZ5uw;AQ09<huBgmvZ3!L)`82D@m!e`5j8A?7Qi
zcukxAUD6ZDEIhZD$%B;h=lqY(hmV7JY{#jKd3=x!>$t0`M{#ql5RRUtyUkNej8cDZ
zm=mYY$G*N*HXdZ8kAh&s#~Yc6>-rTGJZ#mMf5QN}lT)Dny*(c1Lf3V)q99_NOQQQi
z%<1v*+E;sP6Z2VF4Pb9^IhS*^h(pz>$7`QsmN}uu%Smifg-JTUkiw<bn*6$-%WW#N
zXu7u#P|h=AM5IOUdGs#CjUSRnxH}6IW9Abb7fh=JEELS6qF<W94)sFf@YpXm7+isO
zm1lUk!SGWq+MN2JdA#+fa!-xssA?YJ^As?g%5?K?YgEY|+MzL^7%H&-BA)u<7iB_X
z=I6YZ#SOPxB@AkemY)yjDa;Ld?uhF)0}h?(OE#wa&`ERBsl+*Kz6zg}z+<$_B63EN
zeZS%&wX-rJ$=g8}r6dUuEJuc-3L7J%ge=$YHr-vO(Gb~kz}3QCsW{f!=#ZQIHSqP9
zvGLsC2M-tG2a)5BZkkOl=}}SPF!9sk<1)*13Re0fkuP;>8m^W}(VXpMCE^^H``<S}
zhI7hD;eK^!%<qc{R~Zd)nx~lkj+s)9cHR!E4E9*Y7xVAmi%Va%^v*4s*vq#T?J4Q6
zD<tH(J2d3ZluCBx0J?<#Jb~dA;Ctur^_E1II`q5O-TrvfpR-u~Ny;hz;FXx|t%YtZ
zufl$!(0sxenB%cwS3IOEdRvu<g@JIAw!R@Q4>lMK4jqj5VW>AhaH^D`by#U`&Q<zQ
zGcUIA*i;@C15FtJflW=3W*P^pCyufAtNGe#HE!l+T$;+P5?r&mu49nLfj_~mXo|3;
z%8ct}!Y2}mzZ0!ub*Jr5okcF96_4K~y+7%Nfar66-9=R>_vTTdB$6DLHSWVSX_&u6
zQh!=-S+G;dgUGs>_azVawOM>w#+MCbhu_xY_Du=>5bHNs()Sz9oJE^A9EsOd-%~Le
zvoGL|d?aiJ9!|n+4@R9RFmHx((i|sB@a{glCeUsr)itVCuNk&(u{()81|75g$0a?5
zEp*kYt)!$3eUst{!P(_=sH61nldcZ$B;OM<Q^k;z^;27HZEVana#x+nVCbrSH?S|n
zH$kd~G7Ff@f}h<xdd7VNM>HA&%IC&;UKj&8+;SUPX}3O#gDS(>-<3%cB8uGTLj!pa
za@dyfTsIv5eke?UW}!~4|HYn7yMq<qsAh@X%ORKk!g!d3y1#2if%p3tSGs<gj#=JT
zN8+SJRI;}ZXgoWA*SjT!$;yYcg-_#Zb=HT4ne~ZTjF6G7ZYxywkALT7yWIR;=vX0z
zbcN^Pp&yw4uh<Q!TooP4OzG?#dFYi>*q{BI+ciPD4Bv3Q^<Fgg{P_cQO*$ObD${Pf
zV2~pAf3w#{>1-`K9iF`L>@va+eXp&{NEgR#+h~`tXU~{-zJV9A=63XaQqU00n$q)s
z|6lO%5%M}s0P+q{X13LIj@tyVSOCoagV^6wCz4aVq#bAwCkc~JD+rOu;)i)QHr%rM
z{H2ordsARS#_fv-qa84bK5cH9n)6J}1H5VBqB`Wp6(1=JMJPAQDAXc0(Q_0y-F=4&
zHi?3R+ExNO2&m)!{t2RCC`dWh_F=6A{sdJ>IQZdn+Px>zd6IORuM(G|M|vmiAzK}@
z1R9$C+>U);5IHMnP^7MU6I))S<mu)l+nd=FBl`uEfT*E2C=)0ifH+Asg6fvt>fb9`
z!h&3Z@}-CbjU`Kw;jpJZ+Y&zv<3q<>SE>mcviGf2dlk)8P9-U6CDXffZD=oZ)Y*JR
zwcHLHKb6f7KAB~l^f9zY6)ThJkwUY{S8LL&kgq52*L*dR&5%l%*1nMPaL2CqOkn^O
z{78c`0}mdb0^MU0_TL2<OihOd!5C)_qjtFj#3(*Op8kOv;fE}vNf<N(GH6LKo>GOw
zJVpoQS8D@$83s}yKv=%Bqn%hRKt6Tp$d}gjV+g+T@%CVOD#3QC{b&m$vJp+R3(`H*
zDbPVA^4=hl)oG)j_CvV$i{uW2gV{j^M;y+lcYvN<Qb&IYS6Z~o@kV+ZmeAJpf%{YN
zCdX)2nDwP7eE<diV~ZX<A30%`(8q`zdrcN3FlHbno2saQ3qc#gpPJ1Q?JUoy6ieuy
zGNY+rJdgr*xb?O3BtE)8K0_~_vdSMg&7$-RKlW&A^{~g<#h|*D&HV`UEr$$dE10qh
z>zOFRJq-{23T&kp6A=rt=px7u`PgsQb_;5qj$EV4vKr}BwM_>&%WKRjbal++Gxd~{
zdS4p7*V!2y=U8_ai{hbt<TeS#UezD>pCkBubu!c{VD(N%@o$kp=NrD~Vo3hdeUGD@
z6HmJgR?Q7Yh^Bysr7U#7ofCqyVW5?iSQL>S89_V2Sq3zS>X&R@gX<%=J%K(#W`I_S
z{L_S%{NBJ{q8M{9Z84s{v~2mEzPrn&?He{ifd&qF2B=8hy+azteaR9#P5u{^{zCXw
z_SWSjR@ZZHUARc?wQ(cj<05ezjAGPhXTUENV$($^IB_aE#sni}b4Jm@8G_hNit9T6
zRT6~?sJK!9!edGDfYNI~8hi)h0`RPonE+yl%@W*|a>5fLTF+Zcn8Vp!w1}|XACj!_
zGRc<>zW+i$gR^eEVZ5g`W_JT&W6~1!bX7n7c4H`DhV+dRuQbz7%BM8N^2UHxSnRRv
ze-$|K1*TcX0f!k&Jb1yUdLg%o?2;GJJ*P+IlDAx^vXAZw(HZ{m7$zJy)$GhIg3ax}
zU07%o(7O_946cdHwK#NjEw4BuWmVF3{5tp~3K!Ga#t&n)lSAZONhAX#ATTuZm2*>u
zktAA{Rz!f$R?aC&0eYIb-DI;zvUq3ff)ZKHZVQdYwAjR*V;UymO<~~+`kNFhe#F{D
za#p8CnRzW}rZ7ijE{fD##zPYnFfxtP#uLB0eO(hts-YBLAWIc+%d9{ZPq<Ms&)3?J
zW@8j|p^AGzLsS|)ez^b5)3wqjG+M{E+rmq6wM_>N-G{qJhP*;RBpj<NZN*|7ao_##
zP*wa%QVlbevisZiVLdLY$YzUjO=<jAhS>Oft2gl*<fJ-5qj{zZGIpU<5+eJ)(lyvN
z=w%#R833>{M+EOQW!)dSiC5xeU!Af;fuK|`Uu)KLC&z-Rwqz%%^4<V*@FKwXEw$ps
zjxQdHQWe$f|Bx!tls8)v(`3OXZw4L;uoWl(-gc=&P_HgaJ*;+MX2v|9$bXg$D9up+
zTVEI*JeZUu__yAP*YKiTakBG{095`;?)07P<EwID><!N_3DOJ~pvtYS(m3?98nv-a
z{#~;Zp^bNW3_KjUKHGkJKJU>O;M4(i6aV{}TLoG^3!)%1XxvN$XxP2#XCQdmyRy9&
z;BWnUTA?j~jQrCvn>*#dzj$60K>7{;YPU3#{3Vou{>RR9ORXv(h?YDa!(y74!JXuT
zgr^8t5J`(b5Dz#wsJZO*dv)MnU@Ly}wBmBE_RCs*typBx8~l?xk8_864xNCeUj1JV
zf71YQjmqw!q2Q<EPCbFSKuX#d3nEWH4l&2S{A)D)&uXxhYZ?R86y3WVpyd`A!^g#F
zPym$;C`$?AG?&y#c{)p=4`5~jzhfeh91c@^dZfHkEfNSoom!_lZ8uuGHvN+Uz`J`U
zU<<5>$vqWdi1&c5oV0X!R20PZ%W1OAqRsvcKu9SFFRZ`o93Z&)-`IQ0pt!njU6dFh
zAwUuW1PJgZ1W2R7gC_(Dp5W5B1!)NGlHl&H3GUjs1$T$Wn#Ns%Hr>$8S-kJJ_uaSl
zt$Y6LQ|H`UyZ=x{)mm%Hm~)Q#j4_^vSJ7h$@SC<jG}b^G9G5xCXF#`coX>xj+{bYy
zT^cm<=3l5QnA~NWt7gA8cj@w=h=4ab(gRak{PFKaZwhv)?>g1u6Rk=U0(KsjhyDLZ
z0^<BD6Qs>w>;S8oo>3M#&<cmf0LwQFpyB}<smEl`ul;4YBwC<Wit-mTbGE`*1s^cm
zW;aPNIF{r8j`oZ+6cT0xExRrq15H=)(mTG;_5B<95%_1sd5i|sD2@04VVBgBYxw&c
zi~8Gkya~+aa|!Adu92Q8Ja4vd<IKDO9;m_3dk>&Gcz-|pkMf{*$*4IuWh)qy_j)z@
zwU026LID`2<pbC6H)g5z+n}P+{)wag#)PZYCaWlEh&b?x_@!rG%e4U>7o0W;Ws!Sx
zPjB9*hyU#%7w`!1`<GQYcS9}a&#{;W34kqTT^oo({iD=3Qdg?&9BNJ_3<FAzVZ(yA
zfoxKoG(BJd+c?Af^y-}Ul|6c=1n)I`2MqYbzqyS6X(>2NtmV<nw_Yoo{Oxdlow`{*
z$-w|k`OK}!$XPcIZm5oiKvc_H8%RTNHGg3&<d97px&vRAG>62IC$|rt#>Spr<<1V~
zrcvIs8rWvvD^28DYSxNuR_Iqimv9F)xvblL{X)9ys%SV1B|Kf>d$UytMBLP~B&gZu
z&G_7OX!KDvXnwj|nDa^EK8I!Z<)OlZZ=PW6jU{}Y{ku)11E%f1IN|(e6WvNE2MIlu
zjf$`klTa!Sy*6)s!@NOVw|712TZ4eKJT{d4gg004ja%Wk6H79?arfnA(eV3W5vc9?
zvyL|rI&nqPB2A9i*ouxvrUnt|9A4|#P70<kpLBBvxS9klPdjIsh)fHquN8mVgpuyM
zyeqAb;^qqwNpJqD6&(K<6%|3i<UV7M*EY^bZYprO+L43;U5cc$yY_m&G&F5$Jxbix
zE`P^+(=q=W3;(LAxx(R!R)6v(U8lCs_AaX|nD6o|r%}Q5jfUt;U8WJ~xkh*FoD$dA
zv7fuKgoNT=ML)5Z3SX&eB>){i#*q^Hpj;84U}|LCNiAO(>W$hCFjT6ntY&q$8cHfu
zoF4YHLoH@AlfWh>CepHG`O0_Fcxl8W<**e<-8{C8;a55%B8MF+eTsz4US3)T`e|%q
zWYGTN*wD~W<{UE+sf4hWrIi3nS+rRVNa_+cl+ntlDz7faG!h7Jo;+m*`hmlB2iU2+
z>2p<V+!;n_XkYiw$jwI&`q#I2$`uhBRS4!;W9W`1mpgi%DtHRP1L#C5<4xpiWZp+I
zl(^--rm*;#d=+b7Z}TfPo4NjFAL+(x<NOB$NED9#kX<x)zbJv)>xY^b@Z}D-d<>%G
zMMvHT_e0Rf+ta;<$Zp05UX#HzMAiVMBP_x#UWo0ft%@`>H#~t_+ewBt!T!bB(KNK`
zwz@A~k9(8FNNJoQeAb~X`a4I6>=oK*rNS_8_{H4Y4`RGmlh|zcc1N1at%aNY{e9M3
z;13swV5}1CKcvM)zYeG68V^5q@%mJ<rJCsQT1uXFt+?;jaPCVmqL0&m-;4L$-m<&+
z<*kpm#Tu*DK-<z`Y%=Llu{k8dBHeWBpEe3)r_`NFm_cdN1|C1mH+3l}0F7k_d+05&
zlfui8H!6J66gl;|odsVCpr=pfAG5;_Xe=n=&5r1*=1pzZB#&*Win4hKmhQ?uUpFo`
znphLDN!<Jn*Fb4V6WDxM09JxG{oi{xbE=QY5M^97*Lm9<JWD7K<}8&p%)T%ynNoM2
z2AVI#Ej%`RJ=q_pNdU7`_x^VH{RM?RgDnR!C-ll&KkIgE1xN#=;rH=kdz(X4FyLNN
zN#OVon>}nt9*6B3Bg>a{(>|zwOeMk0K?l8XEAOiPc%fRr;qik%XOHkGgv^z_Uw)lF
z8qX@Gs6SBQ7!Dusct@8q@{3NlM52gW%;LuC>HTl$LzC~PsD9rR8hKfXp^WG?kC!lO
zn-J#UhjjsFs@D0lFM{dUgT(x*=t|qI>mt7Nk6#C0Z1hFvW%nLeDca&axtA!Fnmj0U
zA{mj=?2e3@NRn<RaV4ZYYs#N{`nBM^=Wu$ElH{*R6S^+ynQHg*y0I!Ja{l?kRXR>e
zldj$f4Z53_Fgyg#aPN(FM{;g2Ps{$oY=}j~T@{5Uuy6t?KdK|%661^qTZkP_?{G&+
z8gMGm*^I|AmyzERHPwIbEijv6%LrnSkrT`EuNUF?$++6P_?r7kxMq!w#`?V~RDfN0
zYP^bWC9IsBDPZVrXquhn>g51Yw&lE|^Nc^p-adpaN$UeXt%7A6Bd{&w2(sVo!dx^p
zmx<zl!Oj)WOdOkkL;+00@5DUK4?EoMSsW`suAJ9P4U=-^t5QAEkw3duvpcw$Tyar&
z1POD54<1JqD+MUUihUaRZStc^LR^Wbr+H^ZPtLQy;Iwe5L>kd*JN7G%=zzY{freu+
zKq0W^a{*)J)i`b3PQykP9W&bNv_dtfV1!Xfe!u>vO<aUGzTZ&LzOdtR@eD7ov9f}P
zWdi%jMo(^;v?llZQ0JFhtl%&XjJ+kUTurgQp{%w9-zDM6da8UhC}{Kf#OyHmOC+1u
z;gh8J`0$|(UDBbXYRlB>9k@z=->rpWrAwlWVMP)5B$+#B+p!ZM4JqOt-1>Y)!b71~
zykJ?u!L**C%G0OFsPvMZM4|*aK_S1_QlyO#5+;w{tv<sYot&O#r-fv@l#9%P8*j_o
zAE5Hb`Kkjh3ksp{X{i?|Lcgzpb#gbpn^!HFcSC<#$4~X%reRCrUi;9!djHXhF&&+m
z_^pqOBaV*e*$*xP!BV<MTnTq)S+f#~qnI|WrTHq&P*0MTg?gA%^A>7A1;@rn_JQd&
zHr*BhI!7moVw)$zhVjhFykiN&Ex@LuA*+4zvL%L0PTs}Kx_kSM2FMnf8D_YvnbXta
z0No&cJM9NF6Nd|Y6Sump7xTA#HOXV|Jn5|dk-n&+2fAz92Me#MXo`+GtANn9<l45e
zm49-3Dzl~<Pi+&wPNli9e^@k=MtdO{b(M64mSRc$EiS)*>Ivo^1E=BsWAERN{~@mA
z3lJ6l{rjIey#E_?ef6@L>f@Ybv<oNHXnKt}_5>X49E_fpYZi#Ae&T<4SGCElLEv8P
z*@C>g+wGF{(sxX>S`5c$8_Og20oOAJNEY#yrb}X{L~4Udgc6tej;v37`1Q#a&Hpd@
zwO#c?snV-IB1{YgGTYFT%`!U=A6EzWIU3yojTi<=HFwlfOIE{@d^%fW^8AiO3q#Gt
zO+gzMHQ=ZyuMnkT*WY*CNn<`gxz;{+w^J1(diF|-GmZZe>3bnxdMDjg!ko|I_%6Eu
z5ejMgk-24|7uiXVPy`II+XDIfKFwpC6lL4mP}uj6OHW9gO4FrS)-LZoSAb7~qR$Tn
zJzzObFv9&%wge-Z1-mzCvmGf~e+F7;w~NDfLVA$bwyZ+B0~<&DwPkaZY${htq$e^9
z6>G&7P8!<U7lixN8quZdwg+oJb>%x#qt;aZi2opTgm#05IGKO3sCi&vm^?ZZ#D!HJ
zy?{`lzM{j{4g?1i-d1C9q#76}G0q6WoaM!|ruFr<cB}>Q*IJwEXRdRDh6dhw0nC5k
zeyE#lILCJHn8DAoBAe(QtIXWDXW-m!mC5s!ZA{ND68oH?;PL%O&*mr>Q6fs7VIcy^
zv2jkdEUk77gi3j`mo9)5ZO9B1kbVl{+DX}ZT~cJ@u_Yq{5zzsoqV+@8dT6}_<6Ro_
z-)cn{lpl^&6?q8Qow%Q#l<|beuh0ChxYMY;e*epGY+5*<eTz4u=zfNo{t1l-1Jhus
zRE&pEX*s`H_Je>eHPOP2x;pzBYt!X@=mxyV?%vL2Ge@)8zL4w53{-bt-F9aT*}1ne
zXhoaVwxIQJ8pQfV3qxF<3Y_s40l?zOw33x13qKw?Y28#yf8oJ^bXP3Z8J!KE&MX}$
z?L3^fTVw2KY`w2^zS~WJxO&AIruzR(>cwpez=Hpo*6Ua^>p7{-ne^2N1M6&~n-eR>
z15v}q<8Jqdv16hq&Smw=3Bdqnf;JT^qN21Bd-b0eeh<KWlAQJ~g}!(dGC!)Wrf2Mn
zm={LGeVZ6I^bWkjPNWM-sU1J;-)a0FtCMzi@|_k%;Ou4Z!r<uHvTMZCVd$NZ_Uh%%
z#1Okij;v(5cHb12RFwXt0BRc$2?E#s#Vwyd-0)Yk6hFUk@$CEqS3DHBed(d#Lc<Zc
zEdEI`CLH#Bvon39_S)PzhJdCsqX$VN{YKCJ$%7Z<@r!m<hih3D<Mz5lvvI`i>_;3z
zF+W?emt~YrY1LP8<vZ}IrrT%NI^?Q{4Zp;!H>L)U=MIB%x{?sxk~a$jC!g%*A``K^
zv;u3jOI{OQ{u)(u=Zmp+FFh-pvr~5C9@o;g)aJ6C>7%EkLVvK-;VG?rQIW*2ci=x?
zZ+7}sVq;9?X};DuzsnEcgj<M2gVGN=Jl^TLZDuCqo$jtJ!bc@zt;yotWlU-~)ZaK8
znWi6d?y%8r{qne%qYG)-;Wu7+W9{~IO;q?g<22&7HZq(ve*M*m(kwyZyRN#??;q64
zcKK(c6bq8RlTQ2Ux}#?9IUsGSHUge+2xdy|H4Ht7BQF-F{Mxx^K6JTyu2&h&)Dvyh
z*upVkf94Pwad|!@>D7nl+9SEApWp~Wp7)l%FwRXK%gW1qEug?H*7hcLEyha!2O$yJ
z!kEAt^_TVTWfPG{Y;Nz=)AKgl%wd!w9K*k7cIk5XSFP{)h`e1vlqH%txHO`McrWD%
zU5w<C4|abtoC`_FdHHz?^`?msc{~9PF;Xn1S?FVhb}$E16}NNFusSO2oKj?JWyyyR
zD$3tg&F52K4N7WnuKhdr0lr%5fNjCdR=e@T?O;XNLC$RJ!1Hu{gO;D6k|~b`U|4E*
zCHe}o(-Yg^kwK=hGn2(=lOnw99h48MJHg&OO+HO6bNY!D^vZy3YuPhkI?`)I^;tm`
zogcCeEoqT&|HPdv+=eVe-+BZP6m(Z=G(KEwn?y|P9%^XDCs=rqVbXgcNZdy+wpN!x
z$B&=OGx6|7z8xwJD&1;`#*;wWa+Fm0gp@gLo{)t`98Ou>De>~6zN^Q7E!ce0OC1+t
zax92j7r7<dmG=Dr<2JL8Qqmc3RZ?wPgtlgQjQ7dhW3=8_7kuUXMHz-ljo+ND@aeKa
zOEgWx{^WO-vjBuu0X>#2<-!@;&GZ;oJjPb)&hHFMoK<ngXg6chjYHb<4R}@g?FCn_
zGHL3;zN^>SIw4i%VK-0`#oe2+3juAdGrUVWb!#d7DCNp?l(?8xsMu3(Dkyjz-Dmtb
zO(&0mUt1##?nd8Zrx*ENdG&{q_E;A@#p|M3d9<fTrH#b7VI34Kbw?dc8biskYW)L$
zbJa`a8h);O7HXAs&2Q`;As<2bVuF2sFZo|2NmexQnI4wv^Er)6>_TaB>*Cw}4ivx|
zl2#f!eY+7=7oAbMww_=d_l{t1dD)qESugih%1hYEm0;aq1L6&^sx4l~RB<$7v$s~x
zUEOo#uFmu(J@s6$z!^)b<~>`Gjwm`xD^zV;D6;yeyFhP8-(IlX^X@Tpe0IN{?uA0k
zvC2cYG8^h}BAw9$(D4-Vlcb?bp=?qSeYiZ~qm}o&)#qIvKXjcdin`ty*HI`T?9lC?
z58b6TrI=V!L?#Znr_%oag;}U9=--)z9$z>VHWmNic;z}MYEgcU0Ts;UTZO-7(Nf`$
zG;Ly5QOkWZE)Wc8c0C+x7W!m4jxxwGw2lY|U+SdUGmLvOn0u-e%&t%x+oY5Byv%V5
zJ|%3L`#m>~W*UL*azYNuB&kjgKOZ`kg_GoOBF#HH1MIjs`;_&C$N;|rM-C5wN!|;+
z6*%8M)O1~j8LE*ldcq5}?ebe)Uh-fIgAXd1t_5Az6jp@lYQ3d^ypj9$`NRg%m5-<h
zx1Vih#h1(+4TMn`^Z7S7-x<<l)byT&N9APnzG0>#&^Oa)pbXkowVZju)@u49Y+8H2
z{=9SHy&JxTL1I<@9ujk(FjtC>yx=~P0Spr{`595HeFs6qFB+JFMkb!X9!1r0v4J+k
zD(psazAvXaJv-e6)7NKy``EqV@^4tc9}c4$Le}QHT?r#(-_U~Ztn25r3^#kBOezJ^
z4iPDNsP&y^QukGh=k2bd_A9Hgq#_fN)7cuW)DA<fi-+ksB>C6KLUVr;2K{Mwh2q7<
z<d}&L&ghJ+nrrvj(Y%D59$<_BEf$<fr2uMA>cLY)z2^tkDQW*l;ig`&y<WDB(Ll*P
z!5_5P71O;hL9_pXxaP&kAH~l@w&43^|IS;3_Whf;22mcJ;AhMpba;_@Iuy{N>D*hF
z%lg4iGDzUvLu#rw<xV`U^n>y*V;29asOUj@*%gPbk_)=O-!6;hC)0F;KbOb+=u~YI
zQBe!y5Wtm7jjZ(;A-iS|TYAB@8W!1)vTH!vnwS&{$tHy{ogNHE#yUG6Q<vo0Hv8PC
zzd8)ak@2KrM_NA-+DXjwTepQvwvw_}qJyXEQB?d|XjzLADNZk;9kl(<<$;FgEfW~p
zv+PChdjAwV?*pNO&#OWeu5K1BIaWJOMdSFLX1*=F8T!lY=wJZ5`YZb;6Zls7zt#Ru
zDw&--QJ#YVR<&h3{q=DBzV&^|8=~N5_{R*j;>|`pfyud!={Uw?5;|9Z4~FkWS+mX7
zX~*3TIg6zOSreKA?UnX)$4y$suKr5AUnBz>a5dG5)8r)+2k$#gWBvoziUaFuluBcq
z+Gr+HGEZ@hOxO`ST`(dTwz^Q|<hTz;s&tvaS{F0S?0}vjw<m@0Wtcu69!?q37i_L%
z@&UZ(>KNit|G#}CoJTeIx9S!jU9Q7CMUFb|bzh)zEuMu@-(9Nrr0V08Vi0M;q!@Nu
zqqCQ(#a>DUVqQwYt-A+dZZ-fJtL;rndd&j>5^Y<J)e&hqOd%Hk@uW=d`Dcvm7y7)E
ze651js`=2jejiqK6uVOwnmB%cJ7TMy4=k__l|=uI??FG`!kza6EDlJj1M0Qgc>aTo
z$bToi1FP}>w42@kUnj*I7;7AFmjCi1h5x!2wp~{_@qUwAL@xGRn?J>qd;ByrC>S(#
zF{;P3@HU4sRiyx;0n?``&+93rp09V+aZJy$n@SKmu`g>FHh@>p|8Xv^g-*LwLdQ$H
zrhgs0SBP49qNy(|Ht_0`BKHR=iNAuJbzcf+zQ)6wP9ACW7+Z6_xW0xtm?g8d?%v=<
zc=&hqZU*VS`oDr}?Y9Ak3HUuG{l_T0%m39`-+RCf8~FXj{I7tV{`Y_KoBsP1I5_`3
z7XRO|iyyK$TRHn)s1?5}5f7KWwe1bkTR0c|onn%3VGeALc!cmDxBzgD2?4Pl*X6z0
zb1z-gIeQW2EKZ>Z2%^-~;^VZz^m~_n=cT}zuI(=K+=i}?tS15<EobxKv`szn{;qRz
z80<s9(^D2NNJ>)hSsX-Siv>7bU>&Px;zbMN_m9U(tPjzrWk?fxAYY)=UpL`)bNR0&
zA3u>6UFp{3pXTFiIPPKDMEcuV?-)4@mQyd)O6OT|aJFvUemjbvaeX%P8LC)_d5F_S
z@ScQ(yd*qUICUgVfB^@mjzU`fJ)65jA<EKC0IG{q_u&&w?|4t;=`!=p<NxFZ{I6Zo
zALxN?!TO{R9m84+gSq?yvnq8*d<u=nUrOnkx39|`wn)?)|C2|CgX8W4jMc3%_xuZJ
ziR6Nse0-S8nr`|)Aj8Mg^vi+%e%v$PP@4)}<YJ?Zge}H7h0t=o0iHrGvf&o=y9P~x
zlzMjn;1hqKz|M6?GzB|ZHi2Plil<`2?zSa*rN{6}gGNnt)ZmMi;}@OPWkR&@ceM54
zYY&`6u8SH!4!3lBJdJMz?$_=tcx`QGYtT4rCPCNvQ*s19khxVlf9_boi&<{^k|*Nc
zIGGmD{i~w#Dw5ND<{~uoL9TB|(kw)vuGRkVJ8tdqbOi`$`W&k5^P{%F(b~mDu6c+m
zDOPy>cXj7aHRjb)q!atm!ISv@V~ME5cs^tBn%dNQ4mThtDlEjw*^zmW%T|_E+EiTG
zP|-(L&`K+0XkOVGPGxVf6;-!uQ7BzBr0X)}l#?e(!-5gipHtf0U4~m_!W!&O1Zb!r
z5Mk_aVT=@V=)$w%S`1vauczX2_MJb^wsYoz#`dbi2hWaCv!u1yM-ve2$;h3{-?4>)
zr?a|n^nIEP9trYa$WqEzKf<#S;o+ZBqGyy<SgD>sZFZ_d@i!@*AP9@HIjkyV;Z*WK
zKDMS|7F-9d=0p7qPXi61Pqd&7Csn09-s#lSZSn)oU(s*Q;_Q0R(v1f(necmXiL(N|
zoAK3q|BaY=$u(M%NNJWx^#CI1WqX=r7`NWz-r)PG0B>54PqD#a;8M~!H%Q8Mpr@>4
z_Vg!Rc_I*b;c2S&bn;=|F8xyJ57$zKz)g`li{*`;TECNjXftH><SNLiPJ5K=Lz2#d
z#jmtq2q~g}16q96oOE?aD{W+dvfO-lfA?#K{s^^}vw%uA_|HpQEd-*@OvYhiw1PN#
z?TiMaFSGo?G%)C=#7Z${qJe~Rpe0yVnlrHZ&}vrEGaD;rF~aj!kypA*1wTnMfy>rc
zbz|h~StC#JOkJaVd@K*oxT@-f;)kPUrjd88?n&BOs>RnctzlTqw{M&ChjD3<aPv{|
z0a1wUD8V*=G**B=p0+VKM21DUeh^lUT!rx*5PFEMjV1SPWT`+2y*N!NkY1i!)>Bg(
z;hx$7IlAnDGhdB~a7Rx%c4%~bN@mH74t`dt9mITw-$Qhl{yn^zfVW**l&=pWCN4BD
zQh=L&3Vk}<G38(|)10dg;>24%3G#K@7)Hm-2jdXO{KDtiXS~$%*S{LwXx%TgN_%H`
zuC$Ha0e9!W1MxI@^<F4fq7@ta>p~BOY}BqGwU>wG+{>zY4*Ng(-EwtcbaG!~@`QNA
zcU*rAV=jMW1t|z}3}rtf@8}G^=J4`tcXP80Z1LCFO^Y&%5F8sbbL}3(wRX?`mf|D(
zi2W&K;(J7)cC854W<9glfLWGfG2<Hnn%iX!-;dRmByvm6-^*OVCt4Gpt?RD$O0MS-
zd%YF-_Q65o7_y6B<E0+MPA_ymp6jS#G9T`5Qd_%fsE{i+;)cEdJ(sYUXwhwypuTb7
z6Z&xL!q;}PI?wYjDk__eCATt59va65yGDMo%dAkTC>1XuN7tQiahOOI9`owb`qD+0
zT6xF9nlGWfV+8vPw)wZ}+}zdK9#;031R1g+7+#4veW)FC8NsOS-2@750p~&~n+tfZ
zv+lV05^~Tv4|i~5sbuG)G98q@rB0gkj(z)Twn`eVZD=S>G{x)IGoX;Xn=0y7ZL4M2
z!(2A7>oAq^&Bd=l$y;$p0`4dQQRL+LH!Ps=<zYz`AJ_q!r#UHX4O=vhn$s@~4}Gb`
zXlx6Wr@VOdxm&EygGE?ZCcmYdUjD_#e5H%FjHaur?fCPL(bw*V*5yH>)b_7+Bz?5E
z4gmJ2=XR6jz<$-g6Aoh$nrj>QR5W?Hk{iyCNCwBm^2k1;s!WrLprWt^Y8<FrC$0-;
zTWRcR4S$u6H?}Y|R_EwOgdbduJ^4bBrmACVeFm-e|0<%vYoojt?=!s-bQD185k#yM
zyWV*1+HMw2lTX%gNl-YDLdcHe5J6;d;urs;?3L@Jb|B;i$AkgJ)pf&b4K|<#__`Zq
z+Q$?mEGRoqLYtYSKekea!MlHoWBJU*qkR|B%&gn1VmQuek2_^d*2mxCoV66;25%6E
zCU!7~Cq|vs(2w1Jc^O?)Wr7JQZK$-jUf0?cIq#ELKxQ%IMg$-7AN`(b$fP}bn4!iR
zqdO;TW>_{|uw|7h?1i5|8Z}_7Q#KFV=V+cYTD~ywAaXPlp`n_MV-u|{dl8lTW>H8H
zG2>dtNAIDmczRR`39xkFC{l=twnvo_iW0u3Ms#%W3t?Aqehg88{_Y$AG}c+6H}QJ`
z8u;uC8ylP3ZBxC5VdS&}j;cve`4ro|k5Xe~CKsBJuu{?|^IvEzpfq+tTZwOy0;6}T
z`*Q_24x7E4dzm*|Urh3%3+^cx*)LG-3^)}@Uq170+#c8sk(JKiq4!9J=`YsQmp4^g
z_2&y@HOQtWzHonyjc<;Fh7CUo6Zzwob{3#e{jfuYpFn8%$=I*L;ca=CJ$Ppa0_Afb
z^LIAp9l%492e3)o8LRLqAD;J9?~i{M=7(2{*w0+NuE=Vt?4uSE2C0_3AUlMsK-KE1
z$wp|me&e`0tLF*Y7IghpG&qSY7Xa2knVQJLU5l<@5|OQP+jZ$%ONDC{PO`H0YF<}k
zUy?w^VtFCd9=a-rZ-jPYIeain2S}oa6KhBO^^pvrBhNP&nOH^kT34fBsv32cs9hTB
z)?(H-N{m_AkGEnOGZ#7IF^%T(_2Rm|I|FW46Dk9+XR(@E{G>5E<I+&YyD9m=PU1D-
zKizEIT2;~y)~d3epEo9GDYAD(^}foQin7X^*cWP*p8f<|T<K@S<ZU$U4um*ycNu4I
z|6)bN17{Uv{g7D~YP@M<O~lK$#=6fDeM^WR4y7q+WcmrMnIq+%&TtMOq|CG6|Lh{_
z(BoItQpWF{PBR@sfU7O;i4xvEJJ)GxIGvB0BYFt)`qt*9Q1-bDxKE+iG@07M!om)l
zk?FDDfy&ziW(^LD>Egxd?`e)9Lpxu-I`B91i-LW4E?X)Y_4{R~bd@;U9NyY1OGmq3
z>o`bvm&<d@B$*F(b~X%^2{MW6JxPj9LaIymu%xXWk#ka4mLMv35@?*5H#6dFT!g-D
z&A8e1K%6m9UC-CeUl8%^9P+cZ$y$LeYX<G7p_qGz7|-8sRJ2s_>`uuxU#m-Z#nL!f
zFFvguX>fYJaon3ho##eqsu*${O4)gV=OK9s5weheS+>hE5ukALD7OAOnwODhH7Z~i
zX6>?0_FZL#!vynoH&|sYfi0_Lzoq9SS9*X8`86hh-ghoXE!4<6Lf%P0(&4i19qOf;
z;$KIFXSsJZAa>)4tPxKha^s->0M5c2o29F7KT2L<7MCkM#&`Fd-4nv?r)ap<LJ~nO
zN17UeumvUx9Gug>%;{;>F*mIm%YxF<7R>p4#0$Px#(LW&Tt@(71r48VHrLVCSQd~p
z%4ssV)e^;Hv7OvC5FCydC$Vf>=gWGM*Q&`6&nIm5p8zX@v-;B03-{4ALzR%_V(#H4
zhusYdskW^ke`2|;rw+}U#*xbfv>C-)`<fr>b{93Pa$b6z{{W#+5Njz!#a{bD*2Af$
z5~!UN_c?tuQwH&_!#o9KNH~c@XVWVY@>u8c2)B{#c)E1=Ts5$zX=oZ9QzEP}i1*P_
z*@^gLXy@+P!}_Z$TE`L^Qp*{Eoq!Rq!z<z_xAO1WJ=@jX=?(piR0Gv-R-Y129_v`!
zMmTN1r%4muOQj~t><KtyEIKV0$V5<;)P`Y)Pxig$-+dj;)G3+TB|6dJA_AQJvz*&t
zF!-twfw2OLj=8zHYZq(>ipp9j5?Pzot4zYUzGRJkVlyx>IA}a<i7ctsaN1yF3-5K?
zZ?0GLj_a@W8%QW|DR_gbRqzjOgOn!!8uF7+ax7GZuS0zG(bi51WNl%?G>=*q8h1~o
zpG+`xJA~mLZ(Yo1`IIoI?L3l#duqg31TdJ1d*O{G2x=l6EPvDEQU(DoDke8VtY3-q
zK<a7DTqRW_g^H8hu6^af6mR*i_awiMCd|jUb1LQGoZJ7s%g{W##zR6JoF$9N1e~ib
zGTrRlT<i*2D_#@k@EUvg<Hzmot~*46<py2BZDNgZR+edPoO5-HlJ?jX!<~!ZXFuhJ
zQd&P%^w{awOjPD&*JZcweSXeicVeq}*4_j`$xs%)AUvsb+2~VX?YC*c_UF{fctw|R
zSPvogdbPP=U*XBRTYWC$Yi~e|>~373dWB6nVK1HP2}MRZ<|^mY7+acAHA`0RVeMGM
zz(1Qu9$n&HBv77+?zbQYHmAz(92~g5jryC@a*Zz<KoKIT(<o(?dUIcWUjg(+GkYmG
z<7o8G`3n4AEAxr&RS`A2@di;|#O?>K8}t+{rP~4#IUW5df*y+ixXn2@Ii2?B&ThKh
z5kMs3cD^^9CUA0ca@cZta6>3NH8pjzIdWJ^;<uPh*5y}(PY`nZh^sx4yW?@<X0eOi
zvK?h{ZfcT}(%?KVbE+Ejv^GT6RjKmlPN0mTbehpPh^ug5Q35Yw0Iap!|CEZYpOHB{
z)+kGJnGxPn)4u1rUuzdLbuLu2$pSh~v^~z<85B54NTgzwI~WWn9P%3=ErllA=J3Vu
zQ^sQ!&W{UG1<Gu1abl%h@Z;C-C8axG4|+Z2h2}3iZD6*B1#d7XcOmps@58#)aE1)`
zW8PL&*fVdD%e|^ESrU-BYN_P(gaqVvUIySw1^>Rj8o3q(IQ$PZgGLp!Pk+&Qq2~M|
zNRv6LXnOmS1pA)nPs|ks2d5>;z*vUPTSw9@!IhayXLAm0Ys1y?adTlVRT;A931Owq
z7OllDLu;mFLuU#Z%?w_Pm4%F2DPt;M)K@;C`Wh1QE{hsxLDs`=R{N;nssTk~6{%H?
zSUSJO)M5`P^_^|tx{8Bi#poe|P-H~m>ZAh9YAc;>7D=+xi;JF9q_0k6HcQbbvIFUr
zLL@nU112TP*@Nz=uKI$9GAbn<SqP;%o^K)Q5%6sr=fUurXK`DgxW#;eRILJz#M598
z!n_{CGAQ2aptAPTf(g{dw#LTJM$aaUed3KOYszYW-_USss)023Hv{^cb}WF=$1j!?
zgi&iixjeY;+s{+i<F!73>1RDFLKqEHz0-(zf*G%+iOHDN|8!GYD=RCXW^+UJZHGfq
zt!OVV^oVKL#xDZ8c%EgO2EnxW&tH}7PN?6Sxw?EQef1|p-U2E`O#6(C;mtF$O|j>>
ztxZQF2^;3j;wXGmA@o-24-fg9X~d}uItBI}9i8;}`1qtGP&4+xsr7O|7h9Q~Emnw@
zPvK#qrTv(EL3I6x$O-O{P(70^6(h<$ZUXAl)izIU{wiUcIaA1;n`rOnmaSMKYB5<9
zo-^ot-p7<~I%z@zdvC6~3tBL(+1wJKPFc$@sjTze7M-W|W54VptIPl!!K?IVD_7cs
zn<g#gef~~6PLa^PUEXKJ$jFF}xW0%`%99U!&c0HRmmdAJjH|h#!UlD`u3E&+%6b40
zrj85^?dL|}h5cRv4592ZTe1MR#x8q;rMi~8Y)o@+X832L_2h@TY;QPN`sJqZWo)o3
zFi3r?tAqcSpHpuHRa1&sH1=C9rq`{@=ndA^z!UygQv(EmplSaXl?#&+$tUj$8itx2
zmYarxXNz=V(U03F=#>>GfLtXUoNp&v1E5hpK0YGBKi;vPK-r~5?K~Na=Ci~Wz2843
z@)RP-IVF<mSpFjMZL|=F47#DFX3=w3G$LH<^N1F&>0?Fl^N?28X<ef5(M@K}SYzGG
zg{<*ZkODKClIh6sxtb3Y<l=%ZG>(u*^-OUOvjS~wk33l^3ZV~Kx$?s&BTWo*;p;vj
zBawVwWxBaz0UK=4-8mfd6Mw>YVwz|Bk2vpwEH1RBCfGs`5N>l>i&E2Z=~_K%`qPdN
zY(1sQ*nJiJUqe<E^~(G{=lzVO6N-j4ZqGD*Dt4QM%`Gg5pFH{AJvV4A%v<()y>@pa
zU1UO&B5>9KnSUmcm3~S|NFmP^COvs(9{0gNFWkNISFOb@9NghC*ZHkOK?Jro%m<fX
zXG*gf`}R=$1jn0F8F6@<Dsy6++I8z^24>H6e0O^y56O>_epT(iH1a}`GFpk?*LAf9
zzr6jho6VQ>FNsXSJkK<_W~<oXS~3)$Dr-apZW01;7T%R|<H)3YVNtVHrbOf%Vp(H>
zlp4M-O|kA;zjyIz_MNZF=;^Gt3r!j9vY2k3z{AHp_NF^JI$BA24;f5vWprz~`8SSl
zTFb&+0KfzMVe1$F1>pFN(CijbKufjf@$543`NlL)*;Y|6p34s&v;cyF^W3o+NTSpI
zyD|o|)E3pvBEH^3u@8&(q#NH+q*YW>^tp}W?fG}%6=o@>zvGwgnVSz_Y!A7-|2P~h
z@Yz6c2`FCU*uPu<7VJ57NN^hmfc77UXK!61<AHCL4XvIzdzb?HiBNRpZyyp{4PQ~}
zmkIEvBvOxX#d-<`{`Ecp{`VyVp<SC>V&sMncoZ^kzqlaBtMK6mL!W@&$`r|5165_(
zEJqb%w)LUU9{~;U0Vu2SXcec0R?RCi9BXQ8nT$UEnyMAMz^{L3rkc`2tKyTQ%|eZs
zrS4wxR*k4#_WdZJOi~j3>JC7bu+R$xBHH~#F#Ol7Q=U1elw?`corL?Ts#&p7<E`u;
zr_OUZ6-B8Rer~d4@bAZZ5~?6XZz@Xb^q&9?y$4E@zNZ7i^!q=e&W(up-0Q<i?+2@!
z`B?~%+h=#|3J4hWJ{~g+2lS~W-ekx3wY}%{hf^?N!Yr?LssaC_0cbib?b68DWp?o+
zLy9pYy!<FBiP$QFkh;5xp=IXycN9C~(o^CG7#w19qGi3GZ+EFH(M7+=&Mri&A#zHQ
zY+14A46)N5Ulkdo%xU79npeggxVaJM3dQBL)+`g^fp9X)GlbpFEkpSkmC<J1KY&7m
ze`*ApKlN7>=6@<6WEP)Yocf-U96<L~6j#p)6JV_-0YAYMFK^x-H9*<RB-I^8H4?}D
zQb>g!wwwUzh!s6mR)>c8Z4SoIsd;xRWVgGnF^01ht9if*fT<xe?l6-`tl8F!{tT?c
zy|JC<!U`OO<&cBly;iU0Vkrx01(`ootn)SIhQ=QGlxYo+Gs)duxbT?W(EVv3k+!g@
zz%E8dcS5ZPVg>aa%<ufFi;=X(cuvjV9}a8@kxqPTEbXd!MG`e&YHgV>u-tIVdY(~y
z0x&YC6b4b&5LoA_5s4W)D)RRxe;~ER37U0LiwUo+Xt{1`dT!fWI^g00RJ%nBfTE{M
z1@Ya5wlX3@EV;8+-GvAeO|;;vOaa={<Rl`5kaPK|Th0dsVfWfoRlv?X06&<Sgx82e
zW2ER6oR{QH`6qW_1XLu3xbC+La5ts`FsaRTx+1^C$arS)girO)0@twp-yDo{l*vgS
ztmZAm*cxlR+X5r|=63pzlVc3j`#qEnWMjDjhI+M4%QMwOPZ5sQmS-N5IcF-g;|D`B
zQT%6f{k$a?OI5A>5_x?T{Y47q1Qj*?cV4Zh7i3MQQKUx3vFnFQ%oO$)c}S6O2Ytk3
zCCnkLL((GIi>LO_QNA#d0}~5l4HuUzHk%b+D~Vl5X=7#CW8rzEOGx8cBO=|t>$LSs
zK|EFwRWd0cekhf}Qc?l|2=vAn9Y$cmL8@urQn#lFDqce%)W*KQh)h3ZRP0^mTYC8@
zIqr5g(#XnC%pFPos;R78Xr*M3t<T#{y1fX1jWt^jlnjRiiYSLeDMh&6&O%C9+1NyO
z!sW554Gn#z)EWAp@0%6Yw=_*V?7p?BbJz75-x86PR@+}3X|Yd@Kb&jkq~)|oZOGY;
z^lph>IUu4zIr>bE&27YCt;<4VWvs8Q^^?x-Zi?Q)Da~l{oxw`CCWIOO(JRmxBT9`=
z_P89Ju1PP`FPlY=uO!qQRN?Ej^-Tc)K~YWd)we1UAwsINlFPh>f*8gEo!x+Is1@d*
zfi$PM-sIAP(#dPK9*@kvl*?wd;Rlrii#ZfI3M6B=<TXgDyszirPz;<V1v&60$%I^k
z%a58zw2W=X3O?j0?ideQ_^lIWG(iutR<ykwE(RJFi7#tCKF==2^yQE^#i{Y4d>cLI
zyB*37p$~IvON;AH)h&9*bjH-amOvn0Gw0ZVMri?s*hOjL9F1Sd+bZCK+wK4Xd~a`H
zdfD@zkupV}D(Y*+^=y{Mq??y6Rw7cIct7cLvy5qD7ilb#n{;-EhqP*_V#1_S-nMI_
z(CGbu6gJ&1w}u+@BmhXuZU@;8U{CCFpgdO2S>q)#JmwKz=xG{ZR-v7TbFrt5iQ`0z
zE?G0okEHs$;bkP2B6}f|gff$iw9u^R=%=sNwF6#%JBh^dOz~>YvkBh1>;yG7Z@WK^
zqnEBipTk(5d5DHSbBdTxUSwn>x{8a{nUPOVI#bW(k^vS^^C`a_Avs4jV#3;cvUsxY
z)IkZ1?<W4c-PpLnl(*Dve5Q&GAcmSt6BsZb@+apjnA3R{;4K_PErf|0+;AFD!~BvZ
z7vX1FJt!cTNCT(xDeE}CvO+J+Dg_KQhqFz$)?l)HwnxD4gx+o~Fs!W`_pDN<3S45B
zZ40*4H0(Gua~p(MxC^eVhlmed-qM{Pr*2yatEv?#KQx68Q%QFIag!T&_v%)abN@Qb
ziR~|cr*vYIhr5dpvz*iL+$jx>Wf#DLU3%l<e-@T4TB}i>WUuT8;olL^Y(e_6@|H`V
zd_QYlRAdmd>xI-$s_|BGw9u(|hXjkn>mWqvWbCtbw;@);%^Kv}zZ9~q=cx~8?e_Ph
zs1yWueg@)o)#D#!ZeCHP3Bcwbmcz`df)YckV?&pZtJh*lljhv^nr&;3f|4e#$dKV7
z&@z|2(?mPj<DBMA2*;sAXAb5sdCHXZ+=WWyXC+rx%Ylmi@r@&eArEJRYUPL1yfpCF
zR8PzdV7bu-IlBIxvV$&5o<87E6>hTFsr1Ja0owtLv~m9PR<PdYc%}d`fPJFUV2FQL
zje)ws%Um8vPb#iS(7~i}9g&4xbH9|o#D>GW=)A@d$>o+~cE3cv8YnA{LV)A!8K9<p
za-EQ%(}Wtn76d4K#*3jTPTXmzMj%MDbjFWE^cmeea{<L&S`2x+*3!g2l|y0n7iPsZ
z(jq30<x~0wq-I)G?O?8XJEu7be`Aq&{hdqhRE@<+gDuF&S!-Wj%|2_uO&I5L;loC{
zW1&LLn^odF1!4sX3b0FEu7Is+n5No!53JueFqAyT{m_ojNv2?4cQi&^!s2$u9i4&%
zd4j^|r$%m+3Ju)dp<kl33WpqHuqPk$psUmrHrxHWW_ogIszEZrVa3Fz@Sip7in?k~
zdYivLdg1&s2hr9kjQ7kC;|I1W#egp(7gJFyx;f3-XgGL;6M|q}k0g@mlg^(z-c?!8
zJu)L!;)te&Gsw?TDl}K*${!%YS~hZ3)3T<RSaUy@m6&)nD~Tm|TE<-N9ZYwOvnMCM
zlIKEkt&SiRWyoW=z$y$>xtVfZ4_%A~1K+!G7{@9)d%%f;B6?G#mx#=lHkSsjEr~j{
z2ZtPLoJ1C#*fF@y&8CQjbCLQ9EKn-E<ht#ELp|E#2F|g`tFNxh&u(8)d`@qykR}K^
zb2oxi!D6L23&Dl4dzNvVE63C0S64%htAk1O7GG@qBs0=@?FxUZsGgcg`F(s&zdk&e
zR-91SIUP(;#H;m)Q#UmuN2s-bFOPvwI#_y;HI99AJ84$T@H8cURX3LUX>O<han>1e
z6}7bV9~K1IX(lR(HKEV2M}&uWM7OT7&4TZ-^GhNQm<3yc)L8Di``4qII`LQz`ylz;
z28-_2!TlOE<C$&22M|3J?W+kQ22|=K)~7M+&>C}7utYMebf8RLyQ7XcBgdutO9?kK
zE!TWI+?M!L%D+4Y68dm6EQDa=E7TM~m}hjno$RCNhzL46Ty!`_l5xFcDDA*}!;#;^
zwz)dNPf&PQa>UdHUSoKPxSq&WBU~5a<l&f$<U^8QmofhMlRl?q$3LgHSI4SO3K<or
zn$v~Ha<D7XFXW9}_}0+wHefvZ#Ec?yn|g+RxoP{KR`rB^yl3?^Wb^tW8_o`PDmryd
zJeW?1znTY>c(^LCv{%h;he_|2!<`|m@SpuQb7y%g{h3wSkFI)%gaMiXFdHHjXOGKT
zo5NZzPKMLAx?ia>xA^ORc7~O^OT!0snfMWnnu(Xb(pd$CZ<HRuP~3BZjxs6`m8s*0
zX6fzgZ;J9O_t-W23&9T~22@nO7{jctRBD9F)k}H~%o@w3_m2xj6aKK#F*2I(7do)X
zPCv}ly|7#t=pUfex(1oH<BgSDAitZ`f5}soh)9mC%PMZF5eBia_q*t6RcJVkG?Q<_
zqV8od$vvY<P=Tf7zIG+D(uLMr4G!{M8wJJ&d+`JeFd4YHv=<7Z4SbUL56AkCSECH6
zX_l|~EkCgr@WvhT(>>*2&^dokpX9jaoaW@D7q^jo+#Dv%ZX4Lp2-&^|I_>ATdXj-5
zLXg5_U&ctCEs#1{u-z_iR5@))F522~#O;5l^uu}8CxXe4<`Ye+pdrd~J{)&;h8a{`
z^8$gy>O{rG6jH`<(ADppN#xmHIBVOfI2iV0aC5%$c&S@X%h&T_+OgJV3%a|LaFLTs
z^5k&PVvGRH8klQF!<7py#N`F1|G|h+S3OZ&f);r3%d5G!I<>3)x%9YHKNm#M??H9D
zk?vGZLLEadIbOZ8NyGva&+;}-fZ9@;=`EaZoG4tO`|A3=F6VjmeY3L?4k@T1zN%@}
z{bGl;Eij$6^tKwZtq2=CX9CjUFm>_EJ8><H72nkv9Gj_ONvf*+HFy%^Kr{TdL0UH%
zYUBnfm`yKHySEM0;H(bt;VQ`eZr|jAsm3Lx#nkgZ$I$jiq9%#JUJFN?Dy>&lr>dkP
z=oZNXZgH7y&h?;F|FgqVH!S3OEqk!3;DPj*vnPv-Xk@)D3KfJOoD;<Ev@UqH^bT~j
zLr>omyRU<+$|7od%PV&D_O2Hj5qGhdz^I;);s#Ka;&}C2ZHI%tdyi4rp(pleZh$hD
zNWsNG6F!H$D(YS7Nm`+$6b(IJsX3Ky6+__ofqB0ESyBq8*A@jUct$zZG-I-}%tn`V
zM6%^}-ki!pK@1G5`zySjm;o5Zn%0^-XH!n*7*Q<nlD$v6ZYQBJjw1tJ(w}TLNhh`;
zXQAHeBA4{oG}*lt5raI<L73H177iWglN++8KW2$wm+HwMw;UO~$RjT~Je)bMLdp|S
zrPw5VP+=IFl*JpL4AQ$3`wIQ(sCxt9#eKAFYFGLqI{p;6Shp<S01)Tqeu05H3m>6G
za}ACA*#MqvsSwv?QpN(;F;+_StUQ1+4^(Ol^mDmf*ITt*--hy797Qw4tA(B-?pkC+
z=G!%xEaXJs7d!SJeeD#m#eU+!Z9l%>g$%fVVZ3F*yh%2HykkFPT!d#jw8JODYA@&E
zvdUKZ<`%;JKSLDvRv|X2R`Fe14T3Y>o(ql=)G>*VPyIiB*lgHm0CPB8ea_ippd#q*
zMy@3B>X>34sM-I(9;-AU;&(R}>g`NN(&L1+b|87!#qp<Pl!ni3&URF_J+f9$$^Blv
z`cr&NE&ND|mGajFVKchqxLIB+MuD7i-Z+ALM$4G0)}V#!XwW7_n>ryeb8p$|v;i(U
zTk%a&<HBx&C}SWv0a;M+_~Y##S~WXq>CERd$QC+G$s-5FQxYBUpFb)Ie45sjn6%CL
z>zWERh5{*zGjxYL&dB#WIADf5Dz_Z#!2o5`e5+UMDH;&mO%?V)v(zrUD*ce+vMYK`
zJ}UZ?GR=U4!oGbYlHSd?hjz-1Bss9HM4R?mVJWW*fhP=Rb$G9+Zm*U4)+wh;EWI$}
zjQ#$f&e2xL1Aesvxh=%k@k`wGoz7)#h3G9$tx~3Ki;8Cks|J&h5{PbEwS{3op;ge1
zi3<#&C7*69_U4&l`2Lidx!fs>kfwO)G~L~#LaOvh<A}ZhLWRAqxY~mT$UQCL2)U88
z=M$f`bzA{gla~Fsg`33oQyVu3l?~hn|8SG%<6LFYV0tZiEV!^1!2nqV)UYQUpy~{=
z_+~jW%$V?MoncoeU0=CYN_;+z1dCJr`70OWOG_wez}p=R_X=Z(%o2T#{k9@VyXkaX
z=Jpl=2#1N5*5H>lp99)*=qGK5br=o1ER4HA+ONQ0V*aR1UfK`wn@YiB*9C{#RmR9y
zR5-J?zm?y3{8U3>tB`1tN`Q`r8}geri#UtVhMbo)-T5xg1qHz;9AW1_nX#T39_O>B
z=`IqkjeuzFT;nnTJ3l(P;R^sLKc=Uq=;-KzT6XgHT=z`u_JtdZYQ90@7(S;>CEMCb
zSR=qS?!OJ}()*yz<rj%<a=W_MXSz&G7}FsZ^>V$bLY3QF<e*r`1w75%prCl2nUT7k
z65Uy<ywz2%S}~Ay(6O4&_2T%kQ|;xNl%$MSis+MNkuX%d;YeBX_ncTk<s4<iuSa(`
zZZ&Hxsq}G6X(*ww`oJRnMobwg-4#TPO(|O2*uY)H)d55k0Cn`3licuUJvD5)7YprI
z94aRLer{?7F{UklCS=n#)n_*Vf%VSp1u4ewDGC-AyG<@9fLO;vet<!jY<zxE=Xdy@
zXMtHh0-qeTA$z0xN9;Rqa^_c|TwDhtdf4hpX|$TFet~r?J>#>7NtS`K8?C3vl^wXz
z9A5pNs+|2_nDg^kGXPElE8MXqF5cNOFF0=mRKF%CmAChSK*}}tqDN%0&c@Kz_E-hB
zkEK^vt-5~MMoX~6>hrZqE1b`FxR=(=T5&`Oxv<<3;Dy=MMcDLEjn88)kuu_X+h;pd
zMdG?1CA`1e9UKmRoS!>pjBK8{=42d9*R<Bw%?mE_9L`ql?<;<bYcG1{p3`96Bl3|o
z-ma0<A>a{pcH}^|7cGhHwyB=fI9ofI$oj_=(+!e1+KRjOYzxpN>g?<+R<BqAqMQjW
zUvDCxnk9~>TVpGl1!vu#pYV%XytU1XPf>SwZ&E%6m~<_d_I)1^XKyiK#-6?>0$*t|
z8!IQt(l^IB1S(3@I7L?4{IxEPfA;{jAcrR4a;_*}7&3UT9uyi`TjL^r9Yp~oXPg$@
zde8>QX)>vmx?@qB00TK|bKJN!z<q9Hl#PSl*%Y}(ktiK({pC%)`$A)0K)S`YUhuKE
zcx@8T*UEjtgf09}D_lFcMITRT3O?MzdEZKr-}qi3_1zH=k$8&p%`lR~JadrJnX*nt
zEx0Akdd^)um&zVm<W<H`hR1}EqB#jbo(E!Sx!(W~s2YaGn@#xE#p(7083QmDrvnq-
zPij<4!Kfu4qHs#ygOymH`$R3*fI=~5TjAa)XBy|Xr89ukIy)nc3=d8GULll5XfJ3X
zR6$t4y?xQ0Wm8mAqL;XO41t<Xtf<`uqHLJL>pOqC7;q4d^AIuyRW&u_-``*+9k2uD
zJOy#pZNw3T&-<G~#Ip&<HOnru`4_!=*KIM~Orq>wY4dvkDv9R9(LK7mG>l$1Ys1q*
zp-_qyPS`8d_nvFOg($>rJ?>|^z194_Za>*mU<CMN+fZIc#+|DvHC-tY8qasVAMtY)
zGFUN|mX^=%bk!dYC8#EVF=ic*4c<*5sB=orej)xG%cXQktrZJvNyWRehST@EN9ES?
zQBhIAB*jX%*a^rczFh|1w?1rMN9rRA)RN=WNuAl<o7p|nJ;@sT+AutBj!^*FHo^@u
zoxvNLRqeF*IuB@6Ui?f+73k2Lw69W5aZp&^`C(w;yZBbI>|8mHgk*-KKw;R6r)P%7
zDck;_FQfJYbZe@<ulZ}q{f?GCDH|jdrlVE;b!_Rkk6N+%OW>P0nY_SQL;&+r(L;^T
zjU1DtX^!8VuGT=3kdek|kaQQPE)*1?-#@iamH|YSnfB0wsZr@|vB}X-Q@WQxOpIrV
zwx%1;nY&U#7>f&I7Z^?|A7P<$V)K4<11}n)ewn)kX|VHIZ%i7Mc-26SP))aCgDRAH
zl&m>&rbE-~DAY<<4xeHVmG;)7^fYlgRR?K#D=XE%o(r(JNe2fD_$Q{o#x!B9%Hcxd
zU6+=m;>);crW>cqkih-QSW+@aOSMJilJ!J-rk-#5GiiJ!ZqnIZ#SfJnt>jJgu0GJ~
zcx1R6uE|LL9r1E4%TV}E&2G>M#E)pq4_3ND0thJS(b+>8(g`H9VY3>zyD2iHW$?{Y
z1@4<`f=k83+rG7hde@I}AA{SdB_U(}Q$_eg{4tA~b(X`aU4A_hCdL$0;wY3jmN;-e
z``*Klq4aRFd#C|k<u?*3)f+$jPWUMtrk{}{%PFw+kMW&9W4`FQJV0TU#@kMqCixT;
z97xEf`R}k459wAm^_s=<vud>H^{H0H%CpSJv#{om%MSN(%!S0WXf%#c7vo1rTXSuz
zQ23ZBR_c%#G%|nR=P)+e4!6`vZ>`DiUv7H4CodqrV>4VSTI8uHE!MTOxluA}c*w<0
z_m<sDLGL;I;BTVLx^03<JMT+vUtv3J!?U<)-Idhrw<Ao&P-sr@+%E&SjgVFk{Yurq
z7ZW>tGUj(=m>$*JWyI~&YH02@@e)*Jq(v25QJT$HEm)r6`K(m>pYhpwadbR?c@;vc
zs-Bt~Sg6VF;+Wg5+GOOzZMWT>^F-yI2wUW|vMdL=xJJoP68|{DkKS#&=tL=}-MWU|
zOXtHE$n<38erd5doA9<snM?FA4_j-#<NxUG-2a*0<2b%fC&W1}ozTVMbZW^CcH~mW
ztwO@wSxz%_ij9q2wo<c&BDW4{*ig%5t}{Agn~Yp~n09u)Zn;z_Bx7z}n2@vcRsX|z
z{{!z|U!TwG^?bj|MZH`Vli}cA)&PtunyHiBdTuOXYWrOdrxBQ?m_LvYDU&ruFiyE4
zifiVN)7RffR3;=%rl(akK{HekM&$#ndFnfxIxvj_Ir;pP@Z0fB1R0^?w`9mZYGtjP
z<qo&*2&pG6=PMw)$lUhe0s3|^j7gsDAu1=kXcVW<q&D}*CyyP}^n`=G<A2&lA=!3i
z$c8nQr&kJn%u&DSY{0C`o9BaDP?eae-P%rgg8|Fr<I~oyCGAW#bUVwO{vBhNIE|Fi
z86IdG>2YR5x634@eeuJd8^pew3!JMB+I&Q$St#!2f`<IUx~osod!>k&JUI-Hm!wIv
z4IGj0HCXy9u#GRq*CkSmYFn|cPCuL}v<EnOQ}F8nQ%02NH}D3A4IFsUYl19RXQ-^P
zfj7hzY)*zJ8ut=vz0aU}-Kw{8`?i;Fq8Y8P^I9(&=!he|!n`qZ>Dz8?)eH+UV=-<g
z7gVJ{tND*W9J<}Kx}%jY9vpL^iD$hkk)Y#=E+u>edFM7fhfffQDu-(eg*I1GdMjKl
zaAkKxB9dS9MUPbr>1BK^?KQYq)14raW#SX+vh7$tg3K4mheJ5En2*!mtY;`LA*=KH
zKZ_6ZS@$gMi+Iv#-w3#QED`PB@C^6#D71icTXsJ&tmE+#@Ocn=psp54oI*{=_Ywun
z@|w;aP;dW;q3VtjRM%V92;K!DJ2&E69$s1>jL&b~U-9UZgz#C-S!&%E=;Qr+nNy1=
zLdX@E8<W7OziyoeX#Yd{6*<d)8B&gevWHYOtT_%=2dV0g_VBx<qgN}>HPxUmPH@gF
zz5dm^;@F-+iN}Vy>wWn$;{iNwQV$6$w%FrlnbLSxqiHww0?>^bE~z3su#iLsHhWSF
zj>Yl_g!V}?MM@>;hi%4YYbgUx$c2L6<TJZ<X&q*(+CD2%C1A9Im1h)J;-r+~MrTmo
zpAJZRxMR*f;;E~am<E_g3`r)(o?n@*=nj&SDIX_O&b~CuH?4PT61ykzhPBv%3-mDZ
zHPSS>s_V1<Vh^qQae59m2(WN)NOk|grog$L*6oT^$vD~CIG34?y|);e>u=g{LN|2>
zq|u@_ZwP~BedP!ePqEqT653SE+R5N?nM~GpG07fRUkIq?%0<l@ey)5S!V#h)<;3Y-
zcu|jp%?p83qGiEgCzU<-9M2ey&K2OQL?ItT9rrb8(6WT{>I$XBU8OsD0TJ#Mp0Ul5
z_2K@F=dsh(e%PcYWbQLuwuStImr}*p<SxsWyb=H8p{SBD-;!EC*8Gt%`4G>82ET3w
zJ8Gw?S#>A=W^IXLLSee^2B=;T_>umg&DoSJGWKu&(##+fbq0)<ZU%uLaEE(obxXDn
zJc>P2|2=FTmka&5K^Pp-JF8H7c3F=i>wjIX>{rJy#S>hry;w7;bVkl2#3nyx(V=)~
z|6sc#byUzt95coOx2~xmmQ5uXJOK62s1dGFFBem5P<n^LSzHB|oK5(KRry^HTs)6F
z*TVqP_U^mPYXMKbJyx|>P_w0!zs==#mVVEFMOgimC^)qfGLGq|DMz*4InXaBDX2+*
zT9={~t7Id9s3%A--e~y3D)CUjlaQ4VtebP%6Zy=mZDM-F5XA}sV|sHi%&?fDLkDw5
zxAmqdM~!=gFHGDDs*{IGDikw+{K~9MMJ)^ny5u9KtNFs)Gf(&$AP=I>Sl3NRjBK(6
zIj}Zh3+b8&E4qZ;N+N-H$yPxUIR7u=l`L0-K;&|D!|5e(x5C!*XFDXQrl3(kO8ase
O$N99oL#^HU8~*`KQ8cvx

diff --git a/frontend/e2e/tools/review-sandbox.sh b/frontend/e2e/tools/review-sandbox.sh
new file mode 100755
index 00000000..f8e02236
--- /dev/null
+++ b/frontend/e2e/tools/review-sandbox.sh
@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+# A throwaway checkout for agents that need to MUTATE code to test something — inject a
+# regression, delete a guard, probe a fixture. Review runs kept doing that in the live tree:
+# probe specs left behind, tracked files edited, and once an `rm -rf` of a directory the run
+# did not create.
+#
+# Usage:
+#   review-sandbox.sh create [--dirty] [--with-deps]   # prints the sandbox path on stdout
+#   review-sandbox.sh clean <path>                     # one sandbox, refuses anything else
+#   review-sandbox.sh clean --all                      # sweep sandboxes untouched for 2h
+#
+#   --dirty      carry the uncommitted working tree across, for a scope that includes it
+#   --with-deps  hardlink node_modules in, for agents that run pnpm/playwright/vitest
+#
+# A git worktree carries no ignored files, so node_modules has to be supplied. It is hardlinked
+# rather than symlinked because pnpm treats a symlinked node_modules as foreign and tries to
+# purge and reinstall it — through the link, into the real tree. Hardlinks share data, so the
+# copy is cheap, but a tool that rewrites a dependency IN PLACE (rather than the usual
+# write-temp-then-rename) would still reach the original: don't hand --with-deps to an agent
+# whose job is patching libraries.
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+SANDBOX_ROOT="${PENTAGI_SANDBOX_ROOT:-${TMPDIR:-/tmp}}/pentagi-review-sandboxes"
+# A hardlink cannot cross filesystems, so --with-deps is unusable when $TMPDIR is its own mount
+# (tmpfs /tmp, a separate /home, a container volume): `cp -al` fails outright and no sandbox is
+# built. This sibling of the repo is on the repo's filesystem by construction.
+# Under the escape hatch BOTH roots move: `clean --all` sweeps this one too, so a caller that cannot
+# afford a sweep of the repo's parent (the unit test, which otherwise rm -rf's real directories on the
+# developer's machine) needs a single variable that contains every path this script may delete.
+FALLBACK_ROOT="${PENTAGI_SANDBOX_ROOT:+${PENTAGI_SANDBOX_ROOT}/.pentagi-review-sandboxes}"
+FALLBACK_ROOT="${FALLBACK_ROOT:-$(dirname "$REPO_ROOT")/.pentagi-review-sandboxes}"
+
+# Pick a root node_modules can actually be hardlinked into: probe with a real link, fall back to
+# the repo's own filesystem when the probe hits EXDEV.
+linkable_root() {
+    local probe="$SANDBOX_ROOT/.linkprobe"
+
+    mkdir -p "$SANDBOX_ROOT"
+
+    if ln "${BASH_SOURCE[0]}" "$probe" 2>/dev/null; then
+        rm -f "$probe"
+        echo "$SANDBOX_ROOT"
+
+        return
+    fi
+
+    if ! mkdir -p "$FALLBACK_ROOT" 2>/dev/null; then
+        echo "review-sandbox: $SANDBOX_ROOT is on another filesystem than the repo and" \
+            "$FALLBACK_ROOT is not writable — set PENTAGI_SANDBOX_ROOT to a same-filesystem path" >&2
+        exit 2
+    fi
+
+    echo "review-sandbox: hardlinks cannot reach $SANDBOX_ROOT — using $FALLBACK_ROOT" >&2
+    echo "$FALLBACK_ROOT"
+}
+
+create() {
+    local carry_dirty="" with_deps="" path root="$SANDBOX_ROOT"
+
+    for arg in "$@"; do
+        case "$arg" in
+            --dirty) carry_dirty=1 ;;
+            --with-deps) with_deps=1 ;;
+            *)
+                echo "unknown option: $arg" >&2
+                exit 2
+                ;;
+        esac
+    done
+
+    if [[ -n "$with_deps" ]]; then
+        root="$(linkable_root)"
+    fi
+
+    path="$root/wt-$$-$(date +%s)"
+    mkdir -p "$root"
+    git -C "$REPO_ROOT" worktree add --detach --quiet "$path" HEAD
+    # Anything that fails from here leaves a worktree behind, and the caller reads stdout as the
+    # sandbox path — so take the worktree down and say so on stderr rather than printing a stub.
+    trap 'clean "$path" >/dev/null 2>&1; echo "review-sandbox: failed to prepare $path" >&2' ERR
+
+    if [[ -n "$carry_dirty" ]]; then
+        # --binary or a regenerated PNG baseline aborts the patch ("cannot apply binary patch
+        # without full index line"). Untracked files are absent from the diff entirely, so a new
+        # spec would never reach the sandbox — copy them separately, minus the ignored ones.
+        if ! git -C "$REPO_ROOT" diff --quiet HEAD; then
+            git -C "$REPO_ROOT" diff HEAD --binary | git -C "$path" apply --allow-empty
+        fi
+
+        while IFS= read -r -d '' file; do
+            mkdir -p "$path/$(dirname "$file")"
+            cp "$REPO_ROOT/$file" "$path/$file"
+        done < <(git -C "$REPO_ROOT" ls-files --others --exclude-standard -z)
+    fi
+
+    if [[ -n "$with_deps" ]]; then
+        for dir in frontend/node_modules node_modules; do
+            [[ -d "$REPO_ROOT/$dir" ]] && cp -al "$REPO_ROOT/$dir" "$path/$dir"
+        done
+    fi
+
+    echo "$path"
+}
+
+# `git worktree remove` exits 128 for the main working tree and for any directory that is not a
+# worktree, so the rm fallback is what runs for every wrong argument — and being left of `||` it
+# does not trip `set -e`. Resolve the target and refuse anything outside the sandbox root before
+# going near it. The sweep is opt-in and age-filtered for the same reason: this root is shared by
+# every agent on the host, so a bare `clean` used to take out a concurrent agent's live sandbox.
+STALE_MINUTES=120
+
+# A worktree directory's own mtime moves only when a top-level entry is added or removed, so it dates
+# the sandbox's creation — an agent editing frontend/src/... for hours never refreshes it. Age the
+# sandbox by the newest write anywhere inside it instead.
+recently_touched() {
+    [[ -n "$(find "$1" -mmin "-$STALE_MINUTES" -print -quit 2>/dev/null)" ]]
+}
+
+# A strict child of either sandbox root — never a root itself, so a sibling like <root>-old and the
+# root's own path are both rejected.
+contained() {
+    local candidate="$1" root
+
+    for root in "$SANDBOX_ROOT" "$FALLBACK_ROOT"; do
+        mkdir -p "$root"
+
+        case "$candidate" in
+            "$(cd "$root" && pwd -P)"/?*) return 0 ;;
+        esac
+    done
+
+    return 1
+}
+
+clean() {
+    local target="${1:-}" root resolved
+
+    case "$target" in
+        --all)
+            for root in "$SANDBOX_ROOT" "$FALLBACK_ROOT"; do
+                # The roots are derived, not passed in: naming them is how a caller — or a test —
+                # can tell where this is about to delete.
+                echo "swept $root"
+                for path in "$root"/wt-*; do
+                    if [[ -d "$path" ]] && ! recently_touched "$path"; then
+                        rm -rf "$path"
+                    fi
+                done
+            done
+            ;;
+        '')
+            echo "review-sandbox: clean needs a sandbox path, or --all to sweep stale ones" >&2
+            exit 2
+            ;;
+        *)
+            resolved="$(cd "$(dirname "$target")" 2>/dev/null && pwd -P || true)/$(basename "$target")"
+
+            case "$resolved" in
+                */. | */..) resolved="" ;;
+                *) contained "$resolved" || resolved="" ;;
+            esac
+
+            if [[ -z "$resolved" ]]; then
+                echo "review-sandbox: refusing to clean '$target' — not a sandbox under" \
+                    "$SANDBOX_ROOT or $FALLBACK_ROOT" >&2
+                exit 2
+            fi
+
+            git -C "$REPO_ROOT" worktree remove --force "$resolved" || rm -rf "$resolved"
+            ;;
+    esac
+
+    git -C "$REPO_ROOT" worktree prune
+}
+
+case "${1:-}" in
+    create)
+        shift
+        create "$@"
+        ;;
+    clean) clean "${2:-}" ;;
+    *)
+        echo "usage: $(basename "$0") create [--dirty] [--with-deps] | clean <path>|--all" >&2
+        exit 2
+        ;;
+esac
diff --git a/frontend/e2e/tools/review-sandbox.unit.test.ts b/frontend/e2e/tools/review-sandbox.unit.test.ts
new file mode 100644
index 00000000..7d81500a
--- /dev/null
+++ b/frontend/e2e/tools/review-sandbox.unit.test.ts
@@ -0,0 +1,148 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+const SCRIPT = join(__dirname, 'review-sandbox.sh');
+
+let sandboxRoot = '';
+
+// TMPDIR alone does NOT contain this script: `clean --all` also sweeps a fallback root derived from
+// the script's own location, so a bare `pnpm test` used to rm -rf real directories in the repo's
+// parent. PENTAGI_SANDBOX_ROOT moves both roots, which is what keeps a run inside its own tree.
+const run = (...args: string[]) => {
+    try {
+        const stdout = execFileSync(SCRIPT, args, {
+            encoding: 'utf8',
+            env: { ...process.env, PENTAGI_SANDBOX_ROOT: sandboxRoot, TMPDIR: sandboxRoot },
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+
+        return { code: 0, stdout: stdout.trim() };
+    } catch (error) {
+        const failure = error as { status: number; stdout: string };
+
+        return { code: failure.status, stdout: failure.stdout.trim() };
+    }
+};
+
+// -h, because the checkout contains symlinks and touch would otherwise age their targets while the
+// links themselves keep a current mtime — which is what the sweep reads.
+const backdate = (sandbox: string) =>
+    execFileSync('find', [sandbox, '-exec', 'touch', '-h', '-t', '202001010000', '{}', '+']);
+
+beforeEach(() => {
+    sandboxRoot = mkdtempSync(join(tmpdir(), 'sandbox-test-'));
+});
+
+afterEach(() => {
+    rmSync(sandboxRoot, { force: true, recursive: true });
+    // The worktrees a case created are registered in the real repo, so dropping the directory is
+    // only half of it — an unpruned registration would follow the developer around.
+    execFileSync('git', ['worktree', 'prune'], { cwd: join(__dirname, '..', '..') });
+});
+
+describe('review-sandbox clean — containment', () => {
+    it('removes a sandbox it created', () => {
+        const { stdout: sandbox } = run('create');
+
+        expect(existsSync(sandbox)).toBe(true);
+        expect(run('clean', sandbox).code).toBe(0);
+        expect(existsSync(sandbox)).toBe(false);
+    });
+
+    it('refuses a path outside the sandbox root and leaves it intact', () => {
+        const outsider = mkdtempSync(join(tmpdir(), 'outsider-'));
+
+        writeFileSync(join(outsider, 'keep-me'), 'payload');
+
+        expect(run('clean', outsider).code).not.toBe(0);
+        expect(existsSync(join(outsider, 'keep-me'))).toBe(true);
+
+        rmSync(outsider, { force: true, recursive: true });
+    });
+
+    it('refuses the sandbox root itself, and a sibling of it', () => {
+        const { stdout: sandbox } = run('create');
+        const root = join(sandboxRoot, 'pentagi-review-sandboxes');
+
+        expect(run('clean', root).code).not.toBe(0);
+        expect(run('clean', `${root}-old`).code).not.toBe(0);
+        expect(existsSync(sandbox)).toBe(true);
+    });
+
+    it('refuses a traversal that lands outside the root', () => {
+        const { stdout: sandbox } = run('create');
+
+        expect(run('clean', `${sandbox}/../../..`).code).not.toBe(0);
+        expect(existsSync(sandbox)).toBe(true);
+    });
+});
+
+describe('review-sandbox create — where the sandbox lands', () => {
+    // `clean --all` also sweeps a root derived from the script's own location, which no TMPDIR can
+    // move: before PENTAGI_SANDBOX_ROOT governed it too, running this very file deleted real stale
+    // sandboxes from the repo's parent directory on the developer's machine.
+    it('sweeps no root outside the one it was given', () => {
+        const swept = run('clean', '--all')
+            .stdout.split('\n')
+            .filter((line) => line.startsWith('swept '))
+            .map((line) => line.slice('swept '.length));
+
+        expect(swept.length, 'clean --all names every root it sweeps').toBeGreaterThan(0);
+
+        for (const root of swept) {
+            expect(root.startsWith(sandboxRoot), `${root} is outside ${sandboxRoot}`).toBe(true);
+        }
+    });
+
+    it('honours PENTAGI_SANDBOX_ROOT, the escape hatch for a $TMPDIR on another filesystem', () => {
+        const override = mkdtempSync(join(tmpdir(), 'override-root-'));
+        const sandbox = execFileSync(SCRIPT, ['create'], {
+            encoding: 'utf8',
+            env: { ...process.env, PENTAGI_SANDBOX_ROOT: override, TMPDIR: sandboxRoot },
+        }).trim();
+
+        expect(sandbox.startsWith(`${override}/pentagi-review-sandboxes/`)).toBe(true);
+
+        execFileSync(SCRIPT, ['clean', sandbox], {
+            env: { ...process.env, PENTAGI_SANDBOX_ROOT: override, TMPDIR: sandboxRoot },
+        });
+        expect(existsSync(sandbox)).toBe(false);
+
+        rmSync(override, { force: true, recursive: true });
+    });
+});
+
+describe('review-sandbox clean — the sweep', () => {
+    it('refuses a bare clean rather than taking the whole root', () => {
+        const { stdout: sandbox } = run('create');
+
+        expect(run('clean').code).not.toBe(0);
+        expect(existsSync(sandbox)).toBe(true);
+    });
+
+    it('sweeps only what has gone stale', () => {
+        const { stdout: fresh } = run('create');
+
+        expect(run('clean', '--all').code).toBe(0);
+        expect(existsSync(fresh), 'a live sandbox survives the sweep').toBe(true);
+
+        backdate(fresh);
+        expect(run('clean', '--all').code).toBe(0);
+        expect(existsSync(fresh), 'a stale sandbox is swept').toBe(false);
+    });
+
+    it('keeps a sandbox an agent is still working in, however deep the edit sits', () => {
+        const { stdout: busy } = run('create');
+
+        backdate(busy);
+        writeFileSync(join(busy, 'frontend', 'src', 'probe.tsx'), 'export const probe = 1;\n');
+
+        expect(run('clean', '--all').code).toBe(0);
+        expect(existsSync(busy), 'a live sandbox survives the sweep').toBe(true);
+
+        expect(run('clean', busy).code).toBe(0);
+    });
+});
diff --git a/frontend/e2e/tools/run-local-tier.sh b/frontend/e2e/tools/run-local-tier.sh
index 2e83c0f5..f46ffcb3 100755
--- a/frontend/e2e/tools/run-local-tier.sh
+++ b/frontend/e2e/tools/run-local-tier.sh
@@ -23,9 +23,8 @@ compose() {
 # sandboxes for any flow id starting with 9.
 remove_e2e_sandboxes() {
     docker ps -aq --filter 'name=^/?pentagi-terminal-9[0-9]{4,}$' | xargs -r docker rm -f
-    # Each sandbox also gets a `<container>-data` volume, created on the socket
-    # outside the compose project — removing the container leaves it behind, so
-    # every Tier-2 run used to add one more dangling volume.
+    # Each sandbox also gets a `<container>-data` volume, created on the socket outside the compose
+    # project — removing the container leaves it behind, so it needs its own cleanup.
     docker volume ls -q --filter 'name=^pentagi-terminal-9[0-9]{4,}-data$' | xargs -r docker volume rm
 }
 
diff --git a/frontend/graphql-schema.graphql b/frontend/graphql-schema.graphql
index 115c39e1..0547b3d0 100644
--- a/frontend/graphql-schema.graphql
+++ b/frontend/graphql-schema.graphql
@@ -321,6 +321,10 @@ fragment agentConfigFragment on AgentConfig {
     repetitionPenalty
     frequencyPenalty
     presencePenalty
+    minP
+    n
+    json
+    responseMimeType
     reasoning {
         mode
         effort
diff --git a/frontend/src/components/shared/detail-navigation/use-navigation.ts b/frontend/src/components/shared/detail-navigation/use-navigation.ts
index 67541ff3..3f7fddf7 100644
--- a/frontend/src/components/shared/detail-navigation/use-navigation.ts
+++ b/frontend/src/components/shared/detail-navigation/use-navigation.ts
@@ -1,6 +1,6 @@
 import { useMemo } from 'react';
 
-import { createTextMatcher } from './text-filter';
+import { createTextMatcher } from '@/lib/text-filter';
 
 interface NavigationInput<T> {
     currentId: null | string | undefined;
diff --git a/frontend/src/components/shared/file-manager/file-manager.tsx b/frontend/src/components/shared/file-manager/file-manager.tsx
index 895174f5..e576a066 100644
--- a/frontend/src/components/shared/file-manager/file-manager.tsx
+++ b/frontend/src/components/shared/file-manager/file-manager.tsx
@@ -365,7 +365,7 @@ export function FileManager({
         return (
             <Button
                 aria-label={sortHeaderAriaLabel(column, direction)}
-                className="text-muted-foreground hover:text-primary -mx-2 flex h-auto justify-start gap-1.5 px-2 py-1 text-xs font-medium no-underline hover:no-underline"
+                className="text-muted-foreground hover:text-link -mx-2 flex h-auto justify-start gap-1.5 px-2 py-1 text-xs font-medium no-underline hover:no-underline"
                 onClick={() => toggleSort(column)}
                 variant="link"
             >
diff --git a/frontend/src/components/shared/inline-edit/inline-edit-input.test.tsx b/frontend/src/components/shared/inline-edit/inline-edit-input.test.tsx
new file mode 100644
index 00000000..80ffa192
--- /dev/null
+++ b/frontend/src/components/shared/inline-edit/inline-edit-input.test.tsx
@@ -0,0 +1,57 @@
+import { fireEvent, render, screen } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+
+import { InlineEditInput } from './inline-edit-input';
+
+const renderInput = (busy: boolean) => {
+    const onCancel = vi.fn();
+    const onSave = vi.fn();
+
+    render(
+        <InlineEditInput
+            busy={busy}
+            defaultValue="Alpha"
+            onCancel={onCancel}
+            onSave={onSave}
+        />,
+    );
+
+    return { input: screen.getByRole('textbox'), onCancel, onSave };
+};
+
+describe('InlineEditInput', () => {
+    it('saves on Enter and cancels on Escape while idle', () => {
+        const { input, onCancel, onSave } = renderInput(false);
+
+        fireEvent.keyDown(input, { key: 'Enter' });
+        expect(onSave).toHaveBeenCalledTimes(1);
+        expect(onCancel).not.toHaveBeenCalled();
+
+        fireEvent.keyDown(input, { key: 'Escape' });
+        expect(onCancel).toHaveBeenCalledTimes(1);
+    });
+
+    it('ignores Enter while busy, matching the disabled Save button', () => {
+        const { input, onSave } = renderInput(true);
+
+        expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled();
+
+        fireEvent.keyDown(input, { key: 'Enter' });
+        expect(onSave).not.toHaveBeenCalled();
+    });
+
+    it('ignores Escape while busy, matching the disabled Cancel button', () => {
+        const { input, onCancel } = renderInput(true);
+
+        expect(screen.getByRole('button', { name: 'Cancel' })).toBeDisabled();
+
+        fireEvent.keyDown(input, { key: 'Escape' });
+        expect(onCancel).not.toHaveBeenCalled();
+    });
+
+    it('keeps the input editable while busy', () => {
+        const { input } = renderInput(true);
+
+        expect(input).not.toBeDisabled();
+    });
+});
diff --git a/frontend/src/components/shared/inline-edit/inline-edit-input.tsx b/frontend/src/components/shared/inline-edit/inline-edit-input.tsx
index 5abecd0f..127ced6c 100644
--- a/frontend/src/components/shared/inline-edit/inline-edit-input.tsx
+++ b/frontend/src/components/shared/inline-edit/inline-edit-input.tsx
@@ -13,7 +13,10 @@ interface InlineEditInputProps {
      * so focus must be requested explicitly.
      */
     autoFocus?: boolean;
-    /** Disable the Save + Cancel buttons while a mutation is in flight. The input stays editable. */
+    /**
+     * Inert Save + Cancel while a mutation is in flight — both the buttons and
+     * the `Enter`/`Escape` shortcuts. The input itself stays editable.
+     */
     busy?: boolean;
     /** Optional className passed through to the outer `<InputGroup>`. */
     className?: string;
@@ -66,6 +69,10 @@ export function InlineEditInput({
     placeholder,
 }: InlineEditInputProps) {
     const handleKeyDown = (event: KeyboardEvent<HTMLInputElement>) => {
+        if (busy) {
+            return;
+        }
+
         if (event.key === 'Enter') {
             event.preventDefault();
             onSave();
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-code-fence.test.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-code-fence.test.ts
index 01bdaef4..d90dfe77 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-code-fence.test.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-code-fence.test.ts
@@ -25,7 +25,29 @@ describe('code-block fence lengthening — a block documenting a ``` fence stays
     });
 
     it('leaves an ordinary code block on a 3-backtick fence', () => {
-        expect(roundTrip('```js\nconst x = 1;\n```')).toContain('```js');
+        expect(roundTrip('```js\nconst x = 1;\n```')).toBe('```js\nconst x = 1;\n```');
+    });
+});
+
+// A tilde fence's info string may hold a backtick; a backtick fence's may not — re-emitting such a block on a
+// backtick fence produces an opening line that is no longer a fence at all, and the code block is destroyed.
+describe('code-block fence character — a language containing a backtick keeps its tilde fence', () => {
+    it('re-emits a tilde fence so the block survives reload', () => {
+        const src = '~~~`js`\nconst x = 1;\n~~~';
+        const out = roundTrip(src);
+
+        expect(out).toBe(src);
+        expect(nodeCount(out, 'codeBlock')).toBe(1);
+        expect(roundTrip(out)).toBe(out);
+    });
+
+    it('widens the tilde fence past an inner ~~~ run', () => {
+        const src = '~~~~`js`\ninner\n~~~\nafter\n~~~~';
+        const out = roundTrip(src);
+
+        expect(out).toBe(src);
+        expect(nodeCount(out, 'codeBlock')).toBe(1);
+        expect(roundTrip(out)).toBe(out);
     });
 });
 
@@ -47,23 +69,93 @@ describe('code-block language attribute', () => {
 
     it('round-trips the language on the fence for several languages', () => {
         for (const lang of ['ts', 'python', 'bash', 'json', 'go']) {
-            expect(roundTrip(`\`\`\`${lang}\ncode\n\`\`\``)).toContain(`\`\`\`${lang}`);
+            expect(roundTrip(`\`\`\`${lang}\ncode\n\`\`\``)).toBe(`\`\`\`${lang}\ncode\n\`\`\``);
         }
     });
 });
 
-// KNOWN UPSTREAM LIMITATION — not fixable in this layer. @tiptap/markdown derives a MARK's opening/closing
-// delimiter by rendering it around a fixed placeholder (getMarkOpening/getMarkClosing), so the `code` mark's
-// real content is never seen at delimiter time and it always emits a SINGLE backtick. A code span whose
-// content contains a backtick therefore collapses on save and never converges. A NODE (codeBlock, above) DOES
-// receive its real content and is content-aware — hence the fence widening is fixable but this is not. Pinned so
-// the gap stays visible: this test turns RED (the canary to revisit it) if a future @tiptap/markdown makes mark
-// delimiters content-aware and the span starts round-tripping.
-describe('inline code containing a backtick — known lossy on save (upstream mark-delimiter limitation)', () => {
-    it('collapses a backtick-containing code span (does not round-trip)', () => {
-        const out = roundTrip('x ``a `b` c`` y');
+describe('code-block highlighting', () => {
+    const highlightClasses = (md: string): string[] => {
+        const element = document.createElement('div');
+        const editor = new Editor({
+            content: md,
+            contentType: 'markdown',
+            element,
+            extensions: createMarkdownExtensions(),
+        });
+        const classes = [...editor.view.dom.querySelectorAll('pre code span')].flatMap((span) => [...span.classList]);
+        editor.destroy();
 
-        expect(out).not.toContain('``a `b` c``');
-        expect(roundTrip(out)).not.toBe(out);
+        return [...new Set(classes)];
+    };
+
+    const SNIPPET = 'const total = items.map((item) => item.price).reduce((a, b) => a + b, 0);';
+
+    it('highlights a fence that declares its language', () => {
+        expect(highlightClasses(`\`\`\`javascript\n${SNIPPET}\n\`\`\``)).toContain('hljs-keyword');
+    });
+
+    // An undeclared fence must resolve to the plaintext grammar, not to highlightAuto: auto-detection re-runs
+    // over every code block in the document on each keystroke inside one, and it is quadratic in document size.
+    it('leaves a fence with no language unhighlighted rather than guessing', () => {
+        expect(highlightClasses(`\`\`\`\n${SNIPPET}\n\`\`\``)).toEqual([]);
+    });
+});
+
+// Guards the two paired seams of the code-span fix: serializeCodeSpan (markdown-editor-marked.ts) and the
+// code-mark renderMarkdown override that zeroes the placeholder fence. A regression in either turns these red.
+describe('inline code containing a backtick round-trips exactly', () => {
+    it('preserves and converges a backtick-containing code span', () => {
+        const out = roundTrip('x ``a `b` c`` y');
+
+        expect(out).toContain('``a `b` c``');
+        expect(roundTrip(out)).toBe(out);
+    });
+
+    it.each([
+        'a ``` `XSS` ``` b',
+        'x ``` `key` = value ``` y',
+        'run ``` echo `whoami` ``` now',
+        'p ```` a```b ```` q',
+        'a `simple` b',
+        'use `{{.Host}}` here',
+    ])('reaches a stable fixed point for %j', (src) => {
+        const once = roundTrip(src);
+
+        expect(roundTrip(once)).toBe(once);
+    });
+});
+
+// A block created in the editor carries no author-chosen language, so it must serialize as a bare fence.
+// `defaultLanguage` exists for the highlight plugin (`attrs.language || defaultLanguage`); leaking it into
+// the attribute default writes ```plaintext into every prompt, template and knowledge document saved.
+describe('a code block created in the editor', () => {
+    const created = (): { language: null | string; markdown: string } => {
+        const editor = new Editor({
+            content: 'hello',
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+
+        editor.commands.selectAll();
+        editor.commands.toggleCodeBlock();
+
+        const node = (editor.getJSON().content ?? []).find((candidate) => candidate.type === 'codeBlock');
+        const result = {
+            language: (node?.attrs?.language as null | string) ?? null,
+            markdown: editor.getMarkdown(),
+        };
+
+        editor.destroy();
+
+        return result;
+    };
+
+    it('serializes as a bare fence, not as ```plaintext', () => {
+        const { language, markdown } = created();
+
+        expect(language).toBeNull();
+        expect(markdown).toContain('```\nhello\n```');
+        expect(markdown).not.toContain('plaintext');
     });
 });
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-extensions.test.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-extensions.test.ts
index d70c2dfd..810fb579 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-extensions.test.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-extensions.test.ts
@@ -1,7 +1,9 @@
 import { Editor } from '@tiptap/core';
+import { OrderedList, TaskList } from '@tiptap/extension-list';
+import { TextSelection } from '@tiptap/pm/state';
 import { beforeAll, describe, expect, it } from 'vitest';
 
-import { createMarkdownExtensions } from './markdown-editor-extensions';
+import { createMarkdownExtensions, isBlockApplied } from './markdown-editor-extensions';
 import { roundTrip, setupEditorJsdom, structuralCounts } from './markdown-editor-test-setup';
 import { findVariableOccurrences } from './markdown-editor-variable-highlight';
 
@@ -489,3 +491,745 @@ describe('multi-paragraph table cell does not persist a raw control byte on save
         expect(md).toContain('z');
     });
 });
+
+type MarkdownTokenizerShape = {
+    start?: (src: string) => number;
+    tokenize: (src: string, tokens: unknown[], lexer: unknown) => unknown;
+};
+
+describe('list tokenizers are guarded against the upstream per-block full-source split', () => {
+    type Layer = {
+        config: { markdownTokenizer?: MarkdownTokenizerShape };
+        parent?: Layer;
+    };
+
+    // `.extend()` MERGES config into the child, so every wrapper layer reports a `markdownTokenizer` and
+    // walking to "the first layer that has one" lands on a wrapper, not on upstream. The root of the chain is
+    // the only unambiguous handle on the untouched implementation.
+    const rootOf = (layer: Layer): Layer => {
+        let current = layer;
+
+        while (current.parent) {
+            current = current.parent;
+        }
+
+        return current;
+    };
+
+    const extensionOf = (name: string) => {
+        const editor = new Editor({ content: '', extensions: createMarkdownExtensions() });
+        const extension = editor.extensionManager.extensions.find((e) => e.name === name) as Layer | undefined;
+
+        editor.destroy();
+
+        return extension;
+    };
+
+    const tokenizerOf = (name: string) => extensionOf(name)?.config.markdownTokenizer;
+
+    const upstreamTokenizerOf = (name: string) => {
+        const extension = extensionOf(name);
+
+        return extension ? rootOf(extension).config.markdownTokenizer : undefined;
+    };
+
+    it.each([
+        ['orderedList', OrderedList],
+        ['taskList', TaskList],
+    ])('%s tokenize is wrapped, not the upstream function', (name, upstream) => {
+        const ours = tokenizerOf(name);
+        const theirs = (upstream.config as { markdownTokenizer?: { tokenize: unknown } }).markdownTokenizer;
+
+        expect(theirs?.tokenize).toBeTypeOf('function');
+        expect(ours?.tokenize).toBeTypeOf('function');
+        // An unwrapped tokenizer splits the whole remaining document at every block boundary — O(n²) loads.
+        expect(ours?.tokenize).not.toBe(theirs?.tokenize);
+    });
+
+    // The guard must stay at least as wide as ORDERED_LIST_MARKER_PATTERN
+    // (`\d+|[ivxlcdmIVXLCDM]+|[a-zA-Z]{1,2}`); a marker form it rejects is silently demoted to a paragraph.
+    it.each([
+        ['single digit', '1. alpha\n2. beta'],
+        ['multi digit', '10. alpha\n11. beta'],
+        ['lower roman', 'i. alpha\nii. beta'],
+        ['upper roman', 'IX. alpha\nX. beta'],
+        ['single alpha', 'a. alpha\nb. beta'],
+        ['two-letter alpha', 'aa. alpha\nab. beta'],
+        ['two-letter upper alpha', 'AB. alpha\nAC. beta'],
+    ])('ordered list with a %s marker survives the guard', (_name, md) => {
+        // Byte equality alone is blind here: a demoted paragraph holding the same two lines re-serialises
+        // to identical bytes, so the node type is the only assertion that can see the marker being rejected.
+        expect(structuralCounts(roundTrip(md)).orderedList).toBe(1);
+        expect(roundTrip(md)).toBe(md);
+    });
+
+    // Upstream normalises `)` to `.` and drops a leading indent (verified identical without the guard), so
+    // these two assert only what the guard governs: the block is still a list, not demoted to a paragraph.
+    it.each([
+        ['paren delimiter', 'aa) alpha\nab) beta'],
+        ['indented', '  1. alpha\n  2. beta'],
+    ])('ordered list with a %s marker is not demoted to a paragraph', (_name, md) => {
+        expect(structuralCounts(roundTrip(md)).orderedList).toBe(1);
+    });
+
+    // Identity alone would also hold for a pass-through wrapper, which would silently restore the O(n^2)
+    // load. This is the assertion that the short-circuit itself is wired.
+    it.each(['orderedList', 'taskList'])(
+        '%s never reaches upstream tokenize when the source does not open a list',
+        (name) => {
+            const upstream = upstreamTokenizerOf(name);
+            const wrapped = tokenizerOf(name);
+
+            expect(upstream?.tokenize).toBeTypeOf('function');
+
+            const real = upstream!.tokenize;
+            let calls = 0;
+
+            upstream!.tokenize = (...args: Parameters<typeof real>) => {
+                calls += 1;
+
+                return real(...args);
+            };
+
+            try {
+                expect(wrapped?.tokenize('plain paragraph line\n'.repeat(500), [], undefined)).toBeUndefined();
+                expect(calls).toBe(0);
+            } finally {
+                upstream!.tokenize = real;
+            }
+        },
+    );
+
+    it.each([
+        ['dash unchecked', '- [ ] open'],
+        ['dash checked', '- [x] done'],
+        ['asterisk', '* [ ] open'],
+        ['plus', '+ [x] done'],
+        ['upper X', '- [X] done'],
+    ])('task list with a %s marker survives the guard', (_name, md) => {
+        expect(structuralCounts(roundTrip(md)).taskList).toBe(1);
+    });
+});
+
+describe('block toggles are reversible under a whole-document selection', () => {
+    const CONTROLS = [
+        ['blockquote', 'toggleBlockquote'],
+        ['bulletList', 'toggleBulletList'],
+        ['orderedList', 'toggleOrderedList'],
+        ['taskList', 'toggleTaskList'],
+        ['codeBlock', 'toggleCodeBlock'],
+    ] as const;
+
+    const apply = (editor: Editor, command: string) =>
+        (editor.chain().focus() as unknown as Record<string, () => { run: () => boolean }>)[command]!().run();
+
+    const editorWith = (markdown: string) =>
+        new Editor({ content: markdown, contentType: 'markdown', extensions: createMarkdownExtensions() });
+
+    it.each(CONTROLS)('%s applied over Ctrl+A is removed by a second press', (node, command) => {
+        const editor = editorWith('sample text');
+
+        editor.commands.selectAll();
+        apply(editor, command);
+
+        expect(structuralCounts(editor.getMarkdown())[node]).toBe(1);
+
+        editor.commands.selectAll();
+        apply(editor, command);
+
+        const out = editor.getMarkdown();
+
+        editor.destroy();
+
+        // Node counts, not bytes: a second wrap nests a quote / adds an empty item, and several of those
+        // re-serialise to text that still "contains" the original words.
+        expect(structuralCounts(out)[node]).toBeUndefined();
+        expect(out.trim()).toBe('sample text');
+    });
+
+    it.each(CONTROLS)('%s stays reversible over a multi-block Ctrl+A', (node, command) => {
+        const editor = editorWith('one\n\ntwo\n\nthree');
+
+        editor.commands.selectAll();
+        apply(editor, command);
+        editor.commands.selectAll();
+        apply(editor, command);
+
+        const out = editor.getMarkdown();
+
+        editor.destroy();
+
+        expect(structuralCounts(out)[node]).toBeUndefined();
+        expect(words(out).sort()).toEqual(['one', 'three', 'two']);
+    });
+
+    // The keyboard shortcuts (Mod-Shift-b / Mod-Alt-c / Mod-Shift-7..9) go through `editor.commands.x()`,
+    // not through a chain, so the retarget has to hold on that path too or only the toolbar is fixed.
+    it.each(CONTROLS)('%s is reversible through editor.commands, the path the shortcuts use', (node, command) => {
+        const editor = editorWith('sample text');
+        const run = () => (editor.commands as unknown as Record<string, () => boolean>)[command]!();
+
+        editor.commands.selectAll();
+        run();
+
+        expect(structuralCounts(editor.getMarkdown())[node]).toBe(1);
+
+        editor.commands.selectAll();
+        run();
+
+        const out = editor.getMarkdown();
+
+        editor.destroy();
+
+        expect(structuralCounts(out)[node]).toBeUndefined();
+        expect(out.trim()).toBe('sample text');
+    });
+
+    it.each(CONTROLS)('%s is unaffected for a caret selection', (node, command) => {
+        const editor = editorWith('sample text');
+
+        editor.commands.setTextSelection(4);
+        apply(editor, command);
+
+        expect(structuralCounts(editor.getMarkdown())[node]).toBe(1);
+
+        apply(editor, command);
+
+        const out = editor.getMarkdown();
+
+        editor.destroy();
+
+        expect(structuralCounts(out)[node]).toBeUndefined();
+        expect(out.trim()).toBe('sample text');
+    });
+});
+
+describe('a task checkbox is announced with its own text, not its subtree', () => {
+    const labelsFor = (markdown: string) => {
+        const element = document.createElement('div');
+
+        document.body.appendChild(element);
+
+        const editor = new Editor({
+            content: markdown,
+            contentType: 'markdown',
+            element,
+            extensions: createMarkdownExtensions(),
+        });
+        const labels = [...element.querySelectorAll('input[type=checkbox]')].map(
+            (checkbox) => (checkbox as HTMLInputElement).ariaLabel,
+        );
+
+        editor.destroy();
+        element.remove();
+
+        return labels;
+    };
+
+    it('a parent task does not absorb the text of its nested tasks', () => {
+        expect(labelsFor('- [ ] task open\n- [x] task done\n    - [ ] nested open\n    - [x] nested done\n')).toEqual([
+            'Task item checkbox for task open',
+            'Task item checkbox for task done',
+            'Task item checkbox for nested open',
+            'Task item checkbox for nested done',
+        ]);
+    });
+
+    it('an empty task still gets a name', () => {
+        expect(labelsFor('- [ ] \n')).toEqual(['Task item checkbox for empty task item']);
+    });
+});
+
+describe('whole-document block toggles across document shapes', () => {
+    const TOGGLES = [
+        ['blockquote', 'toggleBlockquote'],
+        ['bulletList', 'toggleBulletList'],
+        ['orderedList', 'toggleOrderedList'],
+        ['taskList', 'toggleTaskList'],
+        ['codeBlock', 'toggleCodeBlock'],
+    ] as const;
+
+    // The shapes whose first child is not a textblock are the ones a hardcoded start position gets wrong; the
+    // plain ones pass either way, so trimming the list to them takes the coverage away.
+    const SHAPES = [
+        ['single paragraph', 'sample text'],
+        ['three paragraphs', 'one\n\ntwo\n\nthree'],
+        ['table only', '| A | B |\n| --- | --- |\n| 1 | 2 |'],
+        ['table then paragraph', '| A | B |\n| --- | --- |\n| 1 | 2 |\n\ntail'],
+        ['list only', '- a\n- b\n- c'],
+        ['nested list', '- a\n  - b\n- c'],
+        ['leading rule', '---\n\nbody text'],
+        ['leading image', '![alt](https://x/y.png)\n\nbody text'],
+        ['leading heading', '# Title\n\nbody'],
+        ['fenced code only', '```js\nconst a = 1;\n```'],
+        ['already quoted', '> quoted\n\nplain'],
+    ] as const;
+
+    const editorWith = (markdown: string) =>
+        new Editor({ content: markdown, contentType: 'markdown', extensions: createMarkdownExtensions() });
+
+    const press = (editor: Editor, command: string) =>
+        (editor.commands as unknown as Record<string, () => boolean>)[command]!();
+
+    const topLevelTypes = (editor: Editor) => {
+        const types: string[] = [];
+
+        editor.state.doc.forEach((node) => types.push(node.type.name));
+
+        return types;
+    };
+
+    // Conversions that drop an attribute the target block cannot carry (a listItem holds no heading level, a
+    // paragraph no fence info-string). Measured irreversible with a plain caret too, so making these byte-exact
+    // is an upstream change, not a bug in this path.
+    const LOSSY = new Set([
+        'fenced code only|toggleBulletList',
+        'fenced code only|toggleCodeBlock',
+        'fenced code only|toggleOrderedList',
+        'fenced code only|toggleTaskList',
+        'leading heading|toggleBulletList',
+        'leading heading|toggleCodeBlock',
+        'leading heading|toggleOrderedList',
+        'leading heading|toggleTaskList',
+        'list only|toggleOrderedList',
+        'list only|toggleTaskList',
+        'nested list|toggleOrderedList',
+    ]);
+
+    const cases = SHAPES.flatMap(([shape, source]) =>
+        TOGGLES.map(([, command]) => ({ command, isLossy: LOSSY.has(`${shape}|${command}`), shape, source })),
+    );
+
+    // structuralCounts is blind to the destruction this guards: a rule left OUTSIDE the quote and one inside it
+    // produce identical counts, and a table rebuilt around itself still counts one table.
+    it.each(cases)(
+        '$shape + $command either applies reversibly or refuses harmlessly',
+        ({ command, isLossy, source }) => {
+            const editor = editorWith(source);
+
+            // Baseline AFTER selectAll: TrailingNode materialises its empty paragraph on that transaction, so a
+            // baseline taken before it would blame the toggle for a block the selection itself added.
+            editor.commands.selectAll();
+
+            const original = editor.getMarkdown();
+            const originalText = editor.state.doc.textContent;
+            const originalTypes = topLevelTypes(editor);
+            const applied = press(editor, command);
+
+            if (!applied) {
+                const { selection } = editor.state;
+
+                expect(editor.getMarkdown()).toBe(original);
+                expect(topLevelTypes(editor)).toEqual(originalTypes);
+                expect(selection.empty).toBe(false);
+                editor.destroy();
+
+                return;
+            }
+
+            expect(editor.getMarkdown()).not.toBe(original);
+
+            editor.commands.selectAll();
+            press(editor, command);
+
+            const out = editor.getMarkdown();
+            const outText = editor.state.doc.textContent;
+
+            editor.destroy();
+
+            if (isLossy) {
+                // Text content, not markdown: the declared loss is an attribute (heading level, fence info-string),
+                // and comparing source words would count `js` from ```js as content.
+                sameWords(originalText, outText);
+
+                return;
+            }
+
+            expect(out.trimEnd()).toBe(original.trimEnd());
+        },
+    );
+
+    // Selecting everything with the mouse is a TextSelection, so a guard keyed on AllSelection misses it entirely
+    // and leaves this path on the unfixed code.
+    it.each(TOGGLES)('%s is reversible under a drag-style whole-document selection', (_node, command) => {
+        const editor = editorWith('one\n\ntwo');
+
+        const selectByDrag = () => {
+            const { doc } = editor.state;
+
+            editor.view.dispatch(
+                editor.state.tr.setSelection(TextSelection.between(doc.resolve(1), doc.resolve(doc.content.size - 1))),
+            );
+        };
+
+        selectByDrag();
+
+        expect(editor.state.selection).toBeInstanceOf(TextSelection);
+        expect(press(editor, command)).toBe(true);
+
+        selectByDrag();
+        press(editor, command);
+
+        const out = editor.getMarkdown();
+
+        editor.destroy();
+
+        expect(out.trimEnd()).toBe('one\n\ntwo');
+    });
+
+    it.each(TOGGLES)('%s reports the same state to the toolbar as its own click performs', (node, command) => {
+        const editor = editorWith('sample text');
+
+        editor.commands.selectAll();
+
+        expect(isBlockApplied(editor, node)).toBe(false);
+
+        press(editor, command);
+        editor.commands.selectAll();
+
+        expect(isBlockApplied(editor, node)).toBe(true);
+
+        press(editor, command);
+        editor.commands.selectAll();
+
+        expect(isBlockApplied(editor, node)).toBe(false);
+        editor.destroy();
+    });
+
+    it('reports an already-quoted document as quoted under a whole-document selection', () => {
+        const editor = editorWith('> quoted');
+
+        editor.commands.selectAll();
+
+        expect(isBlockApplied(editor, 'blockquote')).toBe(true);
+        editor.destroy();
+    });
+
+    it.each(TOGGLES)('%s leaves the document untouched when only probed through can()', (_node, command) => {
+        const editor = editorWith('| A | B |\n| --- | --- |\n| 1 | 2 |');
+
+        editor.commands.selectAll();
+
+        const original = editor.getMarkdown();
+
+        (editor.can() as unknown as Record<string, () => boolean>)[command]!();
+
+        const out = editor.getMarkdown();
+
+        editor.destroy();
+
+        expect(out).toBe(original);
+    });
+
+    // Only these commands may drive a disabled state in the toolbar. `can()` runs with dispatch undefined, and
+    // `toggleList`'s `clearNodes()` fallback is a no-op there, so the three list kinds, toggleCodeBlock and
+    // toggleHeading report false for conversions that work. A tiptap upgrade that makes one faithful may add it.
+    it.each([
+        [
+            'toggleBlockquote',
+            (editor: Editor) => editor.can().toggleBlockquote(),
+            (editor: Editor) => editor.commands.toggleBlockquote(),
+        ],
+        ['toggleBold', (editor: Editor) => editor.can().toggleBold(), (editor: Editor) => editor.commands.toggleBold()],
+        ['toggleCode', (editor: Editor) => editor.can().toggleCode(), (editor: Editor) => editor.commands.toggleCode()],
+        [
+            'toggleItalic',
+            (editor: Editor) => editor.can().toggleItalic(),
+            (editor: Editor) => editor.commands.toggleItalic(),
+        ],
+        [
+            'toggleStrike',
+            (editor: Editor) => editor.can().toggleStrike(),
+            (editor: Editor) => editor.commands.toggleStrike(),
+        ],
+        [
+            'setLink',
+            (editor: Editor) => editor.can().setLink({ href: 'https://example.com' }),
+            (editor: Editor) => editor.commands.setLink({ href: 'https://example.com' }),
+        ],
+    ] as const)(
+        '%s answers can() exactly as it performs, on every shape and both selection modes',
+        (_name, ask, perform) => {
+            const disagreements: string[] = [];
+
+            for (const [shape, source] of SHAPES) {
+                for (const mode of ['caret', 'selectAll'] as const) {
+                    const probe = editorWith(source);
+
+                    if (mode === 'caret') {
+                        probe.commands.setTextSelection(3);
+                    } else {
+                        probe.commands.selectAll();
+                    }
+
+                    const canSays = ask(probe);
+                    const commandSays = perform(probe);
+
+                    probe.destroy();
+
+                    if (canSays !== commandSays) {
+                        disagreements.push(`${shape}/${mode}: can=${canSays} command=${commandSays}`);
+                    }
+                }
+            }
+
+            expect(disagreements).toEqual([]);
+        },
+    );
+
+    it('builds exactly one lowlight plugin', () => {
+        const editor = new Editor({ content: '', extensions: createMarkdownExtensions() });
+        const lowlightPlugins = editor.state.plugins.filter((plugin) =>
+            String((plugin as { key?: string }).key).startsWith('lowlight'),
+        );
+
+        editor.destroy();
+
+        expect(lowlightPlugins).toHaveLength(1);
+    });
+});
+
+describe('line-leading block markers are escaped to marked grammar, inline backslashes are not touched', () => {
+    // marked's heading is /^ {0,3}(#{1,6})(?=\s|$)…/ and its blockquote is /^( {0,3}> ?…)+/ — the space after
+    // the marker is a lookahead, not a literal. A serializer that escapes only `# `/`> ` leaves these live, and
+    // the block type flips on the next load.
+    // Starts from a PARAGRAPH node, not from markdown: `>foo` as stored markdown is legitimately a quote. The
+    // defect is that a paragraph the user typed serializes to bytes that read back as a different block.
+    const paragraphSurvives = (text: string) => {
+        const editor = new Editor({
+            content: { content: [{ content: [{ text, type: 'text' }], type: 'paragraph' }], type: 'doc' },
+            extensions: createMarkdownExtensions(),
+        });
+        const saved = editor.getMarkdown();
+
+        editor.destroy();
+
+        const reloaded = new Editor({
+            content: saved,
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+        const out = { counts: structuralCounts(saved), text: reloaded.state.doc.textContent };
+
+        reloaded.destroy();
+
+        return out;
+    };
+
+    it.each([
+        ['>foo', 'a quote marker with no space'],
+        ['#', 'a lone hash'],
+        ['###', 'three hashes alone'],
+        ['#\tfoo', 'a hash followed by a tab'],
+        ['>', 'a lone quote marker'],
+    ])('a typed paragraph of %s stays a paragraph (%s)', (text) => {
+        expect(paragraphSurvives(text)).toEqual({ counts: {}, text });
+    });
+
+    it('leaves a real heading and a real quote alone', () => {
+        expect(structuralCounts(roundTrip('# real heading'))).toEqual({ heading: 1 });
+        expect(structuralCounts(roundTrip('> real quote'))).toEqual({ blockquote: 1 });
+    });
+
+    it('leaves seven hashes as a paragraph, exactly as marked reads them', () => {
+        expect(roundTrip('####### seven')).toBe('####### seven');
+    });
+
+    // The load side used to unescape `\#`/`\>` at ANY inline position while the serializer only re-escaped them
+    // line-leading, so a backslash in the middle of a line was eaten. `\<root\>` is a GNU-grep word boundary;
+    // dropping the second backslash changes what the command matches.
+    it.each([
+        'use \\# for comments and \\> for redirect',
+        "grep '\\<root\\>' /etc/passwd",
+        'sed -e "s/\\>/gt/" file',
+        'shell: cat file \\> out.txt',
+    ])('keeps an inline backslash escape byte-identical: %s', (source) => {
+        expect(roundTrip(source)).toBe(source);
+    });
+});
+
+describe('a setext underline after a hard break does not turn the paragraph into a heading', () => {
+    const hardBreakParagraph = (first: string, second: string) => {
+        const editor = new Editor({
+            content: {
+                content: [
+                    {
+                        content: [{ text: first, type: 'text' }, { type: 'hardBreak' }, { text: second, type: 'text' }],
+                        type: 'paragraph',
+                    },
+                ],
+                type: 'doc',
+            },
+            extensions: createMarkdownExtensions(),
+        });
+        const saved = editor.getMarkdown();
+
+        editor.destroy();
+
+        const reloaded = new Editor({
+            content: saved,
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+        const out = { counts: structuralCounts(saved), saved, text: reloaded.state.doc.textContent };
+
+        reloaded.destroy();
+
+        return out;
+    };
+
+    // marked's lheading run is `(=+|-+) *` — no three-character minimum, and trailing spaces are allowed. A
+    // single `-` on the line after a hard break was enough to swallow the paragraph into an H2.
+    it.each(['===', '---', '=', '-', '--', '===   '])('a continuation line of %s stays text', (underline) => {
+        const result = hardBreakParagraph('foo', underline);
+
+        expect(result.counts).toEqual({});
+        expect(result.text).toBe(`foo${underline}`);
+    });
+
+    it('leaves a real setext heading in stored markdown alone', () => {
+        expect(structuralCounts(roundTrip('Title\n===')).heading).toBe(1);
+    });
+
+    // The escape must not leak a literal backslash into the document text, and it must not eat a backslash the
+    // author wrote inside a character class.
+    it.each(['char class [a-z\\-_] here', 'sed s/a\\=b/x/', 'a \\- b and c \\= d'])(
+        'keeps an inline backslash before = or - byte-identical: %s',
+        (source) => {
+            expect(roundTrip(source)).toBe(source);
+        },
+    );
+});
+
+describe('brackets in a link label or an image alt do not break the node on reload', () => {
+    const reload = (markdown: string) => {
+        const editor = new Editor({
+            content: markdown,
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+        const out = {
+            counts: structuralCounts(markdown),
+            markdown: editor.getMarkdown(),
+            text: editor.state.doc.textContent,
+        };
+
+        editor.destroy();
+
+        return out;
+    };
+
+    const linkDoc = (label: string) => ({
+        content: [
+            {
+                content: [
+                    { marks: [{ attrs: { href: 'https://example.com/a' }, type: 'link' }], text: label, type: 'text' },
+                ],
+                type: 'paragraph',
+            },
+        ],
+        type: 'doc',
+    });
+
+    const imageDoc = (alt: string) => ({
+        content: [{ attrs: { alt, src: 'https://example.com/a.png' }, type: 'image' }],
+        type: 'doc',
+    });
+
+    const saveOf = (content: object) => {
+        const editor = new Editor({ content, extensions: createMarkdownExtensions() });
+        const saved = editor.getMarkdown();
+
+        editor.destroy();
+
+        return saved;
+    };
+
+    // A bracket-free label round-trips; the bracket case is handled where the link is inserted, because the
+    // label text is serialized by the text path and @tiptap/markdown hands a mark's renderMarkdown a
+    // placeholder rather than the text, so the escape cannot live there.
+    it.each(['a\\b', 'plain label', 'http://[::1]:8080/x'])('a link label of %s survives a round trip', (label) => {
+        const saved = saveOf(linkDoc(label));
+        const first = reload(saved);
+
+        expect(first.text).toBe(label);
+        expect(reload(first.markdown).markdown).toBe(first.markdown);
+    });
+
+    // An unbalanced bracket in alt broke `![alt](src)` outright: the reload parsed ZERO image nodes.
+    it.each(['a]b', 'a[b'])('an image alt of %s keeps the image node', (alt) => {
+        const saved = saveOf(imageDoc(alt));
+
+        expect(structuralCounts(saved).image).toBe(1);
+        expect(reload(saved).markdown).toBe(saved);
+    });
+});
+
+describe('a URL inserted as its own link label settles instead of growing', () => {
+    // The Link popover inserts the URL as the visible text when there is no selection. A `]` in that text
+    // closed the markdown label early — `[https://example.com/a]b](…)` — and the serialized form grew on
+    // every load+save cycle (measured 50 → 103 → 156 → 260). The form keeps brackets out of the label; this
+    // pins the property that matters, that the document converges.
+    it.each(['https://example.com/a]b', 'http://[::1]:8080/x', 'https://example.com/plain'])(
+        'inserting %s converges',
+        (url) => {
+            const editor = new Editor({ content: '', extensions: createMarkdownExtensions() });
+
+            editor
+                .chain()
+                .insertContent({
+                    marks: [{ attrs: { href: url }, type: 'link' }],
+                    text: url.replace(/[[\]]/g, ''),
+                    type: 'text',
+                })
+                .run();
+
+            const first = editor.getMarkdown();
+
+            editor.destroy();
+
+            expect(roundTrip(first)).toBe(first);
+        },
+    );
+});
+
+describe('a heading applied over the whole document', () => {
+    const apply = (source: string, level: number) => {
+        const editor = new Editor({ content: source, contentType: 'markdown', extensions: createMarkdownExtensions() });
+
+        editor.commands.selectAll();
+        editor.commands.toggleHeading({ level: level as 1 | 2 | 3 | 4 | 5 | 6 });
+
+        // selectAll materialises TrailingNode's empty paragraph, which serialises as a trailing blank line.
+        const out = editor.getMarkdown().trimEnd();
+
+        editor.destroy();
+
+        return out;
+    };
+
+    // toggleHeading had no whole-document wrapper, so Ctrl+A + "Heading 2" converted every table cell paragraph
+    // to a heading; saved as `| ## h | ## i |`, it reloads as literal cell text and escalates on each save.
+    it('leaves table cells alone', () => {
+        const source = ['lead', '', '| h | i |', '| --- | --- |', '| x | y |'].join('\n');
+        const out = apply(source, 2);
+
+        expect(out).not.toContain('## h');
+        expect(out).toContain('| h');
+        expect(out).toContain('## lead');
+    });
+
+    // The level the user picked has to reach setBlockType — a family that drops the attrs stamps H1 for every
+    // choice, and one that compares only the node type reads an all-H1 document as "already Heading 2".
+    it('applies the level the user chose, not the schema default', () => {
+        expect(apply('intro\n\nsecond', 2)).toBe('## intro\n\n## second');
+    });
+
+    it('promotes an all-H1 document to the chosen level instead of demoting it', () => {
+        expect(apply('# one\n\n# two', 2)).toBe('## one\n\n## two');
+    });
+
+    it('demotes to paragraphs when the chosen level is already applied', () => {
+        expect(apply('## one\n\n## two', 2)).toBe('one\n\ntwo');
+    });
+});
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-extensions.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-extensions.ts
index 739c1f2d..853c3cf8 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-extensions.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-extensions.ts
@@ -1,17 +1,25 @@
 import type {
+    AnyExtension,
+    CommandProps,
+    Editor,
     JSONContent,
     MarkdownParseHelpers,
     MarkdownParseResult,
     MarkdownRendererHelpers,
     MarkdownToken,
 } from '@tiptap/core';
+import type { NodeType, Node as ProseMirrorNode } from '@tiptap/pm/model';
+import type { EditorState } from '@tiptap/pm/state';
 
-import { mergeAttributes } from '@tiptap/core';
+import { isList, mergeAttributes } from '@tiptap/core';
 import { CodeBlockLowlight } from '@tiptap/extension-code-block-lowlight';
 import { Image } from '@tiptap/extension-image';
 import { TaskItem, TaskList } from '@tiptap/extension-list';
 import { TableCell, TableHeader, TableRow } from '@tiptap/extension-table';
 import { Placeholder } from '@tiptap/extensions';
+import { NodeRange } from '@tiptap/pm/model';
+import { Selection, TextSelection } from '@tiptap/pm/state';
+import { findWrapping, liftTarget } from '@tiptap/pm/transform';
 import StarterKit from '@tiptap/starter-kit';
 import { common, createLowlight } from 'lowlight';
 
@@ -24,22 +32,349 @@ import { VariableHighlight } from './markdown-editor-variable-highlight';
 const dropUnderscoreRules = (rules: { find: unknown }[]) =>
     rules.filter((rule) => !(rule.find instanceof RegExp && rule.find.source.includes('_')));
 
-const longestBacktickRun = (text: string): number =>
-    (text.match(/`+/g) ?? []).reduce((max, run) => Math.max(max, run.length), 0);
+type BlockAttrs = Record<string, unknown> | undefined;
+type BlockFamily = {
+    isApplied: (type: NodeType, state: EditorState, attrs?: BlockAttrs) => boolean;
+    toggle: (type: NodeType, props: CommandProps, delegate: DelegatedToggle, attrs?: BlockAttrs) => boolean;
+};
+type CommandMap = Record<string, ToggleCommand | undefined>;
+type DelegatedToggle = (props?: CommandProps) => boolean;
+type ToggleCommand = (...args: never[]) => (props: never) => boolean;
+type TopLevelChild = { node: ProseMirrorNode; pos: number };
+
+// Ctrl+A and a mouse drag across everything are different Selection classes but the same intent, so keying off
+// `instanceof AllSelection` silently leaves the drag path on the broken code path.
+const isWholeDocumentSelection = ({ doc, selection }: EditorState): boolean => {
+    const { empty, from, to } = selection;
+
+    return (
+        !empty &&
+        ((from === 0 && to === doc.content.size) ||
+            (from <= Selection.atStart(doc).from && to >= Selection.atEnd(doc).to))
+    );
+};
+
+// TrailingNode appends its empty paragraph on the selectAll transaction itself, so it is already inside the
+// user's selection before any toggle runs. Counting it makes an already-wrapped document read as unwrapped.
+const contentChildren = (doc: ProseMirrorNode): TopLevelChild[] => {
+    const children: TopLevelChild[] = [];
+
+    doc.forEach((node, pos) => children.push({ node, pos }));
+
+    const last = children.at(-1);
+
+    if (children.length > 1 && last?.node.isTextblock && last.node.content.size === 0) {
+        children.pop();
+    }
+
+    return children;
+};
+
+const contentSpan = (children: TopLevelChild[]) => {
+    const last = children.at(-1)!;
+
+    return { end: last.pos + last.node.nodeSize, start: children[0]!.pos };
+};
+
+// `liftTarget` is null for EVERY range at depth 0, so `commands.lift` can never undo a wrapper spanning the
+// whole document. A range over the wrapper's own content resolves at depth 1, which does have a target.
+const liftRangeOf = (doc: ProseMirrorNode, pos: number, node: ProseMirrorNode) =>
+    doc.resolve(pos + 1).blockRange(doc.resolve(pos + node.nodeSize - 1));
+
+const wrapFamily: BlockFamily = {
+    isApplied: (type, { doc }) => {
+        const children = contentChildren(doc);
+
+        return children.length > 0 && children.every(({ node }) => node.type === type);
+    },
+    toggle: (type, { dispatch, state, tr }) => {
+        const children = contentChildren(state.doc);
+
+        if (!children.length) {
+            return false;
+        }
+
+        if (wrapFamily.isApplied(type, state)) {
+            const targets = children.map(({ node, pos }) => {
+                const range = liftRangeOf(state.doc, pos, node);
+
+                return range ? liftTarget(range) : null;
+            });
+
+            if (targets.some((target) => target === null)) {
+                return false;
+            }
+
+            if (dispatch) {
+                for (const { node, pos } of [...children].reverse()) {
+                    const range = liftRangeOf(tr.doc, tr.mapping.map(pos), node);
+                    const target = range ? liftTarget(range) : null;
+
+                    if (range && target !== null) {
+                        tr.lift(range, target);
+                    }
+                }
+            }
+
+            return true;
+        }
+
+        const { end, start } = contentSpan(children);
+        const range = new NodeRange(state.doc.resolve(start), state.doc.resolve(end), 0);
+        const wrapping = findWrapping(range, type);
+
+        if (!wrapping) {
+            return false;
+        }
+
+        if (dispatch) {
+            tr.wrap(range, wrapping);
+        }
+
+        return true;
+    },
+};
+
+const canRetype = (doc: ProseMirrorNode, pos: number, type: NodeType) => {
+    const $pos = doc.resolve(pos);
+
+    return $pos.parent.canReplaceWith($pos.index(), $pos.index() + 1, type);
+};
+
+const blockTypeCandidates = (state: EditorState, type: NodeType): TopLevelChild[] => {
+    const children = contentChildren(state.doc);
+
+    if (!children.length) {
+        return [];
+    }
+
+    const { end, start } = contentSpan(children);
+    const candidates: TopLevelChild[] = [];
+
+    state.doc.nodesBetween(start, end, (node, pos) => {
+        // A cell serialises inline, so a fence placed inside one comes back from the next load as literal
+        // backticks. Descending into a table trades a reversible refusal for silent corruption.
+        if (node.type.spec.tableRole === 'table') {
+            return false;
+        }
+
+        if (node.isTextblock && (node.type === type || canRetype(state.doc, pos, type))) {
+            candidates.push({ node, pos });
+        }
+
+        return true;
+    });
+
+    return candidates;
+};
+
+// A heading carries its level in attrs, so "already applied" and the value written both have to account for
+// them: comparing node type alone reads an all-H1 document as already being Heading 2 and demotes it, and
+// dropping the attrs on the way in stamps the schema default level for every choice the user makes.
+const hasAttrs = (node: ProseMirrorNode, attrs: BlockAttrs) =>
+    !attrs || Object.entries(attrs).every(([key, value]) => node.attrs[key] === value);
+
+const blockTypeFamily: BlockFamily = {
+    isApplied: (type, state, attrs) => {
+        const candidates = blockTypeCandidates(state, type);
+
+        return candidates.length > 0 && candidates.every(({ node }) => node.type === type && hasAttrs(node, attrs));
+    },
+    toggle: (type, { dispatch, state, tr }, _delegate, attrs) => {
+        const candidates = blockTypeCandidates(state, type);
+
+        if (!candidates.length) {
+            return false;
+        }
+
+        const isApplied = blockTypeFamily.isApplied(type, state, attrs);
+        const target = isApplied ? state.schema.nodes.paragraph! : type;
+        const targetAttrs = isApplied ? null : ((attrs ?? null) as null | Record<string, unknown>);
+
+        if (
+            !candidates.some(
+                ({ node, pos }) =>
+                    (node.type !== target || !hasAttrs(node, attrs)) && canRetype(state.doc, pos, target),
+            )
+        ) {
+            return false;
+        }
+
+        if (dispatch) {
+            for (const { node, pos } of [...candidates].reverse()) {
+                tr.setBlockType(pos, pos + node.nodeSize, target, targetAttrs);
+            }
+        }
+
+        return true;
+    },
+};
+
+const listFamily: BlockFamily = {
+    isApplied: (type, state) => {
+        const children = contentChildren(state.doc);
+
+        return children.length > 0 && children.every(({ node }) => node.type === type);
+    },
+    toggle: (type, { chain, editor, state }, delegate) => {
+        const { extensions } = editor.extensionManager;
+        const children = contentChildren(state.doc);
+        // Derived from `children` rather than recomputed, so the index lookups below compare the same objects.
+        const candidates = children.filter(({ node }) => node.isTextblock || isList(node.type.name, extensions));
+        const first = candidates[0];
+        const last = candidates.at(-1);
+
+        if (!first || !last) {
+            return false;
+        }
+
+        const isApplied = children.every(({ node }) => node.type === type);
+        const hasGap = children.indexOf(last) - children.indexOf(first) + 1 !== candidates.length;
+
+        if (!isApplied && hasGap) {
+            return false;
+        }
+
+        const { end, start } = contentSpan(candidates);
+        const seated = isApplied
+            ? TextSelection.between(state.doc.resolve(start + 1), state.doc.resolve(end - 1))
+            : TextSelection.between(state.doc.resolve(start), state.doc.resolve(end));
+        const restored = state.selection;
+        let hasToggled = false;
+
+        return (
+            // Nothing here may branch on `dispatch`. Under `can()` the transaction is discarded anyway, so
+            // seating costs nothing — but skipping it there hands the delegate the whole-document selection it
+            // cannot use, and the control reports unavailable for a click that would have worked.
+            chain()
+                .command(({ tr }) => {
+                    tr.setSelection(seated);
+
+                    return true;
+                })
+                .command((chained) => {
+                    hasToggled = delegate(chained);
+
+                    return hasToggled;
+                })
+                // A chain dispatches what its callbacks already wrote even when one returns false, so a delegate
+                // that half-applied its `clearNodes` fallback would commit a flattened document without this.
+                .command(({ tr }) => {
+                    if (hasToggled) {
+                        tr.setSelection(restored.map(tr.doc, tr.mapping));
+                    } else {
+                        tr.setMeta('preventDispatch', true);
+                    }
+
+                    return true;
+                })
+                .run()
+        );
+    },
+};
+
+const BLOCK_FAMILIES: Record<string, BlockFamily | undefined> = {
+    blockquote: wrapFamily,
+    bulletList: listFamily,
+    codeBlock: blockTypeFamily,
+    orderedList: listFamily,
+    taskList: listFamily,
+};
+
+/**
+ * The toolbar MUST read its pressed state from here rather than from `editor.isActive`: tiptap's predicate
+ * demands the type cover the whole selection, so an already-quoted document under Ctrl+A reads as not quoted
+ * and the button would contradict what its own click does.
+ */
+export const isBlockApplied = (editor: Editor, nodeName: string): boolean => {
+    const { state } = editor;
+    const family = BLOCK_FAMILIES[nodeName];
+    const type = state.schema.nodes[nodeName];
+
+    if (!family || !type || !isWholeDocumentSelection(state)) {
+        return editor.isActive(nodeName);
+    }
+
+    return family.isApplied(type, state);
+};
+
+const withWholeDocumentToggle = <T extends AnyExtension>(extension: T, commandName: string, family: BlockFamily): T =>
+    extension.extend({
+        addCommands() {
+            const parent = (this.parent?.() ?? {}) as CommandMap;
+            const original = parent[commandName];
+            const { name } = this;
+
+            if (!original) {
+                return parent;
+            }
+
+            return {
+                ...parent,
+                [commandName]:
+                    (...args: never[]) =>
+                    (props: never) => {
+                        const commandProps = props as CommandProps;
+                        const delegate = (chained: CommandProps = commandProps) => original(...args)(chained as never);
+
+                        if (!isWholeDocumentSelection(commandProps.state)) {
+                            return delegate();
+                        }
+
+                        return family.toggle(
+                            commandProps.state.schema.nodes[name]!,
+                            commandProps,
+                            delegate,
+                            args[0] as BlockAttrs,
+                        );
+                    },
+            };
+        },
+    }) as T;
+
+type MarkdownTokenizer = {
+    start?: (src: string) => number;
+    tokenize: (src: string, tokens: unknown[], lexer: unknown) => unknown;
+};
+
+// marked runs every block extension's `tokenize` at EVERY block boundary, handing it the whole remaining
+// document, and @tiptap/extension-list's ordered/task tokenizers open with `src.split('\n')` before bailing
+// on a first line that isn't a list item — so each boundary materialises all remaining lines, O(n²).
+//
+// The gate is the tokenizer's OWN `start`, never a copy of its marker syntax: `start` is anchored and cheap,
+// and reusing it means the guard cannot drift narrower than the grammar upstream accepts. A non-zero result
+// says the block does not begin here, which is exactly when `tokenize` would have returned undefined anyway.
+const guardBlockTokenizer = <T extends AnyExtension>(extension: T): T => {
+    const original = (extension.config as { markdownTokenizer?: MarkdownTokenizer }).markdownTokenizer;
+    const start = original?.start;
+
+    if (!original || !start) {
+        return extension;
+    }
+
+    return extension.extend({
+        markdownTokenizer: {
+            ...original,
+            tokenize: (src: string, tokens: unknown[], lexer: unknown) =>
+                start(src) === 0 ? original.tokenize(src, tokens, lexer) : undefined,
+        },
+    }) as T;
+};
+
+const longestRun = (text: string, runs: RegExp): number =>
+    (text.match(runs) ?? []).reduce((max, run) => Math.max(max, run.length), 0);
 
 // @tiptap/extension-code-block's renderMarkdown always emits a 3-backtick fence, so a code block whose content
 // contains a ``` line (a doc demonstrating fenced markdown — common in knowledge/prompt examples) re-parses as
 // TWO blocks on the next load: the inner fence closes the outer one. CommonMark requires the fence to be longer
-// than any backtick run inside — widen it. Otherwise identical to upstream.
+// than any backtick run inside — widen it. CommonMark also forbids a backtick in a BACKTICK fence's info
+// string while allowing one in a tilde fence's, so a language holding a backtick must ride a `~~~` fence.
+// Otherwise identical to upstream.
 const renderTunedCodeBlock = (node: JSONContent, helpers: MarkdownRendererHelpers): string => {
-    const language = node.attrs?.language || '';
-
-    if (!node.content) {
-        return `\`\`\`${language}\n\n\`\`\``;
-    }
-
-    const content = helpers.renderChildren(node.content);
-    const fence = '`'.repeat(Math.max(3, longestBacktickRun(content) + 1));
+    const language: string = node.attrs?.language || '';
+    const [marker, runs] = language.includes('`') ? (['~', /~+/g] as const) : (['`', /`+/g] as const);
+    const content = node.content ? helpers.renderChildren(node.content) : '';
+    const fence = marker.repeat(Math.max(3, longestRun(content, runs) + 1));
 
     return [`${fence}${language}`, content, fence].join('\n');
 };
@@ -71,6 +406,20 @@ const lowlight = createLowlight(common);
 // stamps the fence language onto the `<pre>` as data-language so a CSS caption
 // (index.css) can name the block — the label lives in the DOM, not the document.
 const TunedCodeBlock = CodeBlockLowlight.extend({
+    // `defaultLanguage` below feeds the highlight plugin, which reads `attrs.language || defaultLanguage`.
+    // As an ATTRIBUTE default it would also stamp `plaintext` onto every block created in the editor, and
+    // renderMarkdown would write that into the fence — a language the author never typed.
+    addAttributes() {
+        const attributes = this.parent?.() as undefined | { language?: Record<string, unknown> };
+
+        return { ...attributes, language: { ...attributes?.language, default: null } };
+    },
+    // CodeBlockLowlight builds its plugins as `[...this.parent?.(), LowlightPlugin(...)]` and `.extend()` copies
+    // that into every layer, so each layer highlights the whole document again. Measured: this pass-through
+    // collapses them to one only from INSIDE this literal — as an outer `.extend()` layer it leaves three.
+    addProseMirrorPlugins() {
+        return this.parent?.() ?? [];
+    },
     parseMarkdown: parseTunedCodeBlock,
     renderHTML({ HTMLAttributes, node }) {
         const language = (node.attrs.language as null | string) || null;
@@ -82,7 +431,9 @@ const TunedCodeBlock = CodeBlockLowlight.extend({
         ];
     },
     renderMarkdown: renderTunedCodeBlock,
-}).configure({ HTMLAttributes: { class: 'hljs' }, lowlight });
+    // Without defaultLanguage an info-string-less fence falls to highlightAuto, which re-scans all 37 `common`
+    // grammars over every code block in the document on each keystroke inside one.
+}).configure({ defaultLanguage: 'plaintext', HTMLAttributes: { class: 'hljs' }, lowlight });
 
 // A paragraph line that literally starts with `# ` or `> ` re-parses as a heading / blockquote on the next load
 // (an ATX heading interrupts a paragraph; `>` opens a quote), silently changing the block TYPE of body text —
@@ -91,10 +442,27 @@ const TunedCodeBlock = CodeBlockLowlight.extend({
 // `1.`/fences overlap with literal regex/glob/backref escapes (`\*`, `\1`, `\|`) the editor must preserve.
 const escapeLineLeadingBlockMarkers = (markdown: string): string =>
     markdown.replace(
-        /(^|\n)( {0,3})(#{1,6} |> )/g,
+        /(^|\n)( {0,3})(#{1,6}(?=[ \t\n]|$)|>)/g,
         (_match, lineStart: string, indent: string, marker: string) => `${lineStart}${indent}\\${marker}`,
     );
 
+// marked reads a line of only `=` or `-` sitting directly under text as a setext underline (`(=+|-+) *` — no
+// three-character minimum), so a hard break followed by such a line turns the whole paragraph into a heading
+// and eats the run. Only continuation lines need it: a paragraph's first line is preceded by a blank line,
+// which stops lheading. The load side unescapes exactly this shape, so an author's `\-` inside a character
+// class is left alone.
+const escapeSetextUnderlines = (markdown: string): string =>
+    markdown.replace(
+        /(\n {0,3})((?:=+|-+) *)(?=\n|$)/g,
+        (_match, lineStart: string, run: string) => `${lineStart}\\${run}`,
+    );
+
+// A `]` inside an image alt closes the markdown label early and the image loses its node entirely on reload.
+// marked unescapes `\[`/`\]` inside a label through its own outputLink pass, independent of the neutralised
+// inline escape tokenizer, so escaping just those two closes the round trip. A lone `\` is NOT escaped —
+// marked would not unescape it back.
+const escapeBracketsInLabel = (text: string): string => text.replace(/[[\]]/g, (bracket) => `\\${bracket}`);
+
 // StarterKit's Bold/Italic register BOTH `**`/`*` and `__`/`_` input+paste rules. The marked layer keeps
 // `_`-emphasis literal on load/paste, so leaving the underscore TYPING rules on would diverge — typed
 // `__init__`/`_word_` would emphasize (→ `**init**`/`*word*`) while the same text loaded stays literal,
@@ -114,10 +482,39 @@ const TunedStarterKit = StarterKit.extend({
                 });
             }
 
+            if (extension.name === 'orderedList') {
+                return withWholeDocumentToggle(guardBlockTokenizer(extension), 'toggleOrderedList', listFamily);
+            }
+
+            if (extension.name === 'bulletList') {
+                return withWholeDocumentToggle(extension, 'toggleBulletList', listFamily);
+            }
+
+            if (extension.name === 'blockquote') {
+                return withWholeDocumentToggle(extension, 'toggleBlockquote', wrapFamily);
+            }
+
+            if (extension.name === 'heading') {
+                return withWholeDocumentToggle(extension, 'toggleHeading', blockTypeFamily);
+            }
+
             if (extension.name === 'paragraph') {
                 return extension.extend({
                     renderMarkdown(node: JSONContent, helpers: MarkdownRendererHelpers) {
-                        return escapeLineLeadingBlockMarkers(helpers.renderChildren(node.content ?? []));
+                        return escapeSetextUnderlines(
+                            escapeLineLeadingBlockMarkers(helpers.renderChildren(node.content ?? [])),
+                        );
+                    },
+                });
+            }
+
+            // Emit the code mark's content with NO backtick fence: the real content-sized fence comes from
+            // serializeCodeSpan in the text encoder (markdown-editor-marked.ts). The two are paired — restoring a
+            // fence here double-wraps every code span.
+            if (extension.name === 'code') {
+                return extension.extend({
+                    renderMarkdown(node: JSONContent, helpers: MarkdownRendererHelpers) {
+                        return node.content ? helpers.renderChildren(node.content) : '';
                     },
                 });
             }
@@ -143,15 +540,27 @@ export const createMarkdownExtensions = (placeholder?: string) => [
         link: { autolink: true, linkOnPaste: true, openOnClick: false },
         underline: false,
     }),
-    TunedCodeBlock,
+    withWholeDocumentToggle(TunedCodeBlock, 'toggleCodeBlock', blockTypeFamily),
     HeadingAutoformat,
     TunedTable.configure({ resizable: true }),
     TableRow,
     TableHeader,
     TableCell,
-    TaskList,
-    TaskItem.configure({ nested: true }),
-    Image,
+    withWholeDocumentToggle(guardBlockTokenizer(TaskList), 'toggleTaskList', listFamily),
+    TaskItem.configure({
+        a11y: {
+            checkboxLabel: (node) => `Task item checkbox for ${node.firstChild?.textContent || 'empty task item'}`,
+        },
+        nested: true,
+    }),
+    Image.extend({
+        renderMarkdown(node: JSONContent) {
+            const { alt = '', src = '', title = '' } = node.attrs ?? {};
+            const label = escapeBracketsInLabel(String(alt));
+
+            return title ? `![${label}](${src} "${title}")` : `![${label}](${src})`;
+        },
+    }),
     VariableHighlight,
     TagHighlight,
     Placeholder.configure({ emptyEditorClass: 'is-editor-empty', placeholder }),
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-focus.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-focus.ts
new file mode 100644
index 00000000..406b228b
--- /dev/null
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-focus.ts
@@ -0,0 +1,17 @@
+import type { Editor } from '@tiptap/react';
+
+/**
+ * `onCloseAutoFocus` handler shared by every editor popover and dropdown: keep focus on the caret instead of
+ * the trigger so the user can keep typing.
+ *
+ * The destroyed check is load-bearing, not defensive. Radix closes a still-open layer asynchronously, so
+ * unmounting the editor with a menu open lands this callback on a torn-down instance and `editor.commands`
+ * throws — reproduced by the toolbar tests, which took `vitest run` to exit 1 while every test read green.
+ */
+export const returnFocusToEditor = (editor: Editor) => (event: Event) => {
+    event.preventDefault();
+
+    if (!editor.isDestroyed) {
+        editor.commands.focus();
+    }
+};
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-heading-autoformat.test.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-heading-autoformat.test.ts
index 25964082..425c4520 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-heading-autoformat.test.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-heading-autoformat.test.ts
@@ -592,6 +592,18 @@ describe('re-entrancy & inert nodes', () => {
         expect(firstBlock(json).type).toBe('codeBlock');
     });
 
+    it('a leading code span whose content starts with "# " keeps its hash and stays a paragraph', () => {
+        const editor = new Editor({ content: '', contentType: 'markdown', extensions: createMarkdownExtensions() });
+
+        // The plugin runs from appendTransaction, so a bare `new Editor({ content })` never reaches it —
+        // the load has to arrive as a transaction, the way every real load does.
+        editor.commands.setContent('`# Title` trailing', { contentType: 'markdown' });
+
+        expect(liveHeadings(editor)).toBe(0);
+        expect(editor.state.doc.textContent).toBe('# Title trailing');
+        expect(editor.getMarkdown().trimEnd()).toBe('`# Title` trailing');
+    });
+
     it('an empty paragraph is skipped without throwing during the scan', () => {
         expect(() =>
             run(doc(para(), para(t('body'))), (editor) => {
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-heading-autoformat.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-heading-autoformat.ts
index 489cbd7e..f203e7b2 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-heading-autoformat.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-heading-autoformat.ts
@@ -55,7 +55,8 @@ export const HeadingAutoformat = Extension.create({
                         }
 
                         const first = node.firstChild;
-                        const match = first?.isText && first.text ? HEADING_MARKER.exec(first.text) : null;
+                        const isMarkup = first?.isText && !first.marks.some((mark) => mark.type.name === 'code');
+                        const match = isMarkup && first.text ? HEADING_MARKER.exec(first.text) : null;
 
                         if (match && !containsHardBreak(node, hardBreak)) {
                             const start = pos + 1;
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-image-handle.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-image-handle.tsx
index 22a08c7c..e998bf07 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-image-handle.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-image-handle.tsx
@@ -6,6 +6,7 @@ import { useEffect, useState } from 'react';
 
 import { Popover, PopoverAnchor, PopoverContent } from '@/components/ui/popover';
 
+import { returnFocusToEditor } from './markdown-editor-focus';
 import { ImageEditForm } from './markdown-editor-image-edit-form';
 import { getEditorScrollParent } from './markdown-editor-styles';
 
@@ -45,10 +46,7 @@ export function ImageHandle({ editor }: { editor: Editor }) {
                 align="start"
                 className="w-80"
                 data-image-handle=""
-                onCloseAutoFocus={(event) => {
-                    event.preventDefault();
-                    editor.commands.focus();
-                }}
+                onCloseAutoFocus={returnFocusToEditor(editor)}
                 onOpenAutoFocus={(event) => {
                     // The popover appears when an image is selected — keep focus in the doc so it doesn't steal it;
                     // the user clicks into the URL field only to actually edit.
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-image-src.test.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-image-src.test.ts
index 624082b1..4d7dac5e 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-image-src.test.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-image-src.test.ts
@@ -65,3 +65,46 @@ describe('normalizeLinkUrl — prepend https to scheme-less input, validate prot
         expect(normalizeLinkUrl(input)).toBeNull();
     });
 });
+
+describe('whitespace and unknown schemes are rejected, not laundered into the document', () => {
+    // `new URL()` accepts a space, so the raw candidate persisted as `[hello](https://example.com/my page)` —
+    // which reloads with the link destroyed and the brackets leaking into the text.
+    it.each(['example.com/my page', 'https://example.com/a b', ' https://example.com/a\tb '])(
+        'rejects a URL containing whitespace: %s',
+        (value) => {
+            expect(normalizeLinkUrl(value)).toBeNull();
+            expect(normalizeImageSrc(value)).toBeNull();
+        },
+    );
+
+    // `https://` was prefixed onto anything unrecognised, so `ftp://host/file` became `https://ftp://host/file`
+    // — parsed as host `ftp`, shown as valid, and persisted as a dead link with no error.
+    it.each(['ftp://example.com/a', 'chrome://settings', 'ssh://host/x', 'file:///etc/passwd'])(
+        'rejects the unknown scheme %s instead of prefixing https:// onto it',
+        (value) => {
+            expect(normalizeLinkUrl(value)).toBeNull();
+        },
+    );
+
+    // Values the guard must NOT catch: a scheme-less host:port reads like a scheme but is ordinary input.
+    it.each(['example.com:8080/path', 'localhost:3000', 'localhost:3000/a', 'a.b.c:9200/_search'])(
+        'still accepts the scheme-less host:port %s',
+        (value) => {
+            expect(normalizeLinkUrl(value)).toBe(`https://${value}`);
+        },
+    );
+
+    it('still accepts a protocol-relative URL', () => {
+        expect(normalizeImageSrc('//cdn.example.com/a.png')).toBe('https://cdn.example.com/a.png');
+    });
+
+    // Byte-fidelity: routing the value through `new URL().href` would rewrite all three, which is why the fix
+    // rejects whitespace rather than re-encoding.
+    it.each([
+        ['example.com', 'https://example.com'],
+        ['https://example.com/{{HOST}}/x', 'https://example.com/{{HOST}}/x'],
+        ['https://example.com/путь', 'https://example.com/путь'],
+    ])('keeps %s byte-identical', (input, expected) => {
+        expect(normalizeLinkUrl(input)).toBe(expected);
+    });
+});
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-link-edit-form.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-link-edit-form.tsx
index 835eaefc..44d7f2e9 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-link-edit-form.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-link-edit-form.tsx
@@ -39,10 +39,20 @@ export function LinkEditForm({ autoFocus = true, editor, initialUrl, isActive, o
         if (empty && !isActive) {
             // No selection to wrap → insert the URL as its own linked text: the visible text is what the user
             // typed, but the href is the normalized value.
+            //
+            // A `]` in that text would close the markdown label early — `[https://x/a]b](…)` — and the whole
+            // construct leaks into literal text, growing on every load+save cycle. The label is serialized by
+            // the text path, which has no mark context, so the escape cannot live in the link's renderMarkdown
+            // (@tiptap/markdown hands that renderer a placeholder, not the text). Keep the brackets out of the
+            // label here instead; the href itself still carries them verbatim.
             editor
                 .chain()
                 .focus()
-                .insertContent({ marks: [{ attrs: { href }, type: 'link' }], text: url.trim(), type: 'text' })
+                .insertContent({
+                    marks: [{ attrs: { href }, type: 'link' }],
+                    text: url.trim().replace(/[[\]]/g, ''),
+                    type: 'text',
+                })
                 .run();
         } else {
             editor.chain().focus().extendMarkRange('link').setLink({ href }).run();
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-link-handle.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-link-handle.tsx
index 71dd36e1..6f38521e 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-link-handle.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-link-handle.tsx
@@ -1,10 +1,11 @@
 import type { Editor } from '@tiptap/react';
 
 import { getMarkRange, posToDOMRect } from '@tiptap/core';
-import { useEffect, useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 
 import { Popover, PopoverAnchor, PopoverContent } from '@/components/ui/popover';
 
+import { returnFocusToEditor } from './markdown-editor-focus';
 import { LinkEditForm } from './markdown-editor-link-edit-form';
 import { getEditorScrollParent } from './markdown-editor-styles';
 
@@ -47,10 +48,7 @@ export function LinkHandle({ editor }: { editor: Editor }) {
                 align="start"
                 className="w-80 p-2"
                 data-link-handle=""
-                onCloseAutoFocus={(event) => {
-                    event.preventDefault();
-                    editor.commands.focus();
-                }}
+                onCloseAutoFocus={returnFocusToEditor(editor)}
                 onOpenAutoFocus={(event) => {
                     // The popover appears whenever the caret enters a link, so keep focus in the doc — stealing it
                     // would interrupt typing/navigation. The user clicks into the URL field only to actually edit.
@@ -74,6 +72,10 @@ export function LinkHandle({ editor }: { editor: Editor }) {
 
 function useLinkHandle(editor: Editor) {
     const [target, setTarget] = useState<LinkTarget | null>(null);
+    // Escape only cleared `target`, and the next selectionUpdate re-targeted unconditionally while the caret
+    // was still in the link — so a dismiss lasted exactly one keystroke. Remember which link was dismissed and
+    // stay closed for it until the caret leaves, an edit shifts its start, or the toolbar opens it on purpose.
+    const dismissedKeyRef = useRef<null | string>(null);
 
     useEffect(() => {
         const linkType = editor.schema.marks.link;
@@ -82,6 +84,7 @@ function useLinkHandle(editor: Editor) {
             const { selection } = editor.state;
 
             if (!linkType || !selection.empty || !editor.isActive('link')) {
+                dismissedKeyRef.current = null;
                 setTarget(null);
 
                 return;
@@ -90,11 +93,16 @@ function useLinkHandle(editor: Editor) {
             const range = getMarkRange(selection.$from, linkType);
 
             if (!range) {
+                dismissedKeyRef.current = null;
                 setTarget(null);
 
                 return;
             }
 
+            if (dismissedKeyRef.current === `${range.from}`) {
+                return;
+            }
+
             const rect = posToDOMRect(editor.view, range.from, range.to);
             const href = (editor.getAttributes('link').href as string | undefined) ?? '';
 
@@ -106,7 +114,13 @@ function useLinkHandle(editor: Editor) {
 
         const clear = () => setTarget(null);
 
+        // An edit before the link moves its start, so the remembered key no longer identifies it.
+        const forget = () => {
+            dismissedKeyRef.current = null;
+        };
+
         editor.on('selectionUpdate', update);
+        editor.on('update', forget);
 
         // Fixed-positioned anchor goes stale on scroll/resize — drop it (it reappears on the next caret entry).
         const scrollParent = getEditorScrollParent(editor.view.dom);
@@ -116,10 +130,17 @@ function useLinkHandle(editor: Editor) {
 
         return () => {
             editor.off('selectionUpdate', update);
+            editor.off('update', forget);
             scrollParent.removeEventListener('scroll', clear);
             window.removeEventListener('resize', clear);
         };
     }, [editor]);
 
-    return { close: () => setTarget(null), target };
+    return {
+        close: () => {
+            dismissedKeyRef.current = target?.key ?? null;
+            setTarget(null);
+        },
+        target,
+    };
 }
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-marked.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-marked.ts
index f64633dc..f8f6a92b 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-marked.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-marked.ts
@@ -5,7 +5,7 @@ import { renderTableToMarkdown, Table } from '@tiptap/extension-table';
 import { Markdown } from '@tiptap/markdown';
 import { Marked } from 'marked';
 
-import { escapeTablePipes } from './markdown-editor-table-pipes';
+import { escapeTablePipes, TEMPLATE_ACTION } from './markdown-editor-table-pipes';
 
 // @tiptap/markdown parses with `marked`, which — unlike markdown-it's `html: false` — always tries to
 // interpret `<...>` as HTML. Our content uses literal XML-ish tags (`<container_environment>`, `<input>`)
@@ -23,9 +23,10 @@ const createTunedMarked = () => {
             //   • del      — keep GFM `~~strike~~`, drop a lone `~…~` (else `~5~` / ranges become <del>)
             //   • emStrong — keep `*`/`**`, drop `_`-delimited emphasis (else `__init__`/`_word_` become em/strong)
             //   • escape   — keep `\`+punct literal (`\.` `\*` `\|` `\\`); marked's default DROPS the backslash
-            //                (CommonMark unescape), silently corrupting regex/paths on the first load. EXCEPT
-            //                `\#`/`\>`: unescape those, symmetric with the paragraph serializer escaping a
-            //                line-leading `# `/`> ` so body text doesn't re-parse as a heading/quote
+            //                (CommonMark unescape), silently corrupting regex/paths on the first load. The
+            //                `\#`/`\>` counterpart to the paragraph serializer is NOT here: an inline tokenizer
+            //                fires at any position, so it also ate the backslash mid-line (`grep '\<root\>'`).
+            //                It lives in the Lexer's inlineTokens override below, which sees line starts.
             //   • html/tag — keep `<xml-like>` tags literal (marked swallows real-HTML-element names)
             // NB: autolink/url are intentionally NOT neutralised — a bare `https://…`, `<url>` or email is
             // meant to become a link (see markdown-editor-extensions.ts link config, kept symmetric with typing).
@@ -36,11 +37,7 @@ const createTunedMarked = () => {
             // `&lt;` — that re-freezes the artifacts.
             del: (src: string) => (/^~~(?!~)/.test(src) ? false : undefined),
             emStrong: (src: string) => (/^_/.test(src) ? undefined : false),
-            escape: (src: string) => {
-                const marker = /^\\([#>])/.exec(src);
-
-                return marker ? { raw: marker[0], text: marker[1]!, type: 'escape' as const } : undefined;
-            },
+            escape: () => undefined,
             html: () => undefined,
             tag: () => undefined,
         },
@@ -51,10 +48,24 @@ const createTunedMarked = () => {
     // tokenization, dropping trailing cells). @tiptap/markdown's manager builds its block lexer via
     // `new markedInstance.Lexer(...)` — including for the construction-time initial parse — so subclassing
     // this PRIVATE instance's Lexer keeps the transform instance-scoped (no shared-class mutation) and still
-    // catches every load. `inlineTokens` is inherited unchanged, so inline fragments are not touched.
+    // catches every load.
     const BaseLexer = instance.Lexer;
 
     instance.Lexer = class extends BaseLexer {
+        // Undo the paragraph serializer's line-leading `\#`/`\>` here rather than in an inline tokenizer or in
+        // `lex`. An inline tokenizer has no notion of position and ate the backslash mid-line; `lex` runs
+        // BEFORE block tokenization, so unescaping there hands marked a live `#`/`>` and the paragraph the
+        // escape exists to protect becomes a heading or a quote again.
+        override inlineTokens(src: string, tokens = []) {
+            const unescaped = src
+                .replace(/(^|\n)\\([#>])/g, '$1$2')
+                // Only a backslash before a run that FILLS the line, matching what the serializer escapes —
+                // an author's `\-` inside `[a-z\-_]` keeps its backslash.
+                .replace(/(\n {0,3})\\((?:=+|-+) *)(?=\n|$)/g, '$1$2');
+
+            return super.inlineTokens(unescaped, tokens);
+        }
+
         override lex(src: string) {
             return super.lex(escapeTablePipes(src));
         }
@@ -64,13 +75,30 @@ const createTunedMarked = () => {
     return instance;
 };
 
-// The serialize-side counterpart to createTunedMarked. @tiptap/markdown's MarkdownManager
-// .encodeTextForMarkdown HTML-entity-encodes text (`<` → `&lt;`) and backslash-escapes ``` ` * _ [ ] ~ \ ```.
-// Both are wrong here: the load side keeps `\`+punct literal (escape tokenizer off), so re-escaping on save
-// would double every backslash; and named HTML entities are DECODED on load (`&lt;`→`<`), so re-encoding
-// would freeze them back into `&lt;`. Serialization is hard-coded in the manager (no per-extension hook), so
-// replace that one method with identity — save emits exactly the text the doc holds.
-type ManagerWithEncode = { encodeTextForMarkdown: (text: string) => string };
+type ManagerWithEncode = { encodeTextForMarkdown: (text: string, node?: SerializedNode, parent?: unknown) => string };
+type SerializedNode = { marks?: (string | { type?: string })[]; text?: string };
+
+const hasCodeMark = (node?: SerializedNode): boolean =>
+    (node?.marks ?? []).some((mark) => (typeof mark === 'string' ? mark : mark.type) === 'code');
+
+// Serialize a literal string as a CommonMark code span (spec 0.31.2 §6.1). @tiptap/markdown's mark path
+// can't do this: it derives the code fence by rendering the mark against a placeholder, so the fence is a
+// fixed single backtick blind to the content — a span whose text holds a backtick (`` `x` ``, common in
+// pentest write-ups) serialises to invalid `` ``x`` `` and degrades further on every save. Choose a fence
+// one longer than the longest backtick run inside, and pad with a space when the content starts or ends
+// with a backtick (or is all-but-not-only spaces) so the reader strips exactly that pad back off. Mirrors
+// prosemirror-markdown's backticksFor; the code-mark renderMarkdown override in markdown-editor-extensions.ts
+// zeroes the placeholder fence so this is the ONLY fence emitted.
+export const serializeCodeSpan = (content: string): string => {
+    const longestRun = (content.match(/`+/g) ?? []).reduce((max, run) => Math.max(max, run.length), 0);
+    const fence = '`'.repeat(longestRun + 1);
+    const needsPad =
+        content.startsWith('`') ||
+        content.endsWith('`') ||
+        (content.startsWith(' ') && content.endsWith(' ') && /\S/.test(content));
+
+    return `${fence}${needsPad ? ` ${content} ` : content}${fence}`;
+};
 
 const TunedMarkdownText = Extension.create({
     name: 'tunedMarkdownText',
@@ -80,7 +108,14 @@ const TunedMarkdownText = Extension.create({
         // lossy default encoder.
         const manager = this.editor.markdown as unknown as ManagerWithEncode;
 
-        manager.encodeTextForMarkdown = (text) => text;
+        // Replace the manager's encoder. Upstream HTML-entity-encodes (`<`→`&lt;`) and backslash-escapes
+        // ``` ` * _ [ ] ~ \ ```; both are wrong here — the load side keeps `\`+punct literal and decodes named
+        // entities, so re-applying either would double backslashes or re-freeze `&lt;`. Prose is therefore
+        // emitted verbatim. The one exception is an inline code span: it needs a real CommonMark fence sized to
+        // its content (see serializeCodeSpan). The code MARK is the discriminator, NOT the manager's broader
+        // isInsideCode — a code BLOCK's body arrives here with empty marks (parent is codeBlock) and must stay
+        // verbatim, its fence coming from TunedCodeBlock.
+        manager.encodeTextForMarkdown = (text, node) => (hasCodeMark(node) ? serializeCodeSpan(text) : text);
     },
     // Lower priority than the Markdown extension so this runs AFTER its onBeforeCreate has created the
     // manager and assigned editor.markdown. onBeforeCreate (not onCreate) because it is synchronous —
@@ -93,14 +128,50 @@ const TunedMarkdownText = Extension.create({
 // has NO exact GFM encoding: escaping the pipe alone yields `\\|`, a live delimiter that drops the trailing
 // cells on the next load. Pad an odd run by one backslash — the cell gains a `\`, the table keeps its cells,
 // and the padded form is byte-stable from the first save.
-export const escapeCellPipes = (text: string): string =>
-    text.replace(/(\\*)\|/g, (_, run: string) => `${run}${run.length % 2 ? '\\\\|' : '\\|'}`);
+// A pipe inside a Go action is the template's pipeline operator. Escaping it makes text/template reject the
+// whole prompt (`unexpected "\" in operand`), so the file cannot be saved at all — and every save re-added the
+// backslash, leaving no way out from rich mode. The loader counts cells with action pipes masked, so leaving
+// them raw no longer skews the header/delimiter comparison.
+export const escapeCellPipes = (text: string): string => {
+    const escapeOutsideActions = (segment: string) =>
+        segment.replace(/(\\*)\|/g, (_, run: string) => `${run}${run.length % 2 ? '\\\\|' : '\\|'}`);
+    let result = '';
+    let cursor = 0;
+
+    for (const action of text.matchAll(TEMPLATE_ACTION)) {
+        result += escapeOutsideActions(text.slice(cursor, action.index)) + action[0];
+        cursor = action.index + action[0].length;
+    }
+
+    return result + escapeOutsideActions(text.slice(cursor));
+};
 
 // @tiptap/extension-table's renderTableToMarkdown is alignment-aware but never escapes pipes, so a literal
 // `|` a cell emits (even from inside inline code) would re-parse as a column delimiter on the next SAVE and
 // drop cells (tiptap PR #7884). renderTableToMarkdown emits cell content only via h.renderChildren, so wrapping
 // that one call to escape pipes fixes the save side, on the official alignment-aware renderer.
 // The LOAD side of the same class is covered by the tuned Lexer subclass in createTunedMarked above.
+// GFM has no headerless table, and renderTableToMarkdown answers that by emitting an EMPTY header row above
+// the demoted rows — so every header-off + save + reload cycle grew the table by one blank row and the header
+// switch silently flipped back on. Promote the first row instead: the row count and every cell survive, and a
+// second save is a no-op because the promoted table already has a header.
+const withPromotedHeaderRow = (node: JSONContent): JSONContent => {
+    const rows = node.content ?? [];
+    const firstRow = rows[0];
+
+    if (!firstRow?.content?.length || firstRow.content.some((cell) => cell.type === 'tableHeader')) {
+        return node;
+    }
+
+    return {
+        ...node,
+        content: [
+            { ...firstRow, content: firstRow.content.map((cell) => ({ ...cell, type: 'tableHeader' })) },
+            ...rows.slice(1),
+        ],
+    };
+};
+
 export const TunedTable = Table.extend({
     renderMarkdown(node: JSONContent, helpers: MarkdownRendererHelpers) {
         const pipeEscaping: MarkdownRendererHelpers = {
@@ -111,7 +182,14 @@ export const TunedTable = Table.extend({
         // renderTableToMarkdown joins a multi-block cell's children (e.g. two paragraphs from Enter-in-cell) with
         // a U+001F separator, outside renderChildren. A GFM cell is single-line, so collapse it to a space rather
         // than persist a raw control byte that survives into the saved .tmpl/knowledge and round-trips unchanged.
-        return renderTableToMarkdown(node, pipeEscaping).replaceAll(String.fromCharCode(0x1f), ' ');
+        // Trim the renderer's own surrounding blank lines. It emits a leading and trailing newline on top of the
+        // block separator the manager already adds, and between two ADJACENT tables that extra line reloads as an
+        // empty paragraph — which serialises to another blank line on the next save. Measured before the trim:
+        // two tables separated by one blank line gained one empty paragraph per cycle and never converged.
+        return renderTableToMarkdown(withPromotedHeaderRow(node), pipeEscaping)
+            .replaceAll(String.fromCharCode(0x1f), ' ')
+            .replace(/^\n+/, '')
+            .replace(/\n+$/, '');
     },
 });
 
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-table-handles.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-table-handles.tsx
index 01e864b5..9081c614 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-table-handles.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-table-handles.tsx
@@ -28,6 +28,7 @@ import {
 } from '@/components/ui/dropdown-menu';
 import { Switch } from '@/components/ui/switch';
 
+import { returnFocusToEditor } from './markdown-editor-focus';
 import { getEditorScrollParent } from './markdown-editor-styles';
 import { ALIGN_OPTIONS, clearLineContents, hasHeaderRow, setColumnAlign } from './markdown-editor-table-commands';
 
@@ -93,10 +94,7 @@ export function TableHandles({ editor }: { editor: Editor }) {
                 <DropdownMenuContent
                     align="start"
                     className="min-w-[176px]"
-                    onCloseAutoFocus={(event) => {
-                        event.preventDefault();
-                        editor.commands.focus();
-                    }}
+                    onCloseAutoFocus={returnFocusToEditor(editor)}
                 >
                     <DropdownMenuItem onSelect={() => focusTarget().addColumnBefore().run()}>
                         <ArrowLeft className="text-muted-foreground size-4 shrink-0" />
@@ -168,10 +166,7 @@ export function TableHandles({ editor }: { editor: Editor }) {
                 <DropdownMenuContent
                     align="start"
                     className="min-w-[176px]"
-                    onCloseAutoFocus={(event) => {
-                        event.preventDefault();
-                        editor.commands.focus();
-                    }}
+                    onCloseAutoFocus={returnFocusToEditor(editor)}
                 >
                     <RowHeaderToggleItem
                         cellPos={target.cellPos}
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-table-pipes.test.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-table-pipes.test.ts
index 0e8419f4..a605a23d 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-table-pipes.test.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-table-pipes.test.ts
@@ -1,5 +1,7 @@
+import { Editor } from '@tiptap/core';
 import { describe, expect, it } from 'vitest';
 
+import { createMarkdownExtensions } from './markdown-editor-extensions';
 import { escapeTablePipes } from './markdown-editor-table-pipes';
 import { roundTrip, setupEditorJsdom } from './markdown-editor-test-setup';
 
@@ -70,11 +72,23 @@ describe('table cell with a piped code span — content survives load and conver
         expect(roundTrip(out)).toBe(out);
     });
 
+    // This used to pin `{{.X \| upper}}` — the escaped form, which Go text/template rejects outright
+    // (`unexpected "\" in operand`), so the prompt could not be saved at all. The pipe is the template's
+    // pipeline operator and stays raw; the cell count survives because the loader masks action pipes.
     it('keeps a Go-template action with a pipe inside a cell', () => {
         const out = roundTrip('| Var | Out |\n| --- | --- |\n| {{.X | upper}} | done |');
 
         expect(out).toContain('done');
-        expect(out).toContain('{{.X \\| upper}}');
+        expect(out).toContain('{{.X | upper}}');
+        expect(out).not.toContain('\\|');
+        expect(roundTrip(out)).toBe(out);
+    });
+
+    it('keeps a code span with a backtick and a pipe inside a cell', () => {
+        const out = roundTrip('| Op | Meaning |\n| --- | --- |\n| `` `x` | y `` | kept |');
+
+        expect(out).toContain('kept');
+        expect(out).toContain('`` `x` \\| y ``');
         expect(roundTrip(out)).toBe(out);
     });
 });
@@ -98,7 +112,7 @@ describe('pipe-less GFM tables (no outer pipe) — cells survive too', () => {
         const out = roundTrip('Var | Out\n--- | ---\n{{.Host | lower}} | done');
 
         expect(out).toContain('done');
-        expect(out).toContain('{{.Host \\| lower}}');
+        expect(out).toContain('{{.Host | lower}}');
     });
 
     it('protects rows whether or not each has a leading pipe (mixed)', () => {
@@ -237,3 +251,275 @@ describe('TABLE_DELIMITER_LINE is linear (ReDoS guard)', () => {
         expect(performance.now() - started).toBeLessThan(100);
     });
 });
+
+describe('a backtick in a backtick fence info string is not a fence opener', () => {
+    const cellsOf = (markdown: string) => {
+        const editor = new Editor({
+            content: markdown,
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+        const cells: string[] = [];
+
+        editor.state.doc.descendants((node) => {
+            if (node.type.name === 'tableCell' || node.type.name === 'tableHeader') {
+                cells.push(node.textContent);
+            }
+
+            return true;
+        });
+        editor.destroy();
+
+        return cells;
+    };
+
+    const TABLE = ['| Op | Meaning |', '| --- | --- |', '| `x | y` | KEEP |'].join('\n');
+
+    // marked's fence rule is /^ {0,3}(`{3,}(?=[^`\n]*(?:\n|$))|~{3,})…/ — the no-backtick lookahead applies to
+    // the BACKTICK branch only. A prose line holding an inline triple-backtick span is not a fence for marked,
+    // so treating it as one desynchronises the scanner from the parser.
+    it('keeps pipe protection for a table that follows an inline triple-backtick span', () => {
+        expect(cellsOf(['```pnpm run dev``` starts it', '', TABLE].join('\n'))).toEqual([
+            'Op',
+            'Meaning',
+            'x | y',
+            'KEEP',
+        ]);
+    });
+
+    it('protects a table that follows no fence at all, unchanged', () => {
+        expect(cellsOf(TABLE)).toEqual(['Op', 'Meaning', 'x | y', 'KEEP']);
+    });
+
+    // The opposite direction of the same desynchronisation: once the phantom fence closes, the scanner's parity
+    // is inverted and it escapes pipes INSIDE a real code block, injecting a backslash into code content.
+    it('leaves a real code block byte-identical, injecting no escape into its content', () => {
+        const source = ['```a`b', '```', '', TABLE].join('\n');
+        const editor = new Editor({ content: source, contentType: 'markdown', extensions: createMarkdownExtensions() });
+        const codeBlocks: string[] = [];
+
+        editor.state.doc.descendants((node) => {
+            if (node.type.name === 'codeBlock') {
+                codeBlocks.push(node.textContent);
+            }
+
+            return true;
+        });
+        editor.destroy();
+
+        expect(codeBlocks.join('')).not.toContain('\\|');
+    });
+
+    it('still treats a genuine fence as a fence', () => {
+        expect(escapeTablePipes(['```js', '| a | b |', '```'].join('\n'))).toBe(
+            ['```js', '| a | b |', '```'].join('\n'),
+        );
+    });
+});
+
+describe('tables nested inside list items keep their pipe protection', () => {
+    const cellsOf = (markdown: string) => {
+        const editor = new Editor({
+            content: markdown,
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+        const cells: string[] = [];
+
+        editor.state.doc.descendants((node) => {
+            if (node.type.name === 'tableCell' || node.type.name === 'tableHeader') {
+                cells.push(node.textContent);
+            }
+
+            return true;
+        });
+        editor.destroy();
+
+        return cells;
+    };
+
+    const table = (indent: string) =>
+        [`${indent}| Op | Meaning |`, `${indent}| --- | --- |`, `${indent}| \`x | y\` | KEEP |`].join('\n');
+
+    const EXPECTED = ['Op', 'Meaning', 'x | y', 'KEEP'];
+
+    it('protects a table under a bullet at its natural content column', () => {
+        expect(cellsOf(['- item', '', table('  ')].join('\n'))).toEqual(EXPECTED);
+    });
+
+    // The ordinary way anyone writes a table under a sub-bullet: the content column is 4, which the top-level
+    // scanner reads as indented code and skips.
+    it('protects a table under a nested bullet', () => {
+        expect(cellsOf(['- outer', '  - inner', '', table('    ')].join('\n'))).toEqual(EXPECTED);
+    });
+
+    it('protects a table under an ordered item', () => {
+        expect(cellsOf(['1. item', '', table('   ')].join('\n'))).toEqual(EXPECTED);
+    });
+
+    it('protects a table under a bullet inside a blockquote', () => {
+        expect(cellsOf(['> - item', '>', `> ${table('  ').split('\n').join('\n> ')}`].join('\n'))).toEqual(EXPECTED);
+    });
+
+    // Relative to the item's content column, four more spaces is still indented code — marked does not make a
+    // table there, so escaping it would write a backslash into code content.
+    it('leaves a table indented four columns past the item content alone', () => {
+        const source = ['- item', '', table('      ')].join('\n');
+
+        expect(escapeTablePipes(source)).toBe(source);
+    });
+
+    // The same rule at top level, which is what a blanket relaxation of the leading-space cap would break.
+    it('leaves a four-space-indented table at top level alone', () => {
+        const source = table('    ');
+
+        expect(escapeTablePipes(source)).toBe(source);
+    });
+
+    it('does not swallow the next item at the same level', () => {
+        const source = ['- first', '', table('  '), '', '- second | not a table'].join('\n');
+
+        expect(escapeTablePipes(source)).toContain('- second | not a table');
+    });
+});
+
+describe('a Go template pipeline in a table cell keeps its own pipe', () => {
+    const cellsOf = (markdown: string) => {
+        const editor = new Editor({
+            content: markdown,
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+        const cells: string[] = [];
+
+        editor.state.doc.descendants((node) => {
+            if (node.type.name === 'tableCell' || node.type.name === 'tableHeader') {
+                cells.push(node.textContent);
+            }
+
+            return true;
+        });
+        editor.destroy();
+
+        return cells;
+    };
+
+    // `{{.Host | urlquery}}` is a Go text/template pipeline. Escaping its pipe makes text/template reject the
+    // whole file with `unexpected "\" in operand`, so the prompt cannot be saved at all.
+    it('does not escape a pipeline in a body cell on save', () => {
+        expect(roundTrip('| host | value |\n| --- | --- |\n| a | {{.Host | urlquery}} |')).not.toContain('\\|');
+    });
+
+    it('keeps every cell of a table whose body holds a pipeline', () => {
+        expect(cellsOf('| host | value |\n| --- | --- |\n| a | {{.Host | urlquery}} |')).toEqual([
+            'host',
+            'value',
+            'a',
+            '{{.Host | urlquery}}',
+        ]);
+    });
+
+    // The header row is where dropping the escape without an action-aware cell count destroys the table: the
+    // raw pipe makes the header count 3 against the delimiter's 2, detection bails, and marked degrades the
+    // whole table to a paragraph.
+    it('keeps every cell of a table whose HEADER holds a pipeline', () => {
+        expect(cellsOf('| {{.A | urlquery}} | note |\n| --- | --- |\n| x | y |')).toEqual([
+            '{{.A | urlquery}}',
+            'note',
+            'x',
+            'y',
+        ]);
+    });
+
+    it('round-trips a pipeline-bearing table byte-identically on the second save', () => {
+        const source = '| host | value |\n| --- | --- |\n| a | {{.Host | urlquery}} |';
+        const once = roundTrip(source);
+
+        expect(roundTrip(once)).toBe(once);
+    });
+
+    // A structural pipe still has to be escaped when it is real content, not a template operator.
+    it('still escapes a pipe inside a code span', () => {
+        expect(roundTrip('| a | b |\n| --- | --- |\n| `x | y` | z |')).toContain('\\|');
+    });
+});
+
+describe('a table with no header row keeps its row count across a save', () => {
+    const rowsOf = (markdown: string) => {
+        const editor = new Editor({
+            content: markdown,
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+        let rows = 0;
+
+        editor.state.doc.descendants((node) => {
+            if (node.type.name === 'tableRow') {
+                rows += 1;
+            }
+
+            return true;
+        });
+
+        const saved = editor.getMarkdown();
+
+        editor.destroy();
+
+        return { rows, saved };
+    };
+
+    // GFM has no headerless table, so the serializer used to emit an EMPTY header row above the demoted rows:
+    // every header-off + save + reload cycle grew the table by one blank row (2 → 3 → 4) and the switch
+    // silently flipped back on. Promoting the first row keeps the row count and every cell.
+    it('does not grow when the header row is toggled off', () => {
+        const editor = new Editor({
+            content: ['| a | b |', '| --- | --- |', '| 1 | 2 |'].join('\n'),
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+
+        editor.commands.setTextSelection(3);
+        editor.commands.toggleHeaderRow();
+
+        const saved = editor.getMarkdown();
+
+        editor.destroy();
+
+        const first = rowsOf(saved);
+
+        expect(first.rows).toBe(2);
+        expect(saved).toContain('a');
+        expect(saved).toContain('1');
+        expect(rowsOf(first.saved).rows).toBe(2);
+    });
+});
+
+describe('adjacent tables do not accumulate blank paragraphs', () => {
+    const kindsOf = (markdown: string) => {
+        const editor = new Editor({
+            content: markdown,
+            contentType: 'markdown',
+            extensions: createMarkdownExtensions(),
+        });
+        const kinds: string[] = [];
+
+        editor.state.doc.forEach((node) => kinds.push(node.type.name));
+        editor.destroy();
+
+        return kinds.join(',');
+    };
+
+    // The table renderer emits a newline of its own on top of the block separator, so between two adjacent
+    // tables that extra line reloaded as an empty paragraph — which serialised to another blank line on the
+    // next save. Measured before the fix: 68 → 88 → 90 → 92 → 94 bytes, one paragraph per cycle, no fixed point.
+    it('keeps two tables adjacent across repeated saves', () => {
+        const source = ['| a | b |', '| --- | --- |', '| 1 | 2 |', '', '| c | d |', '| --- | --- |', '| 3 | 4 |'].join(
+            '\n',
+        );
+        const once = roundTrip(source);
+
+        expect(kindsOf(source)).toBe('table,table');
+        expect(kindsOf(once)).toBe('table,table');
+        expect(roundTrip(once)).toBe(once);
+    });
+});
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-table-pipes.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-table-pipes.ts
index 4e44610f..cbecc8b6 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-table-pipes.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-table-pipes.ts
@@ -20,15 +20,28 @@
 // Capture the full fence run (not a fixed 3) plus the trailing text: renderTunedCodeBlock widens a fence to
 // 4+ backticks when its content holds a ``` line, and CommonMark closes a fence only with a run of the same
 // char, length >= the opener, and no info string — so length- and char-aware tracking is load-bearing.
-const FENCE_LINE = /^ {0,3}(`{3,}|~{3,})(.*)$/;
+// The backtick branch carries marked's own lookahead: a backtick anywhere in the rest of the line means this
+// is prose holding an inline code span, not a fence. Without it the scanner opens a fence marked never opened
+// and the two run out of step in BOTH directions — tables after it lose pipe protection, and once the phantom
+// closes the parity is inverted and pipes get escaped inside real code. Tilde fences carry no such rule.
+const FENCE_LINE = /^ {0,3}(`{3,}(?=[^`\n]*$)|~{3,})(.*)$/;
 // Written to be linear: the trailing `(?: *\|)? *$` (not `\|? *$`) plus per-cell spacing keep any two space
 // runs from competing for the same characters, so a crafted delimiter-looking line can't force O(n²) backtracking.
 const TABLE_DELIMITER_LINE = /^ {0,3}\|? *:?-+:?(?: *\| *:?-+:?)*(?: *\|)? *$/;
-const TEMPLATE_ACTION = /\{\{[^{}]*\}\}/g;
+export const TEMPLATE_ACTION = /\{\{[^{}]*\}\}/g;
+// A pipe inside a Go action is the template's pipeline operator, never a column separator — marked's splitter
+// does not know that, so the scanner masks those pipes before counting. Without this the serializer cannot
+// stop escaping them: an unescaped pipeline in the HEADER row would count one cell too many, detection would
+// bail, and marked would degrade the whole table to a paragraph.
+const maskActionPipes = (row: string): string => row.replace(TEMPLATE_ACTION, (action) => action.replace(/\|/g, '
'));
 // One blockquote marker (`>` + an optional space). The line scanner only recognizes top-level tables, but marked
 // strips this prefix and re-lexes the inner content, so a table inside a blockquote needs the prefix removed
 // before detection — see the recursive handling in escapeTablePipes.
 const BLOCKQUOTE_PREFIX = /^ {0,3}> ?/;
+// A list item whose content actually starts on the same line. CommonMark puts that content at the column after
+// the marker plus its following spaces, except that 5+ spaces mean the item opens with indented code and the
+// content column is one past the marker.
+const LIST_ITEM_START = /^( {0,3})([*+-]|\d{1,9}[.)])( +)(?=\S)/;
 
 // A table's body ends at a blank line or the first line that starts a different block — the same interrupts
 // marked's gfmTable body-row negative lookahead lists (heading, blockquote, fences, list, hr, indented code).
@@ -60,7 +73,7 @@ const escapeUnescapedPipes = (text: string): string =>
 
 // Mirrors marked's splitCells: split on unescaped pipes, drop a blank leading/trailing cell.
 const countCells = (row: string): number => {
-    const cells = row
+    const cells = maskActionPipes(row)
         .replace(/\|/g, (pipe, offset: number, source: string) => (isEscapedAt(source, offset) ? pipe : ' |'))
         .split(/ \|/);
 
@@ -213,6 +226,46 @@ export const escapeTablePipes = (markdown: string): string => {
             continue;
         }
 
+        // A list item indents its content to its own column, and once that column reaches 4 the top-level scan
+        // reads the table as indented code and skips it — while marked dedents the item and re-lexes, where the
+        // table is live. Mirror that: dedent by the content column, recurse, re-indent. The indented-code rule
+        // then applies RELATIVE to the item, so a line four columns past the content start stays unprotected —
+        // which is why this recurses instead of relaxing TABLE_DELIMITER_LINE's leading-space cap.
+        const item = LIST_ITEM_START.exec(line);
+
+        if (item) {
+            const [, indent = '', marker = '', spaces = ''] = item;
+            const contentColumn = indent.length + marker.length + (spaces.length >= 5 ? 1 : spaces.length);
+            let end = index + 1;
+
+            while (end < lines.length && (!lines[end]!.trim() || /^ */.exec(lines[end]!)![0].length >= contentColumn)) {
+                end++;
+            }
+
+            while (end > index + 1 && !lines[end - 1]!.trim()) {
+                end--;
+            }
+
+            const run = lines.slice(index, end);
+
+            if (end > index + 1 && run.some((row) => row.includes('|'))) {
+                const escaped = escapeTablePipes(run.map((row) => row.slice(contentColumn)).join('\n')).split('\n');
+
+                for (let row = index; row < end; row++) {
+                    const rebuilt = lines[row]!.slice(0, contentColumn) + escaped[row - index]!;
+
+                    if (rebuilt !== lines[row]) {
+                        lines[row] = rebuilt;
+                        isChanged = true;
+                    }
+                }
+
+                index = end - 1;
+
+                continue;
+            }
+        }
+
         if (!line.includes('|')) {
             continue;
         }
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-heading.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-heading.tsx
index bbda19f4..bad343f6 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-heading.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-heading.tsx
@@ -13,6 +13,8 @@ import {
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip';
 import { cn } from '@/lib/utils';
 
+import { returnFocusToEditor } from './markdown-editor-focus';
+
 export type HeadingLevel = 1 | 2 | 3 | 4 | 5 | 6;
 
 interface HeadingOption {
@@ -40,24 +42,16 @@ interface HeadingMenuProps {
     activeLevel: 0 | HeadingLevel;
     disabled?: boolean;
     editor: Editor;
+    isInTableCell: boolean;
 }
 
-export function HeadingMenu({ activeLevel, disabled, editor }: HeadingMenuProps) {
-    const isSelected = (value: HeadingOption['value']) =>
-        value === 'paragraph' ? activeLevel === 0 : value === activeLevel;
-    const active = OPTIONS.find((option) => isSelected(option.value)) ?? OPTIONS[0];
+const isSelectedIn = (activeLevel: 0 | HeadingLevel, value: HeadingOption['value']) =>
+    value === 'paragraph' ? activeLevel === 0 : value === activeLevel;
+
+export function HeadingMenu({ activeLevel, disabled, editor, isInTableCell }: HeadingMenuProps) {
+    const active = OPTIONS.find((option) => isSelectedIn(activeLevel, option.value)) ?? OPTIONS[0];
     const ActiveIcon = active?.icon ?? Type;
 
-    const applyOption = (value: HeadingOption['value']) => {
-        if (value === 'paragraph') {
-            editor.chain().focus().setParagraph().run();
-
-            return;
-        }
-
-        editor.chain().focus().toggleHeading({ level: value }).run();
-    };
-
     return (
         <DropdownMenu>
             <Tooltip>
@@ -82,25 +76,48 @@ export function HeadingMenu({ activeLevel, disabled, editor }: HeadingMenuProps)
             <DropdownMenuContent
                 align="start"
                 className="min-w-[140px]"
-                onCloseAutoFocus={(event) => {
-                    // Return focus to the editor caret (not the trigger button) so the user keeps typing.
-                    event.preventDefault();
-                    editor.commands.focus();
-                }}
+                onCloseAutoFocus={returnFocusToEditor(editor)}
             >
-                {OPTIONS.map((option) => (
-                    <DropdownMenuItem
-                        aria-checked={isSelected(option.value)}
-                        key={option.value}
-                        onSelect={() => applyOption(option.value)}
-                        role="menuitemradio"
-                    >
-                        <option.icon className={cn('text-muted-foreground size-4 shrink-0', option.iconClassName)} />
-                        <span>{option.label}</span>
-                        {isSelected(option.value) ? <Check className="ml-auto size-4 shrink-0" /> : null}
-                    </DropdownMenuItem>
-                ))}
+                <HeadingMenuItems
+                    activeLevel={activeLevel}
+                    editor={editor}
+                    isInTableCell={isInTableCell}
+                />
             </DropdownMenuContent>
         </DropdownMenu>
     );
 }
+
+function HeadingMenuItems({
+    activeLevel,
+    editor,
+    isInTableCell,
+}: {
+    activeLevel: 0 | HeadingLevel;
+    editor: Editor;
+    isInTableCell: boolean;
+}) {
+    const applyOption = (value: HeadingOption['value']) => {
+        if (value === 'paragraph') {
+            editor.chain().focus().setParagraph().run();
+
+            return;
+        }
+
+        editor.chain().focus().toggleHeading({ level: value }).run();
+    };
+
+    return OPTIONS.map((option) => (
+        <DropdownMenuItem
+            aria-checked={isSelectedIn(activeLevel, option.value)}
+            disabled={isInTableCell && option.value !== 'paragraph'}
+            key={option.value}
+            onSelect={() => applyOption(option.value)}
+            role="menuitemradio"
+        >
+            <option.icon className={cn('text-muted-foreground size-4 shrink-0', option.iconClassName)} />
+            <span>{option.label}</span>
+            {isSelectedIn(activeLevel, option.value) ? <Check className="ml-auto size-4 shrink-0" /> : null}
+        </DropdownMenuItem>
+    ));
+}
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-image.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-image.tsx
index 1064b392..76a00f46 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-image.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-image.tsx
@@ -7,6 +7,7 @@ import { Button } from '@/components/ui/button';
 import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover';
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip';
 
+import { returnFocusToEditor } from './markdown-editor-focus';
 import { ImageEditForm } from './markdown-editor-image-edit-form';
 
 interface ImagePopoverProps {
@@ -42,10 +43,7 @@ export function ImagePopover({ disabled, editor }: ImagePopoverProps) {
             <PopoverContent
                 align="start"
                 className="w-80"
-                onCloseAutoFocus={(event) => {
-                    event.preventDefault();
-                    editor.commands.focus();
-                }}
+                onCloseAutoFocus={returnFocusToEditor(editor)}
             >
                 <ImageEditForm
                     editor={editor}
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-link.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-link.tsx
index 0970d585..99fd76c1 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-link.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-link.tsx
@@ -7,6 +7,7 @@ import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover
 import { Toggle } from '@/components/ui/toggle';
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip';
 
+import { returnFocusToEditor } from './markdown-editor-focus';
 import { LinkEditForm } from './markdown-editor-link-edit-form';
 
 interface LinkPopoverProps {
@@ -42,11 +43,7 @@ export function LinkPopover({ disabled, editor, isActive }: LinkPopoverProps) {
             <PopoverContent
                 align="start"
                 className="w-80 p-2"
-                onCloseAutoFocus={(event) => {
-                    // Return focus to the editor caret (not the trigger) so the user keeps typing after apply/cancel.
-                    event.preventDefault();
-                    editor.commands.focus();
-                }}
+                onCloseAutoFocus={returnFocusToEditor(editor)}
             >
                 <LinkEditForm
                     editor={editor}
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-list.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-list.tsx
index dedf28d4..541228b6 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-list.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-list.tsx
@@ -13,6 +13,8 @@ import {
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip';
 import { cn } from '@/lib/utils';
 
+import { returnFocusToEditor } from './markdown-editor-focus';
+
 export type ListType = 'bullet' | 'ordered' | 'task';
 
 interface ListOption {
@@ -31,26 +33,15 @@ interface ListMenuProps {
     activeType: ListType | null;
     disabled?: boolean;
     editor: Editor;
+    isInTableCell: boolean;
 }
 
-export function ListMenu({ activeType, disabled, editor }: ListMenuProps) {
+export function ListMenu({ activeType, disabled, editor, isInTableCell }: ListMenuProps) {
     const active = OPTIONS.find((option) => option.value === activeType);
     // The bullet-list icon doubles as the resting affordance, so the active background — not the glyph — is what
     // distinguishes "in a bullet list" from "no list".
     const TriggerIcon = active?.icon ?? List;
 
-    const applyOption = (value: ListType) => {
-        const chain = editor.chain().focus();
-
-        if (value === 'bullet') {
-            chain.toggleBulletList().run();
-        } else if (value === 'ordered') {
-            chain.toggleOrderedList().run();
-        } else {
-            chain.toggleTaskList().run();
-        }
-    };
-
     return (
         <DropdownMenu>
             <Tooltip>
@@ -75,24 +66,50 @@ export function ListMenu({ activeType, disabled, editor }: ListMenuProps) {
             <DropdownMenuContent
                 align="start"
                 className="min-w-[160px]"
-                onCloseAutoFocus={(event) => {
-                    event.preventDefault();
-                    editor.commands.focus();
-                }}
+                onCloseAutoFocus={returnFocusToEditor(editor)}
             >
-                {OPTIONS.map((option) => (
-                    <DropdownMenuItem
-                        aria-checked={activeType === option.value}
-                        key={option.value}
-                        onSelect={() => applyOption(option.value)}
-                        role="menuitemradio"
-                    >
-                        <option.icon className="text-muted-foreground size-4 shrink-0" />
-                        <span>{option.label}</span>
-                        {activeType === option.value ? <Check className="ml-auto size-4 shrink-0" /> : null}
-                    </DropdownMenuItem>
-                ))}
+                <ListMenuItems
+                    activeType={activeType}
+                    editor={editor}
+                    isInTableCell={isInTableCell}
+                />
             </DropdownMenuContent>
         </DropdownMenu>
     );
 }
+
+function ListMenuItems({
+    activeType,
+    editor,
+    isInTableCell,
+}: {
+    activeType: ListType | null;
+    editor: Editor;
+    isInTableCell: boolean;
+}) {
+    const applyOption = (value: ListType) => {
+        const chain = editor.chain().focus();
+
+        if (value === 'bullet') {
+            chain.toggleBulletList().run();
+        } else if (value === 'ordered') {
+            chain.toggleOrderedList().run();
+        } else {
+            chain.toggleTaskList().run();
+        }
+    };
+
+    return OPTIONS.map((option) => (
+        <DropdownMenuItem
+            aria-checked={activeType === option.value}
+            disabled={isInTableCell}
+            key={option.value}
+            onSelect={() => applyOption(option.value)}
+            role="menuitemradio"
+        >
+            <option.icon className="text-muted-foreground size-4 shrink-0" />
+            <span>{option.label}</span>
+            {activeType === option.value ? <Check className="ml-auto size-4 shrink-0" /> : null}
+        </DropdownMenuItem>
+    ));
+}
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-url.ts b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-url.ts
index e4df2e58..2e17b5d6 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-url.ts
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar-url.ts
@@ -10,11 +10,21 @@ const KNOWN_LINK_SCHEME = /^(?:https?:\/\/|mailto:|tel:)/i;
 // Make a scheme-less value absolute so the URL constructor reads it as one, without laundering a root-relative
 // path into a bogus host. `//host/x` (protocol-relative) just needs a scheme; a single leading slash is a
 // root-relative path this field never supports (`/settings` must NOT become `https://settings`) → reject it.
+// A scheme this field does not allow must be REJECTED, not prefixed: `https://` + `ftp://host/file` parses as
+// host `ftp`, so the popover showed no error and persisted a dead link. Matched on `scheme://` rather than a
+// bare `scheme:` so a scheme-less `localhost:3000` or `example.com:8080/path` still reads as host:port, and so
+// the protocol-relative `//cdn…` form below is untouched.
+const FOREIGN_SCHEME = /^[a-z][a-z0-9+.-]*:\/\//i;
+
 const toAbsoluteCandidate = (value: string, hasScheme: RegExp): null | string => {
     if (hasScheme.test(value)) {
         return value;
     }
 
+    if (FOREIGN_SCHEME.test(value)) {
+        return null;
+    }
+
     if (/^\/\/[^/]/.test(value)) {
         return `https:${value}`;
     }
@@ -33,7 +43,11 @@ const toAbsoluteCandidate = (value: string, hasScheme: RegExp): null | string =>
 export const normalizeLinkUrl = (raw: string): null | string => {
     const url = raw.trim();
 
-    if (!url) {
+    // `new URL()` accepts an inner space, so a raw candidate reached the document as
+    // `[hello](https://example.com/my page)` — which reloads with the link gone and the brackets as text.
+    // Rejected rather than percent-encoded: routing the value through `.href` would also rewrite a trailing
+    // slash, a `{{VAR}}` placeholder and a non-ASCII path, all of which this editor must keep byte-identical.
+    if (!url || /\s/.test(url)) {
         return null;
     }
 
@@ -59,7 +73,7 @@ const KNOWN_IMAGE_SCHEME = /^(?:https?:\/\/|data:)/i;
 export const normalizeImageSrc = (raw: string): null | string => {
     const src = raw.trim();
 
-    if (!src) {
+    if (!src || /\s/.test(src)) {
         return null;
     }
 
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar.test.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar.test.tsx
new file mode 100644
index 00000000..d973c295
--- /dev/null
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar.test.tsx
@@ -0,0 +1,214 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { Editor } from '@tiptap/core';
+import { beforeAll, describe, expect, it } from 'vitest';
+
+import { createMarkdownExtensions } from './markdown-editor-extensions';
+import { returnFocusToEditor } from './markdown-editor-focus';
+import { setupEditorJsdom } from './markdown-editor-test-setup';
+import { MarkdownEditorToolbar } from './markdown-editor-toolbar';
+
+beforeAll(setupEditorJsdom);
+
+const DOC = ['paragraph text', '', '```js', 'const a = 1;', '```'].join('\n');
+const CODE_BLOCK_CARET = 20;
+const PARAGRAPH_CARET = 3;
+
+const mount = (caret: number) => {
+    const element = document.createElement('div');
+
+    document.body.append(element);
+
+    const editor = new Editor({
+        content: DOC,
+        contentType: 'markdown',
+        element,
+        extensions: createMarkdownExtensions(),
+    });
+
+    editor.commands.setTextSelection(caret);
+
+    const view = render(<MarkdownEditorToolbar editor={editor} />);
+
+    return {
+        cleanup: () => {
+            view.unmount();
+            editor.destroy();
+            element.remove();
+        },
+        editor,
+    };
+};
+
+describe('toolbar disables controls whose command reports unavailable', () => {
+    it.each(['Bold', 'Italic', 'Strikethrough', 'Inline code', 'Link'])(
+        '%s is disabled inside a code block and enabled in a paragraph',
+        async (label) => {
+            const inCode = mount(CODE_BLOCK_CARET);
+
+            await waitFor(() => expect(screen.getByLabelText(label)).toBeDisabled());
+            inCode.cleanup();
+
+            const inParagraph = mount(PARAGRAPH_CARET);
+
+            await waitFor(() => expect(screen.getByLabelText(label)).toBeEnabled());
+            inParagraph.cleanup();
+        },
+    );
+
+    it('keeps Blockquote enabled inside a code block, where it does apply', async () => {
+        const mounted = mount(CODE_BLOCK_CARET);
+
+        await waitFor(() => expect(screen.getByLabelText('Blockquote')).toBeEnabled());
+        mounted.cleanup();
+    });
+
+    it('keeps Code block enabled inside a code block, where a second press unwraps it', async () => {
+        const mounted = mount(CODE_BLOCK_CARET);
+
+        await waitFor(() => expect(screen.getByLabelText('Code block')).toBeEnabled());
+        mounted.cleanup();
+    });
+
+    // Turning a code block into a list WORKS, but `can().toggleBulletList()` reports false for it, because the
+    // `clearNodes()` fallback inside toggleList does nothing when dispatch is undefined. Disabling on that
+    // answer would take a working conversion away from the user, so these items stay enabled.
+    it.each(['Bullet list', 'Ordered list', 'Task list'])(
+        '%s stays enabled inside a code block, where can() under-reports it',
+        async (label) => {
+            const mounted = mount(CODE_BLOCK_CARET);
+            const user = userEvent.setup();
+
+            expect(mounted.editor.can().toggleBulletList()).toBe(false);
+
+            await user.click(screen.getByLabelText(/^List:/));
+
+            await waitFor(() =>
+                expect(screen.getByRole('menuitemradio', { name: new RegExp(label) })).not.toHaveAttribute(
+                    'aria-disabled',
+                    'true',
+                ),
+            );
+            mounted.cleanup();
+        },
+    );
+});
+
+describe('returnFocusToEditor', () => {
+    const editorWithElement = () => {
+        const element = document.createElement('div');
+
+        document.body.append(element);
+
+        return {
+            cleanup: () => element.remove(),
+            editor: new Editor({ content: 'text', element, extensions: createMarkdownExtensions() }),
+        };
+    };
+
+    // jsdom never reports real DOM focus for the contenteditable, so the observable proof that the call reached
+    // the editor is the transaction `focus()` dispatches.
+    it('reaches the editor while it is alive', () => {
+        const { cleanup, editor } = editorWithElement();
+        let transactions = 0;
+
+        editor.on('transaction', () => {
+            transactions += 1;
+        });
+
+        returnFocusToEditor(editor)(new Event('closeAutoFocus'));
+
+        expect(transactions).toBeGreaterThan(0);
+        editor.destroy();
+        cleanup();
+    });
+
+    // Radix closes a still-open layer asynchronously, so unmounting with a menu open lands this callback on a
+    // destroyed editor. Without the guard `editor.commands` throws outside any test's stack: every test still
+    // reads green and `vitest run` exits 1.
+    it('does nothing once the editor is destroyed, instead of throwing off-stack', () => {
+        const { cleanup, editor } = editorWithElement();
+
+        editor.destroy();
+
+        expect(() => returnFocusToEditor(editor)(new Event('closeAutoFocus'))).not.toThrow();
+        cleanup();
+    });
+});
+
+describe('block controls that a table cell cannot hold are disabled inside one', () => {
+    const TABLE_DOC = ['| A | B |', '| --- | --- |', '| alpha | beta |'].join('\n');
+
+    const mountWithCaretInCell = () => {
+        const element = document.createElement('div');
+
+        document.body.append(element);
+
+        const editor = new Editor({
+            content: TABLE_DOC,
+            contentType: 'markdown',
+            element,
+            extensions: createMarkdownExtensions(),
+        });
+        let caret = 0;
+
+        editor.state.doc.descendants((node, pos) => {
+            if (!caret && node.type.name === 'tableCell') {
+                caret = pos + 2;
+            }
+
+            return true;
+        });
+        editor.commands.setTextSelection(caret);
+
+        const view = render(<MarkdownEditorToolbar editor={editor} />);
+
+        return {
+            cleanup: () => {
+                view.unmount();
+                editor.destroy();
+                element.remove();
+            },
+            editor,
+        };
+    };
+
+    // A cell serialises inline, so one click silently degrades the document: a code block in a cell saves as
+    // `| ``` alpha ``` |` and reloads as INLINE code, and a horizontal rule applied mid-word splits the word.
+    it.each(['Code block', 'Horizontal rule'])('%s is disabled with the caret inside a cell', async (label) => {
+        const mounted = mountWithCaretInCell();
+
+        await waitFor(() => expect(screen.getByLabelText(label)).toBeDisabled());
+        mounted.cleanup();
+    });
+
+    it('disables every list kind inside a cell', async () => {
+        const mounted = mountWithCaretInCell();
+        const user = userEvent.setup();
+
+        await user.click(screen.getByLabelText(/^List:/));
+
+        for (const label of ['Bullet list', 'Ordered list', 'Task list']) {
+            await waitFor(() =>
+                expect(screen.getByRole('menuitemradio', { name: new RegExp(label) })).toHaveAttribute(
+                    'aria-disabled',
+                    'true',
+                ),
+            );
+        }
+
+        mounted.cleanup();
+    });
+
+    it('disables every heading level inside a cell', async () => {
+        const mounted = mountWithCaretInCell();
+        const user = userEvent.setup();
+
+        await user.click(screen.getByLabelText(/^Text style:/));
+
+        await waitFor(() =>
+            expect(screen.getByRole('menuitemradio', { name: /Heading 2/ })).toHaveAttribute('aria-disabled', 'true'),
+        );
+        mounted.cleanup();
+    });
+});
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar.tsx
index c3bb5308..1030948f 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor-toolbar.tsx
@@ -18,11 +18,13 @@ import { memo, useEffect, useRef } from 'react';
 import { Separator } from '@/components/ui/separator';
 import { TooltipProvider } from '@/components/ui/tooltip';
 import { cn } from '@/lib/utils';
+import { isMac } from '@/lib/utils/platform';
 
 import type { HeadingLevel } from './markdown-editor-toolbar-heading';
 import type { ListType } from './markdown-editor-toolbar-list';
 import type { ColumnAlign } from './markdown-editor-toolbar-table';
 
+import { isBlockApplied } from './markdown-editor-extensions';
 import { hasHeaderRow } from './markdown-editor-table-commands';
 import { ToolbarButton, ToolbarToggle } from './markdown-editor-toolbar-button';
 import { HeadingMenu } from './markdown-editor-toolbar-heading';
@@ -38,6 +40,29 @@ interface MarkdownEditorToolbarProps {
 
 const HEADING_LEVELS: HeadingLevel[] = [1, 2, 3, 4, 5, 6];
 
+// prosemirror-keymap resolves `Mod` per platform, so advertising ⌘ on Windows and Linux names a key the
+// binding does not use. Same shape as input-search.tsx's `modifier`. Redo is `Shift+Ctrl+Z` rather than
+// `Ctrl+Y` because both are registered and the shifted form matches the Mac label the user sees elsewhere.
+const shortcutFor = (key: string) => (isMac() ? `⌘${key}` : `Ctrl+${key}`);
+const shiftShortcutFor = (key: string) => (isMac() ? `⇧⌘${key}` : `Ctrl+Shift+${key}`);
+
+// Only commands whose dry run is FAITHFUL belong here. tiptap runs `can()` with dispatch undefined, so
+// `toggleList`'s `clearNodes()` fallback does nothing and the following `wrapInList` fails — the three list
+// kinds, `toggleCodeBlock` and `toggleHeading` all report false for conversions that work. Disabling on that
+// answer takes a working action away from the user, which is worse than a no-op click.
+const blockAvailability = (editor: Editor) => {
+    const can = editor.can();
+
+    return {
+        canBlockquote: can.toggleBlockquote(),
+        canBold: can.toggleBold(),
+        canCode: can.toggleCode(),
+        canItalic: can.toggleItalic(),
+        canLink: can.setLink({ href: 'https://example.com' }),
+        canStrike: can.toggleStrike(),
+    };
+};
+
 // A mouse wheel emits deltaY, which the browser applies to the nearest VERTICAL scroller — never to this
 // overflow-x strip, so a wheel-mouse user can't reach overflowed controls (trackpads emit deltaX and already
 // work). Translate a vertical-dominant wheel into horizontal scroll, releasing at the ends so the page can
@@ -163,13 +188,18 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
     const state = useEditorState({
         editor,
         selector: ({ editor }) => ({
-            activeListType: (editor.isActive('bulletList')
+            activeListType: (isBlockApplied(editor, 'bulletList')
                 ? 'bullet'
-                : editor.isActive('orderedList')
+                : isBlockApplied(editor, 'orderedList')
                   ? 'ordered'
-                  : editor.isActive('taskList')
+                  : isBlockApplied(editor, 'taskList')
                     ? 'task'
                     : null) as ListType | null,
+            // A control whose command reports unavailable is disabled, because these commands return false
+            // without dispatching and the click would be a silent no-op. Only the always-visible strip is
+            // answered here — the menus ask for their own items on open, since `can()` rebuilds the whole
+            // command map per call (~40µs measured, flat in document size) and this selector runs per keystroke.
+            ...blockAvailability(editor),
             canRedo: editor.can().redo(),
             canUndo: editor.can().undo(),
             columnAlign: (editor.getAttributes('tableHeader').align ??
@@ -178,11 +208,16 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
             headingLevel: (HEADING_LEVELS.find((level) => editor.isActive('heading', { level })) ?? 0) as
                 | 0
                 | HeadingLevel,
-            isBlockquote: editor.isActive('blockquote'),
+            isBlockquote: isBlockApplied(editor, 'blockquote'),
             isBold: editor.isActive('bold'),
             isCode: editor.isActive('code'),
-            isCodeBlock: editor.isActive('codeBlock'),
+            isCodeBlock: isBlockApplied(editor, 'codeBlock'),
             isHeaderRow: hasHeaderRow(editor),
+            // A cell serialises inline, so these controls silently degrade the document from a caret inside
+            // one: a code block becomes an inline span on reload, a horizontal rule applied mid-word splits
+            // the word permanently, a list marker and a quote marker survive only as literal text. `can()`
+            // reports true for all of them, so the guard is structural rather than command-driven.
+            isInTableCell: editor.isActive('tableCell') || editor.isActive('tableHeader'),
             isItalic: editor.isActive('italic'),
             isLink: editor.isActive('link'),
             isStrike: editor.isActive('strike'),
@@ -220,6 +255,7 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                         activeLevel={state.headingLevel}
                         disabled={disabled}
                         editor={editor}
+                        isInTableCell={state.isInTableCell}
                     />
 
                     <Separator
@@ -232,25 +268,25 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                         role="group"
                     >
                         <ToolbarToggle
-                            disabled={disabled}
+                            disabled={disabled || !state.canBold}
                             label="Bold"
                             onPressedChange={() => editor.chain().focus().toggleBold().run()}
                             pressed={state.isBold}
-                            shortcut="⌘B"
+                            shortcut={shortcutFor('B')}
                         >
                             <Bold />
                         </ToolbarToggle>
                         <ToolbarToggle
-                            disabled={disabled}
+                            disabled={disabled || !state.canItalic}
                             label="Italic"
                             onPressedChange={() => editor.chain().focus().toggleItalic().run()}
                             pressed={state.isItalic}
-                            shortcut="⌘I"
+                            shortcut={shortcutFor('I')}
                         >
                             <Italic />
                         </ToolbarToggle>
                         <ToolbarToggle
-                            disabled={disabled}
+                            disabled={disabled || !state.canStrike}
                             label="Strikethrough"
                             onPressedChange={() => editor.chain().focus().toggleStrike().run()}
                             pressed={state.isStrike}
@@ -258,7 +294,7 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                             <Strikethrough />
                         </ToolbarToggle>
                         <ToolbarToggle
-                            disabled={disabled}
+                            disabled={disabled || !state.canCode}
                             label="Inline code"
                             onPressedChange={() => editor.chain().focus().toggleCode().run()}
                             pressed={state.isCode}
@@ -266,7 +302,7 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                             <Code />
                         </ToolbarToggle>
                         <LinkPopover
-                            disabled={disabled}
+                            disabled={disabled || !state.canLink}
                             editor={editor}
                             isActive={state.isLink}
                         />
@@ -281,6 +317,7 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                         activeType={state.activeListType}
                         disabled={disabled}
                         editor={editor}
+                        isInTableCell={state.isInTableCell}
                     />
 
                     <Separator
@@ -306,7 +343,7 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                         role="group"
                     >
                         <ToolbarToggle
-                            disabled={disabled}
+                            disabled={disabled || !state.canBlockquote}
                             label="Blockquote"
                             onPressedChange={() => editor.chain().focus().toggleBlockquote().run()}
                             pressed={state.isBlockquote}
@@ -314,7 +351,7 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                             <Quote />
                         </ToolbarToggle>
                         <ToolbarToggle
-                            disabled={disabled}
+                            disabled={disabled || state.isInTableCell}
                             label="Code block"
                             onPressedChange={() => editor.chain().focus().toggleCodeBlock().run()}
                             pressed={state.isCodeBlock}
@@ -326,7 +363,7 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                             editor={editor}
                         />
                         <ToolbarButton
-                            disabled={disabled}
+                            disabled={disabled || state.isInTableCell}
                             label="Horizontal rule"
                             onClick={() => editor.chain().focus().setHorizontalRule().run()}
                         >
@@ -361,7 +398,7 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                         disabled={disabled || !state.canUndo}
                         label="Undo"
                         onClick={() => editor.chain().focus().undo().run()}
-                        shortcut="⌘Z"
+                        shortcut={shortcutFor('Z')}
                     >
                         <Undo />
                     </ToolbarButton>
@@ -369,7 +406,7 @@ export const MarkdownEditorToolbar = memo(function MarkdownEditorToolbar({
                         disabled={disabled || !state.canRedo}
                         label="Redo"
                         onClick={() => editor.chain().focus().redo().run()}
-                        shortcut="⇧⌘Z"
+                        shortcut={shiftShortcutFor('Z')}
                     >
                         <Redo />
                     </ToolbarButton>
diff --git a/frontend/src/components/shared/markdown-editor/markdown-editor.tsx b/frontend/src/components/shared/markdown-editor/markdown-editor.tsx
index 2b407690..2ff3aba6 100644
--- a/frontend/src/components/shared/markdown-editor/markdown-editor.tsx
+++ b/frontend/src/components/shared/markdown-editor/markdown-editor.tsx
@@ -5,8 +5,6 @@ import { history } from '@tiptap/pm/history';
 import { EditorState, TextSelection } from '@tiptap/pm/state';
 import { EditorContent, useEditor } from '@tiptap/react';
 import { useEffect, useImperativeHandle, useMemo, useRef, useState } from 'react';
-// Code-block syntax highlighting theme for TunedCodeBlock (lowlight), matching the viewer.
-import 'highlight.js/styles/atom-one-dark.css';
 
 import { Spinner } from '@/components/ui/spinner';
 import { cn } from '@/lib/utils';
diff --git a/frontend/src/components/shared/markdown.tsx b/frontend/src/components/shared/markdown.tsx
index 42e8ff54..83d5df40 100644
--- a/frontend/src/components/shared/markdown.tsx
+++ b/frontend/src/components/shared/markdown.tsx
@@ -17,7 +17,6 @@ import python from 'highlight.js/lib/languages/python';
 import sql from 'highlight.js/lib/languages/sql';
 import xml from 'highlight.js/lib/languages/xml';
 import yaml from 'highlight.js/lib/languages/yaml';
-import 'highlight.js/styles/atom-one-dark.css';
 import { common, createLowlight } from 'lowlight';
 import { isValidElement, type ReactElement, type ReactNode, useCallback, useMemo } from 'react';
 import ReactMarkdown, { type Components } from 'react-markdown';
diff --git a/frontend/src/components/ui/button.tsx b/frontend/src/components/ui/button.tsx
index 5aeb0dff..edc0e60a 100644
--- a/frontend/src/components/ui/button.tsx
+++ b/frontend/src/components/ui/button.tsx
@@ -27,7 +27,7 @@ const buttonVariants = cva(
                 destructive:
                     'bg-destructive text-destructive-foreground shadow-xs hover:bg-destructive/90 dark:bg-destructive/80 dark:hover:bg-destructive/70',
                 ghost: 'hover:bg-accent hover:text-accent-foreground',
-                link: 'text-primary underline-offset-4 hover:underline',
+                link: 'text-link underline-offset-4 hover:underline',
                 outline: 'border border-input bg-background shadow-xs hover:bg-accent hover:text-accent-foreground',
                 secondary: 'bg-secondary text-secondary-foreground shadow-xs hover:bg-secondary/80',
             },
@@ -39,6 +39,8 @@ export interface ButtonProps extends React.ComponentProps<'button'>, VariantProp
     asChild?: boolean;
 }
 
+export type ButtonVariant = NonNullable<VariantProps<typeof buttonVariants>['variant']>;
+
 function Button({ asChild = false, className, size, type, variant, ...props }: ButtonProps) {
     const Comp = asChild ? Slot : 'button';
 
diff --git a/frontend/src/components/ui/context-menu.tsx b/frontend/src/components/ui/context-menu.tsx
index 9f8da8a9..d658c325 100644
--- a/frontend/src/components/ui/context-menu.tsx
+++ b/frontend/src/components/ui/context-menu.tsx
@@ -214,6 +214,8 @@ function ContextMenuTrigger({ ...props }: React.ComponentProps<typeof ContextMen
     return (
         <ContextMenuPrimitive.Trigger
             data-slot="context-menu-trigger"
+            // Radix renders this as a plain span, which cannot take focus back from a closing dialog.
+            tabIndex={-1}
             {...props}
         />
     );
diff --git a/frontend/src/components/ui/data-table.test.tsx b/frontend/src/components/ui/data-table.test.tsx
index 307fdad6..6fec7a57 100644
--- a/frontend/src/components/ui/data-table.test.tsx
+++ b/frontend/src/components/ui/data-table.test.tsx
@@ -9,7 +9,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { TooltipProvider } from '@/components/ui/tooltip';
 
-import { cycleColumnSort, DataTable } from './data-table';
+import { cycleColumnSort, DataTable, DataTableColumnHeader } from './data-table';
 
 interface Row {
     id: string;
@@ -861,6 +861,32 @@ describe('DataTable — multi-column search', () => {
         expect(screen.getByText('Charlie')).toBeInTheDocument();
     });
 
+    it('folds diacritics so an unaccented query matches an accented cell', async () => {
+        const user = userEvent.setup();
+        const accentedRows: MultiRow[] = [
+            { id: 'a', name: 'Café Runner', role: 'admin' },
+            { id: 'b', name: 'Plain', role: 'user' },
+        ];
+
+        render(
+            <DataTable<MultiRow>
+                columns={MULTI_COLUMNS}
+                data={accentedRows}
+                filterPlaceholder="Filter..."
+            />,
+            { wrapper: Wrapper },
+        );
+
+        await user.type(screen.getByPlaceholderText('Filter...'), 'cafe');
+
+        // The list filter shares matching semantics with detail-navigation's
+        // Prev/Next subset — if this stops matching, the two have diverged.
+        await waitFor(() => {
+            expect(screen.queryByText('Plain')).not.toBeInTheDocument();
+        });
+        expect(screen.getByText('Café Runner')).toBeInTheDocument();
+    });
+
     it('narrows the search when the picker disables a candidate', async () => {
         const user = userEvent.setup();
         render(
@@ -1020,6 +1046,58 @@ describe('DataTable — multi-column search', () => {
     });
 });
 
+describe('DataTable — sort state is exposed to assistive technology', () => {
+    const SORTABLE_COLUMNS: ColumnDef<Row>[] = [
+        {
+            accessorKey: 'name',
+            header: ({ column }) => (
+                <DataTableColumnHeader
+                    column={column}
+                    title="Name"
+                />
+            ),
+        },
+        { enableSorting: false, header: 'Actions', id: 'actions' },
+    ];
+
+    const nameHeader = () => screen.getByRole('columnheader', { name: 'Name' });
+
+    it('cycles `aria-sort` on the header cell as the column is sorted', () => {
+        render(
+            <DataTable<Row>
+                columns={SORTABLE_COLUMNS}
+                data={ROWS}
+            />,
+            { wrapper: Wrapper },
+        );
+
+        expect(nameHeader()).toHaveAttribute('aria-sort', 'none');
+
+        const sortButton = screen.getByRole('button', { name: 'Name' });
+
+        fireEvent.click(sortButton);
+        expect(nameHeader()).toHaveAttribute('aria-sort', 'ascending');
+
+        fireEvent.click(sortButton);
+        expect(nameHeader()).toHaveAttribute('aria-sort', 'descending');
+
+        fireEvent.click(sortButton);
+        expect(nameHeader()).toHaveAttribute('aria-sort', 'none');
+    });
+
+    it('omits `aria-sort` on a column that cannot be sorted', () => {
+        render(
+            <DataTable<Row>
+                columns={SORTABLE_COLUMNS}
+                data={ROWS}
+            />,
+            { wrapper: Wrapper },
+        );
+
+        expect(screen.getByRole('columnheader', { name: 'Actions' })).not.toHaveAttribute('aria-sort');
+    });
+});
+
 interface FakeColumn {
     clearSorting: ReturnType<typeof vi.fn>;
     getIsSorted: ReturnType<typeof vi.fn>;
diff --git a/frontend/src/components/ui/data-table.tsx b/frontend/src/components/ui/data-table.tsx
index db738b48..ca4c6654 100644
--- a/frontend/src/components/ui/data-table.tsx
+++ b/frontend/src/components/ui/data-table.tsx
@@ -59,6 +59,7 @@ import { useLatestRef } from '@/hooks/use-latest-ref';
 import { usePageStorageKeys } from '@/hooks/use-page-storage-keys';
 import { useWindowVirtualList } from '@/hooks/use-window-virtual-list';
 import { migrateLegacyTableState, updateTableState } from '@/lib/table-state';
+import { matchesTextFilter } from '@/lib/text-filter';
 import { cn } from '@/lib/utils';
 
 /**
@@ -283,6 +284,26 @@ export function cycleColumnSort<TData, TValue = unknown>(column: Column<TData, T
     column.toggleSorting(false);
 }
 
+function columnAriaSort<TData, TValue = unknown>(
+    column: Column<TData, TValue>,
+): 'ascending' | 'descending' | 'none' | undefined {
+    if (!column.getCanSort()) {
+        return undefined;
+    }
+
+    const sorted = column.getIsSorted();
+
+    if (sorted === 'asc') {
+        return 'ascending';
+    }
+
+    if (sorted === 'desc') {
+        return 'descending';
+    }
+
+    return 'none';
+}
+
 function DataTable<TData, TValue = unknown>({
     columns,
     columnVisibility: externalColumnVisibility,
@@ -558,10 +579,9 @@ function DataTable<TData, TValue = unknown>({
         [handlePaginationChange],
     );
 
-    // Case-insensitive substring predicate that consults the composite
-    // filter for both "what to look for" and "where to look". Returning
-    // `true` for the empty query keeps the default "no filter = all rows"
-    // behaviour identical to TanStack's built-in `includesString`.
+    // Matching is delegated to the shared text-filter because the same `?q=`
+    // also drives detail-navigation's Prev/Next subset, and the two must agree
+    // on what matches.
     const globalFilterFn = useCallback<FilterFn<TData>>((row, columnId, filter: DataTableGlobalFilter) => {
         if (!filter.query) {
             return true;
@@ -573,9 +593,7 @@ function DataTable<TData, TValue = unknown>({
 
         const value = row.getValue(columnId);
 
-        return String(value ?? '')
-            .toLowerCase()
-            .includes(filter.query.toLowerCase());
+        return matchesTextFilter(String(value ?? ''), filter.query);
     }, []);
 
     const table = useReactTable({
@@ -764,6 +782,7 @@ function DataTable<TData, TValue = unknown>({
                             >
                                 {headerGroup.headers.map((header) => (
                                     <TableHead
+                                        aria-sort={columnAriaSort(header.column)}
                                         className={cn('truncate', header.column.columnDef.meta?.headerClassName)}
                                         key={header.id}
                                         style={
@@ -939,7 +958,7 @@ function DataTableColumnHeader<TData, TValue = unknown>({ column, title }: DataT
 
     return (
         <Button
-            className="text-muted-foreground hover:text-primary flex items-center gap-2 p-0 no-underline hover:no-underline"
+            className="text-muted-foreground hover:text-link flex items-center gap-2 p-0 no-underline hover:no-underline"
             onClick={() => cycleColumnSort(column)}
             variant="link"
         >
@@ -1043,6 +1062,7 @@ function DataTableFilter({ onQueryChange, placeholder, query }: DataTableFilterP
             {localValue ? (
                 <InputGroupAddon align="inline-end">
                     <InputGroupButton
+                        aria-label="Clear search"
                         onClick={handleClear}
                         type="button"
                     >
diff --git a/frontend/src/components/ui/dialog.test.tsx b/frontend/src/components/ui/dialog.test.tsx
new file mode 100644
index 00000000..3f61fae3
--- /dev/null
+++ b/frontend/src/components/ui/dialog.test.tsx
@@ -0,0 +1,142 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { useState } from 'react';
+import { describe, expect, it } from 'vitest';
+
+import { ContextMenu, ContextMenuContent, ContextMenuItem, ContextMenuTrigger } from '@/components/ui/context-menu';
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+
+import { Dialog, DialogContent, DialogDescription, DialogTitle } from './dialog';
+
+const DialogFromButton = () => {
+    const [isOpen, setIsOpen] = useState(false);
+
+    return (
+        <>
+            <button
+                onClick={() => setIsOpen(true)}
+                type="button"
+            >
+                Delete resource
+            </button>
+            <Dialog
+                onOpenChange={setIsOpen}
+                open={isOpen}
+            >
+                <DialogContent>
+                    <DialogTitle>Delete resource</DialogTitle>
+                    <DialogDescription>This cannot be undone.</DialogDescription>
+                </DialogContent>
+            </Dialog>
+        </>
+    );
+};
+
+const DialogFromDropdown = () => {
+    const [isOpen, setIsOpen] = useState(false);
+
+    return (
+        <>
+            <DropdownMenu>
+                <DropdownMenuTrigger>Row actions</DropdownMenuTrigger>
+                <DropdownMenuContent>
+                    <DropdownMenuItem onSelect={() => setIsOpen(true)}>Delete</DropdownMenuItem>
+                </DropdownMenuContent>
+            </DropdownMenu>
+            <Dialog
+                onOpenChange={setIsOpen}
+                open={isOpen}
+            >
+                <DialogContent>
+                    <DialogTitle>Delete resource</DialogTitle>
+                    <DialogDescription>This cannot be undone.</DialogDescription>
+                </DialogContent>
+            </Dialog>
+        </>
+    );
+};
+
+describe('Dialog focus return', () => {
+    it('returns focus to the button that opened the dialog', async () => {
+        const user = userEvent.setup();
+        render(<DialogFromButton />);
+
+        const opener = screen.getByRole('button', { name: 'Delete resource' });
+        await user.click(opener);
+        await screen.findByRole('dialog');
+
+        await user.keyboard('{Escape}');
+        await waitFor(() => {
+            expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+        });
+
+        expect(document.activeElement).toBe(opener);
+    });
+
+    it('returns focus to the menu trigger when the dialog was opened from a menu item', async () => {
+        const user = userEvent.setup();
+        render(<DialogFromDropdown />);
+
+        const trigger = screen.getByRole('button', { name: 'Row actions' });
+        await user.click(trigger);
+        await user.click(await screen.findByRole('menuitem', { name: 'Delete' }));
+        await screen.findByRole('dialog');
+
+        await user.keyboard('{Escape}');
+        await waitFor(() => {
+            expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+        });
+
+        expect(document.activeElement).toBe(trigger);
+    });
+});
+
+const DialogFromContextMenu = () => {
+    const [isOpen, setIsOpen] = useState(false);
+
+    return (
+        <>
+            <ContextMenu>
+                <ContextMenuTrigger>Row</ContextMenuTrigger>
+                <ContextMenuContent>
+                    <ContextMenuItem onSelect={() => setIsOpen(true)}>Delete</ContextMenuItem>
+                </ContextMenuContent>
+            </ContextMenu>
+            <Dialog
+                onOpenChange={setIsOpen}
+                open={isOpen}
+            >
+                <DialogContent>
+                    <DialogTitle>Delete resource</DialogTitle>
+                    <DialogDescription>This cannot be undone.</DialogDescription>
+                </DialogContent>
+            </Dialog>
+        </>
+    );
+};
+
+describe('Dialog opened from a context menu', () => {
+    it('returns focus to the context-menu trigger', async () => {
+        const user = userEvent.setup();
+
+        render(<DialogFromContextMenu />);
+
+        const trigger = document.querySelector<HTMLElement>('[data-slot="context-menu-trigger"]')!;
+
+        await user.pointer({ keys: '[MouseRight]', target: trigger });
+        await user.click(await screen.findByRole('menuitem', { name: 'Delete' }));
+        await screen.findByRole('dialog');
+
+        await user.keyboard('{Escape}');
+        await waitFor(() => {
+            expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+        });
+
+        expect(document.activeElement).toBe(trigger);
+    });
+});
diff --git a/frontend/src/components/ui/dialog.tsx b/frontend/src/components/ui/dialog.tsx
index b0915fe5..6efcbab6 100644
--- a/frontend/src/components/ui/dialog.tsx
+++ b/frontend/src/components/ui/dialog.tsx
@@ -34,6 +34,10 @@ function DialogContent({ children, className, ...props }: React.ComponentProps<t
                 data-slot="dialog-content"
                 {...props}
             >
+                {/* Radix returns focus to its own DialogTrigger; these dialogs are opened from state,
+                    and their content is often unmounted before Radix's close sequence runs, so its
+                    `onCloseAutoFocus` never fires. */}
+                <FocusReturn />
                 {children}
                 <DialogPrimitive.Close
                     className="ring-offset-background focus:ring-ring data-[state=open]:bg-accent data-[state=open]:text-muted-foreground absolute top-4 right-4 rounded-sm opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none"
@@ -119,6 +123,46 @@ function DialogTrigger({ ...props }: React.ComponentProps<typeof DialogPrimitive
     );
 }
 
+/**
+ * Rendered inside the content, so it mounts when the overlay opens and unmounts when it closes —
+ * a wrapper-level hook would instead run when the PAGE mounts, because most dialogs and sheets here
+ * render their content unconditionally and let Radix decide whether it is on screen.
+ */
+function FocusReturn() {
+    // Captured during this component's first render: by the time effects run, Radix has already
+    // moved focus inside the content.
+    const [opener] = React.useState(resolveOpener);
+
+    React.useEffect(
+        () => () => {
+            if (opener?.isConnected) {
+                opener.focus();
+            }
+        },
+        [opener],
+    );
+
+    return null;
+}
+
+function resolveOpener(): HTMLElement | null {
+    const active = document.activeElement as HTMLElement | null;
+    const menu = active?.closest('[role="menu"]');
+
+    if (!menu) {
+        return active;
+    }
+
+    // Radix labels dropdown content with its trigger's id; context-menu content carries no such
+    // link, so the still-open trigger has to be found by slot.
+    const triggerId = menu.getAttribute('aria-labelledby');
+    const trigger = triggerId
+        ? document.getElementById(triggerId)
+        : document.querySelector<HTMLElement>('[data-slot="context-menu-trigger"][data-state="open"]');
+
+    return trigger ?? active;
+}
+
 export {
     Dialog,
     DialogClose,
@@ -128,4 +172,5 @@ export {
     DialogHeader,
     DialogTitle,
     DialogTrigger,
+    FocusReturn,
 };
diff --git a/frontend/src/components/ui/empty.tsx b/frontend/src/components/ui/empty.tsx
index 67d75537..a714a549 100644
--- a/frontend/src/components/ui/empty.tsx
+++ b/frontend/src/components/ui/empty.tsx
@@ -54,7 +54,7 @@ function EmptyDescription({ className, ...props }: React.ComponentProps<'p'>) {
     return (
         <div
             className={cn(
-                'text-muted-foreground [&>a:hover]:text-primary text-sm/relaxed [&>a]:underline [&>a]:underline-offset-4',
+                'text-muted-foreground [&>a:hover]:text-link text-sm/relaxed [&>a]:underline [&>a]:underline-offset-4',
                 className,
             )}
             data-slot="empty-description"
diff --git a/frontend/src/components/ui/sheet.test.tsx b/frontend/src/components/ui/sheet.test.tsx
new file mode 100644
index 00000000..9f70a4cd
--- /dev/null
+++ b/frontend/src/components/ui/sheet.test.tsx
@@ -0,0 +1,96 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { useState } from 'react';
+import { describe, expect, it } from 'vitest';
+
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+
+import { Sheet, SheetContent, SheetDescription, SheetTitle } from './sheet';
+
+const SheetFromButton = () => {
+    const [isOpen, setIsOpen] = useState(false);
+
+    return (
+        <>
+            <button
+                onClick={() => setIsOpen(true)}
+                type="button"
+            >
+                Open details
+            </button>
+            <Sheet
+                onOpenChange={setIsOpen}
+                open={isOpen}
+            >
+                <SheetContent>
+                    <SheetTitle>Details</SheetTitle>
+                    <SheetDescription>Everything about this row.</SheetDescription>
+                </SheetContent>
+            </Sheet>
+        </>
+    );
+};
+
+const SheetFromDropdown = () => {
+    const [isOpen, setIsOpen] = useState(false);
+
+    return (
+        <>
+            <DropdownMenu>
+                <DropdownMenuTrigger>Row actions</DropdownMenuTrigger>
+                <DropdownMenuContent>
+                    <DropdownMenuItem onSelect={() => setIsOpen(true)}>Details</DropdownMenuItem>
+                </DropdownMenuContent>
+            </DropdownMenu>
+            <Sheet
+                onOpenChange={setIsOpen}
+                open={isOpen}
+            >
+                <SheetContent>
+                    <SheetTitle>Details</SheetTitle>
+                    <SheetDescription>Everything about this row.</SheetDescription>
+                </SheetContent>
+            </Sheet>
+        </>
+    );
+};
+
+describe('Sheet focus return', () => {
+    it('returns focus to the button that opened the sheet', async () => {
+        const user = userEvent.setup();
+        render(<SheetFromButton />);
+
+        const opener = screen.getByRole('button', { name: 'Open details' });
+        await user.click(opener);
+        await screen.findByRole('dialog');
+
+        await user.keyboard('{Escape}');
+        await waitFor(() => {
+            expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+        });
+
+        expect(document.activeElement).toBe(opener);
+    });
+
+    it('returns focus to the menu trigger when the sheet was opened from a menu item', async () => {
+        const user = userEvent.setup();
+        render(<SheetFromDropdown />);
+
+        const trigger = screen.getByRole('button', { name: 'Row actions' });
+        await user.click(trigger);
+        await user.click(await screen.findByRole('menuitem', { name: 'Details' }));
+        await screen.findByRole('dialog');
+
+        await user.keyboard('{Escape}');
+        await waitFor(() => {
+            expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+        });
+
+        expect(document.activeElement).toBe(trigger);
+    });
+});
diff --git a/frontend/src/components/ui/sheet.tsx b/frontend/src/components/ui/sheet.tsx
index ff21cd4a..3735bec4 100644
--- a/frontend/src/components/ui/sheet.tsx
+++ b/frontend/src/components/ui/sheet.tsx
@@ -5,6 +5,7 @@ import { cva, type VariantProps } from 'class-variance-authority';
 import { X } from 'lucide-react';
 import * as React from 'react';
 
+import { FocusReturn } from '@/components/ui/dialog';
 import { cn } from '@/lib/utils';
 
 function Sheet({ ...props }: React.ComponentProps<typeof SheetPrimitive.Root>) {
@@ -88,6 +89,7 @@ function SheetContent({ children, className, container, overlay = true, side = '
                 data-slot="sheet-content"
                 {...props}
             >
+                <FocusReturn />
                 <SheetPrimitive.Close className="ring-offset-background focus:ring-ring data-[state=open]:bg-secondary absolute top-4 right-4 rounded-sm opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none">
                     <X className="h-4 w-4" />
                     {/* Not "Close": a sheet with its own footer Close button would
diff --git a/frontend/src/features/authentication/password-change-form.tsx b/frontend/src/features/authentication/password-change-form.tsx
index 96058bb1..218b7900 100644
--- a/frontend/src/features/authentication/password-change-form.tsx
+++ b/frontend/src/features/authentication/password-change-form.tsx
@@ -17,7 +17,10 @@ const passwordChangeSchema = z
         newPassword: z
             .string()
             .min(8, { message: 'Password must be at least 8 characters' })
-            .max(100, { message: 'Password must not exceed 100 characters' })
+            // bcrypt, which hashes it server-side, refuses anything longer than 72 bytes.
+            .refine((password) => new TextEncoder().encode(password).length <= 72, {
+                message: 'Password must not exceed 72 characters',
+            })
             .refine(
                 (password) => {
                     if (password.length > 15) {
diff --git a/frontend/src/features/flows/agents/flow-agents.tsx b/frontend/src/features/flows/agents/flow-agents.tsx
index d13fb7c2..9823cff1 100644
--- a/frontend/src/features/flows/agents/flow-agents.tsx
+++ b/frontend/src/features/flows/agents/flow-agents.tsx
@@ -157,6 +157,7 @@ function FlowAgents() {
                                         {field.value && (
                                             <InputGroupAddon align="inline-end">
                                                 <InputGroupButton
+                                                    aria-label="Clear agent search"
                                                     onClick={() => {
                                                         form.reset({ search: '' });
                                                         setDebouncedSearchValue('');
@@ -206,6 +207,7 @@ function FlowAgents() {
 
                     {!isScrolledToBottom && (
                         <Button
+                            aria-label="Scroll to latest agent log"
                             className="absolute right-4 bottom-4 z-10 shadow-md hover:shadow-lg"
                             onClick={() => scrollToEnd()}
                             size="icon-sm"
diff --git a/frontend/src/features/flows/files/flow-files-attach-resources-dialog.tsx b/frontend/src/features/flows/files/flow-files-attach-resources-dialog.tsx
index 66ee05e2..7396e1d6 100644
--- a/frontend/src/features/flows/files/flow-files-attach-resources-dialog.tsx
+++ b/frontend/src/features/flows/files/flow-files-attach-resources-dialog.tsx
@@ -235,6 +235,7 @@ function FlowFilesAttachResourcesDialogBody({
                         {searchQuery && (
                             <InputGroupAddon align="inline-end">
                                 <InputGroupButton
+                                    aria-label="Clear resource search"
                                     onClick={() => setSearchQuery('')}
                                     type="button"
                                 >
diff --git a/frontend/src/features/flows/files/flow-files-pull-dialog.tsx b/frontend/src/features/flows/files/flow-files-pull-dialog.tsx
index fb15d678..b76d4275 100644
--- a/frontend/src/features/flows/files/flow-files-pull-dialog.tsx
+++ b/frontend/src/features/flows/files/flow-files-pull-dialog.tsx
@@ -421,6 +421,7 @@ function FlowFilesPullDialogForm({ cachedFiles, flowId, onClose, onSuccess }: Fl
                             <TooltipTrigger asChild>
                                 <span>
                                     <Button
+                                        aria-label="Parent directory"
                                         disabled={isUpDisabled}
                                         onClick={handleNavigateUp}
                                         size="icon-sm"
@@ -438,6 +439,7 @@ function FlowFilesPullDialogForm({ cachedFiles, flowId, onClose, onSuccess }: Fl
                             <TooltipTrigger asChild>
                                 <span>
                                     <Button
+                                        aria-label="Refresh listing"
                                         disabled={isListingLoading || isPulling}
                                         onClick={handleRefresh}
                                         size="icon-sm"
diff --git a/frontend/src/features/flows/files/flow-files.tsx b/frontend/src/features/flows/files/flow-files.tsx
index eccb6eab..c08108b7 100644
--- a/frontend/src/features/flows/files/flow-files.tsx
+++ b/frontend/src/features/flows/files/flow-files.tsx
@@ -204,7 +204,7 @@ function FlowFiles() {
 
             {isDragging && (
                 <div className="bg-primary/10 border-primary pointer-events-none absolute inset-0 z-30 flex items-center justify-center rounded-lg border-2 border-dashed">
-                    <div className="text-primary flex flex-col items-center gap-2">
+                    <div className="text-link flex flex-col items-center gap-2">
                         <FolderUp className="size-8" />
                         <span className="text-sm font-medium">Drop files to upload</span>
                     </div>
@@ -233,6 +233,7 @@ function FlowFiles() {
                                             {field.value && (
                                                 <InputGroupAddon align="inline-end">
                                                     <InputGroupButton
+                                                        aria-label="Clear file search"
                                                         onClick={search.resetSearch}
                                                         type="button"
                                                     >
@@ -250,6 +251,7 @@ function FlowFiles() {
                             <TooltipTrigger asChild>
                                 <span>
                                     <Button
+                                        aria-label="Upload files"
                                         disabled={upload.isUploading || isLoading}
                                         onClick={upload.openFilePicker}
                                         size="icon-sm"
@@ -272,6 +274,7 @@ function FlowFiles() {
                             <TooltipTrigger asChild>
                                 <span>
                                     <Button
+                                        aria-label="Attach resources"
                                         disabled={isAttachResourcesDisabled}
                                         onClick={handleOpenAttachResourcesDialog}
                                         size="icon-sm"
@@ -295,6 +298,7 @@ function FlowFiles() {
                             <TooltipTrigger asChild>
                                 <span>
                                     <Button
+                                        aria-label="Pull from container"
                                         disabled={isPullDisabled}
                                         onClick={handleOpenPullDialog}
                                         size="icon-sm"
diff --git a/frontend/src/features/flows/flow-form.test.tsx b/frontend/src/features/flows/flow-form.test.tsx
new file mode 100644
index 00000000..fd20bf23
--- /dev/null
+++ b/frontend/src/features/flows/flow-form.test.tsx
@@ -0,0 +1,127 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { setSelectedProvider, uploadParams } = vi.hoisted(() => ({
+    setSelectedProvider: vi.fn(),
+    uploadParams: { current: null } as { current: null | { onSuccess: (uploaded: { items: unknown[] }) => void } },
+}));
+
+vi.mock('@/providers/providers-provider', () => ({
+    useProviders: () => ({
+        providers: [{ name: 'openai', type: 'openai' }],
+        setSelectedProvider,
+    }),
+}));
+
+vi.mock('@/providers/templates-provider', () => ({
+    useTemplates: () => ({ templates: [] }),
+}));
+
+vi.mock('@/providers/resources-provider', () => ({
+    useResources: () => ({
+        resources: [
+            {
+                createdAt: '',
+                id: '7',
+                isDir: false,
+                name: 'scope.txt',
+                path: 'scope.txt',
+                size: 12,
+                updatedAt: '',
+                userId: '1',
+            },
+        ],
+    }),
+}));
+
+vi.mock('@/features/resources/use-resources-upload', () => ({
+    useResourcesUpload: (params: { onSuccess: (uploaded: { items: unknown[] }) => void }) => {
+        uploadParams.current = params;
+
+        return { isUploading: false, uploadFiles: vi.fn() };
+    },
+}));
+
+const { FlowForm } = await import('./flow-form');
+
+const attachResource = async () => {
+    await waitFor(() => expect(uploadParams.current).not.toBeNull());
+    uploadParams.current!.onSuccess({ items: [{ id: 7 }] });
+    await screen.findByRole('button', { name: 'Remove scope.txt' });
+};
+
+beforeEach(() => {
+    uploadParams.current = null;
+    setSelectedProvider.mockClear();
+});
+
+describe('FlowForm attachments', () => {
+    it('clears the attached resources after a submit', async () => {
+        const user = userEvent.setup({ delay: null });
+        const onSubmit = vi.fn();
+
+        render(
+            <FlowForm
+                defaultValues={{ providerName: 'openai' }}
+                onSubmit={onSubmit}
+                type="assistant"
+            />,
+        );
+
+        await attachResource();
+
+        await user.type(screen.getByRole('textbox'), 'scan it');
+        await user.click(screen.getByRole('button', { name: 'Submit' }));
+
+        await waitFor(() => expect(onSubmit).toHaveBeenCalledOnce());
+        expect(onSubmit.mock.calls[0]?.[0]).toMatchObject({ message: 'scan it', resourceIds: ['7'] });
+
+        await waitFor(() => expect(screen.queryByRole('button', { name: 'Remove scope.txt' })).not.toBeInTheDocument());
+    });
+
+    it('does not resend the previous attachments on the next submit', async () => {
+        const user = userEvent.setup({ delay: null });
+        const onSubmit = vi.fn();
+
+        render(
+            <FlowForm
+                defaultValues={{ providerName: 'openai' }}
+                onSubmit={onSubmit}
+                type="assistant"
+            />,
+        );
+
+        await attachResource();
+
+        await user.type(screen.getByRole('textbox'), 'first');
+        await user.click(screen.getByRole('button', { name: 'Submit' }));
+        await waitFor(() => expect(onSubmit).toHaveBeenCalledOnce());
+
+        await user.type(screen.getByRole('textbox'), 'second');
+        await user.click(screen.getByRole('button', { name: 'Submit' }));
+
+        await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(2));
+        expect(onSubmit.mock.calls[1]?.[0]).toMatchObject({ message: 'second', resourceIds: [] });
+    });
+
+    it('adopts resourceIds that arrive through defaultValues after mount', async () => {
+        const { rerender } = render(
+            <FlowForm
+                defaultValues={{ providerName: 'openai' }}
+                onSubmit={vi.fn()}
+                type="assistant"
+            />,
+        );
+
+        rerender(
+            <FlowForm
+                defaultValues={{ providerName: 'openai', resourceIds: ['7'] }}
+                onSubmit={vi.fn()}
+                type="assistant"
+            />,
+        );
+
+        expect(await screen.findByRole('button', { name: 'Remove scope.txt' })).toBeInTheDocument();
+    });
+});
diff --git a/frontend/src/features/flows/flow-form.tsx b/frontend/src/features/flows/flow-form.tsx
index 1e0e3efb..1dd18744 100644
--- a/frontend/src/features/flows/flow-form.tsx
+++ b/frontend/src/features/flows/flow-form.tsx
@@ -13,7 +13,7 @@ import {
 } from 'lucide-react';
 import { useCallback, useEffect, useMemo, useState } from 'react';
 import { useRef } from 'react';
-import { useWatch } from 'react-hook-form';
+import { useController } from 'react-hook-form';
 import { z } from 'zod';
 
 import type { UserResourceFragmentFragment } from '@/graphql/types';
@@ -164,7 +164,10 @@ export function FlowForm({
         setValue,
     } = form;
 
-    const resourceIds = useWatch({ control, name: 'resourceIds' });
+    // useController registers the field; with useWatch alone `resetField('resourceIds')` is a no-op.
+    const {
+        field: { value: resourceIds },
+    } = useController({ control, name: 'resourceIds' });
 
     const updateResourceIds = useCallback(
         (updater: ((current: string[]) => string[]) | Array<number | string>) => {
@@ -234,9 +237,12 @@ export function FlowForm({
             })
             .forEach(([fieldName, defaultValue]) => {
                 const typedFieldName = fieldName as keyof FlowFormValues;
-                setValue(typedFieldName, defaultValue as never, { shouldDirty: false });
+                // resetField, not setValue: it moves react-hook-form's own baseline too, so a later
+                // pick that happens to equal the mount-time default still counts as dirty and this
+                // effect leaves it alone.
+                resetField(typedFieldName, { defaultValue: defaultValue as never });
             });
-    }, [defaultValues, dirtyFields, setValue, getValues]);
+    }, [defaultValues, dirtyFields, resetField, getValues]);
 
     const isFormDisabled = isDisabled || isLoading || isSubmitting || isCanceling;
 
@@ -336,6 +342,7 @@ export function FlowForm({
                     {templateSearch && (
                         <InputGroupAddon align="inline-end">
                             <InputGroupButton
+                                aria-label="Clear template search"
                                 onClick={(event) => {
                                     event.stopPropagation();
                                     setTemplateSearch('');
@@ -390,6 +397,7 @@ export function FlowForm({
                     {resourceSearch && (
                         <InputGroupAddon align="inline-end">
                             <InputGroupButton
+                                aria-label="Clear resource search"
                                 onClick={(event) => {
                                     event.stopPropagation();
                                     setResourceSearch('');
@@ -574,6 +582,7 @@ export function FlowForm({
                                                                 {providerSearch && (
                                                                     <InputGroupAddon align="inline-end">
                                                                         <InputGroupButton
+                                                                            aria-label="Clear provider search"
                                                                             onClick={(event) => {
                                                                                 event.stopPropagation();
                                                                                 setProviderSearch('');
diff --git a/frontend/src/features/flows/flow-scroll-to-latest.test.tsx b/frontend/src/features/flows/flow-scroll-to-latest.test.tsx
new file mode 100644
index 00000000..cf97d119
--- /dev/null
+++ b/frontend/src/features/flows/flow-scroll-to-latest.test.tsx
@@ -0,0 +1,101 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it, vi } from 'vitest';
+
+import { TooltipProvider } from '@/components/ui/tooltip';
+import { StatusType } from '@/graphql/types';
+
+const flowState = vi.hoisted(() => ({ current: {} as Record<string, unknown> }));
+
+vi.mock('@/hooks/use-auto-scroll', () => ({
+    useAutoScroll: () => ({
+        containerRef: () => {},
+        endRef: { current: null },
+        hasNewMessages: false,
+        isScrolledToBottom: false,
+        scrollToEnd: vi.fn(),
+    }),
+}));
+
+vi.mock('@/providers/flow-provider', () => ({ useFlow: () => flowState.current }));
+vi.mock('@/providers/providers-provider', () => ({ useProviders: () => ({ providers: [] }) }));
+vi.mock('@/providers/system-settings-provider', () => ({ useSystemSettings: () => ({ settings: null }) }));
+
+vi.mock('./flow-form', () => ({ FlowForm: () => <div /> }));
+vi.mock('./flow-tasks-dropdown', () => ({ default: () => <div /> }));
+vi.mock('./agents/flow-agent', () => ({ default: () => <div /> }));
+vi.mock('./tools/flow-tool', () => ({ default: () => <div /> }));
+vi.mock('./vector-stores/flow-vector-store', () => ({ default: () => <div /> }));
+vi.mock('./tasks/flow-task', () => ({ default: () => <div /> }));
+vi.mock('./screenshots/flow-screenshot', () => ({ default: () => <div /> }));
+vi.mock('./messages/flow-message', () => ({ default: () => <div /> }));
+
+const { default: FlowAgents } = await import('./agents/flow-agents');
+const { default: FlowScreenshots } = await import('./screenshots/flow-screenshots');
+const { default: FlowTasks } = await import('./tasks/flow-tasks');
+const { default: FlowTools } = await import('./tools/flow-tools');
+const { default: FlowVectorStores } = await import('./vector-stores/flow-vector-stores');
+const { default: FlowAssistantMessages } = await import('./messages/flow-assistant-messages');
+const { default: FlowAutomationMessages } = await import('./messages/flow-automation-messages');
+
+const item = { id: '1' };
+
+const assistantFlowState = {
+    assistantLogs: [{ assistantId: '5', id: '1' }],
+    assistants: [{ id: '5', provider: { name: 'openai' }, status: StatusType.Running, title: 'Recon assistant' }],
+    createAssistant: vi.fn(),
+    deleteAssistant: vi.fn(),
+    flowId: '42',
+    flowStatus: StatusType.Running,
+    initiateAssistantCreation: vi.fn(),
+    selectAssistant: vi.fn(),
+    selectedAssistantId: '5',
+    stopAssistant: vi.fn(),
+    submitAssistantMessage: vi.fn(),
+};
+
+const renderWithFlow = (state: Record<string, unknown>, ui: React.ReactElement) => {
+    flowState.current = { flowId: '42', ...state };
+
+    return render(<TooltipProvider>{ui}</TooltipProvider>);
+};
+
+describe('scroll-to-latest buttons carry an accessible name', () => {
+    it.each([
+        ['Scroll to latest agent log', { flowData: { agentLogs: [item] } }, <FlowAgents key="agents" />],
+        ['Scroll to latest tool log', { flowData: { searchLogs: [item] } }, <FlowTools key="tools" />],
+        [
+            'Scroll to latest vector store log',
+            { flowData: { vectorStoreLogs: [item] } },
+            <FlowVectorStores key="vector-stores" />,
+        ],
+        ['Scroll to latest task', { flowData: { tasks: [item] } }, <FlowTasks key="tasks" />],
+        ['Scroll to latest screenshot', { flowData: { screenshots: [item] } }, <FlowScreenshots key="screenshots" />],
+        [
+            'Scroll to latest message',
+            {
+                flowData: { messageLogs: [item] },
+                flowStatus: StatusType.Running,
+                stopAutomation: vi.fn(),
+                submitAutomationMessage: vi.fn(),
+            },
+            <FlowAutomationMessages key="automation" />,
+        ],
+        ['Scroll to latest message', assistantFlowState, <FlowAssistantMessages key="assistant" />],
+    ])('names the %s button', (name, state, ui) => {
+        renderWithFlow(state, ui);
+
+        expect(screen.getByRole('button', { name })).toBeInTheDocument();
+    });
+});
+
+describe('assistant list', () => {
+    it('names the per-assistant delete button after the assistant', async () => {
+        const user = userEvent.setup({ delay: null });
+        renderWithFlow(assistantFlowState, <FlowAssistantMessages />);
+
+        await user.click(screen.getByRole('button', { name: 'Select assistant' }));
+
+        expect(await screen.findByRole('button', { name: 'Delete Recon assistant' })).toBeInTheDocument();
+    });
+});
diff --git a/frontend/src/features/flows/messages/flow-assistant-messages.tsx b/frontend/src/features/flows/messages/flow-assistant-messages.tsx
index 9dfb5980..680d6804 100644
--- a/frontend/src/features/flows/messages/flow-assistant-messages.tsx
+++ b/frontend/src/features/flows/messages/flow-assistant-messages.tsx
@@ -159,6 +159,7 @@ function AssistantsDropdown({
 
                 {!isDisabled && (
                     <Button
+                        aria-label={`Delete ${assistant.title}`}
                         className="text-muted-foreground hover:text-destructive absolute top-1/2 right-0.5 shrink-0 -translate-y-1/2 opacity-0 transition-opacity group-hover:opacity-100"
                         onClick={(event) => {
                             event.stopPropagation();
@@ -182,6 +183,7 @@ function AssistantsDropdown({
             >
                 <PopoverTrigger asChild>
                     <Button
+                        aria-label="Select assistant"
                         className="px-2"
                         disabled={isAssistantCreating}
                         variant="outline"
@@ -525,6 +527,7 @@ function FlowAssistantMessages({ className }: FlowAssistantMessagesProps) {
                                             {field.value && (
                                                 <InputGroupAddon align="inline-end">
                                                     <InputGroupButton
+                                                        aria-label="Clear message search"
                                                         disabled={isAssistantCreating}
                                                         onClick={() => {
                                                             form.reset({ search: '' });
@@ -575,6 +578,7 @@ function FlowAssistantMessages({ className }: FlowAssistantMessagesProps) {
 
                         {!isScrolledToBottom && (
                             <Button
+                                aria-label="Scroll to latest message"
                                 className="absolute right-4 bottom-4 z-10 shadow-md hover:shadow-lg"
                                 onClick={() => scrollToEnd()}
                                 size="icon-sm"
diff --git a/frontend/src/features/flows/messages/flow-automation-messages.tsx b/frontend/src/features/flows/messages/flow-automation-messages.tsx
index 8469f0cc..963c2a38 100644
--- a/frontend/src/features/flows/messages/flow-automation-messages.tsx
+++ b/frontend/src/features/flows/messages/flow-automation-messages.tsx
@@ -216,6 +216,7 @@ function FlowAutomationMessages({ className }: FlowAutomationMessagesProps) {
                                         {field.value && (
                                             <InputGroupAddon align="inline-end">
                                                 <InputGroupButton
+                                                    aria-label="Clear message search"
                                                     onClick={() => {
                                                         form.reset({ search: '' });
                                                         setDebouncedSearchValue('');
@@ -265,6 +266,7 @@ function FlowAutomationMessages({ className }: FlowAutomationMessagesProps) {
 
                     {!isScrolledToBottom && (
                         <Button
+                            aria-label="Scroll to latest message"
                             className="absolute right-4 bottom-4 z-10 shadow-md hover:shadow-lg"
                             onClick={() => scrollToEnd()}
                             size="icon-sm"
diff --git a/frontend/src/features/flows/messages/flow-message.tsx b/frontend/src/features/flows/messages/flow-message.tsx
index 7f8cb0e3..b95bc2da 100644
--- a/frontend/src/features/flows/messages/flow-message.tsx
+++ b/frontend/src/features/flows/messages/flow-message.tsx
@@ -210,7 +210,7 @@ function FlowMessage({ log, searchValue = '' }: FlowMessageProps) {
                 <span className="text-muted-foreground/50">{formatDate(new Date(createdAt))}</span>
                 <span
                     className="text-muted-foreground/50"
-                    data-testid="flow-message-id"
+                    data-slot="flow-message-id"
                 >
                     {log.id}
                 </span>
diff --git a/frontend/src/features/flows/screenshots/flow-screenshots.tsx b/frontend/src/features/flows/screenshots/flow-screenshots.tsx
index df81a101..51cf2a9a 100644
--- a/frontend/src/features/flows/screenshots/flow-screenshots.tsx
+++ b/frontend/src/features/flows/screenshots/flow-screenshots.tsx
@@ -99,6 +99,7 @@ function FlowScreenshots() {
                                         {field.value && (
                                             <InputGroupAddon align="inline-end">
                                                 <InputGroupButton
+                                                    aria-label="Clear screenshot search"
                                                     onClick={() => {
                                                         form.reset({ search: '' });
                                                         setDebouncedSearchValue('');
@@ -135,6 +136,7 @@ function FlowScreenshots() {
 
                     {!isScrolledToBottom && (
                         <Button
+                            aria-label="Scroll to latest screenshot"
                             className="absolute right-4 bottom-4 z-10 shadow-md hover:shadow-lg"
                             onClick={() => scrollToEnd()}
                             size="icon-sm"
diff --git a/frontend/src/features/flows/tasks/flow-tasks.tsx b/frontend/src/features/flows/tasks/flow-tasks.tsx
index ec0881f6..ea203b8d 100644
--- a/frontend/src/features/flows/tasks/flow-tasks.tsx
+++ b/frontend/src/features/flows/tasks/flow-tasks.tsx
@@ -115,6 +115,7 @@ function FlowTasks() {
                                         {field.value && (
                                             <InputGroupAddon align="inline-end">
                                                 <InputGroupButton
+                                                    aria-label="Clear task search"
                                                     onClick={() => {
                                                         form.reset({ search: '' });
                                                         setDebouncedSearchValue('');
@@ -152,6 +153,7 @@ function FlowTasks() {
 
                     {!isScrolledToBottom && (
                         <Button
+                            aria-label="Scroll to latest task"
                             className="absolute right-4 bottom-4 z-10 shadow-md hover:shadow-lg"
                             onClick={() => scrollToEnd()}
                             size="icon-sm"
diff --git a/frontend/src/features/flows/terminal/flow-terminal.tsx b/frontend/src/features/flows/terminal/flow-terminal.tsx
index af10bca2..c7909f9a 100644
--- a/frontend/src/features/flows/terminal/flow-terminal.tsx
+++ b/frontend/src/features/flows/terminal/flow-terminal.tsx
@@ -192,6 +192,7 @@ function FlowTerminal() {
                                             )}
                                             {field.value && (
                                                 <InputGroupButton
+                                                    aria-label="Clear terminal search"
                                                     onClick={handleClearSearch}
                                                     size="icon-xs"
                                                     title="Clear search"
diff --git a/frontend/src/features/flows/tools/flow-tools.tsx b/frontend/src/features/flows/tools/flow-tools.tsx
index 80c93fb6..dee01dec 100644
--- a/frontend/src/features/flows/tools/flow-tools.tsx
+++ b/frontend/src/features/flows/tools/flow-tools.tsx
@@ -158,6 +158,7 @@ function FlowTools() {
                                         {field.value && (
                                             <InputGroupAddon align="inline-end">
                                                 <InputGroupButton
+                                                    aria-label="Clear tool search"
                                                     onClick={() => {
                                                         form.reset({ search: '' });
                                                         setDebouncedSearchValue('');
@@ -207,6 +208,7 @@ function FlowTools() {
 
                     {!isScrolledToBottom && (
                         <Button
+                            aria-label="Scroll to latest tool log"
                             className="absolute right-4 bottom-4 z-10 shadow-md hover:shadow-lg"
                             onClick={() => scrollToEnd()}
                             size="icon-sm"
diff --git a/frontend/src/features/flows/vector-stores/flow-vector-stores.tsx b/frontend/src/features/flows/vector-stores/flow-vector-stores.tsx
index 73ba19a5..799e9ac9 100644
--- a/frontend/src/features/flows/vector-stores/flow-vector-stores.tsx
+++ b/frontend/src/features/flows/vector-stores/flow-vector-stores.tsx
@@ -159,6 +159,7 @@ function FlowVectorStores() {
                                         {field.value && (
                                             <InputGroupAddon align="inline-end">
                                                 <InputGroupButton
+                                                    aria-label="Clear vector store search"
                                                     onClick={() => {
                                                         form.reset({ search: '' });
                                                         setDebouncedSearchValue('');
@@ -207,6 +208,7 @@ function FlowVectorStores() {
 
                     {!isScrolledToBottom && (
                         <Button
+                            aria-label="Scroll to latest vector store log"
                             className="absolute right-4 bottom-4 z-10 shadow-md hover:shadow-lg"
                             onClick={() => scrollToEnd()}
                             size="icon-sm"
diff --git a/frontend/src/features/knowledges/knowledge-form.tsx b/frontend/src/features/knowledges/knowledge-form.tsx
index 0c73259e..16614a15 100644
--- a/frontend/src/features/knowledges/knowledge-form.tsx
+++ b/frontend/src/features/knowledges/knowledge-form.tsx
@@ -237,7 +237,12 @@ export function KnowledgeForm({ initialValues, isNew, knowledge, onSubmit }: Kno
                 // Reset BEFORE the caller navigates so `isDirty` is false by the
                 // time the blocker re-evaluates (the caller also calls
                 // `skipNextBlock` to cover reset's async state propagation).
-                reset(resetValues, { keepDefaultValues: false });
+                //
+                // `keepDirtyValues: false` is not the default here: RHF merges the form-level `resetOptions`
+                // into every manual reset, and this form sets `keepDirtyValues` there to protect unsaved edits
+                // during a subscription resync. Inherited by a POST-save reset it keeps the pre-save values and
+                // their dirty flags, so a later save can send a stale field back and silently revert it.
+                reset(resetValues, { keepDefaultValues: false, keepDirtyValues: false });
 
                 return result;
             } catch (error) {
diff --git a/frontend/src/features/knowledges/knowledge-header.tsx b/frontend/src/features/knowledges/knowledge-header.tsx
index 00eb4586..8e10cb4f 100644
--- a/frontend/src/features/knowledges/knowledge-header.tsx
+++ b/frontend/src/features/knowledges/knowledge-header.tsx
@@ -195,6 +195,14 @@ export function KnowledgeHeader({
                     </Breadcrumb>
                 </AppHeaderContent>
                 <AppHeaderActions>
+                    {!isNew && !isMobile && (
+                        <DetailNavigationToolbar<Knowledge>
+                            controller={knowledgeNav}
+                            renderItem={renderKnowledgeItem}
+                            sheetIcon={<LibraryBig className="size-4" />}
+                            sheetTitle="Knowledges"
+                        />
+                    )}
                     {canAnonymize && !isMobile && (
                         <AppHeaderAction
                             disabled={isAnonymizeDisabled}
@@ -213,14 +221,6 @@ export function KnowledgeHeader({
                             type="button"
                         />
                     )}
-                    {!isNew && !isMobile && (
-                        <DetailNavigationToolbar<Knowledge>
-                            controller={knowledgeNav}
-                            renderItem={renderKnowledgeItem}
-                            sheetIcon={<LibraryBig className="size-4" />}
-                            sheetTitle="Knowledges"
-                        />
-                    )}
                     <DropdownMenu>
                         <DropdownMenuTrigger asChild>
                             <Button
diff --git a/frontend/src/graphql/types.ts b/frontend/src/graphql/types.ts
index 62ad1541..a1a2533e 100644
--- a/frontend/src/graphql/types.ts
+++ b/frontend/src/graphql/types.ts
@@ -6,14 +6,18 @@ import type { TypedDocumentNode as DocumentNode } from '@graphql-typed-document-
 export type AgentConfigInput = {
     extraBody?: Record<string, unknown> | null | undefined;
     frequencyPenalty?: number | null | undefined;
+    json?: boolean | null | undefined;
     maxLength?: number | null | undefined;
     maxTokens?: number | null | undefined;
     minLength?: number | null | undefined;
+    minP?: number | null | undefined;
     model: string;
+    n?: number | null | undefined;
     presencePenalty?: number | null | undefined;
     price?: ModelPriceInput | null | undefined;
     reasoning?: ReasoningConfigInput | null | undefined;
     repetitionPenalty?: number | null | undefined;
+    responseMimeType?: string | null | undefined;
     temperature?: number | null | undefined;
     topK?: number | null | undefined;
     topP?: number | null | undefined;
@@ -547,6 +551,10 @@ export type AgentConfigFragmentFragment = {
     repetitionPenalty: number | null;
     frequencyPenalty: number | null;
     presencePenalty: number | null;
+    minP: number | null;
+    n: number | null;
+    json: boolean | null;
+    responseMimeType: string | null;
     extraBody: Record<string, unknown> | null;
     reasoning: { mode: ReasoningMode | null; effort: ReasoningEffort | null; maxTokens: number | null } | null;
     price: { input: number; output: number; cacheRead: number; cacheWrite: number } | null;
@@ -2166,6 +2174,10 @@ export const AgentConfigFragmentFragmentDoc = {
                     { kind: 'Field', name: { kind: 'Name', value: 'repetitionPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'frequencyPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'presencePenalty' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'minP' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'n' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'json' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'responseMimeType' } },
                     {
                         kind: 'Field',
                         name: { kind: 'Name', value: 'reasoning' },
@@ -2357,6 +2369,10 @@ export const AgentsConfigFragmentFragmentDoc = {
                     { kind: 'Field', name: { kind: 'Name', value: 'repetitionPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'frequencyPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'presencePenalty' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'minP' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'n' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'json' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'responseMimeType' } },
                     {
                         kind: 'Field',
                         name: { kind: 'Name', value: 'reasoning' },
@@ -2433,6 +2449,10 @@ export const ProviderConfigFragmentFragmentDoc = {
                     { kind: 'Field', name: { kind: 'Name', value: 'repetitionPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'frequencyPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'presencePenalty' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'minP' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'n' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'json' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'responseMimeType' } },
                     {
                         kind: 'Field',
                         name: { kind: 'Name', value: 'reasoning' },
@@ -3884,6 +3904,10 @@ export const SettingsProvidersDocument = {
                     { kind: 'Field', name: { kind: 'Name', value: 'repetitionPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'frequencyPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'presencePenalty' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'minP' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'n' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'json' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'responseMimeType' } },
                     {
                         kind: 'Field',
                         name: { kind: 'Name', value: 'reasoning' },
@@ -8789,6 +8813,10 @@ export const CreateProviderDocument = {
                     { kind: 'Field', name: { kind: 'Name', value: 'repetitionPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'frequencyPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'presencePenalty' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'minP' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'n' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'json' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'responseMimeType' } },
                     {
                         kind: 'Field',
                         name: { kind: 'Name', value: 'reasoning' },
@@ -9062,6 +9090,10 @@ export const UpdateProviderDocument = {
                     { kind: 'Field', name: { kind: 'Name', value: 'repetitionPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'frequencyPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'presencePenalty' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'minP' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'n' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'json' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'responseMimeType' } },
                     {
                         kind: 'Field',
                         name: { kind: 'Name', value: 'reasoning' },
@@ -11291,6 +11323,10 @@ export const ProviderCreatedDocument = {
                     { kind: 'Field', name: { kind: 'Name', value: 'repetitionPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'frequencyPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'presencePenalty' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'minP' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'n' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'json' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'responseMimeType' } },
                     {
                         kind: 'Field',
                         name: { kind: 'Name', value: 'reasoning' },
@@ -11527,6 +11563,10 @@ export const ProviderUpdatedDocument = {
                     { kind: 'Field', name: { kind: 'Name', value: 'repetitionPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'frequencyPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'presencePenalty' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'minP' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'n' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'json' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'responseMimeType' } },
                     {
                         kind: 'Field',
                         name: { kind: 'Name', value: 'reasoning' },
@@ -11763,6 +11803,10 @@ export const ProviderDeletedDocument = {
                     { kind: 'Field', name: { kind: 'Name', value: 'repetitionPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'frequencyPenalty' } },
                     { kind: 'Field', name: { kind: 'Name', value: 'presencePenalty' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'minP' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'n' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'json' } },
+                    { kind: 'Field', name: { kind: 'Name', value: 'responseMimeType' } },
                     {
                         kind: 'Field',
                         name: { kind: 'Name', value: 'reasoning' },
diff --git a/frontend/src/lib/apollo.test.ts b/frontend/src/lib/apollo.test.ts
index 4e320c17..965b9e8d 100644
--- a/frontend/src/lib/apollo.test.ts
+++ b/frontend/src/lib/apollo.test.ts
@@ -284,3 +284,52 @@ describe('streaming assistant-log link (createStreamingLink)', () => {
         expect(emitted).toEqual([{ somethingElse: { id: '1' } }]);
     });
 });
+
+describe('ProviderConfig cache identity', () => {
+    const PROVIDERS = gql`
+        query P {
+            settingsProviders {
+                default {
+                    anthropic {
+                        id
+                        name
+                        type
+                    }
+                    openai {
+                        id
+                        name
+                        type
+                    }
+                }
+            }
+        }
+    `;
+
+    // The resolver builds default providers without an ID, so every one of them arrives as id 0.
+    // Normalising on that shared id would collapse them onto a single cache entry and the last
+    // write would win — the create form then seeds one provider type from another's defaults.
+    it('keeps two defaults apart even though both carry id 0', () => {
+        const cache = createCache();
+
+        cache.writeQuery({
+            data: {
+                settingsProviders: {
+                    __typename: 'ProvidersConfig',
+                    default: {
+                        __typename: 'DefaultProvidersConfig',
+                        anthropic: { __typename: 'ProviderConfig', id: 0, name: 'anthropic', type: 'anthropic' },
+                        openai: { __typename: 'ProviderConfig', id: 0, name: 'openai', type: 'openai' },
+                    },
+                },
+            },
+            query: PROVIDERS,
+        });
+
+        const read = cache.readQuery<{
+            settingsProviders: { default: { anthropic: { name: string }; openai: { name: string } } };
+        }>({ query: PROVIDERS });
+
+        expect(read?.settingsProviders.default.anthropic.name).toBe('anthropic');
+        expect(read?.settingsProviders.default.openai.name).toBe('openai');
+    });
+});
diff --git a/frontend/src/lib/errors.test.ts b/frontend/src/lib/errors.test.ts
new file mode 100644
index 00000000..34d7d8f8
--- /dev/null
+++ b/frontend/src/lib/errors.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+
+import { isNotFoundError } from './errors';
+
+describe('isNotFoundError', () => {
+    it.each(['no rows in result set', 'flow not found', 'template not found: sql: no rows', 'Record Not Found'])(
+        'treats %j as not-found',
+        (message) => {
+            expect(isNotFoundError(new Error(message))).toBe(true);
+        },
+    );
+
+    // The authz strings are real backend messages that also contain "not found" (see errors.ts) —
+    // they must stay classified as real failures, so do not drop them as odd-looking fixtures.
+    it.each([
+        'network error',
+        'Failed to fetch',
+        'connection refused',
+        'internal server error',
+        "requested permission 'flows.read' not found",
+        'not authorized to access this token',
+        'no permissions granted',
+        'privileges are not set',
+    ])('treats %j as a real failure', (message) => {
+        expect(isNotFoundError(new Error(message))).toBe(false);
+    });
+});
diff --git a/frontend/src/lib/errors.ts b/frontend/src/lib/errors.ts
new file mode 100644
index 00000000..8eda68d8
--- /dev/null
+++ b/frontend/src/lib/errors.ts
@@ -0,0 +1,16 @@
+/**
+ * A backend "no rows in result set" / "not found" GraphQL error, as opposed to a real load
+ * failure (network, 5xx, cold-cache backend error). Detail pages redirect to the list on the
+ * former and render an in-page ErrorState + Retry on the latter — collapsing the two silently
+ * bounces the user off a page that a retry would have loaded.
+ */
+export const isNotFoundError = (error: { message: string }) => {
+    // The backend's authz failure "requested permission '<perm>' not found" (graph/context.go) also
+    // contains "not found"; classing it as a missing record would silently redirect a user who only
+    // lacks access, instead of surfacing the denial.
+    if (/\b(permission|privilege|unauthori[sz]ed|not authori[sz]ed|forbidden|access denied)\b/i.test(error.message)) {
+        return false;
+    }
+
+    return /no rows in result set|not found/i.test(error.message);
+};
diff --git a/frontend/src/components/shared/detail-navigation/text-filter.test.ts b/frontend/src/lib/text-filter.test.ts
similarity index 100%
rename from frontend/src/components/shared/detail-navigation/text-filter.test.ts
rename to frontend/src/lib/text-filter.test.ts
diff --git a/frontend/src/components/shared/detail-navigation/text-filter.ts b/frontend/src/lib/text-filter.ts
similarity index 87%
rename from frontend/src/components/shared/detail-navigation/text-filter.ts
rename to frontend/src/lib/text-filter.ts
index b3344d67..0a032ce5 100644
--- a/frontend/src/components/shared/detail-navigation/text-filter.ts
+++ b/frontend/src/lib/text-filter.ts
@@ -21,10 +21,10 @@ export const normalizeForFilter = (text: string): string =>
  * allocation instead of N.
  *
  * The matcher uses substring matching semantics, with case + diacritic
- * folding (`café` matches `cafe`). It is intentionally close to TanStack
- * Table's default `'includesString'` so a single instance can drive both
- * the list page's column filter and the detail page's Prev/Next subset
- * without the two paths drifting out of sync.
+ * folding (`café` matches `cafe`). It backs both the DataTable global
+ * filter and detail-navigation's Prev/Next subset — the same `?q=` drives
+ * both, so a semantics change here shifts what matches on every list page
+ * and its detail pager at once.
  *
  * - Empty query → every row passes (matcher returns `true`).
  * - `text === null | undefined` with a non-empty query → no match.
diff --git a/frontend/src/lib/upload-validation.test.ts b/frontend/src/lib/upload-validation.test.ts
index eef25c12..deb849e7 100644
--- a/frontend/src/lib/upload-validation.test.ts
+++ b/frontend/src/lib/upload-validation.test.ts
@@ -34,6 +34,48 @@ describe('validateUploadBatch', () => {
         expect(validateUploadBatch(files, DEFAULT_LIMITS)).toBeNull();
     });
 
+    // Every rule below is also exercised one unit UNDER its cap: a limit tested only from the
+    // rejecting side cannot tell an off-by-one from a correct boundary.
+    it('accepts a batch sitting exactly on every cap', () => {
+        const limits = { maxFiles: 3, maxFileSizeMb: 10, maxTotalSizeMb: 30 };
+        const files = Array.from({ length: 3 }, (_, i) => makeFile(`f-${i}.bin`, 10 * MB));
+
+        expect(validateUploadBatch(files, limits)).toBeNull();
+    });
+
+    it('rejects one file past the per-file cap and accepts the file exactly on it', () => {
+        expect(validateUploadBatch([makeFile('at.bin', 300 * MB)], DEFAULT_LIMITS)).toBeNull();
+        expect(validateUploadBatch([makeFile('over.bin', 300 * MB + 1)], DEFAULT_LIMITS)).toBe(
+            'File "over.bin" is larger than 300 MB',
+        );
+    });
+
+    it('rejects one file past the count cap and accepts the batch exactly on it', () => {
+        const limits = { ...DEFAULT_LIMITS, maxFiles: 4 };
+
+        expect(
+            validateUploadBatch(
+                Array.from({ length: 4 }, (_, i) => makeFile(`f-${i}.txt`, 1)),
+                limits,
+            ),
+        ).toBeNull();
+        expect(
+            validateUploadBatch(
+                Array.from({ length: 5 }, (_, i) => makeFile(`f-${i}.txt`, 1)),
+                limits,
+            ),
+        ).toBe('Too many files: max 4 per upload');
+    });
+
+    it('rejects one byte past the total cap and accepts the batch exactly on it', () => {
+        const limits = { ...DEFAULT_LIMITS, maxTotalSizeMb: 20 };
+
+        expect(validateUploadBatch([makeFile('a.bin', 10 * MB), makeFile('b.bin', 10 * MB)], limits)).toBeNull();
+        expect(validateUploadBatch([makeFile('a.bin', 10 * MB), makeFile('b.bin', 10 * MB + 1)], limits)).toBe(
+            'Total upload size exceeds the 20 MB limit',
+        );
+    });
+
     it('rejects batches exceeding the file count cap', () => {
         const files = Array.from({ length: 5 }, (_, i) => makeFile(`f-${i}.txt`, 1));
 
@@ -55,16 +97,16 @@ describe('validateUploadBatch', () => {
         );
     });
 
-    it('rejects 0-byte files by default', () => {
-        const files = [makeFile('ok.txt', 1 * MB), makeFile('empty.txt', 0)];
+    it('accepts 0-byte files alongside other files', () => {
+        const files = [makeFile('ok.txt', 1 * MB), makeFile('.gitkeep', 0)];
 
-        expect(validateUploadBatch(files, DEFAULT_LIMITS)).toBe('File "empty.txt" is empty');
+        expect(validateUploadBatch(files, DEFAULT_LIMITS)).toBeNull();
     });
 
-    it('lets 0-byte files through when rejectEmpty is disabled', () => {
-        const files = [makeFile('ok.txt', 1 * MB), makeFile('empty.txt', 0)];
+    it('accepts a batch made only of 0-byte files', () => {
+        const files = [makeFile('.gitkeep', 0), makeFile('__init__.py', 0)];
 
-        expect(validateUploadBatch(files, { ...DEFAULT_LIMITS, rejectEmpty: false })).toBeNull();
+        expect(validateUploadBatch(files, DEFAULT_LIMITS)).toBeNull();
     });
 
     it('reports the first violation when multiple rules would fail', () => {
diff --git a/frontend/src/lib/upload-validation.ts b/frontend/src/lib/upload-validation.ts
index 1fcbc568..dcd690dd 100644
--- a/frontend/src/lib/upload-validation.ts
+++ b/frontend/src/lib/upload-validation.ts
@@ -6,20 +6,14 @@
  * Mirrors the per-file / per-batch limits enforced by the backend
  * (`pkg/resources/resources.go` for the resources library and
  * `pkg/flowfiles/files.go` for the flow files cache). Both backends do not
- * whitelist file extensions, so neither does this validator — it only checks
- * size, count and emptiness.
+ * whitelist file extensions and both accept 0-byte files, so neither does this
+ * validator — it only checks size and count.
  */
 
 export interface UploadValidationLimits {
     maxFiles: number;
     maxFileSizeMb: number;
     maxTotalSizeMb: number;
-    /**
-     * Reject 0-byte files. Defaults to `true` because both servers stream the
-     * upload body and surface a confusing `EOF on read` error mid-request when
-     * an empty file lands in the multipart payload.
-     */
-    rejectEmpty?: boolean;
 }
 
 const MEGABYTE = 1024 * 1024;
@@ -40,14 +34,9 @@ export const validateUploadBatch = (files: readonly File[], limits: UploadValida
 
     const maxBytesPerFile = limits.maxFileSizeMb * MEGABYTE;
     const maxTotalBytes = limits.maxTotalSizeMb * MEGABYTE;
-    const rejectEmpty = limits.rejectEmpty ?? true;
     let totalBytes = 0;
 
     for (const file of files) {
-        if (rejectEmpty && file.size === 0) {
-            return `File "${file.name}" is empty`;
-        }
-
         if (file.size > maxBytesPerFile) {
             return `File "${file.name}" is larger than ${limits.maxFileSizeMb} MB`;
         }
diff --git a/frontend/src/pages/flows/flow-report.test.tsx b/frontend/src/pages/flows/flow-report.test.tsx
new file mode 100644
index 00000000..4c257f3a
--- /dev/null
+++ b/frontend/src/pages/flows/flow-report.test.tsx
@@ -0,0 +1,51 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+
+const queryResult = vi.hoisted(() => ({
+    current: { data: undefined, error: undefined, loading: false } as Record<string, unknown>,
+}));
+
+vi.mock('@apollo/client/react', () => ({
+    skipToken: Symbol('skipToken'),
+    useQuery: () => queryResult.current,
+}));
+
+vi.mock('react-router-dom', () => ({
+    useParams: () => ({ flowId: '42' }),
+    useSearchParams: () => [new URLSearchParams()],
+}));
+
+vi.mock('@/components/shared/markdown', () => ({
+    default: ({ children }: { children: string }) => <div data-testid="markdown">{children}</div>,
+}));
+
+vi.mock('@/lib/report', () => ({
+    generateFileName: () => 'report',
+    generatePDFFromMarkdown: vi.fn().mockResolvedValue(undefined),
+    generateReport: (tasks: unknown[], flow: { title: string }) => `${flow.title}: ${tasks.length} tasks`,
+}));
+
+const { default: FlowReport } = await import('./flow-report');
+
+describe('FlowReport load states', () => {
+    it('renders the report when a partial error arrives alongside a usable flow', () => {
+        queryResult.current = {
+            data: { flow: { id: '42', title: 'Recon' }, tasks: null },
+            error: new Error('failed to fetch tasks'),
+            loading: false,
+        };
+
+        render(<FlowReport />);
+
+        expect(screen.getByTestId('markdown')).toHaveTextContent('Recon: 0 tasks');
+        expect(screen.queryByText('Failed to load flow data')).not.toBeInTheDocument();
+    });
+
+    it('reports a failure when the flow itself is missing', () => {
+        queryResult.current = { data: { flow: null, tasks: null }, error: new Error('boom'), loading: false };
+
+        render(<FlowReport />);
+
+        expect(screen.getByText('Failed to load flow data')).toBeInTheDocument();
+    });
+});
diff --git a/frontend/src/pages/flows/flow-report.tsx b/frontend/src/pages/flows/flow-report.tsx
index a375fb59..97ed0208 100644
--- a/frontend/src/pages/flows/flow-report.tsx
+++ b/frontend/src/pages/flows/flow-report.tsx
@@ -29,13 +29,13 @@ function FlowReport() {
         setPdfError(null);
     }
 
-    const {
-        data,
-        error: queryError,
-        loading,
-    } = useQuery(FlowReportDocument, flowId ? { errorPolicy: 'all', variables: { id: flowId } } : skipToken);
+    const { data, loading } = useQuery(
+        FlowReportDocument,
+        flowId ? { errorPolicy: 'all', variables: { id: flowId } } : skipToken,
+    );
 
-    const dataReady = !loading && !queryError && !!data?.flow;
+    // Under `errorPolicy:'all'` a partial error arrives alongside a flow that loaded fine.
+    const dataReady = !loading && !!data?.flow;
 
     const reportContent = useMemo(
         () => (dataReady ? generateReport(data.tasks || [], data.flow!) : ''),
@@ -53,7 +53,8 @@ function FlowReport() {
 
         pdfTriggered.current = true;
 
-        const fileName = `${generateFileName(data.flow)}.pdf`;
+        // The generator appends the extension itself.
+        const fileName = generateFileName(data.flow);
 
         generatePDFFromMarkdown(reportContent, fileName)
             .then(() => {
@@ -75,7 +76,7 @@ function FlowReport() {
 
     if (loading) {
         state = 'loading';
-    } else if (queryError || !data?.flow) {
+    } else if (!data?.flow) {
         state = 'error';
         errorMessage = 'Failed to load flow data';
     } else if (pdfPhase === 'error') {
diff --git a/frontend/src/pages/flows/flow.tsx b/frontend/src/pages/flows/flow.tsx
index 5996a649..52fb758f 100644
--- a/frontend/src/pages/flows/flow.tsx
+++ b/frontend/src/pages/flows/flow.tsx
@@ -86,10 +86,6 @@ function Flow() {
 
     const flow = flowData?.flow;
     const actualFlowTitle = flow?.title ?? '';
-    // Surface an optimistic title while the rename mutation is in flight so the
-    // breadcrumb, document title and edit affordance flip immediately on Save.
-    // If the mutation rejects, React rolls back to `actualFlowTitle` on its own
-    // and we surface the toast below — no manual reconciliation needed.
     const [flowTitle, setOptimisticFlowTitle] = useOptimistic(actualFlowTitle, (_current, next: string) => next);
     const isFlowRunning = flow ? ![StatusType.Failed, StatusType.Finished].includes(flow.status) : false;
 
@@ -121,12 +117,6 @@ function Flow() {
             return;
         }
 
-        // Drop the new title into the optimistic state immediately so the
-        // breadcrumb and document title flip before the network round-trip. The
-        // optimistic value lives only inside this transition — once the
-        // mutation settles, useOptimistic falls back to the Apollo cache
-        // (which the mutation response has already updated on success, or
-        // left untouched on error).
         startTransition(async () => {
             setOptimisticFlowTitle(newTitle);
 
@@ -277,6 +267,14 @@ function Flow() {
                 </AppHeaderContent>
                 <AppHeaderActions>
                     {!!(flowData?.tasks ?? [])?.length && <FlowReportDropdown />}
+                    {!isMobile && (
+                        <DetailNavigationToolbar<FlowItem>
+                            controller={flowNav}
+                            renderItem={renderFlowItem}
+                            sheetIcon={<GitFork className="size-4" />}
+                            sheetTitle="Flows"
+                        />
+                    )}
                     {flowId && !isMobile && (
                         <Button
                             aria-label="Toggle favorite"
@@ -290,14 +288,6 @@ function Flow() {
                             <Star className={isFavoriteFlow(flowId) ? 'fill-yellow-500 stroke-yellow-500' : ''} />
                         </Button>
                     )}
-                    {!isMobile && (
-                        <DetailNavigationToolbar<FlowItem>
-                            controller={flowNav}
-                            renderItem={renderFlowItem}
-                            sheetIcon={<GitFork className="size-4" />}
-                            sheetTitle="Flows"
-                        />
-                    )}
                     <DropdownMenu>
                         <DropdownMenuTrigger asChild>
                             <Button
diff --git a/frontend/src/pages/knowledges/knowledge.test.tsx b/frontend/src/pages/knowledges/knowledge.test.tsx
new file mode 100644
index 00000000..30bc34d8
--- /dev/null
+++ b/frontend/src/pages/knowledges/knowledge.test.tsx
@@ -0,0 +1,78 @@
+import { render, screen } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { routes } from '@/lib/routes';
+
+const { navigate } = vi.hoisted(() => ({ navigate: vi.fn() }));
+const { toastError } = vi.hoisted(() => ({ toastError: vi.fn() }));
+const queryResult = vi.hoisted(() => ({
+    current: { data: undefined, error: undefined, loading: false, refetch: vi.fn() } as Record<string, unknown>,
+}));
+
+vi.mock('@apollo/client/react', () => ({
+    skipToken: Symbol('skipToken'),
+    useQuery: () => queryResult.current,
+}));
+
+vi.mock('react-router-dom', () => ({
+    useNavigate: () => navigate,
+    useParams: () => ({ knowledgeId: '7' }),
+}));
+
+vi.mock('sonner', () => ({ toast: { error: toastError } }));
+
+vi.mock('@/providers/knowledges-provider', () => ({
+    useKnowledges: () => ({ createKnowledge: vi.fn(), updateKnowledge: vi.fn() }),
+}));
+
+// The layout shell and the form drag in the header/editor tree; the branching under test sits
+// above them in Knowledge itself, so stub them to a marker.
+vi.mock('@/features/knowledges/knowledge-layout', () => ({
+    KnowledgeLayout: ({ children }: { children: React.ReactNode }) => <div data-testid="layout">{children}</div>,
+}));
+vi.mock('@/features/knowledges/knowledge-form', async (importOriginal) => ({
+    ...(await importOriginal<Record<string, unknown>>()),
+    KnowledgeForm: () => <div data-testid="form" />,
+}));
+
+const { default: Knowledge } = await import('./knowledge');
+
+describe('Knowledge detail load states', () => {
+    beforeEach(() => {
+        navigate.mockClear();
+        toastError.mockClear();
+    });
+
+    it('renders an in-page error with Retry on a real load failure, without redirecting', () => {
+        queryResult.current = { data: undefined, error: new Error('network down'), loading: false, refetch: vi.fn() };
+
+        render(<Knowledge />);
+
+        expect(screen.getByText('Error loading knowledge document')).toBeInTheDocument();
+        expect(screen.getByRole('button', { name: /Try again/ })).toBeInTheDocument();
+        expect(navigate).not.toHaveBeenCalled();
+    });
+
+    it('redirects to the list on a genuine not-found error', () => {
+        queryResult.current = {
+            data: undefined,
+            error: new Error('no rows in result set'),
+            loading: false,
+            refetch: vi.fn(),
+        };
+
+        render(<Knowledge />);
+
+        expect(screen.queryByText('Error loading knowledge document')).not.toBeInTheDocument();
+        expect(toastError).toHaveBeenCalled();
+        expect(navigate).toHaveBeenCalledWith(routes.knowledges, { replace: true });
+    });
+
+    it('redirects to the list when the query resolves with no document', () => {
+        queryResult.current = { data: { knowledgeDocument: null }, error: undefined, loading: false, refetch: vi.fn() };
+
+        render(<Knowledge />);
+
+        expect(navigate).toHaveBeenCalledWith(routes.knowledges, { replace: true });
+    });
+});
diff --git a/frontend/src/pages/knowledges/knowledge.tsx b/frontend/src/pages/knowledges/knowledge.tsx
index 672015dc..01a2d7a2 100644
--- a/frontend/src/pages/knowledges/knowledge.tsx
+++ b/frontend/src/pages/knowledges/knowledge.tsx
@@ -3,6 +3,7 @@ import { useCallback, useEffect, useMemo } from 'react';
 import { useNavigate, useParams } from 'react-router-dom';
 import { toast } from 'sonner';
 
+import { ErrorState } from '@/components/shared/error-state';
 import { Spinner } from '@/components/ui/spinner';
 import {
     type DirtyFlags,
@@ -16,6 +17,7 @@ import {
 } from '@/features/knowledges/knowledge-form';
 import { KnowledgeLayout } from '@/features/knowledges/knowledge-layout';
 import { KnowledgeDocumentDocument } from '@/graphql/types';
+import { isNotFoundError } from '@/lib/errors';
 import { routes } from '@/lib/routes';
 import { useKnowledges } from '@/providers/knowledges-provider';
 
@@ -27,19 +29,33 @@ function Knowledge() {
     const isNew = knowledgeId === 'new';
     const shouldFetch = Boolean(knowledgeId) && !isNew;
 
-    const { data, loading: isLoadingKnowledge } = useQuery(
+    const {
+        data,
+        error,
+        loading: isLoadingKnowledge,
+        refetch,
+    } = useQuery(
         KnowledgeDocumentDocument,
         shouldFetch && knowledgeId ? { variables: { id: knowledgeId } } : skipToken,
     );
 
     const knowledge = data?.knowledgeDocument ?? null;
+    // A real load failure that left nothing to show, as opposed to a genuine not-found: the page
+    // renders it as an in-page ErrorState + Retry instead of bouncing to the list. Mirrors flow.
+    const loadError = error && !knowledge && !isNotFoundError(error) ? error : undefined;
 
     useEffect(() => {
-        if (!isNew && !isLoadingKnowledge && !knowledge) {
+        // Redirect only when the document is genuinely gone (query settled with no document, or a
+        // not-found error) — never on a transient load failure, which Retry can recover.
+        if (isNew || isLoadingKnowledge || loadError) {
+            return;
+        }
+
+        if (!knowledge) {
             toast.error('Knowledge document not found');
             navigate(routes.knowledges, { replace: true });
         }
-    }, [isNew, isLoadingKnowledge, knowledge, navigate]);
+    }, [isNew, isLoadingKnowledge, knowledge, loadError, navigate]);
 
     const initialValues = useMemo<FormValues>(
         () => (knowledge ? documentToFormValues(knowledge) : newDocumentDefaults),
@@ -73,6 +89,23 @@ function Knowledge() {
         [createKnowledge, isNew, knowledgeId, updateKnowledge],
     );
 
+    if (loadError) {
+        return (
+            <KnowledgeLayout
+                isNew={false}
+                knowledge={null}
+            >
+                <div className="flex flex-1 flex-col gap-4 p-4">
+                    <ErrorState
+                        message={loadError.message}
+                        onRetry={() => refetch()}
+                        title="Error loading knowledge document"
+                    />
+                </div>
+            </KnowledgeLayout>
+        );
+    }
+
     if (!isNew && !knowledge) {
         return (
             <KnowledgeLayout
diff --git a/frontend/src/pages/resources/resources.tsx b/frontend/src/pages/resources/resources.tsx
index 1e407337..7f0cc957 100644
--- a/frontend/src/pages/resources/resources.tsx
+++ b/frontend/src/pages/resources/resources.tsx
@@ -469,7 +469,7 @@ function Resources() {
 
                 {isDragging && hasResources && (
                     <div className="bg-primary/10 border-primary pointer-events-none absolute inset-2 z-30 flex items-center justify-center rounded-lg border-2 border-dashed">
-                        <div className="text-primary flex flex-col items-center gap-2">
+                        <div className="text-link flex flex-col items-center gap-2">
                             <FolderUp className="size-8" />
                             <span className="text-sm font-medium">Drop files to upload</span>
                         </div>
@@ -489,6 +489,7 @@ function Resources() {
                         {search.rawQuery ? (
                             <InputGroupAddon align="inline-end">
                                 <InputGroupButton
+                                    aria-label="Clear resource search"
                                     onClick={search.resetSearch}
                                     type="button"
                                 >
diff --git a/frontend/src/pages/settings/settings-api-tokens.tsx b/frontend/src/pages/settings/settings-api-tokens.tsx
index caf87bf9..680a293d 100644
--- a/frontend/src/pages/settings/settings-api-tokens.tsx
+++ b/frontend/src/pages/settings/settings-api-tokens.tsx
@@ -854,7 +854,7 @@ function SettingsAPITokens() {
         </AppHeader>
     );
 
-    if (isLoading) {
+    if (isLoading && !data) {
         return (
             <>
                 {pageHeader}
diff --git a/frontend/src/pages/settings/settings-prompt.tsx b/frontend/src/pages/settings/settings-prompt.tsx
index d67f7bf8..a50a9b9b 100644
--- a/frontend/src/pages/settings/settings-prompt.tsx
+++ b/frontend/src/pages/settings/settings-prompt.tsx
@@ -44,7 +44,6 @@ import {
     variableUseRegex,
 } from '@/components/shared/markdown-editor';
 
-type AgentPrompt = AgentPrompts;
 type AgentPrompts = { human?: DefaultPrompt; system: DefaultPrompt };
 
 import {
@@ -285,8 +284,22 @@ function FormMarkdownItem<T extends FieldValues>({
     );
 }
 
+// Same class as templates: one element serves every `/settings/prompts/:promptId`, so a POP across prompt
+// URLs kept the previous prompt's dirty template — and the previous `activeTab`, which on a tool prompt renders
+// no TabsContent and left the header Save submitting a form id that no longer exists. A key per prompt gives
+// both a fresh start.
 function SettingsPrompt() {
     const { promptId } = useParams<{ promptId: string }>();
+
+    return (
+        <SettingsPromptEditor
+            key={promptId ?? 'new'}
+            promptId={promptId}
+        />
+    );
+}
+
+function SettingsPromptEditor({ promptId }: { promptId?: string }) {
     const { isDesktop } = useBreakpoint();
 
     const { data, error, loading, refetch } = useQuery(SettingsPromptsDocument);
@@ -364,7 +377,7 @@ function SettingsPrompt() {
 
             if (activeTab === 'system') {
                 if (promptInfo.type === 'agent') {
-                    const agentData = promptInfo.data as AgentPrompt | AgentPrompts;
+                    const agentData = promptInfo.data as AgentPrompts;
                     promptType = agentData.system.type;
                 } else {
                     const toolData = promptInfo.data as DefaultPrompt;
@@ -429,7 +442,7 @@ function SettingsPrompt() {
 
         const { agents, tools } = defaultPrompts;
 
-        const agentData = agents?.[promptId as keyof typeof agents] as AgentPrompt | AgentPrompts | undefined;
+        const agentData = agents?.[promptId as keyof typeof agents] as AgentPrompts | undefined;
 
         if (agentData) {
             const userSystemPrompt = userDefined?.find((p) => p.type === agentData.system.type);
@@ -481,7 +494,7 @@ function SettingsPrompt() {
         if (activeTab === 'system') {
             variables =
                 promptInfo.type === 'agent'
-                    ? (promptInfo.data as AgentPrompt | AgentPrompts)?.system?.variables || []
+                    ? (promptInfo.data as AgentPrompts)?.system?.variables || []
                     : (promptInfo.data as DefaultPrompt)?.variables || [];
         } else if (activeTab === 'human' && promptInfo.type === 'agent' && promptInfo.hasHuman) {
             variables = (promptInfo.data as AgentPrompts)?.human?.variables || [];
@@ -529,7 +542,7 @@ function SettingsPrompt() {
             let promptType: PromptType;
 
             if (promptInfo.type === 'agent') {
-                const agentData = promptInfo.data as AgentPrompt | AgentPrompts;
+                const agentData = promptInfo.data as AgentPrompts;
                 promptType = agentData.system.type;
             } else {
                 const toolData = promptInfo.data as DefaultPrompt;
@@ -727,7 +740,7 @@ function SettingsPrompt() {
         </AppHeader>
     );
 
-    if (loading) {
+    if (loading && !data) {
         return (
             <>
                 {pageHeader}
@@ -741,7 +754,7 @@ function SettingsPrompt() {
         );
     }
 
-    if (error) {
+    if (error && !data) {
         return (
             <>
                 {pageHeader}
diff --git a/frontend/src/pages/settings/settings-prompts.tsx b/frontend/src/pages/settings/settings-prompts.tsx
index 5a6002bb..e5e51977 100644
--- a/frontend/src/pages/settings/settings-prompts.tsx
+++ b/frontend/src/pages/settings/settings-prompts.tsx
@@ -21,7 +21,6 @@ import { toast } from 'sonner';
 
 import type { DefaultPromptFragmentFragment as DefaultPrompt, PromptType } from '@/graphql/types';
 
-type AgentPrompt = AgentPrompts;
 type AgentPrompts = { human?: DefaultPrompt; system: DefaultPrompt };
 
 import { AppHeader, AppHeaderContent, AppHeaderTitle } from '@/components/layouts/app/app-header';
@@ -45,6 +44,8 @@ import { DeletePromptDocument, SettingsPromptsDocument } from '@/graphql/types';
 import { usePageStorageKeys } from '@/hooks/use-page-storage-keys';
 import { routes } from '@/lib/routes';
 
+const formatName = (key: string): string => key.replaceAll(/([A-Z])/g, ' $1').replace(/^./, (str) => str.toUpperCase());
+
 type AgentPromptTableData = {
     displayName: string;
     hasHuman: boolean;
@@ -233,11 +234,8 @@ function SettingsPrompts() {
                 case 'system': {
                     return systemType ? userDefined.some((p) => p.type === systemType) : false;
                 }
-                // No default
             }
         }
-
-        return false;
     };
 
     const getAgentPromptsData = (): AgentPromptTableData[] => {
@@ -249,16 +247,12 @@ function SettingsPrompts() {
         const userDefined = data.settingsPrompts.userDefined || [];
         const agentEntries: AgentPromptTableData[] = [];
 
-        const formatName = (key: string): string => {
-            return key.replaceAll(/([A-Z])/g, ' $1').replace(/^./, (str) => str.toUpperCase());
-        };
-
         Object.entries(agents).forEach(([key, prompts]) => {
             if (key === '__typename') {
                 return;
             }
 
-            const systemType = (prompts as AgentPrompt | AgentPrompts)?.system?.type;
+            const systemType = (prompts as AgentPrompts)?.system?.type;
             const humanType = (prompts as AgentPrompts)?.human?.type;
 
             const hasCustomSystem = userDefined.some((p) => p.type === systemType);
@@ -267,17 +261,13 @@ function SettingsPrompts() {
             const agentData: AgentPromptTableData = {
                 displayName: formatName(key),
                 hasHuman: !!(prompts as AgentPrompts)?.human,
-                hasSystem: !!(prompts as AgentPrompt | AgentPrompts)?.system,
+                hasSystem: !!(prompts as AgentPrompts)?.system,
                 humanStatus: (prompts as AgentPrompts)?.human ? (hasCustomHuman ? 'Custom' : 'Default') : 'N/A',
                 humanTemplate: (prompts as AgentPrompts)?.human?.template,
                 humanType,
                 name: key,
-                systemStatus: (prompts as AgentPrompt | AgentPrompts)?.system
-                    ? hasCustomSystem
-                        ? 'Custom'
-                        : 'Default'
-                    : 'N/A',
-                systemTemplate: (prompts as AgentPrompt | AgentPrompts)?.system?.template || '',
+                systemStatus: (prompts as AgentPrompts)?.system ? (hasCustomSystem ? 'Custom' : 'Default') : 'N/A',
+                systemTemplate: (prompts as AgentPrompts)?.system?.template || '',
                 systemType,
             };
 
@@ -296,10 +286,6 @@ function SettingsPrompts() {
         const userDefined = data.settingsPrompts.userDefined || [];
         const toolEntries: ToolPromptTableData[] = [];
 
-        const formatName = (key: string): string => {
-            return key.replaceAll(/([A-Z])/g, ' $1').replace(/^./, (str) => str.toUpperCase());
-        };
-
         Object.entries(tools).forEach(([key, prompt]) => {
             if (key === '__typename') {
                 return;
@@ -336,7 +322,7 @@ function SettingsPrompts() {
 
                 return (
                     <Button
-                        className="text-muted-foreground hover:text-primary flex items-center gap-2 p-0 no-underline hover:no-underline"
+                        className="text-muted-foreground hover:text-link flex items-center gap-2 p-0 no-underline hover:no-underline"
                         onClick={() => handleColumnSort(column)}
                         variant="link"
                     >
@@ -512,7 +498,7 @@ function SettingsPrompts() {
 
                 return (
                     <Button
-                        className="text-muted-foreground hover:text-primary flex items-center gap-2 p-0 hover:no-underline"
+                        className="text-muted-foreground hover:text-link flex items-center gap-2 p-0 hover:no-underline"
                         onClick={() => handleColumnSort(column)}
                         variant="link"
                     >
@@ -792,7 +778,7 @@ function SettingsPrompts() {
         </AppHeader>
     );
 
-    if (isLoading) {
+    if (isLoading && !data) {
         return (
             <>
                 {pageHeader}
diff --git a/frontend/src/pages/settings/settings-provider.test.tsx b/frontend/src/pages/settings/settings-provider.test.tsx
index 5688c160..7ad1938d 100644
--- a/frontend/src/pages/settings/settings-provider.test.tsx
+++ b/frontend/src/pages/settings/settings-provider.test.tsx
@@ -1,12 +1,13 @@
-import { render } from '@testing-library/react';
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { toast } from 'sonner';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { ProviderType } from '@/graphql/types';
 import { routes } from '@/lib/routes';
 
-const { navigate } = vi.hoisted(() => ({ navigate: vi.fn() }));
+const { mutate, navigate } = vi.hoisted(() => ({ mutate: vi.fn(), navigate: vi.fn() }));
 
-const state = vi.hoisted(() => ({ params: new URLSearchParams() }));
+const state = vi.hoisted(() => ({ params: new URLSearchParams(), providerId: 'new' }));
 
 const setSearch = (search: string) => {
     state.params = new URLSearchParams(search);
@@ -26,8 +27,6 @@ const enabled = {
     qwen: true,
 };
 
-const emptyProvider = { agents: {} };
-
 const userDefined = [
     {
         agents: {},
@@ -37,25 +36,43 @@ const userDefined = [
         type: ProviderType.Minimax,
         updatedAt: '',
     },
+    {
+        agents: {},
+        createdAt: '',
+        id: 'edit-1',
+        name: 'Persisted Name',
+        type: ProviderType.Anthropic,
+        updatedAt: '',
+    },
 ];
 
+// The create form seeds agents from the type's defaults, and bails when the type has no models —
+// so a fixture with an empty catalogue would make the seeding tests vacuously green.
+const agentDefaults = (model: string, temperature: number) => ({
+    simple: { maxTokens: 1000, model, temperature },
+});
+
 const settingsProviders = {
     default: {
-        anthropic: emptyProvider,
-        openai: emptyProvider,
+        anthropic: { agents: agentDefaults('claude-e2e', 0.2) },
+        openai: { agents: agentDefaults('gpt-e2e', 0.7) },
     },
     enabled,
-    models: { anthropic: [], minimax: [], openai: [] },
+    models: {
+        anthropic: [{ name: 'claude-e2e' }],
+        minimax: [],
+        openai: [{ name: 'gpt-e2e' }],
+    },
     userDefined,
 };
 
 // A stable `data` identity matters: the page's seeding effect lists `data` as a
 // dependency, so a fresh object each render would loop it (Apollo returns a
 // cached reference in production).
-const queryResult = { data: { settingsProviders }, error: undefined, loading: false };
+const queryResult = { data: { settingsProviders }, error: undefined as Error | undefined, loading: false };
 
 vi.mock('@apollo/client/react', () => ({
-    useMutation: () => [vi.fn(), {}],
+    useMutation: () => [mutate, {}],
     useQuery: () => queryResult,
 }));
 
@@ -65,7 +82,7 @@ vi.mock('react-router-dom', async (importOriginal) => ({
     ...(await importOriginal<typeof import('react-router-dom')>()),
     useBlocker: () => ({ proceed: undefined, reset: undefined, state: 'unblocked' }),
     useNavigate: () => navigate,
-    useParams: () => ({ providerId: 'new' }),
+    useParams: () => ({ providerId: state.providerId }),
     useSearchParams: () => [state.params, vi.fn()],
 }));
 
@@ -77,10 +94,20 @@ vi.mock('@/hooks/use-breakpoint', () => ({
 // whole family so the guard effect under test renders without that scaffolding.
 vi.mock('@/components/layouts/app/app-header', () => {
     const Pass = ({ children }: { children?: React.ReactNode }) => <div>{children}</div>;
+    const Action = ({
+        icon: _icon,
+        label,
+        loading: _loading,
+        ...props
+    }: React.ComponentProps<'button'> & {
+        icon?: React.ReactNode;
+        label?: React.ReactNode;
+        loading?: boolean;
+    }) => <button {...props}>{label}</button>;
 
     return {
         AppHeader: Pass,
-        AppHeaderAction: Pass,
+        AppHeaderAction: Action,
         AppHeaderActions: Pass,
         AppHeaderContent: Pass,
         AppHeaderTitle: Pass,
@@ -92,8 +119,14 @@ vi.mock('sonner', () => ({ toast: { error: vi.fn(), info: vi.fn(), success: vi.f
 import SettingsProvider from './settings-provider';
 
 beforeEach(() => {
+    mutate.mockClear();
     navigate.mockClear();
+    vi.mocked(toast.error).mockClear();
     setSearch('');
+    state.providerId = 'new';
+    queryResult.data = { settingsProviders };
+    queryResult.error = undefined;
+    queryResult.loading = false;
 });
 
 describe('SettingsProvider create-form type guards', () => {
@@ -124,4 +157,134 @@ describe('SettingsProvider create-form type guards', () => {
 
         expect(navigate).not.toHaveBeenCalled();
     });
+
+    // cache-and-network means an error can arrive with cached data still present; the form must
+    // survive it rather than flip to the full-page error screen.
+    it('keeps the form on a refetch error while cached data is present', () => {
+        setSearch('type=anthropic');
+        queryResult.error = new Error('e2e induced refetch failure');
+        render(<SettingsProvider />);
+
+        expect(screen.queryByText('Error loading provider data')).not.toBeInTheDocument();
+        expect(navigate).not.toHaveBeenCalled();
+    });
+
+    // The loading branch runs before the error branch, so it needs the same guard: a background
+    // refetch reports loading:true with cached data and must not blank the form to the spinner.
+    it('keeps the form on a background refetch while cached data is present', () => {
+        setSearch('type=anthropic');
+        queryResult.loading = true;
+        render(<SettingsProvider />);
+
+        expect(screen.queryByText('Loading provider data...')).not.toBeInTheDocument();
+        expect(navigate).not.toHaveBeenCalled();
+    });
+
+    const expandAgent = () => {
+        if (!screen.queryByLabelText('Temperature')) {
+            fireEvent.click(screen.getByRole('button', { name: /Simple/ }));
+        }
+    };
+
+    const temperatureInput = () => screen.getByLabelText('Temperature') as HTMLInputElement;
+
+    it('preserves an in-flight agent edit on the create form across a background refetch', () => {
+        setSearch('type=openai');
+        const { rerender } = render(<SettingsProvider />);
+
+        expandAgent();
+        expect(temperatureInput().value).toBe('0.7');
+
+        fireEvent.change(temperatureInput(), { target: { value: '1.5' } });
+
+        // A refetch that carries no change leaves `data` referentially equal and is inert, so the
+        // payload has to actually differ for this to exercise the seeding effect.
+        queryResult.data = {
+            settingsProviders: { ...settingsProviders, userDefined: [...userDefined] },
+        };
+        rerender(<SettingsProvider />);
+
+        expect(temperatureInput().value).toBe('1.5');
+    });
+
+    it('still re-seeds the agents when the type changes mid-edit', () => {
+        setSearch('type=openai');
+        const { rerender } = render(<SettingsProvider />);
+
+        expandAgent();
+        fireEvent.change(temperatureInput(), { target: { value: '1.5' } });
+
+        setSearch('type=anthropic');
+        rerender(<SettingsProvider />);
+        expandAgent();
+
+        expect(temperatureInput().value).toBe('0.2');
+    });
+
+    it('preserves an in-flight edit across a background refetch', () => {
+        state.providerId = 'edit-1';
+        const { rerender } = render(<SettingsProvider />);
+
+        const nameInput = screen.getByPlaceholderText('Enter provider name') as HTMLInputElement;
+
+        expect(nameInput.value).toBe('Persisted Name');
+
+        fireEvent.change(nameInput, { target: { value: 'My Unsaved Edit' } });
+
+        queryResult.data = { settingsProviders };
+        rerender(<SettingsProvider />);
+
+        expect((screen.getByPlaceholderText('Enter provider name') as HTMLInputElement).value).toBe('My Unsaved Edit');
+    });
+});
+
+describe('SettingsProvider save feedback', () => {
+    const toggleAgent = () => fireEvent.click(screen.getByRole('button', { name: /Simple/ }));
+
+    const saveButton = () => screen.getByRole('button', { name: 'Create' });
+
+    const renderCreateForm = () => {
+        setSearch('type=openai');
+        render(<SettingsProvider />);
+        fireEvent.change(screen.getByPlaceholderText('Enter provider name'), { target: { value: 'My Provider' } });
+    };
+
+    const typeInvalidExtraBody = () => {
+        toggleAgent();
+        fireEvent.change(screen.getByLabelText('Extra Body (JSON)'), { target: { value: '{ nope' } });
+        toggleAgent();
+    };
+
+    it('toasts an agent-level error raised inside a collapsed panel', async () => {
+        renderCreateForm();
+        typeInvalidExtraBody();
+
+        expect(screen.queryByLabelText('Extra Body (JSON)')).not.toBeInTheDocument();
+
+        fireEvent.click(saveButton());
+
+        await waitFor(() => expect(toast.error).toHaveBeenCalledTimes(1));
+        expect(toast.error).toHaveBeenCalledWith(expect.stringContaining('Must be a valid JSON object'));
+        expect(mutate).not.toHaveBeenCalled();
+    });
+
+    it('toasts again when the same invalid form is submitted twice', async () => {
+        renderCreateForm();
+        typeInvalidExtraBody();
+
+        fireEvent.click(saveButton());
+        await waitFor(() => expect(toast.error).toHaveBeenCalledTimes(1));
+
+        fireEvent.click(saveButton());
+        await waitFor(() => expect(toast.error).toHaveBeenCalledTimes(2));
+    });
+
+    it('runs the create mutation when the form is valid', async () => {
+        renderCreateForm();
+
+        fireEvent.click(saveButton());
+
+        await waitFor(() => expect(mutate).toHaveBeenCalledTimes(1));
+        expect(toast.error).not.toHaveBeenCalled();
+    });
 });
diff --git a/frontend/src/pages/settings/settings-provider.tsx b/frontend/src/pages/settings/settings-provider.tsx
index 0cbda151..31e74ba6 100644
--- a/frontend/src/pages/settings/settings-provider.tsx
+++ b/frontend/src/pages/settings/settings-provider.tsx
@@ -12,9 +12,10 @@ import {
     Trash2,
     XCircle,
 } from 'lucide-react';
-import { type ComponentProps, useEffect, useMemo, useState } from 'react';
+import { type ComponentProps, type FormEvent, useEffect, useMemo, useRef, useState } from 'react';
 import {
     type Control,
+    type FieldErrors,
     type FieldPath,
     type FieldValues,
     useController,
@@ -611,10 +612,13 @@ const agentConfigSchema = z
     .object({
         extraBody: optionalJsonObject,
         frequencyPenalty: optionalNumber,
+        json: z.boolean().nullable().optional(),
         maxLength: optionalNumber,
         maxTokens: optionalNumber,
         minLength: optionalNumber,
+        minP: optionalNumber,
         model: requiredString('Model is required'),
+        n: optionalNumber,
         presencePenalty: optionalNumber,
         price: z
             .object({
@@ -634,6 +638,7 @@ const agentConfigSchema = z
             .nullable()
             .optional(),
         repetitionPenalty: optionalNumber,
+        responseMimeType: z.string().nullable().optional(),
         temperature: optionalNumber,
         topK: optionalNumber,
         topP: optionalNumber,
@@ -886,10 +891,15 @@ export const transformFormToGraphQL = (
             const config: AgentConfigInput = {
                 extraBody: data?.extraBody?.trim() ? (JSON.parse(data.extraBody) as Record<string, unknown>) : null,
                 frequencyPenalty: data?.frequencyPenalty ?? null,
+                // Not user-editable: carried through so saving a provider does not strip what the
+                // shipped defaults set (json drives WithJSONMode on the simple_json agent).
+                json: data?.json ?? null,
                 maxLength: data?.maxLength ?? null,
                 maxTokens: data?.maxTokens ?? null,
                 minLength: data?.minLength ?? null,
+                minP: data?.minP ?? null,
                 model: data?.model ?? '',
+                n: data?.n ?? null,
                 presencePenalty: data?.presencePenalty ?? null,
                 price:
                     data?.price &&
@@ -912,6 +922,7 @@ export const transformFormToGraphQL = (
                       }
                     : null,
                 repetitionPenalty: data?.repetitionPenalty ?? null,
+                responseMimeType: data?.responseMimeType ?? null,
                 temperature: data?.temperature ?? null,
                 topK: data?.topK ?? null,
                 topP: data?.topP ?? null,
@@ -1203,12 +1214,17 @@ function SettingsProvider() {
             name: undefined,
             type: undefined,
         },
+        // The seeding effect re-runs on every settingsProviders refetch (cache-and-network +
+        // replaceWithIncoming gives a fresh `data`); without this a background refetch landing
+        // mid-edit silently wipes the unsaved form.
+        resetOptions: { keepDirtyValues: true },
         schema: formSchema,
     });
 
     const { control, formState, handleSubmit: handleFormSubmit, reset, setValue, trigger, watch } = form;
 
     const { isDirty } = useFormState({ control });
+    const seededTypeRef = useRef<null | string>(null);
 
     useEffect(() => {
         if (submitError) {
@@ -1279,6 +1295,17 @@ function SettingsProvider() {
             return;
         }
 
+        // setValue is outside the form's keepDirtyValues, so a background refetch re-runs this effect
+        // with a fresh `data` identity and overwrites agent edits the user has not saved. Re-seed only
+        // when the type actually changed — that is the case where the previous type's agents are wrong.
+        const isSameType = seededTypeRef.current === selectedType;
+
+        seededTypeRef.current = selectedType;
+
+        if (isSameType && form.getFieldState('agents').isDirty) {
+            return;
+        }
+
         const defaultProvider =
             data.settingsProviders.default[selectedType as keyof typeof data.settingsProviders.default];
 
@@ -1509,6 +1536,18 @@ function SettingsProvider() {
         }
     };
 
+    const handleInvalidSubmit = (errors: FieldErrors<FormInput>) => {
+        setSubmitError(
+            `Please fix the following validation errors:\n\n${formatFormErrors(errors as Record<string, unknown>)}`,
+        );
+    };
+
+    const handleFormEvent = async (event: FormEvent<HTMLFormElement>) => {
+        setSubmitError(null);
+
+        await handleFormSubmit(handleSubmit, handleInvalidSubmit)(event);
+    };
+
     const handleDelete = () => {
         if (isNew || !providerId) {
             return;
@@ -1605,7 +1644,7 @@ function SettingsProvider() {
         }
     };
 
-    if (loading) {
+    if (loading && !data) {
         return (
             <>
                 <AppHeader>
@@ -1625,7 +1664,7 @@ function SettingsProvider() {
         );
     }
 
-    if (error) {
+    if (error && !data) {
         return (
             <>
                 <AppHeader>
@@ -2002,7 +2041,7 @@ function SettingsProvider() {
                     className="flex min-h-0 flex-1 flex-col"
                     id="provider-form"
                     noValidate
-                    onSubmit={handleFormSubmit(handleSubmit)}
+                    onSubmit={handleFormEvent}
                 >
                     {isDesktop ? (
                         <DetailSplitLayout
diff --git a/frontend/src/pages/settings/settings-providers.test.tsx b/frontend/src/pages/settings/settings-providers.test.tsx
index bd5a8a94..7d351d11 100644
--- a/frontend/src/pages/settings/settings-providers.test.tsx
+++ b/frontend/src/pages/settings/settings-providers.test.tsx
@@ -1,20 +1,9 @@
 import { render, screen } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
+import { MemoryRouter } from 'react-router-dom';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
-const state = vi.hoisted(() => ({ enabled: {} as Record<string, boolean> | undefined }));
-
-vi.mock('@apollo/client/react', () => ({
-    useMutation: () => [vi.fn(), {}],
-    useQuery: () => ({ data: { settingsProviders: { enabled: state.enabled } } }),
-}));
-
-vi.mock('react-router-dom', async (importOriginal) => ({
-    ...(await importOriginal<typeof import('react-router-dom')>()),
-    useNavigate: () => vi.fn(),
-}));
-
-import { SettingsProvidersHeader } from './settings-providers';
+import { ProviderType } from '@/graphql/types';
 
 const ALL_TYPES = [
     'anthropic',
@@ -30,11 +19,57 @@ const ALL_TYPES = [
     'qwen',
 ];
 
-beforeEach(() => {
-    state.enabled = Object.fromEntries(ALL_TYPES.map((type) => [type, type !== 'minimax' && type !== 'custom']));
+const emptyProvider = { agents: {} };
+
+const makeData = (userDefined: unknown[]) => ({
+    settingsProviders: {
+        default: { anthropic: emptyProvider, openai: emptyProvider },
+        enabled: Object.fromEntries(ALL_TYPES.map((type) => [type, type !== 'minimax' && type !== 'custom'])),
+        models: {},
+        userDefined,
+    },
 });
 
+const queryResult = vi.hoisted(() => ({
+    current: { data: undefined, error: undefined, loading: false, refetch: () => {} } as Record<string, unknown>,
+}));
+
+vi.mock('@apollo/client/react', () => ({
+    useMutation: () => [vi.fn(), {}],
+    useQuery: () => queryResult.current,
+}));
+
+vi.mock('react-router-dom', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('react-router-dom')>()),
+    useNavigate: () => vi.fn(),
+}));
+
+vi.mock('@/hooks/use-table-state', () => ({
+    useTableState: () => ({ filter: '', pageIndex: 0, setFilter: vi.fn(), setPage: vi.fn() }),
+}));
+
+// AppHeader pulls in SidebarTrigger (needs a SidebarProvider context); stub the family so the
+// list's load-state branches render without that scaffolding. SettingsProvidersHeader builds its
+// own trigger from a plain Button, so this does not touch the create-menu tests.
+vi.mock('@/components/layouts/app/app-header', () => {
+    const Pass = ({ children }: { children?: React.ReactNode }) => <div>{children}</div>;
+
+    return {
+        AppHeader: Pass,
+        AppHeaderAction: Pass,
+        AppHeaderActions: Pass,
+        AppHeaderContent: Pass,
+        AppHeaderTitle: Pass,
+    };
+});
+
+import SettingsProviders, { SettingsProvidersHeader } from './settings-providers';
+
 describe('SettingsProvidersHeader create menu', () => {
+    beforeEach(() => {
+        queryResult.current = { data: makeData([]), error: undefined, loading: false, refetch: () => {} };
+    });
+
     it('offers only provider types whose API key is configured', async () => {
         const user = userEvent.setup();
         render(<SettingsProvidersHeader />);
@@ -48,7 +83,17 @@ describe('SettingsProvidersHeader create menu', () => {
     });
 
     it('shows a placeholder, not an empty menu, when no type is enabled', async () => {
-        state.enabled = Object.fromEntries(ALL_TYPES.map((type) => [type, false]));
+        queryResult.current = {
+            data: {
+                settingsProviders: {
+                    ...makeData([]).settingsProviders,
+                    enabled: Object.fromEntries(ALL_TYPES.map((type) => [type, false])),
+                },
+            },
+            error: undefined,
+            loading: false,
+            refetch: () => {},
+        };
         const user = userEvent.setup();
         render(<SettingsProvidersHeader />);
 
@@ -58,3 +103,31 @@ describe('SettingsProvidersHeader create menu', () => {
         expect(screen.queryByRole('menuitem', { name: /OpenAI/ })).not.toBeInTheDocument();
     });
 });
+
+describe('SettingsProviders list load states', () => {
+    const seeded = [
+        {
+            agents: {},
+            createdAt: '2026-01-15T00:00:00Z',
+            id: '1',
+            name: 'Seeded Provider',
+            type: ProviderType.Custom,
+            updatedAt: '2026-01-15T00:00:00Z',
+        },
+    ];
+
+    // cache-and-network flips loading true with cached rows still present; the table must survive
+    // it rather than flip to the full-page spinner.
+    it('keeps the populated table on a background refetch instead of flashing the loader', () => {
+        queryResult.current = { data: makeData(seeded), error: undefined, loading: true, refetch: () => {} };
+
+        render(
+            <MemoryRouter>
+                <SettingsProviders />
+            </MemoryRouter>,
+        );
+
+        expect(screen.getByText('Seeded Provider')).toBeInTheDocument();
+        expect(screen.queryByText('Loading providers...')).not.toBeInTheDocument();
+    });
+});
diff --git a/frontend/src/pages/settings/settings-providers.tsx b/frontend/src/pages/settings/settings-providers.tsx
index cfd8766e..fe0c9181 100644
--- a/frontend/src/pages/settings/settings-providers.tsx
+++ b/frontend/src/pages/settings/settings-providers.tsx
@@ -404,7 +404,7 @@ function SettingsProviders() {
         </AppHeader>
     );
 
-    if (isLoading) {
+    if (isLoading && !data) {
         return (
             <>
                 {pageHeader}
diff --git a/frontend/src/pages/templates/template.tsx b/frontend/src/pages/templates/template.tsx
index 5f87e393..e1e5f441 100644
--- a/frontend/src/pages/templates/template.tsx
+++ b/frontend/src/pages/templates/template.tsx
@@ -15,6 +15,7 @@ import {
     DetailNavigationToolbar,
 } from '@/components/shared/detail-navigation';
 import { DetailSplitLayout } from '@/components/shared/detail-split-layout';
+import { ErrorState } from '@/components/shared/error-state';
 import { InlineEditInput, useInlineEdit } from '@/components/shared/inline-edit';
 import { type EditorViewMode, EditorViewModeToggle, MarkdownEditorField } from '@/components/shared/markdown-editor';
 import { UnsavedChangesDialog, useUnsavedChangesGuard } from '@/components/shared/unsaved-changes';
@@ -39,6 +40,7 @@ import { useTemplateDetailNavigation } from '@/features/templates/use-template-d
 import { FlowTemplateDocument } from '@/graphql/types';
 import { useAppForm } from '@/hooks/use-app-form';
 import { useBreakpoint } from '@/hooks/use-breakpoint';
+import { isNotFoundError } from '@/lib/errors';
 import { routes } from '@/lib/routes';
 import { cn } from '@/lib/utils';
 import { type Template, useTemplates } from '@/providers/templates-provider';
@@ -233,9 +235,23 @@ const renderTemplateItem = (item: Template, isCurrent: boolean): ReactNode => (
     <span className={cn('min-w-0 flex-1 truncate', isCurrent && 'font-medium')}>{item.title}</span>
 );
 
+// One React element serves every `/templates/:templateId`, so without a key the form instance — which sets
+// `keepDirtyValues` so a subscription resync cannot wipe an unsaved body — carried one template's edited text
+// onto the next template and Save wrote it to the wrong row. Keying by id gives each entity its own form, the
+// way knowledge.tsx already keys <KnowledgeForm>. It also stops `/templates/new` inheriting an abandoned draft.
 function Template() {
-    const navigate = useNavigate();
     const { templateId } = useParams<{ templateId?: string }>();
+
+    return (
+        <TemplateForm
+            key={templateId ?? 'new'}
+            templateId={templateId}
+        />
+    );
+}
+
+function TemplateForm({ templateId }: { templateId?: string }) {
+    const navigate = useNavigate();
     const { createTemplate, deleteTemplate, updateTemplate } = useTemplates();
 
     const { isDesktop, isMobile } = useBreakpoint();
@@ -261,10 +277,17 @@ function Template() {
         stopEdit: handleTemplateRenameCancel,
     } = useInlineEdit({ resetKey: templateId });
 
-    const { data: templateData, loading: isLoadingTemplate } = useQuery(
-        FlowTemplateDocument,
-        templateId && !isNew ? { variables: { templateId } } : skipToken,
-    );
+    const {
+        data: templateData,
+        error: templateError,
+        loading: isLoadingTemplate,
+        refetch: refetchTemplate,
+    } = useQuery(FlowTemplateDocument, templateId && !isNew ? { variables: { templateId } } : skipToken);
+
+    const template = templateData?.flowTemplate;
+    // A real load failure that left nothing to show, as opposed to a genuine not-found: the page
+    // renders it as an in-page ErrorState + Retry instead of the "not found" card. Mirrors flow.
+    const templateLoadError = templateError && !template && !isNotFoundError(templateError) ? templateError : undefined;
 
     // `values` re-syncs the form whenever the cache refreshes (an inline rename, a refetch), while
     // `keepDirtyValues` preserves the user's in-flight edits — without it an external re-emit would
@@ -345,7 +368,9 @@ function Template() {
                     await createTemplate(values.title, values.text);
                 } else if (templateId) {
                     await updateTemplate(templateId, { text: values.text, title: values.title });
-                    reset(values, { keepDefaultValues: false });
+                    // See knowledge-form.tsx: the form-level `resetOptions` are merged into every manual
+                    // reset, so a post-save reset inherits `keepDirtyValues` unless it opts out.
+                    reset(values, { keepDefaultValues: false, keepDirtyValues: false });
                 }
 
                 return true;
@@ -413,7 +438,7 @@ function Template() {
     }, [pendingPreset, setValue]);
 
     const hasTemplate = !!templateData?.flowTemplate;
-    const isTemplatePending = !isNew && (isLoadingTemplate || !hasTemplate);
+    const isTemplatePending = !isNew && !hasTemplate;
     const isTemplateMissing = !isNew && !isLoadingTemplate && !hasTemplate;
 
     const pageHeader = (
@@ -456,14 +481,6 @@ function Template() {
                 </AppHeaderContent>
                 {!isTemplateMissing && (
                     <AppHeaderActions>
-                        <AppHeaderAction
-                            disabled={isTemplatePending || (!isNew && !hasUnsavedChanges)}
-                            form="template-form"
-                            icon={<Save />}
-                            label={isNew ? 'Create' : 'Save'}
-                            loading={isSaving}
-                            type="submit"
-                        />
                         {!isNew && !isMobile && (
                             <DetailNavigationToolbar<Template>
                                 controller={templateNav}
@@ -472,6 +489,14 @@ function Template() {
                                 sheetTitle="Templates"
                             />
                         )}
+                        <AppHeaderAction
+                            disabled={isTemplatePending || (!isNew && !hasUnsavedChanges)}
+                            form="template-form"
+                            icon={<Save />}
+                            label={isNew ? 'Create' : 'Save'}
+                            loading={isSaving}
+                            type="submit"
+                        />
                         <DropdownMenu>
                             <DropdownMenuTrigger asChild>
                                 <Button
@@ -725,7 +750,7 @@ function Template() {
         />
     );
 
-    if (!isNew && isLoadingTemplate) {
+    if (!isNew && isLoadingTemplate && !template) {
         return (
             <div className={isDesktop ? 'flex h-[100dvh] min-h-0 flex-col' : 'flex min-h-[100dvh] flex-col'}>
                 {pageHeader}
@@ -736,7 +761,22 @@ function Template() {
         );
     }
 
-    if (!isNew && !isLoadingTemplate && !templateData?.flowTemplate) {
+    if (templateLoadError) {
+        return (
+            <div className={isDesktop ? 'flex h-[100dvh] min-h-0 flex-col' : 'flex min-h-[100dvh] flex-col'}>
+                {pageHeader}
+                <div className="flex flex-1 flex-col gap-4 p-4">
+                    <ErrorState
+                        message={templateLoadError.message}
+                        onRetry={() => refetchTemplate()}
+                        title="Error loading template"
+                    />
+                </div>
+            </div>
+        );
+    }
+
+    if (!isNew && !isLoadingTemplate && !template) {
         return (
             <div className={isDesktop ? 'flex h-[100dvh] min-h-0 flex-col' : 'flex min-h-[100dvh] flex-col'}>
                 {pageHeader}
diff --git a/frontend/src/providers/flow-provider.test.ts b/frontend/src/providers/flow-provider.test.ts
new file mode 100644
index 00000000..7651a728
--- /dev/null
+++ b/frontend/src/providers/flow-provider.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest';
+
+import { deriveFlowMissing } from './flow-provider';
+
+const flow = { flow: { id: '1' } };
+const notFound = new Error('flow not found');
+const partialNotFound = new Error('assistant not found'); // a nested resolver under errorPolicy:'all'
+
+describe('deriveFlowMissing', () => {
+    it('is true when the query settled with the flow genuinely absent', () => {
+        expect(deriveFlowMissing({ flow: null }, undefined)).toBe(true);
+    });
+
+    it('is true on a not-found error with no flow loaded', () => {
+        expect(deriveFlowMissing(undefined, notFound)).toBe(true);
+    });
+
+    // Reverting the `!flowData?.flow` gate turns this red — it is the regression guard.
+    it('is false when a not-found error rides alongside a loaded flow', () => {
+        expect(deriveFlowMissing(flow, partialNotFound)).toBe(false);
+    });
+
+    it('is false on a real load failure (kept behind Retry, not redirected)', () => {
+        expect(deriveFlowMissing(undefined, new Error('network error'))).toBe(false);
+    });
+
+    it('is false while loading (no data, no error yet)', () => {
+        expect(deriveFlowMissing(undefined, undefined)).toBe(false);
+    });
+});
diff --git a/frontend/src/providers/flow-provider.tsx b/frontend/src/providers/flow-provider.tsx
index badfa5ae..113db421 100644
--- a/frontend/src/providers/flow-provider.tsx
+++ b/frontend/src/providers/flow-provider.tsx
@@ -34,9 +34,19 @@ import {
     TerminalLogAddedDocument,
     VectorStoreLogAddedDocument,
 } from '@/graphql/types';
+import { isNotFoundError } from '@/lib/errors';
 import { Log } from '@/lib/log';
 
-const isFlowNotFoundError = (error: Error) => /no rows in result set|not found/i.test(error.message);
+/**
+ * Under `errorPolicy:'all'` a partial not-found error surfaces alongside a flow that loaded fine, so
+ * the not-found disjunct gates on `!flowData?.flow`. Without the gate that partial error redirects
+ * the user off a flow that rendered correctly.
+ */
+export const deriveFlowMissing = (
+    flowData: null | undefined | { flow: unknown },
+    flowError: undefined | { message: string },
+): boolean =>
+    Boolean(flowData && !flowData.flow) || Boolean(flowError && !flowData?.flow && isNotFoundError(flowError));
 
 interface FlowContextValue {
     assistantLogs: Array<AssistantLogFragmentFragment>;
@@ -92,9 +102,9 @@ export function FlowProvider({ children }: FlowProviderProps) {
     // A real load failure that left nothing to show (cold cache + backend error on a
     // deep link), as opposed to a genuine not-found. The detail page renders this as an
     // in-page ErrorState + Retry instead of silently bouncing to the list.
-    const flowLoadError = flowError && !flowData?.flow && !isFlowNotFoundError(flowError) ? flowError : undefined;
+    const flowLoadError = flowError && !flowData?.flow && !isNotFoundError(flowError) ? flowError : undefined;
 
-    const isFlowMissing = Boolean(flowData && !flowData.flow) || Boolean(flowError && isFlowNotFoundError(flowError));
+    const isFlowMissing = deriveFlowMissing(flowData, flowError);
 
     const { data: assistantsData, loading: isAssistantsLoading } = useQuery(AssistantsDocument, {
         fetchPolicy: 'cache-first',
@@ -196,7 +206,7 @@ export function FlowProvider({ children }: FlowProviderProps) {
             return;
         }
 
-        if (isFlowNotFoundError(flowError)) {
+        if (isNotFoundError(flowError)) {
             toast.error('Flow not found', { id: 'flow-load-error' });
         }
 
diff --git a/frontend/src/styles/index.css b/frontend/src/styles/index.css
index 18d214ae..e0716cea 100644
--- a/frontend/src/styles/index.css
+++ b/frontend/src/styles/index.css
@@ -166,6 +166,7 @@
     --color-popover-foreground: var(--popover-foreground);
     --color-primary: var(--primary);
     --color-primary-foreground: var(--primary-foreground);
+    --color-link: var(--link);
     --color-secondary: var(--secondary);
     --color-secondary-foreground: var(--secondary-foreground);
     --color-muted: var(--muted);
@@ -306,6 +307,9 @@
         --sidebar-accent-foreground: oklch(0.32 0 0);
         --sidebar-border: oklch(0.93 0.01 240);
         --sidebar-ring: oklch(0.25 0.14 245);
+        /* Link TEXT. --primary is a fill (paired with white --primary-foreground) and cannot double as
+           text: on dark it measures 3.12:1 on --card, and no lightness clears AA in both roles at once. */
+        --link: oklch(0.25 0.14 245);
         /* Editor highlight TEXT, tuned for readable contrast on the editor surface (unlike --primary, a fill
            color that fails WCAG AA as text on dark). Four distinct hues so adjacent tokens don't blur:
            link = theme blue 245; variable = green 155 (matches the panel's "used" badge); tag = violet 300;
@@ -316,6 +320,17 @@
         --editor-tag: oklch(0.25 0.12 300);
         --editor-code: oklch(0.5 0.16 25);
         --editor-code-bg: oklch(0.94 0.006 245);
+        /* Stock atom-one-light is NOT usable as-is: on this surface it fails AA on 6 of its 8 token colours.
+           These hold its hues and chroma but lower lightness until each clears it. */
+        --editor-syntax-fg: oklch(0.35 0.014 274.5);
+        --editor-syntax-comment: oklch(0.52 0.009 278.6);
+        --editor-syntax-keyword: oklch(0.524 0.211 328.8);
+        --editor-syntax-entity: oklch(0.539 0.179 28.3);
+        --editor-syntax-literal: oklch(0.511 0.126 236.7);
+        --editor-syntax-string: oklch(0.503 0.142 143.5);
+        --editor-syntax-attr: oklch(0.524 0.116 76.9);
+        --editor-syntax-symbol: oklch(0.527 0.193 263.2);
+        --editor-syntax-class: oklch(0.523 0.138 76.2);
         --font-sans: Inter, 'Inter Fallback', sans-serif;
         --font-serif: Inter, 'Inter Fallback', serif;
         --font-mono: 'Roboto Mono', monospace;
@@ -371,11 +386,23 @@
         --sidebar-accent-foreground: oklch(0.92 0.02 245);
         --sidebar-border: oklch(0.3 0.04 245);
         --sidebar-ring: oklch(0.5 0.16 245);
+        --link: oklch(0.68 0.13 245);
         --editor-accent: oklch(0.68 0.13 245);
         --editor-variable: oklch(0.72 0.12 155);
         --editor-tag: oklch(0.68 0.13 300);
         --editor-code: oklch(0.7 0.15 25);
         --editor-code-bg: oklch(0.27 0.03 245);
+        /* atom-one-dark's hues, which already clear AA here — except comment and entity, tuned because
+           stock measures 2.49 and 4.70. */
+        --editor-syntax-fg: oklch(0.762 0.02 263);
+        --editor-syntax-comment: oklch(0.688 0.019 261.3);
+        --editor-syntax-keyword: oklch(0.694 0.164 318.2);
+        --editor-syntax-entity: oklch(0.694 0.131 16.3);
+        --editor-syntax-literal: oklch(0.723 0.092 206.3);
+        --editor-syntax-string: oklch(0.768 0.11 133);
+        --editor-syntax-attr: oklch(0.727 0.095 63.8);
+        --editor-syntax-symbol: oklch(0.728 0.121 245.6);
+        --editor-syntax-class: oklch(0.826 0.097 81.6);
         --font-sans: Inter, 'Inter Fallback', sans-serif;
         --font-serif: Inter, 'Inter Fallback', serif;
         --font-mono: 'Roboto Mono', monospace;
@@ -563,13 +590,19 @@
 .prose pre code.hljs {
     color: inherit;
     background: transparent;
-}
-
-.prose pre code.hljs {
     padding: 0;
     overflow: visible;
 }
 
+/* Without these the viewer falls back to Tailwind Typography's own pre colours, which are dark in BOTH
+   themes (gray-800 light / `rgb(0 0 0 / 50%)` dark) and are plugin internals, not project tokens. */
+.prose {
+    --tw-prose-pre-bg: var(--editor-code-bg);
+    --tw-prose-pre-code: var(--editor-syntax-fg);
+    --tw-prose-invert-pre-bg: var(--editor-code-bg);
+    --tw-prose-invert-pre-code: var(--editor-syntax-fg);
+}
+
 /* Sonner */
 [data-sonner-toast][data-styled='true'] {
     gap: 8px !important;
@@ -634,7 +667,6 @@
     font-size: 0.875em;
 }
 
-/* No background/colour here — the .hljs highlight.js theme (imported in markdown-editor.tsx) supplies them. */
 .tiptap-content .ProseMirror pre {
     position: relative;
     padding: 0.75rem 1rem;
@@ -642,16 +674,27 @@
     overflow-x: auto;
 }
 
+.tiptap-content .ProseMirror pre,
+.prose pre {
+    background: var(--editor-code-bg);
+    color: var(--editor-syntax-fg);
+}
+
+.dark .tiptap-content .ProseMirror pre {
+    --editor-variable: oklch(0.76 0.12 155);
+    --editor-tag: oklch(0.76 0.13 300);
+}
+
 /* data-language is a DOM-only attribute (stamped by renderHTML); it never enters the serialized markdown. */
 .tiptap-content .ProseMirror pre[data-language]::before {
     content: attr(data-language);
     display: block;
     margin: -0.75rem -1rem 0.75rem;
     padding: 0.25rem 1rem;
-    border-bottom: 1px solid oklch(1 0 0 / 0.1);
+    border-bottom: 1px solid color-mix(in oklab, var(--editor-syntax-fg) 14%, transparent);
     border-radius: calc(var(--radius) - 2px) calc(var(--radius) - 2px) 0 0;
-    background-color: oklch(1 0 0 / 0.05);
-    color: oklch(1 0 0 / 0.55);
+    background-color: color-mix(in oklab, var(--editor-syntax-fg) 7%, transparent);
+    color: color-mix(in oklab, var(--editor-syntax-fg) 85%, transparent);
     font-family: var(--font-mono);
     font-size: 0.7rem;
     letter-spacing: 0.05em;
@@ -664,6 +707,74 @@
     font-size: 0.875em;
 }
 
+/* Do not go back to importing a highlight.js stylesheet: a side-effect CSS import cannot be scoped to a
+   theme, so the fence could not follow light/dark at all. Groups mirror atom-one's. */
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-comment,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-quote {
+    color: var(--editor-syntax-comment);
+    font-style: italic;
+}
+
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-doctag,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-keyword,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-formula {
+    color: var(--editor-syntax-keyword);
+}
+
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-section,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-name,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-selector-tag,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-deletion,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-subst {
+    color: var(--editor-syntax-entity);
+}
+
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-literal {
+    color: var(--editor-syntax-literal);
+}
+
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-string,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-regexp,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-addition,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-attribute,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-meta .hljs-string {
+    color: var(--editor-syntax-string);
+}
+
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-attr,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-variable,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-template-variable,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-type,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-selector-class,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-selector-attr,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-selector-pseudo,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-number {
+    color: var(--editor-syntax-attr);
+}
+
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-symbol,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-bullet,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-link,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-meta,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-selector-id,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-title {
+    color: var(--editor-syntax-symbol);
+}
+
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-built_in,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-title.class_,
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-class .hljs-title {
+    color: var(--editor-syntax-class);
+}
+
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-emphasis {
+    font-style: italic;
+}
+
+:is(.tiptap-content .ProseMirror, .prose) pre .hljs-strong {
+    font-weight: 700;
+}
+
 .tiptap-content .ProseMirror blockquote {
     border-left: 3px solid var(--border);
     padding-left: 1rem;
@@ -764,8 +875,24 @@
     border-radius: calc(var(--radius) - 4px);
 }
 
-.tiptap-content .ProseMirror img.ProseMirror-selectednode {
+/* Every selectable node, not just images: a NodeSelection on an `hr` had no visual at all, and since
+   `.ProseMirror-hideselection` blanks the native highlight at the same time, the next keystroke replaced a
+   node the user could not see was selected. prosemirror-view ships an outline rule for this, but its
+   stylesheet is imported nowhere and tiptap's injected CSS carries no equivalent. */
+.tiptap-content .ProseMirror .ProseMirror-selectednode {
     outline: 2px solid var(--primary);
+    outline-offset: 2px;
+}
+
+.tiptap-content .ProseMirror img.ProseMirror-selectednode {
+    outline-offset: 0;
+}
+
+/* tiptap injects `border-top: 1px solid black` for the gap cursor, so on the dark theme the caret you get
+   between two block nodes (pressing left/up at the start of a leading table or fence) is a black line on a
+   near-black background — a caret position with no visible caret. */
+.tiptap-content .ProseMirror-gapcursor::after {
+    border-top-color: var(--foreground);
 }
 
 /* `{{ ... }}` Go-template actions, highlighted via view-only decorations (document bytes untouched). */